PDA

View Full Version : Blue Screen of Death



savanna
2015-02-19, 19:06
I was getting the Blue Screen Of Death that described a problem with the display driver. After reboot I would get it again after 20-30 minutes. I updated the driver, but that didn't help. I ran Spybot and Eset and then found a "Fix-It-For_You" on the Microsoft site and ran that. It seems to have helped, but now I'm getting two error messages after boot up (see attached GIF files). I'm not sure if the missing files are needed, or whether they are part of a virus or malware. Please help me make sure that my machine is clean. Thanx in advance.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-02-2015 01
Ran by Bob (administrator) on XPS8500 on 19-02-2015 08:31:53
Running from C:\Users\Bob\Desktop
Loaded Profiles: Bob & Mcx1-XPS8500 (Available profiles: Bob & Mcx1-XPS8500)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgcsrva.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Cisco WebEx LLC) C:\Windows\SysWOW64\atashost.exe
(Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AdminService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe
(CHENGDU YIWO Tech Development Co., Ltd) C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
(CHENGDU YIWO Tech Development Co., Ltd) C:\Program Files (x86)\EaseUS\Todo Backup\bin\GuardAgent.exe
(Tanuki Software, Ltd.) C:\Program Files\i2p\I2Psvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\ramaint.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(IObit) C:\Program Files (x86)\IObit\Smart Defrag 3\SmartDefrag.exe
() C:\SiteVaultPro\SvPro.exe
(Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AthBtTray.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(SlySoft, Inc.) C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe
(PeerBlock, LLC) C:\Program Files\PeerBlock\peerblock.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Alcor Micro Corp.) C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe
(SlySoft, Inc.) C:\Program Files (x86)\SlySoft\CloneCD\CloneCDTray.exe
(CHENGDU YIWO Tech Development Co., Ltd) C:\Program Files (x86)\EaseUS\Todo Backup\bin\EuWatch.exe
(CHENGDU YIWO Tech Development Co., Ltd) C:\Program Files (x86)\EaseUS\Todo Backup\bin\TrayNotify.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(BonSoft) C:\Program Files (x86)\ClocX\ClocX.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\AVG SafeGuard toolbar\vprot.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe
() C:\Program Files (x86)\SlySoft\AnyDVD\ADvdDiscHlp64.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
() C:\Users\Bob\AppData\Local\TVersity\Media Server\MediaServer.exe
(Oracle Corporation) C:\Windows\System32\java.exe
(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Atheros) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\Ath_CoexAgent.exe
(Atheros) C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe
() C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\loggingserver.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\vds.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_x64.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Dell Inc.) C:\Program Files\Dell\DellDataVault\DellDataVaultWiz.exe
(Dell Products, LP.) C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Dell, Inc.) C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Dell, Inc.) C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe
(CHENGDU YIWO Tech Development Co., Ltd) C:\Program Files (x86)\EaseUS\Todo Backup\bin\Loader.exe
(CHENGDU YIWO Tech Development Co., Ltd) C:\Program Files (x86)\EaseUS\Todo Backup\bin\TBConsoleUI.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(CHENGDU YIWO Tech Development Co., Ltd) C:\Program Files (x86)\EaseUS\Todo Backup\bin\TbService.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe [1014432 2011-12-29] (Atheros Commnucations)
HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AthBtTray.exe [800416 2011-12-29] (Atheros Commnucations)
HKLM\...\Run: [LogMeIn GUI] => C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe [57928 2012-04-02] (LogMeIn, Inc.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6457960 2011-12-23] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1156712 2011-11-15] (Realtek Semiconductor)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-17] (Intel Corporation)
HKLM-x32\...\Run: [ShwiconXP9106] => C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe [237568 2010-03-10] (Alcor Micro Corp.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40336 2014-12-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [CloneCDTray] => C:\Program Files (x86)\SlySoft\CloneCD\CloneCDTray.exe [57344 2009-01-29] (SlySoft, Inc.)
HKLM-x32\...\Run: [StartCCC] => "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
HKLM-x32\...\Run: [EaseUs Watch] => C:\Program Files (x86)\EaseUS\Todo Backup\bin\EuWatch.exe [70728 2012-10-19] (CHENGDU YIWO Tech Development Co., Ltd)
HKLM-x32\...\Run: [EaseUs Tray] => C:\Program Files (x86)\EaseUS\Todo Backup\bin\TrayNotify.exe [1315400 2012-10-30] (CHENGDU YIWO Tech Development Co., Ltd)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [3825176 2012-11-13] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [SMessaging] => C:\Users\Bob\AppData\Local\Strongvault Online Backup\SMessaging.exe
HKLM-x32\...\Run: [ClocX] => C:\Program Files (x86)\ClocX\ClocX.exe [2090496 2013-01-14] (BonSoft)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3674576 2015-01-06] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM-x32\...\Run: [vProt] => C:\Program Files (x86)\AVG SafeGuard toolbar\vprot.exe [2640408 2014-10-28] ()
HKLM-x32\...\RunOnce: [SpybotDeletingE5894] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDDelFile.exe [2710040 2012-11-13] (Safer-Networking Ltd.)
Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist\615\G2AWinLogon_x64.dll (Citrix Online, a division of Citrix Systems, Inc.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [AnyDVD] => C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVD.exe [109480 2014-10-01] (SlySoft, Inc.)
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3671872 2012-04-17] (DT Soft Ltd)
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [Uploader] => C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [Akamai NetSession Interface] => "C:\Users\Bob\AppData\Local\Akamai\netsession_win.exe"
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [3713032 2012-11-13] (Safer-Networking Ltd.)
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [BackupAgent] => C:\Program Files (x86)\Strongvault Online Backup\BackupAgent.exe
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [AVG-Secure-Search-Update_1113a] => C:\Users\Bob\AppData\Roaming\AVG 1113a Campaign\AVG-Secure-Search-Update-1113a.exe /PROMPT /mid=5ad4700098c147d094cad9a4fffc1f77-2ea2192f08b55d83378acdbfcabd2c8082d55b47 /CMPID=1113a
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [Startup Guard] => C:\Program Files (x86)\AceLogix\StartupGuard\sg.exe
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [Ogcics] => C:\Windows\SysWOW64\regsvr32.exe C:\Users\Bob\AppData\Local\YkhxPack\webapprt-stub.dll
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [UTRmedia] => regsvr32.exe C:\Users\Bob\AppData\Local\UTRmedia\CNBJOP7i.DLL <===== ATTENTION
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [PeerBlock] => C:\Program Files\PeerBlock\peerblock.exe [2513992 2014-01-14] (PeerBlock, LLC)
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\RunOnce: [SpybotDeletingF6781] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDDelFile.exe [2710040 2012-11-13] (Safer-Networking Ltd.)
HKU\S-1-5-21-472848371-1800496413-3629884572-1006\...\Run: [AnyDVD] => C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe [8498088 2014-10-01] (SlySoft, Inc.)
HKU\S-1-5-21-472848371-1800496413-3629884572-1006\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3671872 2012-04-17] (DT Soft Ltd)
HKU\S-1-5-21-472848371-1800496413-3629884572-1006\...\Run: [DriverMax] => C:\Program Files (x86)\Innovative Solutions\DriverMax\drivermax.exe [9533848 2012-05-08] (Innovative Solutions)
HKU\S-1-5-21-472848371-1800496413-3629884572-1006\...\Run: [DriverMax_RESTART] => C:\Program Files (x86)\Innovative Solutions\DriverMax\drivermax.exe [9533848 2012-05-08] (Innovative Solutions)
HKU\S-1-5-21-472848371-1800496413-3629884572-1006\...\Run: [Uploader] => C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe
HKU\S-1-5-21-472848371-1800496413-3629884572-1006\...\Run: [Akamai NetSession Interface] => "C:\Users\Bob\AppData\Local\Akamai\netsession_win.exe"
HKU\S-1-5-21-472848371-1800496413-3629884572-1006\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [3713032 2012-11-13] (Safer-Networking Ltd.)
HKU\S-1-5-21-472848371-1800496413-3629884572-1006\...\Run: [AVG-Secure-Search-Update_JUNE2013_TB] => "C:\Program Files (x86)\AVG Secure Search\AVG-Secure-Search-Update_JUNE2013_TB.exe" /PROMPT /CMPID=JUNE2013_TB
HKU\S-1-5-21-472848371-1800496413-3629884572-1006\...\Run: [AVG-Secure-Search-Update_JUNE2013_HP] => "C:\Program Files (x86)\AVG Secure Search\AVG-Secure-Search-Update_JUNE2013_HP.exe" /PROMPT /CMPID=JUNE2013_HP
HKU\S-1-5-21-472848371-1800496413-3629884572-1006\...\Winlogon: [Shell] C:\Windows\eHome\McrMgr.exe [343552 2009-07-13] (Microsoft Corporation) <==== ATTENTION
Startup: C:\Users\Bob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
ShortcutTarget: ERUNT AutoBackup.lnk -> C:\erunt\AUTOBACK.EXE ()
ShellIconOverlayIdentifiers: [0WinSecurityProvider] -> {F76FA5C2-3B6A-451E-8CA5-34C8D0AE0637} => C:\ProgramData\Microsoft\Security\Client\SecurityProvider.dll ()
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-472848371-1800496413-3629884572-1006\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM -> DefaultScope value is missing.
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {39181C36-2062-47D0-8E6A-A5AD85BFE5CE} URL = http://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDR&src=IE-SearchBox
SearchScopes: HKLM-x32 -> DefaultScope value is missing.
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {39181C36-2062-47D0-8E6A-A5AD85BFE5CE} URL = http://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDR&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-472848371-1800496413-3629884572-1000 -> DefaultScope {891988CF-5E9A-48B7-BF5A-AD0F69377215} URL = https://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=994519&p={searchTerms}
SearchScopes: HKU\S-1-5-21-472848371-1800496413-3629884572-1000 -> {284A85DF-5D3B-41C0-A726-2784FE1B9D46} URL = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=902615&p={searchTerms}
SearchScopes: HKU\S-1-5-21-472848371-1800496413-3629884572-1000 -> {39181C36-2062-47D0-8E6A-A5AD85BFE5CE} URL =
SearchScopes: HKU\S-1-5-21-472848371-1800496413-3629884572-1000 -> {891988CF-5E9A-48B7-BF5A-AD0F69377215} URL = https://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=994519&p={searchTerms}
SearchScopes: HKU\S-1-5-21-472848371-1800496413-3629884572-1000 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = https://mysearch.avg.com/search?cid={63C45555-47E9-4A3D-B05B-7C3DCCC03EC8}&mid=5ad4700098c147d094cad9a4fffc1f77-2ea2192f08b55d83378acdbfcabd2c8082d55b47&lang=en&ds=oc011&coid=avgtbdisoc&cmpid=&pr=sa&d=2014-10-28 05:54:49&v=18.1.9.799&pid=safeguard&sg=&sap=dsp&q={searchTerms}
SearchScopes: HKU\S-1-5-21-472848371-1800496413-3629884572-1006 -> DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://isearch.avg.com/search?cid={0F67486E-876F-42B2-8669-8CD5E637806A}&mid=5ad4700098c147d094cad9a4fffc1f77-2ea2192f08b55d83378acdbfcabd2c8082d55b47&lang=en&ds=AVG&pr=fr&d=2012-05-25 18:54:27&v=14.2.0.1&pid=avg&sg=&sap=dsp&q={searchTerms}
SearchScopes: HKU\S-1-5-21-472848371-1800496413-3629884572-1006 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://isearch.avg.com/search?cid={0F67486E-876F-42B2-8669-8CD5E637806A}&mid=5ad4700098c147d094cad9a4fffc1f77-2ea2192f08b55d83378acdbfcabd2c8082d55b47&lang=en&ds=AVG&pr=fr&d=2012-05-25 18:54:27&v=14.2.0.1&pid=avg&sg=&sap=dsp&q={searchTerms}
BHO: AVG Safe Search -> {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -> C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll No File
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HelperObject Class -> {00C6482D-C502-44C8-8409-FCE54AD9C208} -> C:\Program Files (x86)\TechSmith\SnagIt 7\SnagItBHO.dll No File
BHO-x32: Drop Pad Web Backup -> {25DA541F-6ACF-4052-A8AA-1D58284729C7} -> C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: AVG Safe Search -> {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -> C:\Program Files (x86)\AVG\AVG2012\avgssie.dll No File
BHO-x32: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files (x86)\TechSmith\SnagIt 7\SnagItIEAddin.dll No File
Toolbar: HKLM-x32 - AVG SafeGuard toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG SafeGuard toolbar\18.1.9.799\AVG SafeGuard toolbar_toolbar.dll (AVG Secure Search)
Toolbar: HKU\S-1-5-21-472848371-1800496413-3629884572-1006 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
DPF: HKLM-x32 {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} https://support.dell.com/systemprofiler/SysProExe.CAB
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab
DPF: HKLM-x32 {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://tradestation.webex.com/client/T28L/support/ieatgpc1.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\18.1.9\ViProtocol.dll (AVG Secure Search)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{2302EFEB-46FF-44DA-B395-050DF3CBC43E}: [NameServer] 8.8.8.8,8.8.8.8

FireFox:
========
FF ProfilePath: C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\tjg3rdx3.default
FF DefaultSearchEngine: Google
FF Homepage: hxxp://loadmovie.biz/
FF Keyword.URL:
FF NetworkProxy: "http", "127.0.0.1"
FF NetworkProxy: "http_port", 4444
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.31211.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1205146.dll (Adobe Systems, Inc.)
FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\18.1.9\\npsitesafety.dll No File
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.31211.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-472848371-1800496413-3629884572-1000: @citrixonline.com/appdetectorplugin -> C:\Users\Bob\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Bob\AppData\Roaming\mozilla\plugins\npatgpc.dll (Cisco WebEx LLC)
FF SearchPlugin: C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\tjg3rdx3.default\searchplugins\aol-search.xml
FF SearchPlugin: C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\tjg3rdx3.default\searchplugins\avg-secure-search.xml
FF SearchPlugin: C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\tjg3rdx3.default\searchplugins\yahoo_ff.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\avg-secure-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\safeguard-secure-search.xml
FF Extension: Ant Video Downloader - C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\tjg3rdx3.default\Extensions\anttoolbar@ant.com [2015-01-17]
FF Extension: AVG SafeGuard toolbar - C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\tjg3rdx3.default\Extensions\avg@toolbar [2014-10-29]
FF Extension: FoxyProxy Standard - C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\tjg3rdx3.default\Extensions\foxyproxy@eric.h.jung [2015-02-05]
FF Extension: Browsse2save - C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\tjg3rdx3.default\Extensions\gxweiay0@wdoeaewnf.co.uk [2013-04-03]
FF Extension: DownloadHelper - C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\tjg3rdx3.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-09-06]
FF Extension: Antmark extensions - C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\tjg3rdx3.default\Extensions\antmark@ant.com.xpi [2014-08-03]
FF Extension: DownThemAll! - C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\tjg3rdx3.default\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2013-03-18]

Chrome:
=======
CHR Profile: C:\Users\Bob\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Browsse2save) - C:\Users\Bob\AppData\Local\Google\Chrome\User Data\Default\Extensions\inhinkaiimjghmnangojdjhpnbbedbjg [2013-04-03]
CHR Extension: (Amazing Coupons) - C:\Users\Bob\AppData\Local\Google\Chrome\User Data\Default\Extensions\mjildcbkilmkddbbpbjljljdmmlfeppl [2013-03-15]
CHR HKLM-x32\...\Chrome\Extension: [hacjidbllfnlecmikihhjphlicpbepih] - No Path

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AtherosSvc; C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe [106144 2011-12-29] (Atheros Commnucations) [File not signed]
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3440080 2015-01-06] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [309232 2015-01-06] (AVG Technologies CZ, s.r.o.)
S2 DellDataVault; C:\Program Files\Dell\DellDataVault\DellDataVault.exe [2552528 2015-01-30] (Dell Inc.)
R2 DellDataVaultWiz; C:\Program Files\Dell\DellDataVault\DellDataVaultWiz.exe [201424 2015-01-30] (Dell Inc.)
R2 EaseUS Agent; C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe [69192 2012-10-30] (CHENGDU YIWO Tech Development Co., Ltd) [File not signed]
R2 Guard Agent; C:\Program Files (x86)\EaseUS\Todo Backup\bin\GuardAgent.exe [23624 2012-10-19] (CHENGDU YIWO Tech Development Co., Ltd) [File not signed]
R2 i2p; C:\Program Files\i2p\I2Psvc.exe [431104 2014-12-11] (Tanuki Software, Ltd.) [File not signed]
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128280 2012-01-21] ()
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [377704 2015-01-27] (LogMeIn, Inc.)
R2 LMIMaint; C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe [226152 2015-01-27] (LogMeIn, Inc.)
R2 LogMeIn; C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe [407424 2012-04-02] (LogMeIn, Inc.)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1103392 2012-11-13] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1369624 2012-11-13] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [168384 2012-11-13] (Safer-Networking Ltd.)
R2 SiteVaultPro; C:\SiteVaultPro\SvPro.exe [950032 2012-06-18] ()
S2 SupportAssistAgent; C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe [19288 2015-02-06] (Dell Inc.)
R2 TVersityMediaServer; C:\Users\Bob\AppData\Local\TVersity\Media Server\MediaServer.exe [880640 2010-07-12] () [File not signed]
R2 vToolbarUpdater18.1.9; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe [1820184 2014-10-28] (AVG Secure Search)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)
R2 ZAtheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\Ath_CoexAgent.exe [158880 2011-12-29] (Atheros) [File not signed]
R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe [76960 2011-12-26] (Atheros) [File not signed]
S2 vToolbarUpdater15.4.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [138664 2014-04-24] (SlySoft, Inc.)
R3 AnyDVD; C:\Windows\SysWOW64\Drivers\AnyDVD.sys [138664 2014-04-24] (SlySoft, Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [260888 2014-12-08] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [203544 2014-11-18] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [243480 2014-08-28] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [313624 2014-07-18] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [124184 2014-10-05] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [274200 2014-10-10] (AVG Technologies CZ, s.r.o.)
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [50976 2014-10-28] (AVG Technologies)
R3 DDDriver; C:\Windows\System32\drivers\DDDriver64Dcsa.sys [23760 2015-01-30] (Dell Computer Corporation)
R3 DellProf; C:\Windows\System32\drivers\DellProf.sys [23312 2015-01-30] (Dell Computer Corporation)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-05-26] (DT Soft Ltd)
R3 ElbyCDFL; C:\Windows\System32\Drivers\ElbyCDFL.sys [40648 2007-02-15] (SlySoft, Inc.)
R3 ElbyCDFL; C:\Windows\SysWOW64\Drivers\ElbyCDFL.sys [40648 2007-02-15] (SlySoft, Inc.)
R0 EUBAKUP; C:\Windows\System32\drivers\eubakup.sys [58952 2012-10-19] (CHENGDU YIWO Tech Development Co., Ltd) [File not signed]
R0 EUBKMON; C:\Windows\System32\drivers\EUBKMON.sys [48200 2012-10-19] () [File not signed]
R1 EUDSKACS; C:\Windows\system32\drivers\eudskacs.sys [18504 2012-10-19] (CHENGDU YIWO Tech Development Co., Ltd) [File not signed]
R1 EUFDDISK; C:\Windows\system32\drivers\EuFdDisk.sys [189000 2012-10-19] (CHENGDU YIWO Tech Development Co., Ltd) [File not signed]
R2 LMIInfo; C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [16056 2013-05-27] (LogMeIn, Inc.)
S4 LMIRfsClientNP; No ImagePath
R3 pbfilter; C:\Program Files\PeerBlock\pbfilter.sys [22600 2014-01-14] ()
S3 pmxdrv; C:\Windows\system32\drivers\pmxdrv.sys [31152 2012-12-14] ()
R0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [21184 2014-06-04] (IObit)
R3 TotRec8; C:\Windows\system32\drivers\TotRec8.sys [123120 2011-12-14] (High Criteria inc.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-19 08:31 - 2015-02-19 08:33 - 00032275 _____ () C:\Users\Bob\Desktop\FRST.txt
2015-02-19 08:30 - 2015-02-19 08:31 - 00000000 ____D () C:\FRST
2015-02-19 08:29 - 2015-02-19 08:29 - 02086912 _____ (Farbar) C:\Users\Bob\Desktop\FRST64.exe
2015-02-19 08:28 - 2015-02-19 08:28 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-XPS8500-Windows-7-Home-Premium-(64-bit).dat
2015-02-19 08:26 - 2015-02-19 08:26 - 00000000 ____D () C:\RegBackup
2015-02-19 08:25 - 2015-02-19 08:25 - 00002270 _____ () C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
2015-02-19 08:25 - 2015-02-19 08:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2015-02-19 08:25 - 2015-02-19 08:25 - 00000000 ____D () C:\Program Files (x86)\Tweaking.com
2015-02-19 08:24 - 2015-02-19 08:24 - 04804736 _____ () C:\Users\Bob\Desktop\tweaking.com_registry_backup_setup.exe
2015-02-19 08:13 - 2015-02-19 08:13 - 00000000 ___RD () C:\Users\Bob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2015-02-17 18:21 - 2015-02-17 18:21 - 00001771 _____ () C:\Users\Bob\Desktop\PeerBlock.lnk
2015-02-17 18:21 - 2015-02-17 18:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PeerBlock
2015-02-17 10:55 - 2015-01-08 21:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll
2015-02-17 10:55 - 2015-01-08 21:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll
2015-02-17 10:55 - 2015-01-08 21:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll
2015-02-17 10:55 - 2015-01-08 20:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll
2015-02-17 09:38 - 2015-02-17 09:38 - 00000000 ____D () C:\Program Files (x86)\AMD APP
2015-02-17 09:36 - 2015-02-17 09:36 - 226727176 _____ (Dell Inc.) C:\Users\Bob\Desktop\Video_Driver_PCWM7_WN_8.982.12-MUP2.3_A00.EXE
2015-02-17 09:36 - 2015-02-17 09:36 - 00000000 ____D () C:\Users\Bob\AppData\Local\Dell
2015-02-17 08:11 - 2015-02-19 08:12 - 00002072 _____ () C:\Windows\setupact.log
2015-02-17 08:11 - 2015-02-17 08:11 - 00374552 _____ () C:\Windows\Minidump\021715-64865-01.dmp
2015-02-16 19:22 - 2015-02-16 19:23 - 01047584 _____ () C:\Windows\Minidump\021615-34055-01.dmp
2015-02-16 18:51 - 2015-02-17 19:34 - 00000000 ____D () C:\Users\Bob\AppData\Local\YkhxPack
2015-02-16 18:51 - 2015-02-17 19:34 - 00000000 ____D () C:\Users\Bob\AppData\Local\UTRmedia
2015-02-16 18:51 - 2015-02-16 18:51 - 13762592 _____ (Media Player - Codec Pack) C:\Users\Bob\Desktop\media.player.codec.pack.lite.v4.3.5.setup.exe
2015-02-15 04:46 - 2015-02-15 04:46 - 00374184 _____ () C:\Windows\Minidump\021515-44881-01.dmp
2015-02-12 12:38 - 2015-02-12 20:58 - 00000426 _____ () C:\Windows\Tasks\Dell SupportAssistAgent AutoUpdate.job
2015-02-12 12:38 - 2015-02-12 12:38 - 00003224 _____ () C:\Windows\System32\Tasks\Dell SupportAssistAgent AutoUpdate
2015-02-12 12:38 - 2015-02-12 12:38 - 00000000 __HDC () C:\ProgramData\{7417E72F-E156-403E-9DFA-EB0ED1DB06F1}
2015-02-12 12:36 - 2015-02-12 20:58 - 00000000 ____D () C:\ProgramData\SupportAssistAgent
2015-02-12 12:17 - 2015-01-22 22:42 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-02-12 12:17 - 2015-01-22 22:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-12 12:17 - 2015-01-22 21:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-02-12 12:17 - 2015-01-22 21:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-02-11 09:07 - 2015-02-18 12:27 - 00003484 _____ () C:\Windows\System32\Tasks\PCDEventLauncherTask
2015-02-11 09:07 - 2015-02-11 09:07 - 00004024 _____ () C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask
2015-02-11 09:07 - 2015-02-11 09:07 - 00003212 _____ () C:\Windows\System32\Tasks\SystemToolsDailyTest
2015-02-11 09:07 - 2015-02-11 09:07 - 00000000 ____D () C:\ProgramData\PC-Doctor for Windows
2015-02-11 09:07 - 2015-02-11 09:07 - 00000000 ____D () C:\Program Files\Dell Support Center
2015-02-11 09:06 - 2015-02-12 12:38 - 00000000 ____D () C:\Program Files\Dell
2015-02-11 03:37 - 2015-01-14 00:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-11 03:37 - 2015-01-14 00:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-02-11 03:37 - 2015-01-14 00:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-02-11 03:37 - 2015-01-14 00:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-02-11 03:37 - 2015-01-13 23:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-02-11 03:37 - 2015-01-13 23:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-02-11 03:37 - 2015-01-13 23:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-02-11 03:37 - 2014-12-11 23:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-02-11 03:37 - 2014-12-11 23:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-02-11 03:37 - 2014-07-06 20:07 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-02-11 03:37 - 2014-07-06 20:06 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-02-11 03:37 - 2014-07-06 19:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-02-11 03:37 - 2014-07-06 19:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-02-11 03:36 - 2015-02-03 21:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-02-11 03:36 - 2015-02-03 21:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-02-11 03:36 - 2015-02-03 21:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-02-11 03:36 - 2015-02-03 21:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-02-11 03:36 - 2015-02-03 21:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-02-11 03:36 - 2015-02-03 21:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-02-11 03:36 - 2015-02-03 21:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-02-11 03:36 - 2015-01-27 17:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2015-02-11 03:36 - 2015-01-13 23:47 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-11 03:36 - 2015-01-13 23:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-02-11 03:36 - 2015-01-11 21:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-11 03:36 - 2015-01-11 21:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-02-11 03:36 - 2015-01-11 21:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-02-11 03:36 - 2015-01-11 20:49 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-02-11 03:36 - 2015-01-11 20:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-11 03:36 - 2015-01-11 20:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-11 03:36 - 2015-01-11 20:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-02-11 03:36 - 2015-01-11 20:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-02-11 03:36 - 2015-01-11 20:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-02-11 03:36 - 2015-01-11 20:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-02-11 03:36 - 2015-01-11 20:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-02-11 03:36 - 2015-01-11 20:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-02-11 03:36 - 2015-01-11 20:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-02-11 03:36 - 2015-01-11 20:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-02-11 03:36 - 2015-01-11 20:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-02-11 03:36 - 2015-01-11 20:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-02-11 03:36 - 2015-01-11 20:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-11 03:36 - 2015-01-11 20:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-02-11 03:36 - 2015-01-11 20:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-02-11 03:36 - 2015-01-11 20:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-02-11 03:36 - 2015-01-11 20:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-11 03:36 - 2015-01-11 20:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-02-11 03:36 - 2015-01-11 20:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-02-11 03:36 - 2015-01-11 20:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-02-11 03:36 - 2015-01-11 20:04 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-02-11 03:36 - 2015-01-11 20:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-02-11 03:36 - 2015-01-11 20:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-02-11 03:36 - 2015-01-11 19:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-02-11 03:36 - 2015-01-11 19:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-02-11 03:36 - 2015-01-11 19:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-02-11 03:36 - 2015-01-11 19:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-11 03:36 - 2015-01-11 19:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-11 03:36 - 2015-01-11 19:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-11 03:36 - 2015-01-11 19:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-02-11 03:36 - 2015-01-11 19:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-02-11 03:36 - 2015-01-11 19:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-11 03:36 - 2015-01-11 19:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-02-11 03:36 - 2015-01-11 19:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-02-11 03:36 - 2015-01-11 19:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-02-11 03:36 - 2015-01-11 19:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-02-11 03:36 - 2015-01-11 19:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-11 03:36 - 2015-01-11 19:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-02-11 03:36 - 2015-01-11 19:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-02-11 03:36 - 2015-01-11 19:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-02-11 03:36 - 2015-01-11 19:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-02-11 03:36 - 2015-01-11 19:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-11 03:36 - 2015-01-11 19:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-11 03:36 - 2015-01-11 19:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-02-11 03:36 - 2015-01-11 18:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-02-11 03:36 - 2015-01-11 18:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-02-11 03:26 - 2015-01-10 00:48 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-02-11 03:26 - 2015-01-10 00:48 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-02-11 03:26 - 2015-01-10 00:48 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-02-11 03:26 - 2015-01-10 00:48 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-02-11 03:26 - 2015-01-10 00:48 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-02-11 03:26 - 2015-01-10 00:48 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-02-11 03:26 - 2015-01-10 00:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-02-11 03:26 - 2015-01-10 00:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-02-11 03:26 - 2015-01-10 00:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-02-11 03:26 - 2015-01-10 00:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-02-11 03:26 - 2015-01-10 00:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-02-11 03:26 - 2015-01-10 00:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-02-11 03:26 - 2015-01-10 00:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-02-11 03:26 - 2015-01-10 00:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-02-11 03:11 - 2015-01-15 02:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-11 03:11 - 2015-01-15 02:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-02-11 03:11 - 2015-01-15 02:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-02-11 03:11 - 2015-01-15 02:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-02-11 03:11 - 2015-01-15 02:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-02-11 03:11 - 2015-01-15 02:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-02-11 03:11 - 2015-01-15 02:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-02-11 03:11 - 2015-01-15 02:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-02-11 03:11 - 2015-01-15 02:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-02-11 03:11 - 2015-01-15 02:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-02-11 03:11 - 2015-01-15 02:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-02-11 03:11 - 2015-01-15 01:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-02-11 03:11 - 2015-01-15 01:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-02-11 03:11 - 2015-01-15 01:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-02-11 03:11 - 2015-01-15 01:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-02-11 03:11 - 2015-01-15 01:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-02-11 03:11 - 2015-01-15 01:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-02-11 03:11 - 2015-01-14 22:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-11 02:25 - 2015-01-12 21:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-11 02:25 - 2015-01-12 20:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-02-11 01:16 - 2015-01-08 20:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-11 00:41 - 2014-11-25 21:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-11 00:41 - 2014-11-25 21:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-11 00:30 - 2014-12-07 21:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-11 00:30 - 2014-12-07 20:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-02-07 09:52 - 2015-02-19 08:14 - 00000000 ____D () C:\Program Files\PeerBlock
2015-01-30 16:36 - 2015-01-30 16:36 - 00023760 _____ (Dell Computer Corporation) C:\Windows\system32\Drivers\DDDriver64Dcsa.sys
2015-01-30 16:36 - 2015-01-30 16:36 - 00023312 _____ (Dell Computer Corporation) C:\Windows\system32\Drivers\DellProf.sys
2015-01-27 05:46 - 2015-01-27 05:46 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-19 08:27 - 2009-07-13 22:45 - 00028352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-19 08:27 - 2009-07-13 22:45 - 00028352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-19 08:24 - 2012-05-09 15:40 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-19 08:22 - 2014-12-11 18:25 - 00000000 ____D () C:\ProgramData\i2p
2015-02-19 08:21 - 2012-05-24 20:30 - 00000000 ___RD () C:\Junk
2015-02-19 08:21 - 2012-05-09 15:38 - 02011692 _____ () C:\Windows\WindowsUpdate.log
2015-02-19 08:20 - 2012-12-04 18:45 - 00467456 ___SH () C:\EUMONBMP.SYS
2015-02-19 08:16 - 2013-08-05 15:51 - 00000000 ____D () C:\ProgramData\boost_interprocess
2015-02-19 08:13 - 2014-01-23 07:46 - 00001039 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Client.lnk
2015-02-19 08:13 - 2014-01-23 07:46 - 00001023 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Control Panel.lnk
2015-02-19 08:13 - 2012-05-28 09:05 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-19 08:12 - 2013-06-08 06:25 - 00000350 _____ () C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job
2015-02-19 08:12 - 2013-06-03 12:46 - 00000350 _____ () C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job
2015-02-19 08:12 - 2012-05-09 15:53 - 00000828 _____ () C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
2015-02-19 08:12 - 2009-07-13 23:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-19 08:10 - 2012-06-02 18:08 - 00000000 ____D () C:\Users\Bob\AppData\Roaming\vlc
2015-02-19 07:39 - 2012-05-28 09:05 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-19 06:49 - 2012-08-22 06:03 - 00000000 ____D () C:\Jts
2015-02-19 06:03 - 2012-05-30 14:11 - 00000000 ____D () C:\Users\Bob\AppData\Local\CrashDumps
2015-02-19 05:46 - 2012-05-30 09:46 - 00000000 ____D () C:\ProgramData\LogMeIn
2015-02-18 21:18 - 2012-05-25 17:52 - 00000000 ____D () C:\ProgramData\MFAData
2015-02-18 17:34 - 2012-05-25 14:00 - 00000000 ____D () C:\Users\Bob\AppData\Roaming\FileZilla
2015-02-18 17:31 - 2012-07-13 17:04 - 00000000 ____D () C:\Omega
2015-02-18 17:17 - 2012-05-09 15:53 - 00000830 _____ () C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job
2015-02-18 17:15 - 2013-02-01 09:03 - 00000594 _____ () C:\Windows\Tasks\TradeStation Backup - Daily.job
2015-02-18 15:28 - 2012-05-24 20:13 - 00000000 ____D () C:\Program Files (x86)\Tradestation Archives
2015-02-18 15:28 - 2012-05-24 16:26 - 00001508 _____ () C:\Windows\DYNAZIP.LOG
2015-02-18 11:29 - 2012-05-25 06:21 - 00000000 ____D () C:\Movies
2015-02-18 06:01 - 2013-01-24 14:15 - 00000000 ____D () C:\Users\Bob\AppData\Roaming\HandBrake
2015-02-17 21:54 - 2014-06-08 08:48 - 00000000 ____D () C:\Users\Bob\AppData\Roaming\Azureus
2015-02-17 14:53 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\tracing
2015-02-17 08:32 - 2010-11-20 21:47 - 00471598 _____ () C:\Windows\PFRO.log
2015-02-17 08:11 - 2014-02-27 07:03 - 00000000 ____D () C:\Windows\Minidump
2015-02-17 07:36 - 2013-01-28 07:30 - 00000000 ____D () C:\Users\Mcx1-XPS8500
2015-02-17 07:34 - 2012-05-24 16:03 - 00000000 ____D () C:\Users\Bob
2015-02-17 07:16 - 2013-03-09 06:04 - 00000000 ____D () C:\Users\Bob\AppData\Roaming\IObit
2015-02-17 07:16 - 2012-05-09 16:20 - 00000000 ____D () C:\ProgramData\Atheros
2015-02-17 07:16 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\registration
2015-02-14 17:26 - 2012-05-29 11:05 - 00000000 ____D () C:\ADE
2015-02-14 09:27 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\rescache
2015-02-12 16:45 - 2014-06-08 08:49 - 00000000 ____D () C:\Users\Bob\AppData\Roaming\Browser Extensions
2015-02-12 12:36 - 2012-05-09 16:07 - 00000000 ____D () C:\Program Files (x86)\Dell
2015-02-12 09:01 - 2014-01-20 06:22 - 00001137 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 9.lnk
2015-02-12 09:01 - 2014-01-20 06:22 - 00001125 _____ () C:\Users\Public\Desktop\TeamViewer 9.lnk
2015-02-12 04:47 - 2014-12-10 06:01 - 00000000 ____D () C:\Windows\system32\appraiser
2015-02-12 04:47 - 2014-05-07 02:00 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-02-11 22:16 - 2013-07-16 20:27 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-11 22:12 - 2012-05-24 16:46 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-02-11 09:07 - 2012-05-09 15:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell
2015-02-11 09:06 - 2012-05-25 13:00 - 00000000 ____D () C:\ProgramData\PCDr
2015-02-11 03:22 - 2009-07-13 22:45 - 00292464 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-11 03:03 - 2013-09-28 10:32 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-08 21:30 - 2009-07-13 23:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2015-02-08 15:15 - 2009-07-13 22:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-02-05 17:34 - 2012-05-28 09:05 - 00003894 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-05 17:34 - 2012-05-28 09:05 - 00003642 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-05 12:24 - 2012-05-09 15:40 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-05 12:24 - 2012-05-09 15:40 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-05 12:24 - 2012-05-09 15:40 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-29 05:20 - 2012-05-25 13:19 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-27 19:54 - 2012-05-30 09:46 - 00000000 ____D () C:\Program Files (x86)\LogMeIn
2015-01-27 19:53 - 2012-05-30 09:46 - 00107392 _____ (LogMeIn, Inc.) C:\Windows\system32\LMIRfsClientNP.dll
2015-01-27 19:53 - 2012-05-30 09:46 - 00092520 _____ (LogMeIn, Inc.) C:\Windows\system32\LMIinit.dll
2015-01-27 19:53 - 2012-05-30 09:46 - 00035688 _____ (LogMeIn, Inc.) C:\Windows\system32\LMIport.dll
2015-01-26 05:20 - 2014-01-08 06:12 - 00000000 ____D () C:\Users\Bob\dwhelper
2015-01-24 05:45 - 2014-10-20 05:40 - 00001000 _____ () C:\Users\Public\Desktop\AVG 2015.lnk
2015-01-24 05:45 - 2014-03-31 07:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG

==================== Files in the root of some directories =======

2013-06-26 15:09 - 2013-07-30 05:10 - 0003715 _____ () C:\Program Files (x86)\Mozilla Firefoxavg-secure-search.xml
2012-11-14 13:52 - 2012-11-14 13:52 - 0000124 _____ () C:\Users\Bob\AppData\Roaming\-941824844
2012-05-24 20:23 - 2012-12-15 05:57 - 0000320 _____ () C:\Users\Bob\AppData\Roaming\SEC410057.trad
2013-02-24 10:05 - 2013-05-09 15:55 - 0009216 _____ () C:\Users\Bob\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-05-26 10:02 - 2014-02-17 18:30 - 0000083 ___SH () C:\ProgramData\.zreglib
2012-05-25 17:18 - 2012-05-25 17:18 - 0000113 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
2012-05-25 13:38 - 2012-05-25 13:38 - 0000115 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.64.bc

Some content of TEMP:
====================
C:\Users\Bob\AppData\Local\Temp\25hwbij0.dll
C:\Users\Bob\AppData\Local\Temp\2z5mwlh2.dll
C:\Users\Bob\AppData\Local\Temp\clean20.dll
C:\Users\Bob\AppData\Local\Temp\GACInstaller.dll
C:\Users\Bob\AppData\Local\Temp\handbrake-setup.exe
C:\Users\Bob\AppData\Local\Temp\instutil.dll
C:\Users\Bob\AppData\Local\Temp\oi_{425724E8-3C22-416E-BCF3-0BF7A288D70E}.exe
C:\Users\Bob\AppData\Local\Temp\ose00000.exe
C:\Users\Bob\AppData\Local\Temp\RegistASM.exe
C:\Users\Bob\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Bob\AppData\Local\Temp\TSInst10.exe
C:\Users\Bob\AppData\Local\Temp\TSInstallCAUtils.dll
C:\Users\Bob\AppData\Local\Temp\unrar.dll
C:\Users\Bob\AppData\Local\Temp\unrar.exe
C:\Users\Bob\AppData\Local\Temp\unzip.exe
C:\Users\Bob\AppData\Local\Temp\vlc-2.1.2-win32.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-14 09:19

==================== End Of Log ============================





Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-02-2015 01
Ran by Bob at 2015-02-19 08:34:03
Running from C:\Users\Bob\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {4D41356F-32AD-7C42-C820-63775EE4F413}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {F620D48B-1497-73CC-F290-58052563BEAE}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

.NET Reflector Desktop (HKLM-x32\...\{21C448B9-5137-49F3-B364-270E3C88124A}) (Version: 7.6.0.808 - Red Gate Software Ltd)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader X (10.1.13) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.5.146 - Adobe Systems, Inc.)
Amazon Kindle (HKLM-x32\...\Amazon Kindle) (Version: - Amazon)
AMD Catalyst Install Manager (HKLM\...\{A8BBDD74-6FF7-E9D1-4301-52C37371913D}) (Version: 8.0.881.0 - Advanced Micro Devices, Inc.)
Any Video Converter 3.3.9 (HKLM-x32\...\Any Video Converter_is1) (Version: - Any-Video-Converter.com)
AnyDVD (HKLM-x32\...\AnyDVD) (Version: 7.5.2.0 - SlySoft)
Atheros Bluetooth Suite (64) (HKLM\...\{230D1595-57DA-4933-8C4E-375797EBB7E1}) (Version: 7.4.0.115 - Atheros)
Audacity 2.0.2 (HKLM-x32\...\Audacity_is1) (Version: 2.0.2 - Audacity Team)
AVG 2015 (HKLM\...\AVG) (Version: 2015.0.5646 - AVG Technologies)
AVG 2015 (Version: 15.0.4284 - AVG Technologies) Hidden
AVG 2015 (Version: 15.0.5646 - AVG Technologies) Hidden
AVG SafeGuard toolbar (HKLM-x32\...\AVG SafeGuard toolbar) (Version: 18.1.9.799 - AVG Technologies)
Camtasia Studio 8 (HKLM-x32\...\{DB93E2C2-851F-44B2-B09C-351D2C624AE1}) (Version: 8.0.4.1060 - TechSmith Corporation)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Cisco WebEx Meetings (HKLM-x32\...\ActiveTouchMeetingClient) (Version: - Cisco WebEx LLC)
CliSecure 5.2 (HKLM-x32\...\{03CA4929-2B86-4159-A71D-437039B609D1}_is1) (Version: - SecureTeam Software Ltd.)
ClocX (1.6.0) (HKLM-x32\...\ClocX) (Version: - )
CloneCD (HKLM-x32\...\CloneCD) (Version: - SlySoft)
CloneDVD2 (HKLM-x32\...\CloneDVD2) (Version: 2.9.3.0 - Elaborate Bytes)
Consumer In-Home Service Agreement (HKLM-x32\...\{F47C37A4-7189-430A-B81D-739FF8A7A554}) (Version: 2.0.0 - Dell Inc.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.45.4.0315 - DT Soft Ltd)
Dell Data Vault (Version: 4.1.9.0 - Dell Inc.) Hidden
Dell DataSafe Local Backup - Support Software (HKLM-x32\...\{A9668246-FB70-4103-A1E3-66C9BC2EFB49}) (Version: 9.4.67 - Dell Inc.)
Dell DataSafe Local Backup (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 9.4.67 - Dell Inc.)
Dell DataSafe Online (HKLM-x32\...\{C53BCCBE-9268-4C09-82E9-611444A73B3F}) (Version: 2.10.1.3 - Dell)
Dell Digital Delivery (HKLM-x32\...\{BC8233D8-59BA-4D40-92B9-4FDE7452AA8B}) (Version: 3.0.3999.0 - Dell Products, LP)
Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)
Dell SupportAssist (HKLM\...\PC-Doctor for Windows) (Version: 1.0.6584.52 - Dell)
Dell SupportAssistAgent (HKLM-x32\...\{287348C8-8B47-4C36-AF28-441A3B7D8722}) (Version: 1.0.0.55844 - Dell)
Dell WLAN and Bluetooth Client Installation (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 9.0 - Dell Inc.)
DriverMax 6 (HKLM-x32\...\DMX5_is1) (Version: 6.31.0.325 - Innovative Solutions)
DVD Flick 1.3.0.7 (HKLM-x32\...\DVD Flick_is1) (Version: 1.3.0.7 - Dennis Meuwissen)
EaseUS Todo Backup Free 5.3 (HKLM-x32\...\EaseUS Todo Backup Free 5.3_is1) (Version: 5.3 - CHENGDU YIWO Tech Development Co., Ltd)
EPSON Printer Software (HKLM\...\EPSON Printer and Utilities) (Version: - SEIKO EPSON Corporation)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - )
ERUNT 1.1j (HKLM-x32\...\ERUNT_is1) (Version: - Lars Hederer)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
EVEREST Corporate Edition v5.50 (HKLM-x32\...\EVEREST Corporate Edition_is1) (Version: 5.50 - Lavalys, Inc.)
ffdshow v1.2.4499 [2013-01-04] (HKLM-x32\...\ffdshow_is1) (Version: 1.2.4499.0 - )
FileZilla Client 3.6.0.2 (HKLM-x32\...\FileZilla Client) (Version: 3.6.0.2 - FileZilla Project)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
GoToAssist Corporate (HKLM-x32\...\GoToAssist) (Version: 9.1.0.615 - Citrix Online, a division of Citrix Systems, Inc.)
GoToMeeting 5.4.0.1083 (HKU\S-1-5-21-472848371-1800496413-3629884572-1006\...\GoToMeeting) (Version: 5.4.0.1083 - CitrixOnline)
GoToMeeting 5.5.0.1133 (HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\GoToMeeting) (Version: 5.5.0.1133 - CitrixOnline)
HandBrake 0.9.8 (HKLM-x32\...\HandBrake) (Version: 0.9.8 - )
Hubert Senters Bond Breakout 1.2 (HKLM-x32\...\Hubert Senters Bond Breakout_is1) (Version: - Senters Group, LLC)
Hubert Senters Climactic Volume 1.0 (HKLM-x32\...\Hubert Senters Climactic Volume (for NT7)_is1) (Version: - hubertsenters.com)
Hubert Senters Climactic Volume 1.0 (HKLM-x32\...\Hubert Senters Climactic Volume_is1) (Version: - Senters Group, LLC)
Hubert Senters Climactic Volume 1.1 (HKLM-x32\...\Hubert Senters Climactic Volume for Sierra Charts_is1) (Version: - Senters Group, LLC)
Hubert Senters Climactic Volume for MultiCharts (HKLM-x32\...\Hubert Senters Climactic Volume (MultiCharts)_is1) (Version: - Senters Group, LLC)
Hubert Senters Gold Rush 1.0 (HKLM-x32\...\Hubert Senters Gold Rush_is1) (Version: - Senters Group, LLC)
Hubert Senters Gold Spike 1.0 (HKLM-x32\...\Hubert Senters Gold Spike_is1) (Version: - Senters Group, LLC)
Hubert Senters Good Night Gold 1.0 (HKLM-x32\...\Hubert Senters Good Night Gold_is1) (Version: - Senters Group, LLC)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Manageability Engine Firmware Recovery Agent (HKLM-x32\...\{A6C48A9F-694A-4234-B3AA-62590B668927}) (Version: 1.0.0.35342 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.1.1399 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.0.0.1032 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.3.214 - Intel Corporation)
Intel® Trusted Connect Service Client (HKLM\...\{538B98C3-773F-4F20-9C66-802D104DCBE2}) (Version: 1.23.219.2 - Intel Corporation)
IObit Apps Toolbar v7.0 (HKLM-x32\...\{4ED7341F-1942-4623-A27C-9C4F3838172F}) (Version: 7.0 - Spigot, Inc.) <==== ATTENTION
Jasc Animation Shop 3 (HKLM-x32\...\{7C4196CA-CA41-4F34-9C08-7724E7705D52}) (Version: 3.11 - Jasc Software Inc)
Jasc Paint Shop Pro 9 (HKLM-x32\...\{F843C6A3-224D-4615-94F8-3C461BD9AEA0}) (Version: 9.00.0000 - Jasc Software Inc)
Java 7 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417045FF}) (Version: 7.0.450 - Oracle)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
LogMeIn (HKLM-x32\...\{EE4CA5AF-4A55-418C-8CB8-74435814207B}) (Version: 4.1.2450 - LogMeIn, Inc.)
Magical Jelly Bean KeyFinder (HKLM-x32\...\KeyFinder_is1) (Version: 2.0.10.9 - Magical Jelly Bean)
Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
MCEBrowser (HKLM-x32\...\{79F41FC6-07F9-47C2-BBAC-37C7C70EE703}) (Version: 2.2 - ANPARK)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0016-0000-0000-0000000FF1CE}_EXCEL_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-001B-0000-0000-0000000FF1CE}_WORD_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office Excel 2007 (HKLM-x32\...\EXCEL) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Word 2007 (HKLM-x32\...\WORD) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft PowerPoint Viewer (HKLM-x32\...\{95140000-00AF-0409-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.31211.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{820B6609-4C97-3A2B-B644-573B06A0F0CC}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 35.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 en-US)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MultiCharts (HKLM-x32\...\MultiCharts) (Version: 8.0.5620 - MultiCharts)
MultiCharts (x32 Version: 8.0.5620 - TS Support) Hidden
MultiCharts64 (HKLM\...\MultiCharts64) (Version: 8.0.5375 - MultiCharts)
MultiCharts64 (Version: 8.0.5375 - TS Support) Hidden
Multimedia Card Reader (HKLM-x32\...\InstallShield_{41068A8C-3F30-46B6-978A-EA692F28D1AF}) (Version: 1.7.915.93 - Fitipower)
Multimedia Card Reader (x32 Version: 1.7.915.93 - Fitipower) Hidden
Nero BurningROM 12 (HKLM-x32\...\{3D9167B2-87EB-4713-90B4-E46F2CAFE28D}) (Version: 12.0.00300 - Nero AG)
NinjaTrader 7 (HKLM-x32\...\{498F2114-FE59-44C7-A32F-E6F72C872894}) (Version: 7.0.1024 - NinjaTrader)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.3.2 - Frank Heindörfer, Philip Chinery)
pdfsam (HKLM-x32\...\pdfsam) (Version: 2.2.1 - )
PeerBlock 1.2 (r693) (HKLM\...\{015C5B35-B678-451C-9AEE-821E8D69621C}_is1) (Version: 1.2.0.693 - PeerBlock, LLC)
Prerequisite installer (x32 Version: 12.0.0002 - Nero AG) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6537 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.94 (HKLM-x32\...\Revo Uninstaller) (Version: 1.94 - VS Revo Group)
SiteVault Pro (HKLM-x32\...\{CD244D9D-B284-4DDC-8B9F-BCF762AC1681}_is1) (Version: 4.0.31 - Amorphys Romania)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Smart Defrag 3 (HKLM-x32\...\Smart Defrag 3_is1) (Version: 3.3 - IObit)
Snagit 11 (HKLM-x32\...\{44BD21C2-9132-48DB-B65B-23817E4C6F4B}) (Version: 11.2.0 - TechSmith Corporation)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.0.12 - Safer-Networking Ltd.)
Strongvault Online Backup (HKLM-x32\...\{C8A17402-051A-471B-BA64-9147A7467005}) (Version: 2.1.1.0 - Strongvault) <==== ATTENTION
Strongvault Online Backup (x32 Version: 5.0.2.34 - Strongvault Online Backup) Hidden <==== ATTENTION
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.38846 - TeamViewer)
Total Recorder 8.3 Standard Edition (HKLM-x32\...\TotalRecorder) (Version: - )
Trader Workstation 4.0 (HKLM-x32\...\Trader Workstation 4.0) (Version: - )
TradeStation 9.0 (HKLM-x32\...\{6EF11260-2361-409D-B91C-373D8732EED8}) (Version: 9.0.0.9012 - TradeStation Technologies)
TradeStation 9.1 (HKLM-x32\...\{B948B39D-214F-486E-BCD9-8AB691F8762A}) (Version: 9.01.00.12793 - TradeStation Technologies)
TVersity Codec Pack 1.4 (HKLM-x32\...\TVersity Codec Pack) (Version: 1.4 - TVersity Inc.)
TVersity Media Server 1.9 (HKLM-x32\...\TVersity Media Server) (Version: 1.9 - TVersity)
Tweaking.com - Registry Backup (HKLM-x32\...\Tweaking.com - Registry Backup) (Version: 2.1.1 - Tweaking.com)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0016-0000-0000-0000000FF1CE}_EXCEL_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-001B-0000-0000-0000000FF1CE}_WORD_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Visual Studio 2008 x64 Redistributables (HKLM-x32\...\{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}) (Version: 10.0.0.2 - AVG Technologies)
Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.1.2 (HKLM-x32\...\VLC media player) (Version: 2.1.2 - VideoLAN)
Vuze (HKLM\...\8461-7759-5462-8226) (Version: 5.3.0.0 - Azureus Software, Inc.)
Website Extractor 10.52 (HKLM-x32\...\Website Extractor_is1) (Version: - )
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
WinRAR 4.20 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-472848371-1800496413-3629884572-1000_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Program Files (x86)\Citrix\GoToMeeting\1133\G2MOutlookAddin64.dll (Citrix Online, a division of Citrix Systems, Inc.)

==================== Restore Points =========================

17-02-2015 20:25:13 Scheduled Checkpoint

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-02-22 11:29 - 2015-02-18 19:10 - 00001512 _RASH C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
158.58.173.195 www.google-analytics.com.
158.58.173.195 google-analytics.com.
158.58.173.195 connect.facebook.net.
212.83.161.214 www.google-analytics.com.
212.83.161.214 google-analytics.com.
212.83.161.214 connect.facebook.net.
192.95.55.231 www.google-analytics.com.
192.95.55.231 google-analytics.com.
192.95.55.231 connect.facebook.net.


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {08412C21-DB78-4807-82F1-13E5C29E4FF1} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv => C:\Windows\TEMP\{BABC636A-0B2A-48A7-98BF-E852D277A7BB}.exe
Task: {088426E6-E3E4-4C9D-B65D-1A948D75278A} - System32\Tasks\Auto FTP Forex.xml => C:\Omega\FTP_Auto_Upload\ftp_upload_Forex.cmd [2012-11-18] ()
Task: {08FEDB2A-F4C7-4813-9B94-CDAD1CDADB8F} - System32\Tasks\Dell SupportAssistAgent AutoUpdate => C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssist.exe [2015-02-06] (Microsoft)
Task: {0DDC7FB0-E807-4D12-AD3B-DD6C39B51EBE} - System32\Tasks\SmartDefrag3_Update => C:\Program Files (x86)\IObit\Smart Defrag 3\AutoUpdate.exe [2014-07-23] (IObit)
Task: {0EEF6027-ABDA-4A80-A00C-B1157D82FC71} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe
Task: {21538892-EEAF-4B0F-813D-BA09FCD4C1B1} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\Dell\SupportAssist\sessionchecker.exe [2015-02-03] (PC-Doctor, Inc.)
Task: {3B3D2CA3-0580-4E15-A28C-444611D5D6FD} - System32\Tasks\{D6BD40D8-7C23-4DC5-954B-10C7B59D254D} => pcalua.exe -a C:\Junk\rescue2usb.exe -d C:\Junk
Task: {41DC99A4-C1F4-43D3-A8A0-05746AE68826} - System32\Tasks\Auto FTP Stocks.xml => C:\Omega\FTP_Auto_Upload\ftp_upload_Stocks.cmd [2012-11-18] ()
Task: {43463012-A6B2-4272-94B5-185D22ED7713} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
Task: {43E181DD-4E95-45C7-B464-C8273E6E052E} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe
Task: {4C74F371-5723-4BAA-8567-F450CEC0B879} - System32\Tasks\{70C38B8B-37D2-48A9-B98F-5A4A5EF2C6A9} => pcalua.exe -a C:\Users\Bob\Desktop\esetsmartinstaller_enu.exe -d C:\Users\Bob\Desktop
Task: {53E7BDE9-8894-4512-A9E5-17EDB25CCFD4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-05-28] (Google Inc.)
Task: {592C6A55-0342-4B00-BFB1-87DF635C3BCD} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\Dell\SupportAssist\uaclauncher.exe [2015-02-03] (PC-Doctor, Inc.)
Task: {5A754029-4E3B-477E-9C69-F3EF45268237} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-05] (Adobe Systems Incorporated)
Task: {695CFDD7-1AEC-4717-946D-FCC55E999B86} - System32\Tasks\Microsoft\Windows\Media Center\Extender\Update media permissions for Mcx1-XPS8500 => C:\Windows\ehome\McxTask.exe [2009-07-13] (Microsoft Corporation)
Task: {77E37BBB-BB7A-4EFC-8A29-1C6533C7ADAD} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {892E2910-D23C-4497-B736-DD9109013454} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => c:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25] (Intel Corporation)
Task: {89D20355-05D5-434D-8760-073B954A7848} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {8BD1BD81-8B8B-4464-A1A0-0F8498C294FA} - System32\Tasks\SmartDefrag3_Startup => C:\Program Files (x86)\IObit\Smart Defrag 3\SmartDefrag.exe [2014-10-20] (IObit)
Task: {8D0958A1-11FD-4CE7-B372-13CA222857F7} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe
Task: {90170FD2-7BEF-4D84-B4DD-D41AB877BCB5} - System32\Tasks\{DCD3CEF4-DF10-4B4C-A35B-14F361D1F0F2} => pcalua.exe -a C:\Users\Bob\Documents\erunt\ERUNT.EXE -d C:\Users\Bob\Documents\erunt
Task: {92B5D7FD-697D-41CC-9AB7-557A0E1F8355} - System32\Tasks\Auto FTP ETF.xml => C:\Omega\FTP_Auto_Upload\ftp_upload_ETF.cmd [2012-11-18] ()
Task: {9991B4C4-C89A-462C-9CC2-00A2C70A3060} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-05-28] (Google Inc.)
Task: {A5F111FD-9D32-4A26-987D-D8E8E0E85DCF} - System32\Tasks\{4B015CE5-CA51-4E6E-B25C-76A7926D0E95} => pcalua.exe -a "C:\Users\Bob\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WHQM3NFI\Setup TradeStation 9.1 with .NET.exe" -d C:\Users\Bob\Desktop
Task: {B8481CFB-8E85-4ABC-B8AA-2C07D2EEB42A} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv => C:\Windows\TEMP\{B0A47063-09AD-435D-917D-99D1436E26DB}.exe
Task: {C7D4F514-7A65-4CD5-959A-AEE2F348E84A} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => c:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25] (Intel Corporation)
Task: {E763A272-9474-4B03-B6CE-BF26FA72E1B9} - System32\Tasks\{5293C6BC-9EA8-4462-8E85-206422E638E7} => pcalua.exe -a C:\Junk\PaintShopProInstall\iso\setup.exe -d C:\Junk\PaintShopProInstall\iso
Task: {EA208FB1-FE4D-4CEA-A70E-71E93DCB0D71} - System32\Tasks\Auto FTP Futures.xml => C:\Omega\FTP_Auto_Upload\ftp_upload_Futures.cmd [2012-11-18] ()
Task: {FC1C27B1-B372-4FC9-A1FA-8846FB10C511} - System32\Tasks\TradeStation Backup - Daily => C:\Program Files (x86)\TradeStation 9.1\Program\TSBackupRestore.exe [2014-04-03] (TradeStation Technologies, Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job => C:\Windows\TEMP\{B0A47063-09AD-435D-917D-99D1436E26DB}.exe <==== ATTENTION
Task: C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job => C:\Windows\TEMP\{BABC636A-0B2A-48A7-98BF-E852D277A7BB}.exe <==== ATTENTION
Task: C:\Windows\Tasks\Dell SupportAssistAgent AutoUpdate.job => C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssist.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job => c:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe
Task: C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job => c:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe
Task: C:\Windows\Tasks\TradeStation Backup - Daily.job => C:\Program Files (x86)\TradeStation 9.1\Program\TSBackupRestore.exe

==================== Loaded Modules (whitelisted) ==============

2015-02-16 18:49 - 2015-02-16 18:49 - 02622464 _____ () C:\ProgramData\Microsoft\Security\Client\SecurityProvider.dll
2010-01-02 08:42 - 2010-01-02 08:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2015-02-18 05:54 - 2015-02-18 05:54 - 02165760 _____ () C:\ProgramData\Microsoft\Security\Client\SecurityHelper.dll
2012-05-09 15:53 - 2012-01-21 10:35 - 00128280 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
2012-10-23 18:32 - 2012-06-18 15:40 - 00950032 _____ () C:\SiteVaultPro\SvPro.exe
2014-10-28 04:54 - 2014-10-28 04:54 - 02640408 _____ () C:\Program Files (x86)\AVG SafeGuard toolbar\vprot.exe
2014-09-29 18:51 - 2014-09-29 18:51 - 00074664 _____ () C:\Program Files (x86)\SlySoft\AnyDVD\ADvdDiscHlp64.exe
2010-07-12 22:45 - 2010-07-12 22:45 - 00880640 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\MediaServer.exe
2014-12-11 18:25 - 2014-12-11 18:25 - 00014848 _____ () C:\Program Files\i2p\jcpuid.dll
2014-12-11 18:25 - 2014-12-11 18:25 - 00181760 _____ () C:\Program Files\i2p\jbigi.dll
2014-10-28 04:54 - 2014-10-28 04:54 - 00159768 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\loggingserver.exe
2012-12-04 18:42 - 2012-10-19 23:01 - 00051272 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\CodeLog.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00035912 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\CompressFile.dll
2012-12-04 18:42 - 2008-11-25 17:18 - 01291264 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\libxml2.dll
2012-12-04 18:42 - 2004-10-05 03:08 - 00055808 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\zlib1.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00050248 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\TBGetRemoteNetInfo.dll
2012-12-04 18:42 - 2012-11-05 11:57 - 00035400 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\ActivationOnline.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00294472 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\ExchBackupSize.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00572488 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\ExImage.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00468552 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\ExchBackupSizeEx.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00069192 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\EnumTapeDevice.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00070216 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\TbTapeBrowse.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00022088 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\AccountManager.dll
2012-12-04 18:42 - 2012-10-30 18:10 - 00108616 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\NasOperator.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00135752 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\CloudOperator.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00037960 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\ActiveOnline.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00096840 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\TBFireWall.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00033352 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\LibraryManager.dll
2013-01-19 11:51 - 2012-11-13 14:06 - 00108960 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2013-01-19 11:51 - 2012-11-13 14:06 - 00416160 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2013-01-19 11:51 - 2012-11-13 14:06 - 00158624 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2013-01-19 11:51 - 2012-08-23 09:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2013-01-19 11:51 - 2012-11-13 14:06 - 00528288 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\JSDialogPack150.bpl
2014-01-21 05:34 - 2014-06-04 14:17 - 00892288 _____ () C:\Program Files (x86)\IObit\Smart Defrag 3\webres.dll
2012-10-23 18:32 - 2010-03-07 05:31 - 00024110 _____ () C:\SiteVaultPro\mingwm10.dll
2012-10-23 18:32 - 2010-03-30 20:29 - 00279955 _____ () C:\SiteVaultPro\libidn-11.dll
2012-10-23 18:32 - 2010-06-23 06:17 - 01546364 _____ () C:\SiteVaultPro\libeay32.dll
2012-10-23 18:32 - 2010-06-23 06:17 - 00346759 _____ () C:\SiteVaultPro\libssl32.dll
2013-01-19 11:51 - 2012-11-13 14:06 - 00554400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\VirtualTreesDXE150.bpl
2014-10-28 04:54 - 2014-10-28 04:54 - 01654296 _____ () C:\Program Files (x86)\AVG SafeGuard toolbar\TBAPI.dll
2014-10-28 04:54 - 2014-10-28 04:54 - 00519704 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\log4cplusU.dll
2010-07-12 22:06 - 2010-07-12 22:06 - 00344064 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\taglib.dll
2010-07-12 22:06 - 2010-07-12 22:06 - 00729088 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\X11.dll
2010-07-12 22:06 - 2010-07-12 22:06 - 00163840 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\CORE_RL_lcms_.dll
2010-07-12 22:06 - 2010-07-12 22:06 - 00327680 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\libcurl.dll
2010-07-12 22:06 - 2010-07-12 22:06 - 00712704 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\log4cxx.dll
2010-07-11 20:47 - 2010-07-11 20:47 - 04530190 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\avcodec-52.dll
2010-07-11 20:47 - 2010-07-11 20:47 - 00079886 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\avutil-50.dll
2010-07-11 20:47 - 2010-07-11 20:47 - 00309755 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\libmp3lame-0.dll
2010-07-11 20:47 - 2010-07-11 20:47 - 00791566 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\avformat-52.dll
2010-07-11 20:47 - 2010-07-11 20:47 - 00199182 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\swscale-0.dll
2010-07-12 22:06 - 2010-07-12 22:06 - 00505835 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\sqlite3.dll
2006-09-15 23:03 - 2006-09-15 23:03 - 00007680 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\ImageMagickCoders\IM_MOD_RL_GRAY_.dll
2014-11-24 11:39 - 2014-11-24 11:39 - 00155528 _____ () C:\Program Files (x86)\Dell Digital Delivery\ServiceTagPlusPlus.dll
2014-10-16 02:33 - 2014-10-16 02:33 - 00172032 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\92a1650dbe9fad5f46633b835420e1a8\IsdiInterop.ni.dll
2012-05-09 15:50 - 2011-11-29 19:00 - 00059392 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2012-12-04 18:42 - 2008-11-24 21:53 - 00446898 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\libgio-2.0-0.dll
2012-12-04 18:42 - 2008-09-26 11:10 - 00781961 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\libcairo-2.dll
2012-12-04 18:42 - 2008-09-25 16:16 - 00182015 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\libpng12-0.dll
2012-12-04 18:42 - 2008-11-04 10:54 - 00077792 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\libpangocairo-1.0-0.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00120320 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\lib\gtk-2.0\2.10.0\engines\libuitheme.dll
2012-12-04 18:42 - 2008-12-16 12:24 - 00088105 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\lib\gtk-2.0\2.10.0\engines\libwimp.dll
2012-12-04 18:42 - 2008-12-16 12:17 - 00035326 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\lib\gtk-2.0\2.10.0\loaders\libpixbufloader-png.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00036424 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\NetDrive.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00029768 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\License.dll
2012-05-09 15:52 - 2012-01-21 05:23 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00194632 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\TbTapeHlp.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00096840 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\IncTaskChange.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00041544 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\DsMonitor.dll
2015-01-27 05:46 - 2015-01-27 05:46 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\atashost => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\GoToAssist => ""="Service"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-472848371-1800496413-3629884572-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Bob\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.1.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

Administrator (S-1-5-21-472848371-1800496413-3629884572-500 - Administrator - Disabled)
Bob (S-1-5-21-472848371-1800496413-3629884572-1000 - Administrator - Enabled) => C:\Users\Bob
Guest (S-1-5-21-472848371-1800496413-3629884572-501 - Limited - Enabled)
HomeGroupUser$ (S-1-5-21-472848371-1800496413-3629884572-1008 - Limited - Enabled)
LogMeInRemoteUser (S-1-5-21-472848371-1800496413-3629884572-1007 - Administrator - Enabled)
Mcx1-XPS8500 (S-1-5-21-472848371-1800496413-3629884572-1006 - Limited - Enabled) => C:\Users\Mcx1-XPS8500

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/19/2015 08:29:51 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" on line C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Component 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (02/19/2015 08:19:19 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: DellDataVault.exe, version: 3.9.3.0, time stamp: 0x54cc079f
Faulting module name: DellDataVault.exe, version: 3.9.3.0, time stamp: 0x54cc079f
Exception code: 0xc0000005
Fault offset: 0x000000000001aa84
Faulting process id: 0x2140
Faulting application start time: 0xDellDataVault.exe0
Faulting application path: DellDataVault.exe1
Faulting module path: DellDataVault.exe2
Report Id: DellDataVault.exe3

Error: (02/19/2015 08:14:18 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/19/2015 07:55:25 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="ia64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Dependent Assembly Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="ia64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (02/19/2015 07:54:37 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (02/19/2015 07:54:00 AM) (Source: SideBySide) (EventID: 35) (User: )
Description: Activation context generation failed for "SMC,processorArchitecture="x86",type="win32",version="8.2.0.0"1".Error in manifest or policy file "SMC,processorArchitecture="x86",type="win32",version="8.2.0.0"2" on line SMC,processorArchitecture="x86",type="win32",version="8.2.0.0"3.
Component identity found in manifest does not match the identity of the component requested.
Reference is SMC,processorArchitecture="x86",type="win32",version="8.2.0.0".
Definition is SMC,processorArchitecture="x86",type="win32",version="12.0.0.0".
Please use sxstrace.exe for detailed diagnosis.

Error: (02/19/2015 06:03:18 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: plugin-container.exe, version: 35.0.1.5500, time stamp: 0x54c1f9f3
Faulting module name: mozalloc.dll, version: 35.0.1.5500, time stamp: 0x54c1f224
Exception code: 0x80000003
Fault offset: 0x00001425
Faulting process id: 0x2618
Faulting application start time: 0xplugin-container.exe0
Faulting application path: plugin-container.exe1
Faulting module path: plugin-container.exe2
Report Id: plugin-container.exe3

Error: (02/19/2015 05:50:25 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: DellDataVault.exe, version: 3.9.3.0, time stamp: 0x54cc079f
Faulting module name: DellDataVault.exe, version: 3.9.3.0, time stamp: 0x54cc079f
Exception code: 0xc0000005
Fault offset: 0x000000000001aa84
Faulting process id: 0x26e0
Faulting application start time: 0xDellDataVault.exe0
Faulting application path: DellDataVault.exe1
Faulting module path: DellDataVault.exe2
Report Id: DellDataVault.exe3

Error: (02/19/2015 05:47:26 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/18/2015 07:14:44 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="ia64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Dependent Assembly Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="ia64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.


System errors:
=============
Error: (02/19/2015 08:19:23 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Dell Data Vault service terminated unexpectedly. It has done this 1 time(s).

Error: (02/19/2015 08:13:25 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The vToolbarUpdater15.4.0 service failed to start due to the following error:
%%2

Error: (02/19/2015 08:13:15 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Dell SupportAssist Agent service failed to start due to the following error:
%%1053

Error: (02/19/2015 08:13:15 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Dell SupportAssist Agent service to connect.

Error: (02/19/2015 08:11:27 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The TVersityMediaServer service terminated unexpectedly. It has done this 1 time(s).

Error: (02/19/2015 05:50:27 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Dell Data Vault service terminated unexpectedly. It has done this 1 time(s).

Error: (02/19/2015 05:46:52 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The vToolbarUpdater15.4.0 service failed to start due to the following error:
%%2

Error: (02/19/2015 05:46:40 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Dell SupportAssist Agent service failed to start due to the following error:
%%1053

Error: (02/19/2015 05:46:40 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Dell SupportAssist Agent service to connect.

Error: (02/18/2015 09:59:42 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The TVersityMediaServer service terminated unexpectedly. It has done this 1 time(s).


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
Date: 2012-11-14 18:08:23.638
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2012-11-14 18:08:23.623
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i5-3450 CPU @ 3.10GHz
Percentage of memory in use: 37%
Total physical RAM: 8152.96 MB
Available physical RAM: 5097.54 MB
Total Pagefile: 16304.12 MB
Available Pagefile: 13001.41 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:911.22 GB) (Free:95.19 GB) NTFS
Drive e: (Seagate Backup Plus Drive) (Fixed) (Total:2794.51 GB) (Free:828.67 GB) NTFS

==================== MBR & Partition Table ==================
Attempted reading MBR returned 0 bytes.
Could not read MBR for disk 5.

==================== End Of Log ============================


aswMBR version 1.0.1.2252 Copyright(c) 2014 AVAST Software
Run date: 2015-02-19 08:35:36
-----------------------------
08:35:36.712 OS Version: Windows x64 6.1.7601 Service Pack 1
08:35:36.712 Number of processors: 4 586 0x3A09
08:35:36.713 ComputerName: XPS8500 UserName: Bob
08:36:13.310 Initialize success
08:36:13.467 VM: initialized successfully
08:36:13.468 VM: Intel CPU supported
08:36:21.253 VM: supported disk I/O iaStor.sys
08:37:07.674 AVAST engine defs: 15021900
08:39:09.319 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
08:39:09.320 Disk 0 Vendor: Size: 0MB BusType: 0
08:39:09.322 Disk 1 \Device\Harddisk1\DR1 -> \Device\00000087
08:39:09.323 Disk 1 Vendor: Size: 0MB BusType: 0
08:39:09.325 Disk 2 \Device\Harddisk2\DR2 -> \Device\00000088
08:39:09.327 Disk 2 Vendor: Size: 0MB BusType: 0
08:39:09.329 Disk 3 \Device\Harddisk3\DR3 -> \Device\00000089
08:39:09.331 Disk 3 Vendor: Size: 0MB BusType: 0
08:39:09.333 Disk 4 \Device\Harddisk4\DR4 -> \Device\0000008a
08:39:09.335 Disk 4 Vendor: Size: 0MB BusType: 0
08:39:09.589 VM: Disk 0 MBR read successfully
08:39:09.595 Disk 0 MBR scan
08:39:09.603 Disk 0 Windows VISTA default MBR code
08:39:09.608 Disk 0 MBR hidden
08:39:09.614 Disk 0 Partition 1 00 DE Dell Utility DELL 4.1 39 MB offset 63
08:39:09.634 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 20736 MB offset 81920
08:39:09.638 Disk 0 Boot: NTFS code=1
08:39:09.659 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 933092 MB offset 42549248
08:39:09.771 Disk 0 scanning C:\Windows\system32\drivers
08:39:32.052 Service scanning
08:40:07.699 Modules scanning
08:40:07.703 Disk 0 trace - called modules:
08:40:07.729 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys iaStor.sys hal.dll
08:40:07.732 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8009a18060]
08:40:07.735 3 CLASSPNP.SYS[fffff88001cb443f] -> nt!IofCallDriver -> [0xfffffa8007146b10]
08:40:07.737 5 ACPI.sys[fffff88000ee17a1] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa800714b050]
08:40:51.433 AVAST engine scan C:\Windows
08:41:50.386 AVAST engine scan C:\Windows\system32
08:48:59.002 AVAST engine scan C:\Windows\system32\drivers
08:50:01.925 AVAST engine scan C:\Users\Bob
10:37:34.234 AVAST engine scan C:\ProgramData
10:56:29.393 Disk 0 statistics 10742504/0/22 @ 0.70 MB/s
10:56:29.398 Scan finished successfully
11:03:40.480 Disk 0 MBR has been saved successfully to "C:\Users\Bob\Desktop\MBR.dat"
11:03:40.502 The log file has been saved successfully to "C:\Users\Bob\Desktop\aswMBR.txt"
11:04:27.975 Disk 0 MBR has been saved successfully to "C:\Users\Bob\Desktop\MBR.dat"
11:04:27.978 The log file has been saved successfully to "C:\Users\Bob\Desktop\aswMBR.txt"

Juliet
2015-02-20, 13:01
Hi and welcome

There are a few items in your add/remove programs list we need to uninstall.

IObit Apps Toolbar
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden

There might be 2 versions of the below, please uninstall both if found
Strongvault Online Backup (HKLM-x32\...\{C8A17402-051A-471B-BA64-9147A7467005}) (Version: 2.1.1.0 - Strongvault) <==== ATTENTION


~~~~~~~~~~~~~~~~~~~~~~~`

Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)


https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG




start
CloseProcesses:
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [UTRmedia] => regsvr32.exe C:\Users\Bob\AppData\Local\UTRmedia\CNBJOP7i.DLL <===== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
SearchScopes: HKLM -> DefaultScope value is missing.
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {39181C36-2062-47D0-8E6A-A5AD85BFE5CE} URL = http://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDR&src=IE-SearchBox
SearchScopes: HKLM-x32 -> DefaultScope value is missing.
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-472848371-1800496413-3629884572-1000 -> {39181C36-2062-47D0-8E6A-A5AD85BFE5CE} URL =
SearchScopes: HKU\S-1-5-21-472848371-1800496413-3629884572-1006 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://isearch.avg.com/search?cid={0F67486E-876F-42B2-8669-8CD5E637806A}&mid=5ad4700098c147d094cad9a4fffc1f77-2ea2192f08b55d83378acdbfcabd2c8082d55b47&lang=en&ds=AVG&pr=fr&d=2012-05-25 18:54:27&v=14.2.0.1&pid=avg&sg=&sap=dsp&q={searchTerms}
BHO: AVG Safe Search -> {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -> C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll No File
BHO-x32: AVG Safe Search -> {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -> C:\Program Files (x86)\AVG\AVG2012\avgssie.dll No File
Toolbar: HKU\S-1-5-21-472848371-1800496413-3629884572-1006 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
FF NetworkProxy: "http", "127.0.0.1"
FF NetworkProxy: "http_port", 4444
FF NetworkProxy: "type", 0
FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\18.1.9\\npsitesafety.dll No File
FF Extension: Browsse2save - C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\tjg3rdx3.default\Extensions\gxweiay0@wdoeaewnf.co.uk [2013-04-03]
CHR Extension: (Browsse2save) - C:\Users\Bob\AppData\Local\Google\Chrome\User Data\Default\Extensions\inhinkaiimjghmnangojdjhpnbbedbjg [2013-04-03]
CHR Extension: (Amazing Coupons) - C:\Users\Bob\AppData\Local\Google\Chrome\User Data\Default\Extensions\mjildcbkilmkddbbpbjljljdmmlfeppl [2013-03-15]
CHR HKLM-x32\...\Chrome\Extension: [hacjidbllfnlecmikihhjphlicpbepih] - No Path
C:\Users\Bob\AppData\Local\Temp\25hwbij0.dll
C:\Users\Bob\AppData\Local\Temp\2z5mwlh2.dll
C:\Users\Bob\AppData\Local\Temp\clean20.dll
C:\Users\Bob\AppData\Local\Temp\GACInstaller.dll
C:\Users\Bob\AppData\Local\Temp\handbrake-setup.exe
C:\Users\Bob\AppData\Local\Temp\instutil.dll
C:\Users\Bob\AppData\Local\Temp\oi_{425724E8-3C22-416E-BCF3-0BF7A288D70E}.exe
C:\Users\Bob\AppData\Local\Temp\ose00000.exe
C:\Users\Bob\AppData\Local\Temp\RegistASM.exe
C:\Users\Bob\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Bob\AppData\Local\Temp\TSInst10.exe
C:\Users\Bob\AppData\Local\Temp\TSInstallCAUtils.dll
C:\Users\Bob\AppData\Local\Temp\unrar.dll
C:\Users\Bob\AppData\Local\Temp\unrar.exe
C:\Users\Bob\AppData\Local\Temp\unzip.exe
C:\Users\Bob\AppData\Local\Temp\vlc-2.1.2-win32.exe
Task: C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job => C:\Windows\TEMP\{B0A47063-09AD-435D-917D-99D1436E26DB}.exe <==== ATTENTION
Task: C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job => C:\Windows\TEMP\{BABC636A-0B2A-48A7-98BF-E852D277A7BB}.exe <==== ATTENTION
EmptyTemp:
Hosts:
End


Open FRST/FRST64 and press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

~~~~~~~~~~~~~~~~~~~~~`
http://i.imgur.com/BY4dvz9.png AdwCleaner

Please download AdwCleaner (http://www.bleepingcomputer.com/download/adwcleaner/) and save the file to your Desktop.
Right-Click AdwCleaner.exe and select http://i.imgur.com/AVOiBNU.jpg Run as administrator to run the programme.
Follow the prompts.
Click Scan.
Upon completion, click Report. A log (AdwCleaner[R0].txt) will open. Briefly check the log for anything you know to be legitimate.
Ensure anything you know to be legitimate does not have a checkmark, and click Clean.
Follow the prompts and allow your computer to reboot.
After rebooting, a log (AdwCleaner[S0].txt) will open. Copy the contents of the log and paste in your next reply.

-- File and registry key backups are made for anything removed using this tool. Should a legitimate entry be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the entry. Please do not overly concern yourself with the contents of AdwCleaner[R0].txt.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


http://imageshack.us/a/img841/7292/thisisujrt.gif
Please download Junkware Removal Tool (http://www.bleepingcomputer.com/download/junkware-removal-tool/) to your desktop.

Shut down your protection software now to avoid potential conflicts.
You can get help on disabling your protection programs here (http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/490111-how-disable-your-security-applications.html)
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.


*****
please post
Fixlog.txt
C:\AdwCleaner.txt
JRT.txt

Juliet
2015-02-22, 14:52
Still need help?

savanna
2015-02-23, 14:16
Sorry for the delay. I was out of town for a few days, but back and ready to get this fixed.

When trying to remove the IObit Apps Toolbar I get an error message of "The feature you are trying to use is on a network resource that is unavailable."

Google Earth was successfully removed. I like to use that program once in a while. Is it a known source of problems?

I could not find either of the two "Google Update Helper". How do I unhide them?

I could not find "Strongvault Online Backup"

I thought I should get the above resolved before proceeding.

Thank you very much for your help.

Juliet
2015-02-23, 14:54
Let's just continue, those are things we can fix later if need be.

Have you run the script I created and the tools suggested?

please post
Fixlog.txt
C:\AdwCleaner.txt
JRT.txt

savanna
2015-02-23, 17:43
The Farbar Recovery Scan Tool kept locking up on my right away. I tried several times, making sure that any antivirus programs were turned off. I gave it a good 10-15 minutes each time, but the progress bar wasn't moving and it did not leave the "Temporary Internet Files" directory.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

# AdwCleaner v4.111 - Logfile created 23/02/2015 at 09:26:47
# Updated 18/02/2015 by Xplode
# Database : 2015-02-18.3 [Server]
# Operating system : Windows 7 Home Premium Service Pack 1 (x64)
# Username : Bob - XPS8500
# Running from : C:\Users\Bob\Desktop\AdwCleaner.exe
# Option : Cleaning

***** [ Services ] *****

[#] Service Deleted : vToolbarUpdater18.1.9

***** [ Files / Folders ] *****

Folder Deleted : C:\Device
Folder Deleted : C:\ProgramData\AVG SafeGuard toolbar
Folder Deleted : C:\ProgramData\AVG Secure Search
Folder Deleted : C:\ProgramData\Browsse2save
Folder Deleted : C:\Program Files (x86)\AVG SafeGuard toolbar
Folder Deleted : C:\Program Files (x86)\AVG Security Toolbar
Folder Deleted : C:\Program Files (x86)\Common Files\AVG Secure Search
Folder Deleted : C:\Users\Bob\AppData\Local\Temp\Spigot
[!] Folder Deleted : C:\Users\Bob\AppData\Local\AVG SafeGuard toolbar
Folder Deleted : C:\Users\Bob\AppData\LocalLow\AVG SafeGuard toolbar
Folder Deleted : C:\Users\Bob\AppData\Roaming\Browser Extensions
Folder Deleted : C:\Users\Bob\AppData\Roaming\Search Protection
Folder Deleted : C:\Users\Bob\AppData\Roaming\RHEng
Folder Deleted : C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\tjg3rdx3.default\Extensions

\anttoolbar@ant.com
Folder Deleted : C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\tjg3rdx3.default\Extensions

\Avg@toolbar
File Deleted : C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\tjg3rdx3.default\searchplugins

\avg-secure-search.xml
File Deleted : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\avg-secure-search.xml
File Deleted : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\safeguard-secure-search.xml
File Deleted : C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\tjg3rdx3.default\searchplugins

\yahoo_ff.xml

***** [ Scheduled tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AVG SafeGuard toolbar.BrowserWndAPI
Key Deleted : HKLM\SOFTWARE\Classes\AVG SafeGuard toolbar.BrowserWndAPI.1
Key Deleted : HKLM\SOFTWARE\Classes\AVG SafeGuard toolbar.PugiObj
Key Deleted : HKLM\SOFTWARE\Classes\AVG SafeGuard toolbar.PugiObj.1
Key Deleted : HKLM\SOFTWARE\Classes\protocols\handler\viprotocol
Key Deleted : HKLM\SOFTWARE\Classes\S
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{408CFAD9-8F13-4747-8EC7-770A339C7237}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{07CAC314-E962-4F78-89AB-DD002F2490EE}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-

4E65E497C8C0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-

73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3CA2F312-6F6E-4B53-A66E-

4E65E497C8C0}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-

28C697C44CDC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-

A673-4ED3E9456D39}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-

73684A933233}]
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-

73684A933233}
Key Deleted : HKCU\Software\AVG SafeGuard toolbar
Key Deleted : HKCU\Software\IObit Apps
Key Deleted : HKCU\Software\AppDataLow\Software\Browser Extensions
Key Deleted : HKCU\Software\AppDataLow\Software\IObit Apps
Key Deleted : HKLM\SOFTWARE\AVG SafeGuard toolbar
Key Deleted : HKLM\SOFTWARE\AVG Security Toolbar
Key Deleted : HKLM\SOFTWARE\IObit Apps
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG SafeGuard toolbar
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-

18\Components\0238BBE24EA3A70408B81E4BB89C15E5
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-

18\Components\29799DE249E7DBC459FC6C8F07EB8375
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-

18\Components\30C16B15B255BD349A1157B8A83E2AF9
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-

18\Components\ED1CAE30F47D14B41B5FC8FA53658044
Data Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] -

<local>

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17631


-\\ Mozilla Firefox v35.0.1 (x86 en-US)

[tjg3rdx3.default\prefs.js] - Line Deleted : user_pref

("iminent.webbooster.scripts.minibar.registerToolbarEvent102", "1361719985374");
[tjg3rdx3.default\prefs.js] - Line Deleted : user_pref

("iminent.webbooster.scripts.sslminibar.registerToolbarEvent134", "1361721157139");

-\\ Google Chrome v


*************************

AdwCleaner[R0].txt - [6856 bytes] - [23/02/2015 09:24:05]
AdwCleaner[S0].txt - [6822 bytes] - [23/02/2015 09:26:47]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [6881 bytes] ##########


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.2 (02.02.2015:1)
OS: Windows 7 Home Premium x64
Ran by Bob on Mon 02/23/2015 at 9:34:53.33
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SMessaging [Strongvault]



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{25DA541F-6ACF-4052-A8AA-1D58284729C7}



~~~ Files

Successfully deleted: [File] "C:\Windows\wininit.ini"



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\pcdr"
Successfully deleted: [Folder] "C:\Users\Bob\AppData\Roaming\pcdr"



~~~ FireFox

Successfully deleted: [File] C:\Users\Bob\AppData\Roaming\mozilla\firefox\profiles\tjg3rdx3.default\searchplugins\aol-search.xml
Emptied folder: C:\Users\Bob\AppData\Roaming\mozilla\firefox\profiles\tjg3rdx3.default\minidumps [165 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Mon 02/23/2015 at 9:38:58.87
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Juliet
2015-02-23, 18:10
let's try this

Please Run TFC by OldTimer to clear temporary files:
TFC by OldTimer (http://oldtimer.geekstogo.com/TFC.exe ) and save it to your desktop.

Close any open programs and Internet browsers.
Double click TFC.exe to run it on XP (for Vista and Windows 7 right click and choose "Run as administrator") and once it opens click on the Start button on the lower left of the program to allow it to begin cleaning.
Please be patient as clearing out temp files may take a while.
Once it completes you may be prompted to restart your computer, please do so.
Once it's finished you may delete TFC.exe from your desktop or save it for later use for the cleaning of temporary files.

Now see if you can run the FRST again.

savanna
2015-02-23, 18:53
TFC seems to have done the trick. Fixlog.txt is below. Thank you for your help.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 22-02-2015
Ran by Bob at 2015-02-23 10:36:40 Run:5
Running from C:\Users\Bob\Desktop
Loaded Profiles: Bob (Available profiles: Bob & Mcx1-XPS8500)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start
CloseProcesses:
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [UTRmedia] => regsvr32.exe C:\Users\Bob\AppData\Local\UTRmedia\CNBJOP7i.DLL <===== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
SearchScopes: HKLM -> DefaultScope value is missing.
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {39181C36-2062-47D0-8E6A-A5AD85BFE5CE} URL = http://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDR&src=IE-SearchBox
SearchScopes: HKLM-x32 -> DefaultScope value is missing.
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-472848371-1800496413-3629884572-1000 -> {39181C36-2062-47D0-8E6A-A5AD85BFE5CE} URL =
SearchScopes: HKU\S-1-5-21-472848371-1800496413-3629884572-1006 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://isearch.avg.com/search?cid={0F67486E-876F-42B2-8669-8CD5E637806A}&mid=5ad4700098c147d094cad9a4fffc1f77-2ea2192f08b55d83378acdbfcabd2c8082d55b47&lang=en&ds=AVG&pr=fr&d=2012-05-25 18:54:27&v=14.2.0.1&pid=avg&sg=&sap=dsp&q={searchTerms}
BHO: AVG Safe Search -> {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -> C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll No File
BHO-x32: AVG Safe Search -> {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -> C:\Program Files (x86)\AVG\AVG2012\avgssie.dll No File
Toolbar: HKU\S-1-5-21-472848371-1800496413-3629884572-1006 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
FF NetworkProxy: "http", "127.0.0.1"
FF NetworkProxy: "http_port", 4444
FF NetworkProxy: "type", 0
FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\18.1.9\\npsitesafety.dll No File
FF Extension: Browsse2save - C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\tjg3rdx3.default\Extensions\gxweiay0@wdoeaewnf.co.uk [2013-04-03]
CHR Extension: (Browsse2save) - C:\Users\Bob\AppData\Local\Google\Chrome\User Data\Default\Extensions\inhinkaiimjghmnangojdjhpnbbedbjg [2013-04-03]
CHR Extension: (Amazing Coupons) - C:\Users\Bob\AppData\Local\Google\Chrome\User Data\Default\Extensions\mjildcbkilmkddbbpbjljljdmmlfeppl [2013-03-15]
CHR HKLM-x32\...\Chrome\Extension: [hacjidbllfnlecmikihhjphlicpbepih] - No Path
C:\Users\Bob\AppData\Local\Temp\25hwbij0.dll
C:\Users\Bob\AppData\Local\Temp\2z5mwlh2.dll
C:\Users\Bob\AppData\Local\Temp\clean20.dll
C:\Users\Bob\AppData\Local\Temp\GACInstaller.dll
C:\Users\Bob\AppData\Local\Temp\handbrake-setup.exe
C:\Users\Bob\AppData\Local\Temp\instutil.dll
C:\Users\Bob\AppData\Local\Temp\oi_{425724E8-3C22-416E-BCF3-0BF7A288D70E}.exe
C:\Users\Bob\AppData\Local\Temp\ose00000.exe
C:\Users\Bob\AppData\Local\Temp\RegistASM.exe
C:\Users\Bob\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Bob\AppData\Local\Temp\TSInst10.exe
C:\Users\Bob\AppData\Local\Temp\TSInstallCAUtils.dll
C:\Users\Bob\AppData\Local\Temp\unrar.dll
C:\Users\Bob\AppData\Local\Temp\unrar.exe
C:\Users\Bob\AppData\Local\Temp\unzip.exe
C:\Users\Bob\AppData\Local\Temp\vlc-2.1.2-win32.exe
Task: C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job => C:\Windows\TEMP\{B0A47063-09AD-435D-917D-99D1436E26DB}.exe <==== ATTENTION
Task: C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job => C:\Windows\TEMP\{BABC636A-0B2A-48A7-98BF-E852D277A7BB}.exe <==== ATTENTION
EmptyTemp:
Hosts:
End
*****************

Processes closed successfully.
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\Software\Microsoft\Windows\CurrentVersion\Run\\UTRmedia => Value not found.
HKLM\SOFTWARE\Policies\Google => Key not found.
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer => Key not found.
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\SOFTWARE\Policies\Microsoft\Internet Explorer => Key not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully.
HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{39181C36-2062-47D0-8E6A-A5AD85BFE5CE} => Key not found.
HKCR\CLSID\{39181C36-2062-47D0-8E6A-A5AD85BFE5CE} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found.
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{39181C36-2062-47D0-8E6A-A5AD85BFE5CE} => Key not found.
HKCR\CLSID\{39181C36-2062-47D0-8E6A-A5AD85BFE5CE} => Key not found.
HKU\S-1-5-21-472848371-1800496413-3629884572-1006\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233} => Key not found.
HKCR\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233} => Key not found.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} => Key not found.
HKCR\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} => Key not found.
HKCR\Wow6432Node\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} => Key not found.
HKU\S-1-5-21-472848371-1800496413-3629884572-1006\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} => Value not found.
HKCR\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} => Key not found.
Firefox Proxy settings were reset.
Firefox Proxy settings were reset.
Firefox Proxy settings were reset.
HKLM\Software\Wow6432Node\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin => Key not found.
C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\tjg3rdx3.default\Extensions\gxweiay0@wdoeaewnf.co.uk not found.
C:\Users\Bob\AppData\Local\Google\Chrome\User Data\Default\Extensions\inhinkaiimjghmnangojdjhpnbbedbjg directory not found.
C:\Users\Bob\AppData\Local\Google\Chrome\User Data\Default\Extensions\mjildcbkilmkddbbpbjljljdmmlfeppl directory not found.
HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\hacjidbllfnlecmikihhjphlicpbepih => Key not found.
"C:\Users\Bob\AppData\Local\Temp\25hwbij0.dll" => File/Directory not found.
"C:\Users\Bob\AppData\Local\Temp\2z5mwlh2.dll" => File/Directory not found.
"C:\Users\Bob\AppData\Local\Temp\clean20.dll" => File/Directory not found.
"C:\Users\Bob\AppData\Local\Temp\GACInstaller.dll" => File/Directory not found.
"C:\Users\Bob\AppData\Local\Temp\handbrake-setup.exe" => File/Directory not found.
"C:\Users\Bob\AppData\Local\Temp\instutil.dll" => File/Directory not found.
"C:\Users\Bob\AppData\Local\Temp\oi_{425724E8-3C22-416E-BCF3-0BF7A288D70E}.exe" => File/Directory not found.
"C:\Users\Bob\AppData\Local\Temp\ose00000.exe" => File/Directory not found.
"C:\Users\Bob\AppData\Local\Temp\RegistASM.exe" => File/Directory not found.
"C:\Users\Bob\AppData\Local\Temp\SkypeSetup.exe" => File/Directory not found.
"C:\Users\Bob\AppData\Local\Temp\TSInst10.exe" => File/Directory not found.
"C:\Users\Bob\AppData\Local\Temp\TSInstallCAUtils.dll" => File/Directory not found.
"C:\Users\Bob\AppData\Local\Temp\unrar.dll" => File/Directory not found.
"C:\Users\Bob\AppData\Local\Temp\unrar.exe" => File/Directory not found.
"C:\Users\Bob\AppData\Local\Temp\unzip.exe" => File/Directory not found.
"C:\Users\Bob\AppData\Local\Temp\vlc-2.1.2-win32.exe" => File/Directory not found.
C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job not found.
C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job not found.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 35.1 MB temporary data.


The system needed a reboot.

==== End of Fixlog 10:36:42 ====

Juliet
2015-02-23, 19:38
Good work.

Open Malwarebytes' Anti-Malware


On the Dashboard click on Update Now
Go to the Setting Tab
Under Setting go to Detection and Protection
Under PUP and PUM make sure both are set to show Treat Dections as Malware
Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
Then on the Dashboard click on Scan
Make sure to select THREAT SCAN
Then click on Scan
When the scan is finished and the log pops up...select Copy to Clipboard
Please paste the log back into this thread for review
Exit Malwarebytes



~~~~
What we can do now is run an online scan with Eset, for the time being it is our most trusted scanner.
Most reliable and thorough.
The settings I suggest will show us items located in quarantine folders so don't be alarmed with this, also, in case of a false positive I ask that you not allow it to delete what it does find.
This scanner can take quite a bit of time to run, depending of course how full your computer is.


http://i.imgur.com/GzlsbnV.png ESET Online Scan
Note: This scan may take a long time to complete. Please do not browse the Internet whilst your Anti-Virus is disabled.

Please download ESET Online Scan (http://download.eset.com/special/eos/esetsmartinstaller_enu.exe) and save the file to your Desktop.
Temporarily disable your anti-virus software. For instructions, please refer to the following link (http://www.bleepingcomputer.com/forums/t/114351/how-to-temporarily-disable-your-anti-virus-firewall-and-anti-malware-programs/).
Double-click esetsmartinstaller_enu.exe to run the programme.
Agree to the EULA by placing a checkmark next to Yes, I accept the Terms of Use. Then click Start.
Agree to the Terms of Use once more and click Start. Allow components to download.
Place a checkmark next to Enable detection of potentially unwanted applications.
Click Advanced settings. Place a checkmark next to:

Scan archives
Scan for potentially unsafe applications
Enable Anti-Stealth technology


Ensure Remove found threats is unchecked.
Click Start.
Wait for the scan to finish. Please be patient as this can take some time.
Upon completion, click http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetListThreats.png. If no threats were found, skip the next two bullet points.
Click http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetExport.png and save the file to your Desktop, naming it something such as "MyEsetScan".
Push the Back button.
Place a checkmark next to http://3-ps.googleusercontent.com/x/forums.whatthetech.com/i.imgur.com/xKN1w2nv.png.pagespeed.ic.JWqIaEgZi7.png and click http://1-ps.googleusercontent.com/x/forums.whatthetech.com/i.imgur.com/SzOC1p0.png.pagespeed.ce.OWDP45O6oG.png.
Re-enable your anti-virus software.
Copy the contents of the log and paste in your next reply.



Please post
MBAM log
Eset log


How is the computer now?

savanna
2015-02-24, 00:02
MalwareBytes and Eset reports are below. I am still getting two error reports whenever the computer is booted up. They are:
C:\Users\Bob\AppData\Local\YkhxPack\enhace.d... failed to load.
C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll" failed to load.

Thank you for your help.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 2/23/2015
Scan Time: 11:56:01 AM
Logfile:
Administrator: Yes

Version: 2.00.4.1028
Malware Database: v2015.02.23.04
Rootkit Database: v2015.02.22.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Bob

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 409464
Time Elapsed: 11 min, 20 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 39
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\YkhxPack\enhance.DLL, , [766a69b8b6d4f0463b015ec68b778e72],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\YkhxPack\enhance.DLL, , [766a69b8b6d4f0463b015ec68b778e72],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\YkhxPack\enhance.DLL, , [766a69b8b6d4f0463b015ec68b778e72],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\YkhxPack\enhance.DLL, , [766a69b8b6d4f0463b015ec68b778e72],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\YkhxPack\enhance.DLL, , [766a69b8b6d4f0463b015ec68b778e72],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\YkhxPack\enhance.DLL, , [766a69b8b6d4f0463b015ec68b778e72],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\YkhxPack\enhance.DLL, , [766a69b8b6d4f0463b015ec68b778e72],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\YkhxPack\enhance.DLL, , [766a69b8b6d4f0463b015ec68b778e72],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\YkhxPack\enhance.DLL, , [766a69b8b6d4f0463b015ec68b778e72],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\YkhxPack\enhance.DLL, , [766a69b8b6d4f0463b015ec68b778e72],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\YkhxPack\enhance.DLL, , [766a69b8b6d4f0463b015ec68b778e72],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\YkhxPack\enhance.DLL, , [766a69b8b6d4f0463b015ec68b778e72],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\YkhxPack\enhance.DLL, , [766a69b8b6d4f0463b015ec68b778e72],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\YkhxPack\enhance.DLL, , [766a69b8b6d4f0463b015ec68b778e72],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\YkhxPack\enhance.DLL, , [766a69b8b6d4f0463b015ec68b778e72],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\YkhxPack\enhance.DLL, , [766a69b8b6d4f0463b015ec68b778e72],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\YkhxPack\enhance.DLL, , [766a69b8b6d4f0463b015ec68b778e72],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\YkhxPack\enhance.DLL, , [766a69b8b6d4f0463b015ec68b778e72],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\YkhxPack\enhance.DLL, , [766a69b8b6d4f0463b015ec68b778e72],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll, , [c31dfd2489012b0bf547160ee22008f8],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll, , [c31dfd2489012b0bf547160ee22008f8],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll, , [c31dfd2489012b0bf547160ee22008f8],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll, , [c31dfd2489012b0bf547160ee22008f8],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll, , [c31dfd2489012b0bf547160ee22008f8],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll, , [c31dfd2489012b0bf547160ee22008f8],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll, , [c31dfd2489012b0bf547160ee22008f8],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll, , [c31dfd2489012b0bf547160ee22008f8],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll, , [c31dfd2489012b0bf547160ee22008f8],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll, , [c31dfd2489012b0bf547160ee22008f8],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll, , [c31dfd2489012b0bf547160ee22008f8],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll, , [c31dfd2489012b0bf547160ee22008f8],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll, , [c31dfd2489012b0bf547160ee22008f8],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll, , [c31dfd2489012b0bf547160ee22008f8],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll, , [c31dfd2489012b0bf547160ee22008f8],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll, , [c31dfd2489012b0bf547160ee22008f8],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll, , [c31dfd2489012b0bf547160ee22008f8],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll, , [c31dfd2489012b0bf547160ee22008f8],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll, , [c31dfd2489012b0bf547160ee22008f8],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll, , [c31dfd2489012b0bf547160ee22008f8],

Registry Keys: 2
PUP.Optional.Getsavin.A, HKU\S-1-5-21-472848371-1800496413-3629884572-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\GetSavin, , [3ca49a87880253e315ec06a3cb380df3],
PUP.Optional.Getsavin.A, HKU\S-1-5-21-472848371-1800496413-3629884572-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\GetSavin, , [c61a1d04abdfbe78b34f8425b25144bc],

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 3
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\YkhxPack\enhance.DLL, , [766a69b8b6d4f0463b015ec68b778e72],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll, , [c31dfd2489012b0bf547160ee22008f8],
Trojan.Agent.SPEGen, C:\Users\Bob\AppData\Local\YkhxPack\webapprt-stub.dll, , [8c54ea379bef5dd929133be92bd76a96],

Physical Sectors: 0
(No malicious items detected)


(end)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

C:\ProgramData\Microsoft\Security\Client\SecurityHelper.dll a variant of Win64/Sathurbot.A trojan
C:\ProgramData\Microsoft\Security\Client\temp\tmp5EBA.exe Win32/Simda.B trojan
C:\ProgramData\Microsoft\Security\Client\temp\tmp8626.exe Win32/Boaxxe.BR trojan
C:\ProgramData\Microsoft\Security\Client\temp\tmpE780.exe a variant of Win32/Injector.BSIN trojan
C:\Users\All Users\Microsoft\Security\Client\SecurityHelper.dll a variant of Win64/Sathurbot.A trojan
C:\Users\All Users\Microsoft\Security\Client\temp\tmp5EBA.exe Win32/Simda.B trojan
C:\Users\All Users\Microsoft\Security\Client\temp\tmp8626.exe Win32/Boaxxe.BR trojan
C:\Users\All Users\Microsoft\Security\Client\temp\tmpE780.exe a variant of Win32/Injector.BSIN trojan

Juliet
2015-02-24, 01:40
Did you allow MBAM to quarantine all that was found?

At one time did you have Microsoft Security Essentials installed as your antivirus? I see your using AVG now?

If this is the case please run this tool.
http://www.bleepingcomputer.com/download/microsoft-security-essentials-removal-tool/
Microsoft Security Essentials removal tool

Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)



start
CloseProcesses:
HKU\S-1-5-21-472848371-1800496413-3629884572-1006\...\Winlogon: [Shell] C:\Windows\eHome\McrMgr.exe [343552 2009-07-13] (Microsoft Corporation) <==== ATTENTION
C:\Windows\eHome\McrMgr.exe
ShellIconOverlayIdentifiers: [0WinSecurityProvider] -> {F76FA5C2-3B6A-451E-8CA5-34C8D0AE0637} => C:\ProgramData\Microsoft\Security\Client\SecurityProvider.dll ()
C:\ProgramData\Microsoft\Security\Client\SecurityHelper.dll
EmptyTemp:
End


Open FRST/FRST64 and press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

savanna
2015-02-24, 13:48
Everything on my MBAM Advanced Settings page is dimmed so that I can't change anything, but I do see that "Automatically quarantine detected items" is checked. I couldn't remember if I ever ran Microsoft Security Essentials on this machine, so I ran the tool anyway. Yes, I run AVG. I also do weekly scans with Spybot, MBAM and Eset. Fixlog.txt is pasted below.

I'm still getting the following errors on boot-up:
C:\Users\Bob\AppData\Local\YkhxPack\enhace.d... failed to load.
C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll" failed to load.

After googling "vbc.dll" I see several references about it being virus related, but they might have just been attempts to sell scanning software. I couldn't find any information related to the first one. Do you think either of these two are cause for concern?

Thank you for your help.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 22-02-2015
Ran by Bob at 2015-02-24 05:29:33 Run:6
Running from C:\Users\Bob\Desktop
Loaded Profiles: Bob (Available profiles: Bob & Mcx1-XPS8500)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start
CloseProcesses:
HKU\S-1-5-21-472848371-1800496413-3629884572-1006\...\Winlogon: [Shell] C:\Windows\eHome\McrMgr.exe [343552 2009-07-13] (Microsoft Corporation) <==== ATTENTION
C:\Windows\eHome\McrMgr.exe
ShellIconOverlayIdentifiers: [0WinSecurityProvider] -> {F76FA5C2-3B6A-451E-8CA5-34C8D0AE0637} => C:\ProgramData\Microsoft\Security\Client\SecurityProvider.dll ()
C:\ProgramData\Microsoft\Security\Client\SecurityHelper.dll
EmptyTemp:
End
*****************

Processes closed successfully.
HKU\S-1-5-21-472848371-1800496413-3629884572-1006\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value not found.
C:\Windows\eHome\McrMgr.exe => Moved successfully.
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\0WinSecurityProvider" => Key deleted successfully.
"HKCR\CLSID\{F76FA5C2-3B6A-451E-8CA5-34C8D0AE0637}" => Key deleted successfully.
C:\ProgramData\Microsoft\Security\Client\SecurityHelper.dll => Moved successfully.
EmptyTemp: => Removed 659.7 MB temporary data.


The system needed a reboot.

==== End of Fixlog 05:29:40 ====

Juliet
2015-02-24, 14:09
I'd like to see if any remnant files/folders can be found.


Right-Click FRST.exe / FRST64.exe and select http://i.imgur.com/AVOiBNU.jpg Run as administrator to run the programme.
Click Yes to the disclaimer.
Ensure the Addition.txt box is checked.
Click the Scan button and let the programme run.
Upon completion, click OK, then OK on the Addition.txt pop up screen.
Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply.

savanna
2015-02-24, 14:35
Thank you for your help.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-02-2015
Ran by Bob (administrator) on XPS8500 on 24-02-2015 06:30:41
Running from C:\Users\Bob\Desktop
Loaded Profiles: Bob (Available profiles: Bob & Mcx1-XPS8500)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Cisco WebEx LLC) C:\Windows\SysWOW64\atashost.exe
(Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AdminService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe
(CHENGDU YIWO Tech Development Co., Ltd) C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
(CHENGDU YIWO Tech Development Co., Ltd) C:\Program Files (x86)\EaseUS\Todo Backup\bin\GuardAgent.exe
(Tanuki Software, Ltd.) C:\Program Files\i2p\I2Psvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\ramaint.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
() C:\SiteVaultPro\SvPro.exe
(IObit) C:\Program Files (x86)\IObit\Smart Defrag 3\SmartDefrag.exe
(Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AthBtTray.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(SlySoft, Inc.) C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe
(PeerBlock, LLC) C:\Program Files\PeerBlock\peerblock.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Alcor Micro Corp.) C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe
(SlySoft, Inc.) C:\Program Files (x86)\SlySoft\CloneCD\CloneCDTray.exe
(CHENGDU YIWO Tech Development Co., Ltd) C:\Program Files (x86)\EaseUS\Todo Backup\bin\EuWatch.exe
(CHENGDU YIWO Tech Development Co., Ltd) C:\Program Files (x86)\EaseUS\Todo Backup\bin\TrayNotify.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(BonSoft) C:\Program Files (x86)\ClocX\ClocX.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
() C:\Users\Bob\AppData\Local\TVersity\Media Server\MediaServer.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Atheros) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\Ath_CoexAgent.exe
(Atheros) C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Oracle Corporation) C:\Windows\System32\java.exe
() C:\Program Files (x86)\SlySoft\AnyDVD\ADvdDiscHlp64.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Windows\System32\vds.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_x64.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Dell Inc.) C:\Program Files\Dell\DellDataVault\DellDataVaultWiz.exe
(Dell Products, LP.) C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Dell, Inc.) C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe
(Dell, Inc.) C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
(Azureus Software, Inc) C:\Program Files\Vuze\Azureus.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe [1014432 2011-12-29] (Atheros Commnucations)
HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AthBtTray.exe [800416 2011-12-29] (Atheros Commnucations)
HKLM\...\Run: [LogMeIn GUI] => C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe [57928 2012-04-02] (LogMeIn, Inc.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6457960 2011-12-23] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1156712 2011-11-15] (Realtek Semiconductor)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-17] (Intel Corporation)
HKLM-x32\...\Run: [ShwiconXP9106] => C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe [237568 2010-03-10] (Alcor Micro Corp.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40336 2014-12-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [CloneCDTray] => C:\Program Files (x86)\SlySoft\CloneCD\CloneCDTray.exe [57344 2009-01-29] (SlySoft, Inc.)
HKLM-x32\...\Run: [StartCCC] => "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
HKLM-x32\...\Run: [EaseUs Watch] => C:\Program Files (x86)\EaseUS\Todo Backup\bin\EuWatch.exe [70728 2012-10-19] (CHENGDU YIWO Tech Development Co., Ltd)
HKLM-x32\...\Run: [EaseUs Tray] => C:\Program Files (x86)\EaseUS\Todo Backup\bin\TrayNotify.exe [1315400 2012-10-30] (CHENGDU YIWO Tech Development Co., Ltd)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [3825176 2012-11-13] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [ClocX] => C:\Program Files (x86)\ClocX\ClocX.exe [2090496 2013-01-14] (BonSoft)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3710416 2015-02-10] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM-x32\...\RunOnce: [SpybotDeletingE5894] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDDelFile.exe [2710040 2012-11-13] (Safer-Networking Ltd.)
Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist\615\G2AWinLogon_x64.dll (Citrix Online, a division of Citrix Systems, Inc.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [AnyDVD] => C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVD.exe [109480 2014-10-01] (SlySoft, Inc.)
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3671872 2012-04-17] (DT Soft Ltd)
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [Uploader] => C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [Akamai NetSession Interface] => "C:\Users\Bob\AppData\Local\Akamai\netsession_win.exe"
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [3713032 2012-11-13] (Safer-Networking Ltd.)
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [BackupAgent] => C:\Program Files (x86)\Strongvault Online Backup\BackupAgent.exe
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [AVG-Secure-Search-Update_1113a] => C:\Users\Bob\AppData\Roaming\AVG 1113a Campaign\AVG-Secure-Search-Update-1113a.exe /PROMPT /mid=5ad4700098c147d094cad9a4fffc1f77-2ea2192f08b55d83378acdbfcabd2c8082d55b47 /CMPID=1113a
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [Startup Guard] => C:\Program Files (x86)\AceLogix\StartupGuard\sg.exe
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [Ogcics] => C:\Windows\SysWOW64\regsvr32.exe C:\Users\Bob\AppData\Local\YkhxPack\enhance.DLL
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [PeerBlock] => C:\Program Files\PeerBlock\peerblock.exe [2513992 2014-01-14] (PeerBlock, LLC)
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [UTRmedia Update] => regsvr32.exe C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\RunOnce: [SpybotDeletingF6781] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDDelFile.exe [2710040 2012-11-13] (Safer-Networking Ltd.)
Startup: C:\Users\Bob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
ShortcutTarget: ERUNT AutoBackup.lnk -> C:\erunt\AUTOBACK.EXE ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {39181C36-2062-47D0-8E6A-A5AD85BFE5CE} URL = http://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDR&src=IE-SearchBox
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-472848371-1800496413-3629884572-1000 -> DefaultScope {891988CF-5E9A-48B7-BF5A-AD0F69377215} URL = https://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=994519&p={searchTerms}
SearchScopes: HKU\S-1-5-21-472848371-1800496413-3629884572-1000 -> {284A85DF-5D3B-41C0-A726-2784FE1B9D46} URL = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=902615&p={searchTerms}
SearchScopes: HKU\S-1-5-21-472848371-1800496413-3629884572-1000 -> {891988CF-5E9A-48B7-BF5A-AD0F69377215} URL = https://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=994519&p={searchTerms}
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HelperObject Class -> {00C6482D-C502-44C8-8409-FCE54AD9C208} -> C:\Program Files (x86)\TechSmith\SnagIt 7\SnagItBHO.dll No File
BHO-x32: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files (x86)\TechSmith\SnagIt 7\SnagItIEAddin.dll No File
DPF: HKLM-x32 {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} https://support.dell.com/systemprofiler/SysProExe.CAB
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab
DPF: HKLM-x32 {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://tradestation.webex.com/client/T28L/support/ieatgpc1.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{2302EFEB-46FF-44DA-B395-050DF3CBC43E}: [NameServer] 8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{2E77CA47-D0F3-4DBE-9281-32D604AB6FEB}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{7B72D672-3F7B-4E44-AA6C-CE4D9E4AEBAA}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{C1C7CCE8-4CDD-4ADA-A0A7-EA9E70E0BAF2}: [NameServer] 8.8.8.8,8.8.8.8

FireFox:
========
FF ProfilePath: C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\tjg3rdx3.default
FF DefaultSearchEngine: Google
FF Homepage: hxxp://loadmovie.biz/
FF Keyword.URL:
FF NetworkProxy: "http", "127.0.0.1"
FF NetworkProxy: "http_port", 4444
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.31211.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1205146.dll (Adobe Systems, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.31211.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-472848371-1800496413-3629884572-1000: @citrixonline.com/appdetectorplugin -> C:\Users\Bob\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Bob\AppData\Roaming\mozilla\plugins\npatgpc.dll (Cisco WebEx LLC)
FF Extension: FoxyProxy Standard - C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\tjg3rdx3.default\Extensions\foxyproxy@eric.h.jung [2015-02-05]
FF Extension: DownloadHelper - C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\tjg3rdx3.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-09-06]
FF Extension: Antmark extensions - C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\tjg3rdx3.default\Extensions\antmark@ant.com.xpi [2014-08-03]
FF Extension: DownThemAll! - C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\tjg3rdx3.default\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2013-03-18]

Chrome:
=======
CHR Profile: C:\Users\Bob\AppData\Local\Google\Chrome\User Data\Default

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AtherosSvc; C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe [106144 2011-12-29] (Atheros Commnucations) [File not signed]
S2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3411408 2015-02-10] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [308720 2015-02-10] (AVG Technologies CZ, s.r.o.)
S2 DellDataVault; C:\Program Files\Dell\DellDataVault\DellDataVault.exe [2552528 2015-01-30] (Dell Inc.)
R2 DellDataVaultWiz; C:\Program Files\Dell\DellDataVault\DellDataVaultWiz.exe [201424 2015-01-30] (Dell Inc.)
R2 EaseUS Agent; C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe [69192 2012-10-30] (CHENGDU YIWO Tech Development Co., Ltd) [File not signed]
R2 Guard Agent; C:\Program Files (x86)\EaseUS\Todo Backup\bin\GuardAgent.exe [23624 2012-10-19] (CHENGDU YIWO Tech Development Co., Ltd) [File not signed]
R2 i2p; C:\Program Files\i2p\I2Psvc.exe [431104 2014-12-11] (Tanuki Software, Ltd.) [File not signed]
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128280 2012-01-21] ()
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [377704 2015-01-27] (LogMeIn, Inc.)
R2 LMIMaint; C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe [226152 2015-01-27] (LogMeIn, Inc.)
R2 LogMeIn; C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe [407424 2012-04-02] (LogMeIn, Inc.)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1103392 2012-11-13] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1369624 2012-11-13] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [168384 2012-11-13] (Safer-Networking Ltd.)
R2 SiteVaultPro; C:\SiteVaultPro\SvPro.exe [950032 2012-06-18] ()
S2 SupportAssistAgent; C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe [19288 2015-02-19] (Dell Inc.)
R2 TVersityMediaServer; C:\Users\Bob\AppData\Local\TVersity\Media Server\MediaServer.exe [880640 2010-07-12] () [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)
R2 ZAtheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\Ath_CoexAgent.exe [158880 2011-12-29] (Atheros) [File not signed]
R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe [76960 2011-12-26] (Atheros) [File not signed]
S2 vToolbarUpdater15.4.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [138664 2014-04-24] (SlySoft, Inc.)
R3 AnyDVD; C:\Windows\SysWOW64\Drivers\AnyDVD.sys [138664 2014-04-24] (SlySoft, Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [270816 2015-02-10] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [203544 2014-11-18] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [243480 2014-08-28] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [341472 2015-02-03] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [133088 2015-01-23] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [284128 2015-01-16] (AVG Technologies CZ, s.r.o.)
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [50976 2014-10-28] (AVG Technologies)
R3 DDDriver; C:\Windows\System32\drivers\DDDriver64Dcsa.sys [23760 2015-01-30] (Dell Computer Corporation)
R3 DellProf; C:\Windows\System32\drivers\DellProf.sys [23312 2015-01-30] (Dell Computer Corporation)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-05-26] (DT Soft Ltd)
R3 ElbyCDFL; C:\Windows\System32\Drivers\ElbyCDFL.sys [40648 2007-02-15] (SlySoft, Inc.)
R3 ElbyCDFL; C:\Windows\SysWOW64\Drivers\ElbyCDFL.sys [40648 2007-02-15] (SlySoft, Inc.)
R0 EUBAKUP; C:\Windows\System32\drivers\eubakup.sys [58952 2012-10-19] (CHENGDU YIWO Tech Development Co., Ltd) [File not signed]
R0 EUBKMON; C:\Windows\System32\drivers\EUBKMON.sys [48200 2012-10-19] () [File not signed]
R1 EUDSKACS; C:\Windows\system32\drivers\eudskacs.sys [18504 2012-10-19] (CHENGDU YIWO Tech Development Co., Ltd) [File not signed]
R1 EUFDDISK; C:\Windows\system32\drivers\EuFdDisk.sys [189000 2012-10-19] (CHENGDU YIWO Tech Development Co., Ltd) [File not signed]
R2 LMIInfo; C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [16056 2013-05-27] (LogMeIn, Inc.)
S4 LMIRfsClientNP; No ImagePath
R3 pbfilter; C:\Program Files\PeerBlock\pbfilter.sys [22600 2014-01-14] ()
S3 pmxdrv; C:\Windows\system32\drivers\pmxdrv.sys [31152 2012-12-14] ()
R0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [21184 2014-06-04] (IObit)
R3 TotRec8; C:\Windows\system32\drivers\TotRec8.sys [123120 2011-12-14] (High Criteria inc.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-24 05:31 - 2015-02-24 05:31 - 00000000 ___RD () C:\Users\Bob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2015-02-24 05:27 - 2015-02-24 05:27 - 00001116 _____ () C:\FixitRegBackup.reg
2015-02-23 12:24 - 2015-02-23 12:26 - 00000000 ____D () C:\Users\Bob\AppData\Roaming\PCDr
2015-02-23 12:23 - 2015-02-23 12:23 - 00000000 ____D () C:\ProgramData\PCDr
2015-02-23 12:10 - 2015-02-23 15:54 - 00006678 _____ () C:\Users\Bob\Desktop\MB.txt
2015-02-23 10:23 - 2015-02-23 10:23 - 00448512 _____ (OldTimer Tools) C:\Users\Bob\Desktop\TFC.exe
2015-02-23 09:38 - 2015-02-23 09:38 - 00001378 _____ () C:\Users\Bob\Desktop\JRT.txt
2015-02-23 09:30 - 2015-02-23 09:30 - 00006997 _____ () C:\Users\Bob\Desktop\AdwCleaner[S0].txt
2015-02-23 09:24 - 2015-02-23 09:26 - 00000000 ____D () C:\AdwCleaner
2015-02-23 09:00 - 2015-02-23 09:00 - 00000000 ____D () C:\Users\Bob\Desktop\FRST-OlderVersion
2015-02-22 19:21 - 2015-02-22 19:21 - 00000761 _____ () C:\Windows\system32\Drivers\etc\hosts.txt
2015-02-19 08:34 - 2015-02-19 08:34 - 00044075 _____ () C:\Users\Bob\Desktop\Addition.txt
2015-02-19 08:31 - 2015-02-24 06:30 - 00024969 _____ () C:\Users\Bob\Desktop\FRST.txt
2015-02-19 08:30 - 2015-02-24 06:30 - 00000000 ____D () C:\FRST
2015-02-19 08:29 - 2015-02-23 09:00 - 02087424 _____ (Farbar) C:\Users\Bob\Desktop\FRST64.exe
2015-02-19 08:28 - 2015-02-19 08:28 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-XPS8500-Windows-7-Home-Premium-(64-bit).dat
2015-02-19 08:26 - 2015-02-19 08:26 - 00000000 ____D () C:\RegBackup
2015-02-19 08:25 - 2015-02-19 08:25 - 00002270 _____ () C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
2015-02-19 08:25 - 2015-02-19 08:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2015-02-19 08:25 - 2015-02-19 08:25 - 00000000 ____D () C:\Program Files (x86)\Tweaking.com
2015-02-19 08:24 - 2015-02-19 08:24 - 04804736 _____ () C:\Users\Bob\Desktop\tweaking.com_registry_backup_setup.exe
2015-02-17 18:21 - 2015-02-17 18:21 - 00001771 _____ () C:\Users\Bob\Desktop\PeerBlock.lnk
2015-02-17 18:21 - 2015-02-17 18:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PeerBlock
2015-02-17 10:55 - 2015-01-08 21:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll
2015-02-17 10:55 - 2015-01-08 21:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll
2015-02-17 10:55 - 2015-01-08 21:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll
2015-02-17 10:55 - 2015-01-08 20:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll
2015-02-17 09:38 - 2015-02-17 09:38 - 00000000 ____D () C:\Program Files (x86)\AMD APP
2015-02-17 09:36 - 2015-02-17 09:36 - 226727176 _____ (Dell Inc.) C:\Users\Bob\Desktop\Video_Driver_PCWM7_WN_8.982.12-MUP2.3_A00.EXE
2015-02-17 09:36 - 2015-02-17 09:36 - 00000000 ____D () C:\Users\Bob\AppData\Local\Dell
2015-02-17 08:11 - 2015-02-24 05:30 - 00003920 _____ () C:\Windows\setupact.log
2015-02-17 08:11 - 2015-02-17 08:11 - 00374552 _____ () C:\Windows\Minidump\021715-64865-01.dmp
2015-02-16 19:22 - 2015-02-16 19:23 - 01047584 _____ () C:\Windows\Minidump\021615-34055-01.dmp
2015-02-16 18:51 - 2015-02-23 12:12 - 00000000 ____D () C:\Users\Bob\AppData\Local\YkhxPack
2015-02-16 18:51 - 2015-02-23 12:12 - 00000000 ____D () C:\Users\Bob\AppData\Local\UTRmedia
2015-02-16 18:51 - 2015-02-16 18:51 - 13762592 _____ (Media Player - Codec Pack) C:\Users\Bob\Desktop\media.player.codec.pack.lite.v4.3.5.setup.exe
2015-02-15 04:46 - 2015-02-15 04:46 - 00374184 _____ () C:\Windows\Minidump\021515-44881-01.dmp
2015-02-12 12:38 - 2015-02-19 20:58 - 00000426 _____ () C:\Windows\Tasks\Dell SupportAssistAgent AutoUpdate.job
2015-02-12 12:38 - 2015-02-12 12:38 - 00003224 _____ () C:\Windows\System32\Tasks\Dell SupportAssistAgent AutoUpdate
2015-02-12 12:38 - 2015-02-12 12:38 - 00000000 __HDC () C:\ProgramData\{7417E72F-E156-403E-9DFA-EB0ED1DB06F1}
2015-02-12 12:36 - 2015-02-12 20:58 - 00000000 ____D () C:\ProgramData\SupportAssistAgent
2015-02-12 12:17 - 2015-01-22 22:42 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-02-12 12:17 - 2015-01-22 22:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-12 12:17 - 2015-01-22 21:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-02-12 12:17 - 2015-01-22 21:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-02-11 09:07 - 2015-02-23 12:24 - 00003484 _____ () C:\Windows\System32\Tasks\PCDEventLauncherTask
2015-02-11 09:07 - 2015-02-11 09:07 - 00004024 _____ () C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask
2015-02-11 09:07 - 2015-02-11 09:07 - 00003212 _____ () C:\Windows\System32\Tasks\SystemToolsDailyTest
2015-02-11 09:07 - 2015-02-11 09:07 - 00000000 ____D () C:\ProgramData\PC-Doctor for Windows
2015-02-11 09:07 - 2015-02-11 09:07 - 00000000 ____D () C:\Program Files\Dell Support Center
2015-02-11 09:06 - 2015-02-12 12:38 - 00000000 ____D () C:\Program Files\Dell
2015-02-11 03:37 - 2015-01-14 00:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-11 03:37 - 2015-01-14 00:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-02-11 03:37 - 2015-01-14 00:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-02-11 03:37 - 2015-01-14 00:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-02-11 03:37 - 2015-01-13 23:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-02-11 03:37 - 2015-01-13 23:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-02-11 03:37 - 2015-01-13 23:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-02-11 03:37 - 2014-12-11 23:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-02-11 03:37 - 2014-12-11 23:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-02-11 03:37 - 2014-07-06 20:07 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-02-11 03:37 - 2014-07-06 20:06 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-02-11 03:37 - 2014-07-06 19:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-02-11 03:37 - 2014-07-06 19:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-02-11 03:36 - 2015-02-03 21:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-02-11 03:36 - 2015-02-03 21:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-02-11 03:36 - 2015-02-03 21:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-02-11 03:36 - 2015-02-03 21:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-02-11 03:36 - 2015-02-03 21:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-02-11 03:36 - 2015-02-03 21:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-02-11 03:36 - 2015-02-03 21:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-02-11 03:36 - 2015-01-27 17:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2015-02-11 03:36 - 2015-01-13 23:47 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-11 03:36 - 2015-01-13 23:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-02-11 03:36 - 2015-01-11 21:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-11 03:36 - 2015-01-11 21:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-02-11 03:36 - 2015-01-11 21:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-02-11 03:36 - 2015-01-11 20:49 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-02-11 03:36 - 2015-01-11 20:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-11 03:36 - 2015-01-11 20:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-11 03:36 - 2015-01-11 20:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-02-11 03:36 - 2015-01-11 20:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-02-11 03:36 - 2015-01-11 20:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-02-11 03:36 - 2015-01-11 20:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-02-11 03:36 - 2015-01-11 20:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-02-11 03:36 - 2015-01-11 20:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-02-11 03:36 - 2015-01-11 20:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-02-11 03:36 - 2015-01-11 20:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-02-11 03:36 - 2015-01-11 20:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-02-11 03:36 - 2015-01-11 20:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-02-11 03:36 - 2015-01-11 20:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-11 03:36 - 2015-01-11 20:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-02-11 03:36 - 2015-01-11 20:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-02-11 03:36 - 2015-01-11 20:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-02-11 03:36 - 2015-01-11 20:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-11 03:36 - 2015-01-11 20:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-02-11 03:36 - 2015-01-11 20:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-02-11 03:36 - 2015-01-11 20:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-02-11 03:36 - 2015-01-11 20:04 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-02-11 03:36 - 2015-01-11 20:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-02-11 03:36 - 2015-01-11 20:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-02-11 03:36 - 2015-01-11 19:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-02-11 03:36 - 2015-01-11 19:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-02-11 03:36 - 2015-01-11 19:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-02-11 03:36 - 2015-01-11 19:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-11 03:36 - 2015-01-11 19:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-11 03:36 - 2015-01-11 19:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-11 03:36 - 2015-01-11 19:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-02-11 03:36 - 2015-01-11 19:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-02-11 03:36 - 2015-01-11 19:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-11 03:36 - 2015-01-11 19:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-02-11 03:36 - 2015-01-11 19:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-02-11 03:36 - 2015-01-11 19:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-02-11 03:36 - 2015-01-11 19:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-02-11 03:36 - 2015-01-11 19:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-11 03:36 - 2015-01-11 19:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-02-11 03:36 - 2015-01-11 19:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-02-11 03:36 - 2015-01-11 19:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-02-11 03:36 - 2015-01-11 19:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-02-11 03:36 - 2015-01-11 19:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-11 03:36 - 2015-01-11 19:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-11 03:36 - 2015-01-11 19:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-02-11 03:36 - 2015-01-11 18:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-02-11 03:36 - 2015-01-11 18:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-02-11 03:26 - 2015-01-10 00:48 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-02-11 03:26 - 2015-01-10 00:48 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-02-11 03:26 - 2015-01-10 00:48 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-02-11 03:26 - 2015-01-10 00:48 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-02-11 03:26 - 2015-01-10 00:48 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-02-11 03:26 - 2015-01-10 00:48 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-02-11 03:26 - 2015-01-10 00:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-02-11 03:26 - 2015-01-10 00:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-02-11 03:26 - 2015-01-10 00:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-02-11 03:26 - 2015-01-10 00:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-02-11 03:26 - 2015-01-10 00:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-02-11 03:26 - 2015-01-10 00:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-02-11 03:26 - 2015-01-10 00:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-02-11 03:26 - 2015-01-10 00:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-02-11 03:11 - 2015-01-15 02:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-11 03:11 - 2015-01-15 02:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-02-11 03:11 - 2015-01-15 02:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-02-11 03:11 - 2015-01-15 02:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-02-11 03:11 - 2015-01-15 02:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-02-11 03:11 - 2015-01-15 02:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-02-11 03:11 - 2015-01-15 02:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-02-11 03:11 - 2015-01-15 02:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-02-11 03:11 - 2015-01-15 02:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-02-11 03:11 - 2015-01-15 02:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-02-11 03:11 - 2015-01-15 02:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-02-11 03:11 - 2015-01-15 01:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-02-11 03:11 - 2015-01-15 01:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-02-11 03:11 - 2015-01-15 01:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-02-11 03:11 - 2015-01-15 01:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-02-11 03:11 - 2015-01-15 01:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-02-11 03:11 - 2015-01-15 01:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-02-11 03:11 - 2015-01-14 22:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-11 02:25 - 2015-01-12 21:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-11 02:25 - 2015-01-12 20:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-02-11 01:16 - 2015-01-08 20:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-11 00:41 - 2014-11-25 21:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-11 00:41 - 2014-11-25 21:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-11 00:30 - 2014-12-07 21:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-11 00:30 - 2014-12-07 20:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-02-10 16:48 - 2015-02-10 16:48 - 00270816 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsdrivera.sys
2015-02-07 09:52 - 2015-02-24 05:32 - 00000000 ____D () C:\Program Files\PeerBlock
2015-02-03 10:47 - 2015-02-03 10:47 - 00341472 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgloga.sys
2015-01-30 16:36 - 2015-01-30 16:36 - 00023760 _____ (Dell Computer Corporation) C:\Windows\system32\Drivers\DDDriver64Dcsa.sys
2015-01-30 16:36 - 2015-01-30 16:36 - 00023312 _____ (Dell Computer Corporation) C:\Windows\system32\Drivers\DellProf.sys
2015-01-27 05:46 - 2015-01-27 05:46 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-24 06:31 - 2014-06-08 08:48 - 00000000 ____D () C:\Users\Bob\AppData\Roaming\Azureus
2015-02-24 06:24 - 2012-05-09 15:40 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-24 06:22 - 2012-05-25 06:21 - 00000000 ____D () C:\Movies
2015-02-24 05:53 - 2012-06-02 18:08 - 00000000 ____D () C:\Users\Bob\AppData\Roaming\vlc
2015-02-24 05:39 - 2012-05-28 09:05 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-24 05:39 - 2009-07-13 22:45 - 00028352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-24 05:39 - 2009-07-13 22:45 - 00028352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-24 05:37 - 2014-07-23 15:55 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-24 05:35 - 2012-05-09 15:38 - 01155454 _____ () C:\Windows\WindowsUpdate.log
2015-02-24 05:34 - 2013-08-05 15:51 - 00000000 ____D () C:\ProgramData\boost_interprocess
2015-02-24 05:31 - 2014-12-11 18:25 - 00000000 ____D () C:\ProgramData\i2p
2015-02-24 05:31 - 2014-01-23 07:46 - 00001039 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Client.lnk
2015-02-24 05:31 - 2014-01-23 07:46 - 00001023 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Control Panel.lnk
2015-02-24 05:30 - 2012-05-28 09:05 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-24 05:30 - 2012-05-09 15:53 - 00000828 _____ () C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
2015-02-24 05:30 - 2009-07-13 23:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-24 05:26 - 2012-05-24 20:30 - 00000000 ___RD () C:\Junk
2015-02-24 05:21 - 2012-05-25 17:52 - 00000000 ____D () C:\ProgramData\MFAData
2015-02-24 05:19 - 2014-12-11 18:25 - 00000000 ____D () C:\Program Files\i2p
2015-02-24 05:18 - 2012-05-30 09:46 - 00000000 ____D () C:\ProgramData\LogMeIn
2015-02-23 17:38 - 2012-05-25 14:00 - 00000000 ____D () C:\Users\Bob\AppData\Roaming\FileZilla
2015-02-23 17:34 - 2012-07-13 17:04 - 00000000 ____D () C:\Omega
2015-02-23 17:17 - 2012-05-09 15:53 - 00000830 _____ () C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job
2015-02-23 15:55 - 2010-11-20 21:47 - 00473524 _____ () C:\Windows\PFRO.log
2015-02-23 15:44 - 2013-02-01 09:03 - 00000594 _____ () C:\Windows\Tasks\TradeStation Backup - Daily.job
2015-02-23 15:38 - 2012-05-24 20:13 - 00000000 ____D () C:\Program Files (x86)\Tradestation Archives
2015-02-23 15:38 - 2012-05-24 16:26 - 00001508 _____ () C:\Windows\DYNAZIP.LOG
2015-02-23 10:37 - 2009-07-13 23:08 - 00032556 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-02-23 09:33 - 2013-08-05 15:55 - 01388274 _____ (Thisisu) C:\Users\Bob\Desktop\JRT.exe
2015-02-23 09:28 - 2014-10-28 04:55 - 00000000 ____D () C:\Users\Bob\AppData\Local\AVG SafeGuard toolbar
2015-02-23 09:22 - 2013-08-05 15:47 - 02126848 _____ () C:\Users\Bob\Desktop\AdwCleaner.exe
2015-02-23 06:33 - 2012-08-22 06:03 - 00000000 ____D () C:\Jts
2015-02-23 06:21 - 2013-01-28 07:30 - 00000000 ____D () C:\Users\Mcx1-XPS8500
2015-02-21 08:47 - 2014-10-20 05:40 - 00001000 _____ () C:\Users\Public\Desktop\AVG 2015.lnk
2015-02-21 08:47 - 2014-03-31 07:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2015-02-19 11:04 - 2012-11-15 11:04 - 00010331 _____ () C:\Users\Bob\Desktop\aswMBR.txt
2015-02-19 11:04 - 2012-11-15 11:04 - 00000512 _____ () C:\Users\Bob\Desktop\MBR.dat
2015-02-19 08:35 - 2012-11-15 10:59 - 05198336 _____ (AVAST Software) C:\Users\Bob\Desktop\aswMBR.exe
2015-02-19 08:20 - 2012-12-04 18:45 - 00467456 ___SH () C:\EUMONBMP.SYS
2015-02-19 06:03 - 2012-05-30 14:11 - 00000000 ____D () C:\Users\Bob\AppData\Local\CrashDumps
2015-02-18 06:01 - 2013-01-24 14:15 - 00000000 ____D () C:\Users\Bob\AppData\Roaming\HandBrake
2015-02-17 14:53 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\tracing
2015-02-17 08:11 - 2014-02-27 07:03 - 00000000 ____D () C:\Windows\Minidump
2015-02-17 07:34 - 2012-05-24 16:03 - 00000000 ____D () C:\Users\Bob
2015-02-17 07:16 - 2013-03-09 06:04 - 00000000 ____D () C:\Users\Bob\AppData\Roaming\IObit
2015-02-17 07:16 - 2012-05-09 16:20 - 00000000 ____D () C:\ProgramData\Atheros
2015-02-17 07:16 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\registration
2015-02-14 17:26 - 2012-05-29 11:05 - 00000000 ____D () C:\ADE
2015-02-14 09:27 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\rescache
2015-02-12 12:36 - 2012-05-09 16:07 - 00000000 ____D () C:\Program Files (x86)\Dell
2015-02-12 09:01 - 2014-01-20 06:22 - 00001137 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 9.lnk
2015-02-12 09:01 - 2014-01-20 06:22 - 00001125 _____ () C:\Users\Public\Desktop\TeamViewer 9.lnk
2015-02-12 04:47 - 2014-12-10 06:01 - 00000000 ____D () C:\Windows\system32\appraiser
2015-02-12 04:47 - 2014-05-07 02:00 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-02-11 22:16 - 2013-07-16 20:27 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-11 22:12 - 2012-05-24 16:46 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-02-11 09:07 - 2012-05-09 15:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell
2015-02-11 03:22 - 2009-07-13 22:45 - 00292464 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-11 03:03 - 2013-09-28 10:32 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-08 21:30 - 2009-07-13 23:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2015-02-08 15:15 - 2009-07-13 22:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-02-05 17:34 - 2012-05-28 09:05 - 00003894 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-05 17:34 - 2012-05-28 09:05 - 00003642 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-05 12:24 - 2012-05-09 15:40 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-05 12:24 - 2012-05-09 15:40 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-05 12:24 - 2012-05-09 15:40 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-29 05:20 - 2012-05-25 13:19 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-27 19:54 - 2012-05-30 09:46 - 00000000 ____D () C:\Program Files (x86)\LogMeIn
2015-01-27 19:53 - 2012-05-30 09:46 - 00107392 _____ (LogMeIn, Inc.) C:\Windows\system32\LMIRfsClientNP.dll
2015-01-27 19:53 - 2012-05-30 09:46 - 00092520 _____ (LogMeIn, Inc.) C:\Windows\system32\LMIinit.dll
2015-01-27 19:53 - 2012-05-30 09:46 - 00035688 _____ (LogMeIn, Inc.) C:\Windows\system32\LMIport.dll
2015-01-26 05:20 - 2014-01-08 06:12 - 00000000 ____D () C:\Users\Bob\dwhelper

==================== Files in the root of some directories =======

2013-06-26 15:09 - 2013-07-30 05:10 - 0003715 _____ () C:\Program Files (x86)\Mozilla Firefoxavg-secure-search.xml
2012-11-14 13:52 - 2012-11-14 13:52 - 0000124 _____ () C:\Users\Bob\AppData\Roaming\-941824844
2012-05-24 20:23 - 2012-12-15 05:57 - 0000320 _____ () C:\Users\Bob\AppData\Roaming\SEC410057.trad
2013-02-24 10:05 - 2013-05-09 15:55 - 0009216 _____ () C:\Users\Bob\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-05-26 10:02 - 2014-02-17 18:30 - 0000083 ___SH () C:\ProgramData\.zreglib
2012-05-25 17:18 - 2012-05-25 17:18 - 0000113 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
2012-05-25 13:38 - 2012-05-25 13:38 - 0000115 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.64.bc

Some content of TEMP:
====================
C:\Users\Bob\AppData\Local\Temp\i4jdel0.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-23 18:09

==================== End Of Log ============================




Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-02-2015
Ran by Bob at 2015-02-24 06:31:40
Running from C:\Users\Bob\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: AVG AntiVirus Free Edition 2015 (Disabled - Up to date) {4D41356F-32AD-7C42-C820-63775EE4F413}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: AVG AntiVirus Free Edition 2015 (Disabled - Up to date) {F620D48B-1497-73CC-F290-58052563BEAE}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

.NET Reflector Desktop (HKLM-x32\...\{21C448B9-5137-49F3-B364-270E3C88124A}) (Version: 7.6.0.808 - Red Gate Software Ltd)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader X (10.1.13) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.5.146 - Adobe Systems, Inc.)
Amazon Kindle (HKLM-x32\...\Amazon Kindle) (Version: - Amazon)
AMD Catalyst Install Manager (HKLM\...\{A8BBDD74-6FF7-E9D1-4301-52C37371913D}) (Version: 8.0.881.0 - Advanced Micro Devices, Inc.)
Any Video Converter 3.3.9 (HKLM-x32\...\Any Video Converter_is1) (Version: - Any-Video-Converter.com)
AnyDVD (HKLM-x32\...\AnyDVD) (Version: 7.5.2.0 - SlySoft)
Atheros Bluetooth Suite (64) (HKLM\...\{230D1595-57DA-4933-8C4E-375797EBB7E1}) (Version: 7.4.0.115 - Atheros)
Audacity 2.0.2 (HKLM-x32\...\Audacity_is1) (Version: 2.0.2 - Audacity Team)
AVG 2015 (HKLM\...\AVG) (Version: 2015.0.5736 - AVG Technologies)
AVG 2015 (Version: 15.0.4293 - AVG Technologies) Hidden
AVG 2015 (Version: 15.0.5736 - AVG Technologies) Hidden
Camtasia Studio 8 (HKLM-x32\...\{DB93E2C2-851F-44B2-B09C-351D2C624AE1}) (Version: 8.0.4.1060 - TechSmith Corporation)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Cisco WebEx Meetings (HKLM-x32\...\ActiveTouchMeetingClient) (Version: - Cisco WebEx LLC)
CliSecure 5.2 (HKLM-x32\...\{03CA4929-2B86-4159-A71D-437039B609D1}_is1) (Version: - SecureTeam Software Ltd.)
ClocX (1.6.0) (HKLM-x32\...\ClocX) (Version: - )
CloneCD (HKLM-x32\...\CloneCD) (Version: - SlySoft)
CloneDVD2 (HKLM-x32\...\CloneDVD2) (Version: 2.9.3.0 - Elaborate Bytes)
Consumer In-Home Service Agreement (HKLM-x32\...\{F47C37A4-7189-430A-B81D-739FF8A7A554}) (Version: 2.0.0 - Dell Inc.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.45.4.0315 - DT Soft Ltd)
Dell Data Vault (Version: 4.1.9.0 - Dell Inc.) Hidden
Dell DataSafe Local Backup - Support Software (HKLM-x32\...\{A9668246-FB70-4103-A1E3-66C9BC2EFB49}) (Version: 9.4.67 - Dell Inc.)
Dell DataSafe Local Backup (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 9.4.67 - Dell Inc.)
Dell DataSafe Online (HKLM-x32\...\{C53BCCBE-9268-4C09-82E9-611444A73B3F}) (Version: 2.10.1.3 - Dell)
Dell Digital Delivery (HKLM-x32\...\{BC8233D8-59BA-4D40-92B9-4FDE7452AA8B}) (Version: 3.0.3999.0 - Dell Products, LP)
Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)
Dell SupportAssist (HKLM\...\PC-Doctor for Windows) (Version: 1.0.6584.52 - Dell)
Dell SupportAssistAgent (HKLM-x32\...\{287348C8-8B47-4C36-AF28-441A3B7D8722}) (Version: 1.0.1.56462 - Dell)
Dell WLAN and Bluetooth Client Installation (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 9.0 - Dell Inc.)
DriverMax 6 (HKLM-x32\...\DMX5_is1) (Version: 6.31.0.325 - Innovative Solutions)
DVD Flick 1.3.0.7 (HKLM-x32\...\DVD Flick_is1) (Version: 1.3.0.7 - Dennis Meuwissen)
EaseUS Todo Backup Free 5.3 (HKLM-x32\...\EaseUS Todo Backup Free 5.3_is1) (Version: 5.3 - CHENGDU YIWO Tech Development Co., Ltd)
EPSON Printer Software (HKLM\...\EPSON Printer and Utilities) (Version: - SEIKO EPSON Corporation)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - )
ERUNT 1.1j (HKLM-x32\...\ERUNT_is1) (Version: - Lars Hederer)
EVEREST Corporate Edition v5.50 (HKLM-x32\...\EVEREST Corporate Edition_is1) (Version: 5.50 - Lavalys, Inc.)
ffdshow v1.2.4499 [2013-01-04] (HKLM-x32\...\ffdshow_is1) (Version: 1.2.4499.0 - )
FileZilla Client 3.6.0.2 (HKLM-x32\...\FileZilla Client) (Version: 3.6.0.2 - FileZilla Project)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
GoToAssist Corporate (HKLM-x32\...\GoToAssist) (Version: 9.1.0.615 - Citrix Online, a division of Citrix Systems, Inc.)
GoToMeeting 5.5.0.1133 (HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\GoToMeeting) (Version: 5.5.0.1133 - CitrixOnline)
HandBrake 0.9.8 (HKLM-x32\...\HandBrake) (Version: 0.9.8 - )
Hubert Senters Bond Breakout 1.2 (HKLM-x32\...\Hubert Senters Bond Breakout_is1) (Version: - Senters Group, LLC)
Hubert Senters Climactic Volume 1.0 (HKLM-x32\...\Hubert Senters Climactic Volume (for NT7)_is1) (Version: - hubertsenters.com)
Hubert Senters Climactic Volume 1.0 (HKLM-x32\...\Hubert Senters Climactic Volume_is1) (Version: - Senters Group, LLC)
Hubert Senters Climactic Volume 1.1 (HKLM-x32\...\Hubert Senters Climactic Volume for Sierra Charts_is1) (Version: - Senters Group, LLC)
Hubert Senters Climactic Volume for MultiCharts (HKLM-x32\...\Hubert Senters Climactic Volume (MultiCharts)_is1) (Version: - Senters Group, LLC)
Hubert Senters Gold Rush 1.0 (HKLM-x32\...\Hubert Senters Gold Rush_is1) (Version: - Senters Group, LLC)
Hubert Senters Gold Spike 1.0 (HKLM-x32\...\Hubert Senters Gold Spike_is1) (Version: - Senters Group, LLC)
Hubert Senters Good Night Gold 1.0 (HKLM-x32\...\Hubert Senters Good Night Gold_is1) (Version: - Senters Group, LLC)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Manageability Engine Firmware Recovery Agent (HKLM-x32\...\{A6C48A9F-694A-4234-B3AA-62590B668927}) (Version: 1.0.0.35342 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.1.1399 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.0.0.1032 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.3.214 - Intel Corporation)
Intel® Trusted Connect Service Client (HKLM\...\{538B98C3-773F-4F20-9C66-802D104DCBE2}) (Version: 1.23.219.2 - Intel Corporation)
IObit Apps Toolbar v7.0 (HKLM-x32\...\{4ED7341F-1942-4623-A27C-9C4F3838172F}) (Version: 7.0 - Spigot, Inc.) <==== ATTENTION
Jasc Animation Shop 3 (HKLM-x32\...\{7C4196CA-CA41-4F34-9C08-7724E7705D52}) (Version: 3.11 - Jasc Software Inc)
Jasc Paint Shop Pro 9 (HKLM-x32\...\{F843C6A3-224D-4615-94F8-3C461BD9AEA0}) (Version: 9.00.0000 - Jasc Software Inc)
Java 7 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417045FF}) (Version: 7.0.450 - Oracle)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
LogMeIn (HKLM-x32\...\{EE4CA5AF-4A55-418C-8CB8-74435814207B}) (Version: 4.1.2450 - LogMeIn, Inc.)
Magical Jelly Bean KeyFinder (HKLM-x32\...\KeyFinder_is1) (Version: 2.0.10.9 - Magical Jelly Bean)
Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
MCEBrowser (HKLM-x32\...\{79F41FC6-07F9-47C2-BBAC-37C7C70EE703}) (Version: 2.2 - ANPARK)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0016-0000-0000-0000000FF1CE}_EXCEL_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-001B-0000-0000-0000000FF1CE}_WORD_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office Excel 2007 (HKLM-x32\...\EXCEL) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Word 2007 (HKLM-x32\...\WORD) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft PowerPoint Viewer (HKLM-x32\...\{95140000-00AF-0409-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.31211.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{820B6609-4C97-3A2B-B644-573B06A0F0CC}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 35.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 en-US)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MultiCharts (HKLM-x32\...\MultiCharts) (Version: 8.0.5620 - MultiCharts)
MultiCharts (x32 Version: 8.0.5620 - TS Support) Hidden
MultiCharts64 (HKLM\...\MultiCharts64) (Version: 8.0.5375 - MultiCharts)
MultiCharts64 (Version: 8.0.5375 - TS Support) Hidden
Multimedia Card Reader (HKLM-x32\...\InstallShield_{41068A8C-3F30-46B6-978A-EA692F28D1AF}) (Version: 1.7.915.93 - Fitipower)
Multimedia Card Reader (x32 Version: 1.7.915.93 - Fitipower) Hidden
Nero BurningROM 12 (HKLM-x32\...\{3D9167B2-87EB-4713-90B4-E46F2CAFE28D}) (Version: 12.0.00300 - Nero AG)
NinjaTrader 7 (HKLM-x32\...\{498F2114-FE59-44C7-A32F-E6F72C872894}) (Version: 7.0.1024 - NinjaTrader)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.3.2 - Frank Heindörfer, Philip Chinery)
pdfsam (HKLM-x32\...\pdfsam) (Version: 2.2.1 - )
PeerBlock 1.2 (r693) (HKLM\...\{015C5B35-B678-451C-9AEE-821E8D69621C}_is1) (Version: 1.2.0.693 - PeerBlock, LLC)
Prerequisite installer (x32 Version: 12.0.0002 - Nero AG) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6537 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.94 (HKLM-x32\...\Revo Uninstaller) (Version: 1.94 - VS Revo Group)
SiteVault Pro (HKLM-x32\...\{CD244D9D-B284-4DDC-8B9F-BCF762AC1681}_is1) (Version: 4.0.31 - Amorphys Romania)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Smart Defrag 3 (HKLM-x32\...\Smart Defrag 3_is1) (Version: 3.3 - IObit)
Snagit 11 (HKLM-x32\...\{44BD21C2-9132-48DB-B65B-23817E4C6F4B}) (Version: 11.2.0 - TechSmith Corporation)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.0.12 - Safer-Networking Ltd.)
Strongvault Online Backup (HKLM-x32\...\{C8A17402-051A-471B-BA64-9147A7467005}) (Version: 2.1.1.0 - Strongvault) <==== ATTENTION
Strongvault Online Backup (x32 Version: 5.0.2.34 - Strongvault Online Backup) Hidden <==== ATTENTION
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.38846 - TeamViewer)
Total Recorder 8.3 Standard Edition (HKLM-x32\...\TotalRecorder) (Version: - )
Trader Workstation 4.0 (HKLM-x32\...\Trader Workstation 4.0) (Version: - )
TradeStation 9.0 (HKLM-x32\...\{6EF11260-2361-409D-B91C-373D8732EED8}) (Version: 9.0.0.9012 - TradeStation Technologies)
TradeStation 9.1 (HKLM-x32\...\{B948B39D-214F-486E-BCD9-8AB691F8762A}) (Version: 9.01.00.12793 - TradeStation Technologies)
TVersity Codec Pack 1.4 (HKLM-x32\...\TVersity Codec Pack) (Version: 1.4 - TVersity Inc.)
TVersity Media Server 1.9 (HKLM-x32\...\TVersity Media Server) (Version: 1.9 - TVersity)
Tweaking.com - Registry Backup (HKLM-x32\...\Tweaking.com - Registry Backup) (Version: 2.1.1 - Tweaking.com)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0016-0000-0000-0000000FF1CE}_EXCEL_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-001B-0000-0000-0000000FF1CE}_WORD_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Visual Studio 2008 x64 Redistributables (HKLM-x32\...\{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}) (Version: 10.0.0.2 - AVG Technologies)
Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.1.2 (HKLM-x32\...\VLC media player) (Version: 2.1.2 - VideoLAN)
Vuze (HKLM\...\8461-7759-5462-8226) (Version: 5.3.0.0 - Azureus Software, Inc.)
Website Extractor 10.52 (HKLM-x32\...\Website Extractor_is1) (Version: - )
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
WinRAR 4.20 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-472848371-1800496413-3629884572-1000_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Program Files (x86)\Citrix\GoToMeeting\1133\G2MOutlookAddin64.dll (Citrix Online, a division of Citrix Systems, Inc.)

==================== Restore Points =========================

17-02-2015 20:25:13 Scheduled Checkpoint
23-02-2015 06:04:27 Removed Google Earth.
23-02-2015 06:24:11 Installed Microsoft Fix it 50848
24-02-2015 05:26:51 Installed Microsoft Fix it 50535

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-02-22 11:29 - 2015-02-23 10:36 - 00000035 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {08412C21-DB78-4807-82F1-13E5C29E4FF1} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv => C:\Windows\TEMP\{BABC636A-0B2A-48A7-98BF-E852D277A7BB}.exe
Task: {088426E6-E3E4-4C9D-B65D-1A948D75278A} - System32\Tasks\Auto FTP Forex.xml => C:\Omega\FTP_Auto_Upload\ftp_upload_Forex.cmd [2012-11-18] ()
Task: {08FEDB2A-F4C7-4813-9B94-CDAD1CDADB8F} - System32\Tasks\Dell SupportAssistAgent AutoUpdate => C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssist.exe [2015-02-19] (Microsoft)
Task: {0DDC7FB0-E807-4D12-AD3B-DD6C39B51EBE} - System32\Tasks\SmartDefrag3_Update => C:\Program Files (x86)\IObit\Smart Defrag 3\AutoUpdate.exe [2014-07-23] (IObit)
Task: {0EEF6027-ABDA-4A80-A00C-B1157D82FC71} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe
Task: {21538892-EEAF-4B0F-813D-BA09FCD4C1B1} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\Dell\SupportAssist\sessionchecker.exe [2015-02-03] (PC-Doctor, Inc.)
Task: {3B3D2CA3-0580-4E15-A28C-444611D5D6FD} - System32\Tasks\{D6BD40D8-7C23-4DC5-954B-10C7B59D254D} => pcalua.exe -a C:\Junk\rescue2usb.exe -d C:\Junk
Task: {41DC99A4-C1F4-43D3-A8A0-05746AE68826} - System32\Tasks\Auto FTP Stocks.xml => C:\Omega\FTP_Auto_Upload\ftp_upload_Stocks.cmd [2012-11-18] ()
Task: {43463012-A6B2-4272-94B5-185D22ED7713} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
Task: {43E181DD-4E95-45C7-B464-C8273E6E052E} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe
Task: {4C74F371-5723-4BAA-8567-F450CEC0B879} - System32\Tasks\{70C38B8B-37D2-48A9-B98F-5A4A5EF2C6A9} => pcalua.exe -a C:\Users\Bob\Desktop\esetsmartinstaller_enu.exe -d C:\Users\Bob\Desktop
Task: {53E7BDE9-8894-4512-A9E5-17EDB25CCFD4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-05-28] (Google Inc.)
Task: {592C6A55-0342-4B00-BFB1-87DF635C3BCD} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\Dell\SupportAssist\uaclauncher.exe [2015-02-03] (PC-Doctor, Inc.)
Task: {5A754029-4E3B-477E-9C69-F3EF45268237} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-05] (Adobe Systems Incorporated)
Task: {695CFDD7-1AEC-4717-946D-FCC55E999B86} - System32\Tasks\Microsoft\Windows\Media Center\Extender\Update media permissions for Mcx1-XPS8500 => C:\Windows\ehome\McxTask.exe [2009-07-13] (Microsoft Corporation)
Task: {77E37BBB-BB7A-4EFC-8A29-1C6533C7ADAD} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {892E2910-D23C-4497-B736-DD9109013454} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => c:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25] (Intel Corporation)
Task: {89D20355-05D5-434D-8760-073B954A7848} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {8BD1BD81-8B8B-4464-A1A0-0F8498C294FA} - System32\Tasks\SmartDefrag3_Startup => C:\Program Files (x86)\IObit\Smart Defrag 3\SmartDefrag.exe [2014-10-20] (IObit)
Task: {8D0958A1-11FD-4CE7-B372-13CA222857F7} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe
Task: {90170FD2-7BEF-4D84-B4DD-D41AB877BCB5} - System32\Tasks\{DCD3CEF4-DF10-4B4C-A35B-14F361D1F0F2} => pcalua.exe -a C:\Users\Bob\Documents\erunt\ERUNT.EXE -d C:\Users\Bob\Documents\erunt
Task: {92B5D7FD-697D-41CC-9AB7-557A0E1F8355} - System32\Tasks\Auto FTP ETF.xml => C:\Omega\FTP_Auto_Upload\ftp_upload_ETF.cmd [2012-11-18] ()
Task: {9991B4C4-C89A-462C-9CC2-00A2C70A3060} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-05-28] (Google Inc.)
Task: {A5F111FD-9D32-4A26-987D-D8E8E0E85DCF} - System32\Tasks\{4B015CE5-CA51-4E6E-B25C-76A7926D0E95} => pcalua.exe -a "C:\Users\Bob\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WHQM3NFI\Setup TradeStation 9.1 with .NET.exe" -d C:\Users\Bob\Desktop
Task: {B8481CFB-8E85-4ABC-B8AA-2C07D2EEB42A} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv => C:\Windows\TEMP\{B0A47063-09AD-435D-917D-99D1436E26DB}.exe
Task: {C7D4F514-7A65-4CD5-959A-AEE2F348E84A} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => c:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25] (Intel Corporation)
Task: {E763A272-9474-4B03-B6CE-BF26FA72E1B9} - System32\Tasks\{5293C6BC-9EA8-4462-8E85-206422E638E7} => pcalua.exe -a C:\Junk\PaintShopProInstall\iso\setup.exe -d C:\Junk\PaintShopProInstall\iso
Task: {EA208FB1-FE4D-4CEA-A70E-71E93DCB0D71} - System32\Tasks\Auto FTP Futures.xml => C:\Omega\FTP_Auto_Upload\ftp_upload_Futures.cmd [2012-11-18] ()
Task: {FC1C27B1-B372-4FC9-A1FA-8846FB10C511} - System32\Tasks\TradeStation Backup - Daily => C:\Program Files (x86)\TradeStation 9.1\Program\TSBackupRestore.exe [2014-04-03] (TradeStation Technologies, Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Dell SupportAssistAgent AutoUpdate.job => C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssist.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job => c:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe
Task: C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job => c:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe
Task: C:\Windows\Tasks\TradeStation Backup - Daily.job => C:\Program Files (x86)\TradeStation 9.1\Program\TSBackupRestore.exeK/Backup C:\Program Files (x86)\TradeStation 9.1\Templates\Backup\Daily.tsb

==================== Loaded Modules (whitelisted) ==============

2012-05-09 15:53 - 2012-01-21 10:35 - 00128280 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
2012-10-23 18:32 - 2012-06-18 15:40 - 00950032 _____ () C:\SiteVaultPro\SvPro.exe
2010-01-02 08:42 - 2010-01-02 08:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2010-07-12 22:45 - 2010-07-12 22:45 - 00880640 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\MediaServer.exe
2014-12-11 18:25 - 2014-12-11 18:25 - 00014848 _____ () C:\Program Files\i2p\jcpuid.dll
2014-12-11 18:25 - 2014-12-11 18:25 - 00181760 _____ () C:\Program Files\i2p\jbigi.dll
2014-09-29 18:51 - 2014-09-29 18:51 - 00074664 _____ () C:\Program Files (x86)\SlySoft\AnyDVD\ADvdDiscHlp64.exe
2014-06-08 08:48 - 2014-04-15 09:26 - 00097592 _____ () C:\Program Files\Vuze\aereg64.dll
2014-06-08 08:48 - 2014-04-15 09:26 - 00224056 _____ () C:\Users\Bob\AppData\Roaming\Azureus\plugins\azitunes\jacob-1.17-M2-x64.dll
2014-06-08 08:48 - 2014-04-15 09:26 - 00015160 _____ () C:\Users\Bob\AppData\Roaming\Azureus\plugins\azitunes\libProcessAccess64.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00051272 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\CodeLog.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00035912 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\CompressFile.dll
2012-12-04 18:42 - 2008-11-25 17:18 - 01291264 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\libxml2.dll
2012-12-04 18:42 - 2004-10-05 03:08 - 00055808 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\zlib1.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00050248 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\TBGetRemoteNetInfo.dll
2012-12-04 18:42 - 2012-11-05 11:57 - 00035400 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\ActivationOnline.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00294472 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\ExchBackupSize.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00572488 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\ExImage.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00468552 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\ExchBackupSizeEx.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00069192 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\EnumTapeDevice.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00070216 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\TbTapeBrowse.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00022088 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\AccountManager.dll
2012-12-04 18:42 - 2012-10-30 18:10 - 00108616 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\NasOperator.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00135752 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\CloudOperator.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00037960 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\ActiveOnline.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00096840 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\TBFireWall.dll
2013-01-19 11:51 - 2012-11-13 14:06 - 00108960 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2013-01-19 11:51 - 2012-11-13 14:06 - 00416160 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2013-01-19 11:51 - 2012-11-13 14:06 - 00158624 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2013-01-19 11:51 - 2012-08-23 09:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2013-01-19 11:51 - 2012-11-13 14:06 - 00528288 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\JSDialogPack150.bpl
2012-10-23 18:32 - 2010-03-07 05:31 - 00024110 _____ () C:\SiteVaultPro\mingwm10.dll
2012-10-23 18:32 - 2010-03-30 20:29 - 00279955 _____ () C:\SiteVaultPro\libidn-11.dll
2012-10-23 18:32 - 2010-06-23 06:17 - 01546364 _____ () C:\SiteVaultPro\libeay32.dll
2012-10-23 18:32 - 2010-06-23 06:17 - 00346759 _____ () C:\SiteVaultPro\libssl32.dll
2014-01-21 05:34 - 2014-06-04 14:17 - 00892288 _____ () C:\Program Files (x86)\IObit\Smart Defrag 3\webres.dll
2013-01-19 11:51 - 2012-11-13 14:06 - 00554400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\VirtualTreesDXE150.bpl
2010-07-12 22:06 - 2010-07-12 22:06 - 00344064 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\taglib.dll
2010-07-12 22:06 - 2010-07-12 22:06 - 00729088 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\X11.dll
2010-07-12 22:06 - 2010-07-12 22:06 - 00163840 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\CORE_RL_lcms_.dll
2010-07-12 22:06 - 2010-07-12 22:06 - 00327680 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\libcurl.dll
2010-07-12 22:06 - 2010-07-12 22:06 - 00712704 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\log4cxx.dll
2010-07-11 20:47 - 2010-07-11 20:47 - 04530190 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\avcodec-52.dll
2010-07-11 20:47 - 2010-07-11 20:47 - 00079886 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\avutil-50.dll
2010-07-11 20:47 - 2010-07-11 20:47 - 00309755 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\libmp3lame-0.dll
2010-07-11 20:47 - 2010-07-11 20:47 - 00791566 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\avformat-52.dll
2010-07-11 20:47 - 2010-07-11 20:47 - 00199182 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\swscale-0.dll
2010-07-12 22:06 - 2010-07-12 22:06 - 00505835 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\sqlite3.dll
2006-09-15 23:03 - 2006-09-15 23:03 - 00007680 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\ImageMagickCoders\IM_MOD_RL_GRAY_.dll
2014-11-24 11:39 - 2014-11-24 11:39 - 00155528 _____ () C:\Program Files (x86)\Dell Digital Delivery\ServiceTagPlusPlus.dll
2014-10-16 02:33 - 2014-10-16 02:33 - 00172032 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\92a1650dbe9fad5f46633b835420e1a8\IsdiInterop.ni.dll
2012-05-09 15:50 - 2011-11-29 19:00 - 00059392 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2012-05-09 15:52 - 2012-01-21 05:23 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2015-01-27 05:46 - 2015-01-27 05:46 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\atashost => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\GoToAssist => ""="Service"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-472848371-1800496413-3629884572-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Bob\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 8.8.8.8

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

Administrator (S-1-5-21-472848371-1800496413-3629884572-500 - Administrator - Disabled)
Bob (S-1-5-21-472848371-1800496413-3629884572-1000 - Administrator - Enabled) => C:\Users\Bob
Guest (S-1-5-21-472848371-1800496413-3629884572-501 - Limited - Enabled)
HomeGroupUser$ (S-1-5-21-472848371-1800496413-3629884572-1008 - Limited - Enabled)
LogMeInRemoteUser (S-1-5-21-472848371-1800496413-3629884572-1007 - Administrator - Enabled)
Mcx1-XPS8500 (S-1-5-21-472848371-1800496413-3629884572-1006 - Limited - Enabled) => C:\Users\Mcx1-XPS8500

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/24/2015 06:29:55 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program FRST64.exe version 22.2.2015.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 2d88

Start Time: 01d0502d593ebf54

Termination Time: 17

Application Path: C:\Users\Bob\Desktop\FRST64.exe

Report Id: d1366280-bc20-11e4-a98f-08edb918f684

Error: (02/24/2015 05:34:45 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: DellDataVault.exe, version: 3.9.3.0, time stamp: 0x54cc079f
Faulting module name: DellDataVault.exe, version: 3.9.3.0, time stamp: 0x54cc079f
Exception code: 0xc0000005
Fault offset: 0x000000000001aa84
Faulting process id: 0x1520
Faulting application start time: 0xDellDataVault.exe0
Faulting application path: DellDataVault.exe1
Faulting module path: DellDataVault.exe2
Report Id: DellDataVault.exe3

Error: (02/24/2015 05:31:39 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/24/2015 05:23:11 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: DellDataVault.exe, version: 3.9.3.0, time stamp: 0x54cc079f
Faulting module name: DellDataVault.exe, version: 3.9.3.0, time stamp: 0x54cc079f
Exception code: 0xc0000005
Fault offset: 0x000000000001aa84
Faulting process id: 0x1be8
Faulting application start time: 0xDellDataVault.exe0
Faulting application path: DellDataVault.exe1
Faulting module path: DellDataVault.exe2
Report Id: DellDataVault.exe3

Error: (02/24/2015 05:18:47 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/23/2015 06:11:08 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="ia64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Dependent Assembly Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="ia64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (02/23/2015 06:09:41 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Activation context generation failed for "SMC,processorArchitecture="x86",type="win32",version="8.2.0.0"1".Error in manifest or policy file "SMC,processorArchitecture="x86",type="win32",version="8.2.0.0"2" on line SMC,processorArchitecture="x86",type="win32",version="8.2.0.0"3.
Component identity found in manifest does not match the identity of the component requested.
Reference is SMC,processorArchitecture="x86",type="win32",version="8.2.0.0".
Definition is SMC,processorArchitecture="x86",type="win32",version="12.0.0.0".
Please use sxstrace.exe for detailed diagnosis.

Error: (02/23/2015 04:00:34 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: DellDataVault.exe, version: 3.9.3.0, time stamp: 0x54cc079f
Faulting module name: DellDataVault.exe, version: 3.9.3.0, time stamp: 0x54cc079f
Exception code: 0xc0000005
Fault offset: 0x000000000001aa84
Faulting process id: 0x1bd0
Faulting application start time: 0xDellDataVault.exe0
Faulting application path: DellDataVault.exe1
Faulting module path: DellDataVault.exe2
Report Id: DellDataVault.exe3

Error: (02/23/2015 03:56:35 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/23/2015 00:19:41 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.


System errors:
=============
Error: (02/24/2015 05:34:46 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Dell Data Vault service terminated unexpectedly. It has done this 1 time(s).

Error: (02/24/2015 05:31:37 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The vToolbarUpdater15.4.0 service failed to start due to the following error:
%%2

Error: (02/24/2015 05:31:28 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Dell SupportAssist Agent service failed to start due to the following error:
%%1053

Error: (02/24/2015 05:31:28 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Dell SupportAssist Agent service to connect.

Error: (02/24/2015 05:30:04 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Windows Search service failed to start due to the following error:
%%1069

Error: (02/24/2015 05:30:04 AM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: The WSearch service was unable to log on as NT AUTHORITY\SYSTEM with the currently configured password due to the following error:
%%50

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).

Error: (02/24/2015 05:30:00 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module has stopped unexpectedly.

Module Path: C:\Windows\system32\athihvs.dll

Error: (02/24/2015 05:30:00 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module has stopped unexpectedly.

Module Path: C:\Windows\system32\athihvs.dll

Error: (02/24/2015 05:29:55 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module has stopped unexpectedly.

Module Path: C:\Windows\system32\athihvs.dll

Error: (02/24/2015 05:29:34 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Installer service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
Date: 2012-11-14 18:08:23.638
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2012-11-14 18:08:23.623
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i5-3450 CPU @ 3.10GHz
Percentage of memory in use: 37%
Total physical RAM: 8152.96 MB
Available physical RAM: 5055.61 MB
Total Pagefile: 16304.12 MB
Available Pagefile: 12760.23 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:911.22 GB) (Free:107.13 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 931.5 GB) (Disk ID: B8574584)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Active) - (Size=20.3 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=911.2 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Juliet
2015-02-24, 15:56
Follow the tutorial below to unhide files and folders
http://www.bleepingcomputer.com/tutorials/show-hidden-files-in-windows-7/


Please go to one of the below sites to scan the following files:
Virus Total (Recommended) (http://www.virustotal.com/)
jotti.org (http://virusscan.jotti.org/)
VirScan (http://virscan.org/)
click on Browse, and upload the following file for analysis:

C:\Users\Bob\Desktop\media.player.codec.pack.lite.v4.3.5.setup.exe


Then click Submit. Allow the file to be scanned, and then please copy and paste the results link (for Virus Total) here for me to see.
If it says already scanned -- click "reanalyze now"
Please post the results in your next reply.


~~~

Please uninstall/delete through your programs list
IObit Apps Toolbar v7.0

~~~~~

Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)



start
CloseProcesses:
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [Ogcics] => C:\Windows\SysWOW64\regsvr32.exe C:\Users\Bob\AppData\Local\YkhxPack\enhance.DLL
C:\Users\Bob\AppData\Local\YkhxPack\enhance.DLL
Folder: C:\Users\Bob\AppData\Local\YkhxPack
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [UTRmedia Update] => regsvr32.exe C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll
C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll
Folder: C:\Users\Bob\AppData\Local\UTRmedia
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO-x32: HelperObject Class -> {00C6482D-C502-44C8-8409-FCE54AD9C208} -> C:\Program Files (x86)\TechSmith\SnagIt 7\SnagItBHO.dll No File
S2 vToolbarUpdater15.4.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe [X]
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe
2015-02-16 18:51 - 2015-02-23 12:12 - 00000000 ____D () C:\Users\Bob\AppData\Local\YkhxPack
2015-02-16 18:51 - 2015-02-23 12:12 - 00000000 ____D () C:\Users\Bob\AppData\Local\UTRmedia
C:\Users\Bob\AppData\Local\Temp\i4jdel0.exe
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [BackupAgent] => C:\Program Files (x86)\Strongvault Online Backup\BackupAgent.exe
Strongvault Online Backup (x32 Version: 5.0.2.34 - Strongvault Online Backup) Hidden <==== ATTENTION
CMD: ipconfig /flushdns
CMD: netsh winsock reset all
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
EmptyTemp:
End


Open FRST/FRST64 and press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.


Please post
File to be scanned
Fixlog.txt

savanna
2015-02-24, 18:09
I did NOT get any error reports on the last boot-up after the FRST64 fix.

When trying to remove the IObit Apps Toolbar I get an error message of "The feature you are trying to use is on a network resource that is unavailable."

The Virus Total and fixlist.txt info is below.

Thank you for your help.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Community
Statistics
Documentation
FAQ
About

Join our community
Sign in

English

VirusTotal
SHA256: 3f72f3e9935a1f7c00cbb9557c5589084ff8fa67f7efcde94e25a89146380ace
File name: media.player.codec.pack.lite.v4.3.5.setup.exe
Detection ratio: 2 / 50
Analysis date: 2015-02-24 16:05:51 UTC ( 1 minute ago )
0
1

Analysis
File detail
Additional information
Comments
Votes
Behavioural information

Antivirus Result Update
GData Win32.Adware.Spigot.B 20150224
Kingsoft VIRUS_UNKNOWN 20150224
ALYac 20150224
AVG 20150224
AVware 20150224
Ad-Aware 20150224
AegisLab 20150224
Agnitum 20150223
AhnLab-V3 20150224
Alibaba 20150224
Antiy-AVL 20150224
Avast 20150224
Avira 20150224
Baidu-International 20150224
BitDefender 20150224
Bkav 20150213
ByteHero 20150224
CAT-QuickHeal 20150224
CMC 20150223
ClamAV 20150224
Comodo 20150224
Cyren 20150224
DrWeb 20150224
ESET-NOD32 20150224
Emsisoft 20150224
F-Prot 20150224
F-Secure 20150224
Fortinet 20150224
Ikarus 20150224
Jiangmin 20150223
K7AntiVirus 20150224
K7GW 20150224
Kaspersky 20150224
Malwarebytes 20150224
McAfee 20150224
McAfee-GW-Edition 20150224
MicroWorld-eScan 20150224
Microsoft 20150224
NANO-Antivirus 20150224
Norman 20150224
Panda 20150224
Qihoo-360 20150224
Rising 20150223
SUPERAntiSpyware 20150224
Sophos 20150224
Symantec 20150224
Tencent 20150224
TheHacker 20150222
TotalDefense 20150224
TrendMicro 20150224
TrendMicro-HouseCall 20150224
VBA32 20150224
VIPRE 20150224
ViRobot 20150224
Zillya 20150223
Zoner 20150223
nProtect 20150224
Blog | Twitter | contact@virustotal.com | Google groups | ToS | Privacy policy


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



Community
Statistics
Documentation
FAQ
About

Join our community
Sign in

English

VirusTotal
SHA256: 3f72f3e9935a1f7c00cbb9557c5589084ff8fa67f7efcde94e25a89146380ace
File name: media.player.codec.pack.lite.v4.3.5.setup.exe
Detection ratio: 2 / 50
Analysis date: 2015-02-24 16:05:51 UTC ( 1 minute ago )
0
1

Analysis
File detail
Additional information
Comments
Votes
Behavioural information

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.
Authenticode signature block
Copyright
© 2014 Cole Williams

Publisher Cole Williams Software Limited
Product Media Player - Codec Pack
File version 4.3.5.1221
Description Media Player - Codec Pack
Comments Enables playback and encoding for various audio & video formats.
Signature verification Signed file, verified signature
Signing date 7:03 AM 12/21/2014
Signers
[+] Cole Williams Software Limited
[+] COMODO RSA Code Signing CA
[+] COMODO
Counter signers
[+] COMODO Time Stamping Signer
[+] USERTrust
Packers identified
F-PROT AutoIt, NSIS, appended, UPX_LZMA, CAB
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2009-12-05 22:50:46
Entry Point 0x0000323C
Number of sections 5
PE sections
Name Virtual address Virtual size Raw size Entropy MD5
.text 4096 23130 23552 6.42 0bc2ffd32265a08d72b795b18265828d
.rdata 28672 4496 4608 5.18 f179218a059068529bdb4637ef5fa28e
.data 36864 110488 1024 4.71 975304d6dd6c4a4f076b15511e2bbbc0
.ndata 147456 65536 0 0.00 d41d8cd98f00b204e9800998ecf8427e
.rsrc 212992 199336 199680 4.92 26ecf07f4f79db1fbab426906bf2d92e
PE imports
[+] ADVAPI32.dll
[+] COMCTL32.dll
[+] GDI32.dll
[+] KERNEL32.dll
[+] SHELL32.dll
[+] USER32.dll
[+] VERSION.dll
[+] ole32.dll
Number of PE resources by type
RT_ICON 18
RT_DIALOG 5
RT_MANIFEST 1
RT_BITMAP 1
RT_VERSION 1
RT_GROUP_ICON 1
Number of PE resources by language
ENGLISH US 26
NEUTRAL 1
ExifTool file metadata
UninitializedDataSize
1024

Comments
Enables playback and encoding for various audio & video formats.

LinkerVersion
6.0

ImageVersion
6.0

FileSubtype
0

FileVersionNumber
4.3.5.1221

LanguageCode
Neutral

FileFlagsMask
0x0000

CharacterSet
Windows, Latin1

InitializedDataSize
119808

MIMEType
application/octet-stream

Subsystem
Windows GUI

FileVersion
4.3.5.1221

TimeStamp
2009:12:05 23:50:46+01:00

FileType
Win32 EXE

PEType
PE32

SubsystemVersion
4.0

FileDescription
Media Player - Codec Pack

OSVersion
4.0

FileOS
Win32

LegalCopyright
2014 Cole Williams

MachineType
Intel 386 or later, and compatibles

CompanyName
Media Player - Codec Pack

CodeSize
23552

ProductName
Media Player - Codec Pack

ProductVersionNumber
4.3.5.1221

EntryPoint
0x323c

ObjectFileType
Executable application

Blog | Twitter | contact@virustotal.com | Google groups | ToS | Privacy policy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



Community
Statistics
Documentation
FAQ
About

Join our community
Sign in

English

VirusTotal
SHA256: 3f72f3e9935a1f7c00cbb9557c5589084ff8fa67f7efcde94e25a89146380ace
File name: media.player.codec.pack.lite.v4.3.5.setup.exe
Detection ratio: 2 / 50
Analysis date: 2015-02-24 16:05:51 UTC ( 1 minute ago )
0
1

Analysis
File detail
Additional information
Comments
Votes
Behavioural information

File identification
MD5 f130bf6fc9843dc591b9e84844174f54
SHA1 d9aa121204d1bee6119952a1ebacad330867a646
SHA256 3f72f3e9935a1f7c00cbb9557c5589084ff8fa67f7efcde94e25a89146380ace
ssdeep
393216:wNuK6VsjjA+mwfgJY9XA8P3U4v8nHfA0CQjwjPDGlwJMXY:wNYIt9XA8s4EHfIQjCGuJMXY

authentihash cd4866c8d7e07e80c0d80c6c86e574c538957bef0a574fcfc79cf2b8a033d162
imphash 099c0646ea7282d232219f8807883be0
File size 13.1 MB ( 13762592 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID NSIS - Nullsoft Scriptable Install System (94.8%)
Win32 Executable MS Visual C++ (generic) (3.4%)
Win32 Dynamic Link Library (generic) (0.7%)
Win32 Executable (generic) (0.5%)
Generic Win/DOS Executable (0.2%)
Tags
nsis peexe signed

VirusTotal metadata
First submission 2015-01-03 00:53:56 UTC ( 1 month, 3 weeks ago )
Last submission 2015-02-24 16:05:51 UTC ( 2 minutes ago )
File names output.52239153.txt
media.player.codec.pack.lite.v4.3.5.setup.exe
3f72f3e9935a1f7c00cbb9557c5589084ff8fa67f7efcde94e25a89146380ace
52239153
media.player.codec.pack.lite.v4.3.5.setup.exe
Advanced heuristic and reputation engines
ClamAV PUA
Possibly Unwanted Application. While not necessarily malicious, the scanned file presents certain characteristics which depending on the user policies and environment may or may not represent a threat. For full details see: http://www.clamav.net/doc/pua.html .

Symantec reputation Suspicious.Insight
Blog | Twitter | contact@virustotal.com | Google groups | ToS | Privacy policy


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 22-02-2015
Ran by Bob at 2015-02-24 09:51:01 Run:7
Running from C:\Users\Bob\Desktop
Loaded Profiles: Bob (Available profiles: Bob & Mcx1-XPS8500)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start
CloseProcesses:
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [Ogcics] => C:\Windows\SysWOW64\regsvr32.exe C:\Users\Bob\AppData\Local\YkhxPack\enhance.DLL
C:\Users\Bob\AppData\Local\YkhxPack\enhance.DLL
Folder: C:\Users\Bob\AppData\Local\YkhxPack
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [UTRmedia Update] => regsvr32.exe C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll
C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll
Folder: C:\Users\Bob\AppData\Local\UTRmedia
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO-x32: HelperObject Class -> {00C6482D-C502-44C8-8409-FCE54AD9C208} -> C:\Program Files (x86)\TechSmith\SnagIt 7\SnagItBHO.dll No File
S2 vToolbarUpdater15.4.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe [X]
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe
2015-02-16 18:51 - 2015-02-23 12:12 - 00000000 ____D () C:\Users\Bob\AppData\Local\YkhxPack
2015-02-16 18:51 - 2015-02-23 12:12 - 00000000 ____D () C:\Users\Bob\AppData\Local\UTRmedia
C:\Users\Bob\AppData\Local\Temp\i4jdel0.exe
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [BackupAgent] => C:\Program Files (x86)\Strongvault Online Backup\BackupAgent.exe
Strongvault Online Backup (x32 Version: 5.0.2.34 - Strongvault Online Backup) Hidden <==== ATTENTION
CMD: ipconfig /flushdns
CMD: netsh winsock reset all
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
EmptyTemp:
End
*****************

Processes closed successfully.
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Ogcics => value deleted successfully.
"C:\Users\Bob\AppData\Local\YkhxPack\enhance.DLL" => File/Directory not found.

========================= Folder: C:\Users\Bob\AppData\Local\YkhxPack ========================

2015-02-16 18:51 - 2015-02-16 18:51 - 0051220 _____ () C:\Users\Bob\AppData\Local\YkhxPack\DrawLine.2
2015-02-22 19:15 - 2015-02-22 19:15 - 0051220 _____ () C:\Users\Bob\AppData\Local\YkhxPack\enhance.2
2015-02-16 19:13 - 2015-02-22 19:06 - 0051220 _____ () C:\Users\Bob\AppData\Local\YkhxPack\webapprt-stub.2

====== End of Folder: ======

HKU\S-1-5-21-472848371-1800496413-3629884572-1000\Software\Microsoft\Windows\CurrentVersion\Run\\UTRmedia Update => value deleted successfully.
"C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll" => File/Directory not found.

========================= Folder: C:\Users\Bob\AppData\Local\UTRmedia ========================

2015-02-16 18:51 - 2015-02-16 18:51 - 0237076 _____ () C:\Users\Bob\AppData\Local\UTRmedia\CNBJOP7i.2
2015-02-22 19:06 - 2015-02-22 19:06 - 0237076 _____ () C:\Users\Bob\AppData\Local\UTRmedia\vbc.2

====== End of Folder: ======

HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00C6482D-C502-44C8-8409-FCE54AD9C208}" => Key deleted successfully.
"HKCR\Wow6432Node\CLSID\{00C6482D-C502-44C8-8409-FCE54AD9C208}" => Key deleted successfully.
vToolbarUpdater15.4.0 => Service deleted successfully.
"C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe" => File/Directory not found.
C:\Users\Bob\AppData\Local\YkhxPack => Moved successfully.
C:\Users\Bob\AppData\Local\UTRmedia => Moved successfully.
C:\Users\Bob\AppData\Local\Temp\i4jdel0.exe => Moved successfully.
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\Software\Microsoft\Windows\CurrentVersion\Run\\BackupAgent => value deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5E33D30D-D896-4D92-B033-5F45819B2937}\\SystemComponent => value deleted successfully.

========= ipconfig /flushdns =========


Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========


========= netsh winsock reset all =========


Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.


========= End of CMD: =========


========= netsh int ipv4 reset =========

Reseting Global, OK!
Reseting Interface, OK!
Restart the computer to complete this action.


========= End of CMD: =========


========= netsh int ipv6 reset =========

Reseting Interface, OK!
Restart the computer to complete this action.


========= End of CMD: =========

EmptyTemp: => Removed 1.8 GB temporary data.


The system needed a reboot.

==== End of Fixlog 09:51:19 ====

Juliet
2015-02-24, 18:19
I think we got it.

C:\Users\Bob\Desktop\media.player.codec.pack.lite.v4.3.5.setup.exe
File name: media.player.codec.pack.lite.v4.3.5.setup.exe
Detection ratio: 2 / 50

2 vendors classified this as Adware. It's not being flagged by any of the other well known antivirus as of yet...
You can leave this alone or delete it, I'll let you make this call.

Ready to remove tools and quarantine folders?

savanna
2015-02-24, 18:42
I agree - that looks like the culprit. I'd like to give it a few days just to make sure. I'll give it 2 days and if everything looks OK I'll get back with you to proceed.

Thank you VERY much for your help.

Juliet
2015-02-24, 19:08
That'll work. Use the computer lightly as in, no big downloads just general use.

Juliet
2015-02-26, 12:56
If all appears good now


http://i.imgur.com/AFZxnZc.jpg DelFix

Please download DelFix (http://general-changelog-team.fr/en/downloads/finish/20-outils-de-xplode/9-delfix)
or from here http://www.bleepingcomputer.com/download/delfix/ and save the file to your Desktop.
Double-click DelFix.exe to run the programme.
Place a checkmark next to the following items:

Activate UAC
Remove disinfection tools
Create registry backup


Click the Run button.

-- This will remove the specialised tools we used to disinfect your system. Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).

~~~~~~~~~~~


Answers to common security questions - Best Practices (http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/) by quietman7, MVP
How Malware Spreads - How did I get infected? (http://www.bleepingcomputer.com/forums/t/287710/how-malware-spreads-how-did-i-get-infected/) by quietman7, MVP
Simple and easy ways to keep your computer safe and secure on the Internet (http://www.bleepingcomputer.com/tutorials/keep-your-computer-safe-online/) by Lawrence Abrams, MVP
How to Prevent Malware (http://users.telenet.be/bluepatchy/miekiemoes/prevention.html) by miekiemoes, MVP
How to backup and restore your data using Cobian Backup (http://www.bleepingcomputer.com/tutorials/backup-and-restore-data-with-cobian-backup/) by YourHighness
Slow Computer/browser? It May Not Be Malware (http://www.bleepingcomputer.com/forums/t/87058/slow-computerbrowser-check-here-first;-it-may-not-be-malware/) by quietman7, MVP


The following programmes come highly recommended in the security community.

http://3-ps.googleusercontent.com/x/forums.whatthetech.com/i.imgur.com/xKsUqI5A.png.pagespeed.ic.vn1Hlvqi8h.jpgAdBlock (https://adblockplus.org/en/firefox) is a browser add-on that blocks annoying banners, pop-ups and video ads.
http://i.imgur.com/E8I37RF.pngCryptoPrevent (https://www.foolishit.com/) places policy restrictions on loading points for ransomware (eg.CryptoPrevent), preventing your files from being encrypted.
http://i.imgur.com/EG85Vjt.png Malwarebytes Anti-Exploit (https://www.malwarebytes.org/antiexploit/) (MBAE) is designed to prevent zero-day malware from exploiting vulnerable software.
http://3-ps.googleusercontent.com/x/forums.whatthetech.com/i.imgur.com/x6YRrgUC.png.pagespeed.ic.HjgFxjvw2Z.jpgMalwarebytes Anti-Malware Premium (https://www.malwarebytes.org/) (MBAM) works in real-time along side your Anti-Virus to prevent malware execution.
http://1-ps.googleusercontent.com/x/forums.whatthetech.com/i.imgur.com/xjv4nhMJ.png.pagespeed.ic.A5YbWn1eDO.png NoScript (http://noscript.net/) is a Firefox add-on that blocks the actions of malicious scripts by using whitelisting and other technology.
http://i.imgur.com/3O8r9Uq.png (http://www.sandboxie.com/) Sandboxie (http://www.sandboxie.com/) isolates programmes of your choice, preventing files from being written to your HDD unless approved by you.
http://1-ps.googleusercontent.com/x/forums.whatthetech.com/i.imgur.com/DgW1XL2.png.pagespeed.ce.v1OlJl_ZAS.png Secuina PSI (http://secunia.com/vulnerability_scanning/personal/) will scan your computer for vulnerable software that is outdated, and automatically find the latest update for you.
http://3-ps.googleusercontent.com/x/forums.whatthetech.com/i.imgur.com/xj1OLIec.png.pagespeed.ic.k6hhwopU0q.jpg SpywareBlaster (https://www.brightfort.com/spywareblaster.html) is a form of passive protection, designed to block the actions of malicious websites and tracking cookies.
http://3-ps.googleusercontent.com/x/forums.whatthetech.com/i.imgur.com/xJEP5iWI.png.pagespeed.ic.4tmM1lM7DQ.pngWeb of Trust (https://www.mywot.com/) (WOT) is a browser add-on designed to alert you before interacting with a potentially malicious website.

savanna
2015-02-26, 23:49
Yes, it looks like its running better now and I've run Delfix. Thank you VERY much for your help.

Juliet
2015-02-27, 00:07
We're glad to help :)

Juliet
2015-02-27, 13:53
Glad we could help. :)http://i204.photobucket.com/albums/bb106/Juliet702/sparkle.gif

Since this issue appears resolved ... this Topic is closed.