Blue Screen of Death

[Juliet]

Did you allow MBAM to quarantine all that was found?

At one time did you have Microsoft Security Essentials installed as your antivirus? I see your using AVG now?

If this is the case please run this tool.
http://www.bleepingcomputer.com/down...-removal-tool/
Microsoft Security Essentials removal tool

Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)

start
CloseProcesses:
HKU\S-1-5-21-472848371-1800496413-3629884572-1006\...\Winlogon: [Shell] C:\Windows\eHome\McrMgr.exe [343552 2009-07-13] (Microsoft Corporation) <==== ATTENTION
C:\Windows\eHome\McrMgr.exe
ShellIconOverlayIdentifiers: [0WinSecurityProvider] -> {F76FA5C2-3B6A-451E-8CA5-34C8D0AE0637} => C:\ProgramData\Microsoft\Security\Client\SecurityProvider.dll ()
C:\ProgramData\Microsoft\Security\Client\SecurityHelper.dll
EmptyTemp:
End

Open FRST/FRST64 and press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

[savanna]

Everything on my MBAM Advanced Settings page is dimmed so that I can't change anything, but I do see that "Automatically quarantine detected items" is checked. I couldn't remember if I ever ran Microsoft Security Essentials on this machine, so I ran the tool anyway. Yes, I run AVG. I also do weekly scans with Spybot, MBAM and Eset. Fixlog.txt is pasted below.

I'm still getting the following errors on boot-up:
C:\Users\Bob\AppData\Local\YkhxPack\enhace.d... failed to load.
C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll" failed to load.

After googling "vbc.dll" I see several references about it being virus related, but they might have just been attempts to sell scanning software. I couldn't find any information related to the first one. Do you think either of these two are cause for concern?

Thank you for your help.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 22-02-2015
Ran by Bob at 2015-02-24 05:29:33 Run:6
Running from C:\Users\Bob\Desktop
Loaded Profiles: Bob (Available profiles: Bob & Mcx1-XPS8500)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start
CloseProcesses:
HKU\S-1-5-21-472848371-1800496413-3629884572-1006\...\Winlogon: [Shell] C:\Windows\eHome\McrMgr.exe [343552 2009-07-13] (Microsoft Corporation) <==== ATTENTION
C:\Windows\eHome\McrMgr.exe
ShellIconOverlayIdentifiers: [0WinSecurityProvider] -> {F76FA5C2-3B6A-451E-8CA5-34C8D0AE0637} => C:\ProgramData\Microsoft\Security\Client\SecurityProvider.dll ()
C:\ProgramData\Microsoft\Security\Client\SecurityHelper.dll
EmptyTemp:
End
*****************

Processes closed successfully.
HKU\S-1-5-21-472848371-1800496413-3629884572-1006\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value not found.
C:\Windows\eHome\McrMgr.exe => Moved successfully.
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\0WinSecurityProvider" => Key deleted successfully.
"HKCR\CLSID\{F76FA5C2-3B6A-451E-8CA5-34C8D0AE0637}" => Key deleted successfully.
C:\ProgramData\Microsoft\Security\Client\SecurityHelper.dll => Moved successfully.
EmptyTemp: => Removed 659.7 MB temporary data.


The system needed a reboot.

==== End of Fixlog 05:29:40 ====

[Juliet]

I'd like to see if any remnant files/folders can be found.

• Right-Click FRST.exe / FRST64.exe and select Run as administrator to run the programme.
• Click Yes to the disclaimer.
• Ensure the Addition.txt box is checked.
• Click the Scan button and let the programme run.
• Upon completion, click OK, then OK on the Addition.txt pop up screen.
• Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply.
  

[savanna]

Thank you for your help.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-02-2015
Ran by Bob (administrator) on XPS8500 on 24-02-2015 06:30:41
Running from C:\Users\Bob\Desktop
Loaded Profiles: Bob (Available profiles: Bob & Mcx1-XPS8500)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic...ery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Cisco WebEx LLC) C:\Windows\SysWOW64\atashost.exe
(Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AdminService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe
(CHENGDU YIWO Tech Development Co., Ltd) C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
(CHENGDU YIWO Tech Development Co., Ltd) C:\Program Files (x86)\EaseUS\Todo Backup\bin\GuardAgent.exe
(Tanuki Software, Ltd.) C:\Program Files\i2p\I2Psvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\ramaint.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
() C:\SiteVaultPro\SvPro.exe
(IObit) C:\Program Files (x86)\IObit\Smart Defrag 3\SmartDefrag.exe
(Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AthBtTray.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(SlySoft, Inc.) C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe
(PeerBlock, LLC) C:\Program Files\PeerBlock\peerblock.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Alcor Micro Corp.) C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe
(SlySoft, Inc.) C:\Program Files (x86)\SlySoft\CloneCD\CloneCDTray.exe
(CHENGDU YIWO Tech Development Co., Ltd) C:\Program Files (x86)\EaseUS\Todo Backup\bin\EuWatch.exe
(CHENGDU YIWO Tech Development Co., Ltd) C:\Program Files (x86)\EaseUS\Todo Backup\bin\TrayNotify.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(BonSoft) C:\Program Files (x86)\ClocX\ClocX.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
() C:\Users\Bob\AppData\Local\TVersity\Media Server\MediaServer.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Atheros) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\Ath_CoexAgent.exe
(Atheros) C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Oracle Corporation) C:\Windows\System32\java.exe
() C:\Program Files (x86)\SlySoft\AnyDVD\ADvdDiscHlp64.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Windows\System32\vds.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_x64.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Dell Inc.) C:\Program Files\Dell\DellDataVault\DellDataVaultWiz.exe
(Dell Products, LP.) C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Dell, Inc.) C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe
(Dell, Inc.) C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
(Azureus Software, Inc) C:\Program Files\Vuze\Azureus.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe [1014432 2011-12-29] (Atheros Commnucations)
HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AthBtTray.exe [800416 2011-12-29] (Atheros Commnucations)
HKLM\...\Run: [LogMeIn GUI] => C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe [57928 2012-04-02] (LogMeIn, Inc.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6457960 2011-12-23] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1156712 2011-11-15] (Realtek Semiconductor)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-17] (Intel Corporation)
HKLM-x32\...\Run: [ShwiconXP9106] => C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe [237568 2010-03-10] (Alcor Micro Corp.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40336 2014-12-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [CloneCDTray] => C:\Program Files (x86)\SlySoft\CloneCD\CloneCDTray.exe [57344 2009-01-29] (SlySoft, Inc.)
HKLM-x32\...\Run: [StartCCC] => "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
HKLM-x32\...\Run: [EaseUs Watch] => C:\Program Files (x86)\EaseUS\Todo Backup\bin\EuWatch.exe [70728 2012-10-19] (CHENGDU YIWO Tech Development Co., Ltd)
HKLM-x32\...\Run: [EaseUs Tray] => C:\Program Files (x86)\EaseUS\Todo Backup\bin\TrayNotify.exe [1315400 2012-10-30] (CHENGDU YIWO Tech Development Co., Ltd)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [3825176 2012-11-13] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [ClocX] => C:\Program Files (x86)\ClocX\ClocX.exe [2090496 2013-01-14] (BonSoft)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3710416 2015-02-10] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM-x32\...\RunOnce: [SpybotDeletingE5894] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDDelFile.exe [2710040 2012-11-13] (Safer-Networking Ltd.)
Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist\615\G2AWinLogon_x64.dll (Citrix Online, a division of Citrix Systems, Inc.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [AnyDVD] => C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVD.exe [109480 2014-10-01] (SlySoft, Inc.)
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3671872 2012-04-17] (DT Soft Ltd)
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [Uploader] => C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [Akamai NetSession Interface] => "C:\Users\Bob\AppData\Local\Akamai\netsession_win.exe"
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [3713032 2012-11-13] (Safer-Networking Ltd.)
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [BackupAgent] => C:\Program Files (x86)\Strongvault Online Backup\BackupAgent.exe
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [AVG-Secure-Search-Update_1113a] => C:\Users\Bob\AppData\Roaming\AVG 1113a Campaign\AVG-Secure-Search-Update-1113a.exe /PROMPT /mid=5ad4700098c147d094cad9a4fffc1f77-2ea2192f08b55d83378acdbfcabd2c8082d55b47 /CMPID=1113a
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [Startup Guard] => C:\Program Files (x86)\AceLogix\StartupGuard\sg.exe
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [Ogcics] => C:\Windows\SysWOW64\regsvr32.exe C:\Users\Bob\AppData\Local\YkhxPack\enhance.DLL
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [PeerBlock] => C:\Program Files\PeerBlock\peerblock.exe [2513992 2014-01-14] (PeerBlock, LLC)
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [UTRmedia Update] => regsvr32.exe C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\RunOnce: [SpybotDeletingF6781] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDDelFile.exe [2710040 2012-11-13] (Safer-Networking Ltd.)
Startup: C:\Users\Bob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
ShortcutTarget: ERUNT AutoBackup.lnk -> C:\erunt\AUTOBACK.EXE ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir...ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir...=ie&ar=msnhome
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir...ie&ar=iesearch
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {39181C36-2062-47D0-8E6A-A5AD85BFE5CE} URL = http://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDR&src=IE-SearchBox
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-472848371-1800496413-3629884572-1000 -> DefaultScope {891988CF-5E9A-48B7-BF5A-AD0F69377215} URL = https://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=994519&p={searchTerms}
SearchScopes: HKU\S-1-5-21-472848371-1800496413-3629884572-1000 -> {284A85DF-5D3B-41C0-A726-2784FE1B9D46} URL = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=902615&p={searchTerms}
SearchScopes: HKU\S-1-5-21-472848371-1800496413-3629884572-1000 -> {891988CF-5E9A-48B7-BF5A-AD0F69377215} URL = https://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=994519&p={searchTerms}
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HelperObject Class -> {00C6482D-C502-44C8-8409-FCE54AD9C208} -> C:\Program Files (x86)\TechSmith\SnagIt 7\SnagItBHO.dll No File
BHO-x32: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll (Safer-Networking Ltd.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files (x86)\TechSmith\SnagIt 7\SnagItIEAddin.dll No File
DPF: HKLM-x32 {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} https://support.dell.com/systemprofiler/SysProExe.CAB
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab
DPF: HKLM-x32 {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://tradestation.webex.com/clien...t/ieatgpc1.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{2302EFEB-46FF-44DA-B395-050DF3CBC43E}: [NameServer] 8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{2E77CA47-D0F3-4DBE-9281-32D604AB6FEB}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{7B72D672-3F7B-4E44-AA6C-CE4D9E4AEBAA}: [NameServer] 8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{C1C7CCE8-4CDD-4ADA-A0A7-EA9E70E0BAF2}: [NameServer] 8.8.8.8,8.8.8.8

FireFox:
========
FF ProfilePath: C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\tjg3rdx3.default
FF DefaultSearchEngine: Google
FF Homepage: hxxp://loadmovie.biz/
FF Keyword.URL:
FF NetworkProxy: "http", "127.0.0.1"
FF NetworkProxy: "http_port", 4444
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.31211.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1205146.dll (Adobe Systems, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.31211.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-472848371-1800496413-3629884572-1000: @citrixonline.com/appdetectorplugin -> C:\Users\Bob\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Bob\AppData\Roaming\mozilla\plugins\npatgpc.dll (Cisco WebEx LLC)
FF Extension: FoxyProxy Standard - C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\tjg3rdx3.default\Extensions\foxyproxy@eric.h.jung [2015-02-05]
FF Extension: DownloadHelper - C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\tjg3rdx3.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-09-06]
FF Extension: Antmark extensions - C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\tjg3rdx3.default\Extensions\antmark@ant.com.xpi [2014-08-03]
FF Extension: DownThemAll! - C:\Users\Bob\AppData\Roaming\Mozilla\Firefox\Profiles\tjg3rdx3.default\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2013-03-18]

Chrome:
=======
CHR Profile: C:\Users\Bob\AppData\Local\Google\Chrome\User Data\Default

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AtherosSvc; C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe [106144 2011-12-29] (Atheros Commnucations) [File not signed]
S2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3411408 2015-02-10] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [308720 2015-02-10] (AVG Technologies CZ, s.r.o.)
S2 DellDataVault; C:\Program Files\Dell\DellDataVault\DellDataVault.exe [2552528 2015-01-30] (Dell Inc.)
R2 DellDataVaultWiz; C:\Program Files\Dell\DellDataVault\DellDataVaultWiz.exe [201424 2015-01-30] (Dell Inc.)
R2 EaseUS Agent; C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe [69192 2012-10-30] (CHENGDU YIWO Tech Development Co., Ltd) [File not signed]
R2 Guard Agent; C:\Program Files (x86)\EaseUS\Todo Backup\bin\GuardAgent.exe [23624 2012-10-19] (CHENGDU YIWO Tech Development Co., Ltd) [File not signed]
R2 i2p; C:\Program Files\i2p\I2Psvc.exe [431104 2014-12-11] (Tanuki Software, Ltd.) [File not signed]
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128280 2012-01-21] ()
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [377704 2015-01-27] (LogMeIn, Inc.)
R2 LMIMaint; C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe [226152 2015-01-27] (LogMeIn, Inc.)
R2 LogMeIn; C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe [407424 2012-04-02] (LogMeIn, Inc.)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1103392 2012-11-13] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1369624 2012-11-13] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [168384 2012-11-13] (Safer-Networking Ltd.)
R2 SiteVaultPro; C:\SiteVaultPro\SvPro.exe [950032 2012-06-18] ()
S2 SupportAssistAgent; C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe [19288 2015-02-19] (Dell Inc.)
R2 TVersityMediaServer; C:\Users\Bob\AppData\Local\TVersity\Media Server\MediaServer.exe [880640 2010-07-12] () [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)
R2 ZAtheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\Ath_CoexAgent.exe [158880 2011-12-29] (Atheros) [File not signed]
R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe [76960 2011-12-26] (Atheros) [File not signed]
S2 vToolbarUpdater15.4.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [138664 2014-04-24] (SlySoft, Inc.)
R3 AnyDVD; C:\Windows\SysWOW64\Drivers\AnyDVD.sys [138664 2014-04-24] (SlySoft, Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [270816 2015-02-10] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [203544 2014-11-18] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [243480 2014-08-28] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [341472 2015-02-03] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [133088 2015-01-23] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [284128 2015-01-16] (AVG Technologies CZ, s.r.o.)
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [50976 2014-10-28] (AVG Technologies)
R3 DDDriver; C:\Windows\System32\drivers\DDDriver64Dcsa.sys [23760 2015-01-30] (Dell Computer Corporation)
R3 DellProf; C:\Windows\System32\drivers\DellProf.sys [23312 2015-01-30] (Dell Computer Corporation)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-05-26] (DT Soft Ltd)
R3 ElbyCDFL; C:\Windows\System32\Drivers\ElbyCDFL.sys [40648 2007-02-15] (SlySoft, Inc.)
R3 ElbyCDFL; C:\Windows\SysWOW64\Drivers\ElbyCDFL.sys [40648 2007-02-15] (SlySoft, Inc.)
R0 EUBAKUP; C:\Windows\System32\drivers\eubakup.sys [58952 2012-10-19] (CHENGDU YIWO Tech Development Co., Ltd) [File not signed]
R0 EUBKMON; C:\Windows\System32\drivers\EUBKMON.sys [48200 2012-10-19] () [File not signed]
R1 EUDSKACS; C:\Windows\system32\drivers\eudskacs.sys [18504 2012-10-19] (CHENGDU YIWO Tech Development Co., Ltd) [File not signed]
R1 EUFDDISK; C:\Windows\system32\drivers\EuFdDisk.sys [189000 2012-10-19] (CHENGDU YIWO Tech Development Co., Ltd) [File not signed]
R2 LMIInfo; C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [16056 2013-05-27] (LogMeIn, Inc.)
S4 LMIRfsClientNP; No ImagePath
R3 pbfilter; C:\Program Files\PeerBlock\pbfilter.sys [22600 2014-01-14] ()
S3 pmxdrv; C:\Windows\system32\drivers\pmxdrv.sys [31152 2012-12-14] ()
R0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [21184 2014-06-04] (IObit)
R3 TotRec8; C:\Windows\system32\drivers\TotRec8.sys [123120 2011-12-14] (High Criteria inc.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-24 05:31 - 2015-02-24 05:31 - 00000000 ___RD () C:\Users\Bob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2015-02-24 05:27 - 2015-02-24 05:27 - 00001116 _____ () C:\FixitRegBackup.reg
2015-02-23 12:24 - 2015-02-23 12:26 - 00000000 ____D () C:\Users\Bob\AppData\Roaming\PCDr
2015-02-23 12:23 - 2015-02-23 12:23 - 00000000 ____D () C:\ProgramData\PCDr
2015-02-23 12:10 - 2015-02-23 15:54 - 00006678 _____ () C:\Users\Bob\Desktop\MB.txt
2015-02-23 10:23 - 2015-02-23 10:23 - 00448512 _____ (OldTimer Tools) C:\Users\Bob\Desktop\TFC.exe
2015-02-23 09:38 - 2015-02-23 09:38 - 00001378 _____ () C:\Users\Bob\Desktop\JRT.txt
2015-02-23 09:30 - 2015-02-23 09:30 - 00006997 _____ () C:\Users\Bob\Desktop\AdwCleaner[S0].txt
2015-02-23 09:24 - 2015-02-23 09:26 - 00000000 ____D () C:\AdwCleaner
2015-02-23 09:00 - 2015-02-23 09:00 - 00000000 ____D () C:\Users\Bob\Desktop\FRST-OlderVersion
2015-02-22 19:21 - 2015-02-22 19:21 - 00000761 _____ () C:\Windows\system32\Drivers\etc\hosts.txt
2015-02-19 08:34 - 2015-02-19 08:34 - 00044075 _____ () C:\Users\Bob\Desktop\Addition.txt
2015-02-19 08:31 - 2015-02-24 06:30 - 00024969 _____ () C:\Users\Bob\Desktop\FRST.txt
2015-02-19 08:30 - 2015-02-24 06:30 - 00000000 ____D () C:\FRST
2015-02-19 08:29 - 2015-02-23 09:00 - 02087424 _____ (Farbar) C:\Users\Bob\Desktop\FRST64.exe
2015-02-19 08:28 - 2015-02-19 08:28 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-XPS8500-Windows-7-Home-Premium-(64-bit).dat
2015-02-19 08:26 - 2015-02-19 08:26 - 00000000 ____D () C:\RegBackup
2015-02-19 08:25 - 2015-02-19 08:25 - 00002270 _____ () C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
2015-02-19 08:25 - 2015-02-19 08:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2015-02-19 08:25 - 2015-02-19 08:25 - 00000000 ____D () C:\Program Files (x86)\Tweaking.com
2015-02-19 08:24 - 2015-02-19 08:24 - 04804736 _____ () C:\Users\Bob\Desktop\tweaking.com_registry_backup_setup.exe
2015-02-17 18:21 - 2015-02-17 18:21 - 00001771 _____ () C:\Users\Bob\Desktop\PeerBlock.lnk
2015-02-17 18:21 - 2015-02-17 18:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PeerBlock
2015-02-17 10:55 - 2015-01-08 21:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll
2015-02-17 10:55 - 2015-01-08 21:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll
2015-02-17 10:55 - 2015-01-08 21:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll
2015-02-17 10:55 - 2015-01-08 20:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll
2015-02-17 09:38 - 2015-02-17 09:38 - 00000000 ____D () C:\Program Files (x86)\AMD APP
2015-02-17 09:36 - 2015-02-17 09:36 - 226727176 _____ (Dell Inc.) C:\Users\Bob\Desktop\Video_Driver_PCWM7_WN_8.982.12-MUP2.3_A00.EXE
2015-02-17 09:36 - 2015-02-17 09:36 - 00000000 ____D () C:\Users\Bob\AppData\Local\Dell
2015-02-17 08:11 - 2015-02-24 05:30 - 00003920 _____ () C:\Windows\setupact.log
2015-02-17 08:11 - 2015-02-17 08:11 - 00374552 _____ () C:\Windows\Minidump\021715-64865-01.dmp
2015-02-16 19:22 - 2015-02-16 19:23 - 01047584 _____ () C:\Windows\Minidump\021615-34055-01.dmp
2015-02-16 18:51 - 2015-02-23 12:12 - 00000000 ____D () C:\Users\Bob\AppData\Local\YkhxPack
2015-02-16 18:51 - 2015-02-23 12:12 - 00000000 ____D () C:\Users\Bob\AppData\Local\UTRmedia
2015-02-16 18:51 - 2015-02-16 18:51 - 13762592 _____ (Media Player - Codec Pack) C:\Users\Bob\Desktop\media.player.codec.pack.lite.v4.3.5.setup.exe
2015-02-15 04:46 - 2015-02-15 04:46 - 00374184 _____ () C:\Windows\Minidump\021515-44881-01.dmp
2015-02-12 12:38 - 2015-02-19 20:58 - 00000426 _____ () C:\Windows\Tasks\Dell SupportAssistAgent AutoUpdate.job
2015-02-12 12:38 - 2015-02-12 12:38 - 00003224 _____ () C:\Windows\System32\Tasks\Dell SupportAssistAgent AutoUpdate
2015-02-12 12:38 - 2015-02-12 12:38 - 00000000 __HDC () C:\ProgramData\{7417E72F-E156-403E-9DFA-EB0ED1DB06F1}
2015-02-12 12:36 - 2015-02-12 20:58 - 00000000 ____D () C:\ProgramData\SupportAssistAgent
2015-02-12 12:17 - 2015-01-22 22:42 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-02-12 12:17 - 2015-01-22 22:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-12 12:17 - 2015-01-22 21:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-02-12 12:17 - 2015-01-22 21:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-02-11 09:07 - 2015-02-23 12:24 - 00003484 _____ () C:\Windows\System32\Tasks\PCDEventLauncherTask
2015-02-11 09:07 - 2015-02-11 09:07 - 00004024 _____ () C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask
2015-02-11 09:07 - 2015-02-11 09:07 - 00003212 _____ () C:\Windows\System32\Tasks\SystemToolsDailyTest
2015-02-11 09:07 - 2015-02-11 09:07 - 00000000 ____D () C:\ProgramData\PC-Doctor for Windows
2015-02-11 09:07 - 2015-02-11 09:07 - 00000000 ____D () C:\Program Files\Dell Support Center
2015-02-11 09:06 - 2015-02-12 12:38 - 00000000 ____D () C:\Program Files\Dell
2015-02-11 03:37 - 2015-01-14 00:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-11 03:37 - 2015-01-14 00:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-02-11 03:37 - 2015-01-14 00:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-02-11 03:37 - 2015-01-14 00:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-02-11 03:37 - 2015-01-13 23:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-02-11 03:37 - 2015-01-13 23:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-02-11 03:37 - 2015-01-13 23:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-02-11 03:37 - 2014-12-11 23:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-02-11 03:37 - 2014-12-11 23:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-02-11 03:37 - 2014-07-06 20:07 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-02-11 03:37 - 2014-07-06 20:06 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-02-11 03:37 - 2014-07-06 19:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-02-11 03:37 - 2014-07-06 19:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-02-11 03:36 - 2015-02-03 21:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-02-11 03:36 - 2015-02-03 21:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-02-11 03:36 - 2015-02-03 21:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-02-11 03:36 - 2015-02-03 21:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-02-11 03:36 - 2015-02-03 21:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-02-11 03:36 - 2015-02-03 21:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-02-11 03:36 - 2015-02-03 21:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-02-11 03:36 - 2015-01-27 17:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2015-02-11 03:36 - 2015-01-13 23:47 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-11 03:36 - 2015-01-13 23:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-02-11 03:36 - 2015-01-11 21:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-11 03:36 - 2015-01-11 21:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-02-11 03:36 - 2015-01-11 21:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-02-11 03:36 - 2015-01-11 20:49 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-02-11 03:36 - 2015-01-11 20:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-11 03:36 - 2015-01-11 20:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-11 03:36 - 2015-01-11 20:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-02-11 03:36 - 2015-01-11 20:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-02-11 03:36 - 2015-01-11 20:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-02-11 03:36 - 2015-01-11 20:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-02-11 03:36 - 2015-01-11 20:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-02-11 03:36 - 2015-01-11 20:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-02-11 03:36 - 2015-01-11 20:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-02-11 03:36 - 2015-01-11 20:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-02-11 03:36 - 2015-01-11 20:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-02-11 03:36 - 2015-01-11 20:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-02-11 03:36 - 2015-01-11 20:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-11 03:36 - 2015-01-11 20:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-02-11 03:36 - 2015-01-11 20:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-02-11 03:36 - 2015-01-11 20:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-02-11 03:36 - 2015-01-11 20:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-11 03:36 - 2015-01-11 20:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-02-11 03:36 - 2015-01-11 20:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-02-11 03:36 - 2015-01-11 20:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-02-11 03:36 - 2015-01-11 20:04 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-02-11 03:36 - 2015-01-11 20:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-02-11 03:36 - 2015-01-11 20:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-02-11 03:36 - 2015-01-11 19:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-02-11 03:36 - 2015-01-11 19:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-02-11 03:36 - 2015-01-11 19:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-02-11 03:36 - 2015-01-11 19:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-11 03:36 - 2015-01-11 19:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-11 03:36 - 2015-01-11 19:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-11 03:36 - 2015-01-11 19:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-02-11 03:36 - 2015-01-11 19:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-02-11 03:36 - 2015-01-11 19:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-11 03:36 - 2015-01-11 19:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-02-11 03:36 - 2015-01-11 19:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-02-11 03:36 - 2015-01-11 19:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-02-11 03:36 - 2015-01-11 19:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-02-11 03:36 - 2015-01-11 19:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-11 03:36 - 2015-01-11 19:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-02-11 03:36 - 2015-01-11 19:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-02-11 03:36 - 2015-01-11 19:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-02-11 03:36 - 2015-01-11 19:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-02-11 03:36 - 2015-01-11 19:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-11 03:36 - 2015-01-11 19:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-11 03:36 - 2015-01-11 19:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-02-11 03:36 - 2015-01-11 18:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-02-11 03:36 - 2015-01-11 18:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-02-11 03:26 - 2015-01-10 00:48 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-02-11 03:26 - 2015-01-10 00:48 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-02-11 03:26 - 2015-01-10 00:48 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-02-11 03:26 - 2015-01-10 00:48 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-02-11 03:26 - 2015-01-10 00:48 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-02-11 03:26 - 2015-01-10 00:48 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-02-11 03:26 - 2015-01-10 00:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-02-11 03:26 - 2015-01-10 00:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-02-11 03:26 - 2015-01-10 00:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-02-11 03:26 - 2015-01-10 00:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-02-11 03:26 - 2015-01-10 00:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-02-11 03:26 - 2015-01-10 00:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-02-11 03:26 - 2015-01-10 00:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-02-11 03:26 - 2015-01-10 00:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-02-11 03:11 - 2015-01-15 02:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-11 03:11 - 2015-01-15 02:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-02-11 03:11 - 2015-01-15 02:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-02-11 03:11 - 2015-01-15 02:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-02-11 03:11 - 2015-01-15 02:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-02-11 03:11 - 2015-01-15 02:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-02-11 03:11 - 2015-01-15 02:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-02-11 03:11 - 2015-01-15 02:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-02-11 03:11 - 2015-01-15 02:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-02-11 03:11 - 2015-01-15 02:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-02-11 03:11 - 2015-01-15 02:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-02-11 03:11 - 2015-01-15 01:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-02-11 03:11 - 2015-01-15 01:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-02-11 03:11 - 2015-01-15 01:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-02-11 03:11 - 2015-01-15 01:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-02-11 03:11 - 2015-01-15 01:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-02-11 03:11 - 2015-01-15 01:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-02-11 03:11 - 2015-01-14 22:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-11 02:25 - 2015-01-12 21:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-11 02:25 - 2015-01-12 20:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-02-11 01:16 - 2015-01-08 20:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-11 00:41 - 2014-11-25 21:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-11 00:41 - 2014-11-25 21:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-11 00:30 - 2014-12-07 21:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-11 00:30 - 2014-12-07 20:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-02-10 16:48 - 2015-02-10 16:48 - 00270816 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsdrivera.sys
2015-02-07 09:52 - 2015-02-24 05:32 - 00000000 ____D () C:\Program Files\PeerBlock
2015-02-03 10:47 - 2015-02-03 10:47 - 00341472 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgloga.sys
2015-01-30 16:36 - 2015-01-30 16:36 - 00023760 _____ (Dell Computer Corporation) C:\Windows\system32\Drivers\DDDriver64Dcsa.sys
2015-01-30 16:36 - 2015-01-30 16:36 - 00023312 _____ (Dell Computer Corporation) C:\Windows\system32\Drivers\DellProf.sys
2015-01-27 05:46 - 2015-01-27 05:46 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-24 06:31 - 2014-06-08 08:48 - 00000000 ____D () C:\Users\Bob\AppData\Roaming\Azureus
2015-02-24 06:24 - 2012-05-09 15:40 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-24 06:22 - 2012-05-25 06:21 - 00000000 ____D () C:\Movies
2015-02-24 05:53 - 2012-06-02 18:08 - 00000000 ____D () C:\Users\Bob\AppData\Roaming\vlc
2015-02-24 05:39 - 2012-05-28 09:05 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-24 05:39 - 2009-07-13 22:45 - 00028352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-24 05:39 - 2009-07-13 22:45 - 00028352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-24 05:37 - 2014-07-23 15:55 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-24 05:35 - 2012-05-09 15:38 - 01155454 _____ () C:\Windows\WindowsUpdate.log
2015-02-24 05:34 - 2013-08-05 15:51 - 00000000 ____D () C:\ProgramData\boost_interprocess
2015-02-24 05:31 - 2014-12-11 18:25 - 00000000 ____D () C:\ProgramData\i2p
2015-02-24 05:31 - 2014-01-23 07:46 - 00001039 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Client.lnk
2015-02-24 05:31 - 2014-01-23 07:46 - 00001023 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Control Panel.lnk
2015-02-24 05:30 - 2012-05-28 09:05 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-24 05:30 - 2012-05-09 15:53 - 00000828 _____ () C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
2015-02-24 05:30 - 2009-07-13 23:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-24 05:26 - 2012-05-24 20:30 - 00000000 ___RD () C:\Junk
2015-02-24 05:21 - 2012-05-25 17:52 - 00000000 ____D () C:\ProgramData\MFAData
2015-02-24 05:19 - 2014-12-11 18:25 - 00000000 ____D () C:\Program Files\i2p
2015-02-24 05:18 - 2012-05-30 09:46 - 00000000 ____D () C:\ProgramData\LogMeIn
2015-02-23 17:38 - 2012-05-25 14:00 - 00000000 ____D () C:\Users\Bob\AppData\Roaming\FileZilla
2015-02-23 17:34 - 2012-07-13 17:04 - 00000000 ____D () C:\Omega
2015-02-23 17:17 - 2012-05-09 15:53 - 00000830 _____ () C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job
2015-02-23 15:55 - 2010-11-20 21:47 - 00473524 _____ () C:\Windows\PFRO.log
2015-02-23 15:44 - 2013-02-01 09:03 - 00000594 _____ () C:\Windows\Tasks\TradeStation Backup - Daily.job
2015-02-23 15:38 - 2012-05-24 20:13 - 00000000 ____D () C:\Program Files (x86)\Tradestation Archives
2015-02-23 15:38 - 2012-05-24 16:26 - 00001508 _____ () C:\Windows\DYNAZIP.LOG
2015-02-23 10:37 - 2009-07-13 23:08 - 00032556 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-02-23 09:33 - 2013-08-05 15:55 - 01388274 _____ (Thisisu) C:\Users\Bob\Desktop\JRT.exe
2015-02-23 09:28 - 2014-10-28 04:55 - 00000000 ____D () C:\Users\Bob\AppData\Local\AVG SafeGuard toolbar
2015-02-23 09:22 - 2013-08-05 15:47 - 02126848 _____ () C:\Users\Bob\Desktop\AdwCleaner.exe
2015-02-23 06:33 - 2012-08-22 06:03 - 00000000 ____D () C:\Jts
2015-02-23 06:21 - 2013-01-28 07:30 - 00000000 ____D () C:\Users\Mcx1-XPS8500
2015-02-21 08:47 - 2014-10-20 05:40 - 00001000 _____ () C:\Users\Public\Desktop\AVG 2015.lnk
2015-02-21 08:47 - 2014-03-31 07:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2015-02-19 11:04 - 2012-11-15 11:04 - 00010331 _____ () C:\Users\Bob\Desktop\aswMBR.txt
2015-02-19 11:04 - 2012-11-15 11:04 - 00000512 _____ () C:\Users\Bob\Desktop\MBR.dat
2015-02-19 08:35 - 2012-11-15 10:59 - 05198336 _____ (AVAST Software) C:\Users\Bob\Desktop\aswMBR.exe
2015-02-19 08:20 - 2012-12-04 18:45 - 00467456 ___SH () C:\EUMONBMP.SYS
2015-02-19 06:03 - 2012-05-30 14:11 - 00000000 ____D () C:\Users\Bob\AppData\Local\CrashDumps
2015-02-18 06:01 - 2013-01-24 14:15 - 00000000 ____D () C:\Users\Bob\AppData\Roaming\HandBrake
2015-02-17 14:53 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\tracing
2015-02-17 08:11 - 2014-02-27 07:03 - 00000000 ____D () C:\Windows\Minidump
2015-02-17 07:34 - 2012-05-24 16:03 - 00000000 ____D () C:\Users\Bob
2015-02-17 07:16 - 2013-03-09 06:04 - 00000000 ____D () C:\Users\Bob\AppData\Roaming\IObit
2015-02-17 07:16 - 2012-05-09 16:20 - 00000000 ____D () C:\ProgramData\Atheros
2015-02-17 07:16 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\registration
2015-02-14 17:26 - 2012-05-29 11:05 - 00000000 ____D () C:\ADE
2015-02-14 09:27 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\rescache
2015-02-12 12:36 - 2012-05-09 16:07 - 00000000 ____D () C:\Program Files (x86)\Dell
2015-02-12 09:01 - 2014-01-20 06:22 - 00001137 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 9.lnk
2015-02-12 09:01 - 2014-01-20 06:22 - 00001125 _____ () C:\Users\Public\Desktop\TeamViewer 9.lnk
2015-02-12 04:47 - 2014-12-10 06:01 - 00000000 ____D () C:\Windows\system32\appraiser
2015-02-12 04:47 - 2014-05-07 02:00 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-02-11 22:16 - 2013-07-16 20:27 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-11 22:12 - 2012-05-24 16:46 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-02-11 09:07 - 2012-05-09 15:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell
2015-02-11 03:22 - 2009-07-13 22:45 - 00292464 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-11 03:03 - 2013-09-28 10:32 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-08 21:30 - 2009-07-13 23:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2015-02-08 15:15 - 2009-07-13 22:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-02-05 17:34 - 2012-05-28 09:05 - 00003894 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-05 17:34 - 2012-05-28 09:05 - 00003642 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-05 12:24 - 2012-05-09 15:40 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-05 12:24 - 2012-05-09 15:40 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-05 12:24 - 2012-05-09 15:40 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-29 05:20 - 2012-05-25 13:19 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-27 19:54 - 2012-05-30 09:46 - 00000000 ____D () C:\Program Files (x86)\LogMeIn
2015-01-27 19:53 - 2012-05-30 09:46 - 00107392 _____ (LogMeIn, Inc.) C:\Windows\system32\LMIRfsClientNP.dll
2015-01-27 19:53 - 2012-05-30 09:46 - 00092520 _____ (LogMeIn, Inc.) C:\Windows\system32\LMIinit.dll
2015-01-27 19:53 - 2012-05-30 09:46 - 00035688 _____ (LogMeIn, Inc.) C:\Windows\system32\LMIport.dll
2015-01-26 05:20 - 2014-01-08 06:12 - 00000000 ____D () C:\Users\Bob\dwhelper

==================== Files in the root of some directories =======

2013-06-26 15:09 - 2013-07-30 05:10 - 0003715 _____ () C:\Program Files (x86)\Mozilla Firefoxavg-secure-search.xml
2012-11-14 13:52 - 2012-11-14 13:52 - 0000124 _____ () C:\Users\Bob\AppData\Roaming\-941824844
2012-05-24 20:23 - 2012-12-15 05:57 - 0000320 _____ () C:\Users\Bob\AppData\Roaming\SEC410057.trad
2013-02-24 10:05 - 2013-05-09 15:55 - 0009216 _____ () C:\Users\Bob\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-05-26 10:02 - 2014-02-17 18:30 - 0000083 ___SH () C:\ProgramData\.zreglib
2012-05-25 17:18 - 2012-05-25 17:18 - 0000113 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
2012-05-25 13:38 - 2012-05-25 13:38 - 0000115 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.64.bc

Some content of TEMP:
====================
C:\Users\Bob\AppData\Local\Temp\i4jdel0.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-23 18:09

==================== End Of Log ============================




Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-02-2015
Ran by Bob at 2015-02-24 06:31:40
Running from C:\Users\Bob\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: AVG AntiVirus Free Edition 2015 (Disabled - Up to date) {4D41356F-32AD-7C42-C820-63775EE4F413}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: AVG AntiVirus Free Edition 2015 (Disabled - Up to date) {F620D48B-1497-73CC-F290-58052563BEAE}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

.NET Reflector Desktop (HKLM-x32\...\{21C448B9-5137-49F3-B364-270E3C88124A}) (Version: 7.6.0.808 - Red Gate Software Ltd)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader X (10.1.13) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.5.146 - Adobe Systems, Inc.)
Amazon Kindle (HKLM-x32\...\Amazon Kindle) (Version: - Amazon)
AMD Catalyst Install Manager (HKLM\...\{A8BBDD74-6FF7-E9D1-4301-52C37371913D}) (Version: 8.0.881.0 - Advanced Micro Devices, Inc.)
Any Video Converter 3.3.9 (HKLM-x32\...\Any Video Converter_is1) (Version: - Any-Video-Converter.com)
AnyDVD (HKLM-x32\...\AnyDVD) (Version: 7.5.2.0 - SlySoft)
Atheros Bluetooth Suite (64) (HKLM\...\{230D1595-57DA-4933-8C4E-375797EBB7E1}) (Version: 7.4.0.115 - Atheros)
Audacity 2.0.2 (HKLM-x32\...\Audacity_is1) (Version: 2.0.2 - Audacity Team)
AVG 2015 (HKLM\...\AVG) (Version: 2015.0.5736 - AVG Technologies)
AVG 2015 (Version: 15.0.4293 - AVG Technologies) Hidden
AVG 2015 (Version: 15.0.5736 - AVG Technologies) Hidden
Camtasia Studio 8 (HKLM-x32\...\{DB93E2C2-851F-44B2-B09C-351D2C624AE1}) (Version: 8.0.4.1060 - TechSmith Corporation)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Cisco WebEx Meetings (HKLM-x32\...\ActiveTouchMeetingClient) (Version: - Cisco WebEx LLC)
CliSecure 5.2 (HKLM-x32\...\{03CA4929-2B86-4159-A71D-437039B609D1}_is1) (Version: - SecureTeam Software Ltd.)
ClocX (1.6.0) (HKLM-x32\...\ClocX) (Version: - )
CloneCD (HKLM-x32\...\CloneCD) (Version: - SlySoft)
CloneDVD2 (HKLM-x32\...\CloneDVD2) (Version: 2.9.3.0 - Elaborate Bytes)
Consumer In-Home Service Agreement (HKLM-x32\...\{F47C37A4-7189-430A-B81D-739FF8A7A554}) (Version: 2.0.0 - Dell Inc.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.45.4.0315 - DT Soft Ltd)
Dell Data Vault (Version: 4.1.9.0 - Dell Inc.) Hidden
Dell DataSafe Local Backup - Support Software (HKLM-x32\...\{A9668246-FB70-4103-A1E3-66C9BC2EFB49}) (Version: 9.4.67 - Dell Inc.)
Dell DataSafe Local Backup (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 9.4.67 - Dell Inc.)
Dell DataSafe Online (HKLM-x32\...\{C53BCCBE-9268-4C09-82E9-611444A73B3F}) (Version: 2.10.1.3 - Dell)
Dell Digital Delivery (HKLM-x32\...\{BC8233D8-59BA-4D40-92B9-4FDE7452AA8B}) (Version: 3.0.3999.0 - Dell Products, LP)
Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)
Dell SupportAssist (HKLM\...\PC-Doctor for Windows) (Version: 1.0.6584.52 - Dell)
Dell SupportAssistAgent (HKLM-x32\...\{287348C8-8B47-4C36-AF28-441A3B7D8722}) (Version: 1.0.1.56462 - Dell)
Dell WLAN and Bluetooth Client Installation (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 9.0 - Dell Inc.)
DriverMax 6 (HKLM-x32\...\DMX5_is1) (Version: 6.31.0.325 - Innovative Solutions)
DVD Flick 1.3.0.7 (HKLM-x32\...\DVD Flick_is1) (Version: 1.3.0.7 - Dennis Meuwissen)
EaseUS Todo Backup Free 5.3 (HKLM-x32\...\EaseUS Todo Backup Free 5.3_is1) (Version: 5.3 - CHENGDU YIWO Tech Development Co., Ltd)
EPSON Printer Software (HKLM\...\EPSON Printer and Utilities) (Version: - SEIKO EPSON Corporation)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - )
ERUNT 1.1j (HKLM-x32\...\ERUNT_is1) (Version: - Lars Hederer)
EVEREST Corporate Edition v5.50 (HKLM-x32\...\EVEREST Corporate Edition_is1) (Version: 5.50 - Lavalys, Inc.)
ffdshow v1.2.4499 [2013-01-04] (HKLM-x32\...\ffdshow_is1) (Version: 1.2.4499.0 - )
FileZilla Client 3.6.0.2 (HKLM-x32\...\FileZilla Client) (Version: 3.6.0.2 - FileZilla Project)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
GoToAssist Corporate (HKLM-x32\...\GoToAssist) (Version: 9.1.0.615 - Citrix Online, a division of Citrix Systems, Inc.)
GoToMeeting 5.5.0.1133 (HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\GoToMeeting) (Version: 5.5.0.1133 - CitrixOnline)
HandBrake 0.9.8 (HKLM-x32\...\HandBrake) (Version: 0.9.8 - )
Hubert Senters Bond Breakout 1.2 (HKLM-x32\...\Hubert Senters Bond Breakout_is1) (Version: - Senters Group, LLC)
Hubert Senters Climactic Volume 1.0 (HKLM-x32\...\Hubert Senters Climactic Volume (for NT7)_is1) (Version: - hubertsenters.com)
Hubert Senters Climactic Volume 1.0 (HKLM-x32\...\Hubert Senters Climactic Volume_is1) (Version: - Senters Group, LLC)
Hubert Senters Climactic Volume 1.1 (HKLM-x32\...\Hubert Senters Climactic Volume for Sierra Charts_is1) (Version: - Senters Group, LLC)
Hubert Senters Climactic Volume for MultiCharts (HKLM-x32\...\Hubert Senters Climactic Volume (MultiCharts)_is1) (Version: - Senters Group, LLC)
Hubert Senters Gold Rush 1.0 (HKLM-x32\...\Hubert Senters Gold Rush_is1) (Version: - Senters Group, LLC)
Hubert Senters Gold Spike 1.0 (HKLM-x32\...\Hubert Senters Gold Spike_is1) (Version: - Senters Group, LLC)
Hubert Senters Good Night Gold 1.0 (HKLM-x32\...\Hubert Senters Good Night Gold_is1) (Version: - Senters Group, LLC)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Manageability Engine Firmware Recovery Agent (HKLM-x32\...\{A6C48A9F-694A-4234-B3AA-62590B668927}) (Version: 1.0.0.35342 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.1.1399 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.0.0.1032 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.3.214 - Intel Corporation)
Intel® Trusted Connect Service Client (HKLM\...\{538B98C3-773F-4F20-9C66-802D104DCBE2}) (Version: 1.23.219.2 - Intel Corporation)
IObit Apps Toolbar v7.0 (HKLM-x32\...\{4ED7341F-1942-4623-A27C-9C4F3838172F}) (Version: 7.0 - Spigot, Inc.) <==== ATTENTION
Jasc Animation Shop 3 (HKLM-x32\...\{7C4196CA-CA41-4F34-9C08-7724E7705D52}) (Version: 3.11 - Jasc Software Inc)
Jasc Paint Shop Pro 9 (HKLM-x32\...\{F843C6A3-224D-4615-94F8-3C461BD9AEA0}) (Version: 9.00.0000 - Jasc Software Inc)
Java 7 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417045FF}) (Version: 7.0.450 - Oracle)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
LogMeIn (HKLM-x32\...\{EE4CA5AF-4A55-418C-8CB8-74435814207B}) (Version: 4.1.2450 - LogMeIn, Inc.)
Magical Jelly Bean KeyFinder (HKLM-x32\...\KeyFinder_is1) (Version: 2.0.10.9 - Magical Jelly Bean)
Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
MCEBrowser (HKLM-x32\...\{79F41FC6-07F9-47C2-BBAC-37C7C70EE703}) (Version: 2.2 - ANPARK)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0016-0000-0000-0000000FF1CE}_EXCEL_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-001B-0000-0000-0000000FF1CE}_WORD_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office Excel 2007 (HKLM-x32\...\EXCEL) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Word 2007 (HKLM-x32\...\WORD) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft PowerPoint Viewer (HKLM-x32\...\{95140000-00AF-0409-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.31211.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{820B6609-4C97-3A2B-B644-573B06A0F0CC}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 35.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 en-US)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MultiCharts (HKLM-x32\...\MultiCharts) (Version: 8.0.5620 - MultiCharts)
MultiCharts (x32 Version: 8.0.5620 - TS Support) Hidden
MultiCharts64 (HKLM\...\MultiCharts64) (Version: 8.0.5375 - MultiCharts)
MultiCharts64 (Version: 8.0.5375 - TS Support) Hidden
Multimedia Card Reader (HKLM-x32\...\InstallShield_{41068A8C-3F30-46B6-978A-EA692F28D1AF}) (Version: 1.7.915.93 - Fitipower)
Multimedia Card Reader (x32 Version: 1.7.915.93 - Fitipower) Hidden
Nero BurningROM 12 (HKLM-x32\...\{3D9167B2-87EB-4713-90B4-E46F2CAFE28D}) (Version: 12.0.00300 - Nero AG)
NinjaTrader 7 (HKLM-x32\...\{498F2114-FE59-44C7-A32F-E6F72C872894}) (Version: 7.0.1024 - NinjaTrader)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.3.2 - Frank Heindörfer, Philip Chinery)
pdfsam (HKLM-x32\...\pdfsam) (Version: 2.2.1 - )
PeerBlock 1.2 (r693) (HKLM\...\{015C5B35-B678-451C-9AEE-821E8D69621C}_is1) (Version: 1.2.0.693 - PeerBlock, LLC)
Prerequisite installer (x32 Version: 12.0.0002 - Nero AG) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6537 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.94 (HKLM-x32\...\Revo Uninstaller) (Version: 1.94 - VS Revo Group)
SiteVault Pro (HKLM-x32\...\{CD244D9D-B284-4DDC-8B9F-BCF762AC1681}_is1) (Version: 4.0.31 - Amorphys Romania)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Smart Defrag 3 (HKLM-x32\...\Smart Defrag 3_is1) (Version: 3.3 - IObit)
Snagit 11 (HKLM-x32\...\{44BD21C2-9132-48DB-B65B-23817E4C6F4B}) (Version: 11.2.0 - TechSmith Corporation)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.0.12 - Safer-Networking Ltd.)
Strongvault Online Backup (HKLM-x32\...\{C8A17402-051A-471B-BA64-9147A7467005}) (Version: 2.1.1.0 - Strongvault) <==== ATTENTION
Strongvault Online Backup (x32 Version: 5.0.2.34 - Strongvault Online Backup) Hidden <==== ATTENTION
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.38846 - TeamViewer)
Total Recorder 8.3 Standard Edition (HKLM-x32\...\TotalRecorder) (Version: - )
Trader Workstation 4.0 (HKLM-x32\...\Trader Workstation 4.0) (Version: - )
TradeStation 9.0 (HKLM-x32\...\{6EF11260-2361-409D-B91C-373D8732EED8}) (Version: 9.0.0.9012 - TradeStation Technologies)
TradeStation 9.1 (HKLM-x32\...\{B948B39D-214F-486E-BCD9-8AB691F8762A}) (Version: 9.01.00.12793 - TradeStation Technologies)
TVersity Codec Pack 1.4 (HKLM-x32\...\TVersity Codec Pack) (Version: 1.4 - TVersity Inc.)
TVersity Media Server 1.9 (HKLM-x32\...\TVersity Media Server) (Version: 1.9 - TVersity)
Tweaking.com - Registry Backup (HKLM-x32\...\Tweaking.com - Registry Backup) (Version: 2.1.1 - Tweaking.com)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0016-0000-0000-0000000FF1CE}_EXCEL_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-001B-0000-0000-0000000FF1CE}_WORD_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Visual Studio 2008 x64 Redistributables (HKLM-x32\...\{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}) (Version: 10.0.0.2 - AVG Technologies)
Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.1.2 (HKLM-x32\...\VLC media player) (Version: 2.1.2 - VideoLAN)
Vuze (HKLM\...\8461-7759-5462-8226) (Version: 5.3.0.0 - Azureus Software, Inc.)
Website Extractor 10.52 (HKLM-x32\...\Website Extractor_is1) (Version: - )
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
WinRAR 4.20 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-472848371-1800496413-3629884572-1000_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Program Files (x86)\Citrix\GoToMeeting\1133\G2MOutlookAddin64.dll (Citrix Online, a division of Citrix Systems, Inc.)

==================== Restore Points =========================

17-02-2015 20:25:13 Scheduled Checkpoint
23-02-2015 06:04:27 Removed Google Earth.
23-02-2015 06:24:11 Installed Microsoft Fix it 50848
24-02-2015 05:26:51 Installed Microsoft Fix it 50535

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-02-22 11:29 - 2015-02-23 10:36 - 00000035 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {08412C21-DB78-4807-82F1-13E5C29E4FF1} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv => C:\Windows\TEMP\{BABC636A-0B2A-48A7-98BF-E852D277A7BB}.exe
Task: {088426E6-E3E4-4C9D-B65D-1A948D75278A} - System32\Tasks\Auto FTP Forex.xml => C:\Omega\FTP_Auto_Upload\ftp_upload_Forex.cmd [2012-11-18] ()
Task: {08FEDB2A-F4C7-4813-9B94-CDAD1CDADB8F} - System32\Tasks\Dell SupportAssistAgent AutoUpdate => C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssist.exe [2015-02-19] (Microsoft)
Task: {0DDC7FB0-E807-4D12-AD3B-DD6C39B51EBE} - System32\Tasks\SmartDefrag3_Update => C:\Program Files (x86)\IObit\Smart Defrag 3\AutoUpdate.exe [2014-07-23] (IObit)
Task: {0EEF6027-ABDA-4A80-A00C-B1157D82FC71} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe
Task: {21538892-EEAF-4B0F-813D-BA09FCD4C1B1} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\Dell\SupportAssist\sessionchecker.exe [2015-02-03] (PC-Doctor, Inc.)
Task: {3B3D2CA3-0580-4E15-A28C-444611D5D6FD} - System32\Tasks\{D6BD40D8-7C23-4DC5-954B-10C7B59D254D} => pcalua.exe -a C:\Junk\rescue2usb.exe -d C:\Junk
Task: {41DC99A4-C1F4-43D3-A8A0-05746AE68826} - System32\Tasks\Auto FTP Stocks.xml => C:\Omega\FTP_Auto_Upload\ftp_upload_Stocks.cmd [2012-11-18] ()
Task: {43463012-A6B2-4272-94B5-185D22ED7713} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
Task: {43E181DD-4E95-45C7-B464-C8273E6E052E} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe
Task: {4C74F371-5723-4BAA-8567-F450CEC0B879} - System32\Tasks\{70C38B8B-37D2-48A9-B98F-5A4A5EF2C6A9} => pcalua.exe -a C:\Users\Bob\Desktop\esetsmartinstaller_enu.exe -d C:\Users\Bob\Desktop
Task: {53E7BDE9-8894-4512-A9E5-17EDB25CCFD4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-05-28] (Google Inc.)
Task: {592C6A55-0342-4B00-BFB1-87DF635C3BCD} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\Dell\SupportAssist\uaclauncher.exe [2015-02-03] (PC-Doctor, Inc.)
Task: {5A754029-4E3B-477E-9C69-F3EF45268237} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-05] (Adobe Systems Incorporated)
Task: {695CFDD7-1AEC-4717-946D-FCC55E999B86} - System32\Tasks\Microsoft\Windows\Media Center\Extender\Update media permissions for Mcx1-XPS8500 => C:\Windows\ehome\McxTask.exe [2009-07-13] (Microsoft Corporation)
Task: {77E37BBB-BB7A-4EFC-8A29-1C6533C7ADAD} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {892E2910-D23C-4497-B736-DD9109013454} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => c:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25] (Intel Corporation)
Task: {89D20355-05D5-434D-8760-073B954A7848} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {8BD1BD81-8B8B-4464-A1A0-0F8498C294FA} - System32\Tasks\SmartDefrag3_Startup => C:\Program Files (x86)\IObit\Smart Defrag 3\SmartDefrag.exe [2014-10-20] (IObit)
Task: {8D0958A1-11FD-4CE7-B372-13CA222857F7} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe
Task: {90170FD2-7BEF-4D84-B4DD-D41AB877BCB5} - System32\Tasks\{DCD3CEF4-DF10-4B4C-A35B-14F361D1F0F2} => pcalua.exe -a C:\Users\Bob\Documents\erunt\ERUNT.EXE -d C:\Users\Bob\Documents\erunt
Task: {92B5D7FD-697D-41CC-9AB7-557A0E1F8355} - System32\Tasks\Auto FTP ETF.xml => C:\Omega\FTP_Auto_Upload\ftp_upload_ETF.cmd [2012-11-18] ()
Task: {9991B4C4-C89A-462C-9CC2-00A2C70A3060} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-05-28] (Google Inc.)
Task: {A5F111FD-9D32-4A26-987D-D8E8E0E85DCF} - System32\Tasks\{4B015CE5-CA51-4E6E-B25C-76A7926D0E95} => pcalua.exe -a "C:\Users\Bob\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WHQM3NFI\Setup TradeStation 9.1 with .NET.exe" -d C:\Users\Bob\Desktop
Task: {B8481CFB-8E85-4ABC-B8AA-2C07D2EEB42A} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv => C:\Windows\TEMP\{B0A47063-09AD-435D-917D-99D1436E26DB}.exe
Task: {C7D4F514-7A65-4CD5-959A-AEE2F348E84A} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => c:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25] (Intel Corporation)
Task: {E763A272-9474-4B03-B6CE-BF26FA72E1B9} - System32\Tasks\{5293C6BC-9EA8-4462-8E85-206422E638E7} => pcalua.exe -a C:\Junk\PaintShopProInstall\iso\setup.exe -d C:\Junk\PaintShopProInstall\iso
Task: {EA208FB1-FE4D-4CEA-A70E-71E93DCB0D71} - System32\Tasks\Auto FTP Futures.xml => C:\Omega\FTP_Auto_Upload\ftp_upload_Futures.cmd [2012-11-18] ()
Task: {FC1C27B1-B372-4FC9-A1FA-8846FB10C511} - System32\Tasks\TradeStation Backup - Daily => C:\Program Files (x86)\TradeStation 9.1\Program\TSBackupRestore.exe [2014-04-03] (TradeStation Technologies, Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Dell SupportAssistAgent AutoUpdate.job => C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssist.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job => c:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe
Task: C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job => c:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe
Task: C:\Windows\Tasks\TradeStation Backup - Daily.job => C:\Program Files (x86)\TradeStation 9.1\Program\TSBackupRestore.exeK/Backup C:\Program Files (x86)\TradeStation 9.1\Templates\Backup\Daily.tsb

==================== Loaded Modules (whitelisted) ==============

2012-05-09 15:53 - 2012-01-21 10:35 - 00128280 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
2012-10-23 18:32 - 2012-06-18 15:40 - 00950032 _____ () C:\SiteVaultPro\SvPro.exe
2010-01-02 08:42 - 2010-01-02 08:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2010-07-12 22:45 - 2010-07-12 22:45 - 00880640 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\MediaServer.exe
2014-12-11 18:25 - 2014-12-11 18:25 - 00014848 _____ () C:\Program Files\i2p\jcpuid.dll
2014-12-11 18:25 - 2014-12-11 18:25 - 00181760 _____ () C:\Program Files\i2p\jbigi.dll
2014-09-29 18:51 - 2014-09-29 18:51 - 00074664 _____ () C:\Program Files (x86)\SlySoft\AnyDVD\ADvdDiscHlp64.exe
2014-06-08 08:48 - 2014-04-15 09:26 - 00097592 _____ () C:\Program Files\Vuze\aereg64.dll
2014-06-08 08:48 - 2014-04-15 09:26 - 00224056 _____ () C:\Users\Bob\AppData\Roaming\Azureus\plugins\azitunes\jacob-1.17-M2-x64.dll
2014-06-08 08:48 - 2014-04-15 09:26 - 00015160 _____ () C:\Users\Bob\AppData\Roaming\Azureus\plugins\azitunes\libProcessAccess64.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00051272 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\CodeLog.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00035912 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\CompressFile.dll
2012-12-04 18:42 - 2008-11-25 17:18 - 01291264 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\libxml2.dll
2012-12-04 18:42 - 2004-10-05 03:08 - 00055808 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\zlib1.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00050248 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\TBGetRemoteNetInfo.dll
2012-12-04 18:42 - 2012-11-05 11:57 - 00035400 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\ActivationOnline.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00294472 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\ExchBackupSize.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00572488 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\ExImage.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00468552 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\ExchBackupSizeEx.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00069192 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\EnumTapeDevice.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00070216 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\TbTapeBrowse.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00022088 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\AccountManager.dll
2012-12-04 18:42 - 2012-10-30 18:10 - 00108616 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\NasOperator.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00135752 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\CloudOperator.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00037960 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\ActiveOnline.dll
2012-12-04 18:42 - 2012-10-19 23:01 - 00096840 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\TBFireWall.dll
2013-01-19 11:51 - 2012-11-13 14:06 - 00108960 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2013-01-19 11:51 - 2012-11-13 14:06 - 00416160 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2013-01-19 11:51 - 2012-11-13 14:06 - 00158624 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2013-01-19 11:51 - 2012-08-23 09:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2013-01-19 11:51 - 2012-11-13 14:06 - 00528288 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\JSDialogPack150.bpl
2012-10-23 18:32 - 2010-03-07 05:31 - 00024110 _____ () C:\SiteVaultPro\mingwm10.dll
2012-10-23 18:32 - 2010-03-30 20:29 - 00279955 _____ () C:\SiteVaultPro\libidn-11.dll
2012-10-23 18:32 - 2010-06-23 06:17 - 01546364 _____ () C:\SiteVaultPro\libeay32.dll
2012-10-23 18:32 - 2010-06-23 06:17 - 00346759 _____ () C:\SiteVaultPro\libssl32.dll
2014-01-21 05:34 - 2014-06-04 14:17 - 00892288 _____ () C:\Program Files (x86)\IObit\Smart Defrag 3\webres.dll
2013-01-19 11:51 - 2012-11-13 14:06 - 00554400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\VirtualTreesDXE150.bpl
2010-07-12 22:06 - 2010-07-12 22:06 - 00344064 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\taglib.dll
2010-07-12 22:06 - 2010-07-12 22:06 - 00729088 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\X11.dll
2010-07-12 22:06 - 2010-07-12 22:06 - 00163840 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\CORE_RL_lcms_.dll
2010-07-12 22:06 - 2010-07-12 22:06 - 00327680 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\libcurl.dll
2010-07-12 22:06 - 2010-07-12 22:06 - 00712704 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\log4cxx.dll
2010-07-11 20:47 - 2010-07-11 20:47 - 04530190 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\avcodec-52.dll
2010-07-11 20:47 - 2010-07-11 20:47 - 00079886 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\avutil-50.dll
2010-07-11 20:47 - 2010-07-11 20:47 - 00309755 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\libmp3lame-0.dll
2010-07-11 20:47 - 2010-07-11 20:47 - 00791566 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\avformat-52.dll
2010-07-11 20:47 - 2010-07-11 20:47 - 00199182 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\swscale-0.dll
2010-07-12 22:06 - 2010-07-12 22:06 - 00505835 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\sqlite3.dll
2006-09-15 23:03 - 2006-09-15 23:03 - 00007680 _____ () C:\Users\Bob\AppData\Local\TVersity\Media Server\ImageMagickCoders\IM_MOD_RL_GRAY_.dll
2014-11-24 11:39 - 2014-11-24 11:39 - 00155528 _____ () C:\Program Files (x86)\Dell Digital Delivery\ServiceTagPlusPlus.dll
2014-10-16 02:33 - 2014-10-16 02:33 - 00172032 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\92a1650dbe9fad5f46633b835420e1a8\IsdiInterop.ni.dll
2012-05-09 15:50 - 2011-11-29 19:00 - 00059392 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2012-05-09 15:52 - 2012-01-21 05:23 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2015-01-27 05:46 - 2015-01-27 05:46 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\atashost => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\GoToAssist => ""="Service"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-472848371-1800496413-3629884572-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Bob\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 8.8.8.8

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

Administrator (S-1-5-21-472848371-1800496413-3629884572-500 - Administrator - Disabled)
Bob (S-1-5-21-472848371-1800496413-3629884572-1000 - Administrator - Enabled) => C:\Users\Bob
Guest (S-1-5-21-472848371-1800496413-3629884572-501 - Limited - Enabled)
HomeGroupUser$ (S-1-5-21-472848371-1800496413-3629884572-1008 - Limited - Enabled)
LogMeInRemoteUser (S-1-5-21-472848371-1800496413-3629884572-1007 - Administrator - Enabled)
Mcx1-XPS8500 (S-1-5-21-472848371-1800496413-3629884572-1006 - Limited - Enabled) => C:\Users\Mcx1-XPS8500

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/24/2015 06:29:55 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program FRST64.exe version 22.2.2015.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 2d88

Start Time: 01d0502d593ebf54

Termination Time: 17

Application Path: C:\Users\Bob\Desktop\FRST64.exe

Report Id: d1366280-bc20-11e4-a98f-08edb918f684

Error: (02/24/2015 05:34:45 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: DellDataVault.exe, version: 3.9.3.0, time stamp: 0x54cc079f
Faulting module name: DellDataVault.exe, version: 3.9.3.0, time stamp: 0x54cc079f
Exception code: 0xc0000005
Fault offset: 0x000000000001aa84
Faulting process id: 0x1520
Faulting application start time: 0xDellDataVault.exe0
Faulting application path: DellDataVault.exe1
Faulting module path: DellDataVault.exe2
Report Id: DellDataVault.exe3

Error: (02/24/2015 05:31:39 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/24/2015 05:23:11 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: DellDataVault.exe, version: 3.9.3.0, time stamp: 0x54cc079f
Faulting module name: DellDataVault.exe, version: 3.9.3.0, time stamp: 0x54cc079f
Exception code: 0xc0000005
Fault offset: 0x000000000001aa84
Faulting process id: 0x1be8
Faulting application start time: 0xDellDataVault.exe0
Faulting application path: DellDataVault.exe1
Faulting module path: DellDataVault.exe2
Report Id: DellDataVault.exe3

Error: (02/24/2015 05:18:47 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/23/2015 06:11:08 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="ia64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Dependent Assembly Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="ia64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (02/23/2015 06:09:41 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Activation context generation failed for "SMC,processorArchitecture="x86",type="win32",version="8.2.0.0"1".Error in manifest or policy file "SMC,processorArchitecture="x86",type="win32",version="8.2.0.0"2" on line SMC,processorArchitecture="x86",type="win32",version="8.2.0.0"3.
Component identity found in manifest does not match the identity of the component requested.
Reference is SMC,processorArchitecture="x86",type="win32",version="8.2.0.0".
Definition is SMC,processorArchitecture="x86",type="win32",version="12.0.0.0".
Please use sxstrace.exe for detailed diagnosis.

Error: (02/23/2015 04:00:34 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: DellDataVault.exe, version: 3.9.3.0, time stamp: 0x54cc079f
Faulting module name: DellDataVault.exe, version: 3.9.3.0, time stamp: 0x54cc079f
Exception code: 0xc0000005
Fault offset: 0x000000000001aa84
Faulting process id: 0x1bd0
Faulting application start time: 0xDellDataVault.exe0
Faulting application path: DellDataVault.exe1
Faulting module path: DellDataVault.exe2
Report Id: DellDataVault.exe3

Error: (02/23/2015 03:56:35 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/23/2015 00:19:41 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.


System errors:
=============
Error: (02/24/2015 05:34:46 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Dell Data Vault service terminated unexpectedly. It has done this 1 time(s).

Error: (02/24/2015 05:31:37 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The vToolbarUpdater15.4.0 service failed to start due to the following error:
%%2

Error: (02/24/2015 05:31:28 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Dell SupportAssist Agent service failed to start due to the following error:
%%1053

Error: (02/24/2015 05:31:28 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Dell SupportAssist Agent service to connect.

Error: (02/24/2015 05:30:04 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Windows Search service failed to start due to the following error:
%%1069

Error: (02/24/2015 05:30:04 AM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: The WSearch service was unable to log on as NT AUTHORITY\SYSTEM with the currently configured password due to the following error:
%%50

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).

Error: (02/24/2015 05:30:00 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module has stopped unexpectedly.

Module Path: C:\Windows\system32\athihvs.dll

Error: (02/24/2015 05:30:00 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module has stopped unexpectedly.

Module Path: C:\Windows\system32\athihvs.dll

Error: (02/24/2015 05:29:55 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY)
Description: WLAN Extensibility Module has stopped unexpectedly.

Module Path: C:\Windows\system32\athihvs.dll

Error: (02/24/2015 05:29:34 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Installer service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
Date: 2012-11-14 18:08:23.638
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2012-11-14 18:08:23.623
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i5-3450 CPU @ 3.10GHz
Percentage of memory in use: 37%
Total physical RAM: 8152.96 MB
Available physical RAM: 5055.61 MB
Total Pagefile: 16304.12 MB
Available Pagefile: 12760.23 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:911.22 GB) (Free:107.13 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 931.5 GB) (Disk ID: B8574584)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Active) - (Size=20.3 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=911.2 GB) - (Type=07 NTFS)

==================== End Of Log ============================

[Juliet]

Follow the tutorial below to unhide files and folders
http://www.bleepingcomputer.com/tuto...-in-windows-7/


Please go to one of the below sites to scan the following files:
Virus Total (Recommended)
jotti.org
VirScan
click on Browse, and upload the following file for analysis:

C:\Users\Bob\Desktop\media.player.codec.pack.lite.v4.3.5.setup.exe


Then click Submit. Allow the file to be scanned, and then please copy and paste the results link (for Virus Total) here for me to see.
If it says already scanned -- click "reanalyze now"
Please post the results in your next reply.


~~~

Please uninstall/delete through your programs list
IObit Apps Toolbar v7.0

~~~~~

Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)

start
CloseProcesses:
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [Ogcics] => C:\Windows\SysWOW64\regsvr32.exe C:\Users\Bob\AppData\Local\YkhxPack\enhance.DLL
C:\Users\Bob\AppData\Local\YkhxPack\enhance.DLL
Folder: C:\Users\Bob\AppData\Local\YkhxPack
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [UTRmedia Update] => regsvr32.exe C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll
C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll
Folder: C:\Users\Bob\AppData\Local\UTRmedia
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO-x32: HelperObject Class -> {00C6482D-C502-44C8-8409-FCE54AD9C208} -> C:\Program Files (x86)\TechSmith\SnagIt 7\SnagItBHO.dll No File
S2 vToolbarUpdater15.4.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe [X]
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe
2015-02-16 18:51 - 2015-02-23 12:12 - 00000000 ____D () C:\Users\Bob\AppData\Local\YkhxPack
2015-02-16 18:51 - 2015-02-23 12:12 - 00000000 ____D () C:\Users\Bob\AppData\Local\UTRmedia
C:\Users\Bob\AppData\Local\Temp\i4jdel0.exe
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [BackupAgent] => C:\Program Files (x86)\Strongvault Online Backup\BackupAgent.exe
Strongvault Online Backup (x32 Version: 5.0.2.34 - Strongvault Online Backup) Hidden <==== ATTENTION
CMD: ipconfig /flushdns
CMD: netsh winsock reset all
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
EmptyTemp:
End

Open FRST/FRST64 and press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.


Please post
File to be scanned
Fixlog.txt

[savanna]

I did NOT get any error reports on the last boot-up after the FRST64 fix.

When trying to remove the IObit Apps Toolbar I get an error message of "The feature you are trying to use is on a network resource that is unavailable."

The Virus Total and fixlist.txt info is below.

Thank you for your help.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Community
Statistics
Documentation
FAQ
About

Join our community
Sign in

English

VirusTotal
SHA256: 3f72f3e9935a1f7c00cbb9557c5589084ff8fa67f7efcde94e25a89146380ace
File name: media.player.codec.pack.lite.v4.3.5.setup.exe
Detection ratio: 2 / 50
Analysis date: 2015-02-24 16:05:51 UTC ( 1 minute ago )
0
1

Analysis
File detail
Additional information
Comments
Votes
Behavioural information

Antivirus Result Update
GData Win32.Adware.Spigot.B 20150224
Kingsoft VIRUS_UNKNOWN 20150224
ALYac 20150224
AVG 20150224
AVware 20150224
Ad-Aware 20150224
AegisLab 20150224
Agnitum 20150223
AhnLab-V3 20150224
Alibaba 20150224
Antiy-AVL 20150224
Avast 20150224
Avira 20150224
Baidu-International 20150224
BitDefender 20150224
Bkav 20150213
ByteHero 20150224
CAT-QuickHeal 20150224
CMC 20150223
ClamAV 20150224
Comodo 20150224
Cyren 20150224
DrWeb 20150224
ESET-NOD32 20150224
Emsisoft 20150224
F-Prot 20150224
F-Secure 20150224
Fortinet 20150224
Ikarus 20150224
Jiangmin 20150223
K7AntiVirus 20150224
K7GW 20150224
Kaspersky 20150224
Malwarebytes 20150224
McAfee 20150224
McAfee-GW-Edition 20150224
MicroWorld-eScan 20150224
Microsoft 20150224
NANO-Antivirus 20150224
Norman 20150224
Panda 20150224
Qihoo-360 20150224
Rising 20150223
SUPERAntiSpyware 20150224
Sophos 20150224
Symantec 20150224
Tencent 20150224
TheHacker 20150222
TotalDefense 20150224
TrendMicro 20150224
TrendMicro-HouseCall 20150224
VBA32 20150224
VIPRE 20150224
ViRobot 20150224
Zillya 20150223
Zoner 20150223
nProtect 20150224
Blog | Twitter | contact@virustotal.com | Google groups | ToS | Privacy policy


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



Community
Statistics
Documentation
FAQ
About

Join our community
Sign in

English

VirusTotal
SHA256: 3f72f3e9935a1f7c00cbb9557c5589084ff8fa67f7efcde94e25a89146380ace
File name: media.player.codec.pack.lite.v4.3.5.setup.exe
Detection ratio: 2 / 50
Analysis date: 2015-02-24 16:05:51 UTC ( 1 minute ago )
0
1

Analysis
File detail
Additional information
Comments
Votes
Behavioural information

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.
Authenticode signature block
Copyright
© 2014 Cole Williams

Publisher Cole Williams Software Limited
Product Media Player - Codec Pack
File version 4.3.5.1221
Description Media Player - Codec Pack
Comments Enables playback and encoding for various audio & video formats.
Signature verification Signed file, verified signature
Signing date 7:03 AM 12/21/2014
Signers
[+] Cole Williams Software Limited
[+] COMODO RSA Code Signing CA
[+] COMODO
Counter signers
[+] COMODO Time Stamping Signer
[+] USERTrust
Packers identified
F-PROT AutoIt, NSIS, appended, UPX_LZMA, CAB
PE header basic information
Target machine Intel 386 or later processors and compatible processors
Compilation timestamp 2009-12-05 22:50:46
Entry Point 0x0000323C
Number of sections 5
PE sections
Name Virtual address Virtual size Raw size Entropy MD5
.text 4096 23130 23552 6.42 0bc2ffd32265a08d72b795b18265828d
.rdata 28672 4496 4608 5.18 f179218a059068529bdb4637ef5fa28e
.data 36864 110488 1024 4.71 975304d6dd6c4a4f076b15511e2bbbc0
.ndata 147456 65536 0 0.00 d41d8cd98f00b204e9800998ecf8427e
.rsrc 212992 199336 199680 4.92 26ecf07f4f79db1fbab426906bf2d92e
PE imports
[+] ADVAPI32.dll
[+] COMCTL32.dll
[+] GDI32.dll
[+] KERNEL32.dll
[+] SHELL32.dll
[+] USER32.dll
[+] VERSION.dll
[+] ole32.dll
Number of PE resources by type
RT_ICON 18
RT_DIALOG 5
RT_MANIFEST 1
RT_BITMAP 1
RT_VERSION 1
RT_GROUP_ICON 1
Number of PE resources by language
ENGLISH US 26
NEUTRAL 1
ExifTool file metadata
UninitializedDataSize
1024

Comments
Enables playback and encoding for various audio & video formats.

LinkerVersion
6.0

ImageVersion
6.0

FileSubtype
0

FileVersionNumber
4.3.5.1221

LanguageCode
Neutral

FileFlagsMask
0x0000

CharacterSet
Windows, Latin1

InitializedDataSize
119808

MIMEType
application/octet-stream

Subsystem
Windows GUI

FileVersion
4.3.5.1221

TimeStamp
2009:12:05 23:50:46+01:00

FileType
Win32 EXE

PEType
PE32

SubsystemVersion
4.0

FileDescription
Media Player - Codec Pack

OSVersion
4.0

FileOS
Win32

LegalCopyright
2014 Cole Williams

MachineType
Intel 386 or later, and compatibles

CompanyName
Media Player - Codec Pack

CodeSize
23552

ProductName
Media Player - Codec Pack

ProductVersionNumber
4.3.5.1221

EntryPoint
0x323c

ObjectFileType
Executable application

Blog | Twitter | contact@virustotal.com | Google groups | ToS | Privacy policy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



Community
Statistics
Documentation
FAQ
About

Join our community
Sign in

English

VirusTotal
SHA256: 3f72f3e9935a1f7c00cbb9557c5589084ff8fa67f7efcde94e25a89146380ace
File name: media.player.codec.pack.lite.v4.3.5.setup.exe
Detection ratio: 2 / 50
Analysis date: 2015-02-24 16:05:51 UTC ( 1 minute ago )
0
1

Analysis
File detail
Additional information
Comments
Votes
Behavioural information

File identification
MD5 f130bf6fc9843dc591b9e84844174f54
SHA1 d9aa121204d1bee6119952a1ebacad330867a646
SHA256 3f72f3e9935a1f7c00cbb9557c5589084ff8fa67f7efcde94e25a89146380ace
ssdeep
393216:wNuK6VsjjA+mwfgJY9XA8P3U4v8nHfA0CQjwjPDGlwJMXY:wNYIt9XA8s4EHfIQjCGuJMXY

authentihash cd4866c8d7e07e80c0d80c6c86e574c538957bef0a574fcfc79cf2b8a033d162
imphash 099c0646ea7282d232219f8807883be0
File size 13.1 MB ( 13762592 bytes )
File type Win32 EXE
Magic literal
PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID NSIS - Nullsoft Scriptable Install System (94.8%)
Win32 Executable MS Visual C++ (generic) (3.4%)
Win32 Dynamic Link Library (generic) (0.7%)
Win32 Executable (generic) (0.5%)
Generic Win/DOS Executable (0.2%)
Tags
nsis peexe signed

VirusTotal metadata
First submission 2015-01-03 00:53:56 UTC ( 1 month, 3 weeks ago )
Last submission 2015-02-24 16:05:51 UTC ( 2 minutes ago )
File names output.52239153.txt
media.player.codec.pack.lite.v4.3.5.setup.exe
3f72f3e9935a1f7c00cbb9557c5589084ff8fa67f7efcde94e25a89146380ace
52239153
media.player.codec.pack.lite.v4.3.5.setup.exe
Advanced heuristic and reputation engines
ClamAV PUA
Possibly Unwanted Application. While not necessarily malicious, the scanned file presents certain characteristics which depending on the user policies and environment may or may not represent a threat. For full details see: http://www.clamav.net/doc/pua.html .

Symantec reputation Suspicious.Insight
Blog | Twitter | contact@virustotal.com | Google groups | ToS | Privacy policy


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 22-02-2015
Ran by Bob at 2015-02-24 09:51:01 Run:7
Running from C:\Users\Bob\Desktop
Loaded Profiles: Bob (Available profiles: Bob & Mcx1-XPS8500)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start
CloseProcesses:
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [Ogcics] => C:\Windows\SysWOW64\regsvr32.exe C:\Users\Bob\AppData\Local\YkhxPack\enhance.DLL
C:\Users\Bob\AppData\Local\YkhxPack\enhance.DLL
Folder: C:\Users\Bob\AppData\Local\YkhxPack
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [UTRmedia Update] => regsvr32.exe C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll
C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll
Folder: C:\Users\Bob\AppData\Local\UTRmedia
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO-x32: HelperObject Class -> {00C6482D-C502-44C8-8409-FCE54AD9C208} -> C:\Program Files (x86)\TechSmith\SnagIt 7\SnagItBHO.dll No File
S2 vToolbarUpdater15.4.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe [X]
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe
2015-02-16 18:51 - 2015-02-23 12:12 - 00000000 ____D () C:\Users\Bob\AppData\Local\YkhxPack
2015-02-16 18:51 - 2015-02-23 12:12 - 00000000 ____D () C:\Users\Bob\AppData\Local\UTRmedia
C:\Users\Bob\AppData\Local\Temp\i4jdel0.exe
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\...\Run: [BackupAgent] => C:\Program Files (x86)\Strongvault Online Backup\BackupAgent.exe
Strongvault Online Backup (x32 Version: 5.0.2.34 - Strongvault Online Backup) Hidden <==== ATTENTION
CMD: ipconfig /flushdns
CMD: netsh winsock reset all
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
EmptyTemp:
End
*****************

Processes closed successfully.
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Ogcics => value deleted successfully.
"C:\Users\Bob\AppData\Local\YkhxPack\enhance.DLL" => File/Directory not found.

========================= Folder: C:\Users\Bob\AppData\Local\YkhxPack ========================

2015-02-16 18:51 - 2015-02-16 18:51 - 0051220 _____ () C:\Users\Bob\AppData\Local\YkhxPack\DrawLine.2
2015-02-22 19:15 - 2015-02-22 19:15 - 0051220 _____ () C:\Users\Bob\AppData\Local\YkhxPack\enhance.2
2015-02-16 19:13 - 2015-02-22 19:06 - 0051220 _____ () C:\Users\Bob\AppData\Local\YkhxPack\webapprt-stub.2

====== End of Folder: ======

HKU\S-1-5-21-472848371-1800496413-3629884572-1000\Software\Microsoft\Windows\CurrentVersion\Run\\UTRmedia Update => value deleted successfully.
"C:\Users\Bob\AppData\Local\UTRmedia\vbc.dll" => File/Directory not found.

========================= Folder: C:\Users\Bob\AppData\Local\UTRmedia ========================

2015-02-16 18:51 - 2015-02-16 18:51 - 0237076 _____ () C:\Users\Bob\AppData\Local\UTRmedia\CNBJOP7i.2
2015-02-22 19:06 - 2015-02-22 19:06 - 0237076 _____ () C:\Users\Bob\AppData\Local\UTRmedia\vbc.2

====== End of Folder: ======

HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00C6482D-C502-44C8-8409-FCE54AD9C208}" => Key deleted successfully.
"HKCR\Wow6432Node\CLSID\{00C6482D-C502-44C8-8409-FCE54AD9C208}" => Key deleted successfully.
vToolbarUpdater15.4.0 => Service deleted successfully.
"C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe" => File/Directory not found.
C:\Users\Bob\AppData\Local\YkhxPack => Moved successfully.
C:\Users\Bob\AppData\Local\UTRmedia => Moved successfully.
C:\Users\Bob\AppData\Local\Temp\i4jdel0.exe => Moved successfully.
HKU\S-1-5-21-472848371-1800496413-3629884572-1000\Software\Microsoft\Windows\CurrentVersion\Run\\BackupAgent => value deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5E33D30D-D896-4D92-B033-5F45819B2937}\\SystemComponent => value deleted successfully.

========= ipconfig /flushdns =========


Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========


========= netsh winsock reset all =========


Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.


========= End of CMD: =========


========= netsh int ipv4 reset =========

Reseting Global, OK!
Reseting Interface, OK!
Restart the computer to complete this action.


========= End of CMD: =========


========= netsh int ipv6 reset =========

Reseting Interface, OK!
Restart the computer to complete this action.


========= End of CMD: =========

EmptyTemp: => Removed 1.8 GB temporary data.


The system needed a reboot.

==== End of Fixlog 09:51:19 ====

[Juliet]

I think we got it.

C:\Users\Bob\Desktop\media.player.codec.pack.lite.v4.3.5.setup.exe
File name: media.player.codec.pack.lite.v4.3.5.setup.exe
Detection ratio: 2 / 50

2 vendors classified this as Adware. It's not being flagged by any of the other well known antivirus as of yet...
You can leave this alone or delete it, I'll let you make this call.

Ready to remove tools and quarantine folders?

[savanna]

I agree - that looks like the culprit. I'd like to give it a few days just to make sure. I'll give it 2 days and if everything looks OK I'll get back with you to proceed.

Thank you VERY much for your help.

[Juliet]

That'll work. Use the computer lightly as in, no big downloads just general use.

[Juliet]

If all appears good now


DelFix

• Please download DelFix
  or from here http://www.bleepingcomputer.com/download/delfix/ and save the file to your Desktop.
• Double-click DelFix.exe to run the programme.
• Place a checkmark next to the following items:
  
  • Activate UAC
  • Remove disinfection tools
  • Create registry backup
  
  
• Click the Run button.

-- This will remove the specialised tools we used to disinfect your system. Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).

~~~~~~~~~~~

• Answers to common security questions - Best Practices by quietman7, MVP
• How Malware Spreads - How did I get infected? by quietman7, MVP
• Simple and easy ways to keep your computer safe and secure on the Internet by Lawrence Abrams, MVP
• How to Prevent Malware by miekiemoes, MVP
• How to backup and restore your data using Cobian Backup by YourHighness
• Slow Computer/browser? It May Not Be Malwareby quietman7, MVP
  

The following programmes come highly recommended in the security community.

• AdBlock is a browser add-on that blocks annoying banners, pop-ups and video ads.
• CryptoPrevent places policy restrictions on loading points for ransomware (eg.CryptoPrevent), preventing your files from being encrypted.
• Malwarebytes Anti-Exploit (MBAE) is designed to prevent zero-day malware from exploiting vulnerable software.
• Malwarebytes Anti-Malware Premium (MBAM) works in real-time along side your Anti-Virus to prevent malware execution.
• NoScript is a Firefox add-on that blocks the actions of malicious scripts by using whitelisting and other technology.
• Sandboxie isolates programmes of your choice, preventing files from being written to your HDD unless approved by you.
• Secuina PSI will scan your computer for vulnerable softwarethat is outdated, and automatically find the latest update for you.
• SpywareBlaster is a form of passive protection, designed to block the actions of malicious websites and tracking cookies.
• Web of Trust (WOT) is a browser add-on designed to alert you before interacting with a potentially malicious website.