Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Laptop loaded with "shopping programs", chrome won't run,

Started by frobey , Mar 15 2015 01:38 PM

This topic is locked

#1
frobey

Posted 15 March 2015 - 01:38 PM

Member

Member
67 posts

Hi, a friend asked me to look at his laptop since it was "slow", it is loaded with all the various shopping programs as well as "optimizer programs". I have no idea where they got these...

I removed a bunch of them as well as well as a couple of the optimizing programs but that didn't help even after a reboot. I tried to get the laptop into Safe Mode to see if it acted any differently but it didn't seem to want to respond to F8...

When the laptop boots it takes at least 5 minutes for it to come up.

Google Chrome will not run at all. I can get IE to come up but then it goes to trovi.com and if I want to download something like malwarebytes, appbusy.com pops up...preventing me from using the browser. It also went to sh

It just popped up a box with a voice telling me that I should call 1-877-518-6938 immediately because I am infected. Never seen that before...

I had to download FRST64 on my own laptop and then transfer it over by flashdrive.

Here are the FRST and addition logs.

Thanks for any help you can give me!!!

Frank

FRST.txt

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015

Ran by Bill (administrator) on MYPC on 15-03-2015 15:29:15

Running from C:\Users\Bill\Desktop

Loaded Profiles: Bill (Available profiles: Bill)

Platform: Windows 8.1 (X64) OS Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe

(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe

(CartCrunch Israel Ltd.) C:\ProgramData\PicColor Utility\ColorMedia.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe

() C:\ProgramData\PicColor Utility\PicColor.exe

(Search Module Ltd.) C:\Program Files\Common Files\Goobzo\GBUpdate\smu.exe

() C:\Program Files (x86)\Solution Real\updateSolutionReal.exe

() C:\Program Files (x86)\Solution Real\bin\utilSolutionReal.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe

(Word Proser) C:\Program Files (x86)\WordProser_1.10.0.5\Service\wpsvc.exe

(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe

(Client Connect LTD) C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17477_none_fa2b7d3b9b36c7b4\TiWorker.exe

() C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmdServer.exe

(Cisco Consumer Products LLC) C:\Program Files (x86)\Linksys AE6000\WPS_Mon.exe

(Samsung Electronics) C:\ProgramData\MakeMarkerFile.exe

() C:\Program Files (x86)\ver9SpeedCheck\r2SpeedCheckz46.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\sSettings.exe

(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\SW Update\SWMAgent.exe

() C:\Program Files (x86)\ver9SpeedCheck\SpeedCheck.exe

() C:\Users\Bill\AppData\Local\ospd_us_657\upospd_us_657.exe

(Client Connect LTD) C:\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe

(Client Connect LTD) C:\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe

() C:\Program Files (x86)\Solution Real\bin\SolutionReal.PurBrowse64.exe

() C:\Program Files (x86)\Solution Real\bin\SolutionReal.BrowserAdapter.exe

() C:\Program Files (x86)\Solution Real\bin\SolutionReal.BrowserAdapter64.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe

(Samsung Electronics CO., LTD.) C:\Program Files\Samsung\S Agent\CommonAgent.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\Installer\setup.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe

(Hewlett-Packard Co.) C:\Program Files\HP\HP ENVY 5530 series\Bin\ScanToPCActivationApp.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Hewlett-Packard Co.) C:\Program Files\HP\HP ENVY 5530 series\Bin\HPNetworkCommunicatorCom.exe

(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe

() C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe

(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe

(Microsoft Corporation) C:\Windows\System32\WerFault.exe

(SoftBrain Technologies Ltd.) C:\Users\Bill\AppData\Local\SmartWeb\SmartWebHelper.exe

() C:\Users\Bill\AppData\Local\wincheck\wincheck.exe

(PC Utilities Software Limited) C:\ProgramData\{b200f4f3-87a5-88de-b200-0f4f387ad3ce}\optimizerpro_soft_partner.exe

(SoftBrain Technologies Ltd.) C:\Users\Bill\AppData\Local\SmartWeb\SmartWebApp.exe

(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13191824 2012-08-10] (Realtek Semiconductor)

HKLM\...\Run: [BtTray] => C:\Program Files (x86)\Bluetooth Suite\BtTray.exe [766080 2012-10-31] (Qualcomm Atheros)

HKLM\...\Run: [BtvStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [127616 2012-10-31] (Qualcomm Atheros Commnucations)

HKLM\...\Run: [3D BubbleSound] => "C:\Program Files\BubbleSound\3D BubbleSound.exe"

HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [2994880 2012-08-14] (Symantec Corporation)

HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [97392 2012-08-15] (CyberLink Corp.)

HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)

HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [SmartWeb] => C:\Users\Bill\AppData\Local\SmartWeb\SmartWebHelper.exe [270696 2014-12-31] (SoftBrain Technologies Ltd.)

HKLM-x32\...\Run: [WinCheck] => C:\Users\Bill\AppData\Local\wincheck\wincheck.exe [267776 2015-01-18] ()

HKLM-x32\...\Run: [gmsd_us_108] => [X]

HKLM-x32\...\Run: [YTDownloader] => "C:\Program Files (x86)\YTDownloader\YTDownloader.exe" /boot

HKLM-x32\...\RunOnce: [upospd_us_657.exe] => C:\Users\Bill\AppData\Local\ospd_us_657\upospd_us_657.exe [3289768 2015-01-14] ()

HKU\S-1-5-21-2961404673-414218333-4232183137-1001\...\Run: [HP ENVY 5530 series (NET)] => C:\Program Files\HP\HP ENVY 5530 series\Bin\ScanToPCActivationApp.exe [3414048 2013-02-08] (Hewlett-Packard Co.)

HKU\S-1-5-21-2961404673-414218333-4232183137-1001\...\Run: [Itibiti.exe] => C:\Program Files (x86)\Itibiti Soft Phone\Itibiti.exe

HKU\S-1-5-21-2961404673-414218333-4232183137-1001\...\Run: [PCKeeper2] => "C:\Program Files\Kromtech\PCKeeper\PCKeeper.exe" /autorun

HKU\S-1-5-21-2961404673-414218333-4232183137-1001\...\Run: [YTDownloader] => "C:\Program Files (x86)\YTDownloader\YTDownloader.exe" /boot

AppInit_DLLs: C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\VC64LO~1.DLL => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\VC64Loader.dll [256272 2015-02-19] (Client Connect LTD)

AppInit_DLLs-x32: c:\progra~2\searchprotect\searchprotect\bin\vc32loader.dll => c:\Program Files (x86)\searchprotect\searchprotect\bin\vc32loader.dll [218384 2015-02-19] (Client Connect LTD)

AppInit_DLLs-x32: c:/progra~3/{a9c44~1/171~1.0/laca.dll => c:\ProgramData\{A9C44107-F946-9081-48C0-E0039842338D}\1.7.1.0\laca.dll [649216 2015-01-14] ()

Startup: C:\Users\Bill\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP ENVY 5530 series (Network).lnk

Startup: C:\Users\Bill\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\optimizerpro_soft_partner.lnk

ShortcutTarget: optimizerpro_soft_partner.lnk -> C:\ProgramData\{b200f4f3-87a5-88de-b200-0f4f387ad3ce}\optimizerpro_soft_partner.exe (PC Utilities Software Limited)

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings: [ProxySettingsPerUser] 0 <======= ATTENTION (Policy Restriction on ProxySettings)

HKU\S-1-5-21-2961404673-414218333-4232183137-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.trovi.com...&D=031515&SSPV=

HKU\S-1-5-21-2961404673-414218333-4232183137-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.aol.com/?...gusaolp00000004

URLSearchHook: HKU\S-1-5-21-2961404673-414218333-4232183137-1001 - (No Name) - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - No File

SearchScopes: HKLM -> {460C3D19-B3D4-4964-A550-77D263B0CCCB} URL = http://www-searching...q={searchTerms}

SearchScopes: HKLM -> {7F4EFF06-7032-458e-AE16-1C1D8255C28A} URL = http://www-searching...q={searchTerms}

SearchScopes: HKLM -> {9D104B0D-4B45-48A3-8222-54140634588F} URL = http://www-searching...q={searchTerms}

SearchScopes: HKLM -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL =

SearchScopes: HKU\S-1-5-21-2961404673-414218333-4232183137-1001 -> DefaultScope {6C0BCDBF-E321-4B06-A865-F0CB012778D3} URL = http://www-searching...q={searchTerms}

SearchScopes: HKU\S-1-5-21-2961404673-414218333-4232183137-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www-searching...q={searchTerms}

SearchScopes: HKU\S-1-5-21-2961404673-414218333-4232183137-1001 -> {0EFDBE7D-8118-4469-9048-EF6348CDBC68} URL = http://www.bing.com/...=MSSEDF&pc=MSE1

SearchScopes: HKU\S-1-5-21-2961404673-414218333-4232183137-1001 -> {250D9A93-5D4F-4316-9B27-8D4CE4AD37F3} URL = http://vosteran.com/...r=582010452&ir=

SearchScopes: HKU\S-1-5-21-2961404673-414218333-4232183137-1001 -> {460C3D19-B3D4-4964-A550-77D263B0CCCB} URL = http://www-searching...q={searchTerms}

SearchScopes: HKU\S-1-5-21-2961404673-414218333-4232183137-1001 -> {4BC38336-B2F7-4D9C-A066-60349298D3CD} URL = http://www.bing.com/...=MSSEDF&pc=MSE1

SearchScopes: HKU\S-1-5-21-2961404673-414218333-4232183137-1001 -> {6C0BCDBF-E321-4B06-A865-F0CB012778D3} URL = http://www-searching...q={searchTerms}

SearchScopes: HKU\S-1-5-21-2961404673-414218333-4232183137-1001 -> {7F4EFF06-7032-458e-AE16-1C1D8255C28A} URL = http://www-searching...q={searchTerms}

SearchScopes: HKU\S-1-5-21-2961404673-414218333-4232183137-1001 -> {9D104B0D-4B45-48A3-8222-54140634588F} URL = http://www-searching...q={searchTerms}

SearchScopes: HKU\S-1-5-21-2961404673-414218333-4232183137-1001 -> {A33DB9FD-7A8A-496E-92D3-9CFCF9D9E1C9} URL = http://www-searching...q={searchTerms}

SearchScopes: HKU\S-1-5-21-2961404673-414218333-4232183137-1001 -> {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = http://nortonsafe.se...t=kwd&qsrc=2869

SearchScopes: HKU\S-1-5-21-2961404673-414218333-4232183137-1001 -> {C04B7D22-5AEC-4561-8F49-27F6269208F6} URL = http://www2.inbox.co...&iwk=245&lng=en

SearchScopes: HKU\S-1-5-21-2961404673-414218333-4232183137-1001 -> {C9EB2C4F-47E5-411E-85DA-B6F748ED2C13} URL =

SearchScopes: HKU\S-1-5-21-2961404673-414218333-4232183137-1001 -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL = http://slirsredirect...t=customie10-ie

SearchScopes: HKU\S-1-5-21-2961404673-414218333-4232183137-1001 -> {F0CE452A-D6D2-4EFC-B4A6-5444870DDF3D} URL = http://www-searching...q={searchTerms}

SearchScopes: HKU\S-1-5-21-2961404673-414218333-4232183137-1001 -> {F18F2FF9-0286-4EAD-A017-951B00125A36} URL = http://www.trovi.com...rchTerms}&SSPV=

SearchScopes: HKU\S-1-5-21-2961404673-414218333-4232183137-1001 -> {F7C78C08-3CC7-416F-B827-7C1785ABBDA8} URL = http://www-searching...q={searchTerms}

BHO: No Name -> {A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C} -> No File

BHO: frEoe2you -> {bab3f72a-a8c6-46f8-99a2-29aa3f086e0b} -> C:\Program Files (x86)\frEoe2you\Llta6cxaOTjYQN.x64.dll [2015-03-06] ()

BHO-x32: frEoe2you -> {bab3f72a-a8c6-46f8-99a2-29aa3f086e0b} -> C:\Program Files (x86)\frEoe2you\Llta6cxaOTjYQN.dll [2015-03-06] ()

Toolbar: HKU\S-1-5-21-2961404673-414218333-4232183137-1001 -> No Name - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No File

Winsock: Catalog9 01 C:\WINDOWS\SysWOW64\ColorMedia.dll [301168] (CartCrunch Israel Ltd.)

Winsock: Catalog9 02 C:\WINDOWS\SysWOW64\ColorMedia.dll [301168] (CartCrunch Israel Ltd.)

Winsock: Catalog9 03 C:\WINDOWS\SysWOW64\ColorMedia.dll [301168] (CartCrunch Israel Ltd.)

Winsock: Catalog9 04 C:\WINDOWS\SysWOW64\ColorMedia.dll [301168] (CartCrunch Israel Ltd.)

Winsock: Catalog9 16 C:\WINDOWS\SysWOW64\ColorMedia.dll [301168] (CartCrunch Israel Ltd.)

Winsock: Catalog9-x64 01 C:\WINDOWS\system32\ColorMedia64.dll [344440] (CartCrunch Israel Ltd.)

Winsock: Catalog9-x64 02 C:\WINDOWS\system32\ColorMedia64.dll [344440] (CartCrunch Israel Ltd.)

Winsock: Catalog9-x64 03 C:\WINDOWS\system32\ColorMedia64.dll [344440] (CartCrunch Israel Ltd.)

Winsock: Catalog9-x64 04 C:\WINDOWS\system32\ColorMedia64.dll [344440] (CartCrunch Israel Ltd.)

Winsock: Catalog9-x64 16 C:\WINDOWS\system32\ColorMedia64.dll [344440] (CartCrunch Israel Ltd.)

Tcpip\Parameters: [DhcpNameServer] 172.27.35.1

Tcpip\..\Interfaces\{88050F13-6393-4F81-8AB9-5A56BEBA3659}: [NameServer] 31.168.228.244,82.166.96.242

Tcpip\..\Interfaces\{9987A74A-52B8-491E-9D89-D665646FB8BD}: [NameServer] 31.168.228.244,82.166.96.242

Tcpip\..\Interfaces\{EE88AD8C-77A7-4060-8A74-C7F3D99B2A06}: [NameServer] 31.168.228.244,82.166.96.242

StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:

========

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)

FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2014-01-06] (Google, Inc.)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\Program Files (x86)\Microsoft Office\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-09-12] (Microsoft Corporation)

FF Plugin-x32: @staging.google.com/globalUpdate Update;version=10 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll [2015-02-04] (globalUpdate)

FF Plugin-x32: @staging.google.com/globalUpdate Update;version=4 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll [2015-02-04] (globalUpdate)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll [2014-11-13] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll [2014-11-13] (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)

FF HKLM\...\Firefox\Extensions: [{5081D2D4-1637-404c-B74F-50526718257D}] - C:\Program Files\shopperz\Firefox

FF HKLM-x32\...\Firefox\Extensions: [{5081D2D4-1637-404c-B74F-50526718257D}] - C:\Program Files\shopperz\Firefox

FF HKU\S-1-5-21-2961404673-414218333-4232183137-1001\...\Firefox\Extensions: [{AAC83427-BA95-CD20-6216-ACF1FD53519D}] - C:\Program Files (x86)\ver9SpeedCheck\187.xpi

FF Extension: SpeedCheck - C:\Program Files (x86)\ver9SpeedCheck\187.xpi [2015-02-15]

Chrome:

=======

CHR dev: Chrome dev build detected! <======= ATTENTION

CHR Profile: C:\Users\Bill\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Newhub) - C:\Users\Bill\AppData\Local\Google\Chrome\User Data\Default\Extensions\aoejbmmillcdifgagjpdlaamnalbielp [2014-03-28]

CHR Extension: (Google Docs) - C:\Users\Bill\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-03-07]

CHR Extension: (Google Drive) - C:\Users\Bill\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-03-07]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Bill\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-11-14]

CHR Extension: (YouTube) - C:\Users\Bill\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-03-07]

CHR Extension: (Google Search) - C:\Users\Bill\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-03-07]

CHR Extension: (JavaScript Notepad) - C:\Users\Bill\AppData\Local\Google\Chrome\User Data\Default\Extensions\eemkmiehbcigiognajmhgfgglomdbddc [2015-03-03]

CHR Extension: (VideoDownloadConverter) - C:\Users\Bill\AppData\Local\Google\Chrome\User Data\Default\Extensions\jkmljihjgjdghdhggolmhbjekicljfci [2014-01-19]

CHR Extension: (PlusHD Q-9.1V14.01) - C:\Users\Bill\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcdeaofcapijfmeopimkgcepdpbdepnb [2015-01-14]

CHR Extension: (TransferBigFilescom Gmail Extension) - C:\Users\Bill\AppData\Local\Google\Chrome\User Data\Default\Extensions\lajnjaghjodocddaglgghffgacnoepgf [2015-02-28]

CHR Extension: (Google Wallet) - C:\Users\Bill\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-21]

CHR Extension: (Iminent NewTab) - C:\Users\Bill\AppData\Local\Google\Chrome\User Data\Default\Extensions\nociobghckdhokecfeajdpimjeapnopn [2015-02-13]

CHR Extension: (No Name) - C:\Users\Bill\AppData\Local\Google\Chrome\User Data\Default\Extensions\nongkkjjhbjloiienhkhphhjjlnlnbfe [2015-02-11]

CHR Extension: (Vosteran New Tab) - C:\Users\Bill\AppData\Local\Google\Chrome\User Data\Default\Extensions\oilkkkefbalmbfppgjmgjoefbclebkce [2015-01-14]

CHR Extension: (MapsGalaxy) - C:\Users\Bill\AppData\Local\Google\Chrome\User Data\Default\Extensions\pcpehlgijbdajfafffojllcaecaecngb [2014-01-12]

CHR Extension: (Gmail) - C:\Users\Bill\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-03-07]

CHR HKLM\...\Chrome\Extension: [oilkkkefbalmbfppgjmgjoefbclebkce] - https://clients2.goo...ice/update2/crx

CHR HKU\S-1-5-21-2961404673-414218333-4232183137-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [aoejbmmillcdifgagjpdlaamnalbielp] - C:\Users\Bill\AppData\Local\nwhb-v9.4.15.crx [2014-03-28]

CHR HKU\S-1-5-21-2961404673-414218333-4232183137-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [oilkkkefbalmbfppgjmgjoefbclebkce] - https://clients2.goo...ice/update2/crx

CHR HKLM-x32\...\Chrome\Extension: [oilkkkefbalmbfppgjmgjoefbclebkce] - https://clients2.goo...ice/update2/crx

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 05a601a1; c:\Program Files (x86)\EngineRunner\EngineRunner.dll [1608704 2015-02-28] () [File not signed]

S2 372ab9f0; c:\Program Files (x86)\Optimizer Pro 3.31\OptProMon.dll [1597008 2015-01-14] ()

R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [231040 2012-10-31] (Qualcomm Atheros Commnucations) [File not signed]

R2 CltMngSvc; C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe [2948880 2015-02-19] (Client Connect LTD)

R2 ColorMedia; C:\ProgramData\PicColor Utility\ColorMedia.exe [1844232 2015-01-27] (CartCrunch Israel Ltd.) [File not signed]

R2 Easy Launcher; C:\Program Files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe [1593976 2012-09-05] (Samsung Electronics CO., LTD.)

S2 globalUpdate; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [68608 2015-02-04] (globalUpdate) [File not signed]

S3 globalUpdatem; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [68608 2015-02-04] (globalUpdate) [File not signed]

R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [3943104 2012-08-14] (Symantec Corporation)

R2 PicColor Service; C:\ProgramData\PicColor Utility\PicColor.exe [567296 2015-02-03] () [File not signed]

R2 SMUpd; C:\Program Files\Common Files\Goobzo\GBUpdate\smu.exe [2719592 2015-02-02] (Search Module Ltd.)

R2 Update Solution Real; C:\Program Files (x86)\Solution Real\updateSolutionReal.exe [413936 2015-03-15] ()

R2 Util Solution Real; C:\Program Files (x86)\Solution Real\bin\utilSolutionReal.exe [413936 2015-03-15] ()

R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-11-19] (Microsoft Corporation)

R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-11-19] (Microsoft Corporation)

R2 wpsvc_1.10.0.5; C:\Program Files (x86)\WordProser_1.10.0.5\Service\wpsvc.exe [277584 2014-12-11] (Word Proser)

R2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2012-10-31] (Atheros) [File not signed]

S2 BrsHelper; C:\PROGRA~2\YTDOWN~1\BROWSE~2.EXE [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [35496 2012-07-09] (Advanced Micro Devices, Inc.)

S2 APXACC; C:\Windows\system32\DRIVERS\appexDrv.sys [199008 2012-06-22] (AppEx Networks Corporation)

R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [91648 2012-08-21] (Advanced Micro Devices)

R3 BTATH_HID; C:\Windows\system32\DRIVERS\btath_hid.sys [222360 2012-10-31] (Qualcomm Atheros)

R3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [76952 2012-10-31] (Qualcomm Atheros)

R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-09-24] (Microsoft Corporation)

R1 ccSet_NARA; C:\Windows\system32\drivers\NARAx64\0401000.00E\ccSetx64.sys [168608 2012-05-25] (Symantec Corporation)

S3 RadioHIDMini; C:\Windows\System32\drivers\RadioHIDMini.sys [23408 2012-07-27] (Windows ® Win 7 DDK provider) [File not signed]

R3 SMUpdd; C:\Program Files\Common Files\Goobzo\GBUpdate\smw.sys [42856 2015-02-02] ()

R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-11-19] (Microsoft Corporation)

R2 webinstrNHKT; C:\WINDOWS\system32\Drivers\webinstrNHKT.sys [50264 2015-02-15] ()

R1 wpnfd_1_10_0_5; C:\Windows\System32\drivers\wpnfd_1_10_0_5.sys [58240 2014-12-11] (Word Proser)

R1 {1d7d694e-604c-4da2-9100-b2601d3a1c57}Gw64; C:\Windows\System32\drivers\{1d7d694e-604c-4da2-9100-b2601d3a1c57}Gw64.sys [48792 2015-01-25] (StdLib)

R1 {31c21995-b861-4864-ab50-4a53fbca73d4}Gw64; C:\Windows\System32\drivers\{31c21995-b861-4864-ab50-4a53fbca73d4}Gw64.sys [48784 2015-02-04] (StdLib)

R1 {5c281c6e-0132-4ac6-ad9d-d1d95d218412}Gw64; C:\Windows\System32\drivers\{5c281c6e-0132-4ac6-ad9d-d1d95d218412}Gw64.sys [48792 2015-01-23] (StdLib)

R1 {df8eec40-f909-439c-9ffe-3fee212f71b9}Gw64; C:\Windows\System32\drivers\{df8eec40-f909-439c-9ffe-3fee212f71b9}Gw64.sys [48784 2015-02-01] (StdLib)

S1 cherimoya; system32\drivers\cherimoya.sys [X]

S3 MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [X]

R3 SPPD; \??\C:\WINDOWS\system32\drivers\SPPD.sys [X]

S1 ssnfd_1_10_0_5; system32\drivers\ssnfd_1_10_0_5.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-15 15:29 - 2015-03-15 15:29 - 00000000 ___RD () C:\Users\Bill\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices

2015-03-15 15:16 - 2015-03-15 15:16 - 00000000 ____D () C:\Program Files (x86)\ProcessInit

2015-03-15 15:15 - 2015-03-15 15:15 - 00000000 ____D () C:\ProgramData\2a03dba000000bc6

2015-03-15 14:51 - 2015-03-15 14:53 - 00038179 _____ () C:\Users\Bill\Desktop\Addition.txt

2015-03-15 14:48 - 2015-03-15 15:29 - 00025487 _____ () C:\Users\Bill\Desktop\FRST.txt

2015-03-15 14:47 - 2015-03-15 15:29 - 00000000 ____D () C:\FRST

2015-03-15 14:47 - 2015-03-15 14:42 - 02095616 _____ (Farbar) C:\Users\Bill\Desktop\FRST64.exe

2015-03-15 14:41 - 2015-01-29 14:45 - 01763352 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll

2015-03-15 14:41 - 2015-01-29 14:34 - 01488040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll

2015-03-15 14:39 - 2015-02-12 13:40 - 22291584 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll

2015-03-15 14:39 - 2015-02-12 13:34 - 19731824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll

2015-03-15 14:39 - 2015-02-07 19:57 - 01090048 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll

2015-03-15 14:39 - 2015-02-07 19:49 - 00791040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll

2015-03-15 14:39 - 2015-01-27 21:31 - 00402432 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPhoto.dll

2015-03-15 14:39 - 2015-01-27 21:11 - 00357376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPhoto.dll

2015-03-15 14:39 - 2015-01-27 19:47 - 02501368 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe

2015-03-15 14:39 - 2015-01-27 19:41 - 02207488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe

2015-03-15 14:39 - 2015-01-21 01:54 - 01384712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll

2015-03-15 14:39 - 2015-01-21 01:15 - 01123848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll

2015-03-15 14:39 - 2014-12-11 01:36 - 00046456 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockScreenContentServer.exe

2015-03-06 10:26 - 2015-03-06 10:26 - 00000000 ____D () C:\Program Files (x86)\frEoe2you

2015-03-06 10:06 - 2015-03-06 10:26 - 00000000 ____D () C:\Program Files (x86)\FllaashCoupon

2015-03-04 12:13 - 2015-03-15 14:01 - 00000000 ____D () C:\Users\Bill\Documents\ProPCCleaner

2015-03-03 20:02 - 2015-03-06 10:06 - 00000000 ____D () C:\Program Files (x86)\deaLstEr

2015-03-03 20:02 - 2015-03-03 20:02 - 00000000 ____D () C:\Program Files (x86)\JavaScript Notepad

2015-03-03 20:01 - 2015-03-06 10:06 - 00000000 ____D () C:\Program Files (x86)\DiscountLeocaaToR

2015-03-03 20:01 - 2015-03-03 20:01 - 00000000 ____D () C:\Program Files (x86)\PriceDownlOaderr

2015-02-28 19:55 - 2015-02-28 19:55 - 00000000 ____D () C:\Program Files (x86)\lOewraite

2015-02-28 19:54 - 2015-02-28 19:55 - 00000000 ____D () C:\Program Files (x86)\TransferBigFilescom Gmail Extension

2015-02-28 19:54 - 2015-02-28 19:54 - 00000000 ____D () C:\ProgramData\aggnakmglaoeailapkcgnblfommppdpe

2015-02-28 19:53 - 2015-03-06 10:06 - 00000000 ____D () C:\Program Files (x86)\offferduEaell

2015-02-28 19:53 - 2015-03-06 10:06 - 00000000 ____D () C:\Program Files (x86)\buyandBrowsea

2015-02-28 19:53 - 2015-02-28 19:53 - 00000000 ____D () C:\Program Files (x86)\nitRodeeal

2015-02-28 19:53 - 2015-02-28 19:53 - 00000000 ____D () C:\Program Files (x86)\nicenfRee

2015-02-28 19:52 - 2015-02-28 19:52 - 00000000 ____D () C:\ProgramData\ChampionDeals

2015-02-28 19:22 - 2015-02-28 19:23 - 00004222 _____ () C:\WINDOWS\System32\Tasks\SPBIW_UpdateTask_Time_3534343030393132372d2d55506c2a5a55576c412334

2015-02-28 19:21 - 2015-02-28 19:21 - 00003120 _____ () C:\WINDOWS\System32\Tasks\Logon_Trigger_WPS_Mon_Task

2015-02-28 19:21 - 2015-02-28 19:21 - 00003074 _____ () C:\WINDOWS\System32\Tasks\UNELEVATE_18080

2015-02-28 19:21 - 2015-02-28 19:21 - 00000000 ____D () C:\ProgramData\Ralink

2015-02-28 19:20 - 2015-02-28 19:21 - 00000000 ____D () C:\Program Files (x86)\Linksys AE6000

2015-02-28 19:20 - 2015-02-28 19:20 - 00000000 ____D () C:\ProgramData\Cisco Systems

2015-02-28 19:13 - 2015-03-03 19:42 - 00000000 ____D () C:\Users\Bill\AppData\Local\avayvaxvaa

2015-02-28 19:13 - 2015-02-28 19:13 - 00003444 _____ () C:\WINDOWS\System32\Tasks\avayvaxvaa

2015-02-28 19:12 - 2015-02-28 19:12 - 00000000 ____D () C:\Program Files (x86)\EngineRunner

2015-02-24 23:44 - 2015-02-24 23:44 - 00003150 _____ () C:\WINDOWS\System32\Tasks\UNELEVATE_22256

2015-02-24 23:35 - 2015-03-06 10:06 - 00000000 ____D () C:\Program Files (x86)\bruowwseAndsshop

2015-02-24 23:35 - 2015-02-24 23:36 - 00000000 ____D () C:\Program Files (x86)\Pyramid Run

2015-02-24 16:24 - 2015-03-06 10:06 - 00000000 ____D () C:\Program Files (x86)\appsaVe

2015-02-24 16:23 - 2015-02-24 16:24 - 00000000 ____D () C:\Program Files (x86)\buyaandbrowse

2015-02-24 16:19 - 2014-12-13 17:28 - 00513488 _____ () C:\WINDOWS\SysWOW64\locale.nls

2015-02-24 16:19 - 2014-12-13 17:28 - 00513488 _____ () C:\WINDOWS\system32\locale.nls

2015-02-24 16:19 - 2014-10-28 21:27 - 01200128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll

2015-02-24 16:19 - 2014-10-28 21:27 - 00323072 _____ (Microsoft Corporation) C:\WINDOWS\system32\GlobCollationHost.dll

2015-02-24 16:19 - 2014-10-28 21:04 - 00868352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll

2015-02-24 16:19 - 2014-10-28 21:04 - 00200704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GlobCollationHost.dll

2015-02-24 15:50 - 2015-03-15 15:09 - 00003738 _____ () C:\WINDOWS\System32\Tasks\DriverRestore_ScheduledScan

2015-02-24 15:50 - 2015-03-15 15:09 - 00003592 _____ () C:\WINDOWS\System32\Tasks\DriverRestore_DailyScan

2015-02-24 15:50 - 2015-02-24 15:50 - 00001039 _____ () C:\Users\Public\Desktop\DriverRestore.lnk

2015-02-24 15:50 - 2015-02-24 15:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverRestore

2015-02-24 15:50 - 2014-11-24 17:09 - 00020872 _____ (Phoenix Technologies) C:\WINDOWS\SysWOW64\Drivers\DrvAgent64.SYS

2015-02-24 15:49 - 2015-03-15 15:02 - 00000000 ____D () C:\Program Files (x86)\DriverRestore

2015-02-24 15:48 - 2015-02-28 19:13 - 00000000 ____D () C:\ProgramData\40ee09c0000064f3

2015-02-24 15:37 - 2015-03-15 13:56 - 00000020 _____ () C:\Users\Bill\AppData\Roaming\appdataFr3.bin

2015-02-24 15:34 - 2015-02-24 15:34 - 00000000 ____D () C:\ProgramData\cheapcoup

2015-02-24 11:39 - 2015-03-15 14:00 - 00003450 _____ () C:\WINDOWS\System32\Tasks\ProPCCleaner_Popup

2015-02-24 11:39 - 2015-02-24 11:39 - 00003186 _____ () C:\WINDOWS\System32\Tasks\ProPCCleaner_Start

2015-02-24 11:39 - 2015-02-24 11:39 - 00000000 ____D () C:\Users\Bill\AppData\Local\Pro_PC_Cleaner

2015-02-24 11:35 - 2015-02-24 11:35 - 00000000 ____D () C:\Users\Bill\AppData\Local\Cyberlink

2015-02-19 10:25 - 2015-02-28 19:23 - 00001586 _____ () C:\WINDOWS\wininit.ini

2015-02-15 12:07 - 2015-02-24 15:40 - 00000000 ____D () C:\WINDOWS\system32\MpEngineStore

2015-02-15 12:03 - 2015-02-15 12:03 - 00000000 ____D () C:\9b57c021e1f305c24cdd076e

2015-02-15 11:57 - 2015-03-15 15:27 - 00000420 _____ () C:\WINDOWS\Tasks\SpeedCheck Update.job

2015-02-15 11:57 - 2015-02-15 11:57 - 00003058 _____ () C:\WINDOWS\System32\Tasks\SpeedCheck Update

2015-02-15 11:57 - 2015-02-15 11:57 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_Kernel_webinstrNHKT_01009.Wdf

2015-02-15 11:57 - 2015-02-15 11:56 - 00050264 _____ () C:\WINDOWS\system32\Drivers\webinstrNHKT.sys

2015-02-15 11:56 - 2015-02-15 11:56 - 00000000 ____D () C:\Program Files (x86)\ver9SpeedCheck

2015-02-13 09:45 - 2015-03-15 14:31 - 00000000 ____D () C:\Program Files\shopperz

2015-02-13 09:45 - 2015-02-13 09:45 - 00000045 _____ () C:\user.js

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-15 15:31 - 2012-11-14 02:23 - 00000360 _____ () C:\WINDOWS\Tasks\Xerox PhotoCafe Communicator.job

2015-03-15 15:30 - 2015-01-14 15:12 - 00000000 ____D () C:\Users\Bill\AppData\Local\ospd_us_657

2015-03-15 15:29 - 2014-11-19 20:23 - 01911558 _____ () C:\WINDOWS\WindowsUpdate.log

2015-03-15 15:29 - 2013-03-06 10:53 - 00002347 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2015-03-15 15:29 - 2012-07-26 03:59 - 00000000 ____D () C:\WINDOWS\CbsTemp

2015-03-15 15:27 - 2015-01-14 15:14 - 00000906 _____ () C:\WINDOWS\Tasks\globalUpdateUpdateTaskMachineCore.job

2015-03-15 15:27 - 2015-01-14 15:11 - 00002167 _____ () C:\WINDOWS\patsearch.bin

2015-03-15 15:27 - 2015-01-14 10:23 - 00000000 ____D () C:\Program Files (x86)\Solution Real

2015-03-15 15:27 - 2014-11-13 10:20 - 00000912 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

2015-03-15 15:27 - 2012-07-26 01:26 - 00000269 _____ () C:\WINDOWS\win.ini

2015-03-15 15:26 - 2015-02-04 09:49 - 00005360 _____ () C:\WINDOWS\SysWOW64\ColorMedia.ini

2015-03-15 15:26 - 2015-02-04 09:49 - 00002960 _____ () C:\WINDOWS\SysWOW64\ColorMediaOff.ini

2015-03-15 15:26 - 2015-02-04 09:49 - 00002960 _____ () C:\WINDOWS\system32\ColorMediaOff.ini

2015-03-15 15:26 - 2013-08-22 10:46 - 00290506 _____ () C:\WINDOWS\setupact.log

2015-03-15 15:26 - 2013-08-22 10:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT

2015-03-15 15:25 - 2014-09-24 03:03 - 01220380 _____ () C:\WINDOWS\PFRO.log

2015-03-15 15:23 - 2013-08-22 11:36 - 00000000 ___RD () C:\WINDOWS\ToastData

2015-03-15 15:22 - 2013-02-15 00:44 - 00000000 ____D () C:\ProgramData\Microsoft Help

2015-03-15 15:15 - 2013-02-14 21:55 - 00000000 ____D () C:\Users\Bill\AppData\Local\CrashDumps

2015-03-15 15:00 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\system32\sru

2015-03-15 14:54 - 2015-01-14 15:14 - 00000910 _____ () C:\WINDOWS\Tasks\globalUpdateUpdateTaskMachineUA.job

2015-03-15 14:51 - 2014-09-24 03:15 - 00863592 _____ () C:\WINDOWS\system32\PerfStringBackup.INI

2015-03-15 14:38 - 2013-02-14 22:02 - 00003596 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2961404673-414218333-4232183137-1001

2015-03-15 14:30 - 2014-11-19 20:30 - 00000000 ____D () C:\Users\Bill

2015-03-15 14:30 - 2013-08-22 09:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI

2015-03-15 14:25 - 2014-11-13 10:20 - 00000916 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job

2015-03-15 14:16 - 2014-11-19 22:15 - 00003906 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{332AEA28-16B4-408B-A387-0183146100E6}

2015-03-15 14:09 - 2013-08-22 11:36 - 00000000 ___HD () C:\WINDOWS\system32\GroupPolicy

2015-03-15 14:09 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\GroupPolicy

2015-03-15 14:00 - 2013-12-07 12:57 - 00000000 ____D () C:\Users\Bill\AppData\Roaming\HpUpdate

2015-03-15 14:00 - 2012-11-14 02:15 - 00000000 ____D () C:\ProgramData\WinClon

2015-03-15 13:57 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\AppReadiness

2015-03-06 10:26 - 2015-02-09 13:48 - 00000000 ____D () C:\ProgramData\9280794494656593764

2015-03-03 20:52 - 2012-11-14 02:19 - 00000000 ____D () C:\ProgramData\Temp

2015-03-03 09:17 - 2014-12-21 14:43 - 00295552 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe

2015-02-28 19:39 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\system32\NDF

2015-02-28 19:21 - 2012-11-14 01:17 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information

2015-02-28 19:13 - 2015-02-12 10:02 - 00000000 ____D () C:\Program Files (x86)\SearchProtect

2015-02-25 00:04 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\tracing

2015-02-24 23:50 - 2014-11-19 21:14 - 00000000 ____D () C:\ProgramData\Package Cache

2015-02-23 10:06 - 2012-11-14 02:19 - 00000000 ____D () C:\Program Files (x86)\CyberLink

2015-02-19 10:17 - 2013-08-22 10:44 - 00481120 _____ () C:\WINDOWS\system32\FNTCACHE.DAT

2015-02-15 12:03 - 2013-08-27 08:35 - 00000000 ____D () C:\WINDOWS\system32\MRT

2015-02-15 12:03 - 2013-03-03 14:49 - 116773704 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

2015-02-15 12:02 - 2013-03-06 10:52 - 00000000 ____D () C:\Program Files (x86)\Adobe

2015-02-15 11:57 - 2014-12-11 11:43 - 00000000 ____D () C:\WINDOWS\system32\appraiser

2015-02-15 11:57 - 2014-09-24 05:50 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel

==================== Files in the root of some directories =======

2015-02-24 15:37 - 2015-03-15 13:56 - 0000020 _____ () C:\Users\Bill\AppData\Roaming\appdataFr3.bin

2014-09-01 04:18 - 2014-09-01 04:18 - 0001248 _____ () C:\Users\Bill\AppData\Roaming\DUWHVM

2015-01-16 15:31 - 2015-01-16 15:31 - 0000010 _____ () C:\Users\Bill\AppData\Roaming\mbam.context.scan

2013-12-20 10:08 - 2015-01-15 10:22 - 0000222 _____ () C:\Users\Bill\AppData\Roaming\WB.CFG

2014-02-24 21:20 - 2014-03-18 09:38 - 0004608 _____ () C:\Users\Bill\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2015-01-15 10:23 - 2015-01-15 10:23 - 0000010 _____ () C:\Users\Bill\AppData\Local\DSI.DAT

2015-01-15 10:22 - 2015-01-15 10:22 - 0022528 _____ () C:\Users\Bill\AppData\Local\dsisetup22337032.exe

2014-03-28 09:08 - 2014-03-28 09:08 - 0686631 _____ () C:\Users\Bill\AppData\Local\nwhb-v9.4.15.crx

2014-11-18 17:56 - 2014-11-18 17:56 - 0000000 _____ () C:\Users\Bill\AppData\Local\{14715840-CEAE-46D1-BF63-B9A253D2C280}

2013-12-07 12:53 - 2013-12-07 12:53 - 0000057 _____ () C:\ProgramData\Ament.ini

2012-11-14 02:23 - 2012-08-08 00:07 - 2258432 _____ (Samsung Electronics) C:\ProgramData\MakeMarkerFile.exe

2012-11-14 02:23 - 2012-08-07 06:11 - 0003196 _____ () C:\ProgramData\MakeMarkerFile.xml

Files to move or delete:

====================

C:\ProgramData\MakeMarkerFile.exe

C:\Users\EasySurvey\EasySurvey.exe

Some content of TEMP:

====================

C:\Users\Bill\AppData\Local\Temp\eon7rwm6.dll

C:\Users\Bill\AppData\Local\Temp\tu17p84.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-03-15 14:24

==================== End Of Log ============================

addition.txt

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015

Ran by Bill at 2015-03-15 15:31:41

Running from C:\Users\Bill\Desktop

Boot Mode: Normal

==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Reader XI (11.0.10) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)

AMD Catalyst Install Manager (HKLM\...\{403A4E7A-D239-04D8-6A3D-31DD203C018D}) (Version: 8.0.881.0 - Advanced Micro Devices, Inc.)

Cisco Linksys AE6000 Driver (HKLM-x32\...\{02221266-B345-4544-A5C3-A995520E774D}) (Version: 1.1.0.3 - Cisco Consumer Products LLC)

CyberLink PowerDVD 10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.4421.02 - CyberLink Corp.)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

Driver Restore (HKLM\...\Driver Restore) (Version: 2.3.0.0 - 383 Media, Inc.)

Easy File Share (HKLM-x32\...\{A7C37D4B-F37A-42E8-9B6A-B28C18AD4C12}) (Version: 1.3.4 - Samsung Electronics CO.,LTD.)

EngineRunner (HKLM-x32\...\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{5a601a1}) (Version: - Software Publisher) <==== ATTENTION

E-POP (HKLM-x32\...\{F06DD8D9-9DC8-430C-835C-C9BF21E05CC1}) (Version: 1.0.1 - Samsung Electronics CO., LTD.)

Galería de fotos (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Galerie de photos (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.95 - Google Inc.)

Google+ Auto Backup (HKLM-x32\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google)

Help Desk (HKLM\...\{18BB06D9-8518-48E5-88F7-5AE1DF02546B}) (Version: 1.0.6 - Samsung Electronics CO., LTD.)

HP ENVY 5530 series Basic Device Software (HKLM\...\{24284F3A-B8F3-4123-AE25-2B6D1BEC524C}) (Version: 30.0.1093.41190 - Hewlett-Packard Co.)

HP ENVY 5530 series Help (HKLM-x32\...\{97EAE055-1BE8-4775-8101-453E9715EC3F}) (Version: 30.0.0 - Hewlett Packard)

HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.7702 - HP)

HP Update (HKLM-x32\...\{6F1C00D2-25C2-4CBA-8126-AE9A6E2E9CD5}) (Version: 5.003.003.001 - Hewlett-Packard)

Itibiti RTC (x32 Version: 0.0.1 - Itibiti Inc) Hidden

Media Downloader version 1.5 (HKLM-x32\...\Media Downloader_is1) (Version: 1.5 - Media Downloader)

Microsoft Office (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.6120.5004 - Microsoft Corporation)

Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)

Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Norton Online Backup (HKLM-x32\...\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.2.3.51 - Symantec Corporation)

Norton Online Backup ARA (x32 Version: 4.1.0.14 - Symantec Corporation) Hidden

OneSoftPerDay 025.657 (HKLM-x32\...\ospd_us_657_is1) (Version: - ONESOFTPERDAY)

Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)

PicColor Utility (HKLM-x32\...\PicColor Utility) (Version: 1.0.0.2184 - )

PlusHD Q-9.1V14.01 (HKLM-x32\...\PlusHD Q-9.1V14.01) (Version: 1.36.01.08 - PlusHD Q-9.1V14.01)

Product Improvement Study for HP ENVY 5530 series (HKLM\...\{F0F71D41-68E3-4721-BD66-E684F9B4A87B}) (Version: 30.0.1093.41190 - Hewlett-Packard Co.)

Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.0.214 - Qualcomm Atheros Communications)

Qualcomm Atheros Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Qualcomm Atheros)

Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6702 - Realtek Semiconductor Corp.)

Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.39030 - Realtek Semiconductor Corp.)

Recovery (HKLM-x32\...\{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}) (Version: 6.0.7.2 - Samsung Electronics CO., LTD.)

Remote Desktop Access (VuuPC) (HKLM-x32\...\VOPackage) (Version: 1.0.0.0 - CMI Limited) <==== ATTENTION

S Agent (Version: 1.0.8 - Samsung Electronics CO., LTD.) Hidden

Search module (HKLM-x32\...\Search module) (Version: - Goobzo)

Search Protect (HKLM-x32\...\SearchProtect) (Version: 2.21.20.22 - Client Connect LTD) <==== ATTENTION

Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)

Settings (HKLM-x32\...\{52E5DE60-C96B-42CC-9A37-FE04725940AE}) (Version: 2.0.0 - Samsung Electronics CO., LTD.)

Software Updater (HKLM-x32\...\SoftwareUpdater) (Version: 1.0.0.0 - Software Updater Ltd)

SpeedCheck (HKLM-x32\...\0FE96EBF-28D5-C985-634A-C147091FE3F9) (Version: - SpeedCheck-software) <==== ATTENTION

Support Center (HKLM\...\{73280CF7-9471-4FB6-B018-E5FD7A09F1AF}) (Version: 2.0.13 - Samsung Electronics CO., LTD.)

Support Center FAQ (x32 Version: 1.0.5 - Samsung Electronics CO., LTD.) Hidden

SW Update (HKLM-x32\...\{20F96D9A-41A4-4EFA-997B-B972F0E1E26A}) (Version: 2.0.24 - Samsung Electronics CO., LTD.)

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.14.2 - Synaptics Incorporated)

User Guide (HKLM-x32\...\{C7588111-1A12-4EFE-8CA0-DA4344480D92}) (Version: 1.4.00 - Samsung Electronics CO., LTD.)

WinCheck (HKLM-x32\...\wincheck) (Version: 1.0.0.0 - WinCheck) <==== ATTENTION!

Windows Driver Package - Samsung Electronics Co. Ltd. (RadioHIDMini) HIDClass (07/27/2012 20.57.1.735) (HKLM\...\9F04C462DAB591BDCCE784F77E4D4F1736010B92) (Version: 07/27/2012 20.57.1.735 - Samsung Electronics Co. Ltd.)

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)

Word Proser 1.10.0.5 (HKLM-x32\...\WordProser_1.10.0.5) (Version: 1.10.0.5 - Word Proser) <==== ATTENTION

Xerox PhotoCafe (HKLM-x32\...\Xerox PhotoCafe) (Version: 1.0.0.6162 - Xerox)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

==================== Restore Points =========================

27-01-2015 16:47:29 Scheduled Checkpoint

01-02-2015 16:15:28 Removed GeekBuddy.

09-02-2015 13:27:18 Windows Update

11-02-2015 10:53:33 Configured PowerDVD

15-02-2015 11:50:07 Windows Update

23-02-2015 10:03:01 Configured Power2Go

28-02-2015 19:13:17 Windows Update

15-03-2015 14:25:05 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 09:25 - 2013-08-22 09:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {01FB21A5-F54E-4173-B3E3-0FB186D94F5B} - System32\Tasks\EOSSVMA => C:\ProgramData\38b2bc6477024acda7d41a3bfc14c3eb\38b2bc6477024acda7d41a3bfc14c3eb.exe [2015-02-03] ()

Task: {0DA05C06-F8FD-4A1E-A1DA-61BB6204CCAD} - System32\Tasks\SearchSnacks Auto Updater 1.10.0.5 Core => C:\Program Files (x86)\SearchSnacks_1.10.0.5\Update\SearchSnacksAutoUpdateClient.exe

Task: {10A298B7-5547-4390-BC2E-B98AE06835A2} - System32\Tasks\advRecovery => C:\Program Files\Samsung\Recovery\WCScheduler.exe [2012-10-15] (SEC)

Task: {12C0AAF0-1015-42BF-88EA-77BAF103D523} - System32\Tasks\avayvaxvaa => C:\Users\Bill\AppData\Local\avayvaxvaa\avayvaxvaa.exe [2015-02-19] () <==== ATTENTION

Task: {193B0360-F846-4F28-9AD9-CD8DFACC702B} - System32\Tasks\Logon_Trigger_WPS_Mon_Task => C:\Program Files (x86)\Linksys AE6000\WPS_Mon.exe [2012-12-20] (Cisco Consumer Products LLC)

Task: {1F6CE88C-9141-490F-86DD-3B42702A516F} - System32\Tasks\globalUpdateUpdateTaskMachineUA => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [2015-02-04] (globalUpdate) <==== ATTENTION

Task: {270CC987-AB25-41C3-9694-22D1E5C838EC} - System32\Tasks\DonutQuotes => C:\Program Files (x86)\donutleads\ScheduledTask.exe

Task: {45CD155C-2EDD-4BBD-B881-4A68848A6C91} - System32\Tasks\globalUpdateUpdateTaskMachineCore => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [2015-02-04] (globalUpdate) <==== ATTENTION

Task: {5253BF3F-5346-4766-835A-3B4E1FE70876} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-02-15] (Microsoft Corporation)

Task: {53C9B0F7-4EEE-452C-A2A3-88BB65E75F16} - System32\Tasks\{C5EFA263-DC63-43C5-8A8C-26FCA193F311} => pcalua.exe -a "C:\Program Files (x86)\donutleads\uninstall.exe"

Task: {55107E21-1FAB-4E11-802C-F56CAF9B48EA} - System32\Tasks\SearchSnacks Auto Updater 1.10.0.5 Pending Update => C:\Program Files (x86)\SearchSnacks_1.10.0.5\Update\SearchSnacksAutoUpdateClient.exe

Task: {5543F907-D8C0-4F68-B45E-41C6B07C636C} - System32\Tasks\Synaptics TouchPad Enhancements => \Program Files\Synaptics\SynTP\SynTPEnh.exe [2012-10-16] (Synaptics Incorporated)

Task: {57474893-BA77-4FB3-86A1-DF0523500E8D} - System32\Tasks\CleanerPro_Start => C:\Program Files (x86)\Cleaner Pro\CleanerPro.exe

Task: {5B5FD57E-CA47-4F07-95AD-6217F8287E44} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)

Task: {5CEDF6EA-39DC-4B75-B84B-E0385306490A} - System32\Tasks\SmartWeb Upgrade Trigger Task => C:\Users\Bill\AppData\Local\SmartWeb\SmartWebHelper.exe [2014-12-31] (SoftBrain Technologies Ltd.) <==== ATTENTION

Task: {64E09980-94C1-4351-A8F5-7A0A76763671} - System32\Tasks\DriverRestore_DailyScan => C:\Program Files (x86)\DriverRestore\DriverRestore.exe [2014-11-29] ()

Task: {6BBB2931-1304-4A04-938C-2BC5167ADD72} - System32\Tasks\Settings => C:\Program Files (x86)\Samsung\Settings\sSettings.exe [2012-09-05] (Samsung Electronics CO., LTD.)

Task: {6CC812EA-A94F-4577-A460-DD9FEC2FD070} - System32\Tasks\{3916FB30-1D1B-4EEB-93E7-EA26E9C85BAC} => pcalua.exe -a C:\PROGRA~2\WSE_VO~1\\uninstall.exe -c /uninstaller

Task: {7EC57F4E-A7C9-45DC-927D-92C2384588F4} - System32\Tasks\DriverRestore_ScheduledScan => C:\Program Files (x86)\DriverRestore\DriverRestore.exe [2014-11-29] ()

Task: {84E6CCF4-D432-4C68-A7E1-664557CAA51D} - System32\Tasks\LaunchSignup => C:\Program Files (x86)\MyPC Backup\Signup Wizard.exe <==== ATTENTION

Task: {89E99110-5367-4FB9-A093-9A714AF26076} - System32\Tasks\SPBIW_UpdateTask_Time_3534343030393132372d2d55506c2a5a55576c412334 => Wscript.exe //B "C:\ProgramData\ShopperPro\spbihe.js" spbiu.exe /invoke /f:check_services /l:0 <==== ATTENTION

Task: {8B6BFEE7-D685-4327-A90A-053AB2C2838F} - System32\Tasks\ProPCCleaner_Start => C:\Program Files (x86)\Pro PC Cleaner\ProPCCleaner.exe <==== ATTENTION

Task: {A2E4DCF2-9547-422A-8C2A-432C9F6A2354} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-03-06] (Google Inc.)

Task: {A5CC1119-4A3C-4168-B9DB-29BFB8A63BEE} - System32\Tasks\SMWUpd => C:\Program Files\Common Files\Goobzo\GBUpdate\updater.exe [2015-02-02] (Goobzo) <==== ATTENTION

Task: {A7F2CC81-532F-4B81-BFFE-5082DA7E7943} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc

Task: {A7F9BEDA-BE22-4E49-B5FA-F3F7B7150DEE} - System32\Tasks\MakeMarkerFile => %ProgramData%\MakeMarkerFile.exe

Task: {B331AFB7-F299-4FAA-BFF6-06B1E1F5B4BB} - System32\Tasks\SMW_UpdateTask_Time_3534343030393132372d78782345572a4a3441325057 => Wscript.exe //B "C:\ProgramData\SearchModule\smhe.js" smu.exe /invoke /f:check_services /l:0 <==== ATTENTION

Task: {B385544D-1193-438C-8291-133CB596D553} - System32\Tasks\UNELEVATE_18080 => C:\Program Files (x86)\ShopperPro\JSDriver\1492.0.0.0\jsdrv.exe <==== ATTENTION

Task: {B849690A-86E9-4BC3-A5B3-E774B584E504} - System32\Tasks\SAgent => C:\Program Files\Samsung\S Agent\CommonAgent.exe [2012-10-03] (Samsung Electronics CO., LTD.)

Task: {BB1B31AE-1C5F-4290-A03B-A2B0555AC30B} - System32\Tasks\ProPCCleaner_Popup => C:\Program Files (x86)\Pro PC Cleaner\Splash.exe <==== ATTENTION

Task: {BDE88742-ED76-4600-ABC5-EBD90B6CA4FA} - System32\Tasks\WLANStartup => C:\Program Files (x86)\Samsung\Easy Settings\WLANStartup.exe

Task: {C1485452-FB47-439D-ABB8-9757B76D426D} - System32\Tasks\Xerox PhotoCafe Communicator => C:\ProgramData\Xerox PhotoCafe\MessageCheck.exe [2011-10-26] ()

Task: {C9C798AB-3770-49F0-8C86-873C56BAAA01} - System32\Tasks\SWUpdateAgent => C:\Program Files (x86)\Samsung\SW Update\SWMAgent.exe [2012-10-17] (Samsung Electronics CO., LTD.)

Task: {CB187E49-115F-41A3-B7EC-FEEA1FB6A379} - System32\Tasks\CleanerPro_Popup => C:\Program Files (x86)\Cleaner Pro\Splash.exe

Task: {D4656973-7430-4DDE-94D2-177E4685785F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-03-06] (Google Inc.)

Task: {E5B48B08-70DD-4EED-AC7A-C868922CB34F} - System32\Tasks\UNELEVATE_22256 => C:\Program Files (x86)\ShopperPro\JSDriver\1492.0.0.0\jsdrv.exe <==== ATTENTION

Task: {FD4B8332-62C6-48AA-801B-5C56C2E1D74F} - System32\Tasks\SpeedCheck Update => C:\Program Files (x86)\ver9SpeedCheck\r2SpeedCheckz46.exe [2015-02-15] ()

Task: {FD5723C6-22EF-4A07-803E-6B3435E20299} - System32\Tasks\HPCustParticipation HP ENVY 5530 series => C:\Program Files\HP\HP ENVY 5530 series\Bin\HPCustPartic.exe [2013-02-08] (Hewlett-Packard Co.)

Task: C:\WINDOWS\Tasks\globalUpdateUpdateTaskMachineCore.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION

Task: C:\WINDOWS\Tasks\globalUpdateUpdateTaskMachineUA.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\SpeedCheck Update.job => C:\Program Files (x86)\ver9SpeedCheck\r2SpeedCheckz46.exe

Task: C:\WINDOWS\Tasks\Xerox PhotoCafe Communicator.job => C:\ProgramData\Xerox PhotoCafe\MessageCheck.exe

==================== Loaded Modules (whitelisted) ==============

2015-02-04 09:49 - 2015-02-03 13:20 - 00567296 _____ () C:\ProgramData\PicColor Utility\PicColor.exe

2015-01-14 07:25 - 2015-03-15 14:07 - 00413936 _____ () C:\Program Files (x86)\Solution Real\updateSolutionReal.exe

2015-01-14 10:30 - 2015-03-15 14:02 - 00413936 _____ () C:\Program Files (x86)\Solution Real\bin\utilSolutionReal.exe

2012-09-05 03:50 - 2012-09-05 03:50 - 00085112 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmdServer.exe

2013-09-05 01:17 - 2013-09-05 01:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\office.odf

2010-10-20 16:23 - 2010-10-20 16:23 - 08801632 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll

2015-02-15 11:56 - 2015-02-15 11:56 - 00521728 _____ () C:\Program Files (x86)\ver9SpeedCheck\r2SpeedCheckz46.exe

2015-02-15 11:56 - 2015-02-15 11:56 - 00745984 _____ () C:\Program Files (x86)\ver9SpeedCheck\SpeedCheck.exe

2015-01-14 15:12 - 2015-01-14 20:01 - 03289768 _____ () C:\Users\Bill\AppData\Local\ospd_us_657\upospd_us_657.exe

2015-01-14 10:31 - 2015-03-15 10:25 - 00353520 _____ () C:\Program Files (x86)\Solution Real\bin\SolutionReal.PurBrowse64.exe

2015-01-14 10:31 - 2015-03-15 11:07 - 00105712 _____ () C:\Program Files (x86)\Solution Real\bin\SolutionReal.BrowserAdapter.exe

2015-01-14 10:31 - 2015-03-15 11:07 - 00123120 _____ () C:\Program Files (x86)\Solution Real\bin\SolutionReal.BrowserAdapter64.exe

2012-10-31 07:55 - 2012-10-31 07:55 - 00011264 _____ () C:\Program Files (x86)\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll

2012-10-31 07:57 - 2012-10-31 07:57 - 00012928 _____ () C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe

2015-01-18 06:57 - 2015-01-18 06:57 - 00267776 _____ () C:\Users\Bill\AppData\Local\wincheck\wincheck.exe

2015-02-28 19:12 - 2015-02-28 19:13 - 01608704 _____ () c:\Program Files (x86)\EngineRunner\EngineRunner.dll

2015-01-16 09:54 - 2015-01-16 09:54 - 00337920 _____ () C:\Program Files (x86)\Solution Real\bin\sqlite3.DLL

2012-09-05 03:50 - 2012-09-05 03:50 - 00028792 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmdWrapper.dll

2012-09-05 03:50 - 2012-09-05 03:50 - 01012856 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmd.dll

2012-09-05 03:50 - 2012-09-05 03:50 - 00110712 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsBase.dll

2012-09-05 03:50 - 2012-09-05 03:50 - 00056440 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\HookDllPS2.dll

2012-09-05 03:50 - 2012-09-05 03:50 - 00211064 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\WinCRT.dll

2015-02-28 19:21 - 2012-11-27 15:12 - 01210256 ____N () C:\Program Files (x86)\Linksys AE6000\RaWLAPI.dll

2012-09-05 03:50 - 2012-09-05 03:50 - 00026744 _____ () C:\Program Files (x86)\Samsung\Settings\EasySettingsAPI.dll

2012-09-05 03:50 - 2012-09-05 03:50 - 00110712 _____ () C:\Program Files (x86)\Samsung\Settings\EasySettingsBase.dll

2012-09-05 03:50 - 2012-09-05 03:50 - 00060536 _____ () C:\Program Files (x86)\Samsung\Settings\EasyMovieEnhancer.dll

2012-09-05 03:50 - 2012-09-05 03:50 - 00103544 _____ () C:\Program Files (x86)\Samsung\Settings\EasySettingsCmdClient.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ColorMedia => ""="service"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2961404673-414218333-4232183137-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Bill\Pictures\2012-02-19 001\DSCF9157.JPG

DNS Servers: 31.168.228.244 - 82.166.96.242

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run: => "BtTray"

HKLM\...\StartupApproved\Run32: => "Norton Online Backup"

HKU\S-1-5-21-2961404673-414218333-4232183137-1001\...\StartupApproved\Run: => "Itibiti.exe"

HKU\S-1-5-21-2961404673-414218333-4232183137-1001\...\StartupApproved\Run: => "PCKeeper2"

HKU\S-1-5-21-2961404673-414218333-4232183137-1001\...\StartupApproved\Run: => "Super Optimizer"

==================== Accounts: =============================

Administrator (S-1-5-21-2961404673-414218333-4232183137-500 - Administrator - Disabled)

Bill (S-1-5-21-2961404673-414218333-4232183137-1001 - Administrator - Enabled) => C:\Users\Bill

Guest (S-1-5-21-2961404673-414218333-4232183137-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-2961404673-414218333-4232183137-1003 - Limited - Enabled)

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:

==================

Error: (03/15/2015 03:28:48 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: MakeMarkerFile.exe, version: 1.0.0.2, time stamp: 0x5021e5e8

Faulting module name: MakeMarkerFile.exe, version: 1.0.0.2, time stamp: 0x5021e5e8

Exception code: 0xc0000417

Fault offset: 0x000000000014d7cc

Faulting process id: 0x454

Faulting application start time: 0xMakeMarkerFile.exe0

Faulting application path: MakeMarkerFile.exe1

Faulting module path: MakeMarkerFile.exe2

Report Id: MakeMarkerFile.exe3

Faulting package full name: MakeMarkerFile.exe4

Faulting package-relative application ID: MakeMarkerFile.exe5

Error: (03/15/2015 03:15:40 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: chrome.exe, version: 39.0.2171.95, time stamp: 0x548243f3

Faulting module name: chrome.dll, version: 39.0.2171.95, time stamp: 0x54823ff4

Exception code: 0x80000003

Fault offset: 0x004fd39c

Faulting process id: 0xb24

Faulting application start time: 0xchrome.exe0

Faulting application path: chrome.exe1

Faulting module path: chrome.exe2

Report Id: chrome.exe3

Faulting package full name: chrome.exe4

Faulting package-relative application ID: chrome.exe5

Error: (03/15/2015 02:33:42 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: MakeMarkerFile.exe, version: 1.0.0.2, time stamp: 0x5021e5e8

Faulting module name: MakeMarkerFile.exe, version: 1.0.0.2, time stamp: 0x5021e5e8

Exception code: 0xc0000417

Fault offset: 0x000000000014d7cc

Faulting process id: 0x6bc

Faulting application start time: 0xMakeMarkerFile.exe0

Faulting application path: MakeMarkerFile.exe1

Faulting module path: MakeMarkerFile.exe2

Report Id: MakeMarkerFile.exe3

Faulting package full name: MakeMarkerFile.exe4

Faulting package-relative application ID: MakeMarkerFile.exe5

Error: (03/15/2015 02:29:49 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: The program IEXPLORE.EXE version 11.0.9600.17416 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 2954

Start Time: 01d05f4da5e34e6f

Termination Time: 4294967295

Application Path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Report Id: 39cd7448-cb41-11e4-bedd-50b7c3b857f2

Faulting package full name:

Faulting package-relative application ID:

Error: (03/15/2015 02:17:00 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: chrome.exe, version: 39.0.2171.95, time stamp: 0x548243f3

Faulting module name: chrome.dll, version: 39.0.2171.95, time stamp: 0x54823ff4

Exception code: 0x80000003

Fault offset: 0x004fd39c

Faulting process id: 0x1cd4

Faulting application start time: 0xchrome.exe0

Faulting application path: chrome.exe1

Faulting module path: chrome.exe2

Report Id: chrome.exe3

Faulting package full name: chrome.exe4

Faulting package-relative application ID: chrome.exe5

Error: (03/15/2015 02:16:34 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: chrome.exe, version: 39.0.2171.95, time stamp: 0x548243f3

Faulting module name: chrome.dll, version: 39.0.2171.95, time stamp: 0x54823ff4

Exception code: 0x80000003

Fault offset: 0x004fd39c

Faulting process id: 0x1e84

Faulting application start time: 0xchrome.exe0

Faulting application path: chrome.exe1

Faulting module path: chrome.exe2

Report Id: chrome.exe3

Faulting package full name: chrome.exe4

Faulting package-relative application ID: chrome.exe5

Error: (03/15/2015 02:15:39 PM) (Source: Application Hang) (EventID: 1002) (User: )

Process ID: 2a74

Start Time: 01d05f4bd5bbe95c

Termination Time: 62

Application Path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Report Id: 458cf060-cb3f-11e4-bedd-50b7c3b857f2

Faulting package full name:

Faulting package-relative application ID:

Error: (03/15/2015 02:14:10 PM) (Source: Application Hang) (EventID: 1002) (User: )

Process ID: 28ac

Start Time: 01d05f4baa38fe16

Termination Time: 171

Application Path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Report Id: 0edf5adf-cb3f-11e4-bedd-50b7c3b857f2

Faulting package full name:

Faulting package-relative application ID:

Error: (03/15/2015 02:09:54 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: chrome.exe, version: 39.0.2171.95, time stamp: 0x548243f3

Faulting module name: chrome.dll, version: 39.0.2171.95, time stamp: 0x54823ff4

Exception code: 0x80000003

Fault offset: 0x004fd39c

Faulting process id: 0xb08

Faulting application start time: 0xchrome.exe0

Faulting application path: chrome.exe1

Faulting module path: chrome.exe2

Report Id: chrome.exe3

Faulting package full name: chrome.exe4

Faulting package-relative application ID: chrome.exe5

Error: (03/15/2015 02:08:13 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: NinjaMaintainer.exe, version: 1.0.0.1, time stamp: 0x549fb562

Faulting module name: BrSp.dll_unloaded, version: 0.0.0.0, time stamp: 0x549fb56f

Exception code: 0xc00001a5

Fault offset: 0x00010218

Faulting process id: 0xac0

Faulting application start time: 0xNinjaMaintainer.exe0

Faulting application path: NinjaMaintainer.exe1

Faulting module path: NinjaMaintainer.exe2

Report Id: NinjaMaintainer.exe3

Faulting package full name: NinjaMaintainer.exe4

Faulting package-relative application ID: NinjaMaintainer.exe5

System errors:

=============

Error: (03/15/2015 03:26:36 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The BrsHelper service failed to start due to the following error:

%%2

Error: (03/15/2015 03:26:18 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The AppEx Networks Accelerator LWF service failed to start due to the following error:

%%31

Error: (03/15/2015 03:26:18 PM) (Source: APXACC) (EventID: 1003) (User: )

Description: The NDIS6 LWF initialization has failed. (0xC0000001)

Error: (03/15/2015 03:24:33 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: The Superfetch service terminated with the following error:

%%1062

Error: (03/15/2015 02:46:59 PM) (Source: disk) (EventID: 7) (User: )

Description: The device, \Device\Harddisk1\DR1, has a bad block.