[badgerduck]

I am running Windows 7. My computer is running sluggishly and my desktop seams to refresh frequently.  I open Task Manager to see that multiple Google Chrome process zmeiwjb.exe*32 are running even though I do not have Google Chrome installed on this computer. This process runs even when I have no programs/or browsers open and uses a lot of memory. I have run multiple full MS Security Essentials scans each being clean.  I used System Mechanic Pro 12.7 to incinerate the zmeiwjb.exe*32 file and incinerate all deleted files.  Upon system reboot the process seems to be gone and the computer running smoothly. But the process soon reappears.  I would very much appreciate help solving this.  I’ve noted a few similar instances on this site but being a novice, the process of fixing this problem is a bit daunting.  

 

R/badgerduck

 

 

 

OTL logfile created on: 10/31/2014 4:12:14 PM - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Randy\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.17358)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
4.00 Gb Total Physical Memory | 1.97 Gb Available Physical Memory | 49.38% Memory free
7.99 Gb Paging File | 5.25 Gb Available in Paging File | 65.68% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 233.88 Gb Total Space | 193.75 Gb Free Space | 82.84% Space Free | Partition Type: NTFS
Drive J: | 231.78 Gb Total Space | 191.64 Gb Free Space | 82.68% Space Free | Partition Type: NTFS
 
Computer Name: OFFICE | User Name: Randy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - File not found --
PRC - [2014/10/31 16:10:55 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Randy\Desktop\OTL.exe
PRC - [2014/10/30 20:47:59 | 000,860,488 | ---- | M] (Google Inc.) -- C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\zmeiwjb.exe
PRC - [2014/09/04 07:50:02 | 000,064,704 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2014/08/13 02:06:26 | 005,386,320 | ---- | M] (iolo technologies, LLC) -- C:\Program Files (x86)\iolo\System Mechanic Professional\LiveBoost.exe
PRC - [2014/08/13 02:06:12 | 004,902,208 | ---- | M] (iolo technologies, LLC) -- C:\Program Files (x86)\iolo\System Mechanic Professional\SystemGuardAlerter.exe
PRC - [2014/08/12 23:39:54 | 004,700,872 | ---- | M] (iolo technologies, LLC) -- C:\Program Files (x86)\iolo\Common\Lib\ioloServiceManager.exe
PRC - [2009/09/26 00:32:18 | 000,189,736 | ---- | M] (Seagate Technology LLC) -- J:\SEAGATE\Sync\FreeAgentService.exe
PRC - [2009/09/26 00:31:32 | 000,185,640 | ---- | M] (Seagate LLC) -- J:\SEAGATE\FreeAgent Status\stxmenumgr.exe
PRC - [2009/07/13 20:14:30 | 000,014,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\regsvr32.exe
PRC - [2006/11/30 17:08:52 | 000,051,968 | ---- | M] (ArcSoft, Inc.) -- C:\Program Files (x86)\ArcSoft\PhotoStudio 5.5\PrintProcess.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2014/10/30 20:47:59 | 014,669,128 | ---- | M] () -- C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\PepperFlash\pepflashplayer.dll
MOD - [2014/10/30 20:47:59 | 000,353,096 | ---- | M] () -- C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\ppgooglenaclpluginchrome.dll
MOD - [2014/10/30 20:47:58 | 008,537,928 | ---- | M] () -- C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\pdf.dll
MOD - [2014/10/30 20:47:58 | 001,732,936 | ---- | M] () -- C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\ffmpegsumo.dll
MOD - [2014/10/30 20:47:58 | 000,718,152 | ---- | M] () -- C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\libglesv2.dll
MOD - [2014/10/30 20:47:58 | 000,126,280 | ---- | M] () -- C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\libegl.dll
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2014/10/16 11:30:27 | 000,111,616 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)
SRV:64bit: - [2014/08/22 15:14:34 | 000,368,624 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV:64bit: - [2014/08/22 15:14:34 | 000,023,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV:64bit: - [2013/07/10 08:55:50 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2010/05/27 11:59:40 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2014/09/24 11:11:34 | 000,267,440 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2014/09/04 07:50:02 | 000,064,704 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2014/08/17 01:40:45 | 000,067,224 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2014/08/12 23:39:54 | 004,700,872 | ---- | M] (iolo technologies, LLC) [Auto | Running] -- C:\Program Files (x86)\iolo\Common\Lib\ioloServiceManager.exe -- (ioloSystemService)
SRV - [2013/09/11 22:21:54 | 000,105,144 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2013/06/28 18:48:04 | 000,014,624 | ---- | M] (Intuit Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe -- (IntuitUpdateServiceV4)
SRV - [2009/09/26 00:32:18 | 000,189,736 | ---- | M] (Seagate Technology LLC) [Auto | Running] -- J:\SEAGATE\Sync\FreeAgentService.exe -- (FreeAgentGoNext Service)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2014/08/12 23:38:24 | 000,032,912 | ---- | M] (EldoS Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\rawdsk3.sys -- (RawDisk3)
DRV:64bit: - [2014/07/17 18:05:06 | 000,125,584 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:64bit: - [2014/03/31 21:06:06 | 000,058,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fssfltr.sys -- (fssfltr)
DRV:64bit: - [2013/12/03 10:54:50 | 000,082,160 | ---- | M] (Raxco Software, Inc.) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\PDFsFilter.sys -- (PDFsFilter)
DRV:64bit: - [2013/12/03 10:54:48 | 000,030,752 | ---- | M] (EldoS Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElRawDsk.sys -- (ElRawDisk)
DRV:64bit: - [2013/03/31 18:31:14 | 000,304,480 | ---- | M] (silex technology, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\sxuptp.sys -- (sxuptp)
DRV:64bit: - [2012/09/15 08:38:12 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2012/09/15 08:37:46 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011/03/11 01:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 01:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010/11/20 08:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/05/27 12:39:12 | 006,856,192 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2010/05/27 12:39:12 | 006,856,192 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2010/05/27 11:25:36 | 000,264,192 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2010/05/06 04:21:46 | 000,125,456 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2010/03/08 20:08:36 | 000,121,800 | ---- | M] (QUALCOMM Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HtcVComV64.sys -- (HtcVCom32)
DRV:64bit: - [2009/07/13 20:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 20:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 20:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/13 19:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV:64bit: - [2009/06/10 15:35:20 | 000,278,016 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1e6032e.sys -- (e1express)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 15:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2009/07/13 20:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC
IE - HKLM\..\URLSearchHook: {e4878b45-e2c0-4307-b6e8-734922f92f5b} - C:\Program Files (x86)\Road_Runner\prxtbRoad.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...ms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = D0 CA BD 2F D2 91 CD 01  [binary data]
IE - HKCU\..\URLSearchHook: {e4878b45-e2c0-4307-b6e8-734922f92f5b} - C:\Program Files (x86)\Road_Runner\prxtbRoad.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes,DefaultScope = {4219814A-37CB-4D45-B780-2BB19D5E9F75}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IESR02
IE - HKCU\..\SearchScopes\{4219814A-37CB-4D45-B780-2BB19D5E9F75}: "URL" = http://search.rr.com...con=iesearchbox
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\system32\npDeployJava1.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.67.2: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.67.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3528.0331: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
 
 
O1 HOSTS File: ([2009/06/10 16:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [WrtMon.exe] C:\Windows\SysNative\spool\drivers\x64\3\WrtMon.exe ()
O4 - HKLM..\Run: [MaxMenuMgr] J:\SEAGATE\FreeAgent Status\StxMenuMgr.exe (Seagate LLC)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [Mfmbxori] C:\Users\Randy\AppData\Local\Diagnostics\Mfmbxori.dll (Borland Software Corporation)
O4 - Startup: C:\Users\Randy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Cisco VUSB.lnk =  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset...lineScanner.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{229CAD67-72F5-4676-B95F-019FB8489905}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{f1bf5d49-9653-11e3-beda-001aa094bc0c}\Shell - "" = AutoRun
O33 - MountPoints2\{f1bf5d49-9653-11e3-beda-001aa094bc0c}\Shell\AutoRun\command - "" = E:\HTC_Sync_Manager_PC.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2014/10/31 16:10:55 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Randy\Desktop\OTL.exe
[2014/10/31 15:29:19 | 002,155,152 | ---- | C] (iolo technologies, LLC) -- C:\Windows\SysNative\Incinerator64.dll
[2014/10/31 15:27:50 | 000,032,912 | ---- | C] (EldoS Corporation) -- C:\Windows\SysNative\drivers\rawdsk3.sys
[2014/10/31 15:27:45 | 000,000,000 | ---D | C] -- C:\logs
[2014/10/29 16:40:47 | 000,000,000 | ---D | C] -- C:\Users\Randy\AppData\Local\Deployment
[2014/10/15 21:21:28 | 000,000,000 | ---D | C] -- C:\Users\Randy\Tracing
[2014/10/15 21:20:35 | 000,000,000 | ---D | C] -- C:\Windows\en
[2014/10/15 21:19:02 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
[2014/10/15 21:19:00 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\DRVSTORE
[2014/10/15 21:18:54 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live
[2014/10/15 21:16:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft OneDrive
 
========== Files - Modified Within 30 Days ==========
 
[2014/10/31 16:11:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2014/10/31 16:10:55 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Randy\Desktop\OTL.exe
[2014/10/31 15:37:49 | 000,022,768 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2014/10/31 15:37:49 | 000,022,768 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2014/10/31 15:30:27 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2014/10/31 15:30:18 | 3219,787,776 | -HS- | M] () -- C:\hiberfil.sys
[2014/10/31 15:29:22 | 000,001,481 | ---- | M] () -- C:\Users\Randy\Desktop\LiveBoost.lnk
[2014/10/31 15:29:22 | 000,001,477 | ---- | M] () -- C:\Users\Randy\Desktop\System Mechanic Professional.lnk
[2014/10/30 12:21:08 | 000,003,272 | ---- | M] () -- C:\bootsqm.dat
[2014/10/26 21:55:48 | 000,083,876 | ---- | M] () -- C:\Users\Randy\Desktop\University_of_Minnesota_Twin_Cities_completion.pdf
[2014/10/22 19:37:59 | 000,786,578 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2014/10/22 19:37:59 | 000,665,304 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2014/10/22 19:37:59 | 000,123,112 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2014/10/16 12:51:09 | 000,418,288 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
 
========== Files Created - No Company Name ==========
 
[2014/10/31 15:29:22 | 000,001,481 | ---- | C] () -- C:\Users\Randy\Desktop\LiveBoost.lnk
[2014/10/30 12:21:08 | 000,003,272 | ---- | C] () -- C:\bootsqm.dat
[2014/10/26 21:55:48 | 000,083,876 | ---- | C] () -- C:\Users\Randy\Desktop\University_of_Minnesota_Twin_Cities_completion.pdf
[2014/10/15 21:20:13 | 000,001,305 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk
[2014/10/15 21:19:47 | 000,001,458 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
[2014/10/15 21:19:38 | 000,002,486 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
[2014/05/17 10:27:47 | 002,440,206 | ---- | C] () -- C:\Users\Randy\AppData\Local\[j0012]-[p04].bmp
[2014/05/17 10:27:46 | 002,440,206 | ---- | C] () -- C:\Users\Randy\AppData\Local\[j0012]-[p03].bmp
[2014/05/17 10:27:44 | 002,440,206 | ---- | C] () -- C:\Users\Randy\AppData\Local\[j0012]-[p02].bmp
[2014/05/17 10:27:43 | 002,440,206 | ---- | C] () -- C:\Users\Randy\AppData\Local\[j0012]-[p01].bmp
[2014/02/10 18:28:09 | 000,074,703 | ---- | C] () -- C:\Windows\SysWow64\mfc45.dat
[2013/08/21 01:20:09 | 000,000,044 | ---- | C] () -- C:\Users\Randy\jagex_cl_runescape_LIVE.dat
[2013/08/21 01:20:09 | 000,000,024 | ---- | C] () -- C:\Users\Randy\random.dat
[2013/02/16 13:07:50 | 000,000,775 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
[2013/01/02 16:48:10 | 000,000,017 | ---- | C] () -- C:\Users\Randy\AppData\Local\resmon.resmoncfg
 
========== ZeroAccess Check ==========
 
[2009/07/13 23:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2014/08/17 01:32:59 | 014,175,744 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2014/08/17 01:32:59 | 012,874,240 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 20:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2012/09/15 08:38:27 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 20:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2014/01/06 12:18:34 | 000,000,000 | ---D | M] -- C:\Users\Randy\AppData\Roaming\Broderbund
[2012/09/24 08:48:15 | 000,000,000 | ---D | M] -- C:\Users\Randy\AppData\Roaming\Canon
[2014/10/31 15:28:18 | 000,000,000 | ---D | M] -- C:\Users\Randy\AppData\Roaming\iolo
[2013/12/13 14:22:18 | 000,000,000 | ---D | M] -- C:\Users\Randy\AppData\Roaming\ioloGovernor
[2013/02/18 12:07:33 | 000,000,000 | ---D | M] -- C:\Users\Randy\AppData\Roaming\Leadertech
[2013/10/22 08:52:10 | 000,000,000 | ---D | M] -- C:\Users\Randy\AppData\Roaming\NewSoft
[2013/08/04 14:07:06 | 000,000,000 | ---D | M] -- C:\Users\Randy\AppData\Roaming\Oracle
[2012/09/13 19:14:39 | 000,000,000 | ---D | M] -- C:\Users\Randy\AppData\Roaming\ScanSoft
 
========== Purity Check ==========
 
 

< End of report >

[Advertisements]

Hello, badgerduck. Welcome to Geeks to Go! My nickname is Nevan and I will be helping you getting your system back on its electronic feet.

Before we get started, please keep those things in mind:

• Always read every part of my post carefully. If you don't, you may do something wrong and there could be more problems to solve.
• If your security programs give you any warnings when using tools I asked you to, don't be afraid. Every tool I provide to you is 100% safe.
• Only run tools that I ask you to. Some of them can be dangerous to your system as they have much power.
• You should save or print my instructions. It is possible that we will be using Safe mode, which will cut you off from your internet connection and without access to them, you might be stuck.
• Malware removal is a complicated process that takes multiple steps to be completed. Don't give up, be patient.
• The tools we are going to use and your software may cause unwanted interactions. Because of that, I recommend you to make backups of any important files from your machine before proceeding as they might be lost.
• I recommend you to stay with me until I tell you that we are done. It is important because when your system does not show any bad symptoms anymore it does not mean that it is 100% clean.
• Your time to reply is limited. If you don't reply within 3 days, your topic will be closed and you will have to request it to be reopened by contacting one of Moderator group members with the link to this topic.
• Every program I ask you to download should be saved to and run from desktop. If you don't know how to choose the direction of where a download is saved, check this site. You can also just copy these programs to your desktop manually and then run them from there.
• Remember that the fixes I give you are only for your machine. Using it on other systems may (and probably will) cause problems.
• Finally, if you have any questions or are unsure about something, just ask. I will not blame you for it. It is better to ask rather than regret it later.

Also, please note that I'm currently in training, so my answers to you will have to be checked first by an experienced helper before I can post them. This can lengthen the time between my answers to you, but in return you will have an extra person reviewing your log.

 
I need to have another look at the system. Please, do the following:

FRST Scan

• Download Farbar Recovery Scan Tool and save it to your Desktop.
• Right click FRST64.exe and click Run as administrator. When the tool opens click Yes to disclaimer.
• Make sure that Addition.txt is checked and press the Scan button.
• It will produce two logs - one called FRST.txt and another one called Addition.txt in the same directory the tool is run from.
• Select all (CTRL+A) the content of the logs, copy them (CTRL+C) and paste (CTRL+V) them into your next reply.

 
Things that should appear in your next post:

• FRST.txt log content
• Addition.txt log content

[Nevan]

Hello, badgerduck. Welcome to Geeks to Go! My nickname is Nevan and I will be helping you getting your system back on its electronic feet.

Before we get started, please keep those things in mind:

• Always read every part of my post carefully. If you don't, you may do something wrong and there could be more problems to solve.
• If your security programs give you any warnings when using tools I asked you to, don't be afraid. Every tool I provide to you is 100% safe.
• Only run tools that I ask you to. Some of them can be dangerous to your system as they have much power.
• You should save or print my instructions. It is possible that we will be using Safe mode, which will cut you off from your internet connection and without access to them, you might be stuck.
• Malware removal is a complicated process that takes multiple steps to be completed. Don't give up, be patient.
• The tools we are going to use and your software may cause unwanted interactions. Because of that, I recommend you to make backups of any important files from your machine before proceeding as they might be lost.
• I recommend you to stay with me until I tell you that we are done. It is important because when your system does not show any bad symptoms anymore it does not mean that it is 100% clean.
• Your time to reply is limited. If you don't reply within 3 days, your topic will be closed and you will have to request it to be reopened by contacting one of Moderator group members with the link to this topic.
• Every program I ask you to download should be saved to and run from desktop. If you don't know how to choose the direction of where a download is saved, check this site. You can also just copy these programs to your desktop manually and then run them from there.
• Remember that the fixes I give you are only for your machine. Using it on other systems may (and probably will) cause problems.
• Finally, if you have any questions or are unsure about something, just ask. I will not blame you for it. It is better to ask rather than regret it later.

Also, please note that I'm currently in training, so my answers to you will have to be checked first by an experienced helper before I can post them. This can lengthen the time between my answers to you, but in return you will have an extra person reviewing your log.

 
I need to have another look at the system. Please, do the following:

FRST Scan

• Download Farbar Recovery Scan Tool and save it to your Desktop.
• Right click FRST64.exe and click Run as administrator. When the tool opens click Yes to disclaimer.
• Make sure that Addition.txt is checked and press the Scan button.
• It will produce two logs - one called FRST.txt and another one called Addition.txt in the same directory the tool is run from.
• Select all (CTRL+A) the content of the logs, copy them (CTRL+C) and paste (CTRL+V) them into your next reply.

 
Things that should appear in your next post:

• FRST.txt log content
• Addition.txt log content

[badgerduck]

Thank you Nevan.

As instructed I backed up important files, downloaded FRST and here are the two reports.

FRST.txt:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-10-2014 01
Ran by Randy (administrator) on OFFICE on 31-10-2014 21:33:36
Running from C:\Users\Randy\Desktop
Loaded Profile: Randy (Available profiles: Randy)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Seagate Technology LLC) J:\SEAGATE\Sync\FreeAgentService.exe
(iolo technologies, LLC) C:\Program Files (x86)\iolo\Common\Lib\ioloServiceManager.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(iolo technologies, LLC) C:\Program Files (x86)\iolo\System Mechanic Professional\SystemGuardAlerter.exe
(iolo technologies, LLC) C:\Program Files (x86)\iolo\System Mechanic Professional\LiveBoost.exe
(iolo technologies, LLC) C:\Program Files (x86)\iolo\System Mechanic Professional\ioloGovernor64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
() C:\Windows\System32\spool\drivers\x64\3\WrtMon.exe
(Microsoft Corporation) C:\Windows\System32\regsvr32.exe
() C:\Windows\System32\spool\drivers\x64\3\WrtProc.exe
(Cisco Consumer Products LLC) C:\Program Files\CiscoVUSB\CiscoVUSB.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Seagate LLC) J:\SEAGATE\FreeAgent Status\stxmenumgr.exe
(Microsoft Corporation) C:\Windows\SysWOW64\regsvr32.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\SETLANG.EXE
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Google Inc.) C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\zmeiwjb.exe
(Google Inc.) C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\zmeiwjb.exe
(Google Inc.) C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\zmeiwjb.exe
(Google Inc.) C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\zmeiwjb.exe
(Google Inc.) C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\zmeiwjb.exe
(Google Inc.) C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\zmeiwjb.exe
(Google Inc.) C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\zmeiwjb.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
HKLM\...\Run: [WrtMon.exe] => C:\Windows\system32\spool\drivers\x64\3\WrtMon.exe [20480 2006-09-20] ()
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-05-27] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [MaxMenuMgr] => J:\SEAGATE\FreeAgent Status\StxMenuMgr.exe [185640 2009-09-26] (Seagate LLC)
HKU\S-1-5-21-4283896459-4070683001-661046522-1000\...\Run: [Mfmbxori] => regsvr32.exe /s "C:\Users\Randy\AppData\Local\Diagnostics\Mfmbxori.dll" <===== ATTENTION
HKU\S-1-5-21-4283896459-4070683001-661046522-1000\...\MountPoints2: {f1bf5d49-9653-11e3-beda-001aa094bc0c} - E:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-4283896459-4070683001-661046522-1000\...409d6c4515e9\InprocServer32: [Default-shell32] <==== ATTENTION!
Startup: C:\Users\Randy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Cisco VUSB.lnk
ShortcutTarget: Cisco VUSB.lnk -> C:\Program Files\CiscoVUSB\CiscoVUSB.exe (Cisco Consumer Products LLC)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xD0CABD2FD291CD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
URLSearchHook: HKLM-x32 - Road Runner Toolbar - {e4878b45-e2c0-4307-b6e8-734922f92f5b} - C:\Program Files (x86)\Road_Runner\prxtbRoad.dll (Conduit Ltd.)
URLSearchHook: HKCU - Road Runner Toolbar - {e4878b45-e2c0-4307-b6e8-734922f92f5b} - C:\Program Files (x86)\Road_Runner\prxtbRoad.dll (Conduit Ltd.)
SearchScopes: HKCU - DefaultScope {4219814A-37CB-4D45-B780-2BB19D5E9F75} URL = http://search.rr.com...con=iesearchbox
SearchScopes: HKCU - {4219814A-37CB-4D45-B780-2BB19D5E9F75} URL = http://search.rr.com...con=iesearchbox
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset...lineScanner.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF Plugin: @java.com/DTPlugin,version=10.21.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

Chrome:
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 FreeAgentGoNext Service; J:\SEAGATE\Sync\FreeAgentService.exe [189736 2009-09-26] (Seagate Technology LLC)
R2 ioloSystemService; C:\Program Files (x86)\iolo\Common\Lib\ioloServiceManager.exe [4700872 2014-08-12] (iolo technologies, LLC)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 ElRawDisk; C:\Windows\system32\drivers\ElRawDsk.sys [30752 2013-12-03] (EldoS Corporation)
S3 HtcVCom32; C:\Windows\System32\DRIVERS\HtcVComV64.sys [121800 2010-03-08] (QUALCOMM Incorporated)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
R1 RawDisk3; C:\Windows\system32\drivers\rawdsk3.sys [32912 2014-08-12] (EldoS Corporation)
R3 sxuptp; C:\Windows\System32\DRIVERS\sxuptp.sys [304480 2013-03-31] (silex technology, Inc.)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-31 21:33 - 2014-10-31 21:33 - 00009148 ____C () C:\Users\Randy\Desktop\FRST.txt
2014-10-31 21:32 - 2014-10-31 21:33 - 00000000 ___DC () C:\FRST
2014-10-31 21:30 - 2014-10-31 21:30 - 02113536 ____C (Farbar) C:\Users\Randy\Desktop\FRST64.exe
2014-10-31 16:20 - 2014-10-31 16:20 - 00074466 ____C () C:\Users\Randy\Desktop\Extras.Txt
2014-10-31 16:18 - 2014-10-31 16:18 - 00049350 ____C () C:\Users\Randy\Desktop\OTL.Txt
2014-10-31 16:10 - 2014-10-31 16:10 - 00602112 ____C (OldTimer Tools) C:\Users\Randy\Desktop\OTL.exe
2014-10-31 15:29 - 2014-10-31 15:29 - 00001481 ____C () C:\Users\Randy\Desktop\LiveBoost.lnk
2014-10-31 15:29 - 2014-08-12 23:41 - 02155152 ____C (iolo technologies, LLC) C:\Windows\system32\Incinerator64.dll
2014-10-31 15:27 - 2014-08-12 23:38 - 00032912 ____C (EldoS Corporation) C:\Windows\system32\Drivers\rawdsk3.sys
2014-10-31 11:08 - 2014-10-31 11:08 - 00011762 ____C () C:\Users\Randy\Documents\Copy of T shirt order form.xlsx
2014-10-30 12:21 - 2014-10-30 12:21 - 00003272 ____N () C:\bootsqm.dat
2014-10-29 16:40 - 2014-10-30 14:33 - 00000000 ___DC () C:\Users\Randy\AppData\Local\Deployment
2014-10-27 15:21 - 2014-10-31 20:58 - 00001120 ____C () C:\Windows\setupact.log
2014-10-27 15:21 - 2014-10-27 15:21 - 00000000 ____C () C:\Windows\setuperr.log
2014-10-16 08:20 - 2014-10-16 11:32 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-16 08:20 - 2014-10-16 11:32 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-16 08:20 - 2014-10-16 11:32 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
2014-10-16 08:20 - 2014-10-16 11:32 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
2014-10-16 08:20 - 2014-10-16 11:32 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-16 08:20 - 2014-10-16 11:32 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
2014-10-16 08:20 - 2014-10-16 11:32 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-16 08:20 - 2014-10-16 11:31 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-10-16 08:20 - 2014-10-16 11:31 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-10-16 08:20 - 2014-10-16 11:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-10-16 08:20 - 2014-10-16 11:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-10-16 08:20 - 2014-10-16 11:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-10-16 08:20 - 2014-10-16 11:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-10-16 08:20 - 2014-10-16 11:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-10-16 08:20 - 2014-10-16 11:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-10-16 08:20 - 2014-10-16 11:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-10-16 08:20 - 2014-10-16 11:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-10-16 08:20 - 2014-10-16 11:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-10-16 08:20 - 2014-10-16 11:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-10-16 08:19 - 2014-10-16 11:30 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-10-16 08:19 - 2014-10-16 11:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-16 08:19 - 2014-10-16 11:30 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-16 08:19 - 2014-10-16 11:30 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-10-16 08:19 - 2014-10-16 11:30 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-10-16 08:19 - 2014-10-16 11:30 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-16 08:19 - 2014-10-16 11:30 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00507392 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00378552 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00331448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00276480 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-10-16 08:19 - 2014-10-16 11:30 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-10-16 08:19 - 2014-10-16 11:30 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-10-16 08:19 - 2014-10-16 11:30 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-10-16 08:19 - 2014-10-16 11:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-10-16 08:17 - 2014-10-16 11:29 - 03722240 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-16 08:17 - 2014-10-16 11:29 - 03241472 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-16 08:17 - 2014-10-16 11:29 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-10-16 08:17 - 2014-10-16 11:29 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-10-16 08:17 - 2014-10-16 11:29 - 01118720 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-10-16 08:17 - 2014-10-16 11:29 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-10-16 08:17 - 2014-10-16 11:29 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-16 08:17 - 2014-10-16 11:29 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-10-16 08:17 - 2014-10-16 11:29 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-16 08:17 - 2014-10-16 11:29 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-10-16 08:17 - 2014-10-16 11:29 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-16 08:17 - 2014-10-16 11:29 - 00212480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-10-16 08:17 - 2014-10-16 11:29 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll
2014-10-16 08:17 - 2014-10-16 11:29 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-10-16 08:17 - 2014-10-16 11:29 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2014-10-16 08:17 - 2014-10-16 11:29 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-10-16 08:17 - 2014-10-16 11:29 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-10-16 08:17 - 2014-10-16 11:29 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-10-16 08:17 - 2014-10-16 11:29 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-10-16 08:17 - 2014-10-16 11:29 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-10-16 08:17 - 2014-10-16 11:28 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-16 08:17 - 2014-10-16 11:28 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-10-15 22:54 - 2014-10-15 23:03 - 165261807 ____C () C:\Users\Randy\Downloads\October 13, 2014.mp4
2014-10-15 21:21 - 2014-10-15 21:21 - 00000000 ___DC () C:\Users\Randy\Tracing
2014-10-15 21:20 - 2014-10-15 21:20 - 00001305 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk
2014-10-15 21:20 - 2014-10-15 21:20 - 00000000 ___DC () C:\Windows\en
2014-10-15 21:19 - 2014-10-15 21:20 - 00000000 __RDC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
2014-10-15 21:19 - 2014-10-15 21:19 - 00002486 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
2014-10-15 21:19 - 2014-10-15 21:19 - 00001458 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
2014-10-15 21:19 - 2014-03-31 21:06 - 00058056 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\fssfltr.sys
2014-10-15 21:18 - 2014-10-15 21:18 - 00000000 ___DC () C:\Program Files\Windows Live
2014-10-15 21:16 - 2014-10-15 21:16 - 00000000 ___DC () C:\ProgramData\Microsoft OneDrive
2014-10-15 21:14 - 2014-10-15 21:21 - 01239752 ____C (Microsoft Corporation) C:\Users\Randy\Downloads\wlsetup-web.exe
2014-10-01 07:00 - 2014-10-01 07:09 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2014-10-01 07:00 - 2014-10-01 07:09 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-31 21:11 - 2012-09-13 18:59 - 00000830 ____C () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-31 21:10 - 2009-07-14 00:13 - 00786578 ____C () C:\Windows\system32\PerfStringBackup.INI
2014-10-31 21:06 - 2009-07-13 23:45 - 00022768 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-31 21:06 - 2009-07-13 23:45 - 00022768 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-31 21:02 - 2012-09-13 12:04 - 01220916 ____C () C:\Windows\WindowsUpdate.log
2014-10-31 20:58 - 2009-07-14 00:08 - 00000006 ___HC () C:\Windows\Tasks\SA.DAT
2014-10-31 19:14 - 2012-09-13 18:55 - 00735662 ____C () C:\Windows\PFRO.log
2014-10-31 15:30 - 2012-09-13 20:18 - 00000000 ___DC () C:\ProgramData\iolo
2014-10-31 15:29 - 2014-02-25 12:22 - 00001477 ____C () C:\Users\Randy\Desktop\System Mechanic Professional.lnk
2014-10-31 15:29 - 2014-02-25 12:22 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Mechanic Professional
2014-10-31 15:28 - 2014-02-25 12:18 - 00000000 ___DC () C:\Users\Randy\AppData\Roaming\iolo
2014-10-31 15:28 - 2013-12-13 14:22 - 00003144 ____C () C:\Windows\System32\Tasks\iolo Process Governor
2014-10-31 15:28 - 2013-12-13 14:22 - 00000000 ___DC () C:\ProgramData\ioloGovernor
2014-10-30 15:01 - 2012-09-13 19:00 - 00000000 ___DC () C:\Users\Randy\AppData\Local\Google
2014-10-30 15:01 - 2012-09-13 18:59 - 00000000 ___DC () C:\Program Files (x86)\Google
2014-10-30 12:26 - 2012-09-13 12:05 - 00000000 ___DC () C:\Users\Randy
2014-10-30 06:25 - 2012-09-13 12:30 - 00275080 ____C (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-10-29 16:40 - 2013-02-21 16:50 - 00000000 ___DC () C:\Users\Randy\AppData\Local\Apps\2.0
2014-10-28 09:42 - 2012-09-30 21:13 - 00000000 ___DC () C:\Users\Randy\.epaysol
2014-10-27 09:28 - 2009-07-13 22:20 - 00000000 ___DC () C:\Windows\Resources
2014-10-26 23:43 - 2009-07-13 22:20 - 00000000 ___DC () C:\Windows\system32\NDF
2014-10-17 14:38 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\rescache
2014-10-16 12:51 - 2009-07-13 23:45 - 00418288 ____C () C:\Windows\system32\FNTCACHE.DAT
2014-10-16 12:48 - 2014-05-06 09:40 - 00000000 __SDC () C:\Windows\system32\CompatTel
2014-10-16 11:33 - 2012-09-13 13:14 - 00000000 ___DC () C:\ProgramData\Microsoft Help
2014-10-16 11:28 - 2013-08-14 11:32 - 00000000 ___DC () C:\Windows\system32\MRT
2014-10-16 11:15 - 2012-09-13 23:11 - 103265616 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-15 21:21 - 2013-02-21 15:38 - 00000000 ___DC () C:\Users\Randy\AppData\Local\Windows Live
2014-10-15 21:20 - 2013-02-21 15:43 - 00001374 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk
2014-10-15 21:19 - 2013-02-21 15:42 - 00000000 ___DC () C:\Program Files (x86)\Windows Live
2014-10-04 16:57 - 2013-04-08 10:22 - 00000000 ___DC () C:\Windows\Minidump

Files to move or delete:
====================
C:\Users\Randy\jagex_cl_runescape_LIVE.dat
C:\Users\Randy\random.dat


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-26 12:00

==================== End Of Log ============================


Addition.txt:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 30-10-2014 01
Ran by Randy at 2014-10-31 21:34:29
Running from C:\Users\Randy\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)
Adobe Reader X (10.1.12) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.12 - Adobe Systems Incorporated)
ArcSoft PhotoStudio 5.5 (HKLM-x32\...\{85309D89-7BE9-4094-BB17-24999C6118FC}) (Version: - ArcSoft)
ATI AVIVO64 Codecs (Version: 11.6.0.50527 - ATI Technologies Inc.) Hidden
ATI Catalyst Install Manager (HKLM\...\{EDA9E418-06E0-1FCB-1210-838F1ED5FBE6}) (Version: 3.0.778.0 - ATI Technologies, Inc.)
Canon CanoScan 8800F User Registration (HKLM-x32\...\Canon CanoScan 8800F User Registration) (Version: - )
Canon MP Navigator EX 1.0 (HKLM-x32\...\MP Navigator EX 1.0) (Version: - )
Canon Utilities Solution Menu (HKLM-x32\...\CanonSolutionMenu) (Version: - )
CanoScan 8800F (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ4805) (Version: - )
Carbonite Online Backup Setup (HKLM-x32\...\Carbonite Setup Lite) (Version: 3.8.0 - Carbonite Inc.)
ccc-core-static (x32 Version: 2010.0527.1242.20909 - ATI) Hidden
Cisco VUSB (HKLM\...\Cisco VUSB) (Version: 1.2.0 - Cisco Consumer Products LLC)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Homeworld (HKLM-x32\...\Homeworld) (Version: - )
HydraVision (x32 Version: 4.2.166.0 - ATI Technologies Inc.) Hidden
iolo technologies' System Mechanic Professional (HKLM-x32\...\{BBD3F66B-1180-4785-B679-3F91572CD3B4}_is1) (Version: 14.0.1 - iolo technologies, LLC)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217040FF}) (Version: 7.0.670 - Oracle)
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mavis Beacon Teaches Typing Deluxe 20 (HKLM-x32\...\{23B591D7-1C20-44FB-97C2-6953AE67DE18}) (Version: 20.00.0000 - Broderbund)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-0011-0000-0000-0000000FF1CE}_PROPLUSR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM-x32\...\{95140000-007A-0409-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office Professional Plus 2007 (HKLM-x32\...\PROPLUSR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Photo Common (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Presto! PageManager 7.15.16 (HKLM-x32\...\{D2D6B9EB-C6DC-4DAA-B4DE-BB7D9735E7DA}) (Version: 7.15.16 - NewSoft Technology Corporation)
Road Runner Toolbar (HKLM-x32\...\Road_Runner Toolbar) (Version: 6.9.0.16 - Road Runner)
ScanSoft OmniPage SE 4 (HKLM-x32\...\{B2F3DBD9-A9D2-4838-B45D-C917DAB32BC3}) (Version: 15.2.0020 - Nuance Communications, Inc.)
Seagate Manager Installer (HKLM-x32\...\InstallShield_{2A30052B-831C-41D3-8044-3C0388066350}) (Version: 2.01.0600 - Seagate)
Seagate Manager Installer (x32 Version: 2.01.0600 - Seagate) Hidden
System Mechanic 12 Professional (x32 Version: 14.0.1 - ) Hidden
TurboTax 2012 (HKLM-x32\...\TurboTax 2012) (Version: 2012.0 - Intuit, Inc)
TurboTax 2013 (HKLM-x32\...\TurboTax 2013) (Version: 2013.0 - Intuit, Inc)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-0011-0000-0000-0000000FF1CE}_PROPLUSR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points =========================

30-10-2014 17:14:27 iolo Designated Drivers Pre-Update Restore Point (41C74F)
30-10-2014 17:14:42 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 21:34 - 2009-06-10 16:00 - 00000824 ___AC C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {1AD63CAB-0C2E-49FC-9374-3DA601EE8A06} - System32\Tasks\{FDAC7655-42CA-437F-839A-BF3CB55AE225} => Chrome.exe
Task: {5723FB9E-B34A-4D35-B34F-1CEEEEB22EA3} - System32\Tasks\iolo Process Governor => C:\Program Files (x86)\iolo\System Mechanic Professional\iologovernor64.exe [2014-08-13] (iolo technologies, LLC)
Task: {8E843174-04C3-4E94-9DCE-BA7906A56023} - System32\Tasks\{E831ED58-5160-4B8C-A1AF-1BBF5C03ADF8} => Chrome.exe
Task: {C0BE6949-B2AC-4F8D-8A7A-78107C02C863} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-24] (Adobe Systems Incorporated)
Task: {CDDED647-1356-47A6-B413-E1533C17D979} - System32\Tasks\{03F1D329-489F-47BB-AA59-5D4F038EE954} => Chrome.exe
Task: {EF7B31E2-3DD1-4DF2-A284-0A7115392D27} - System32\Tasks\{F26F192C-25FF-4955-B6E7-108861516E94} => Chrome.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2012-09-13 19:24 - 2006-09-20 08:35 - 00020480 ____C () C:\Windows\System32\spool\drivers\x64\3\WrtMon.exe
2012-09-13 19:24 - 2006-10-30 16:59 - 00024576 ____C () C:\Windows\System32\spool\drivers\x64\3\WrtProc.exe
2013-03-07 18:40 - 2013-03-31 18:31 - 00281600 ____C () C:\Program Files\CiscoVUSB\Svlscapi.dll
2010-04-16 14:20 - 2010-04-16 14:20 - 00016384 ___RC () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2010-05-27 12:40 - 2010-05-27 12:40 - 00270336 ____C () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2014-10-26 13:22 - 2014-10-30 20:47 - 00718152 ____C () C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\libglesv2.dll
2014-10-26 13:22 - 2014-10-30 20:47 - 00126280 ____C () C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\libegl.dll
2014-10-26 13:22 - 2014-10-30 20:47 - 08537928 ____C () C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\pdf.dll
2014-10-26 13:22 - 2014-10-30 20:47 - 00353096 ____C () C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\ppGoogleNaClPluginChrome.dll
2014-10-26 13:22 - 2014-10-30 20:47 - 01732936 ____C () C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\ffmpegsumo.dll
2014-10-26 13:22 - 2014-10-30 20:47 - 14669128 ____C () C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\18176224.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\34958083.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AMP => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AMPSE => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BITS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EventSystem => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ioloSystemService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vseamps => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vsedsps => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vseqrts => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\18176224.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\34958083.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AMP => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AMPSE => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\BITS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\EventSystem => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ioloSystemService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vseamps => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vsedsps => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vseqrts => ""="Service"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: CanonSolutionMenu => C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe /logon
MSCONFIG\startupreg: OpwareSE4 => "C:\Program Files (x86)\ScanSoft\OmniPageSE4\OpwareSE4.exe"
MSCONFIG\startupreg: SSBkgdUpdate => "C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

========================= Accounts: ==========================

Administrator (S-1-5-21-4283896459-4070683001-661046522-500 - Administrator - Disabled)
Guest (S-1-5-21-4283896459-4070683001-661046522-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-4283896459-4070683001-661046522-1002 - Limited - Enabled)
Randy (S-1-5-21-4283896459-4070683001-661046522-1000 - Administrator - Enabled) => C:\Users\Randy

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (10/30/2014 03:06:58 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "36.0.1985.143,language="*",type="win32",version="36.0.1985.143"1".
Dependent Assembly 36.0.1985.143,language="*",type="win32",version="36.0.1985.143" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (10/29/2014 05:21:59 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "36.0.1985.143,language="*",type="win32",version="36.0.1985.143"1".
Dependent Assembly 36.0.1985.143,language="*",type="win32",version="36.0.1985.143" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (10/29/2014 05:13:39 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "36.0.1985.143,language="*",type="win32",version="36.0.1985.143"1".
Dependent Assembly 36.0.1985.143,language="*",type="win32",version="36.0.1985.143" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (10/29/2014 05:06:08 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "36.0.1985.143,language="*",type="win32",version="36.0.1985.143"1".
Dependent Assembly 36.0.1985.143,language="*",type="win32",version="36.0.1985.143" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (10/29/2014 05:03:56 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "36.0.1985.143,language="*",type="win32",version="36.0.1985.143"1".
Dependent Assembly 36.0.1985.143,language="*",type="win32",version="36.0.1985.143" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (10/29/2014 05:03:49 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "36.0.1985.143,language="*",type="win32",version="36.0.1985.143"1".
Dependent Assembly 36.0.1985.143,language="*",type="win32",version="36.0.1985.143" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (10/29/2014 05:03:49 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "36.0.1985.143,language="*",type="win32",version="36.0.1985.143"1".
Dependent Assembly 36.0.1985.143,language="*",type="win32",version="36.0.1985.143" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (10/29/2014 05:03:22 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "36.0.1985.143,language="*",type="win32",version="36.0.1985.143"1".
Dependent Assembly 36.0.1985.143,language="*",type="win32",version="36.0.1985.143" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (10/29/2014 05:03:05 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "36.0.1985.143,language="*",type="win32",version="36.0.1985.143"1".
Dependent Assembly 36.0.1985.143,language="*",type="win32",version="36.0.1985.143" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (10/29/2014 04:56:33 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "36.0.1985.143,language="*",type="win32",version="36.0.1985.143"1".
Dependent Assembly 36.0.1985.143,language="*",type="win32",version="36.0.1985.143" could not be found.
Please use sxstrace.exe for detailed diagnosis.


System errors:
=============
Error: (10/31/2014 09:34:35 PM) (Source: Microsoft-Windows-Bits-Client) (EventID: 16398) (User: NT AUTHORITY)
Description: A new BITS job could not be created. The current job count for the user Office\Randy (60) is equal to or greater than the job limit (60) specified through group policy. To correct the problem, complete or cancel the BITS jobs that haven't made progress by looking at the error, and restart the BITS service. If this error recurs, contact your system administrator and increate the per-user and per-computer Group Policy job limits.

Error: (10/31/2014 09:28:10 PM) (Source: Microsoft-Windows-Bits-Client) (EventID: 16398) (User: NT AUTHORITY)
Description: A new BITS job could not be created. The current job count for the user Office\Randy (60) is equal to or greater than the job limit (60) specified through group policy. To correct the problem, complete or cancel the BITS jobs that haven't made progress by looking at the error, and restart the BITS service. If this error recurs, contact your system administrator and increate the per-user and per-computer Group Policy job limits.

Error: (10/31/2014 09:26:44 PM) (Source: Microsoft-Windows-Bits-Client) (EventID: 16398) (User: NT AUTHORITY)
Description: A new BITS job could not be created. The current job count for the user Office\Randy (60) is equal to or greater than the job limit (60) specified through group policy. To correct the problem, complete or cancel the BITS jobs that haven't made progress by looking at the error, and restart the BITS service. If this error recurs, contact your system administrator and increate the per-user and per-computer Group Policy job limits.

Error: (10/31/2014 09:21:00 PM) (Source: Microsoft-Windows-Bits-Client) (EventID: 16398) (User: NT AUTHORITY)
Description: A new BITS job could not be created. The current job count for the user Office\Randy (60) is equal to or greater than the job limit (60) specified through group policy. To correct the problem, complete or cancel the BITS jobs that haven't made progress by looking at the error, and restart the BITS service. If this error recurs, contact your system administrator and increate the per-user and per-computer Group Policy job limits.

Error: (10/31/2014 09:14:50 PM) (Source: Microsoft-Windows-Bits-Client) (EventID: 16398) (User: NT AUTHORITY)
Description: A new BITS job could not be created. The current job count for the user Office\Randy (60) is equal to or greater than the job limit (60) specified through group policy. To correct the problem, complete or cancel the BITS jobs that haven't made progress by looking at the error, and restart the BITS service. If this error recurs, contact your system administrator and increate the per-user and per-computer Group Policy job limits.

Error: (10/31/2014 09:14:23 PM) (Source: Microsoft-Windows-Bits-Client) (EventID: 16398) (User: NT AUTHORITY)
Description: A new BITS job could not be created. The current job count for the user Office\Randy (60) is equal to or greater than the job limit (60) specified through group policy. To correct the problem, complete or cancel the BITS jobs that haven't made progress by looking at the error, and restart the BITS service. If this error recurs, contact your system administrator and increate the per-user and per-computer Group Policy job limits.

Error: (10/31/2014 09:06:24 PM) (Source: Microsoft-Windows-Bits-Client) (EventID: 16398) (User: NT AUTHORITY)
Description: A new BITS job could not be created. The current job count for the user Office\Randy (60) is equal to or greater than the job limit (60) specified through group policy. To correct the problem, complete or cancel the BITS jobs that haven't made progress by looking at the error, and restart the BITS service. If this error recurs, contact your system administrator and increate the per-user and per-computer Group Policy job limits.

Error: (10/31/2014 09:05:52 PM) (Source: Microsoft-Windows-Bits-Client) (EventID: 16398) (User: NT AUTHORITY)
Description: A new BITS job could not be created. The current job count for the user Office\Randy (60) is equal to or greater than the job limit (60) specified through group policy. To correct the problem, complete or cancel the BITS jobs that haven't made progress by looking at the error, and restart the BITS service. If this error recurs, contact your system administrator and increate the per-user and per-computer Group Policy job limits.

Error: (10/31/2014 07:36:52 PM) (Source: Microsoft-Windows-Bits-Client) (EventID: 16398) (User: NT AUTHORITY)
Description: A new BITS job could not be created. The current job count for the user Office\Randy (60) is equal to or greater than the job limit (60) specified through group policy. To correct the problem, complete or cancel the BITS jobs that haven't made progress by looking at the error, and restart the BITS service. If this error recurs, contact your system administrator and increate the per-user and per-computer Group Policy job limits.

Error: (10/31/2014 07:32:12 PM) (Source: Microsoft-Windows-Bits-Client) (EventID: 16398) (User: NT AUTHORITY)
Description: A new BITS job could not be created. The current job count for the user Office\Randy (60) is equal to or greater than the job limit (60) specified through group policy. To correct the problem, complete or cancel the BITS jobs that haven't made progress by looking at the error, and restart the BITS service. If this error recurs, contact your system administrator and increate the per-user and per-computer Group Policy job limits.


Microsoft Office Sessions:
=========================
Error: (09/09/2013 02:45:18 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6680.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 48 seconds with 0 seconds of active time. This session ended with a crash.

Error: (01/24/2013 11:04:49 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 1 seconds with 0 seconds of active time. This session ended with a crash.


CodeIntegrity Errors:
===================================
Date: 2013-07-08 09:58:14.197
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

Date: 2013-07-08 08:33:46.688
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

Date: 2013-07-08 07:25:33.152
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

Date: 2013-04-12 17:04:06.531
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

Date: 2013-04-12 16:50:52.377
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

Date: 2013-04-12 16:37:11.758
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

Date: 2013-04-12 16:20:02.810
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

Date: 2013-04-12 14:26:50.612
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

Date: 2013-04-12 13:45:32.893
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Processor: Intel® Core™2 Duo CPU E6550 @ 2.33GHz
Percentage of memory in use: 57%
Total physical RAM: 4094.18 MB
Available physical RAM: 1735.86 MB
Total Pagefile: 8186.53 MB
Available Pagefile: 5287.26 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:233.88 GB) (Free:193.12 GB) NTFS
Drive e: (FreeAgent Drive) (Fixed) (Total:298.09 GB) (Free:105.31 GB) NTFS
Drive j: (New Volume) (Fixed) (Total:231.78 GB) (Free:191.64 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 3A2DFFDB)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=233.9 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=231.8 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 298.1 GB) (Disk ID: A4B57300)
Partition 1: (Not Active) - (Size=298.1 GB) - (Type=07 NTFS)

==================== End Of Log ============================

[Nevan]

Thank you Nevan.

You're welcome

We have some work to do, so let's get started.

Step #1
Restore point creation

• Click the Start Orb. Right click Computer and click Properties
• In the left column under Tasks, click Advance System Settings and accept the warning if you get one
• Click the System Protection Tab
• Windows 7/8: In the Protection Settings section, make sure the protection for the System drive is ON. If it isn't, click the Configure button and turn it on.
  Note: It may take some time for the system to populate the Available Disks box, so be patient.
• Click the Create button at the bottom
• Type in a name fo the restore point, i.e: Before Fixes
• Click Create
• A small System Protection window will come up telling you a Restore Point is being created.
• Another System Protection window will come up telling you the Restore Point has been created, click OK
• Click OK again.
• Close the Control Panel box.

 
Step #2
Uninstall programs

Go to Start Menu>Control Panel>Programs>Uninstall a program (or Control Panel>Programs and Features if using icon view) and remove Road Runner Toolbar.

 
Step #3
FRST Fix

• Download attached fixlist.txt file to your desktop.
   fixlist.txt   3.91KB   237 downloads
  NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
• Right click FRST64.exe on your desktop and click Run as administrator. When the tool opens click Yes to disclaimer.
• Press the Fix button just once and wait.
  NOTE: It's important that both FRST64.exe and fixlist.txt are in the same location or the fix will not work.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished, FRST will generate a log on the desktop (Fixlog.txt). Select all (CTRL+A) the content of the log, copy it (CTRL+C) and paste (CTRL+V) it into your next reply.

 
Step #4
AdwCleaner

• Download AdwCleaner to your Desktop.
• Close any open windows
• Disable your Antivirus program
• Double click AdwCleaner.exe on your desktop to run it
  

  

• Click the button
• Wait for AdwCleaner to finish the scan
• When the scan is finished, there will be "Pending. Please uncheck elements you don't want to remove" message. Leave everything as it is and click button. A Notepad window will be opened
• Select all (CTRL+A) the content of the log, copy it (CTRL+C) and paste (CTRL+V) it into your next reply.

 
Things that should appear in your next post:

• Fixlog.txt log content
• AdwCleaner log content

[badgerduck]

Nevan,

 

I performed the steps per your previous post.  After all was done and the reports generated I turned MS Security Essentials back on. R/badgerduck

 

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 01-11-2014
Ran by Randy at 2014-11-01 22:35:51 Run:1
Running from C:\Users\Randy\Desktop
Loaded Profile: Randy (Available profiles: Randy)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
HKU\S-1-5-21-4283896459-4070683001-661046522-1000\...\Run: [Mfmbxori] => regsvr32.exe /s "C:\Users\Randy\AppData\Local\Diagnostics\Mfmbxori.dll" <===== ATTENTION
HKU\S-1-5-21-4283896459-4070683001-661046522-1000\...\MountPoints2: {f1bf5d49-9653-11e3-beda-001aa094bc0c} - E:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-4283896459-4070683001-661046522-1000\...409d6c4515e9\InprocServer32: [Default-shell32] <==== ATTENTION!
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xD0CABD2FD291CD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
URLSearchHook: HKLM-x32 - Road Runner Toolbar - {e4878b45-e2c0-4307-b6e8-734922f92f5b} - C:\Program Files (x86)\Road_Runner\prxtbRoad.dll (Conduit Ltd.)
URLSearchHook: HKCU - Road Runner Toolbar - {e4878b45-e2c0-4307-b6e8-734922f92f5b} - C:\Program Files (x86)\Road_Runner\prxtbRoad.dll (Conduit Ltd.)
SearchScopes: HKCU - DefaultScope {4219814A-37CB-4D45-B780-2BB19D5E9F75} URL = http://search.rr.com...con=iesearchbox
SearchScopes: HKCU - {4219814A-37CB-4D45-B780-2BB19D5E9F75} URL = http://search.rr.com...con=iesearchbox
C:\Users\Randy\jagex_cl_runescape_LIVE.dat
C:\Users\Randy\random.dat
Task: {1AD63CAB-0C2E-49FC-9374-3DA601EE8A06} - System32\Tasks\{FDAC7655-42CA-437F-839A-BF3CB55AE225} => Chrome.exe
Task: {8E843174-04C3-4E94-9DCE-BA7906A56023} - System32\Tasks\{E831ED58-5160-4B8C-A1AF-1BBF5C03ADF8} => Chrome.exe
Task: {CDDED647-1356-47A6-B413-E1533C17D979} - System32\Tasks\{03F1D329-489F-47BB-AA59-5D4F038EE954} => Chrome.exe
Task: {EF7B31E2-3DD1-4DF2-A284-0A7115392D27} - System32\Tasks\{F26F192C-25FF-4955-B6E7-108861516E94} => Chrome.exe
2014-10-26 13:22 - 2014-10-30 20:47 - 00718152 ____C () C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\libglesv2.dll
2014-10-26 13:22 - 2014-10-30 20:47 - 00126280 ____C () C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\libegl.dll
2014-10-26 13:22 - 2014-10-30 20:47 - 08537928 ____C () C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\pdf.dll
2014-10-26 13:22 - 2014-10-30 20:47 - 00353096 ____C () C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\ppGoogleNaClPluginChrome.dll
2014-10-26 13:22 - 2014-10-30 20:47 - 01732936 ____C () C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\ffmpegsumo.dll
2014-10-26 13:22 - 2014-10-30 20:47 - 14669128 ____C () C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\PepperFlash\pepflashplayer.dll
C:\Users\Randy\AppData\LocalLow\Conduit
C:\Program Files (x86)\Road_Runner
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\18176224.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\34958083.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AMP => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AMPSE => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vseamps => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vsedsps => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vseqrts => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\18176224.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\34958083.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AMP => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AMPSE => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vseamps => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vsedsps => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vseqrts => ""="Service"
CloseProcesses:
EmptyTemp:
CMD: bitsadmin /reset /allusers
*****************

HKU\S-1-5-21-4283896459-4070683001-661046522-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Mfmbxori => value deleted successfully.
"HKU\S-1-5-21-4283896459-4070683001-661046522-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f1bf5d49-9653-11e3-beda-001aa094bc0c}" => Key deleted successfully.
"HKCR\CLSID\{f1bf5d49-9653-11e3-beda-001aa094bc0c}" => Key not found.
"HKU\S-1-5-21-4283896459-4070683001-661046522-1000\Software\Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}" => Key deleted successfully.
HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.
HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache => value deleted successfully.
HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache_TIMESTAMP => value deleted successfully.
HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache AcceptLangs => value deleted successfully.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\URLSearchHooks\\{e4878b45-e2c0-4307-b6e8-734922f92f5b} => Value not found.
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\\{e4878b45-e2c0-4307-b6e8-734922f92f5b} => value deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
"HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{4219814A-37CB-4D45-B780-2BB19D5E9F75}" => Key deleted successfully.
"HKCR\CLSID\{4219814A-37CB-4D45-B780-2BB19D5E9F75}" => Key not found.
C:\Users\Randy\jagex_cl_runescape_LIVE.dat => Moved successfully.
C:\Users\Randy\random.dat => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{1AD63CAB-0C2E-49FC-9374-3DA601EE8A06}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1AD63CAB-0C2E-49FC-9374-3DA601EE8A06}" => Key deleted successfully.
C:\Windows\System32\Tasks\{FDAC7655-42CA-437F-839A-BF3CB55AE225} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{FDAC7655-42CA-437F-839A-BF3CB55AE225}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8E843174-04C3-4E94-9DCE-BA7906A56023}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8E843174-04C3-4E94-9DCE-BA7906A56023}" => Key deleted successfully.
C:\Windows\System32\Tasks\{E831ED58-5160-4B8C-A1AF-1BBF5C03ADF8} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{E831ED58-5160-4B8C-A1AF-1BBF5C03ADF8}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CDDED647-1356-47A6-B413-E1533C17D979}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CDDED647-1356-47A6-B413-E1533C17D979}" => Key deleted successfully.
C:\Windows\System32\Tasks\{03F1D329-489F-47BB-AA59-5D4F038EE954} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{03F1D329-489F-47BB-AA59-5D4F038EE954}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{EF7B31E2-3DD1-4DF2-A284-0A7115392D27}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{EF7B31E2-3DD1-4DF2-A284-0A7115392D27}" => Key deleted successfully.
C:\Windows\System32\Tasks\{F26F192C-25FF-4955-B6E7-108861516E94} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{F26F192C-25FF-4955-B6E7-108861516E94}" => Key deleted successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\libglesv2.dll => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\libegl.dll => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\pdf.dll => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\ppGoogleNaClPluginChrome.dll => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\ffmpegsumo.dll => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\PepperFlash\pepflashplayer.dll => Moved successfully.

"C:\Users\Randy\AppData\LocalLow\Conduit" directory move:

C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Hpslehi => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\joejmukuv => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Mvrzbdhv => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Tnrdydqznwxb => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Ydmlgywyhwop => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Qbjlpof\gneecnlhz.js => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Qbjlpof\manifest.json => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\kvesfmoi\manifest.json => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\kvesfmoi\Prjxlkjjl.js => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\debug.log => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\rundll32.exe => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\VisualElementsManifest.xml => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\zmeiwjb.exe => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\Dictionaries\en-US-3-0.bdic => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\36.0.1985.143.manifest => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\chrome.dll => Moved successfully.
Could not move "C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\chrome_100_percent.pak" => Scheduled to move on reboot.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\chrome_200_percent.pak => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\chrome_child.dll => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\chrome_elf.dll => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\d3dcompiler_43.dll => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\d3dcompiler_46.dll => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\delegate_execute.exe => Moved successfully.
Could not move "C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\icudtl.dat" => Scheduled to move on reboot.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\libexif.dll => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\libpeerconnection.dll => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\metro_driver.dll => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\mksnapshot.ia32.exe.assert.manifest => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\nacl64.exe => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\nacl_irt_x86_32.nexe => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\nacl_irt_x86_64.nexe => Moved successfully.
Could not move "C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\resources.pak" => Scheduled to move on reboot.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\secondarytile.png => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\widevinecdmadapter.dll => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\xinput1_3.dll => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\VisualElements\logo.png => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\VisualElements\smalllogo.png => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\VisualElements\splash-620x300.png => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\PepperFlash\manifest.json => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\Locales\en-GB.pak => Moved successfully.
Could not move "C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\Locales\en-US.pak" => Scheduled to move on reboot.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\Extensions\external_extensions.json => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\default_apps\docs.crx => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\default_apps\drive.crx => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\default_apps\external_extensions.json => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\default_apps\gmail.crx => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\default_apps\search.crx => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\default_apps\youtube.crx => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\LanguagePacks\en.xml => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\Feeds\http___alerts_conduit-services_com_root_586406_582268_US.xml => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\Dialogs\DialogsAPI.js => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\Dialogs\PIE.htc => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\Dialogs\settings.js => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\Dialogs\version.txt => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\AppNotification.js => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\initialNotification.html => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\main.html => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\NotificationDialogStyle.css => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\sampleNotification.html => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\close.png => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\like.png => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Next.png => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Next_hover.png => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\powered-by.png => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Prev.png => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Prev_hover.png => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\settings.png => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Thumbs.db => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\light\close.png => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\light\Next.png => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\light\Next_hover.png => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\light\powered-by.png => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\light\Prev.png => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\light\Prev_hover.png => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\light\settings.png => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\light\Thumbs.db => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\dark\close.png => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\dark\Next.png => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\dark\Next_hover.png => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\dark\powered-by.png => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\dark\Prev.png => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\dark\Prev_hover.png => Moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\dark\settings.png => Moved successfully.
Could not move "C:\Users\Randy\AppData\LocalLow\Conduit" directory. => Scheduled to move on reboot.

"C:\Program Files (x86)\Road_Runner" => File/Directory not found.
"HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\18176224.sys" => Key deleted successfully.
"HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\34958083.sys" => Key deleted successfully.
"HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\AMP" => Key deleted successfully.
"HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\AMPSE" => Key deleted successfully.
"HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\vseamps" => Key deleted successfully.
"HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\vsedsps" => Key deleted successfully.
"HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\vseqrts" => Key deleted successfully.
"HKLM\System\CurrentControlSet\Control\SafeBoot\Network\18176224.sys" => Key deleted successfully.
"HKLM\System\CurrentControlSet\Control\SafeBoot\Network\34958083.sys" => Key deleted successfully.
"HKLM\System\CurrentControlSet\Control\SafeBoot\Network\AMP" => Key deleted successfully.
"HKLM\System\CurrentControlSet\Control\SafeBoot\Network\AMPSE" => Key deleted successfully.
"HKLM\System\CurrentControlSet\Control\SafeBoot\Network\vseamps" => Key deleted successfully.
"HKLM\System\CurrentControlSet\Control\SafeBoot\Network\vsedsps" => Key deleted successfully.
"HKLM\System\CurrentControlSet\Control\SafeBoot\Network\vseqrts" => Key deleted successfully.
Processes closed successfully.

=========  bitsadmin /reset /allusers =========

BITSADMIN version 3.0 [ 7.5.7601 ]
BITS administration utility.
© Copyright 2000-2006 Microsoft Corp.

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

{C453D4DD-5F33-4D49-AD2A-9DA32D8384BB} canceled.
{A79C08D0-9E0F-4097-B10D-49C57E7AD4C0} canceled.
{0D8EABC3-AA9F-4F0A-AA84-6D1290755CEE} canceled.
{055C5CB8-71DC-4E93-BCAE-0BA6EAEDA988} canceled.
{FCFFB036-0B03-44F4-A08E-258DE5A38D37} canceled.
{647BD6EF-C67C-4427-9D09-29262D115DF2} canceled.
{EA67BC5E-5DB4-4478-BBD7-0E43E979B973} canceled.
{7F4A592A-CCB5-40A9-935C-4E513BA7D8FB} canceled.
{19EF4648-2400-47CC-A9CF-F86467ED8E70} canceled.
{DD5BB59C-4804-4E8C-B398-DAAB161BD2F5} canceled.
{5CF6201B-E6FE-4120-9F6F-940FEE85FE24} canceled.
{442566E5-C625-47AA-AAF6-196447A91B3A} canceled.
{B1999BEC-7EDB-4DDA-8AE9-15DCF3E42FD7} canceled.
{86FDB341-D5BF-4ED0-893C-1849D9A26CA7} canceled.
{3DF4C288-5319-4FC2-8694-96442C6DD237} canceled.
{9492E20A-856A-46C9-BD2A-6301F0C7544D} canceled.
{D663CB30-F6D5-486E-9599-77FC35F2FD0A} canceled.
{30CE46AF-4A69-4593-AF3A-A8A4280239E0} canceled.
{68E91D0F-C230-495A-BFED-22D7E5A6A54F} canceled.
{21BA3A72-0D3D-44DE-AEC9-DA6DD4C56885} canceled.
{A9556FC6-E37E-4D47-96C8-CD2D471223DF} canceled.
{F42F4362-9597-4CFA-90CA-DDD4612ACA1C} canceled.
{E4708753-E6F8-484E-85EB-627493C450FC} canceled.
{8696E675-FD1E-42AD-AC3F-09C2E8994E04} canceled.
{5973CCA0-AB07-491E-9EF4-007F126D4D6E} canceled.
{3C9FE522-C8FD-45D7-B700-121DA54FD7F4} canceled.
{59E09E3F-A43A-48E5-9036-10BCBB1E6B9C} canceled.
{F9210BA3-CDA2-4690-80D5-248661A35B0B} canceled.
{DA92D75D-38DB-41C2-B1AE-8EBA96BD1B37} canceled.
{30375E5D-6EB9-4F03-9FC2-D881E4872C15} canceled.
{0DBD3018-956B-4E6A-830E-2490097B6D0E} canceled.
{A6B14696-DE16-47A2-8869-F85E995193CB} canceled.
{E38584C6-D959-45C3-9E60-BC9EE49F42A5} canceled.
{E4E380BA-55D4-4EA8-93CC-034B65C501AC} canceled.
{46857BA9-AD4B-4A3A-AE5A-560601E88079} canceled.
{CB08B46A-63D5-444A-ADBA-4EC7DABA7171} canceled.
{77BAE36D-3A40-4F19-A36B-8BFC0E6E31F1} canceled.
{3FA04B1A-2CC4-49F1-8780-DF2CEC332FFC} canceled.
{D524B005-829A-4F7F-BFB4-8E053FA9753A} canceled.
{5C2F8463-166C-4A5A-8AB7-38AFEBFCEA26} canceled.
{756977F6-A6A3-43D7-84D3-0409FD0122D4} canceled.
{878950F2-1BF2-41D9-B808-BA32CA609B11} canceled.
{1945F02A-8652-4C92-BD8A-108C1DE42FEE} canceled.
{F2F3D6ED-F056-48BD-A822-C6DF2016C7F4} canceled.
{A7CBCE8F-AFE2-4153-BA05-C7509488B4EF} canceled.
{7CA3102E-40F3-4AEF-8C9C-3321DCC0E4ED} canceled.
{A7B17ADA-2096-46D2-A10D-BF78961CA320} canceled.
{539F4ED2-39D4-4017-975D-BF1E5A5F2EC4} canceled.
{3E661C0D-242A-46AD-AFA8-7EE327F00169} canceled.
{32E507AB-2C45-4F94-8C49-1E40376E31BB} canceled.
{9BD48C32-51BA-4B1D-B43C-A1FA0F248EA8} canceled.
{2E3034B6-70FC-4D0C-B750-D03B0015137D} canceled.
{150BBAB9-4765-4B9E-9512-76285D36B379} canceled.
{294CC283-21FD-4A11-839D-2FBC5F76525F} canceled.
{DA17C254-CB96-4621-B735-7B01F734DAEF} canceled.
{2A6A231E-88B3-483F-A51F-7E73AE0567FD} canceled.
{D19F71EB-F404-4FB0-B5F7-E88FF1E32200} canceled.
{BC6F9A89-DA56-46B9-BC07-5A6129A1EF51} canceled.
{AB4E3075-6E71-4E8A-A3AC-7793B569D2E9} canceled.
{D44E450C-2534-4101-B6E7-921069EBD7CD} canceled.
60 out of 60 jobs canceled.

========= End of CMD: =========

EmptyTemp: => Removed 644.8 MB temporary data.

=> Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2014-11-01 22:38:51)<=

C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\chrome_100_percent.pak => Is moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\icudtl.dat => Is moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\resources.pak => Is moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit\rrzdgaudy\Gwbyfkl\36.0.1985.143\Locales\en-US.pak => Is moved successfully.
C:\Users\Randy\AppData\LocalLow\Conduit => Is moved successfully.

==== End of Fixlog ====

 

 

# AdwCleaner v3.311 - Report created 01/11/2014 at 22:46:27
# Updated 30/09/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Randy - OFFICE
# Running from : C:\Users\Randy\Desktop\AdwCleaner.exe
# Option : Scan

***** [ Services ] *****

***** [ Files / Folders ] *****

File Found : C:\END
Folder Found : C:\Program Files (x86)\Conduit
Folder Found : C:\Users\Randy\AppData\Local\Conduit

***** [ Scheduled Tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Found : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Found : HKCU\Software\AppDataLow\Software\SmartBar
Key Found : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2187784
Key Found : HKLM\SOFTWARE\Conduit
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17344

*************************

AdwCleaner[R0].txt - [1087 octets] - [01/11/2014 22:46:27]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [1147 octets] ##########

[Nevan]

Hello, badgerduck.

Everything went well in our previous steps, so we can move forward.

Step #1
Junkware Removal Tool

• Download Junkware Removal Tool to your Desktop
• Close any open windows
• Disable your Antivirus program
• Double click JRT.exe on your desktop to run it
  

  

• Click any button to start the scan
• Wait for Junkware Removal Tool to finish the scan
• When the scan is finished, JRT.txt will be saved to your desktop and it will automatically open
• Select all (CTRL+A) the content of the log, copy it (CTRL+C) and paste (CTRL+V) it into your next reply.

 
Step #2
AdwCleaner

• Close any open windows
• Double click AdwCleaner.exe on your desktop to run it
  

  

• Click the button
• Wait for AdwCleaner to finish the scan
• When the scan is finished, there will be "Pending. Please uncheck elements you don't want to remove" message. Leave everything as it is and click button.
• When the cleaning is finished, the program will ask you to reboot the system. Please do so.
• Once your machine has rebooted, a Notepad window will be opened. If it won't, you can find it in C:\AdwCleaner. The report will be saved as AdwCleaner[S0].txt.
• Select all (CTRL+A) the content of the log, copy it (CTRL+C) and paste (CTRL+V) it into your next reply.

Remember to enable your Antivirus program once you're done!

 
Step #3
FRST Scan

• Right click FRST64.exe on your Desktop and click Run as administrator. When the tool opens click Yes to disclaimer.
• Make sure that Addition.txt is checked and press the Scan button.
• It will produce two logs - one called FRST.txt and another one called Addition.txt in the same directory the tool is run from.
• Select all (CTRL+A) the content of the logs, copy them (CTRL+C) and paste (CTRL+V) them into your next reply.

 
Things that should appear in your next post:

• JRT.txt log content
• AdwCleaner[S0].txt log content
• FRST.txt log content
• Addition.txt log content
• Please tell me how your computer is behaving now. Any problems?

[badgerduck]

Nevan,

 

Steps 1-3 completed.  Here are the reports.

 

JRT.ttxt log:

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.3.5 (10.31.2014:1)
OS: Windows 7 Home Premium x64
Ran by Randy on Sun 11/02/2014 at 12:54:54.21
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

~~~ Services

 

~~~ Registry Values

 

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Toolbar.CT2187784
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Toolbar.CT2187784
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\conduitinstaller_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\conduitinstaller_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\conduitinstaller_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\conduitinstaller_RASMANCS

 

~~~ Files

 

~~~ Folders

Successfully deleted: [Folder] "C:\Users\Randy\appdata\local\conduit"
Successfully deleted: [Folder] "C:\Program Files (x86)\conduit"

 

~~~ Event Viewer Logs were cleared

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sun 11/02/2014 at 12:57:12.62
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

AdwCleaner[S0].txt:

 

# AdwCleaner v3.311 - Report created 02/11/2014 at 12:58:57
# Updated 30/09/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Randy - OFFICE
# Running from : C:\Users\Randy\Desktop\AdwCleaner.exe
# Option : Scan

***** [ Services ] *****

***** [ Files / Folders ] *****

File Found : C:\END

***** [ Scheduled Tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Found : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Found : HKCU\Software\AppDataLow\Software\SmartBar
Key Found : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Found : HKLM\SOFTWARE\Conduit

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17344

*************************

AdwCleaner[R0].txt - [1227 octets] - [01/11/2014 21:46:27]
AdwCleaner[R1].txt - [852 octets] - [02/11/2014 12:58:57]

########## EOF - C:\AdwCleaner\AdwCleaner[R1].txt - [911 octets] ##########

 

FRST.txt log:

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-11-2014
Ran by Randy (administrator) on OFFICE on 02-11-2014 13:02:40
Running from C:\Users\Randy\Desktop
Loaded Profile: Randy (Available profiles: Randy)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Seagate Technology LLC) J:\SEAGATE\Sync\FreeAgentService.exe
(iolo technologies, LLC) C:\Program Files (x86)\iolo\Common\Lib\ioloServiceManager.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(iolo technologies, LLC) C:\Program Files (x86)\iolo\System Mechanic Professional\LiveBoost.exe
(iolo technologies, LLC) C:\Program Files (x86)\iolo\System Mechanic Professional\ioloGovernor64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
() C:\Windows\System32\spool\drivers\x64\3\WrtMon.exe
() C:\Windows\System32\spool\drivers\x64\3\WrtProc.exe
(Cisco Consumer Products LLC) C:\Program Files\CiscoVUSB\CiscoVUSB.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Seagate LLC) J:\SEAGATE\FreeAgent Status\stxmenumgr.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
HKLM\...\Run: [WrtMon.exe] => C:\Windows\system32\spool\drivers\x64\3\WrtMon.exe [20480 2006-09-20] ()
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-05-27] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [MaxMenuMgr] => J:\SEAGATE\FreeAgent Status\StxMenuMgr.exe [185640 2009-09-25] (Seagate LLC)
Startup: C:\Users\Randy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Cisco VUSB.lnk
ShortcutTarget: Cisco VUSB.lnk -> C:\Program Files\CiscoVUSB\CiscoVUSB.exe (Cisco Consumer Products LLC)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset...lineScanner.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF Plugin: @java.com/DTPlugin,version=10.21.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

Chrome:
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 FreeAgentGoNext Service; J:\SEAGATE\Sync\FreeAgentService.exe [189736 2009-09-25] (Seagate Technology LLC)
R2 ioloSystemService; C:\Program Files (x86)\iolo\Common\Lib\ioloServiceManager.exe [4700872 2014-08-12] (iolo technologies, LLC)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 ElRawDisk; C:\Windows\system32\drivers\ElRawDsk.sys [30752 2013-12-03] (EldoS Corporation)
S3 HtcVCom32; C:\Windows\System32\DRIVERS\HtcVComV64.sys [121800 2010-03-08] (QUALCOMM Incorporated)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
R1 RawDisk3; C:\Windows\system32\drivers\rawdsk3.sys [32912 2014-08-12] (EldoS Corporation)
R3 sxuptp; C:\Windows\System32\DRIVERS\sxuptp.sys [304480 2013-03-31] (silex technology, Inc.)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-02 13:01 - 2014-11-02 13:01 - 00000990 ____C () C:\Users\Randy\Desktop\AdwCleaner[R1].txt
2014-11-02 12:57 - 2014-11-02 12:57 - 00001403 ____C () C:\Users\Randy\Desktop\JRT.txt
2014-11-02 12:54 - 2014-11-02 12:54 - 00000000 ___DC () C:\Windows\ERUNT
2014-11-02 12:53 - 2014-11-02 12:53 - 01706359 ____C (Thisisu) C:\Users\Randy\Desktop\JRT.exe
2014-11-01 21:46 - 2014-11-02 12:59 - 00000000 ___DC () C:\AdwCleaner
2014-11-01 21:42 - 2014-11-01 21:42 - 01375089 ____C () C:\Users\Randy\Desktop\AdwCleaner.exe
2014-11-01 21:35 - 2014-11-02 13:02 - 00000000 ___DC () C:\Users\Randy\Desktop\FRST-OlderVersion
2014-10-31 20:34 - 2014-10-31 20:35 - 00025929 ____C () C:\Users\Randy\Desktop\Addition.txt
2014-10-31 20:33 - 2014-11-02 13:03 - 00006711 ____C () C:\Users\Randy\Desktop\FRST.txt
2014-10-31 20:32 - 2014-11-02 13:02 - 00000000 ___DC () C:\FRST
2014-10-31 20:30 - 2014-11-02 13:02 - 02114560 ____C (Farbar) C:\Users\Randy\Desktop\FRST64.exe
2014-10-31 15:20 - 2014-10-31 15:20 - 00074466 ____C () C:\Users\Randy\Desktop\Extras.Txt
2014-10-31 15:18 - 2014-10-31 15:18 - 00049350 ____C () C:\Users\Randy\Desktop\OTL.Txt
2014-10-31 15:10 - 2014-10-31 15:10 - 00602112 ____C (OldTimer Tools) C:\Users\Randy\Desktop\OTL.exe
2014-10-31 14:29 - 2014-10-31 14:29 - 00001481 ____C () C:\Users\Randy\Desktop\LiveBoost.lnk
2014-10-31 14:29 - 2014-08-12 22:41 - 02155152 ____C (iolo technologies, LLC) C:\Windows\system32\Incinerator64.dll
2014-10-31 14:27 - 2014-08-12 22:38 - 00032912 ____C (EldoS Corporation) C:\Windows\system32\Drivers\rawdsk3.sys
2014-10-31 10:08 - 2014-10-31 10:08 - 00011762 ____C () C:\Users\Randy\Documents\Copy of T shirt order form.xlsx
2014-10-29 15:40 - 2014-10-30 13:33 - 00000000 ___DC () C:\Users\Randy\AppData\Local\Deployment
2014-10-27 14:21 - 2014-11-02 12:41 - 00001680 ____C () C:\Windows\setupact.log
2014-10-27 14:21 - 2014-10-27 14:21 - 00000000 ____C () C:\Windows\setuperr.log
2014-10-16 07:20 - 2014-10-16 10:32 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-16 07:20 - 2014-10-16 10:32 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-16 07:20 - 2014-10-16 10:32 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
2014-10-16 07:20 - 2014-10-16 10:32 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
2014-10-16 07:20 - 2014-10-16 10:32 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-16 07:20 - 2014-10-16 10:32 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
2014-10-16 07:20 - 2014-10-16 10:32 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-16 07:20 - 2014-10-16 10:31 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-10-16 07:20 - 2014-10-16 10:31 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-10-16 07:20 - 2014-10-16 10:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-10-16 07:20 - 2014-10-16 10:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-10-16 07:20 - 2014-10-16 10:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-10-16 07:20 - 2014-10-16 10:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-10-16 07:20 - 2014-10-16 10:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-10-16 07:20 - 2014-10-16 10:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-10-16 07:20 - 2014-10-16 10:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-10-16 07:20 - 2014-10-16 10:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-10-16 07:20 - 2014-10-16 10:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-10-16 07:20 - 2014-10-16 10:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-10-16 07:19 - 2014-10-16 10:30 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-10-16 07:19 - 2014-10-16 10:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-16 07:19 - 2014-10-16 10:30 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-16 07:19 - 2014-10-16 10:30 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-10-16 07:19 - 2014-10-16 10:30 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-10-16 07:19 - 2014-10-16 10:30 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-16 07:19 - 2014-10-16 10:30 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00507392 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00378552 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00331448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00276480 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-10-16 07:19 - 2014-10-16 10:30 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-10-16 07:19 - 2014-10-16 10:30 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-10-16 07:19 - 2014-10-16 10:30 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-10-16 07:19 - 2014-10-16 10:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-10-16 07:17 - 2014-10-16 10:29 - 03722240 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-16 07:17 - 2014-10-16 10:29 - 03241472 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-16 07:17 - 2014-10-16 10:29 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-10-16 07:17 - 2014-10-16 10:29 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-10-16 07:17 - 2014-10-16 10:29 - 01118720 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-10-16 07:17 - 2014-10-16 10:29 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-10-16 07:17 - 2014-10-16 10:29 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-16 07:17 - 2014-10-16 10:29 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-10-16 07:17 - 2014-10-16 10:29 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-16 07:17 - 2014-10-16 10:29 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-10-16 07:17 - 2014-10-16 10:29 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-16 07:17 - 2014-10-16 10:29 - 00212480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-10-16 07:17 - 2014-10-16 10:29 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll
2014-10-16 07:17 - 2014-10-16 10:29 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-10-16 07:17 - 2014-10-16 10:29 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2014-10-16 07:17 - 2014-10-16 10:29 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-10-16 07:17 - 2014-10-16 10:29 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-10-16 07:17 - 2014-10-16 10:29 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-10-16 07:17 - 2014-10-16 10:29 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-10-16 07:17 - 2014-10-16 10:29 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-10-16 07:17 - 2014-10-16 10:28 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-16 07:17 - 2014-10-16 10:28 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-10-15 21:54 - 2014-10-15 22:03 - 165261807 ____C () C:\Users\Randy\Downloads\October 13, 2014.mp4
2014-10-15 20:21 - 2014-10-15 20:21 - 00000000 ___DC () C:\Users\Randy\Tracing
2014-10-15 20:20 - 2014-10-15 20:20 - 00001305 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk
2014-10-15 20:20 - 2014-10-15 20:20 - 00000000 ___DC () C:\Windows\en
2014-10-15 20:19 - 2014-10-15 20:20 - 00000000 __RDC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
2014-10-15 20:19 - 2014-10-15 20:19 - 00002486 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
2014-10-15 20:19 - 2014-10-15 20:19 - 00001458 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
2014-10-15 20:19 - 2014-03-31 20:06 - 00058056 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\fssfltr.sys
2014-10-15 20:18 - 2014-10-15 20:18 - 00000000 ___DC () C:\Program Files\Windows Live
2014-10-15 20:16 - 2014-10-15 20:16 - 00000000 ___DC () C:\ProgramData\Microsoft OneDrive
2014-10-15 20:14 - 2014-10-15 20:21 - 01239752 ____C (Microsoft Corporation) C:\Users\Randy\Downloads\wlsetup-web.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-02 12:49 - 2009-07-13 22:45 - 00022768 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-02 12:49 - 2009-07-13 22:45 - 00022768 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-02 12:46 - 2009-07-13 23:13 - 00786578 ____C () C:\Windows\system32\PerfStringBackup.INI
2014-11-02 12:44 - 2012-09-13 11:04 - 01341749 ____C () C:\Windows\WindowsUpdate.log
2014-11-02 12:41 - 2009-07-13 23:08 - 00000006 ___HC () C:\Windows\Tasks\SA.DAT
2014-11-02 12:11 - 2012-09-13 17:59 - 00000830 ____C () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-01 21:37 - 2012-09-13 17:55 - 00735998 ____C () C:\Windows\PFRO.log
2014-11-01 21:36 - 2012-09-13 11:05 - 00000000 ___DC () C:\Users\Randy
2014-10-31 14:30 - 2012-09-13 19:18 - 00000000 ___DC () C:\ProgramData\iolo
2014-10-31 14:29 - 2014-02-25 11:22 - 00001477 ____C () C:\Users\Randy\Desktop\System Mechanic Professional.lnk
2014-10-31 14:29 - 2014-02-25 11:22 - 00000000 ___DC () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Mechanic Professional
2014-10-31 14:28 - 2014-02-25 11:18 - 00000000 ___DC () C:\Users\Randy\AppData\Roaming\iolo
2014-10-31 14:28 - 2013-12-13 13:22 - 00003144 ____C () C:\Windows\System32\Tasks\iolo Process Governor
2014-10-31 14:28 - 2013-12-13 13:22 - 00000000 ___DC () C:\ProgramData\ioloGovernor
2014-10-30 14:01 - 2012-09-13 18:00 - 00000000 ___DC () C:\Users\Randy\AppData\Local\Google
2014-10-30 14:01 - 2012-09-13 17:59 - 00000000 ___DC () C:\Program Files (x86)\Google
2014-10-30 05:25 - 2012-09-13 11:30 - 00275080 ____C (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-10-29 15:40 - 2013-02-21 15:50 - 00000000 ___DC () C:\Users\Randy\AppData\Local\Apps\2.0
2014-10-28 08:42 - 2012-09-30 20:13 - 00000000 ___DC () C:\Users\Randy\.epaysol
2014-10-27 08:28 - 2009-07-13 21:20 - 00000000 ___DC () C:\Windows\Resources
2014-10-26 22:43 - 2009-07-13 21:20 - 00000000 ___DC () C:\Windows\system32\NDF
2014-10-17 13:38 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\rescache
2014-10-16 11:51 - 2009-07-13 22:45 - 00418288 ____C () C:\Windows\system32\FNTCACHE.DAT
2014-10-16 11:48 - 2014-05-06 08:40 - 00000000 __SDC () C:\Windows\system32\CompatTel
2014-10-16 10:33 - 2012-09-13 12:14 - 00000000 ___DC () C:\ProgramData\Microsoft Help
2014-10-16 10:28 - 2013-08-14 10:32 - 00000000 ___DC () C:\Windows\system32\MRT
2014-10-16 10:15 - 2012-09-13 22:11 - 103265616 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-15 20:21 - 2013-02-21 14:38 - 00000000 ___DC () C:\Users\Randy\AppData\Local\Windows Live
2014-10-15 20:20 - 2013-02-21 14:43 - 00001374 ____C () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk
2014-10-15 20:19 - 2013-02-21 14:42 - 00000000 ___DC () C:\Program Files (x86)\Windows Live
2014-10-04 15:57 - 2013-04-08 09:22 - 00000000 ___DC () C:\Windows\Minidump

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-10-26 11:00

==================== End Of Log ============================

 

Addition.txt log:

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-11-2014
Ran by Randy at 2014-11-02 13:03:24
Running from C:\Users\Randy\Desktop
Boot Mode: Normal
==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Disabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AS: Microsoft Security Essentials (Disabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)
Adobe Reader X (10.1.12) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.12 - Adobe Systems Incorporated)
ArcSoft PhotoStudio 5.5 (HKLM-x32\...\{85309D89-7BE9-4094-BB17-24999C6118FC}) (Version:  - ArcSoft)
ATI AVIVO64 Codecs (Version: 11.6.0.50527 - ATI Technologies Inc.) Hidden
ATI Catalyst Install Manager (HKLM\...\{EDA9E418-06E0-1FCB-1210-838F1ED5FBE6}) (Version: 3.0.778.0 - ATI Technologies, Inc.)
Canon CanoScan 8800F User Registration (HKLM-x32\...\Canon CanoScan 8800F User Registration) (Version:  - )
Canon MP Navigator EX 1.0 (HKLM-x32\...\MP Navigator EX 1.0) (Version:  - )
Canon Utilities Solution Menu (HKLM-x32\...\CanonSolutionMenu) (Version:  - )
CanoScan 8800F (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ4805) (Version:  - )
Carbonite Online Backup Setup (HKLM-x32\...\Carbonite Setup Lite) (Version: 3.8.0 - Carbonite Inc.)
ccc-core-static (x32 Version: 2010.0527.1242.20909 - ATI) Hidden
Cisco VUSB (HKLM\...\Cisco VUSB) (Version: 1.2.0 - Cisco Consumer Products LLC)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Homeworld (HKLM-x32\...\Homeworld) (Version:  - )
HydraVision (x32 Version: 4.2.166.0 - ATI Technologies Inc.) Hidden
iolo technologies' System Mechanic Professional (HKLM-x32\...\{BBD3F66B-1180-4785-B679-3F91572CD3B4}_is1) (Version: 14.0.1 - iolo technologies, LLC)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217040FF}) (Version: 7.0.670 - Oracle)
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mavis Beacon Teaches Typing Deluxe 20 (HKLM-x32\...\{23B591D7-1C20-44FB-97C2-6953AE67DE18}) (Version: 20.00.0000 - Broderbund)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-0011-0000-0000-0000000FF1CE}_PROPLUSR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM-x32\...\{95140000-007A-0409-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office Professional Plus 2007 (HKLM-x32\...\PROPLUSR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Photo Common (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Presto! PageManager 7.15.16 (HKLM-x32\...\{D2D6B9EB-C6DC-4DAA-B4DE-BB7D9735E7DA}) (Version: 7.15.16 - NewSoft Technology Corporation)
ScanSoft OmniPage SE 4 (HKLM-x32\...\{B2F3DBD9-A9D2-4838-B45D-C917DAB32BC3}) (Version: 15.2.0020 - Nuance Communications, Inc.)
Seagate Manager Installer (HKLM-x32\...\InstallShield_{2A30052B-831C-41D3-8044-3C0388066350}) (Version: 2.01.0600 - Seagate)
Seagate Manager Installer (x32 Version: 2.01.0600 - Seagate) Hidden
System Mechanic 12 Professional (x32 Version: 14.0.1 - ) Hidden
TurboTax 2012 (HKLM-x32\...\TurboTax 2012) (Version: 2012.0 - Intuit, Inc)
TurboTax 2013 (HKLM-x32\...\TurboTax 2013) (Version: 2013.0 - Intuit, Inc)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-0011-0000-0000-0000000FF1CE}_PROPLUSR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

==================== Restore Points  =========================

30-10-2014 17:14:27 iolo Designated Drivers Pre-Update Restore Point (41C74F)
30-10-2014 17:14:42 Windows Update
02-11-2014 03:29:30 before fixes

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 20:34 - 2009-06-10 15:00 - 00000824 ___AC C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {5723FB9E-B34A-4D35-B34F-1CEEEEB22EA3} - System32\Tasks\iolo Process Governor => C:\Program Files (x86)\iolo\System Mechanic Professional\iologovernor64.exe [2014-08-12] (iolo technologies, LLC)
Task: {C0BE6949-B2AC-4F8D-8A7A-78107C02C863} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-24] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2012-09-13 18:24 - 2006-09-20 07:35 - 00020480 ____C () C:\Windows\System32\spool\drivers\x64\3\WrtMon.exe
2012-09-13 18:24 - 2006-10-30 15:59 - 00024576 ____C () C:\Windows\System32\spool\drivers\x64\3\WrtProc.exe
2013-03-07 17:40 - 2013-03-31 17:31 - 00281600 ____C () C:\Program Files\CiscoVUSB\Svlscapi.dll
2010-04-16 13:20 - 2010-04-16 13:20 - 00016384 ___RC () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2010-05-27 11:40 - 2010-05-27 11:40 - 00270336 ____C () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BITS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EventSystem => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ioloSystemService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\BITS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\EventSystem => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ioloSystemService => ""="Service"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: CanonSolutionMenu => C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe /logon
MSCONFIG\startupreg: OpwareSE4 => "C:\Program Files (x86)\ScanSoft\OmniPageSE4\OpwareSE4.exe"
MSCONFIG\startupreg: SSBkgdUpdate => "C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

========================= Accounts: ==========================

Administrator (S-1-5-21-4283896459-4070683001-661046522-500 - Administrator - Disabled)
Guest (S-1-5-21-4283896459-4070683001-661046522-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-4283896459-4070683001-661046522-1002 - Limited - Enabled)
Randy (S-1-5-21-4283896459-4070683001-661046522-1000 - Administrator - Enabled) => C:\Users\Randy

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================
Error: (09/09/2013 01:45:18 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6680.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 48 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (01/24/2013 10:04:49 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 1 seconds with 0 seconds of active time.  This session ended with a crash.

CodeIntegrity Errors:
===================================
  Date: 2013-07-08 09:58:14.197
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-07-08 08:33:46.688
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-07-08 07:25:33.152
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-04-12 17:04:06.531
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-04-12 16:50:52.377
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-04-12 16:37:11.758
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-04-12 16:20:02.810
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-04-12 14:26:50.612
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-04-12 13:45:32.893
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\wininet.dll because the set of per-page image hashes could not be found on the system.

==================== Memory info ===========================

Processor: Intel® Core™2 Duo CPU E6550 @ 2.33GHz
Percentage of memory in use: 29%
Total physical RAM: 4094.18 MB
Available physical RAM: 2872.66 MB
Total Pagefile: 8186.53 MB
Available Pagefile: 6837.97 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:233.88 GB) (Free:193.14 GB) NTFS
Drive j: (New Volume) (Fixed) (Total:231.78 GB) (Free:191.64 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 3A2DFFDB)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=233.9 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=231.8 GB) - (Type=07 NTFS)

==================== End Of Log ============================

 

Awaiting your reply.  Thank you.

[Nevan]

Hello, badgerduck.

You've done the AdwCleaner step wrong. I assume that you clicked Report button, where you had to click Clean button. This resulted in presenting the wrong log and not removing the entries that it found. You'll have to do it again. Now be aware that I want you to give me log named AdwCleaner[S0].txt, and not AdwCleaner[R0].txt

Also, you didn't tell me anything about the current status of your computer. Please, do so.

Step #1
AdwCleaner

• Close any open windows
• Double click AdwCleaner.exe on your desktop to run it
  

  

• Click the button
• Wait for AdwCleaner to finish the scan
• When the scan is finished, there will be "Pending. Please uncheck elements you don't want to remove" message. Leave everything as it is and click button.
• When the cleaning is finished, the program will ask you to reboot the system. Please do so.
• Once your machine has rebooted, a Notepad window will be opened. If it won't, you can find it in C:\AdwCleaner. The report will be saved as AdwCleaner[S0].txt.
• Select all (CTRL+A) the content of the log, copy it (CTRL+C) and paste (CTRL+V) it into your next reply.

 
Step #2
Malwarebytes Anti-Malware

• Download Malwarebytes Anti-Malware to your Desktop
• Double click the file to open it. Install the program.
• Before you click Finish, make sure that:
  • Enable free trial of Malwarebytes Anti-Malware Premium is unchecked
  • Launch Malwarebytes Anti-Malware is checked
  
• In Database version section, click Update Now
• Once the update is done, click Settings>Detection and Protection
• Make sure that all three boxes under Detection Options are checked
  
• Go back to Dashboard and click the big, green Scan Now button.
• Wait for Malwarebytes Anti-Malware to finish the scan
• If the program will detect anything, click the button. The program might want to reboot the system. Allow it it wants to.
• Once the deletion is done (or after reboot), go to History and double click the last Scan Log.
• Click the button.
• Paste (CTRL+V) the log into your next reply.

 
Step #3
ESET Online Scanner

• Note: This step can only be done using Internet Explorer, Google Chrome or Mozilla Firefox

• Disable your Antivirus program (click here if you don't know how to do this).
• Visit ESET site
• Click
• When using:
  • Internet Explorer:
    • Accept the Terms of Use and click Start
    • Allow the running of add-on
  • Other browsers:
    • Download esetsmartinstaller_enu.exe that you'll be given link to
    • Double click esetsmartinstaller_enu.exe
    • Allow the Terms of Use and click Start
• Make sure that:
  • Enable detection of potentially unwanted applications is checked
  • In Advanced Settings: Remove found threats is unchecked. Scan archives, Scan for potentially unsafe applications and Enable Anti-Stealth technology are checked
  
• Click Start
• The program will begin to download it's virus database. The speed may vary depending on your Internet connection.
• When completed, the program will begin to scan. This may take several hours. Please, be patient.
• Do not do anything on your machine as it may interrupt the scan
• When the scan is done, click Finish
• A log.txt file will be created at C:\Program Files\ESET\ESET Online Scanner. Open it using Notepad.
• Select all (CTRL+A) the content of the log, copy it (CTRL+C) and paste (CTRL+V) it into your next reply.

Remember to enable your Antivirus program once you're done!

 
Things that should appear in your next post:

• AdwCleaner[S0].txt log content
• Malwarebytes Anti-Malware log
• ESET Online Scanner log
• Please tell me how your computer is behaving now. Any problems?

[badgerduck]

I apologize.  The computer ran fine after the Roadrunner Google toolbar was removed.  Task Manager showed normal processes running at appropriate memory usage. 

 

# AdwCleaner v3.311 - Report created 03/11/2014 at 09:24:00
# Updated 30/09/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Randy - OFFICE
# Running from : C:\Users\Randy\Desktop\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

File Deleted : C:\END

***** [ Scheduled Tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKLM\SOFTWARE\Conduit

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17344

*************************

AdwCleaner[R0].txt - [1227 octets] - [01/11/2014 21:46:27]
AdwCleaner[R1].txt - [990 octets] - [02/11/2014 12:58:57]
AdwCleaner[R2].txt - [1049 octets] - [03/11/2014 09:23:04]
AdwCleaner[S0].txt - [982 octets] - [03/11/2014 09:24:00]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1041 octets] ##########

 

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 11/3/2014
Scan Time: 9:45:52 AM
Logfile: Malwarebytes log.txt
Administrator: Yes

Version: 2.00.3.1025
Malware Database: v2014.11.03.06
Rootkit Database: v2014.11.01.02
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Randy

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 306722
Time Elapsed: 8 min, 57 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 2
Broken.OpenCommand, HKCR\scrfile\shell\open\command, NOTEPAD.EXE "Good: ("Bad: (NOTEPAD.EXE "%1"),Replaced,[ffffffffffffffffffffffffffffffff]" /S)", %4, %5
Broken.OpenCommand, HKCR\regfile\shell\open\command, NOTEPAD.EXE "Good: (regedit.exe "Bad: (NOTEPAD.EXE "%1"),Replaced,[ffffffffffffffffffffffffffffffff]")", %4, %5

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)

 

 

ESETSmartInstaller@High as CAB hook log:
OnlineScanner64.ocx - registred OK
OnlineScanner.ocx - registred OK
# product=EOS
# version=8
# IEXPLORE.EXE=11.00.9600.16428 (winblue_gdr.131013-1700)
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=0397ec9f58d16640af5ab3352bc36642
# engine=20909
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-11-03 04:52:39
# local_time=2014-11-03 10:52:39 (-0600, Central Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Microsoft Security Essentials'
# compatibility_mode=5895 16777213 100 100 3572420 86215581 0 0
# compatibility_mode_1='System Shield'
# compatibility_mode=7428 16777213 100 95 159796 28026237 0 0
# scanned=132753
# found=1
# cleaned=0
# scan_time=1997
sh=BF06E2F6EDF5ED6F37AB6543964E3BD2277DBD73 ft=1 fh=e8acf6a4944e02b1 vn="Win32/TrojanDownloader.Tracur.AM trojan" ac=I fn="C:\Users\Randy\AppData\Local\Diagnostics\Mfmbxori.dll"
 

[Nevan]

Hello, badgerduck.

Your logs look good so we can now uninstall the ESET scanner and run the last FRST fix to remove what it's found. After that, we'll check your computer for programs that are out of date. Once that is done we'll be ready to clean up out tools and wrap this puppy up. I will also give you some suggestions to keep your computer secure in the future.

Step #1
Uninstall programs

Go to Start Menu>Control Panel>Programs>Uninstall a program (or Control Panel>Programs and Features if using icon view) and remove ESET Online Scanner v3.

 
Step #2
FRST Fix

• Download attached fixlist.txt file to your desktop.
   fixlist.txt   121bytes   158 downloads
  NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
• Right click FRST64.exe on your desktop and click Run as administrator. When the tool opens click Yes to disclaimer.
• Press the Fix button just once and wait.
  NOTE: It's important that both FRST64.exe and fixlist.txt are in the same location or the fix will not work.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished, FRST will generate a log on the desktop (Fixlog.txt). Select all (CTRL+A) the content of the log, copy it (CTRL+C) and paste (CTRL+V) it into your next reply.

 
Step #3
Security Check

Download Security Check from here or here.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE: If SecurityCheck aborts and you get the following message: UNSUPPORTED OPERATING SYSTEM! ABORTED! try rebooting the system and then run SecurityCheck again.

 
Things that should appear in your next post:

• Fixlog.txt log content
• checkup.txt log content

[badgerduck]

Nevan,

 

Here are the two reports.  MS Security Essentials did not pick up the Trojan or the issues that MB bytes identified.  I think I need something more thorough than MS Security Essentials.

 

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-11-2014
Ran by Randy at 2014-11-04 13:06:03 Run:2
Running from C:\Users\Randy\Desktop
Loaded Profile: Randy (Available profiles: Randy)
Boot Mode: Normal
==============================================

 

Content of fixlist:
*****************
C:\Users\Randy\AppData\Local\Diagnostics\Mfmbxori.dll
C:\Program Files (x86)\ESET\ESET Online Scanner
DeleteQuarantine:
*****************

"C:\Users\Randy\AppData\Local\Diagnostics\Mfmbxori.dll" => File/Directory not found.
C:\Program Files (x86)\ESET\ESET Online Scanner => Moved successfully.
"C:\FRST\Quarantine" => Removed successfully.

==== End of Fixlog ====

 

 

 

Results of screen317's Security Check version 0.99.89 
 Windows 7 Service Pack 1 x64 (UAC is enabled) 
 Internet Explorer 11 
``````````````Antivirus/Firewall Check:``````````````
 Windows Firewall Enabled! 
Microsoft Security Essentials  
 Antivirus up to date! 
`````````Anti-malware/Other Utilities Check:`````````
 Java 7 Update 67 
 Adobe Reader 10.1.12 Adobe Reader out of Date! 
````````Process Check: objlist.exe by Laurent```````` 
 Microsoft Security Essentials MSMpEng.exe
 Microsoft Security Essentials msseces.exe
 iolo Common Lib ioloServiceManager.exe
 iolo System Mechanic Professional SystemGuardAlerter.exe 
 iolo System Mechanic Professional iologovernor64.exe 
 iolo System Mechanic Professional LiveBoost.exe 
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 1%
````````````````````End of Log``````````````````````
 

[Nevan]

Hello, badgerduck.

I wouldn't worry about Microsoft Security Essentials. It's one of the best free antivirus programs. People are coming here with different antivirus programs and many of them have exactly the same infections. It's more about being careful when using the Internet.

Your Adobe Reader is out of date. Adobe products have known security flaws that are targeted by malware writers, so we need to update Adobe Reader and you should keep it up to date.
Visit this site to update Adobe Reader.

• Warning!: Make sure to uncheck Optional offer box when downloading Adobe products or you will install an adware on your computer.

Please, tell me if there were any problems with updating Adobe Reader.

Besides that, good news. Your system is now clear and we can clean the tools that we used. I also prepared some tips for you to stay safe in the future.

 
DelFix
Now that your system is clean, we can clear system restore points and malware removal tools that we used. To do that, download and run Delfix.

• Note: Make sure that the following options are checked:
  • Remove disinfection tools
  • Create registry backup
  • Purge system restore
  • Reset System Settings

After the cleaning is done, DelFix.txt will be opened in Notepad. If it won't, you can find it in C:\ directory. Select all (CTRL+A) the content of the log, copy it (CTRL+C) and paste (CTRL+V) it into your next reply.

Also, delete any other .exe .txt, .bat .reg or .zip files that we used and are remaining and empty the Recycle bin.

 
Preventing Re-Infection

As prevention is better than cure, I have listed some tips for you to stay safe on the internet in the future. Make a good use of them.

 
WARNING!: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java.
Read this article.
I would recommend that you completely uninstall Java unless you need it to run an important software.
In that instance I would recommend that you disable Java in your browsers until you need it for that software and then enable it. (See How to diasble Java in your web browser and How to unplug Java from the browser)

If you still want to keep Java

• Click the Start button
• Click Control Panel
• Double Click Java - Looks like a coffee cup. You may have to switch to Classical View on the upper left of the Control Panel to see it.
• Click the Update tab
• Click Update Now
• Allow any updates to be downloaded and installed

• Warning!: Make sure to uncheck Optional offer box when downloading Java or you will install an adware on your computer.

 
Adobe products have to always be updated, because they also are being used to infect your computer.

• If you want to update Adobe Flash Player, visit this site.
• If you want to update Adobe Reader, visit this site.
• Warning!: Make sure to uncheck Optional offer box when downloading Adobe products or you will install an adware on your computer.

 
Turning on Automatic Updates is a crucial security measure. Keeping them out-of-date is like begging to get your system infected.

• Click Start > Control Panel > System and Security > Windows Update
• Under Windows Update click Turn automatic updating on or off
• Make sure that your settings are set so that you will receive updates automatically and click OK.

 
FileHippo is one of programs that can check for out-of-date programs on your computer. You can get it here

 
Recommendations for security programs

• Malwarebytes' Anti-Malware is a new and powerful anti-malware tool. It is totally free but for real-time protection you will have to pay a small one-time fee.
• WinPatrol as a robust security monitor, will alert you to hijackings, malware attacks and critical changes made to your computer without your permission. WinPatrol takes a snapshot of your critical system resources and alerts you to any changes that may occur without your knowledge.

 
Cryptolocker prevention
Cryptolocker is a new ransomware that heavily encrypts your important files. At the moment there are no programs that can decrypt these files. You can read how to protect against it here.

 
For some good tips about how to prevent infection in the future, visit this site.

[badgerduck]

Nevan,

 

I have run delfix and report is below.  I have deleted Java, updated Adobe products and purchased Malwarebytes premium.  I ran an additional scan after purchasing MB and a Trojan was detected and removed, (report included).  I'm I still have MS Security Essentials.  Thank you for all your help.  You do a very good job of walking a novice user through the process.  R/Badgerduck

 

# DelFix v10.8 - Logfile created 05/11/2014 at 15:18:06

# Updated 29/07/2014 by Xplode

# Username : Randy - OFFICE

# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

 

~ Removing disinfection tools ...

 

Deleted : C:\FRST

Deleted : C:\TDSSKiller_Quarantine

Deleted : C:\AdwCleaner

Deleted : C:\Users\Randy\Desktop\FRST-OlderVersion

Deleted : C:\TDSSKiller.2.8.16.0_08.07.2013_10.02.29_log.txt

Deleted : C:\TDSSKiller.2.8.16.0_08.07.2013_10.08.25_log.txt

Deleted : C:\TDSSKiller.2.8.16.0_12.04.2013_17.13.20_log.txt

Deleted : C:\TDSSKiller.2.8.16.0_12.04.2013_17.16.30_log.txt

Deleted : C:\TDSSKiller.2.8.18.0_08.07.2013_10.04.08_log.txt

Deleted : C:\TDSSKiller.2.8.18.0_08.07.2013_10.07.42_log.txt

Deleted : C:\Users\Randy\Desktop\Addition.txt

Deleted : C:\Users\Randy\Desktop\AdwCleaner.exe

Deleted : C:\Users\Randy\Desktop\AdwCleaner[R1].txt

Deleted : C:\Users\Randy\Desktop\AdwCleaner[S0].txt

Deleted : C:\Users\Randy\Desktop\Extras.Txt

Deleted : C:\Users\Randy\Desktop\Fixlog.txt

Deleted : C:\Users\Randy\Desktop\FRST.txt

Deleted : C:\Users\Randy\Desktop\FRST64.exe

Deleted : C:\Users\Randy\Desktop\JRT.exe

Deleted : C:\Users\Randy\Desktop\JRT.txt

Deleted : C:\Users\Randy\Desktop\OTL.Txt

Deleted : C:\Users\Randy\Desktop\OTL.exe

Deleted : C:\Users\Randy\Desktop\SecurityCheck.exe

Deleted : C:\Users\Randy\Downloads\tdsskiller.exe

Deleted : C:\Users\Randy\Downloads\tdsskiller.zip

Deleted : HKLM\SOFTWARE\OldTimer Tools

Deleted : HKLM\SOFTWARE\AdwCleaner

 

~ Creating registry backup ... OK

 

~ Cleaning system restore ...

 

Deleted : RP #351 [Windows Update | 11/03/2014 00:33:45]

 

New restore point created !

 

~ Resetting system settings ... OK

 

 

 

Malwarebytes Anti-Malware
www.malwarebytes.org

Update, 11/6/2014 9:42:41 AM, SYSTEM, OFFICE, Manual, Rootkit Database, 2014.9.18.1, 2014.11.1.2,
Update, 11/6/2014 9:43:06 AM, SYSTEM, OFFICE, Manual, Malware Database, 2014.9.19.5, 2014.11.6.5,
Protection, 11/6/2014 9:43:50 AM, SYSTEM, OFFICE, Protection, Malware Protection, Starting,
Protection, 11/6/2014 9:43:50 AM, SYSTEM, OFFICE, Protection, Malware Protection, Started,
Protection, 11/6/2014 9:43:50 AM, SYSTEM, OFFICE, Protection, Malicious Website Protection, Starting,
Protection, 11/6/2014 9:43:51 AM, SYSTEM, OFFICE, Protection, Malicious Website Protection, Started,
Detection, 11/6/2014 9:52:34 AM, Randy, OFFICE, Protection, Malware Protection, File, Trojan.JobLaunch.ODB, C:\Windows\System32\zhnzron.dll, Quarantine, [fb92da5e3a42eb4b0bc827b7758cad53]
Scan, 11/6/2014 9:53:48 AM, SYSTEM, OFFICE, Manual, Start:11/6/2014 9:44:18 AM, Duration:9 min 5 sec, Threat Scan, Completed, 1 Malware Detection, 0 Non-Malware Detections,
Protection, 11/6/2014 9:55:35 AM, SYSTEM, OFFICE, Protection, Malware Protection, Starting,
Protection, 11/6/2014 9:55:35 AM, SYSTEM, OFFICE, Protection, Malware Protection, Started,
Protection, 11/6/2014 9:55:35 AM, SYSTEM, OFFICE, Protection, Malicious Website Protection, Starting,
Protection, 11/6/2014 9:55:36 AM, SYSTEM, OFFICE, Protection, Malicious Website Protection, Started,

(end)

[Nevan]

Okay, looks like we're done. Thank you for the logs and your kind words.

 

Stay safe!

[godawgs]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.