PDA

View Full Version : Everything is in slow motion


mla34
2016-04-19, 19:09
Hi,

I'm not even sure if this is a malware problem. My computer did an automatic update overnight and the next morning the computer was VERY slow. I tried rebooting but it didn't change anything. The windows fade in and out in slow motion. I have never seen this before and thought maybe something in the update was an issue. I did a Norton scan, a Spybot scan, and a Malwarebytes scan. All were negative for any weird things that I could see. I know it's my bad but I did a system restore, thinking it would undo the update and I could go from there. It did not change anything. So.....here I am.

Even typing this is very slow. A couple of other things - my Firefox icon was missing from my taskbar and when I went looking for it, it had been deleted? I ended up reinstalling it. Also, Skype will not connect. Let me know if there is any other information you need. Below are the scan results.

Thank you in advance for your help. I have been fortunate enough to have worked with you before with much success. I will wait to hear back.
Maureen


Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:18-04-2016
Ran by The Arnolds (administrator) on 2011 (19-04-2016 10:21:35)
Running from C:\Users\The Arnolds\Desktop
Loaded Profiles: The Arnolds (Available Profiles: The Arnolds & Greg)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Logitech Inc.) C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\LVPrS64H.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Security Suite\Engine\22.6.0.142\n360.exe
(Dell, Inc.) C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Dell Inc.) C:\Program Files\Dell\DellDataVault\DellDataVaultWiz.exe
(Dell Inc.) C:\Program Files (x86)\Dell Update\DellUpService.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.29.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.29.5\GoogleCrashHandler64.exe
(Dell Inc.) C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe
(Dell Inc.) C:\Program Files\Dell\DellDataVault\DellDataVault.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Dell Inc.) C:\Program Files (x86)\Dell Update\DellUpTray.exe
(Hewlett-Packard Development Company, LP) C:\Program Files\HP\HP Officejet 5740 series\Bin\ScanToPCActivationApp.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Security Suite\Engine\22.6.0.142\n360.exe
(Hewlett-Packard Development Company, LP) C:\Program Files\HP\HP Officejet 5740 series\Bin\HPNetworkCommunicatorCom.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(SoftThinks SAS) C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [594992 2016-01-29] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2307240755-147757143-1248280979-1001\...\Run: [HP Officejet 5740 series (NET)] => C:\Program Files\HP\HP Officejet 5740 series\Bin\ScanToPCActivationApp.exe [3483656 2014-08-22] (Hewlett-Packard Development Company, LP)
HKU\S-1-5-21-2307240755-147757143-1248280979-1001\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
HKU\S-1-5-21-2307240755-147757143-1248280979-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [50670720 2016-03-01] (Skype Technologies S.A.)
HKU\S-1-5-21-2307240755-147757143-1248280979-1001\...\RunOnce: [FlashPlayerUpdate] => C:\Windows\system32\Macromed\Flash\FlashUtil64_21_0_0_197_ActiveX.exe [881344 2016-03-29] (Adobe Systems Incorporated)
HKU\S-1-5-18\...\RunOnce: [iCloud] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloud.exe [346440 2013-11-20] (Apple Inc.)
ShellIconOverlayIdentifiers: [ OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton Security Suite\Engine64\22.6.0.142\buShell.dll [2016-02-18] (Symantec Corporation)
ShellIconOverlayIdentifiers: [ OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton Security Suite\Engine64\22.6.0.142\buShell.dll [2016-02-18] (Symantec Corporation)
ShellIconOverlayIdentifiers: [ OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton Security Suite\Engine64\22.6.0.142\buShell.dll [2016-02-18] (Symantec Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76
Tcpip\..\Interfaces\{2CD7CF38-6B63-4E45-8E8C-12C0DC71B922}: [DhcpNameServer] 75.75.75.75 75.75.76.76
Tcpip\..\Interfaces\{A39A604B-7C4A-4A39-99FE-D29B6FD237C6}: [DhcpNameServer] 75.75.75.75 75.75.76.76

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-2307240755-147757143-1248280979-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-2307240755-147757143-1248280979-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-2307240755-147757143-1248280979-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://xfinity.comcast.net/
SearchScopes: HKLM -> DefaultScope {49606DC7-976D-4030-A74E-9FB5C842FA68} URL =
SearchScopes: HKLM-x32 -> DefaultScope value is missing
SearchScopes: HKU\S-1-5-21-2307240755-147757143-1248280979-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Security Suite\Engine64\22.6.0.142\coIEPlg.dll [2016-02-21] (Symantec Corporation)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-01-08] (Microsoft Corporation)
BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Security Suite\Engine\22.6.0.142\coIEPlg.dll [2016-02-21] (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\ssv.dll [2016-02-11] (Oracle Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-01-08] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\jp2ssv.dll [2016-02-11] (Oracle Corporation)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine64\22.6.0.142\coIEPlg.dll [2016-02-21] (Symantec Corporation)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine\22.6.0.142\coIEPlg.dll [2016-02-21] (Symantec Corporation)
DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2016-02-01] (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-01-08] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-01-08] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\The Arnolds\AppData\Roaming\Mozilla\Firefox\Profiles\3r6yn46d.default
FF Homepage: hxxp://home.ancestry.com/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_20_0_0_306.dll [2016-02-10] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_306.dll [2016-02-10] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll [2013-06-26] (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-10-08] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.73.2 -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\dtplugin\npDeployJava1.dll [2016-02-11] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.73.2 -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\plugin2\npjp2.dll [2016-02-11] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-02] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-02] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-02-26] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2307240755-147757143-1248280979-1001: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 -> C:\Users\The Arnolds\AppData\Roaming\Visan\plugins\npRLSecurePluginLayer.dll [2011-07-25] (RocketLife, LLP)
FF Extension: Skype - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2016-01-06]
FF HKLM\...\Firefox\Extensions: [{C1A2A613-35F1-4FCF-B27F-2840527B6556}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_22.5.2.15\coFFAddon
FF Extension: Norton Identity Safe - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_22.5.2.15\coFFAddon [2016-03-24]
FF HKLM-x32\...\Firefox\Extensions: [{C1A2A613-35F1-4FCF-B27F-2840527B6556}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_22.5.2.15\coFFAddon

Chrome:
=======
CHR HKLM\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Security Suite\Engine\22.6.0.142\Exts\Chrome.crx [2016-03-14]
CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Security Suite\Engine\22.6.0.142\Exts\Chrome.crx [2016-03-14]
CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-10-07] (Apple Inc.)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1433216 2016-01-08] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1773696 2016-01-08] (Microsoft Corporation)
R2 DellDataVault; C:\Program Files\Dell\DellDataVault\DellDataVault.exe [2571352 2016-01-05] (Dell Inc.)
R2 DellDataVaultWiz; C:\Program Files\Dell\DellDataVault\DellDataVaultWiz.exe [201816 2016-01-05] (Dell Inc.)
R2 DellUpdate; C:\Program Files (x86)\Dell Update\DellUpService.exe [237272 2015-08-27] (Dell Inc.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1513784 2015-10-05] (Malwarebytes)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
R2 N360; C:\Program Files (x86)\Norton Security Suite\Engine\22.6.0.142\N360.exe [289080 2016-02-26] (Symantec Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 SupportAssistAgent; C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe [31928 2016-01-12] (Dell Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [X]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
R1 BHDrvx64; C:\Program Files (x86)\Norton Security Suite\NortonData\22.5.2.15\Definitions\BASHDefs\20160414.001_69\BHDrvx64.sys [1766640 2016-04-14] (Symantec Corporation)
R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1606000.08E\ccSetx64.sys [173808 2015-07-10] (Symantec Corporation)
R3 DDDriver; C:\Windows\System32\drivers\DDDriver64Dcsa.sys [32464 2015-09-11] (Dell Computer Corporation)
R3 DellProf; C:\Windows\System32\drivers\DellProf.sys [24240 2015-05-22] (Dell Computer Corporation)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [498512 2015-11-12] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [157520 2015-11-12] (Symantec Corporation)
R1 IDSVia64; C:\Program Files (x86)\Norton Security Suite\NortonData\22.5.2.15\Definitions\IPSDefs\20160418.001\IDSvia64.sys [767224 2016-04-13] (Symantec Corporation)
R3 LVPr2M64; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30232 2009-10-07] ()
S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30232 2009-10-07] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2016-04-19] (Malwarebytes)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-10-05] (Malwarebytes Corporation)
R3 NAVENG; C:\Program Files (x86)\Norton Security Suite\NortonData\22.5.2.15\Definitions\VirusDefs\20160418.025\ENG64.SYS [138488 2016-04-14] (Symantec Corporation)
R3 NAVEX15; C:\Program Files (x86)\Norton Security Suite\NortonData\22.5.2.15\Definitions\VirusDefs\20160418.025\EX64.SYS [2148080 2016-04-14] (Symantec Corporation)
R3 SRTSP; C:\Windows\System32\Drivers\N360x64\1606000.08E\SRTSP64.SYS [928504 2016-02-23] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1606000.08E\SRTSPX64.SYS [50936 2015-07-10] (Symantec Corporation)
R0 SymEFASI; C:\Windows\System32\drivers\N360x64\1606000.08E\SYMEFASI64.SYS [1621232 2016-02-23] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [111344 2015-11-18] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360x64\1606000.08E\Ironx64.SYS [295664 2016-02-23] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\N360x64\1606000.08E\SYMNETS.SYS [577768 2016-02-23] (Symantec Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-04-19 10:21 - 2016-04-19 10:21 - 00019356 _____ C:\Users\The Arnolds\Desktop\FRST.txt
2016-04-19 10:15 - 2016-04-19 10:21 - 00000000 ____D C:\FRST
2016-04-19 10:14 - 2016-04-19 10:15 - 02375680 _____ (Farbar) C:\Users\The Arnolds\Desktop\FRST64.exe
2016-04-19 10:10 - 2016-04-19 10:10 - 00000207 _____ C:\Windows\tweaking.com-regbackup-2011-Windows-7-Home-Premium-(64-bit).dat
2016-04-19 10:10 - 2016-04-19 10:10 - 00000000 ____D C:\RegBackup
2016-04-19 10:09 - 2016-04-19 10:09 - 00002237 _____ C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
2016-04-19 10:09 - 2016-04-19 10:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2016-04-19 10:09 - 2016-04-19 10:09 - 00000000 ____D C:\Program Files (x86)\Tweaking.com
2016-04-19 10:07 - 2016-04-19 10:09 - 00018006 _____ C:\Windows\Tweaking.com - Registry Backup Setup Log.txt
2016-04-19 10:06 - 2016-04-19 10:06 - 05523840 _____ (Tweaking.com) C:\Users\The Arnolds\Desktop\tweaking.com_registry_backup_setup.exe
2016-04-16 05:23 - 2016-04-16 05:23 - 00001149 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2016-04-14 17:45 - 2016-03-17 19:01 - 00631176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2016-04-14 17:45 - 2016-03-17 18:56 - 02084864 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2016-04-14 17:45 - 2016-03-17 18:53 - 01464320 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2016-04-14 17:45 - 2016-03-17 18:28 - 01414144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2016-04-14 17:45 - 2016-03-16 14:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\system32\mtxoci.dll
2016-04-14 17:45 - 2016-03-16 14:28 - 00176128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msorcl32.dll
2016-04-14 17:45 - 2016-03-16 14:28 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mtxoci.dll
2016-04-14 17:45 - 2016-03-06 14:53 - 01885696 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2016-04-14 17:45 - 2016-03-06 14:53 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2016-04-14 17:45 - 2016-03-06 14:38 - 01240576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2016-04-14 17:45 - 2016-03-06 14:38 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2016-04-14 17:45 - 2016-02-02 14:57 - 00511488 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2016-04-14 17:44 - 2016-04-04 14:14 - 00038120 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2016-04-14 17:44 - 2016-04-04 14:02 - 01169408 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2016-04-14 17:44 - 2016-04-02 09:08 - 01386496 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2016-04-14 17:44 - 2016-03-29 13:53 - 03216896 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-04-14 17:44 - 2016-03-23 10:02 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2016-04-14 17:44 - 2016-03-17 19:04 - 05551336 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2016-04-14 17:44 - 2016-03-17 19:04 - 00706280 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2016-04-14 17:44 - 2016-03-17 19:04 - 00154344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2016-04-14 17:44 - 2016-03-17 19:04 - 00095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2016-04-14 17:44 - 2016-03-17 19:01 - 01732864 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2016-04-14 17:44 - 2016-03-17 18:58 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2016-04-14 17:44 - 2016-03-17 18:58 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2016-04-14 17:44 - 2016-03-17 18:58 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2016-04-14 17:44 - 2016-03-17 18:58 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2016-04-14 17:44 - 2016-03-17 18:58 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2016-04-14 17:44 - 2016-03-17 18:58 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2016-04-14 17:44 - 2016-03-17 18:58 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2016-04-14 17:44 - 2016-03-17 18:58 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2016-04-14 17:44 - 2016-03-17 18:58 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2016-04-14 17:44 - 2016-03-17 18:58 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2016-04-14 17:44 - 2016-03-17 18:57 - 01212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2016-04-14 17:44 - 2016-03-17 18:57 - 00344064 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2016-04-14 17:44 - 2016-03-17 18:57 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2016-04-14 17:44 - 2016-03-17 18:57 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2016-04-14 17:44 - 2016-03-17 18:57 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2016-04-14 17:44 - 2016-03-17 18:56 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2016-04-14 17:44 - 2016-03-17 18:54 - 00316416 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2016-04-14 17:44 - 2016-03-17 18:54 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2016-04-14 17:44 - 2016-03-17 18:54 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2016-04-14 17:44 - 2016-03-17 18:54 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2016-04-14 17:44 - 2016-03-17 18:53 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2016-04-14 17:44 - 2016-03-17 18:53 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2016-04-14 17:44 - 2016-03-17 18:53 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:36 - 03998952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2016-04-14 17:44 - 2016-03-17 18:36 - 03943144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2016-04-14 17:44 - 2016-03-17 18:33 - 01314112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2016-04-14 17:44 - 2016-03-17 18:31 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2016-04-14 17:44 - 2016-03-17 18:31 - 00666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2016-04-14 17:44 - 2016-03-17 18:31 - 00275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2016-04-14 17:44 - 2016-03-17 18:31 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2016-04-14 17:44 - 2016-03-17 18:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2016-04-14 17:44 - 2016-03-17 18:30 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2016-04-14 17:44 - 2016-03-17 18:30 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2016-04-14 17:44 - 2016-03-17 18:30 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2016-04-14 17:44 - 2016-03-17 18:29 - 00251392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2016-04-14 17:44 - 2016-03-17 18:29 - 00141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2016-04-14 17:44 - 2016-03-17 18:29 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2016-04-14 17:44 - 2016-03-17 18:27 - 00260608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2016-04-14 17:44 - 2016-03-17 18:27 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2016-04-14 17:44 - 2016-03-17 18:27 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2016-04-14 17:44 - 2016-03-17 18:27 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2016-04-14 17:44 - 2016-03-17 18:26 - 00553984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2016-04-14 17:44 - 2016-03-17 18:25 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2016-04-14 17:44 - 2016-03-17 18:24 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2016-04-14 17:44 - 2016-03-17 18:24 - 00644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2016-04-14 17:44 - 2016-03-17 18:24 - 00342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2016-04-14 17:44 - 2016-03-17 18:24 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2016-04-14 17:44 - 2016-03-17 18:24 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2016-04-14 17:44 - 2016-03-17 18:24 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:24 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:24 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:24 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:24 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:24 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:24 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:24 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:24 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:24 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:24 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:24 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:24 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 18:24 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 17:53 - 00148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2016-04-14 17:44 - 2016-03-17 17:52 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2016-04-14 17:44 - 2016-03-17 17:52 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2016-04-14 17:44 - 2016-03-17 17:51 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2016-04-14 17:44 - 2016-03-17 17:44 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2016-04-14 17:44 - 2016-03-17 17:43 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2016-04-14 17:44 - 2016-03-17 17:41 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2016-04-14 17:44 - 2016-03-17 17:38 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2016-04-14 17:44 - 2016-03-17 17:37 - 00291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2016-04-14 17:44 - 2016-03-17 17:37 - 00129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2016-04-14 17:44 - 2016-03-17 17:35 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2016-04-14 17:44 - 2016-03-17 17:35 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2016-04-14 17:44 - 2016-03-17 17:30 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2016-04-14 17:44 - 2016-03-17 17:30 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2016-04-14 17:44 - 2016-03-17 17:30 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2016-04-14 17:44 - 2016-03-17 17:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2016-04-14 17:44 - 2016-03-17 17:29 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2016-04-14 17:44 - 2016-03-17 17:29 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 17:29 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 17:29 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 17:29 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2016-04-14 17:44 - 2016-03-17 14:04 - 00698368 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2016-04-14 17:44 - 2016-03-17 14:04 - 00499200 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2016-04-14 17:44 - 2016-03-17 14:04 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2016-04-14 17:44 - 2016-03-17 14:04 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2016-04-14 17:44 - 2016-03-15 20:16 - 00760320 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll
2016-04-14 17:44 - 2016-03-15 20:16 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\samlib.dll
2016-04-14 17:44 - 2016-03-15 19:53 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\samlib.dll
2016-04-14 17:44 - 2016-02-05 14:56 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\tbs.dll
2016-04-14 17:44 - 2016-02-05 14:54 - 00109568 _____ (Microsoft Corporation) C:\Windows\system32\fveapibase.dll
2016-04-14 17:44 - 2016-02-05 13:33 - 00015360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tbs.dll
2016-04-14 17:44 - 2016-01-20 20:51 - 00073664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\disk.sys
2016-04-14 17:44 - 2015-06-03 16:21 - 00451080 _____ (Microsoft Corporation) C:\Windows\system32\fveapi.dll
2016-04-14 17:35 - 2016-03-11 14:57 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2016-04-14 17:35 - 2016-03-11 14:35 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2016-04-14 17:34 - 2016-03-31 15:25 - 00394952 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2016-04-14 17:34 - 2016-03-31 14:41 - 00346320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2016-04-14 17:34 - 2016-03-30 20:54 - 25817600 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-04-14 17:34 - 2016-03-30 20:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2016-04-14 17:34 - 2016-03-30 20:40 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2016-04-14 17:34 - 2016-03-30 20:31 - 02892800 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-04-14 17:34 - 2016-03-30 20:28 - 00571904 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-04-14 17:34 - 2016-03-30 20:28 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2016-04-14 17:34 - 2016-03-30 20:27 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2016-04-14 17:34 - 2016-03-30 20:27 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2016-04-14 17:34 - 2016-03-30 20:27 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2016-04-14 17:34 - 2016-03-30 20:25 - 06052352 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-04-14 17:34 - 2016-03-30 20:22 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2016-04-14 17:34 - 2016-03-30 20:21 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2016-04-14 17:34 - 2016-03-30 20:19 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2016-04-14 17:34 - 2016-03-30 20:17 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-04-14 17:34 - 2016-03-30 20:17 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2016-04-14 17:34 - 2016-03-30 20:17 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2016-04-14 17:34 - 2016-03-30 20:17 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2016-04-14 17:34 - 2016-03-30 20:11 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2016-04-14 17:34 - 2016-03-30 20:08 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2016-04-14 17:34 - 2016-03-30 20:03 - 20352512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-04-14 17:34 - 2016-03-30 20:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2016-04-14 17:34 - 2016-03-30 20:00 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2016-04-14 17:34 - 2016-03-30 19:59 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2016-04-14 17:34 - 2016-03-30 19:57 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2016-04-14 17:34 - 2016-03-30 19:56 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2016-04-14 17:34 - 2016-03-30 19:55 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2016-04-14 17:34 - 2016-03-30 19:53 - 00496640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2016-04-14 17:34 - 2016-03-30 19:53 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2016-04-14 17:34 - 2016-03-30 19:52 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2016-04-14 17:34 - 2016-03-30 19:52 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2016-04-14 17:34 - 2016-03-30 19:52 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2016-04-14 17:34 - 2016-03-30 19:52 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2016-04-14 17:34 - 2016-03-30 19:51 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2016-04-14 17:34 - 2016-03-30 19:48 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2016-04-14 17:34 - 2016-03-30 19:48 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2016-04-14 17:34 - 2016-03-30 19:46 - 00476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2016-04-14 17:34 - 2016-03-30 19:45 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2016-04-14 17:34 - 2016-03-30 19:45 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2016-04-14 17:34 - 2016-03-30 19:45 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2016-04-14 17:34 - 2016-03-30 19:45 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2016-04-14 17:34 - 2016-03-30 19:43 - 00806400 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-04-14 17:34 - 2016-03-30 19:43 - 00725504 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2016-04-14 17:34 - 2016-03-30 19:42 - 02131968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-04-14 17:34 - 2016-03-30 19:42 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2016-04-14 17:34 - 2016-03-30 19:39 - 15415808 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-04-14 17:34 - 2016-03-30 19:38 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2016-04-14 17:34 - 2016-03-30 19:34 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2016-04-14 17:34 - 2016-03-30 19:33 - 00091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2016-04-14 17:34 - 2016-03-30 19:31 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2016-04-14 17:34 - 2016-03-30 19:31 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2016-04-14 17:34 - 2016-03-30 19:30 - 04611072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-04-14 17:34 - 2016-03-30 19:30 - 02596864 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-04-14 17:34 - 2016-03-30 19:30 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2016-04-14 17:34 - 2016-03-30 19:29 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2016-04-14 17:34 - 2016-03-30 19:24 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2016-04-14 17:34 - 2016-03-30 19:23 - 02056192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2016-04-14 17:34 - 2016-03-30 19:23 - 00693248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2016-04-14 17:34 - 2016-03-30 19:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2016-04-14 17:34 - 2016-03-30 19:21 - 13811712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-04-14 17:34 - 2016-03-30 19:18 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-04-14 17:34 - 2016-03-30 19:06 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2016-04-14 17:34 - 2016-03-30 19:05 - 02121216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2016-04-14 17:34 - 2016-03-30 19:02 - 01311744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-04-14 17:34 - 2016-03-30 19:00 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2016-04-13 02:31 - 2016-04-13 02:31 - 00373888 _____ C:\Users\The Arnolds\Downloads\Edward Reynolds Death Cert .pdf
2016-04-12 03:30 - 2016-04-16 05:23 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-04-03 12:11 - 2016-04-03 12:11 - 00391942 _____ C:\Users\The Arnolds\Downloads\document(1).pdf
2016-03-30 14:52 - 2016-03-30 14:52 - 00154694 _____ C:\Users\The Arnolds\Desktop\Kelly's Directory of Sussex, 1915 Historical Directories of England & Wales.htm
2016-03-30 14:52 - 2016-03-30 14:52 - 00153874 _____ C:\Users\The Arnolds\Desktop\1025.pdf
2016-03-30 14:52 - 2016-03-30 14:52 - 00000000 ____D C:\Users\The Arnolds\Desktop\Kelly's Directory of Sussex, 1915 Historical Directories of England & Wales_files
2016-03-30 14:51 - 2016-03-30 14:51 - 00153268 _____ C:\Users\The Arnolds\Desktop\document.pdf
2016-03-30 14:49 - 2016-03-30 14:49 - 00153874 _____ C:\Users\The Arnolds\Downloads\document.pdf
2016-03-26 20:13 - 2016-03-26 20:13 - 00000000 ____D C:\Users\Greg\AppData\Roaming\Sun
2016-03-26 20:13 - 2016-03-26 20:13 - 00000000 ____D C:\Users\Greg\.oracle_jre_usage
2016-03-25 13:11 - 2016-03-25 13:11 - 00000000 ____D C:\Users\Greg\AppData\Local\CEF
2016-03-24 18:23 - 2016-03-24 18:23 - 00012652 _____ C:\Users\The Arnolds\Documents\Payment Confirmation.pdf
2016-03-24 18:19 - 2016-03-24 18:19 - 00077459 _____ C:\Users\The Arnolds\Documents\greg resume.zip
2016-03-24 17:33 - 2016-03-24 17:33 - 00003230 _____ C:\Windows\System32\Tasks\Norton WSC Integration
2016-03-21 14:58 - 2016-03-21 14:58 - 00000153 _____ C:\ADRInfos.xml
2016-03-21 13:47 - 2016-03-21 13:47 - 00003554 _____ C:\Windows\System32\Tasks\HP AR Program Upload - e3003bafa5354944900a171dbfc23f205e608b3e79ef433bad2ebf14a609bb92

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-04-19 10:21 - 2011-12-09 12:38 - 00000000 ____D C:\Users\The Arnolds\AppData\Roaming\Skype
2016-04-19 10:17 - 2009-07-14 00:45 - 00028352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-04-19 10:17 - 2009-07-14 00:45 - 00028352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-04-19 09:52 - 2013-07-10 20:19 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-04-19 09:37 - 2015-08-18 14:34 - 00000438 _____ C:\Windows\Tasks\HP Photo Creations Communicator.job
2016-04-19 04:43 - 2015-08-25 14:36 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-04-19 03:54 - 2015-08-31 09:01 - 00000000 ____D C:\Program Files (x86)\Dell Update
2016-04-19 03:54 - 2011-10-12 08:26 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup
2016-04-19 00:52 - 2013-07-10 20:19 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-04-17 10:24 - 2009-07-14 01:13 - 00783424 _____ C:\Windows\system32\PerfStringBackup.INI
2016-04-17 10:24 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\inf
2016-04-17 09:54 - 2011-10-12 08:57 - 00000000 ____D C:\Users\Default\AppData\Local\SoftThinks
2016-04-17 09:54 - 2011-10-12 08:57 - 00000000 ____D C:\Users\Default User\AppData\Local\SoftThinks
2016-04-17 09:47 - 2011-12-09 13:28 - 00000000 _____ C:\Windows\system32\Drivers\lvuvc.hs
2016-04-17 09:47 - 2009-07-14 01:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-04-17 09:25 - 2014-01-09 18:43 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-04-17 09:18 - 2013-08-19 13:35 - 00000000 ____D C:\Users\Greg\AppData\Roaming\SoftGrid Client
2016-04-16 16:40 - 2015-08-25 14:36 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-04-16 05:23 - 2014-01-09 18:43 - 00001161 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-04-16 05:02 - 2011-10-12 08:28 - 00000000 ___RD C:\Program Files (x86)\Skype
2016-04-16 05:02 - 2011-10-12 08:28 - 00000000 ____D C:\ProgramData\Skype
2016-04-15 11:06 - 2012-01-12 10:24 - 00128672 _____ C:\Users\Greg\AppData\Local\GDIPFONTCACHEV1.DAT
2016-04-15 03:33 - 2009-07-14 00:45 - 00490080 _____ C:\Windows\system32\FNTCACHE.DAT
2016-04-15 03:25 - 2014-12-10 04:23 - 00000000 ____D C:\Windows\system32\appraiser
2016-04-15 03:06 - 2013-08-14 03:01 - 00000000 ____D C:\Windows\system32\MRT
2016-04-15 03:03 - 2011-12-09 18:02 - 135176864 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-04-14 21:15 - 2011-12-01 21:05 - 00000000 ____D C:\Users\Greg
2016-04-14 16:50 - 2011-12-01 15:12 - 00000000 ____D C:\Users\The Arnolds
2016-04-14 16:45 - 2015-12-21 11:02 - 00000000 ____D C:\Windows\System32\Tasks\Remediation
2016-04-14 16:22 - 2015-04-04 03:01 - 00000000 ___SD C:\Windows\system32\GWX
2016-04-14 16:22 - 2014-05-07 03:00 - 00000000 ___SD C:\Windows\system32\CompatTel
2016-04-14 16:22 - 2011-10-12 08:14 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2016-04-14 16:22 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\servicing
2016-04-14 16:21 - 2015-11-18 11:13 - 00000000 ____D C:\ProgramData\Norton
2016-04-14 16:21 - 2015-08-25 14:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-04-14 16:21 - 2011-12-09 16:09 - 00000000 ____D C:\Users\The Arnolds\AppData\Roaming\IrfanView
2016-04-14 16:21 - 2009-07-13 23:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2016-04-14 16:19 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\registration
2016-04-14 16:17 - 2011-12-13 09:12 - 00000000 ____D C:\Users\The Arnolds\AppData\Roaming\SoftGrid Client
2016-04-14 16:16 - 2012-01-28 16:24 - 00000000 __RHD C:\MSOCache
2016-04-13 03:10 - 2012-03-24 13:21 - 00000000 ____D C:\Users\The Arnolds\Documents\genealogy
2016-04-06 10:18 - 2010-11-20 23:27 - 00453280 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2016-03-31 11:49 - 2012-06-22 13:38 - 00000000 ____D C:\Users\The Arnolds\Documents\Recipes
2016-03-29 14:04 - 2012-03-30 18:28 - 00797376 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-03-29 14:04 - 2011-10-12 08:14 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-03-25 13:11 - 2011-12-07 21:56 - 00000000 ____D C:\Users\Greg\AppData\Local\Adobe
2016-03-24 18:55 - 2015-10-31 13:16 - 00000000 ____D C:\Users\The Arnolds\Documents\Travel
2016-03-24 17:41 - 2015-12-02 17:08 - 00000000 ____D C:\Windows\System32\Tasks\Norton 360
2016-03-24 17:40 - 2015-04-04 03:01 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2016-03-24 17:34 - 2015-11-18 11:24 - 00000000 ____D C:\Windows\system32\Drivers\N360x64
2016-03-24 17:33 - 2015-11-18 11:25 - 00002359 _____ C:\Users\Public\Desktop\Norton Security Suite.LNK
2016-03-24 17:33 - 2015-11-18 11:24 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Security Suite
2016-03-24 17:33 - 2009-07-14 01:08 - 00032556 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2016-03-23 07:13 - 2012-06-22 13:37 - 00000000 ____D C:\Users\The Arnolds\Documents\Wetzel stuff
2016-03-21 16:32 - 2014-08-20 08:53 - 00000000 ____D C:\Users\The Arnolds\Documents\Maureen and Greg health
2016-03-21 14:40 - 2012-03-30 18:28 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

==================== Files in the root of some directories =======

2012-04-24 15:52 - 2012-04-24 15:52 - 0000288 _____ () C:\Users\The Arnolds\AppData\Roaming\.backup.dm
2013-02-05 19:07 - 2013-07-08 15:25 - 0003584 _____ () C:\Users\The Arnolds\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-11-20 14:31 - 2014-11-20 14:31 - 0000057 _____ () C:\ProgramData\Ament.ini
2011-12-09 12:44 - 2011-12-09 12:44 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2012-09-14 11:37 - 2014-11-20 14:00 - 0006945 _____ () C:\ProgramData\hpzinstall.log
2014-11-20 13:50 - 2014-11-20 13:50 - 0000016 _____ () C:\ProgramData\mntemp

Files to move or delete:
====================
C:\Users\The Arnolds\jobq.dat


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-02-28 01:10

==================== End of FRST.txt ===================

Additional scan result of Farbar Recovery Scan Tool (x64) Version:18-04-2016
Ran by The Arnolds (2016-04-19 10:22:07)
Running from C:\Users\The Arnolds\Desktop
Windows 7 Home Premium Service Pack 1 (X64) (2011-12-01 19:12:04)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-2307240755-147757143-1248280979-500 - Administrator - Disabled)
Greg (S-1-5-21-2307240755-147757143-1248280979-1003 - Administrator - Enabled) => C:\Users\Greg
Guest (S-1-5-21-2307240755-147757143-1248280979-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2307240755-147757143-1248280979-1002 - Limited - Enabled)
The Arnolds (S-1-5-21-2307240755-147757143-1248280979-1001 - Administrator - Enabled) => C:\Users\The Arnolds

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Norton Security Suite (Enabled - Up to date) {53C7D717-52E2-B95E-FA61-6F32ECC805DB}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: Norton Security Suite (Enabled - Up to date) {E8A636F3-74D8-B6D0-C0D1-5440974F4F66}
FW: Norton Security Suite (Enabled) {6BFC5632-188D-B806-D13E-C607121B42A0}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
Accidental Damage Services Agreement (HKLM-x32\...\{EF85FEF4-EB92-4075-A6D2-5F519BB30A2C}) (Version: 2.0.0 - Dell Inc.)
Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.010.20060 - Adobe Systems Incorporated)
Adobe Flash Player 20 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 20.0.0.306 - Adobe Systems Incorporated)
Adobe Flash Player 21 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 21.0.0.197 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.3.133 - Adobe Systems, Inc.)
Apple Application Support (32-bit) (HKLM-x32\...\{649A1FD9-5892-46AD-8DF0-C4A43FF61CB7}) (Version: 4.1 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{0DE0A178-AC7B-4650-806C-CF226DE03766}) (Version: 4.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{3540181E-340A-4E7A-B409-31663472B2F7}) (Version: 9.1.0.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.50.4.0 - Conexant)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dell Data Vault (Version: 4.3.7.0 - Dell Inc.) Hidden
Dell DataSafe Local Backup - Support Software (HKLM-x32\...\{A9668246-FB70-4103-A1E3-66C9BC2EFB49}) (Version: 9.4.60 - Dell Inc.)
Dell DataSafe Local Backup (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 9.4.60 - Dell Inc.)
Dell DataSafe Online (HKLM-x32\...\{7EC66A95-AC2D-4127-940B-0445A526AB2F}) (Version: 2.1.19634 - Dell)
Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)
Dell Getting Started Guide (HKLM-x32\...\{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}) (Version: 1.00.0000 - Dell Inc.)
Dell MusicStage (HKLM-x32\...\{91AF2672-F5BC-42CF-8037-A9D2F92BBCC0}) (Version: 1.5.201.0 - Fingertapps)
Dell PhotoStage (HKLM-x32\...\{E4335E82-17B3-460F-9E70-39D9BC269DB3}) (Version: 1.5.0.65 - ArcSoft)
Dell Stage (HKLM-x32\...\{E2EBA7C0-8072-447F-856D-FFEE8D15B23B}) (Version: 1.5.201.0 - Fingertapps)
Dell SupportAssist (HKLM\...\PC-Doctor for Windows) (Version: 1.2.6745.47 - Dell)
Dell SupportAssistAgent (HKLM-x32\...\{A62A2F03-3006-40CA-A3FA-C1086B2FEF5D}) (Version: 1.2.0.94 - Dell)
Dell Update (HKLM-x32\...\{DB82968B-57A4-4397-81A5-ECAB21B5DFCD}) (Version: 1.7.1015.0 - Dell Inc.)
Dell VideoStage (HKLM-x32\...\InstallShield_{DCE0E79A-B9AC-41AC-98C1-7EF0538BCA7F}) (Version: 1.2.0.1712 - CyberLink Corp.)
Dell VideoStage (x32 Version: 1.2.0.1712 - CyberLink Corp.) Hidden
DirectX 9 Runtime (x32 Version: 1.00.0000 - Sonic Solutions) Hidden
FamilySearch Indexing 3.11.0 (HKLM-x32\...\0591-8077-9297-0833) (Version: 3.11.0 - FamilySearch)
Google Earth (HKLM-x32\...\{817750FA-EC6A-485D-9901-0683AE6FFDF1}) (Version: 7.1.5.1557 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.29.5 - Google Inc.) Hidden
HP Officejet 5740 series Basic Device Software (HKLM\...\{7FAA9D15-FF0B-4593-8D4A-0B941FD1977A}) (Version: 34.2.117.50647 - Hewlett-Packard Co.)
HP Officejet 5740 series Help (HKLM-x32\...\{F17D53C7-DCE8-469C-9690-CF8F5903519C}) (Version: 34.0.0 - Hewlett Packard)
HP Photo Creations (HKU\S-1-5-21-2307240755-147757143-1248280979-1001\...\HP Photo Creations) (Version: 1.0.0.19522 - HP)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0000 - Microsoft) Hidden
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
iCloud (HKLM\...\{81E20D41-C277-4526-934D-F2380AF91B78}) (Version: 3.1.0.40 - Apple Inc.)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.30 - Irfan Skiljan)
iTunes (HKLM\...\{E690A491-702F-4DEC-9977-C015D1DBB57C}) (Version: 12.3.1.23 - Apple Inc.)
Java 8 Update 73 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218073F0}) (Version: 8.0.730.2 - Oracle Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Logitech Vid HD (HKLM-x32\...\Logitech Vid) (Version: 7.2 (7259) - Logitech Inc..)
Logitech Webcam Software (HKLM\...\{987FE247-4E69-4A2E-A961-D14F901FDBF6}) (Version: 12.10.1113 - Logitech Inc.)
Logitech Webcam Software Driver Package (HKLM\...\lvdrivers_12.10) (Version: 12.10.1110 - Logitech Inc.)
Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.6.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft Office Click-to-Run 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Excel Viewer (HKLM-x32\...\{95120000-003F-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Starter 2010 - English (HKLM-x32\...\{90140011-0066-0409-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft PowerPoint Viewer (HKLM-x32\...\{95140000-00AF-0409-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{820B6609-4C97-3A2B-B644-573B06A0F0CC}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Mozilla Firefox 45.0.2 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 45.0.2 (x86 en-US)) (Version: 45.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 45.0.2 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Norton Security Suite (HKLM-x32\...\N360) (Version: 22.6.0.142 - Symantec Corporation)
PhotoShowExpress (x32 Version: 2.0.063 - Sonic Solutions) Hidden
PlayReady PC Runtime x86 (HKLM-x32\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)
Product Improvement Study for HP Officejet 5740 series (HKLM\...\{308C7555-5D43-4D9A-BDC0-14B2948EF438}) (Version: 34.2.117.50647 - Hewlett-Packard Co.)
QualxServ Service Agreement (HKLM-x32\...\{903679E8-44C8-4C07-9600-05C92654FC50}) (Version: 2.0.0 - Dell Inc.)
QuickTime 7 (HKLM-x32\...\{80CEEB1E-0A6C-45B9-A312-37A1D25FDEBC}) (Version: 7.78.80.95 - Apple Inc.)
RBVirtualFolder64Inst (Version: 1.00.0000 - Roxio, Inc.) Hidden
Roxio Creator Starter (HKLM-x32\...\{6F0BBEFE-BE1C-419B-BA1F-D36C9E7915BC}) (Version: 12.1.77.0 - Roxio)
Roxio File Backup (Version: 1.3.2 - Roxio) Hidden
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 14.0 - HP)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 8.0.0.9103 - Microsoft Corporation)
Skype™ 7.21 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.21.100 - Skype Technologies S.A.)
Sonic CinePlayer Decoder Pack (x32 Version: 4.3.0 - Sonic Solutions) Hidden
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
SyncUP (x32 Version: 1.12.12400.17.102 - Nero AG) Hidden
Total Uninstall 6.9.1 (HKLM\...\Total Uninstall 6_is1) (Version: 6.9.1 - Gavrila Martau)
TrustedID (HKLM-x32\...\{C16A92EF-017B-4839-9C75-FBADB5A1FA27}) (Version: 5.0 - TrustedID)
TrustedID IDMonitor Identity Protection (HKLM-x32\...\{0E74474A-1CDF-4249-A507-CE8C1DCEC8BC}) (Version: 1.1.0 - TrustedID Inc)
Tweaking.com - Registry Backup (HKLM-x32\...\Tweaking.com - Registry Backup) (Version: 3.4.1 - Tweaking.com)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-2307240755-147757143-1248280979-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\The Arnolds\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay => No File

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0048D89E-7858-4F50-ABE6-156F1907B406} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe
Task: {0A0F12B4-FEEB-4B26-8B5D-5C89D98B0F9A} - \Microsoft\Windows\Windows Activation Technologies\ValidationTaskDeadline -> No File <==== ATTENTION
Task: {0B5D7F72-CA2A-420D-B484-CAF3C83AF35B} - \Microsoft\Windows\Windows Activation Technologies\ValidationTask -> No File <==== ATTENTION
Task: {1EA7DA97-101F-4450-A7EE-5DA46ACB9A0C} - System32\Tasks\{03FCFFFC-7B06-4071-95BB-D3FF43E4360E} => pcalua.exe -a D:\SETUP.EXE -d D:\
Task: {2F57269B-1E09-4E2D-AB1E-B0FDAC7D279C} - \Microsoft\Windows\WindowsBackup\ConfigNotification -> No File <==== ATTENTION
Task: {30831AF5-E62F-46A2-BF67-44916692D949} - System32\Tasks\Dell SupportAssistAgent AutoUpdate => C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssist.exe [2016-01-12] (Dell Inc.)
Task: {32393AEE-83ED-46AF-BA92-6CE50180C9BE} - System32\Tasks\Norton 360\Norton Error Analyzer => C:\Program Files (x86)\Norton Security Suite\Engine\22.6.0.142\SymErr.exe [2016-02-10] (Symantec Corporation)
Task: {3AEBEBAA-EAB8-4C8F-9E4C-7BB77A41A0FC} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {3D4ECD29-C64B-42B8-8566-EEA545D7B1CC} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
Task: {49A290FF-113F-44E0-99D4-35CEC754443D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-27] (Google Inc.)
Task: {4D520EFB-B3AA-4475-9EC1-D9A31DF57B34} - System32\Tasks\HP Photo Creations Communicator => C:\Users\The Arnolds\AppData\Roaming\HP Photo Creations\Communicator.exe [2015-12-02] ()
Task: {584CAE2E-A612-40E5-868C-48DD1FD45CC8} - System32\Tasks\{2CD8D41C-8923-4422-A94E-554C67A7733C} => C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVH.EXE [2015-03-18] (Microsoft Corporation)
Task: {717B36A2-F524-4EC9-9182-15E16B1A7E33} - System32\Tasks\Remediation\AntimalwareMigrationTask => C:\Program Files\Common Files\AV\Norton Security Suite\Upgrade.exe [2016-02-26] (Symantec Corporation)
Task: {8142211D-2FAA-4ACF-BD4C-1A2BAF75182D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-03-29] (Adobe Systems Incorporated)
Task: {83D1F5F7-0C45-42C5-95A1-0C6AB1CB5963} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\Dell\SupportAssist\uaclauncher.exe [2015-12-29] (PC-Doctor, Inc.)
Task: {92062FF6-0C68-4FC8-BA1F-57E8132CE648} - System32\Tasks\Norton 360\Norton Error Processor => C:\Program Files (x86)\Norton Security Suite\Engine\22.6.0.142\SymErr.exe [2016-02-10] (Symantec Corporation)
Task: {95251532-06A3-4933-8302-528EFCE5599F} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-12-14] (Adobe Systems Incorporated)
Task: {994C86AD-A929-4B2C-88A0-4E25A107A029} - System32\Tasks\Microsoft\Windows\SystemRestore\SR => C:\Windows\system32\srtasks.exe
Task: {A520B0F6-144C-4F22-AD53-11AC95063C43} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-27] (Google Inc.)
Task: {A6AF9377-77CE-47AB-AD7D-EC32CAD0C82D} - System32\Tasks\Microsoft\Windows\Location\Notifications => C:\Windows\System32\LocationNotificationWindows.exe
Task: {A9A8D595-9C8D-4662-BA8D-5DA442FC3CBE} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {AC4E5ACF-89F7-4220-BA21-81EE183975E2} - \Microsoft\Windows\Application Experience\AitAgent -> No File <==== ATTENTION
Task: {BB73F895-56A2-4E6C-AA6F-4401989E6989} - System32\Tasks\{C132595D-2BA6-44BE-98C5-8DCBDED0F80C} => C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVH.EXE [2015-03-18] (Microsoft Corporation)
Task: {C2CEF2CB-ABC9-4A09-B78C-454964317587} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-08-27] (Apple Inc.)
Task: {C965F7E8-B846-4C4B-A8E9-8C6C40536497} - System32\Tasks\HP AR Program Upload - 413983f85e9b405aba94288ac55fba3ef67f20ab8beb457d8cee87f875a16fbe => C:\Program Files\HP\HP Officejet 5740 series\bin\HPRewards.exe [2014-08-22] (Hewlett-Packard Development Company, LP)
Task: {CEE64558-E1A7-4D9D-80A7-2001912BE5B5} - \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector -> No File <==== ATTENTION
Task: {D043B63B-9B86-42D5-8572-A3310C9A6A4B} - System32\Tasks\PCDDataUploadTask => uaclauncher.exe
Task: {D4033CE2-1EF4-4BBA-9443-8DDFD680F51E} - System32\Tasks\HP AR Program Upload - e3003bafa5354944900a171dbfc23f205e608b3e79ef433bad2ebf14a609bb92 => C:\Program Files\HP\HP Officejet 5740 series\bin\HPRewards.exe [2014-08-22] (Hewlett-Packard Development Company, LP)
Task: {E24205DC-7C4B-4F59-8DB5-956C1B073B3C} - System32\Tasks\HPCustParticipation HP Officejet 5740 series => C:\Program Files\HP\HP Officejet 5740 series\Bin\HPCustPartic.exe [2014-08-22] (Hewlett-Packard Development Company, LP)
Task: {E4305E85-F92A-41B9-930D-C03DAEEC38C5} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\Dell\SupportAssist\sessionchecker.exe [2015-12-29] (PC-Doctor, Inc.)
Task: {E9180FE8-5EAB-4B9D-B667-5C6D44043BDB} - System32\Tasks\{23C08620-51E4-408D-965F-4906D4B5AC8A} => pcalua.exe -a D:\SETUP.EXE -d D:\
Task: {EC8651EE-EA75-4872-860D-A53B87B817C1} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Security Suite\Engine\22.6.0.142\WSCStub.exe [2016-02-26] (Symantec Corporation)
Task: {F984F246-943F-419D-8235-1106936777C5} - System32\Tasks\HPPSdr Restart Diagnose => C:\Users\THEARN~1\AppData\Local\Temp\7zS4B74\HPDiagnosticCoreUI.exe <==== ATTENTION
Task: {FA2BC0A6-8D4B-458A-85C8-2B8C72487513} - \Microsoft\Windows\MemoryDiagnostic\DecompressionFailureDetector -> No File <==== ATTENTION

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HP Photo Creations Communicator.job => C:\Users\The Arnolds\AppData\Roaming\HP Photo Creations\Communicator.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2015-01-20 23:35 - 2015-01-20 23:35 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-10-13 05:45 - 2015-10-13 05:45 - 01328912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2011-10-12 08:26 - 2011-08-18 11:05 - 02751808 _____ () C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
2015-08-25 10:25 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-08-25 10:25 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-08-25 10:25 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-08-25 10:25 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2015-08-25 10:25 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:5C321E34 [119]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

There are 7747 more sites.

IE restricted site: HKU\S-1-5-21-2307240755-147757143-1248280979-1001\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-2307240755-147757143-1248280979-1001\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-2307240755-147757143-1248280979-1001\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-2307240755-147757143-1248280979-1001\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-2307240755-147757143-1248280979-1001\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-2307240755-147757143-1248280979-1001\...\0190-dialers.com -> 0190-dialers.com
IE restricted site: HKU\S-1-5-21-2307240755-147757143-1248280979-1001\...\01i.info -> 01i.info
IE restricted site: HKU\S-1-5-21-2307240755-147757143-1248280979-1001\...\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com
IE restricted site: HKU\S-1-5-21-2307240755-147757143-1248280979-1001\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-2307240755-147757143-1248280979-1001\...\0411dd.com -> 0411dd.com
IE restricted site: HKU\S-1-5-21-2307240755-147757143-1248280979-1001\...\0511zfhl.com -> 0511zfhl.com
IE restricted site: HKU\S-1-5-21-2307240755-147757143-1248280979-1001\...\05p.com -> 05p.com
IE restricted site: HKU\S-1-5-21-2307240755-147757143-1248280979-1001\...\0632qyw.com -> 0632qyw.com
IE restricted site: HKU\S-1-5-21-2307240755-147757143-1248280979-1001\...\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com
IE restricted site: HKU\S-1-5-21-2307240755-147757143-1248280979-1001\...\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com
IE restricted site: HKU\S-1-5-21-2307240755-147757143-1248280979-1001\...\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com
IE restricted site: HKU\S-1-5-21-2307240755-147757143-1248280979-1001\...\0calories.net -> 0calories.net
IE restricted site: HKU\S-1-5-21-2307240755-147757143-1248280979-1001\...\0cj.net -> 0cj.net
IE restricted site: HKU\S-1-5-21-2307240755-147757143-1248280979-1001\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-2307240755-147757143-1248280979-1001\...\1-2005-search.com -> www.1-2005-search.com

There are 12563 more sites.


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 22:34 - 2014-06-30 11:32 - 00000027 ____N C:\Windows\system32\Drivers\etc\hosts

127.0.0.1 localhost

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2307240755-147757143-1248280979-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\The Arnolds\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 75.75.75.75 - 75.75.76.76
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: gupdate => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\startupreg: AccuWeatherWidget => "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj" --startup
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: AppleIEDAV => C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe
MSCONFIG\startupreg: ApplePhotoStreams => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: Dell DataSafe Online => C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe
MSCONFIG\startupreg: DellStage => "C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj" --startup
MSCONFIG\startupreg: Desktop Disc Tool => "C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe"
MSCONFIG\startupreg: HotKeysCmds => "C:\Windows\system32\hkcmd.exe"
MSCONFIG\startupreg: HP Software Update => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: iCloudServices => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
MSCONFIG\startupreg: IgfxTray => "C:\Windows\system32\igfxtray.exe"
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: LogitechQuickCamRibbon => "C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe" /hide
MSCONFIG\startupreg: MSC => "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
MSCONFIG\startupreg: Persistence => "C:\Windows\system32\igfxpers.exe"
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: RoxWatchTray => "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe"
MSCONFIG\startupreg: SDTray => "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{6E7CF561-0E8A-43E1-B10F-A93F8D9CBDC1}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{02F8FCB5-661D-49BF-BA7C-79FDF4F7767B}] => (Allow) c:\Program Files (x86)\Dell\VideoStage\VideoStage.exe
FirewallRules: [{BFAE84FA-14E7-4E3F-9A86-A1E59C4AB301}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{826D372A-81B1-4C3D-892A-875D7F73B58D}] => (Allow) LPort=2869
FirewallRules: [{4D1729AB-7560-4F11-A36D-5E157F0DE36A}] => (Allow) LPort=1900
FirewallRules: [{C22446EC-CBBF-438C-B11F-D9BFEE545A62}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{2784059C-0659-4E0C-98B0-DB172853D35E}] => (Allow) C:\Program Files (x86)\Windows Live\Mesh\MOE.exe
FirewallRules: [{8AFE31EF-18D4-4C17-8BF4-9D14ED83F8CF}] => (Allow) C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe
FirewallRules: [{CA2C27AB-D004-43A0-8B4F-5C10B0EBC056}] => (Allow) C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe
FirewallRules: [{BEA3ACB7-DA14-40F5-A13B-CBCB0F597A97}] => (Allow) LPort=9700
FirewallRules: [{97C3A09C-F71C-4B91-B571-EED0698B981E}] => (Allow) LPort=9701
FirewallRules: [{D672E387-7F0E-47F4-AD46-3BEA12687E8C}] => (Allow) LPort=9702
FirewallRules: [{82FC0D47-91C2-486B-8114-D1D3138AB59A}] => (Allow) LPort=9700
FirewallRules: [{67F41B24-18EA-4D4B-B4A9-C85F03A3B321}] => (Allow) C:\Program Files\dell stage\dell stage\accuweather\accuweather.exe
FirewallRules: [{218A652E-741F-4133-BFE1-FF28C344775D}] => (Allow) C:\Program Files\dell stage\musicstage\musicstageengine.exe
FirewallRules: [{CE9DC649-2F65-4F05-9FA1-D21BF742AC60}] => (Allow) C:\Program Files\dell stage\dell stage\stage_primary.exe
FirewallRules: [TCP Query User{42561331-461D-4D60-8A1D-C146BDDEF82F}C:\program files (x86)\logitech\logitech vid\vid.exe] => (Block) C:\program files (x86)\logitech\logitech vid\vid.exe
FirewallRules: [UDP Query User{CDCA9780-BA23-4FF2-8B9E-C74AD936905B}C:\program files (x86)\logitech\logitech vid\vid.exe] => (Block) C:\program files (x86)\logitech\logitech vid\vid.exe
FirewallRules: [{6DA311A3-5DB4-427A-A7AA-7A13E4A9744D}] => (Allow) C:\Program Files (x86)\Common Files\Nero\BDCore\Nero Blu-ray Player\Blu-rayPlayer.exe
FirewallRules: [{99A986D7-6D47-4669-B3B1-E41675F239BB}] => (Allow) C:\Program Files (x86)\Common Files\Nero\BDCore\Nero Blu-ray Player\Blu-rayPlayer.exe
FirewallRules: [{5B9FEFA8-AD8F-4061-9605-FC873FD52C50}] => (Allow) C:\Program Files (x86)\Logitech\Vid HD\Vid.exe
FirewallRules: [{FDCF9470-77AF-4340-8CCE-28A2D5A8AE8F}] => (Allow) C:\Program Files (x86)\Logitech\Vid HD\Vid.exe
FirewallRules: [{EF157E4B-9F6C-4526-AC0E-A41BF3EA259D}] => (Allow) C:\Users\Greg\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{603A1377-BA84-46C9-80D0-FB8F758ACA87}] => (Allow) C:\Users\The Arnolds\AppData\Local\Temp\7zS3FC5\HPDiagnosticCoreUI.exe
FirewallRules: [{C69A5A8A-7C5C-4106-8970-F7B0F5009985}] => (Allow) C:\Users\The Arnolds\AppData\Local\Temp\7zS3FC5\HPDiagnosticCoreUI.exe
FirewallRules: [{3FABFF64-45B4-4DB1-826A-272932291C53}] => (Allow) C:\Users\The Arnolds\AppData\Local\Temp\7zS41AF\HPDiagnosticCoreUI.exe
FirewallRules: [{679241EF-889B-4706-B580-3AEDF0052D76}] => (Allow) C:\Users\The Arnolds\AppData\Local\Temp\7zS41AF\HPDiagnosticCoreUI.exe
FirewallRules: [{6F1F857D-EE3A-47D3-BCF3-A4501C3B2827}] => (Allow) C:\Users\The Arnolds\AppData\Local\Temp\7zS70BD\HPDiagnosticCoreUI.exe
FirewallRules: [{AF78FF54-1048-488E-91A7-9C6EF18F95B4}] => (Allow) C:\Users\The Arnolds\AppData\Local\Temp\7zS70BD\HPDiagnosticCoreUI.exe
FirewallRules: [{0ECDF56A-4B0F-41A1-9018-FD7382E2DD99}] => (Allow) C:\Program Files\HP\HP Officejet 5740 series\bin\FaxApplications.exe
FirewallRules: [{2564526E-9BF2-463E-A979-66AE2D679EB3}] => (Allow) C:\Program Files\HP\HP Officejet 5740 series\bin\DigitalWizards.exe
FirewallRules: [{D8952622-61CD-4598-8EC2-055C609F084A}] => (Allow) C:\Program Files\HP\HP Officejet 5740 series\bin\SendAFax.exe
FirewallRules: [{B76D8A3B-4845-4240-B3BC-677F3E41ACC9}] => (Allow) C:\Program Files\HP\HP Officejet 5740 series\Bin\DeviceSetup.exe
FirewallRules: [{E95F8EA5-6C35-418E-B1DC-B447C4A74E6C}] => (Allow) LPort=5357
FirewallRules: [{5E3C7839-1E49-4B9B-B86B-16B4869AD7B6}] => (Allow) C:\Program Files\HP\HP Officejet 5740 series\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [{D2BB39CA-AA77-4046-8E9B-64A2BAD5F6A3}] => (Allow) C:\Users\The Arnolds\AppData\Local\Temp\7zS074A\HPDiagnosticCoreUI.exe
FirewallRules: [{7734CE69-DAD2-4CF3-B94F-78BAEF4BAB18}] => (Allow) C:\Users\The Arnolds\AppData\Local\Temp\7zS074A\HPDiagnosticCoreUI.exe
FirewallRules: [{4CA272DB-0AEE-408D-A550-314513B5E917}] => (Allow) C:\Users\The Arnolds\AppData\Local\Temp\7zS0782\HPDiagnosticCoreUI.exe
FirewallRules: [{0E21BE88-E3E3-4F1D-82C8-D67E02878D17}] => (Allow) C:\Users\The Arnolds\AppData\Local\Temp\7zS0782\HPDiagnosticCoreUI.exe
FirewallRules: [{9009994A-7EF0-4FD5-9981-33B3D693415E}] => (Allow) C:\Users\The Arnolds\AppData\Local\Temp\7zS0D41\HPDiagnosticCoreUI.exe
FirewallRules: [{85BC2F8B-C357-43FC-9709-C4D8384C5535}] => (Allow) C:\Users\The Arnolds\AppData\Local\Temp\7zS0D41\HPDiagnosticCoreUI.exe
FirewallRules: [{2229106B-7AD4-4834-8857-5CCFE70768D4}] => (Allow) C:\Users\The Arnolds\AppData\Local\Temp\7zS0D41\HPDiagnosticCoreUI.exe
FirewallRules: [{00E70EDE-44A0-40BD-B33E-D42A7302E69A}] => (Allow) C:\Users\The Arnolds\AppData\Local\Temp\7zS0D41\HPDiagnosticCoreUI.exe
FirewallRules: [{A78B306E-099A-46FA-918C-01C1245C4E00}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{EE8D4908-1EB3-4A00-92AF-7B6E88596ADB}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{2B670EB4-BA0F-4203-AFAA-B0572DEF3CB3}] => (Allow) C:\Users\The Arnolds\AppData\Local\Temp\7zS4B74\HPDiagnosticCoreUI.exe
FirewallRules: [{8AB18BC8-216F-4E94-8BB4-EBC4D89E0D02}] => (Allow) C:\Users\The Arnolds\AppData\Local\Temp\7zS4B74\HPDiagnosticCoreUI.exe
FirewallRules: [{1A45B8D0-5377-4A51-BBC3-77E1BC0DB222}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{C0BEFECD-DB48-4AA5-BA9D-FAF23AD56DA2}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{5A73F78D-3F4F-45F0-B9B5-78AB2879B246}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{E7AB27B1-97C8-49B5-A80B-6BF8FC5CC207}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{30657353-36A0-41C3-B933-1388D8188420}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{4590BC9A-4CB0-4042-9AA9-D6088D07083D}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{30B9E7DA-2288-46C4-8543-F8F173E82589}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service

==================== Restore Points =========================

12-04-2016 05:03:03 Windows Update
13-04-2016 03:00:29 Windows Update
14-04-2016 03:00:17 Windows Update
14-04-2016 16:12:50 Restore Operation
14-04-2016 17:32:07 Windows Update
15-04-2016 03:00:23 Windows Update

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (04/19/2016 05:42:58 AM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Information only.
(Patch task for {90140011-0066-0409-0000-0000000FF1CE}): DownloadLatest Failed: HTTP status 403: The client does not have sufficient access rights to the requested server object.

Error: (04/17/2016 09:58:48 AM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Information only.
(Patch task for {90140011-0066-0409-0000-0000000FF1CE}): DownloadLatest Failed: HTTP status 403: The client does not have sufficient access rights to the requested server object.

Error: (04/17/2016 09:48:33 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/17/2016 09:36:33 AM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Information only.
(Patch task for {90140011-0066-0409-0000-0000000FF1CE}): DownloadLatest Failed: HTTP status 403: The client does not have sufficient access rights to the requested server object.

Error: (04/17/2016 09:26:14 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/16/2016 11:28:43 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Information only.
(Patch task for {90140011-0066-0409-0000-0000000FF1CE}): DownloadLatest Failed: HTTP status 403: The client does not have sufficient access rights to the requested server object.

Error: (04/15/2016 03:45:13 AM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Information only.
(Patch task for {90140011-0066-0409-0000-0000000FF1CE}): DownloadLatest Failed: HTTP status 403: The client does not have sufficient access rights to the requested server object.

Error: (04/15/2016 03:35:04 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/14/2016 07:35:06 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program IEXPLORE.EXE version 11.0.9600.18231 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 18f0

Start Time: 01d196a4f9c91796

Termination Time: 31

Application Path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Report Id:

Error: (04/14/2016 04:52:26 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Information only.
(Patch task for {90140011-0066-0409-0000-0000000FF1CE}): DownloadLatest Failed: HTTP status 403: The client does not have sufficient access rights to the requested server object.


System errors:
=============
Error: (04/17/2016 10:55:07 AM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: The following fatal alert was generated: 10. The internal error state is 10.

Error: (04/17/2016 10:55:07 AM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: The following fatal alert was generated: 10. The internal error state is 10.

Error: (04/17/2016 09:55:12 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SftService service.

Error: (04/17/2016 09:48:04 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The HP CUE DeviceDiscovery Service service terminated with the following error:
%%126

Error: (04/17/2016 09:47:40 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 9:37:28 AM on ‎4/‎17/‎2016 was unexpected.

Error: (04/17/2016 09:27:28 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SftService service.

Error: (04/17/2016 09:26:58 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SftService service.

Error: (04/17/2016 09:25:59 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The HP CUE DeviceDiscovery Service service terminated with the following error:
%%126

Error: (04/16/2016 05:07:13 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: The following fatal alert was generated: 10. The internal error state is 10.

Error: (04/16/2016 05:07:13 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: The following fatal alert was generated: 10. The internal error state is 10.


CodeIntegrity:
===================================
Date: 2014-06-30 11:25:23.605
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-06-30 11:25:23.535
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i3-2120 CPU @ 3.30GHz
Percentage of memory in use: 61%
Total physical RAM: 6056.63 MB
Available physical RAM: 2312.43 MB
Total Virtual: 12111.45 MB
Available Virtual: 8059.02 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:916.66 GB) (Free:707.49 GB) NTFS
Drive z: () (Fixed) (Total:0.04 GB) (Free:0.04 GB) FAT

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 931.5 GB) (Disk ID: 31547343)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Active) - (Size=14.8 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=916.7 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

aswMBR version 1.0.1.2252 Copyright(c) 2014 AVAST Software
Run date: 2016-04-19 10:29:06
-----------------------------
10:29:06.982 OS Version: Windows x64 6.1.7601 Service Pack 1
10:29:06.982 Number of processors: 4 586 0x2A07
10:29:06.982 ComputerName: 2011 UserName:
10:29:15.532 Initialize success
10:29:16.352 VM: initialized successfully
10:29:16.352 VM: Intel CPU supported
10:29:20.113 VM: supported disk I/O ataport.SYS
10:30:39.867 AVAST engine defs: 16033102
10:32:08.679 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
10:32:08.679 Disk 0 Vendor: ST31000524AS JC47 Size: 953869MB BusType: 3
10:32:08.769 VM: Disk 0 MBR read successfully
10:32:08.779 Disk 0 MBR scan
10:32:08.779 Disk 0 Windows VISTA default MBR code
10:32:08.789 Disk 0 Partition 1 00 DE Dell Utility DELL 4.1 39 MB offset 63
10:32:08.799 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 15166 MB offset 81920
10:32:08.799 Disk 0 Boot: NTFS code=1
10:32:08.809 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 938662 MB offset 31141888
10:32:08.829 Disk 0 scanning C:\Windows\system32\drivers
10:32:18.818 Service scanning
10:32:37.834 Modules scanning
10:32:37.834 Disk 0 trace - called modules:
10:32:37.854 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS intelide.sys PCIIDEX.SYS hal.dll atapi.sys
10:32:37.864 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8006609060]
10:32:37.864 3 CLASSPNP.SYS[fffff88001ac343f] -> nt!IofCallDriver -> [0xfffffa8006369520]
10:32:37.874 5 ACPI.sys[fffff88000f1a7a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8006361060]
10:32:38.844 AVAST engine scan C:\Windows
10:32:41.440 AVAST engine scan C:\Windows\system32
10:35:58.178 AVAST engine scan C:\Windows\system32\drivers
10:36:28.460 AVAST engine scan C:\Users\The Arnolds
11:20:52.291 AVAST engine scan C:\ProgramData
11:30:07.484 Disk 0 statistics 4833202/0/5 @ 0.82 MB/s
11:30:07.494 Scan finished successfully
11:52:51.904 Disk 0 MBR has been saved successfully to "C:\Users\The Arnolds\Desktop\MBR.dat"
11:52:51.904 The log file has been saved successfully to "C:\Users\The Arnolds\Desktop\aswMBR.txt"
Juliet
2016-04-19, 20:05
We'll do some cleaning first and see how the machine reacts to that.
What I'm a bit fearful of is that you might be another victim of Microsoft's last versions of updates that went out this month that, myself had a very hard time recovering from.

Let's begin.

Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)


https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG




start
CreateRestorePoint:
CloseProcesses:
HKLM-x32\...\Run: [] => [X]
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-2307240755-147757143-1248280979-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
SearchScopes: HKLM -> DefaultScope {49606DC7-976D-4030-A74E-9FB5C842FA68} URL =
SearchScopes: HKLM-x32 -> DefaultScope value is missing
SearchScopes: HKU\S-1-5-21-2307240755-147757143-1248280979-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\ssv.dll [2016-02-11] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\jp2ssv.dll [2016-02-11] (Oracle Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.73.2 -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\dtplugin\npDeployJava1.dll [2016-02-11] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.73.2 -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\plugin2\npjp2.dll [2016-02-11] (Oracle Corporation)
CHR HKLM\...\Chrome\Extension: - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: - hxxps://clients2.google.com/service/update2/crx
C:\Users\The Arnolds\jobq.dat
CustomCLSID: HKU\S-1-5-21-2307240755-147757143-1248280979-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\The Arnolds\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay => No File
Task: {0A0F12B4-FEEB-4B26-8B5D-5C89D98B0F9A} - \Microsoft\Windows\Windows Activation Technologies\ValidationTaskDeadline -> No File <==== ATTENTION
Task: {0B5D7F72-CA2A-420D-B484-CAF3C83AF35B} - \Microsoft\Windows\Windows Activation Technologies\ValidationTask -> No File <==== ATTENTION
Task: {2F57269B-1E09-4E2D-AB1E-B0FDAC7D279C} - \Microsoft\Windows\WindowsBackup\ConfigNotification -> No File <==== ATTENTION
Task: {AC4E5ACF-89F7-4220-BA21-81EE183975E2} - \Microsoft\Windows\Application Experience\AitAgent -> No File <==== ATTENTION
Task: {CEE64558-E1A7-4D9D-80A7-2001912BE5B5} - \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector -> No File <==== ATTENTION
Task: {F984F246-943F-419D-8235-1106936777C5} - System32\Tasks\HPPSdr Restart Diagnose => C:\Users\THEARN~1\AppData\Local\Temp\7zS4B74\HPDiagnosticCoreUI.exe <==== ATTENTION
Task: {FA2BC0A6-8D4B-458A-85C8-2B8C72487513} - \Microsoft\Windows\MemoryDiagnostic\DecompressionFailureDetector -> No File <==== ATTENTION
AlternateDataStreams: C:\ProgramData\Temp:5C321E34 [119]
CMD: ipconfig /flushdns
CMD: netsh winsock reset all
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
CMD: bitsadmin /reset /allusers
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f

Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
EmptyTemp:
Hosts:
End


Open FRST/FRST64 and press the > Fix < button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

~~~~~~~~~~~~~~~~

http://i.imgur.com/BY4dvz9.png AdwCleaner

Please download AdwCleaner (http://www.bleepingcomputer.com/download/adwcleaner/dl/125/) and save the file to your Desktop.
Right-click AdwCleaner.exe and select http://i.imgur.com/AVOiBNU.jpg Run as administrator to run the programme.
Follow the prompts.
Click http://i.imgur.com/A49sxPr.png Scan.
Upon completion, click http://i.imgur.com/6cyn5v5.png Logfile. A log (AdwCleaner[S1].txt) will open. Briefly check the log for anything you [i]know to be legitimate.
Return to AdwCleaner. Ensure anything you know to be legitimate does not have a checkmark under the corresponding tab.
Click http://i.imgur.com/MqHawIb.png Clean.
Follow the prompts and allow your computer to reboot.
After the reboot, a log (AdwCleaner[C1].txt) will open. Copy the contents of the log and paste in your next reply.

[i]-- File and folder backups are made for items removed using this programme. Should a legitimate file or folder be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the item. Please do not overly concern yourself with the contents of AdwCleaner[C1].txt.



Please download Junkware Removal Tool (http://www.bleepingcomputer.com/download/junkware-removal-tool/)
or from here http://downloads.malwarebytes.org/file/jrt
to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

please post

~~~~
Fixlog.txt
AdwCleaner[C1].txt
JRT.txt
mla34
2016-04-20, 19:58
Hi, Juliet,
Thanks so much for your help. Below please find the three logs.
I thought I should tell you that I got an application error box when I opened the Farber tool. Not sure if it is anything to worry about.

Exception EAccessViolation in module ERUNT.exe at 00003A3E.
Access violation at address 00403A3E in module 'ERUNT.exe'.
Write of address 0076005D


Fix result of Farbar Recovery Scan Tool (x64) Version:18-04-2016
Ran by The Arnolds (2016-04-20 11:36:04) Run:1
Running from C:\Users\The Arnolds\Desktop
Loaded Profiles: The Arnolds & Greg (Available Profiles: The Arnolds & Greg)
Boot Mode: Normal
==============================================

fixlist content:
*****************
start
CreateRestorePoint:
CloseProcesses:
HKLM-x32\...\Run: [] => [X]
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-2307240755-147757143-1248280979-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
SearchScopes: HKLM -> DefaultScope {49606DC7-976D-4030-A74E-9FB5C842FA68} URL =
SearchScopes: HKLM-x32 -> DefaultScope value is missing
SearchScopes: HKU\S-1-5-21-2307240755-147757143-1248280979-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\ssv.dll [2016-02-11] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\jp2ssv.dll [2016-02-11] (Oracle Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.73.2 -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\dtplugin\npDeployJava1.dll [2016-02-11] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.73.2 -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\plugin2\npjp2.dll [2016-02-11] (Oracle Corporation)
CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx
C:\Users\The Arnolds\jobq.dat
CustomCLSID: HKU\S-1-5-21-2307240755-147757143-1248280979-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\The Arnolds\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay => No File
Task: {0A0F12B4-FEEB-4B26-8B5D-5C89D98B0F9A} - \Microsoft\Windows\Windows Activation Technologies\ValidationTaskDeadline -> No File <==== ATTENTION
Task: {0B5D7F72-CA2A-420D-B484-CAF3C83AF35B} - \Microsoft\Windows\Windows Activation Technologies\ValidationTask -> No File <==== ATTENTION
Task: {2F57269B-1E09-4E2D-AB1E-B0FDAC7D279C} - \Microsoft\Windows\WindowsBackup\ConfigNotification -> No File <==== ATTENTION
Task: {AC4E5ACF-89F7-4220-BA21-81EE183975E2} - \Microsoft\Windows\Application Experience\AitAgent -> No File <==== ATTENTION
Task: {CEE64558-E1A7-4D9D-80A7-2001912BE5B5} - \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector -> No File <==== ATTENTION
Task: {F984F246-943F-419D-8235-1106936777C5} - System32\Tasks\HPPSdr Restart Diagnose => C:\Users\THEARN~1\AppData\Local\Temp\7zS4B74\HPDiagnosticCoreUI.exe <==== ATTENTION
Task: {FA2BC0A6-8D4B-458A-85C8-2B8C72487513} - \Microsoft\Windows\MemoryDiagnostic\DecompressionFailureDetector -> No File <==== ATTENTION
AlternateDataStreams: C:\ProgramData\Temp:5C321E34 [119]
CMD: ipconfig /flushdns
CMD: netsh winsock reset all
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
CMD: bitsadmin /reset /allusers
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f

Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
EmptyTemp:
Hosts:
End
*****************

Restore point was successfully created.
Processes closed successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value removed successfully
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ SkyDrive1" => key removed successfully
HKCR\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A} => key not found.
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ SkyDrive2" => key removed successfully
HKCR\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => key not found.
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ SkyDrive3" => key removed successfully
HKCR\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524} => key not found.
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully
"HKU\S-1-5-21-2307240755-147757143-1248280979-1001\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
"HKU\S-1-5-21-2307240755-147757143-1248280979-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => key removed successfully
HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}" => key removed successfully
"HKCR\Wow6432Node\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}" => key removed successfully
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}" => key removed successfully
"HKCR\Wow6432Node\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}" => key removed successfully
"HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=11.73.2" => key removed successfully
C:\Program Files (x86)\Java\jre1.8.0_73\bin\dtplugin\npDeployJava1.dll => moved successfully
"HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=11.73.2" => key removed successfully
C:\Program Files (x86)\Java\jre1.8.0_73\bin\plugin2\npjp2.dll => moved successfully
"HKLM\SOFTWARE\Google\Chrome\Extensions\iikflkcanblccfahdhdonehdalibjnif" => key removed successfully
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\iikflkcanblccfahdhdonehdalibjnif" => key removed successfully
C:\Users\The Arnolds\jobq.dat => moved successfully
"HKU\S-1-5-21-2307240755-147757143-1248280979-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{0A0F12B4-FEEB-4B26-8B5D-5C89D98B0F9A}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0A0F12B4-FEEB-4B26-8B5D-5C89D98B0F9A}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Windows Activation Technologies\ValidationTaskDeadline" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{0B5D7F72-CA2A-420D-B484-CAF3C83AF35B}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0B5D7F72-CA2A-420D-B484-CAF3C83AF35B}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Windows Activation Technologies\ValidationTask" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2F57269B-1E09-4E2D-AB1E-B0FDAC7D279C}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2F57269B-1E09-4E2D-AB1E-B0FDAC7D279C}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\WindowsBackup\ConfigNotification" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{AC4E5ACF-89F7-4220-BA21-81EE183975E2}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AC4E5ACF-89F7-4220-BA21-81EE183975E2}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Application Experience\AitAgent" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CEE64558-E1A7-4D9D-80A7-2001912BE5B5}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CEE64558-E1A7-4D9D-80A7-2001912BE5B5}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\MemoryDiagnostic\CorruptionDetector" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{F984F246-943F-419D-8235-1106936777C5}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F984F246-943F-419D-8235-1106936777C5}" => key removed successfully
C:\Windows\System32\Tasks\HPPSdr Restart Diagnose => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\HPPSdr Restart Diagnose" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{FA2BC0A6-8D4B-458A-85C8-2B8C72487513}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FA2BC0A6-8D4B-458A-85C8-2B8C72487513}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\MemoryDiagnostic\DecompressionFailureDetector" => key removed successfully
C:\ProgramData\Temp => ":5C321E34" ADS removed successfully.

========= ipconfig /flushdns =========


Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========


========= netsh winsock reset all =========


Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.


========= End of CMD: =========


========= netsh int ipv4 reset =========

Reseting Interface, OK!
Restart the computer to complete this action.


========= End of CMD: =========


========= netsh int ipv6 reset =========

Reseting Interface, OK!
Restart the computer to complete this action.


========= End of CMD: =========


========= bitsadmin /reset /allusers =========


BITSADMIN version 3.0 [ 7.5.7601 ]
BITS administration utility.
(C) Copyright 2000-2006 Microsoft Corp.

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

{C8F1E7E2-626D-4FB1-9522-63EE964D08FB} canceled.
{FA8A3809-4D9F-4DFD-B7FA-5D59FD272650} canceled.
{3A8C4A37-FF55-4169-B3E9-10BE2DFB52E7} canceled.
{1703EAD5-4996-485B-94A6-8DEAD48ECE59} canceled.
{BD0132F4-58FA-4004-8D9E-9629715E0831} canceled.
{2E7A655D-1DCC-4738-AC36-BAF92A01CF81} canceled.
{650F77CC-98B7-4FA0-851B-BD495AD024BD} canceled.
{AC696913-5CC2-4EEE-AA64-14BF3AAFF754} canceled.
{4245BFF7-6062-4A81-8219-21D2EB3F15E8} canceled.
{2B309D8D-32AA-41AF-BA5D-1F1AC9F7969E} canceled.
{B174FCD1-F1AB-4501-8E05-C4308C68CE24} canceled.
{EBA29719-41A4-423F-A7D3-6917729E250E} canceled.
{479A2D55-2AFC-450D-9A72-B073B16D1AFA} canceled.
{EF47A355-EEF1-4610-99F0-493AF670553B} canceled.
{C59FAB6B-2B4C-4857-B247-EBB623B99EFA} canceled.
{E0928E36-396B-46C0-835E-45A382C68E1A} canceled.
{6FFA84A6-D630-4341-B771-E9AA8A47665D} canceled.
{50BB570F-C22C-46D7-B831-48A428F1ED95} canceled.
{D596DD1A-ACBB-4D14-8BA1-95A0FC677300} canceled.
{E615F111-500F-4FD0-B582-F6B1690BDF95} canceled.
{6DCD3F22-129F-44AF-8998-90F6325646D9} canceled.
{5CFECE2E-FE0E-4647-8A5D-02F5B216AD31} canceled.
{84424D38-FF45-4C74-83E3-7AB4768D4BAF} canceled.
{E1AFB6E6-A65B-4B8A-8371-3D530730694D} canceled.
{1398102C-2B20-49B4-A4B2-72236CD03418} canceled.
{0A111C9D-DCDB-4605-9380-1176ADC0DDFD} canceled.
{A1FE0518-0B1F-44CC-84CC-1BE917625C6F} canceled.
{397AD199-E21A-4259-B2AB-BBE664097437} canceled.
{FAB7899F-24AE-40B5-8C6B-C96A39E6C5E3} canceled.
{2D0CB0CA-C618-4198-BB91-4491EE8CDD33} canceled.
{3FF265F1-37B2-4039-A719-6026C0A2BF43} canceled.
{37598842-50A6-403D-8CE8-53A9F556E64E} canceled.
{ACCFB975-77E6-4FEB-B31E-3B3E2CD265A4} canceled.
{8B42C2D4-4F09-47B5-AEF5-DFAD26DD19F2} canceled.
{DDAF781D-B827-4123-BD54-A0113DEB53E1} canceled.
{70BA5DD8-10C0-4831-BCFE-3D24EC50AD62} canceled.
{8246EA4E-07B3-41D2-B846-6C9C517D410A} canceled.
{80D958BF-33ED-4310-96FE-513085C7E7EB} canceled.
{20DDF8DE-61F3-4106-B240-5023F31C7C5E} canceled.
{20F274AD-EA2A-42DB-881F-DA6723CB91DC} canceled.
{48F222AC-EF7F-4963-95F3-8354118D76B6} canceled.
{4BD7A03C-5470-45B2-B38A-DF5B7483FEF1} canceled.
{3A8AB962-93EC-4A7D-AA32-CD04EA39D55B} canceled.
{B2D803E4-7865-40D9-BCB0-65B203153DC1} canceled.
{6A4BFECC-DE9F-47F0-BFBE-6AACEBE13541} canceled.
{BA771650-BB1F-4755-B9BA-A35A35AC057C} canceled.
{4BBDDB0A-E4EA-43AE-A627-780791D286E6} canceled.
{271E7100-8F6C-42D1-AF15-937E76AB01EF} canceled.
{C1113270-2EB0-4E0B-B7C2-7ADB56071E4F} canceled.
{B0B61774-3B7A-41E0-9EDA-78810038E996} canceled.
{ACF64D01-296C-45CA-8454-320159042020} canceled.
{F193060E-BD26-4AD7-8842-3D08B36ECB1A} canceled.
{2FEB180A-DCEA-484E-8D3A-E0D02001ADC7} canceled.
{7A28CE5B-31A7-4993-99E9-8A5F67071712} canceled.
{1291F102-4BE4-4170-B1CF-5102E2C172A8} canceled.
{27563AF9-9B90-4938-93C6-58B074F25D5A} canceled.
{C34A7CC1-F02D-4F5C-89D2-C0871D034F1E} canceled.
{660440A3-32C0-40C5-B0AD-1607FF980BCD} canceled.
{E5A8EAE1-3327-4CC8-8ED4-5A4AFC635EC3} canceled.
59 out of 59 jobs canceled.

========= End of CMD: =========


========= reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========

The operation completed successfully.



========= End of Reg: =========


========= reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========

The operation completed successfully.



========= End of Reg: =========


========= reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========

The operation completed successfully.



========= End of Reg: =========


========= reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========

The operation completed successfully.



========= End of Reg: =========

C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.
EmptyTemp: => 1.5 GB temporary data Removed.


The system needed a reboot.

==== End of Fixlog 11:42:23 ====


# AdwCleaner v5.112 - Logfile created 20/04/2016 at 12:04:50
# Updated 17/04/2016 by Xplode
# Database : 2016-04-19.5 [Server]
# Operating system : Windows 7 Home Premium Service Pack 1 (X64)
# Username : The Arnolds - 2011
# Running from : C:\Users\The Arnolds\Desktop\AdwCleaner.exe
# Option : Clean
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****

[-] Folder Deleted : C:\Users\The Arnolds\AppData\Roaming\Yahoo!\Companion

***** [ Files ] *****


***** [ DLLs ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****

[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\YMERemote.DLL
[-] Key Deleted : HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar
[-] Key Deleted : HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar.1
[-] Key Deleted : HKLM\SOFTWARE\Classes\YMERemote.YMECompPlugin
[-] Key Deleted : HKLM\SOFTWARE\Classes\YMERemote.YMECompPlugin.1
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{7D831388-D405-4272-9511-A07440AD2927}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F51C15D4-3D0A-4DBA-A095-EBCC09F24DA2}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8233093C-178B-484B-979E-3C6B5B147DBC}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{B722ED8B-0B38-408E-BB89-260C73BCF3D4}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}
[-] Key Deleted : HKCU\Software\Yahoo\Companion
[-] Key Deleted : HKCU\Software\Yahoo\YFriendsBar
[-] Key Deleted : HKCU\Software\AppDataLow\Software\Yahoo\Companion
[-] Key Deleted : HKLM\SOFTWARE\Yahoo\Companion

***** [ Web browsers ] *****

[-] [C:\Users\The Arnolds\AppData\Roaming\Mozilla\Firefox\Profiles\3r6yn46d.default\prefs.js] Deleted : user_pref("datareporting.sessions.previous.466", "{"s":1460982234599,"a":81,"t":47935,"c":true,"m":826,"fp":991,"sr":1034}");
[-] [C:\Users\The Arnolds\AppData\Roaming\Mozilla\Firefox\Profiles\3r6yn46d.default\prefs.js] Deleted : user_pref("urlclassifier.keyupdatetime.hxxps://sb-ssl.google.com/safebrowsing/newkey", 1399722345);
[-] [C:\Users\Greg\AppData\Roaming\Mozilla\Firefox\Profiles\nm1zf3dw.default-1447859967497\prefs.js] Deleted : user_pref("datareporting.healthreport.lastDataSubmissionRequestedTime", "1450802345319");

*************************

:: "Tracing" keys deleted
:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C1].txt - [2469 bytes] - [20/04/2016 12:04:50]
C:\AdwCleaner\AdwCleaner[S1].txt - [2710 bytes] - [20/04/2016 12:00:13]

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [2615 bytes] ##########


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.4 (03.14.2016)
Operating System: Windows 7 Home Premium x64
Ran by The Arnolds (Administrator) on Wed 04/20/2016 at 12:43:44.95
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 12

Successfully deleted: C:\ProgramData\mntemp (File)
Successfully deleted: C:\Windows\system32\Tasks\PCDEventLauncherTask (Task)
Successfully deleted: C:\Windows\system32\Tasks\PCDoctorBackgroundMonitorTask (Task)
Successfully deleted: C:\Windows\wininit.ini (File)
Successfully deleted: C:\Users\The Arnolds\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NCVFOHVO (Temporary Internet Files Folder)
Successfully deleted: C:\Users\The Arnolds\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OW887L8U (Temporary Internet Files Folder)
Successfully deleted: C:\Users\The Arnolds\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R6V0ND2T (Temporary Internet Files Folder)
Successfully deleted: C:\Users\The Arnolds\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XOQMV61N (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NCVFOHVO (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OW887L8U (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R6V0ND2T (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XOQMV61N (Temporary Internet Files Folder)



Registry: 0





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Wed 04/20/2016 at 12:45:53.20
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Juliet
2016-04-20, 22:55
I got an application error box when I opened the Farber tool

Exception EAccessViolation in module ERUNT.exe

Yes I see the error for a backup but we can continue.

PCDoctor
Is what was found in your logs a left over from an incomplete uninstall?



Please download the Malwarebytes Anti-Malware (https://downloads.malwarebytes.org/file/mbam) setup file to your Desktop.


Open mbam-setup.x.x.xxxx.exe (x represents the version #) and follow the prompts to install the programme.

Open Malwarebytes Anti-Malware and click Update.

Once updated, click the Settings tab, followed by Detection and Protection and tick Scan for rootkits.

Click the Scan tab, ensure Threat Scan is selected and click Start Scan.

Note: You may see the following message, "Could not load DDA driver". Click Yes, allow your PC to reboot and continue afterwards.

If threats are detected, click Remove Selected. If you are prompted to reboot, click Yes.

Upon completion of the scan (or after the reboot), click the History tab.

Click Application Logs, followed by the first Scan Log.

Click Export, followed by Copy to Clipboard. Paste the log in your next reply.



~~~~~~~~~~~~~~~~~~``

What we can do now is run an online scan with Eset, a good trusted scanner, reliable and thorough.
The settings I suggest will show us items located in quarantine folders so don't be alarmed with this, also, in case of a false positive I ask that you not allow it to delete what it does find.
This scanner can take quite a bit of time to run, depending of course how full your computer is.



http://i.imgur.com/GzlsbnV.png ESET Online Scan
Note: This scan may take a long time to complete. Please do not browse the Internet whilst your Anti-Virus is disabled.

Please download ESET Online Scan (http://download.eset.com/special/eos/esetsmartinstaller_enu.exe) and save the file to your Desktop.
Temporarily disable your anti-virus software. For instructions, please refer to the following link (http://www.bleepingcomputer.com/forums/t/114351/how-to-temporarily-disable-your-anti-virus-firewall-and-anti-malware-programs/).
Double-click esetsmartinstaller_enu.exe to run the programme.
Agree to the EULA by placing a checkmark next to Yes, I accept the Terms of Use. Then click Start.
Agree to the Terms of Use once more and click Start. Allow components to download.
Place a checkmark next to Enable detection of potentially unwanted applications.
Click Advanced settings. Place a checkmark next to:

Scan archives
Scan for potentially unsafe applications
Enable Anti-Stealth technology


Ensure Remove found threats is unchecked.
Click Start.
Wait for the scan to finish. Please be patient as this can take some time.
Upon completion, click http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetListThreats.png. If no threats were found, skip the next two bullet points.
Click http://billy-oneal.com/Canned%20Speeches/speechimages/eset/esetExport.png and save the file to your Desktop, naming it something such as "MyEsetScan".
Push the Back button.
Place a checkmark next to http://i.imgur.com/KN1w2nv.png and click http://i.imgur.com/SzOC1p0.png.
Re-enable your anti-virus software.
Copy the contents of the log and paste in your next reply.

Also. please tell me how the computer is now.
mla34
2016-04-21, 03:05
Hi, Juliet,

I have no idea what this is.
PCDoctor
Is what was found in your logs a left over from an incomplete uninstall?

The computer is still very slow and laggy. The windows open and close in slow motion - fading in and out very slowly.
Below please fine the logs from my latest homework.:)


Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 4/20/2016
Scan Time: 4:37 PM
Logfile:
Administrator: Yes

Version: 2.2.1.1043
Malware Database: v2016.04.20.06
Rootkit Database: v2016.04.17.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: The Arnolds

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 505229
Time Elapsed: 50 min, 28 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)


C:\Program Files (x86)\Dell DataSafe Local Backup\hstart.exe a variant of Win32/HiddenStart.A potentially unsafe application
C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\hstart.exe a variant of Win32/HiddenStart.A potentially unsafe application
C:\Windows\SysWOW64\Adobe\Shockwave 12\gt.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application
Juliet
2016-04-21, 04:25
ESET log is ok, nothing outright malicious to worry about, just be aware of the installer entries in the downloads folder, they are bundled with unwanted extras.
If you do intend to use those installers do not use the default setting, use advanced option if available and be sure to untick the unwanted extras that will be offered.

Task: {83D1F5F7-0C45-42C5-95A1-0C6AB1CB5963} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\Dell\SupportAssist\uaclauncher.exe [2015-12-29] (PC-Doctor, Inc.)
It's coming through a Dell SupportAssist application.

Has Norton Security Suite updating as it should?
Have you had trouble trying to download and install this latest updates from Microsoft?

When trying to open a browser or program, right click on the task bar and open task manager, then at the bottom of that window click on Show all Processes from all users.
From here try to locate which process is using the most CPU?

From what your describing, something is running in the background using all resources.
mla34
2016-04-21, 09:46
Hi, Juliet,

Thanks for the explanations.

Norton has been updating as usual.

Microsoft updates have never been an issue but this all problem started with the most recent update last week. Is there something specific in the update that would be causing this problem? Can I uninstall and reinstall updates? Any way to figure out what bit might be causing the issue?

As for Task Manager, I don't know what most of the entries are, except for the ones that include the actual name of a program that I am familiar with. It shows 86 programs open and using about 3% CPU usage. All the "CPU" numbers are zero, with the exception of System Idle Process with fluctuates around 100 and System with fluctuates around 2.

I have not upgraded to Microsoft 10. I have read pros and cons about it and now with these issues, I don't know if it is something I should do. Would that help? Would it create more issues?

Also, I have heard that Java is not something that is necessary to have on the computer and can actually cause a security issue. Should I remove it?

Are there any other things to do to try and find the issue? You mentioned in your first post that you also had an issue with the Microsoft update. Were you able to solve your issues? Did you have the same slow and fading windows?
Juliet
2016-04-21, 13:37
Norton has been updating as usual
It's probably not Nortons doing the slow down but you can experiment.
Right click on the icon and see if you can temporarily disable it just to experiment to see if a browser will open as it should. Then re-enable it.


Microsoft updates have never been an issue but this all problem started with the most recent update last week. Is there something specific in the update that would be causing this problem? Can I uninstall and reinstall updates? Any way to figure out what bit might be causing the issue?
I like never found out what it was. I had scvhost.exe stay on 25 to 50 cpu for days on end.....When trying to update Microsoft Security Essentials it could not download, checking for windows updates would search for hours and never finish. I could end task on the scvhost.exe that was pulling all my resources and it would stop everything.
I finally found an article at another forum where others were experiencing the same and downloaded and update someone suggested which in it's own is still a risk and BINGO, I was cured.
I'm explaining my experience, which can be totally isolated and not recommended to others.


I have not upgraded to Microsoft 10. I have read pros and cons about it and now with these issues, I don't know if it is something I should do. Would that help? Would it create more issues?
You know, thats a hard question have read pros and cons too. Myself let's wait till we see no more items return to be deleted.


Also, I have heard that Java is not something that is necessary to have on the computer and can actually cause a security issue. Should I remove it?
I think at this time you can remove Java from add/remove programs list. If in time an application needs Java to run you can re-download it then.

~~~~~~~~~~~~~~~~~~~~~

http://i.imgur.com/mlEX1wH.png RogueKiller Scan

Please download RogueKiller (x32) (http://www.adlice.com/download/roguekiller/?wpdmdl=3744&ind=aHR0cHM6Ly93d3cuZHJvcGJveC5jb20vcy9rYW80MTByODY4dHF5cjEvUm9ndWVLaWxsZXIuZXhlP2RsPTA) / RogueKiller (x64) (http://www.adlice.com/download/roguekiller/?wpdmdl=3744&ind=aHR0cHM6Ly93d3cuZHJvcGJveC5jb20vcy9rMnYxNTJ4MDEyaTFzOWUvUm9ndWVLaWxsZXJYNjQuZXhlP2RsPTA) and save the file to your Desktop.
Close any running programmes.
Right-click RogueKiller.exe / RogueKillerx64.exe and select http://i.imgur.com/AVOiBNU.jpg Run as administrator to run the programme.
Allow the Prescan to complete. Upon completion, a window will open. Click Accept.
A browser window may open. Close the browser window.
Click the SCAN tab, followed by Start Scan.
Upon completion, a window titled RogueKiller FREE and a browser window may open. Close both windows.
Click Report, followed by Open TXT.
Close the programme. Do not fix anything!
A log (rk_xxx.txt) will be open. Copy the contents of the log and paste in your next reply.


~~~~~~~~~~~~~~~~~


http://i1269.photobucket.com/albums/jj590/OCD-WTT/bullseye_zpse9eaf36e.gif Malwarebytes Anti-Rootkit

Download Malwarebytes Anti-Rootkit (http://downloads.malwarebytes.org/file/mbar)
Once the file has been downloaded, right click on the downloaded file and select the Extract all menu option.
Follow the instructions to extract the ZIP file to a folder called mbar-versionnumber on your desktop.
Once the ZIP file has been extracted, open the folder and when that folder opens, double-click on the mbar folder.
Double-click on the mbar.exe file to launch Malwarebytes Anti-Rootkit.
After you double-click on the mbar.exe file, you may receive a User Account Control (UAC) message if you are sure you wish to allow the program to run. Please allow to start Malwarebytes Anti-Rootkit correctly.
Malwarebytes Anti-Rootkit will now install necessary drivers that are required for the program to operate correctly.
If you receive a DDA driver message like could not load DDA driver, click on the Yes button and Malwarebytes Anti-Rootkit will now restart your computer and will start automatically.

http://i1269.photobucket.com/albums/jj590/OCD-WTT/MBAMAnti-Rootkit1_zps4613be8c.png


Please click by the introduction screen on the Next button to continue.


http://i1269.photobucket.com/albums/jj590/OCD-WTT/MBAMAnti-Rootkit2update_zpsf85fca28.png


Next you will see the Update Database screen.
Click on the Update button so Malwarebytes Anti-Rootkit can download the latest definition updates.


http://i1269.photobucket.com/albums/jj590/OCD-WTT/MBAMAnti-Rootkitupdatecomplete_zpscf9f4cdb.png


When the update has finished, click on the Next button.

http://i1269.photobucket.com/albums/jj590/OCD-WTT/MBAMAnti-Rootkitscan_zps9b346fe7.png


Next you can select some basic scanning options. Make sure the Drivers, Sectors, and System scan targets are selected before you click on the Scan button.
Malwarebytes Anti-Rootkit will now start scanning your computer for rootkits. This scan can take some time, so please be patient.


http://i1269.photobucket.com/albums/jj590/OCD-WTT/MBAMAnti-Rootkitscan-results_zps9f0fdf8e.png


When the scan with Malwarebytes Anti-Rootkit is finished, the program will display a screen with the results from the scan.
Make sure everything is selected and that the option to create a restore point is checked.
Next click on the Cleanup button. Malwarebytes Anti-Rootkit will then prompt you to reboot your computer.
Click on Yes button to restart your computer.


~~~~~~~~~~~~~`

Please post these 2 logs when finished.
mla34
2016-04-21, 17:04
Hi, Juliet,
Thank you for answering all of my questions!

I am including the log from Rogue Killer. There was no malware found when I ran the malwarebytes so the message was "no clean up required" No log.



RogueKiller V12.1.3.0 (x64) [Apr 18 2016] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/software/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : The Arnolds [Administrator]
Started from : C:\Users\The Arnolds\Desktop\RogueKillerX64.exe
Mode : Scan -- Date : 04/21/2016 08:55:19

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 4 ¤¤¤
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-2307240755-147757143-1248280979-1001\Software\Microsoft\Internet Explorer\Main | Start Page : http://xfinity.comcast.net/ -> Found
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-2307240755-147757143-1248280979-1001\Software\Microsoft\Internet Explorer\Main | Start Page : http://xfinity.comcast.net/ -> Found
[PUM.SearchPage] (X64) HKEY_USERS\S-1-5-21-2307240755-147757143-1248280979-1001\Software\Microsoft\Internet Explorer\Main | Search Bar : Preserve -> Found
[PUM.SearchPage] (X86) HKEY_USERS\S-1-5-21-2307240755-147757143-1248280979-1001\Software\Microsoft\Internet Explorer\Main | Search Bar : Preserve -> Found

¤¤¤ Tasks : 1 ¤¤¤
[Suspicious.Path] %WINDIR%\Tasks\HP Photo Creations Communicator.job -- C:\Users\The Arnolds\AppData\Roaming\HP Photo Creations\Communicator.exe (--auto) -> Found

¤¤¤ Files : 1 ¤¤¤
[PUP][Folder] C:\ProgramData\{010DD54D-6F97-418D-BC47-2089F30A0075} -> Found

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

¤¤¤ Web browsers : 1 ¤¤¤
[PUM.HomePage][FIREFX:Config] 3r6yn46d.default : user_pref("browser.startup.homepage", "http://home.ancestry.com/"); -> Found

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: ST31000524AS ATA Device +++++
--- User ---
[MBR] 376e5ac98c0f1e3dc22bf4849d5d01d9
[BSP] e568e0587ab99c9ae75339c0d0e641ca : HP|VT.Unknown MBR Code
Partition table:
0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 MB
1 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 81920 | Size: 15166 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 31141888 | Size: 938662 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK

+++++ PhysicalDrive1: Generic- Multi-Card USB Device +++++
Error reading User MBR! ([15] The device is not ready. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] The request is not supported. )
Juliet
2016-04-21, 17:57
To turn on/off Automatic Updates yourself, follow these steps:

Click Start, type Windows update in the search box, and then click Windows Update in the Programs list.
In the left pane, click Change settings.
Select the option that you want, which here for right now will bw to Never check for updates.
This should be temporary as to try and find out if this might be related to a Microsoft error.
You may have to click on OK.
~~~~~~~~~~~~~~~~~~~~~~~`

Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)


start
CreateRestorePoint:
CloseProcesses:
Task: {4D520EFB-B3AA-4475-9EC1-D9A31DF57B34} - System32\Tasks\HP Photo Creations Communicator => C:\Users\The Arnolds\AppData\Roaming\HP Photo Creations\Communicator.exe [2015-12-02] ()
C:\ProgramData\{010DD54D-6F97-418D-BC47-2089F30A0075}
EmptyTemp:
Hosts:
End


Open FRST/FRST64 and press the > Fix < button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

Once this is done let me know how the machine is now.
mla34
2016-04-21, 20:31
Here is the log. Computer is same, still slow and laggy.

Fix result of Farbar Recovery Scan Tool (x64) Version:18-04-2016
Ran by The Arnolds (2016-04-21 13:07:54) Run:2
Running from C:\Users\The Arnolds\Desktop
Loaded Profiles: The Arnolds (Available Profiles: The Arnolds & Greg)
Boot Mode: Normal
==============================================

fixlist content:
*****************
start
CreateRestorePoint:
CloseProcesses:
Task: {4D520EFB-B3AA-4475-9EC1-D9A31DF57B34} - System32\Tasks\HP Photo Creations Communicator => C:\Users\The Arnolds\AppData\Roaming\HP Photo Creations\Communicator.exe [2015-12-02] ()
C:\ProgramData\{010DD54D-6F97-418D-BC47-2089F30A0075}
EmptyTemp:
Hosts:
End
*****************

Restore point was successfully created.
Processes closed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4D520EFB-B3AA-4475-9EC1-D9A31DF57B34}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4D520EFB-B3AA-4475-9EC1-D9A31DF57B34}" => key removed successfully
C:\Windows\System32\Tasks\HP Photo Creations Communicator => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\HP Photo Creations Communicator" => key removed successfully
C:\ProgramData\{010DD54D-6F97-418D-BC47-2089F30A0075} => moved successfully
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.
EmptyTemp: => 554.9 MB temporary data Removed.


The system needed a reboot.

==== End of Fixlog 13:09:07 ====
Juliet
2016-04-21, 23:42
turn on/off Automatic Updates and reboot the computer?
Did you try the above?


It's probably not Nortons doing the slow down but you can experiment.
Right click on the icon and see if you can temporarily disable it just to experiment to see if a browser will open as it should. Then re-enable it.
Did you try the above?

By chance, did you receive a Private message from me?
mla34
2016-04-22, 04:57
Hi, Juliet,

Yes, I tried the Norton disable/enable with reboot....no change. Sorry for not letting you know.

Also tried the Microsoft update on/off...no change.

No, I did not receive a PM from you. I'm not even sure how I would be notified that you sent one.
Juliet
2016-04-22, 12:42
You might have your private messages turned off in your profile, we can check this later.

There was a link I wanted you to read over here (http://www.bleepingcomputer.com/forums/t/611172/windows-update/)
Some of the issues your having might be related to comments there.


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This repair may take some hours !!!

Tweaking.com - Windows Repair All-In-One (Portable)

- Download Windows Repair All-In-One (Portable Version) from here (http://www.tweaking.com/content/page/windows_repair_all_in_one.html).

- Extract tweaking.com_windows_repair_aio.zip to your Desktop.

- Disable all your antivirus and antimalware software - see how to do that here (http://www.bleepingcomputer.com/forums/t/114351/how-to-temporarily-disable-your-anti-virus-firewall-and-anti-malware-programs/).
- Right click on https://i.imgur.com/QfBzvq1.png and select Run as Administrator (XP users just double click) to start Windows Repair All-In-One.
(Windows Vista/7/8 users: Accept UAC warning if it is enabled.)

- A window will appear. Click Step 2.
http://i.imgur.com/2f8o60N.png

- Click the Open Pre-Scan button, then click Start Scan. Wait for Windows Repair to finish scanning.

- Depending on which error Windows Repair found, click Repair Reparse Point or Repair Environment Variable accordingly. When the button changes to "Done!", click the close button to return to Windows Repair.

- Go to Step 3, then click Check in the See If Check Disk Is Needed.

- If Windows Repair stated that errors are found, click Open Check Disk At Next Boot. Choose (/R) Fixes errors on the disk also locate bad sectors and recovers readable information, then click Add To Next Boot. Reboot the computer to let Windows check the disk.
http://i.imgur.com/Ymy7crZ.png

- Go to Step 4, then click Do It.
http://i.imgur.com/zDtdN75.png

- Go to Step 5. Under System Restore click Create.
http://i.imgur.com/f7lEe1N.png

- Go to Repairs and click Open Repairs. Leave all checkmarks as they are, then click Start Repairs.
http://i.imgur.com/PGv2vtD.png

- By default Windows Repair All-In-One will create a "Logs" folder in its folder on the Desktop. Please post the contents of the log in your next reply.
Juliet
2016-04-22, 12:54
I wanted to post another statement about Windows updates being way off this month

https://forums.whatthetech.com/index.php?showtopic=130602#entry876511



FYI...

KB3148812 breaks WSUS server - DO NOT INSTALL
- https://myonlinesecurity.co.uk/kb3148812-breaks-wsus-server/
22 Apr 2016 - "We are seeing loads of reports of KB3148812* -breaks- WSUS server. This update is supposed to prepare WSUS (Windows Software Update Services) to be able to install W10 updates from the WSUS server. It is described as Update enables ESD decryption provision in WSUS in Windows Server 2012 and Windows Server 2012 R2. Update enables ESD decryption provision in WSUS in Windows Server 2012 and Windows Server 2012 R2..."

Update enables ESD decryption provision in WSUS in Windows Server 2012 and Windows Server 2012 R2
* https://support.microsoft.com/en-us/kb/3148812
Last Review: 04/20/2016 04:45:00 - Rev: 3.0

What you need to know about KB3148812
** http://blogs.technet.com/b/wsus/archive/2016/04/22/what-you-need-to-know-about-kb3148812.aspx
21 Apr 2016 - "... We try not to require post-update manual effort whenever possible, and unfortunately in this case it was unavoidable. This post describes the symptoms you’ll see, details how to resolve them, and then provides some background on this change... it requires some additional manual steps to be taken afterward in order to realign the moving parts of the system. More information on that will be available via the KB article and this blog later-this-week." ??
mla34
2016-04-22, 18:23
Oh, boy, Juliet, I think I screwed up. Have been going through the steps and on step 3 I did not reboot the computer. Yikes. I did step four and now I don't know if I should create a restore point yet without rebooting. Not sure what to do so I will wait to hear back from you before doing anything. That's what I get for multitasking. So sorry.
mla34
2016-04-22, 18:25
Also, I did get your Pm, just did not get any alert that it was there. No worries. I did read through everything on that link. I have not read through your latest post stuff but will once I feel it is safe to browse through the internet. Right now antivirus is still disabled. Thanks so much.
Juliet
2016-04-23, 00:17
I would make a restore point now, and when we're finished we can make another.

Surfing the internet should be done with Antivirus protection on.
mla34
2016-04-23, 14:55
Ugh, so another screw up. Sorry. Got in late last night and without thinking rebooted before doing a restore. Now, this morning, just staring at the computer once again, not knowing if I should go back into Tweaking and start again or just pick up where I left off or if I have screwed up all the stuff I did yesterday. Will wait again for your thoughts.

Thanks for sending the links. I did read through them, although I have to admit I do not understand all the information, other than I gather that the Microsoft update is what screwed up my computer.
Juliet
2016-04-23, 15:24
Microsoft update is what screwed up my computer.

It's possible, especially when I can't find any malware.

After you restarted your computer, how did it act?

If it's acting better then we can skip the below


I don't think it would hurt to just start over.





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This repair may take some hours !!!

Tweaking.com - Windows Repair All-In-One (Portable)

- Download Windows Repair All-In-One (Portable Version) from here (http://www.tweaking.com/content/page/windows_repair_all_in_one.html).

- Extract tweaking.com_windows_repair_aio.zip to your Desktop.

- Disable all your antivirus and antimalware software - see how to do that here (http://www.bleepingcomputer.com/forums/t/114351/how-to-temporarily-disable-your-anti-virus-firewall-and-anti-malware-programs/).
- Right click on https://i.imgur.com/QfBzvq1.png and select Run as Administrator (XP users just double click) to start Windows Repair All-In-One.
(Windows Vista/7/8 users: Accept UAC warning if it is enabled.)

- A window will appear. Click Step 2.
http://i.imgur.com/2f8o60N.png

- Click the Open Pre-Scan button, then click Start Scan. Wait for Windows Repair to finish scanning.

- Depending on which error Windows Repair found, click Repair Reparse Point or Repair Environment Variable accordingly. When the button changes to "Done!", click the close button to return to Windows Repair.

- Go to Step 3, then click Check in the See If Check Disk Is Needed.

- If Windows Repair stated that errors are found, click Open Check Disk At Next Boot. Choose (/R) Fixes errors on the disk also locate bad sectors and recovers readable information, then click Add To Next Boot. Reboot the computer to let Windows check the disk.
http://i.imgur.com/Ymy7crZ.png

- Go to Step 4, then click Do It.
http://i.imgur.com/zDtdN75.png

- Go to Step 5. Under System Restore click Create.
http://i.imgur.com/f7lEe1N.png

- Go to Repairs and click Open Repairs. Leave all checkmarks as they are, then click Start Repairs.
http://i.imgur.com/PGv2vtD.png

- By default Windows Repair All-In-One will create a "Logs" folder in its folder on the Desktop. Please post the contents of the log in your next reply.
mla34
2016-04-24, 06:31
Hi, Juliet,
There are a bunch of logs so I hope this is the right one. BTW, the computer is the same, very slow and fading in and out windows. No change. Thanks.

Tweaking.com - Windows Repair v3.8.6
--------------------------------------------------------------------------------

System Variables
--------------------------------------------------------------------------------
OS: Windows 7 Home Premium
OS Architecture: 64-bit
OS Version: 6.1.7601
OS Service Pack: Service Pack 1
Computer Name: 2011
Windows Drive: C:\
Windows Path: C:\Windows
Program Files: C:\Program Files
Program Files (x86): C:\Program Files (x86)
Current Profile: C:\Users\The Arnolds
Current Profile SID: S-1-5-21-2307240755-147757143-1248280979-1001
Current Profile Classes: S-1-5-21-2307240755-147757143-1248280979-1001_Classes
Profiles Location: C:\Users
Profiles Location 2: C:\Windows\ServiceProfiles
Local Settings AppData: C:\Users\The Arnolds\AppData\Local
--------------------------------------------------------------------------------

System Information
--------------------------------------------------------------------------------
System Up Time: 0 Days 07:38:46

Process Count: 81
Commit Total: 2.16 GB
Commit Limit: 11.83 GB
Commit Peak: 2.38 GB
Handle Count: 27378
Kernel Total: 579.36 MB
Kernel Paged: 475.39 MB
Kernel Non Paged: 103.98 MB
System Cache: 4.00 GB
Thread Count: 990
--------------------------------------------------------------------------------

Memory Before Cleaning with CleanMem
--------------------------------------------------------------------------------
Memory Total: 5.91 GB
Memory Used: 2.11 GB(35.6217%)
Memory Avail.: 3.81 GB
--------------------------------------------------------------------------------

Cleaning Memory Before Starting Repairs...

Memory After Cleaning with CleanMem
--------------------------------------------------------------------------------
Memory Total: 5.91 GB
Memory Used: 2.14 GB(36.243%)
Memory Avail.: 3.77 GB
--------------------------------------------------------------------------------

Starting Repairs...
Started at (4/23/2016 8:27:35 PM)

Setting Any Missing 'InstallDate' From Uninstall Sections Before Running Repair...
Total Missing 'InstallDate' Fixed: 60

01 - Reset Registry Permissions
Restore Windows 7/8/10 Default Registry Permissions
Start (4/23/2016 8:27:40 PM)


Decompressing & Updating Windows Permission File C:\Users\The Arnolds\Desktop\tweaking.com_windows_repair_aio\Tweaking.com - Windows Repair\files\permissions\7\hku.7z
Done, 0.34 seconds.


Decompressing & Updating Windows Permission File C:\Users\The Arnolds\Desktop\tweaking.com_windows_repair_aio\Tweaking.com - Windows Repair\files\permissions\7\hklm.7z
Done, 1.67 seconds.

Running Repair Under System Account
Done (4/23/2016 8:34:05 PM)

Reset File Permissions: C:
C: & Sub Folders
Start (4/23/2016 8:34:05 PM)

Running Repair Under Current User Account
Done (4/23/2016 9:10:39 PM)

Reset File Permissions
Restore Windows 7/8/10 Default File Permissions
Start (4/23/2016 9:10:39 PM)


Decompressing & Updating Windows Permission File C:\Users\The Arnolds\Desktop\tweaking.com_windows_repair_aio\Tweaking.com - Windows Repair\files\permissions\7\default.7z
Done, 0.23 seconds.


Decompressing & Updating Windows Permission File C:\Users\The Arnolds\Desktop\tweaking.com_windows_repair_aio\Tweaking.com - Windows Repair\files\permissions\7\profile.7z
Done, 0.22 seconds.


Decompressing & Updating Windows Permission File C:\Users\The Arnolds\Desktop\tweaking.com_windows_repair_aio\Tweaking.com - Windows Repair\files\permissions\7\program_files.7z
Done, 0.35 seconds.


Decompressing & Updating Windows Permission File C:\Users\The Arnolds\Desktop\tweaking.com_windows_repair_aio\Tweaking.com - Windows Repair\files\permissions\7\program_files_x86.7z
Done, 0.38 seconds.


Decompressing & Updating Windows Permission File C:\Users\The Arnolds\Desktop\tweaking.com_windows_repair_aio\Tweaking.com - Windows Repair\files\permissions\7\programdata.7z
Done, 0.55 seconds.


Decompressing & Updating Windows Permission File C:\Users\The Arnolds\Desktop\tweaking.com_windows_repair_aio\Tweaking.com - Windows Repair\files\permissions\7\windows.7z
Done, 1.43 seconds.

Running Repair Under Current User Account
Done (4/23/2016 9:29:47 PM)

Reset File Permissions: Cleanup
Repairing Restricted Folders Permissions To Avoid Infinite Loops
Start (4/23/2016 9:29:47 PM)

Running Repair Under Current User Account
Running Repair Under System Account
Done (4/23/2016 9:29:51 PM)

03 - Reset Service Permissions
Start (4/23/2016 9:29:51 PM)

Running Repair Under Current User Account
Running Repair Under System Account
Done (4/23/2016 9:31:41 PM)

04 - Register System Files
Start (4/23/2016 9:31:41 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/23/2016 9:33:11 PM)

05 - Repair WMI
Start (4/23/2016 9:33:11 PM)

Starting Security Center So We Can Export The Security Info.

Exporting Antivirus Info...
Norton Security Suite Exported.

Exporting AntiSpyware Info...
Windows Defender Exported.
Spybot - Search and Destroy Exported.
Norton Security Suite Exported.

Exporting 3rd Party Firewall Info...
Norton Security Suite Exported.

Running Repair Under Current User Account
Done (4/23/2016 9:36:34 PM)

06 - Repair Windows Firewall
Start (4/23/2016 9:36:34 PM)

Decompressing & Updating Windows Permission File C:\Users\The Arnolds\Desktop\tweaking.com_windows_repair_aio\Tweaking.com - Windows Repair\files\permissions\7\services.7z
Done, 0.17 seconds.

Running Repair Under Current User Account
Running Repair Under System Account
Done (4/23/2016 9:37:17 PM)

07 - Repair Internet Explorer
Start (4/23/2016 9:37:17 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/23/2016 9:37:54 PM)

08 - Repair MDAC/MS Jet
Start (4/23/2016 9:37:54 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/23/2016 9:38:09 PM)

09 - Repair Hosts File
Start (4/23/2016 9:38:09 PM)
Running Repair Under System Account
Done (4/23/2016 9:38:11 PM)

10 - Remove Policies Set By Infections
Start (4/23/2016 9:38:11 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/23/2016 9:38:14 PM)

11 - Repair Start Menu Icons Removed By Infections
Start (4/23/2016 9:38:14 PM)
Running Repair Under System Account
Done (4/23/2016 9:38:16 PM)

12 - Repair Icons
Start (4/23/2016 9:38:16 PM)
Running Repair Under Current User Account
Done (4/23/2016 9:38:17 PM)

13 - Repair Network
Start (4/23/2016 9:38:17 PM)

Decompressing & Updating Windows Permission File C:\Users\The Arnolds\Desktop\tweaking.com_windows_repair_aio\Tweaking.com - Windows Repair\files\permissions\7\services.7z
Done, 0.16 seconds.

Running Repair Under Current User Account
Running Repair Under System Account
Done (4/23/2016 9:38:40 PM)

14 - Remove Temp Files
Start (4/23/2016 9:38:40 PM)
Running Repair Under System Account
Done (4/23/2016 9:38:43 PM)

15 - Repair Proxy Settings
Start (4/23/2016 9:38:43 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/23/2016 9:38:46 PM)

17 - Repair Windows Updates
Start (4/23/2016 9:38:46 PM)

Decompressing & Updating Windows Permission File C:\Users\The Arnolds\Desktop\tweaking.com_windows_repair_aio\Tweaking.com - Windows Repair\files\permissions\7\services.7z
Done, 0.16 seconds.

Running Repair Under Current User Account
Running Repair Under System Account
Setting Windows Updates Files That Are In Use To Be Removed At Next Boot.
Done (4/23/2016 9:40:26 PM)

18 - Repair CD/DVD Missing/Not Working
Start (4/23/2016 9:40:26 PM)
iTunes and GEARAspiWDM.sys was found, adding UpperFilters for iTunes Reg Key
UpperFilters added?: True
Done (4/23/2016 9:40:26 PM)

19 - Repair Volume Shadow Copy Service
Start (4/23/2016 9:40:26 PM)

Decompressing & Updating Windows Permission File C:\Users\The Arnolds\Desktop\tweaking.com_windows_repair_aio\Tweaking.com - Windows Repair\files\permissions\7\services.7z
Done, 0.16 seconds.

Running Repair Under Current User Account
Running Repair Under System Account
Done (4/23/2016 9:40:51 PM)

20 - Repair Windows Sidebar/Gadgets
Start (4/23/2016 9:40:51 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/23/2016 9:40:55 PM)

21 - Repair MSI (Windows Installer)
Start (4/23/2016 9:40:55 PM)

Decompressing & Updating Windows Permission File C:\Users\The Arnolds\Desktop\tweaking.com_windows_repair_aio\Tweaking.com - Windows Repair\files\permissions\7\services.7z
Done, 0.16 seconds.

Running Repair Under Current User Account
Running Repair Under System Account
Done (4/23/2016 9:41:13 PM)

22 - Repair Windows Snipping Tool
Start (4/23/2016 9:41:13 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/23/2016 9:41:16 PM)

23.01 - Repair bat Association
Start (4/23/2016 9:41:16 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/23/2016 9:41:20 PM)

23.02 - Repair cmd Association
Start (4/23/2016 9:41:20 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/23/2016 9:41:24 PM)

23.03 - Repair com Association
Start (4/23/2016 9:41:24 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/23/2016 9:41:27 PM)

23.04 - Repair Directory Association
Start (4/23/2016 9:41:28 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/23/2016 9:41:31 PM)

23.05 - Repair Drive Association
Start (4/23/2016 9:41:31 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/23/2016 9:41:34 PM)

23.06 - Repair exe Association
Start (4/23/2016 9:41:34 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/23/2016 9:41:37 PM)

23.07 - Repair Folder Association
Start (4/23/2016 9:41:37 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/23/2016 9:41:41 PM)

23.08 - Repair inf Association
Start (4/23/2016 9:41:41 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/23/2016 9:41:44 PM)

23.09 - Repair lnk (Shortcuts) Association
Start (4/23/2016 9:41:44 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/23/2016 9:41:48 PM)

23.10 - Repair msc Association
Start (4/23/2016 9:41:48 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/23/2016 9:41:52 PM)

23.11 - Repair reg Association
Start (4/23/2016 9:41:52 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/23/2016 9:41:56 PM)

23.12 - Repair scr Association
Start (4/23/2016 9:41:56 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/23/2016 9:42:00 PM)

24 - Repair Windows Safe Mode
Start (4/23/2016 9:42:00 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/23/2016 9:42:05 PM)

25 - Repair Print Spooler
Start (4/23/2016 9:42:05 PM)

Decompressing & Updating Windows Permission File C:\Users\The Arnolds\Desktop\tweaking.com_windows_repair_aio\Tweaking.com - Windows Repair\files\permissions\7\services.7z
Done, 0.16 seconds.

Running Repair Under Current User Account
Running Repair Under System Account
Done (4/23/2016 9:42:29 PM)

26 - Restore Important Windows Services
Start (4/23/2016 9:42:29 PM)

Decompressing & Updating Windows Permission File C:\Users\The Arnolds\Desktop\tweaking.com_windows_repair_aio\Tweaking.com - Windows Repair\files\permissions\7\services.7z
Done, 0.14 seconds.

Running Repair Under Current User Account
Running Repair Under System Account
Done (4/23/2016 9:42:44 PM)

27 - Set Windows Services To Default Startup
Start (4/23/2016 9:42:44 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/23/2016 9:43:34 PM)

Skipping Repair.
Repair is for Windows v6.2 (Windows 8 & Newer) or higher.
Current version: 6.1.7601

Skipping Repair.
Repair is for Windows v6.2 (Windows 8 & Newer) or higher.
Current version: 6.1.7601

Skipping Repair.
Repair is for Windows v6.2 (Windows 8 & Newer) or higher.
Current version: 6.1.7601

31 - Repair Windows 'New' Submenu
Start (4/23/2016 9:43:34 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/23/2016 9:43:39 PM)

32 - Restore UAC (User Account Control) Settings
Start (4/23/2016 9:43:39 PM)
Running Repair Under Current User Account
Running Repair Under System Account
Done (4/23/2016 9:43:43 PM)

33 - Repair Performance Counters
Start (4/23/2016 9:43:43 PM)
Running Repair Under Current User Account
Done (4/23/2016 9:43:54 PM)

Cleaning up empty logs...

All Selected Repairs Done.
Done at (4/23/2016 9:43:54 PM)
Total Repair Time: 01:16:21


...YOU MUST RESTART YOUR SYSTEM...
Juliet
2016-04-24, 14:17
A couple of things we can try.
******
With Windows 7 (64 bit operating system) the following procedure will turn off all three lines of "fade" effects:

1. Click on control panel;
2. Click on view by: Large Icons;
3. Click on "Performance Information and tools";
4; Click on adjust "Visual effects";
5; There will be three line items showing the word "Fade" as the first character string on each line.
If there is a check mark - Uncheck the box in front of each of those three lines and then "OK" everything and back out then reboot your computer.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Go to Control Panel --> System --> Advanced System Settings --> Advanced Tab --> Settings (under Performance) --> Uncheck all options that have the word "Fade Out" --> Click Apply

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~`
Try unplugging all non-essential USB devices and restarting your computer and hopefully the problem goes away.
http://www.sevenforums.com/tutorials/165554-usb-driver-general-fix-problems.html

~~~~
Also, if no improvement is seen I would uninstall the most recent Microsoft updates. With windows set to update to never check, I would manually download and install 1 or 2 at a time to find one that might be causing these problems.

Here what we can do is, locate the updates most recently downloaded. Go to the Microsoft Orb button, then All Programs, then windows updates
Then View update history, then at the top click on View update history. This will show you the ones by date that were downloaded and installed last.
We may need to reinstall these one by one till we find out which one MIGHT be causing a problem.
mla34
2016-04-24, 16:26
Hi, Juliet,

I tried the first two suggestions....no change.

After reading through the sevenforums website tutorial, it is more than I am comfortable with doing. Uninstalling and possibly reinstalling drivers is a bit scary for me. I decided to try the fourth suggestion so I skipped that for now.

When I go into Windows Update and click on the update history tab, there is nothing there. That seems very strange to me. Nothing, just completely blank. Was the history deleted during one of the other "jobs" I did?

Not sure where to go from here. Thanks.
Juliet
2016-04-24, 18:44
OK, this might be our last option here.
If the below doesn't work I will have to send you to a different forum that deals with windows 7 system problems.


computer did an automatic update overnight and the next morning the computer was VERY slow
What we can try is to do a system restore before those last windows updates, it's my wish......something good will come from it.
It wont hurt your computer, I've had to do it a couple of times and had to do it after this months windows updates.

The below tutorial is very easy to follow.
http://www.sevenforums.com/tutorials/700-system-restore.html
mla34
2016-04-25, 00:50
Hi, Juliet,

I am ready to do a system restore. My only concern is that it is telling me that two drivers may not be working properly after the restore and may have to be reinstalled.
Microsoft (DiskDrive) 06/21/2006 6.1.7600.16385
Microsoft (SECURITY) 06/21/2006 6.1.7600.16385

Is this ok?
Juliet
2016-04-25, 03:23
thats pretty much any driver that comes default with Windows will show that 6/21/2006 date.


Check your hard disk for errors
http://windows.microsoft.com/en-us/windows-vista/check-your-hard-disk-for-errors


run Windows Updates to cover security patches and you may need to update Norton to have the latest virus definitions.
mla34
2016-04-25, 05:37
I just went back in to System Restore to run but now the date of April 15 is no longer an option. That is when the Windows update created a problem. How can I restore to a point before that when there is no option to do that? Ugh....I can now only go back to April 19th. This is very frustrating.....
Any suggestions?
Juliet
2016-04-25, 12:53
Read through this link to check for other options
http://www.sevenforums.com/tutorials/700-system-restore.html

Scroll down to #8 "Choose a different restore point"
mla34
2016-04-25, 17:30
Yup, I did that and the furthest back I could go was April 19th so I ran the System Restore. The computer is still the same. I was hoping to go back before the 15th. Also, the Windows Update list is still blank so there is nothing to uninstall. You mentioned in a post about running Windows Update for security patches and to update Norton. Should I just do that and see what happens? If nothing changes, where do I go from here? Does it make sense to scrap Windows 7 and just do the update to Windows 10? Are there files from Windows 7 that are needed to update to Windows 10?
I know you are scratching your head, too, Juliet. Thanks so much for your help and input.
Juliet
2016-04-25, 22:59
Yup, I did that and the furthest back I could go was April 19th so I ran the System Restore. The computer is still the same. I was hoping to go back before the 15th. Also, the Windows Update list is still blank so there is nothing to uninstall. You mentioned in a post about running Windows Update for security patches and to update Norton. Should I just do that and see what happens? If nothing changes, where do I go from here? Does it make sense to scrap Windows 7 and just do the update to Windows 10? Are there files from Windows 7 that are needed to update to Windows 10?
I know you are scratching your head, too, Juliet. Thanks so much for your help and input.

Let's manually try to check for windows updates.

http://windows.microsoft.com/en-us/windows/is-computer-up-to-date#1TC=windows-7

~~~~~~~~~~~

Open the norton application, look for the update button and click on update now?

~~~~~~~~~~~~~~~~~
The below forum has helpers that assist in correcting windows system issues.
https://forums.whatthetech.com/index.php?showforum=119

Myself, updating to windows 10 right now might not be a good idea so let's hold off for now.. It could help possibly then on the other hand could do some damage.
mla34
2016-04-27, 15:34
Hi, Juliet,
Sorry for the delay in getting back to you. Life sometimes gets in the way!
I will check out the suggestions today and respond later today. Thanks!
Juliet
2016-04-27, 17:01
that'll work.
mla34
2016-04-27, 18:10
Ok, so I'm not sure how I found this but I eventually got to a list of updates. There are 15 updates dated 4/15/16, which is the date things went bad. Can I uninstall only those updates and see what happens? They are either standard Windows updates or security related. I won't do anything until I hear back from you.

Norton is updated.

As for the forum link you sent me, I did read through it but won't do anything with it until we try above, if you think that's ok. Thanks!
Juliet
2016-04-27, 21:18
There are 15 updates dated 4/15/16, which is the date things went bad
That should be it.

Through your control panel, make sure security updates for Microsoft is set to "never check for updates"
Then go to uninstall those updates. Remember, you can download and install all those updates again, we want to see if one of those is what has caused these problems.

Do 1 or 2 at a time....
mla34
2016-04-27, 23:04
I uninstalled all 15 updates there were from 4/15/16. I did a restart and it was so slow that I decided to just hit the power button. I got the screen that said Windows failed to start. The two choices I had were to "Launch Start Up Repair" or just start normally. I chose the first, thinking that repair might be good. After all is said and done, the computer is still slow and windows still fade in and out.

Two weird things:
1. Skype loaded up connected right away, which it was not doing but now has lost connection.
2. I have little padlocks showing on almost all the desktop icons, as well on files in my documents folders. Very weird. Any clues about that? They were there this morning when I wrote to you. Forgot to mention it to you then.

All in all, it seems to be about the same. Even though I have checked that it is never to check for updates, when I rebooted, there are now 4 Microsoft updates listed as being installed today, I guess from the reboot. Why did they get installed? There is another file in that list from 4/15/16 was Adobe Acrobat Reader DC which I would have uninstalled but that is not given as an option. Maybe that has something to do with all of this?
Thanks.
Juliet
2016-04-27, 23:13
The two choices I had were to "Launch Start Up Repair" or just start normally. I chose the first, thinking that repair might be good. After all is said and done, the computer is still slow and windows still fade in and out.
Start Windows in normal mode may have been your best option.

I'm going to have to refer you to another forum that can deal with these windows issues better then I can, I just don't know that much about what goes on behind the scenes with these problems.


You'll have to register, don't worry it's a safe place and I work there too.
Open a new topic, in the Topic Title type in failed Launch Start Up Repair also Supply a link to this topic so they can see what we've attempted.
https://forums.whatthetech.com/index.php?showforum=119
mla34
2016-04-28, 02:25
Hi, Juliet,

Thanks so much for all your help. I will visit that site tomorrow and do as you have suggested. I appreciate your time so much!
Maureen
Juliet
2016-04-28, 03:32
Your welcome :)
mla34
2016-05-01, 19:05
Hi, Juliet,

I am working with a guy from What The Tech now but he has suggested I get back in touch with you to ask you about uninstalling and deleting the programs and logs that I now have on my computer from all the work we did. Would you please let me know what I should do and how? Thanks so much!
Juliet
2016-05-02, 02:29
I'll post it here too

http://i.imgur.com/AFZxnZc.jpg DelFix

Please download DelFix (http://general-changelog-team.fr/en/downloads/finish/20-outils-de-xplode/9-delfix) or from Here (http://www.bleepingcomputer.com/download/delfix/) and save the file to your Desktop.

Double-click DelFix.exe to run the programme.
Place a checkmark next to the following items:

Activate UAC
Remove disinfection tools



Click the Run button.
-- This will remove the specialised tools we used to disinfect your system. Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).
Juliet
2016-05-06, 17:02
Glad we could help. :)http://i204.photobucket.com/albums/bb106/Juliet702/sparkle.gif

Since this issue appears resolved ... this Topic is closed.