[Dazed&Confused]

Addition log:

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-02-2015
Ran by Guitar at 2015-02-16 10:26:56
Running from C:\Users\Guitar\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: ZoneAlarm Free Firewall Antivirus (Disabled - Up to date) {23B6D20A-C2DE-B3F5-C67D-07ECD854E6A9}
AS: ZoneAlarm Free Firewall Anti-Spyware (Disabled - Up to date) {98D733EE-E4E4-BC7B-FCCD-3C9EA3D3AC14}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: ZoneAlarm Free Firewall Firewall (Disabled) {1B8D532F-88B1-B2AD-ED22-AED92687A1D2}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
Adobe Acrobat  9 Standard (HKLM-x32\...\{AC76BA86-1033-0000-BA7E-000000000004}{AC76BA86-1033-0000-BA7E-000000000004}) (Version: 9.5.5 - Adobe Systems)
Adobe Acrobat 9.5.5 - CPSID_83708 (HKLM-x32\...\{AC76BA86-1033-0000-BA7E-000000000004}_955) (Version:  - Adobe Systems Incorporated)
Adobe Flash Player 10 ActiveX (HKLM-x32\...\{B7B3E9B3-FB14-4927-894B-E9124509AF5A}) (Version: 10.0.32.18 - Adobe Systems, Inc.)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
BufferChm (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden
Citrix Online Launcher (HKLM-x32\...\{A08A6B7D-1F21-4843-85A3-77B8D15FAE0E}) (Version: 1.0.244 - Citrix)
D110 (x32 Version: 140.0.283.000 - Hewlett-Packard) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAZzle (HKLM-x32\...\DAZzle) (Version:  - )
Dell System Detect (HKU\S-1-5-21-2404089428-2033709462-2392081876-1000\...\9204f5692a8faf3b) (Version: 5.4.0.4 - Dell)
Destinations (x32 Version: 140.0.77.000 - Hewlett-Packard) Hidden
DeviceDiscovery (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden
EPSON Connect version 1.0 (HKLM-x32\...\EPSON Connect_is1) (Version: 1.0 - Epson America Inc.)
Epson Customer Participation (HKLM\...\{814FA673-A085-403C-9545-747FC1495069}) (Version: 1.6.3.0 - SEIKO EPSON CORPORATION)
Epson Event Manager (HKLM-x32\...\{0F13C24A-FFE2-4CD0-8E0B-DC804E0A0E0B}) (Version: 3.10.0035 - Seiko Epson Corporation)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)
EPSON XP-410 Series Printer Uninstall (HKLM\...\EPSON XP-410 Series) (Version:  - SEIKO EPSON Corporation)
Epson XP-410 User's Guide version 1.0 (HKLM-x32\...\UsersGuideEpson XP-410 User's Guide_is1) (Version: 1.0 - )
EpsonNet Print (HKLM-x32\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.6.0 - SEIKO EPSON CORPORATION)
GDR 4033 for SQL Server 2008 R2 (KB2977320) (64-bit) (HKLM\...\KB2977320) (Version: 10.52.4033.0 - Microsoft Corporation)
GoToMeeting 6.4.11.2273 (HKU\S-1-5-21-2404089428-2033709462-2392081876-1000\...\GoToMeeting) (Version: 6.4.11.2273 - CitrixOnline)
GPBaseService2 (x32 Version: 140.0.211.000 - Hewlett-Packard) Hidden
HP Imaging Device Functions 14.0 (HKLM\...\HP Imaging Device Functions) (Version: 14.0 - HP)
HP Photosmart D110 All-In-One Driver Software 14.0 Rel. 7 (HKLM\...\{DBC1DE57-B55A-4D57-9769-1DB9BE506AF7}) (Version: 14.0 - HP)
HP Smart Web Printing 4.60 (HKLM\...\HP Smart Web Printing) (Version: 4.60 - HP)
HP Solution Center 14.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 14.0 - HP)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPAppStudio (x32 Version: 140.0.95.000 - Hewlett-Packard) Hidden
HPPhotoGadget (x32 Version: 140.0.524.000 - Hewlett-Packard) Hidden
HPProductAssistant (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2932 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
Java 7 Update 55 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417055FF}) (Version: 7.0.550 - Oracle)
Java 7 Update 65 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.650 - Oracle)
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
LTCM Client (HKLM-x32\...\{B38E9B55-7136-4E66-A084-320512FF3F6F}) (Version: 1.20.3792 - Leader Technologies Inc)
Microsoft .NET Framework 1.1 (HKLM-x32\...\Microsoft .NET Framework 1.1  (1033)) (Version:  - )
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Home and Business 2013 - en-us (HKLM\...\HomeBusinessRetail - en-us) (Version: 15.0.4675.1003 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-2404089428-2033709462-2392081876-1000\...\OneDriveSetup.exe) (Version: 17.0.4035.0328 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server 2008 R2 (64-bit) (HKLM\...\Microsoft SQL Server 2008 R2) (Version:  - Microsoft Corporation)
Microsoft SQL Server 2008 R2 Native Client (HKLM\...\{E8F7904A-4780-4F3F-B153-21BE32857120}) (Version: 10.52.4033.0 - Microsoft Corporation)
Microsoft SQL Server 2008 R2 Setup (English) (HKLM\...\{1D4A3734-9328-440F-960C-42B4CE481EB4}) (Version: 10.52.4033.0 - Microsoft Corporation)
Microsoft SQL Server 2008 Setup Support Files  (HKLM\...\{B40EE88B-400A-4266-A17B-E3DE64E94431}) (Version: 10.1.2731.0 - Microsoft Corporation)
Microsoft SQL Server 2012 (64-bit) (HKLM\...\Microsoft SQL Server SQLServer2012) (Version:  - Microsoft Corporation)
Microsoft SQL Server 2012 Native Client  (HKLM\...\{49D665A2-4C2A-476E-9AB8-FCC425F526FC}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Setup (English) (HKLM\...\{8CB0713F-CFE0-445D-BCB2-538465860E1A}) (Version: 11.1.3128.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Transact-SQL ScriptDom  (HKLM\...\{0E8670B8-3965-4930-ADA6-570348B67153}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server Desktop Engine (SHIPWORKS) (HKLM-x32\...\{E09B48B5-E141-427A-AB0C-D3605127224A}) (Version: 8.00.761 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft VSS Writer for SQL Server 2012 (HKLM\...\{3E0DD83F-BE4C-4478-86A0-AD0D79D1353E}) (Version: 11.0.2100.60 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 35.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 en-US)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mozilla Thunderbird 31.4.0 (x86 en-US) (HKLM-x32\...\Mozilla Thunderbird 31.4.0 (x86 en-US)) (Version: 31.4.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Network64 (Version: 140.0.215.000 - Hewlett-Packard) Hidden
Network64 (Version: 140.0.221.000 - Hewlett-Packard) Hidden
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
PC Tools Registry Mechanic 11.1 (HKLM-x32\...\Registry Mechanic_is1) (Version: 11.1 - PC Tools)
PS_AIO_07_D110_SW_Min (x32 Version: 140.0.142.000 - Hewlett-Packard) Hidden
QuickTransfer (x32 Version: 140.0.98.000 - Hewlett-Packard) Hidden
Realtek Ethernet Controller All-In-One Windows Driver (HKLM-x32\...\{F7E7F0CB-AA41-4D5A-B6F2-8E6738EB063F}) (Version: 7.67.1226.2012 - Realtek)
Scan (x32 Version: 140.0.80.000 - Hewlett-Packard) Hidden
Service Pack 2 for SQL Server 2008 R2 (KB2630458) (64-bit) (HKLM\...\KB2630458) (Version: 10.52.4000.0 - Microsoft Corporation)
ShipWorks® 2.9.73 (HKLM-x32\...\ShipWorks_is1) (Version: 2.9.73 - Interapptive®, Inc.)
ShipWorks® 3.9.6.6889 (HKLM\...\{CA3940B9-E534-4144-8E08-C6625A9D9DB2}_is1) (Version: 3.9.6.6889 - Interapptive®, Inc.)
SmartWebPrinting (x32 Version: 140.0.186.000 - Hewlett-Packard) Hidden
Software Updater (HKLM-x32\...\{FA7EE274-7370-43B7-9A45-A39B17CCCDC5}) (Version: 4.3.3 - SEIKO EPSON CORPORATION)
SolutionCenter (x32 Version: 140.0.214.000 - Hewlett-Packard) Hidden
SQL Server 2008 R2 SP2 Common Files (Version: 10.52.4000.0 - Microsoft Corporation) Hidden
SQL Server 2008 R2 SP2 Database Engine Services (Version: 10.52.4000.0 - Microsoft Corporation) Hidden
SQL Server 2008 R2 SP2 Database Engine Shared (Version: 10.52.4000.0 - Microsoft Corporation) Hidden
SQL Server 2012 Common Files (Version: 11.0.2100.60 - Microsoft Corporation) Hidden
SQL Server 2012 Database Engine Services (Version: 11.0.2100.60 - Microsoft Corporation) Hidden
SQL Server 2012 Database Engine Shared (Version: 11.0.2100.60 - Microsoft Corporation) Hidden
SQL Server Browser for SQL Server 2012 (HKLM-x32\...\{4B9E6EB0-0EED-4E74-9479-F982C3254F71}) (Version: 11.0.2100.60 - Microsoft Corporation)
Sql Server Customer Experience Improvement Program (Version: 10.50.1600.1 - Microsoft Corporation) Hidden
Sql Server Customer Experience Improvement Program (Version: 11.0.2100.60 - Microsoft Corporation) Hidden
Status (x32 Version: 140.0.256.000 - Hewlett-Packard) Hidden
Switch Sound File Converter (HKLM-x32\...\Switch) (Version: 4.65 - NCH Software)
Toolbox (x32 Version: 140.0.428.000 - Hewlett-Packard) Hidden
TrayApp (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden
WebReg (x32 Version: 140.0.212.017 - Hewlett-Packard) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
ZoneAlarm Antivirus (x32 Version: 13.3.209.000 - Check Point Software Technologies Ltd.) Hidden
ZoneAlarm Firewall (x32 Version: 13.3.209.000 - Check Point Software Technologies Ltd.) Hidden
ZoneAlarm Free Firewall (HKLM-x32\...\ZoneAlarm Free Firewall) (Version: 13.3.209.000 - Check Point)
ZoneAlarm Security (x32 Version: 13.3.209.000 - Check Point Software Technologies Ltd.) Hidden
ZoneAlarm Security Toolbar  (HKLM-x32\...\zonealarm) (Version: 1.8.29.17 - Check Point Software Technologies LTD)
ZoneAlarm Security Toolbar  (HKU\S-1-5-21-2404089428-2033709462-2392081876-1000\...\zonealarm) (Version: 1.8.29.17 - Check Point Software Technologies LTD)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2404089428-2033709462-2392081876-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Guitar\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay No File
CustomCLSID: HKU\S-1-5-21-2404089428-2033709462-2392081876-1000_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Program Files (x86)\Citrix\GoToMeeting\2128\G2MOutlookAddin64.dll (Citrix Online, a division of Citrix Systems, Inc.)
CustomCLSID: HKU\S-1-5-21-2404089428-2033709462-2392081876-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Guitar\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2404089428-2033709462-2392081876-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Guitar\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2404089428-2033709462-2392081876-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Guitar\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2404089428-2033709462-2392081876-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Guitar\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2404089428-2033709462-2392081876-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Guitar\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points  =========================

11-02-2015 08:25:55 Windows Update
11-02-2015 08:51:24 Installed Microsoft Fix it 50981
11-02-2015 10:21:31 Windows Backup
11-02-2015 13:41:47 Installed AVG 2015
11-02-2015 13:42:20 Installed AVG 2015
12-02-2015 11:40:01 Windows Update
16-02-2015 08:42:20 Restore Operation
16-02-2015 09:29:05 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 19:34 - 2009-06-10 14:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0F1DFA0F-9A13-486A-ABB9-75D8976491D0} - System32\Tasks\EPSON XP-410 Series Update {CBD881FB-6534-4107-912B-3F850E014EAA} => C:\Windows\system32\spool\DRIVERS\x64\3\E_ITSLAE.EXE [2013-02-27] (SEIKO EPSON CORPORATION)
Task: {216B8931-EDCF-430A-A42F-C79861240F30} - System32\Tasks\{B77CCD62-67BC-4013-95F5-A6A72E56C0FE} => Firefox.exe
Task: {25013580-8DFF-484F-8CFC-A2758D06B854} - System32\Tasks\G2MUpdateTask-S-1-5-21-2404089428-2033709462-2392081876-1000 => C:\Program Files (x86)\Citrix\GoToMeeting\2273\g2mupdate.exe [2015-01-24] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {6B70F4B3-EECD-4E13-BD39-8C0EBEAE0ECA} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {93AF5C6C-0B45-414E-A988-38BADE96A4C1} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-11-04] (Microsoft Corporation)
Task: {9EF53E35-1545-4E41-AACF-F5EF7949B4B5} - System32\Tasks\EPSON XP-410 Series Invitation {CBD881FB-6534-4107-912B-3F850E014EAA} => C:\Windows\system32\spool\DRIVERS\x64\3\E_ITSLAE.EXE [2013-02-27] (SEIKO EPSON CORPORATION)
Task: {A3B6A73E-5BD0-4EEF-9154-27DB8655E4B3} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {B9D7A167-393C-488D-9955-58B0BA079D93} - System32\Tasks\RMAutoUpdate => C:\Program Files (x86)\PC Tools\PC Tools Registry Mechanic\SULauncher.exe [2012-08-21] (PC Tools)
Task: {D619EFDD-1BEC-4D1A-8848-7A063EC9D28C} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {EC8ACBF0-0C57-439C-A585-3F9EFB543C86} - System32\Tasks\{5BCB3FA4-E271-4E8E-9D07-DCBC71E2C31A} => Firefox.exe
Task: {FF1C2103-4BF7-4252-9307-C0A07A6EFCE4} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-05] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\EPSON XP-410 Series Invitation {CBD881FB-6534-4107-912B-3F850E014EAA}.job => C:\Windows\system32\spool\DRIVERS\x64\3\E_ITSLAE.EXE
Task: C:\Windows\Tasks\EPSON XP-410 Series Update {CBD881FB-6534-4107-912B-3F850E014EAA}.job => C:\Windows\system32\spool\DRIVERS\x64\3\E_ITSLAE.EXE
Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-2404089428-2033709462-2392081876-1000.job => C:\Program Files (x86)\Citrix\GoToMeeting\2273\g2mupdate.exe
Task: C:\Windows\Tasks\RMAutoUpdate.job => C:\Program Files (x86)\PC Tools\PC Tools Registry Mechanic\SULauncher.exe

==================== Loaded Modules (whitelisted) ==============

2014-11-19 18:02 - 2014-09-23 06:36 - 08897696 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2014-03-19 06:29 - 2014-05-20 08:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2012-12-14 02:42 - 2012-12-14 02:42 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-10-09 09:08 - 2014-10-15 10:22 - 00148992 _____ () C:\Program Files\ShipWorks\RestSharp.dll
2014-10-11 13:06 - 2014-10-11 13:06 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-10-11 13:05 - 2014-10-11 13:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2015-01-26 20:17 - 2015-01-26 20:17 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:D1B5B4F1
AlternateDataStreams: C:\Users\Guitar\Documents\Dyna-ST70.pdf:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vsmon => ""="Service"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2404089428-2033709462-2392081876-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Guitar\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.0.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

Administrator (S-1-5-21-2404089428-2033709462-2392081876-500 - Administrator - Disabled)
ASPNET (S-1-5-21-2404089428-2033709462-2392081876-1005 - Limited - Enabled)
Guest (S-1-5-21-2404089428-2033709462-2392081876-501 - Limited - Disabled)
Guitar (S-1-5-21-2404089428-2033709462-2392081876-1000 - Administrator - Enabled) => C:\Users\Guitar
HomeGroupUser$ (S-1-5-21-2404089428-2033709462-2392081876-1002 - Limited - Enabled)

==================== Faulty Device Manager Devices =============

Name: Photosmart D110 series
Description: Photosmart D110 series
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: HP
Service: StillCam
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Photosmart D110 series
Description: Photosmart D110 series
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (02/16/2015 09:14:53 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/16/2015 09:13:38 AM) (Source: MSSQL$SHIPWORKS) (EventID: 19011) (User: )
Description: FillAddress(MSAFD Tcpip [TCP/IPv6]) : Error 0

Error: (02/16/2015 08:34:38 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/16/2015 08:33:53 AM) (Source: MSSQL$SHIPWORKS) (EventID: 19011) (User: )
Description: FillAddress(MSAFD Tcpip [TCP/IPv6]) : Error 0

Error: (02/15/2015 07:00:00 PM) (Source: Windows Backup) (EventID: 4103) (User: )
Description: The backup did not complete because of an error writing to the backup location E:\. The error is: The backup location cannot be found or is not valid. Review your backup settings and check the backup location. (0x81000006).

Error: (02/15/2015 02:14:38 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/15/2015 02:13:38 PM) (Source: MSSQL$SHIPWORKS) (EventID: 19011) (User: )
Description: FillAddress(MSAFD Tcpip [TCP/IPv6]) : Error 0

Error: (02/15/2015 07:56:50 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/15/2015 07:55:58 AM) (Source: MSSQL$SHIPWORKS) (EventID: 19011) (User: )
Description: FillAddress(MSAFD Tcpip [TCP/IPv6]) : Error 0

Error: (02/14/2015 03:27:09 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (02/16/2015 09:14:04 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The TrueVector Internet Monitor service terminated unexpectedly.  It has done this 1 time(s).

Error: (02/16/2015 09:13:20 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The TrueVector Internet Monitor service hung on starting.

Error: (02/16/2015 09:06:46 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Microsoft Antimalware Service service failed to start due to the following error:
%%1053

Error: (02/16/2015 09:06:46 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Microsoft Antimalware Service service to connect.

Error: (02/16/2015 08:34:24 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The HP CUE DeviceDiscovery Service service terminated unexpectedly.  It has done this 1 time(s).

Error: (02/16/2015 08:33:18 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Microsoft Antimalware Service service failed to start due to the following error:
%%2

Error: (02/15/2015 02:14:54 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The HP CUE DeviceDiscovery Service service terminated unexpectedly.  It has done this 1 time(s).

Error: (02/15/2015 02:13:24 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Microsoft Antimalware Service service failed to start due to the following error:
%%2

Error: (02/15/2015 07:56:25 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The HP CUE DeviceDiscovery Service service terminated unexpectedly.  It has done this 1 time(s).

Error: (02/15/2015 07:56:25 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The hpqcxs08 service terminated unexpectedly.  It has done this 1 time(s).


Microsoft Office Sessions:
=========================
Error: (02/16/2015 09:14:53 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/16/2015 09:13:38 AM) (Source: MSSQL$SHIPWORKS) (EventID: 19011) (User: )
Description: FillAddress(MSAFD Tcpip [TCP/IPv6]) : Error 0

Error: (02/16/2015 08:34:38 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/16/2015 08:33:53 AM) (Source: MSSQL$SHIPWORKS) (EventID: 19011) (User: )
Description: FillAddress(MSAFD Tcpip [TCP/IPv6]) : Error 0

Error: (02/15/2015 07:00:00 PM) (Source: Windows Backup) (EventID: 4103) (User: )
Description: E:\The backup location cannot be found or is not valid. Review your backup settings and check the backup location. (0x81000006)

Error: (02/15/2015 02:14:38 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/15/2015 02:13:38 PM) (Source: MSSQL$SHIPWORKS) (EventID: 19011) (User: )
Description: FillAddress(MSAFD Tcpip [TCP/IPv6]) : Error 0

Error: (02/15/2015 07:56:50 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/15/2015 07:55:58 AM) (Source: MSSQL$SHIPWORKS) (EventID: 19011) (User: )
Description: FillAddress(MSAFD Tcpip [TCP/IPv6]) : Error 0

Error: (02/14/2015 03:27:09 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


==================== Memory info ===========================

Processor: Intel® Core™ i3-3220 CPU @ 3.30GHz
Percentage of memory in use: 57%
Total physical RAM: 3998.08 MB
Available physical RAM: 1708.85 MB
Total Pagefile: 7994.35 MB
Available Pagefile: 5602.58 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:232.79 GB) (Free:169.59 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: FC026294)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=232.8 GB) - (Type=07 NTFS)

==================== End Of Log ============================

[Advertisements]

Hi.

Ok, system restored to 2/6/15.

Good, we will leave the ZoneAlarm Free installed for the time being.

Java Advice:

There has been a recent severe exploitation of this software. Even though this exploit has been reportedly fixed there is still a vulnerability with the software, the below is currently all that it is installed Java related:-

Java 7 Update 55
Java 7 Update 65

So you need to uninstall all(if still present via Uninstall a program or Programs and Features located in the Control Panel)...Your choice if you wish to go ahead and reinstall but as mentioned I advise against it and for the present I do not even have anything Java related installed on my machines.

Please let myself know what you wish to do about this in your next reply please and if you opt to re-install I will provide both the appropriate instructions and safety advice etc.

Uninstall Further Software:

When in Uninstall a program or Programs and Features and removing the Java installations also uninstall the following:-

PC Tools Registry Mechanic <-- Will not actually improve anything and has the potential to worsen a situation and even render a machine unbootable.

Custom FRST Script:

Please download the attached fixlist.txt(see below) and save to the desktop.

[attachment=75544:fixlist.txt]

• Now right-click on FRST64.exe and select Run as Administrator to start FRST.
• Then click on the Fix button/radio tab >> at the Fix completed prompt click on OK
• Your machine should now automatically reboot itself.
• Post the contents of the newly created Fixlog in your next reply.

Note: If FRST advises there is a new updated version to be downloaded, do so/allow this.

Malwarebytes Anti-Malware:

Please download the installer for Malwarebytes' Anti-Malware(select the free version) to your desktop.

Alternate download is here.

• Right-click on mbam-setup-2.0.4.1028.exe and select Run as Administrator, then follow the prompts to install the program.
• Select the language and click OK >> Accept the agreement.
• Deselect the check-mark next to Enable the Free Trial(you may enable this when I give tha lall clear if you so wish) and then ensure Launch Malwarebytes' Anti-Malware is selected, then click on finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Scan Now".
• The scan may take some time to finish, so please be patient.
• When the scan is complete, click on Quarantine All
• When disinfection is completed, a dialogue will open and you may be prompted to Restart.(See Extra Note)
• Upon restart, launch Malwarebytes Antimalware and select History >> Application Logs.
• Double click on the last scan done, then on Copy to Clipboard.
• To submit your reply, click on Add Reply, then right click on the window and select Paste.
• Submit your reply.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Next:

When completed the above, please post back the following in the order asked for:

• How is your computer performing now, any further symptoms and or problems encountered?
• Fix Log from the Custom FRST Script
• Malwarebytes Anti-Malware Log.

[Dakeyras]

Hi.

Ok, system restored to 2/6/15.

Good, we will leave the ZoneAlarm Free installed for the time being.

Java Advice:

There has been a recent severe exploitation of this software. Even though this exploit has been reportedly fixed there is still a vulnerability with the software, the below is currently all that it is installed Java related:-

Java 7 Update 55
Java 7 Update 65

So you need to uninstall all(if still present via Uninstall a program or Programs and Features located in the Control Panel)...Your choice if you wish to go ahead and reinstall but as mentioned I advise against it and for the present I do not even have anything Java related installed on my machines.

Please let myself know what you wish to do about this in your next reply please and if you opt to re-install I will provide both the appropriate instructions and safety advice etc.

Uninstall Further Software:

When in Uninstall a program or Programs and Features and removing the Java installations also uninstall the following:-

PC Tools Registry Mechanic <-- Will not actually improve anything and has the potential to worsen a situation and even render a machine unbootable.

Custom FRST Script:

Please download the attached fixlist.txt(see below) and save to the desktop.

[attachment=75544:fixlist.txt]

• Now right-click on FRST64.exe and select Run as Administrator to start FRST.
• Then click on the Fix button/radio tab >> at the Fix completed prompt click on OK
• Your machine should now automatically reboot itself.
• Post the contents of the newly created Fixlog in your next reply.

Note: If FRST advises there is a new updated version to be downloaded, do so/allow this.

Malwarebytes Anti-Malware:

Please download the installer for Malwarebytes' Anti-Malware(select the free version) to your desktop.

Alternate download is here.

• Right-click on mbam-setup-2.0.4.1028.exe and select Run as Administrator, then follow the prompts to install the program.
• Select the language and click OK >> Accept the agreement.
• Deselect the check-mark next to Enable the Free Trial(you may enable this when I give tha lall clear if you so wish) and then ensure Launch Malwarebytes' Anti-Malware is selected, then click on finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Scan Now".
• The scan may take some time to finish, so please be patient.
• When the scan is complete, click on Quarantine All
• When disinfection is completed, a dialogue will open and you may be prompted to Restart.(See Extra Note)
• Upon restart, launch Malwarebytes Antimalware and select History >> Application Logs.
• Double click on the last scan done, then on Copy to Clipboard.
• To submit your reply, click on Add Reply, then right click on the window and select Paste.
• Submit your reply.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Next:

When completed the above, please post back the following in the order asked for:

• How is your computer performing now, any further symptoms and or problems encountered?
• Fix Log from the Custom FRST Script
• Malwarebytes Anti-Malware Log.

[Dazed&Confused]

Okey doke.  I uninstalled both versions of Java, and uninstalled PC Tools Registry Mechanic.  The computer seems mostly fine, although the hard drive seems to be "ticking" a lot more than it should.

 

Fix Log:

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 15-02-2015
Ran by Guitar at 2015-02-16 15:31:47 Run:1
Running from C:\Users\Guitar\Desktop
Loaded Profiles: Guitar (Available profiles: Guitar)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
CreateRestorePoint:
HKLM-x32\...\Run: [] => [X]
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKU\S-1-5-21-2404089428-2033709462-2392081876-1000 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} -  No File
FF SearchPlugin: C:\Users\Guitar\AppData\Roaming\Mozilla\Firefox\Profiles\d3jx9paj.default\searchplugins\ask-search.xml
FF SearchPlugin: C:\Users\Guitar\AppData\Roaming\Mozilla\Firefox\Profiles\d3jx9paj.default\searchplugins\startpage-custom-search.xml
FF Extension: No Name - C:\Users\Guitar\AppData\Roaming\Mozilla\Firefox\Profiles\d3jx9paj.default\extensions\[email protected] [Not Found]
R2 PCToolsSSDMonitorSvc; C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [794272 2012-08-21] (PC Tools)
U2 TMAgent; No ImagePath
2015-02-11 13:44 - 2015-02-11 13:44 - 00000000 ____D () C:\Users\Guitar\AppData\Roaming\AVG2015
2015-02-11 13:43 - 2015-02-11 13:43 - 00000000 ____D () C:\Users\Guitar\AppData\Roaming\TuneUp Software
2015-02-11 13:42 - 2015-02-16 09:05 - 00000000 ____D () C:\ProgramData\AVG2015
2015-02-11 13:42 - 2015-02-11 13:42 - 00000000 ___HD () C:\$AVG
2015-02-11 13:42 - 2015-02-11 13:42 - 00000000 ____D () C:\Program Files (x86)\AVG
2015-02-11 13:31 - 2015-02-16 09:00 - 00000000 ____D () C:\ProgramData\MFAData
2015-02-11 13:31 - 2015-02-11 14:03 - 00000000 ____D () C:\Users\Guitar\AppData\Local\Avg2015
2015-02-11 13:31 - 2015-02-11 13:31 - 00000000 ____D () C:\Users\Guitar\AppData\Local\MFAData
2015-02-11 08:05 - 2015-02-11 08:05 - 00000952 _____ () C:\sh4_service.log
2015-02-11 08:02 - 2015-02-11 06:56 - 00285747 _____ () C:\shldr
2015-02-11 08:02 - 2015-02-11 06:56 - 00008192 _____ () C:\shldr.mbr
2015-02-11 06:57 - 2015-02-11 06:57 - 00000000 _____ () C:\autoexec.bat
2015-02-11 06:56 - 2015-02-11 06:56 - 00000000 ____D () C:\sh4ldr
2015-02-11 06:54 - 2015-02-11 06:54 - 00000000 ____D () C:\Program Files\Enigma Software Group
2015-02-11 01:04 - 2015-02-11 01:04 - 00002451 _____ () C:\spyhunter.log
2015-02-16 09:13 - 2013-10-08 10:08 - 00000304 _____ () C:\Windows\Tasks\RMAutoUpdate.job
2015-02-16 09:00 - 2013-10-07 16:48 - 00000000 ____D () C:\Program Files (x86)\MyPC Backup
2015-02-16 09:00 - 2013-10-07 10:10 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2015-02-16 09:00 - 2013-10-07 10:10 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
2015-02-16 08:47 - 2015-01-12 16:13 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-02-16 08:47 - 2014-04-26 08:39 - 00000000 ____D () C:\Program Files\Java
2015-02-16 08:47 - 2014-04-09 15:48 - 00000000 ____D () C:\Program Files (x86)\Java
2015-02-16 08:47 - 2013-10-08 10:06 - 00000000 ____D () C:\Program Files (x86)\PC Tools
AlternateDataStreams: C:\ProgramData\TEMP:D1B5B4F1
C:\Program Files (x86)\Common Files\PC Tools
cmd: ipconfig /flushdns
cmd: bitsadmin /reset /allusers
Hosts:
EmptyTemp:
*****************

Restore point was successfully created.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9} => Key not found.
"HKCR\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}" => Key deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} => Key not found.
"HKCR\Wow6432Node\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}" => Key deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9} => Key not found.
"HKCR\Wow6432Node\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}" => Key deleted successfully.
HKU\S-1-5-21-2404089428-2033709462-2392081876-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} => value deleted successfully.
HKCR\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} => Key not found.
C:\Users\Guitar\AppData\Roaming\Mozilla\Firefox\Profiles\d3jx9paj.default\searchplugins\ask-search.xml => Moved successfully.
C:\Users\Guitar\AppData\Roaming\Mozilla\Firefox\Profiles\d3jx9paj.default\searchplugins\startpage-custom-search.xml => Moved successfully.
C:\Users\Guitar\AppData\Roaming\Mozilla\Firefox\Profiles\d3jx9paj.default\extensions\[email protected] not found.
PCToolsSSDMonitorSvc => Service not found.
TMAgent => Service deleted successfully.
C:\Users\Guitar\AppData\Roaming\AVG2015 => Moved successfully.
C:\Users\Guitar\AppData\Roaming\TuneUp Software => Moved successfully.
C:\ProgramData\AVG2015 => Moved successfully.
C:\$AVG => Moved successfully.
C:\Program Files (x86)\AVG => Moved successfully.
C:\ProgramData\MFAData => Moved successfully.
C:\Users\Guitar\AppData\Local\Avg2015 => Moved successfully.
C:\Users\Guitar\AppData\Local\MFAData => Moved successfully.
C:\sh4_service.log => Moved successfully.
C:\shldr => Moved successfully.
C:\shldr.mbr => Moved successfully.
C:\autoexec.bat => Moved successfully.
C:\sh4ldr => Moved successfully.
C:\Program Files\Enigma Software Group => Moved successfully.
C:\spyhunter.log => Moved successfully.
"C:\Windows\Tasks\RMAutoUpdate.job" => File/Directory not found.
C:\Program Files (x86)\MyPC Backup => Moved successfully.
"C:\Program Files\Microsoft Security Client" => Warning: FRST is scripted not to move this directory.
C:\Program Files (x86)\Microsoft Security Client => Moved successfully.
C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7 => Moved successfully.
C:\Program Files\Java => Moved successfully.
C:\Program Files (x86)\Java => Moved successfully.
"C:\Program Files (x86)\PC Tools" => File/Directory not found.
C:\ProgramData\TEMP => ":D1B5B4F1" ADS removed successfully.
C:\Program Files (x86)\Common Files\PC Tools => Moved successfully.

=========  ipconfig /flushdns =========


Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========


=========  bitsadmin /reset /allusers =========


BITSADMIN version 3.0 [ 7.5.7601 ]
BITS administration utility.
© Copyright 2000-2006 Microsoft Corp.

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

0 out of 0 jobs canceled.

========= End of CMD: =========

C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 385.3 MB temporary data.


The system needed a reboot.

==== End of Fixlog 15:32:33 ====

[Dazed&Confused]

Malware Bytes log:

 

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 2/16/2015
Scan Time: 3:45:23 PM
Logfile: Malwarebytes log.txt
Administrator: Yes

Version: 2.00.4.1028
Malware Database: v2015.02.16.09
Rootkit Database: v2015.02.03.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Guitar

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 342890
Time Elapsed: 8 min, 32 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 2
PUP.Optional.InstallCore.A, HKU\S-1-5-21-2404089428-2033709462-2392081876-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, Quarantined, [9099ee31414974c29fb54496d82be818],
PUP.Optional.InstallCore.A, HKU\S-1-5-21-2404089428-2033709462-2392081876-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, Quarantined, [6dbcba6539519e98cf6dfdf3e81c7d83],

Registry Values: 1
PUP.Optional.InstallCore.A, HKU\S-1-5-21-2404089428-2033709462-2392081876-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, 0F, Quarantined, [6dbcba6539519e98cf6dfdf3e81c7d83]

Registry Data: 0
(No malicious items detected)

Folders: 1
PUP.Optional.MindSpark.A, C:\Users\Guitar\AppData\Roaming\Mozilla\Firefox\Profiles\d3jx9paj.default\VideoDownloadConverter_4z, Quarantined, [a7821e01bfcb0333331e5e01020104fc],

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)

[Dakeyras]

Hi.

Okey doke. I uninstalled both versions of Java

Do you wish to reinstall Java or not ?

although the hard drive seems to be "ticking" a lot more than it should.

It may just be something is running in the background(malware related) and or the drive is in need of some in-depth maintenance. Though the worst case scenario is that is beginning to fail, hopefully it is not the latter and either we way we can check this out in due course.

Scan with JRT:

Please download Junkware Removal Tool to your desktop.

Note: Temp' disable/shut down your protection software now to avoid potential conflicts, how to do so can be read here.

• Right-click on JRT.exe and select Run as Administrator to launch the application >> follow the on-screen prompt.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next reply.

Note: Reboot your machine and ensure all disabled security software is now enabled etc.

Scan with AdwCleaner:

Please download adwcleaner from here and save to your desktop.

• Right-click on adwcleaner.exe and select Run as Administrator to launch the application.
• Now click on the Scan tab >> once the scan is complete click on the Cleaning tab and follow the prompts.
• Allow the system to reboot. You will then be presented with the report. Copy & Paste this report on your next reply.

Note: The log can also be located at C: >> AdwCleaner >> AdwCleaner[S0].txt

Check Hard Disk For Errors:

Download the attached hddcheck.bat below and save to your desktop:-

[attachment=75556:hddcheck.bat]

Now right-click on hddcheck.bat and select Run as Administrator to run the batch file. A blank command window will open on your desktop, then close in a few minutes. This is normal and the batch file itself will self-delete when completed.

A file icon named checkhd.txt should appear on your desktop. Please post the contents of this file in your next reply.

Next:

When completed the above, please post back the following in the order asked for:

• How is your computer performing now, any further symptoms and or problems encountered?
• Junkware Removal Tool Log.
• AdwCleaner Log.
• Check Hard Disk For Errors Log.

[Dazed&Confused]

A quick FYI, I'm really busy, but haven't quit on this.  I'll follow through with your next recommendations this evening.

[Dakeyras]

Acknowledged.

[Dazed&Confused]

Thank you for your patience

 

At this time, we do not want to reinstall Java, since you say it's a risk.  The computer seems to be running well, and is starting faster than it was.

 

JRT log:

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.2 (02.02.2015:1)
OS: Windows 7 Professional x64
Ran by Guitar on Fri 02/20/2015 at  8:02:45.39
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\AboutURLs\\Tabs



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\updateWhilokii_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\updateWhilokii_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\updateWhilokii_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\updateWhilokii_RASMANCS



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\apn"
Successfully deleted: [Folder] "C:\Users\Guitar\AppData\Roaming\registry mechanic"
Successfully deleted: [Folder] "C:\Users\Guitar\appdata\local\mobogenie"
Successfully deleted: [Folder] "C:\Program Files (x86)\mobogenie"



~~~ FireFox

Successfully deleted: [File] C:\Users\Guitar\AppData\Roaming\mozilla\firefox\profiles\d3jx9paj.default\user.js
Successfully deleted the following from C:\Users\Guitar\AppData\Roaming\mozilla\firefox\profiles\d3jx9paj.default\prefs.js

user_pref("extensions.toolbar.mindspark.lastInstalled", "[email protected]");
user_pref("extensions.zonealarm.hmpgUrl", "hxxp://search.zonealarm.com/?src=hp&tbid=HFA5&Lan=EN&gu=416fb1de9be24dd5974aea1504f73c9b&tu=10G9y00H42D33N0&sku=&tstsId=&ver=&");
user_pref("extensions.zonealarm.kw_url", "hxxp://search.zonealarm.com/search?src=sp&tbid=HFA5&Lan=EN&gu=416fb1de9be24dd5974aea1504f73c9b&tu=10G9y00H42D33N0&sku=&tstsId=&ver=&&
user_pref("extensions.zonealarm.newTabUrl", "hxxp://search.zonealarm.com/?src=nt&tbid=HFA5&Lan=EN&gu=416fb1de9be24dd5974aea1504f73c9b&tu=10G9y00H42D33N0&sku=&tstsId=&ver=&");
user_pref("extensions.zonealarm.tlbrSrchUrl", "hxxp://search.zonealarm.com/search?src=tb&tbid=HFA5&Lan={dfltLng}&gu=416fb1de9be24dd5974aea1504f73c9b&tu=10G9y00H42D33N0&sku=&ts
Emptied folder: C:\Users\Guitar\AppData\Roaming\mozilla\firefox\profiles\d3jx9paj.default\minidumps [1104 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Fri 02/20/2015 at  8:05:13.44
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

[Dazed&Confused]

Adwcleaner log:

 

# AdwCleaner v4.111 - Logfile created 20/02/2015 at 08:11:12
# Updated 18/02/2015 by Xplode
# Database : 2015-02-18.3 [Server]
# Operating system : Windows 7 Professional Service Pack 1 (x64)
# Username : Guitar - GUITAR-PC
# Running from : C:\Users\Guitar\Desktop\AdwCleaner.exe
# Option : Cleaning

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\Program Files (x86)\Check Point Software Technologies LTD
Folder Deleted : C:\Users\Guitar\AppData\Roaming\Check Point Software Technologies LTD
Folder Deleted : C:\Users\Guitar\Documents\Mobogenie
File Deleted : C:\Users\Guitar\daemonprocess.txt
File Deleted : C:\Users\Guitar\AppData\Roaming\Mozilla\Firefox\Profiles\d3jx9paj.default\searchplugins\zonealarm.xml

***** [ Scheduled tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHost.Tool
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHost.Tool.1
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{06DEB529-DE09-43EC-B6E2-451AAB0FF000}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{19D2F415-D58B-46BC-9390-C03DCBC21EB2}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6E45F3E8-2683-4824-A6BE-08108022FB36}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{744E0E81-BC79-4719-A58B-C98F7E78EE5D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{987D9269-F8A1-408F-BF62-4397D2F5363E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{9F0F16DD-4E76-4049-A9B1-7A91E48F0323}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E0722BEB-FDA1-4AA1-A2A8-15A74A5B3F70}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F4288797-CB12-49CE-9DF8-7CDFA1143BEA}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{744E0E81-BC79-4719-A58B-C98F7E78EE5D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{06DEB529-DE09-43EC-B6E2-451AAB0FF000}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{212C2C4F-C845-4FBC-9561-C833A13D8DCE}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{3C5D1D57-16C8-473C-A552-37B8D88596FE}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4A115D8A-6A7B-4C72-92B1-2E2D01F36979}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{99DF8440-814E-497F-BDDD-FB93E9E9DF96}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{E00DE9B9-B128-4C39-B732-B5D85013FA48}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{83CAD530-387D-40FD-82EA-B9E863D92A9B}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{744E0E81-BC79-4719-A58B-C98F7E78EE5D}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{AB4DA692-F26B-403C-AF8F-FD87D121F8F1}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Data Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17631


-\\ Mozilla Firefox v35.0.1 (x86 en-US)


*************************

AdwCleaner[R0].txt - [4005 bytes] - [20/02/2015 08:10:02]
AdwCleaner[S0].txt - [3988 bytes] - [20/02/2015 08:11:12]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4047  bytes] ##########
 

[Dazed&Confused]

Check Hard Disk for Errors log:

 

The type of the file system is NTFS.

WARNING!  F parameter not specified.
Running CHKDSK in read-only mode.

CHKDSK is verifying files (stage 1 of 3)...
File verification completed.
  1132 large file records processed.                                   

  0 bad file records processed.                                     

  2 EA records processed.                                           

  44 reparse records processed.                                      

CHKDSK is verifying indexes (stage 2 of 3)...
Index verification completed.
  0 unindexed files scanned.                                        

  0 unindexed files recovered.                                      

CHKDSK is verifying security descriptors (stage 3 of 3)...
Security descriptor verification completed.
  57285 data files processed.                                           

CHKDSK is verifying Usn Journal...
Usn Journal verification completed.
Windows has checked the file system and found no problems.

 244093951 KB total disk space.
  64514112 KB in 148899 files.
    124824 KB in 57286 indexes.
         0 KB in bad sectors.
    343079 KB in use by the system.
     65536 KB occupied by the log file.
 179111936 KB available on disk.

      4096 bytes in each allocation unit.
  61023487 total allocation units on disk.
  44777984 allocation units available on disk.
 

[Dakeyras]

Hi.

Thank you for your patience

You're welcome!

At this time, we do not want to reinstall Java, since you say it's a risk. The computer seems to be running well, and is starting faster than it was.

Acknowledged re Java and good about the overall performance. Also it appears the hard-drive is in good health also.

Uninstall ZoneAlarm:

Please download the Removal Tool from here and save to your desktop.

Right-click on clean.exe and select Run as Administrator >> click on Yes at the prompt.

When Finished uninstalling products is denoted >> click on the Restart button.

Next:

We will now be installing a new Anti-Virus solution, either of the below will suffice just pick one only and install etc...

Avast:

Click here to download the installer and save to the desktop.

• Once downloaded, right-click on avast_free_antivirus_setup.exe and select Run as Administrator >> after the main installation windows has loaded deselect the following:-

Yes, install Google Chrome as my default browser
Yes, install Google Toolbar for Internet Explorer

• Now click on Regular Installation >>, then on Continue
• The installation process will now begin.
• Once Your installation is now completed is denoted, click on Done.
• A startup/quick scan will now commence and you will be informed when complete.

Note: This article explains the various features of the software, Configure Avast Free Antivirus.

MSE:

Download the installer for Microsoft Security Essentials and save to the desktop.

• Once downloaded, right-click on the installer for Microsoft Security Essentials(mseinstall.exe) and select and select Run as Administrator.
• Follow the prompts to install >> when asked if you want to turn one the Windows Firewall, agree to this...
• Update >> Carry Out a Complete Scan.

Note: This article explains the various features of the software, Getting started with Microsoft Security Essentials

Next:

Let myself know when completed the above...if any problems encountered and or any further issues remaining, thank you.

[Dazed&Confused]

I used the clean.exe file to remove Zonealarm, but I can't install MSE.  It gives me error code 0x80070643.

[Dakeyras]

Hi.

I can't install MSE. It gives me error code 0x80070643.

Carry out the following please then afterwards try to install MSE again...

Uninstall MSE Remnants:

Download the Microsoft Security Essentials Removal Tool and save to your desktop

Once downloaded, double-click on MicrosoftFixit50692.msi >> select I Agree >> Next> >> once processed click on Close.

Reset Windows Installer:

Download the attached ResetWI.bat below and save to your desktop.

[attachment=75634:ResetWI.bat]

Right-click on ResetWI.bat and select Run as Administrator to run the batch file.

Once processed your machine will automatically reboot.

[Dazed&Confused]

When running Microsoft Fix It I get this error:

 

Service "Microsoft Antimalware Service" (MsMpSvc) could not be stopped.  Verify that you have sufficient privleges to stop system services.

[Dakeyras]

Hi.

Let's try a different methodology as follows...

Please download this MS-Fixt from here and save to the desktop.

• Right-click on MicrosoftFixit.ProgramInstallUninstall.RNP.1348057854208685.2.1.Run.exe and select Run as Administrator >> Accept
• Once the MS-Fixit has fully loaded select Detect problems and let me select the files to apply >> Uninstalling
• After detecting problems has completed >> use the scroll menu to locate Microsoft Security Client and click once on it to highlight.
• Then click on Next >> Yes, try uninstall >> select all issues denoted if they are not >> Next
• When the Microsoft Security Client has been uninstalled follow the prompts and close the MS-Fixt.

Next:-

• Now re-launch the MS-Fixt again and follow the prior procedure but this time have it uninstall Microsoft Antimalware(if present).
• Once that procedure is completed and or if Microsoft Antimalware was not present, reboot your machine regardless.

Next:

Download and run the batch file from post #28 per the instructions. Then afterwards check if MSE can now be installed successfully or not.

Let myself know the outcome of the above in your next reply and we will then go from there, thank you.