[jamesrturpen]

Can anyone provide me with a fixlist? I'm having problems opening Windows Defender, its come to my attention that using this software is a solution. If someone can provide me with the list I'd greatly appreciate it. Here's my log file....

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-05-2015 01
Ran by jamesrturpen (administrator) on JAMESRTURPEN-PC on 06-05-2015 21:05:59
Running from C:\Users\jamesrturpen\Desktop
Loaded Profiles: jamesrturpen (Available profiles: jamesrturpen & Mcx1-JAMESRTURPEN-PC)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(TOSHIBA) C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCameraSrv.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe
() C:\Program Files (x86)\Jsip\Jsip.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Winmagic Inc.) C:\Program Files (x86)\WinMagic\SecureDoc-NT\SDPin.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler64.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\rselect\RSelSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe
(WinMagic Inc.) C:\Program Files (x86)\WinMagic\SecureDoc-NT\SDService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Amazon.com) C:\Program Files (x86)\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\hidfind.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
(Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
(Mozy, Inc.) C:\Program Files\MozyHome\mozybackup.exe
(Mozy, Inc.) C:\Program Files\MozyHome\mozybackup.exe
(Microsoft Corporation) C:\Program Files\Zune\ZuneNss.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [308736 2009-04-02] (Alps Electric Co., Ltd.)
HKLM\...\Run: [ThpSrv] => C:\Windows\system32\thpsrv /logon
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8081952 2009-08-24] (Realtek Semiconductor)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-04-07] (Apple Inc.)
HKLM-x32\...\Run: [StartSecurDoc] => C:\Program Files (x86)\WinMagic\SecureDoc-NT\SDPin.exe [2184264 2010-07-25] (Winmagic Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist\900\G2AWinLogon_x64.dll (Citrix Online, a division of Citrix Systems, Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] fastprox.dll ATTENTION! ====> ZeroAccess?
HKLM\...\Policies\Explorer: [UseDefaultTile] 0
HKU\S-1-5-19\...\Winlogon: [Shell] C:\Windows\Explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-20\...\Winlogon: [Shell] C:\Windows\Explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [163328 2010-11-20] (Microsoft Corporation)
HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\...\Run: [TranscodingService] => C:\Program Files (x86)\TiVo\Desktop\Plus\\TranscodingService.exe [856336 2010-08-24] (TiVo Inc.)
HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\...\Policies\system: [DisableChangePassword] 0
HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\...\Policies\Explorer: [NoLogOff] 0
HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x95000000
HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\...\Policies\Explorer: [NoSetActiveDesktop] 0
HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\...409d6c4515e9\InprocServer32: [Default-shell32] C:\$Recycle.Bin\S-1-5-21-3124041595-2245722441-2419751327-1000\$3b75540adbbdacf373836bb4b95f9b71\n. ATTENTION! ====> ZeroAccess?
HKU\S-1-5-18\...\Policies\Explorer: [NoSetActiveDesktop] 0
HKU\S-1-5-18\...\Winlogon: [Shell] C:\Windows\Explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION
ShellIconOverlayIdentifiers: [mozy] -> {b32a6748-f273-4546-b60a-3c5adc239de5} => C:\Program Files\MozyHome\mozyshell.dll [2011-02-08] (Mozy, Inc.)
ShellIconOverlayIdentifiers: [mozy2] -> {747E722C-CB46-4a9d-BDFE-192AAD5099B1} => C:\Program Files\MozyHome\mozyshell.dll [2011-02-08] (Mozy, Inc.)
ShellIconOverlayIdentifiers: [mozy3] -> {EE6F5A00-7898-40f7-AB77-51FF9D6DEB20} => C:\Program Files\MozyHome\mozyshell.dll [2011-02-08] (Mozy, Inc.)
ShellIconOverlayIdentifiers-x32: [WMAllKey] -> {5028CECA-A6C3-4D9C-BA25-6C04D8C3ED80} => C:\Program Files (x86)\WinMagic\SecureDoc-NT\SDContext.dll [2010-07-25] (Winmagic Inc.)
ShellIconOverlayIdentifiers-x32: [WMNoKey] -> {2659CB3D-3D6E-42CE-AD9D-FE41C3617CC1} => C:\Program Files (x86)\WinMagic\SecureDoc-NT\SDContext.dll [2010-07-25] (Winmagic Inc.)
ShellIconOverlayIdentifiers-x32: [WMNotTransformed] -> {01DBDE7E-2D13-4495-BE04-12AA56CC2751} => C:\Program Files (x86)\WinMagic\SecureDoc-NT\SDContext.dll [2010-07-25] (Winmagic Inc.)
ShellIconOverlayIdentifiers-x32: [WMPartialKey] -> {5133E633-CFED-4043-9971-38936512E6D4} => C:\Program Files (x86)\WinMagic\SecureDoc-NT\SDContext.dll [2010-07-25] (Winmagic Inc.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:13091
ProxyEnable: [S-1-5-21-3124041595-2245722441-2419751327-1000] => Internet Explorer proxy is enabled.
ProxyServer: [S-1-5-21-3124041595-2245722441-2419751327-1000] => http=127.0.0.1:13091;
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft...=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft...d=ie&ar=msnhome
HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft...=ie&ar=iesearch
HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/
SearchScopes: HKLM -> DefaultScope {44C22B8E-39E0-4A61-AB8B-EF3D9A2D77DB} URL = http://www.google.co...ng}&rlz=1I7TSHB
SearchScopes: HKLM -> {44C22B8E-39E0-4A61-AB8B-EF3D9A2D77DB} URL = http://www.google.co...ng}&rlz=1I7TSHB
SearchScopes: HKLM-x32 -> DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.co...ng}&rlz=1I7TSHB
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://search.live.c...ferrer:source?}
SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.co...ng}&rlz=1I7TSHB
SearchScopes: HKLM-x32 -> {7CC94BCA-8E5E-4FAD-ACE5-798C208642BC} URL = http://www.google.co...age={startPage}
SearchScopes: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000 -> DefaultScope {1BB2D5A5-CB28-6828-A0B4-440879C5BE32} URL = http://www.bing.com/...eferrer:source}
SearchScopes: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000 -> {07F354D8-97BB-48B4-99C5-9A6706CB2684} URL = http://search.yahoo....p={searchTerms}
SearchScopes: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000 -> {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = http://websearch.ask...s}&locale=en_US
SearchScopes: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000 -> {195EF21C-18F4-4DC4-A1CA-617D1D77C479} URL = http://search.genieo...q={searchTerms}
SearchScopes: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000 -> {1BB2D5A5-CB28-6828-A0B4-440879C5BE32} URL = http://www.bing.com/...eferrer:source}
SearchScopes: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000 -> {44C22B8E-39E0-4A61-AB8B-EF3D9A2D77DB} URL =
SearchScopes: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.co...&rlz=1I7TSHB_en
SearchScopes: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000 -> {7CC94BCA-8E5E-4FAD-ACE5-798C208642BC} URL = http://www.google.co...age={startPage}
SearchScopes: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000 -> {8250F6A0-A4E5-4496-B0EC-22C17B52CB04} URL = https://search.yahoo...p={searchTerms}
SearchScopes: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000 -> {A1805FC6-4A09-46B4-875B-05E03CE9C26A} URL = http://search.condui...q={searchTerms}
SearchScopes: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000 -> {B42FF0B8-6B7F-58A0-3465-D8FA89BD9731} URL = http://indyd.asksear...}&cfg=2-571-0-0
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO-x32: &Yahoo! Toolbar Helper -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll [2008-05-15] (Yahoo! Inc.)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre8\bin\ssv.dll [2014-06-07] (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-04-01] (Microsoft Corporation.)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre8\bin\jp2ssv.dll [2014-06-07] (Oracle Corporation)
BHO-x32: ChromeFrame BHO -> {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} -> C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll [2014-02-01] (Google Inc.)
Toolbar: HKLM-x32 - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll [2008-05-15] (Yahoo! Inc.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-04-01] (Microsoft Corporation.)
Toolbar: HKU\.DEFAULT -> No Name - {58BECA16-CAE6-4B7A-A0E8-153D0CBBA63A} -  No File
Toolbar: HKU\.DEFAULT -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000 -> No Name - {58BECA16-CAE6-4B7A-A0E8-153D0CBBA63A} -  No File
DPF: HKLM-x32 {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.appl...ex/qtplugin.cab
DPF: HKLM-x32 {036F8A56-0BC8-4607-8F98-D3231E6FF5ED} https://emeeting.new...raUpdaterAx.cab
DPF: HKLM-x32 {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files (x86)\Yahoo!\Common\Yinsthelper.dll
DPF: HKLM-x32 {6E2510E6-BF2D-4C78-9F28-2F5C8760F124} https://eroom.newyor...etup/client.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.m...ash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab
Handler-x32: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll [2014-02-01] (Google Inc.)
Winsock: Catalog5 03 C:\Windows\SysWOW64\mswsock.dll [231424 2013-10-10] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5 04 %SystemRoot%\System32\nwprovau.dll File Not found
Winsock: Catalog5-x64 01 mswsock.dll File Not found ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5-x64 05 mswsock.dll File Not found ATTENTION: The LibraryPath should be "%SystemRoot%\System32\mswsock.dll"
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\jamesrturpen\AppData\Roaming\Mozilla\Firefox\Profiles\u27gjy1u.default
FF DefaultSearchEngine: Bing
FF DefaultSearchEngine.US: Bing
FF SearchEngineOrder.1: Bing
FF SearchEngineOrder.2: Yahoo
FF SearchEngineOrder.3: Google
FF Homepage: my.yahoo.com
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-15] ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.31211.0\npctrl.dll [2014-12-11] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-15] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @emc.com/NpDmDataTransfer -> C:\Program Files (x86)\eRoom 7\npeRoom7.dll [2010-12-20] (Documentum, Inc.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @google.com/npPicasa2,version=2.0.0 -> C:\Program Files (x86)\Picasa2\npPicasa2.dll [2008-08-20] (Google, Inc.)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Picasa2\npPicasa3.dll [2010-12-01] (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=11.0.2 -> C:\Program Files (x86)\Java\jre8\bin\dtplugin\npDeployJava1.dll [2014-06-07] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre8\bin\new_plugin\npjp2.dll No File
FF Plugin-x32: @java.com/JavaPlugin,version=11.0.2 -> C:\Program Files (x86)\Java\jre8\bin\plugin2\npjp2.dll [2014-06-07] (Oracle Corporation)
FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files (x86)\Yahoo!\Shared\npYState.dll [2010-06-01] (Yahoo! Inc.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.31211.0\npctrl.dll [2014-12-11] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-05] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-05] (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2012-10-12] ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin-x32: [email protected]/YahooActiveXPluginBridge;version=1.0.0.1 -> C:\Program Files (x86)\Yahoo!\Common\npyaxmpb.dll [2007-03-09] (Yahoo! Inc.)
FF Plugin HKU\S-1-5-21-3124041595-2245722441-2419751327-1000: @movenetworks.com/Quantum Media Player -> C:\Users\jamesrturpen\AppData\Roaming\Move Networks\plugins\npqmp071705000014.dll No File
FF Plugin HKU\S-1-5-21-3124041595-2245722441-2419751327-1000: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll [2011-11-17] (Amazon.com, Inc.)
FF user.js: detected! => C:\Users\jamesrturpen\AppData\Roaming\Mozilla\Firefox\Profiles\u27gjy1u.default\user.js [2014-08-14]
FF Extension: Simple White - C:\Users\jamesrturpen\AppData\Roaming\Mozilla\Firefox\Profiles\u27gjy1u.default\Extensions\[email protected] [2015-03-20]
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-30]
FF HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\...\Firefox\Extensions: [[email protected]] - C:\Users\jamesrturpen\AppData\Roaming\Move Networks

Chrome:
=======
CHR HomePage: Default -> hxxp://www.my.yahoo.com/
CHR StartupUrls: Default -> "hxxp://my.yahoo.com/"
CHR DefaultSearchKeyword: Default -> bing.com
CHR DefaultSearchURL: Default -> https://www.bing.com...q={searchTerms}
CHR DefaultNewTabURL: Default -> https://www.bing.com...ab?setmkt=en-US
CHR DefaultSuggestURL: Default -> http://api.bing.com/...uage={language}
CHR Profile: C:\Users\jamesrturpen\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\jamesrturpen\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-12-27]
CHR Extension: (Google Search) - C:\Users\jamesrturpen\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-12-27]
CHR Extension: (Weather Forecast) - C:\Users\jamesrturpen\AppData\Local\Google\Chrome\User Data\Default\Extensions\daidbcgjmglbmccacppklkejkpcekill [2014-08-07]
CHR Extension: (Hola Better Internet) - C:\Users\jamesrturpen\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio [2013-12-27]
CHR Extension: (ifhikkcafabcgolfjegfcgloomalapol) - C:\Users\jamesrturpen\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifhikkcafabcgolfjegfcgloomalapol [2014-09-18]
CHR Extension: (Black carbon + silver metal) - C:\Users\jamesrturpen\AppData\Local\Google\Chrome\User Data\Default\Extensions\lodhggoaglindpoejnjldimdlikkphph [2014-08-09]
CHR Extension: (Google Wallet) - C:\Users\jamesrturpen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-27]
CHR Extension: (Gmail) - C:\Users\jamesrturpen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-12-27]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

Locked "Jsip" service was unlocked successfully. <===== ATTENTION

R2 ADVService; C:\Program Files (x86)\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe [25704 2010-09-13] (Amazon.com) [File not signed]
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-20] (Apple Inc.)
R2 camsvc; C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCameraSrv.exe [20544 2009-04-16] (TOSHIBA)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
R2 Jsip; C:\Program Files (x86)\Jsip\Jsip.exe [390144 2014-06-06] () [File not signed] <==== ATTENTION
R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [61440 2006-10-19] (Hewlett-Packard Company) [File not signed]
S3 LiveUpdate; C:\Program Files (x86)\Symantec\LiveUpdate\LuComServer_3_3.EXE [3093880 2010-02-17] (Symantec Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 mozybackup; C:\Program Files\MozyHome\mozybackup.exe [79672 2009-06-24] (Mozy, Inc.)
S2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2009-05-14] (Hewlett-Packard) [File not signed]
S2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2009-05-14] (Hewlett-Packard) [File not signed]
R2 RSELSVC; C:\Program Files\TOSHIBA\rselect\RSelSvc.exe [55808 2009-02-19] (TOSHIBA Corporation) [File not signed]
S4 TivoBeacon2; C:\Program Files (x86)\TiVo\Desktop\TiVoBeacon.exe [1104656 2010-08-24] (TiVo Inc.)
R2 TODDSrv; C:\Windows\system32\TODDSrv.exe [135168 2007-11-21] (TOSHIBA Corporation) [File not signed]
R2 TOSHIBA eco Utility Service; C:\Program Files\TOSHIBA\TECO\TecoService.exe [242176 2009-04-24] (TOSHIBA Corporation) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-13] (Microsoft Corporation)
R2 WinMagic SecureDoc Service; C:\Program Files (x86)\WinMagic\SecureDoc-NT\SDService.exe [693320 2010-07-25] (WinMagic Inc.)
S2 0119701324248277mcinstcleanup; C:\Users\JAMESR~1\AppData\Local\Temp\011970~1.EXE C:\PROGRA~2\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service
S2 RoxLiveShare9; "C:\Program Files (x86)\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [487216 2014-11-25] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142640 2014-11-25] (Symantec Corporation)
S3 mferkdk; C:\Windows\System32\drivers\mferkdk.sys [40904 2009-11-04] (McAfee, Inc.)
S3 mfesmfk; C:\Windows\System32\drivers\mfesmfk.sys [49480 2009-11-04] (McAfee, Inc.)
R1 mozyFilter; C:\Windows\System32\DRIVERS\mozy.sys [66552 2011-02-07] (Mozy, Inc.)
R0 PinFile; C:\Windows\System32\DRIVERS\PinFile.sys [21504 2009-09-28] (WinMagic, Inc.)
R1 PMCF; C:\Windows\system32\drivers\PMCF.sys [16448 2009-07-28] ()
S3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [31744 2009-01-09] (Research in Motion Ltd)
R0 SDDisk2K; C:\Windows\System32\DRIVERS\SDDisk2K.sys [139776 2010-01-20] (WinMagic Inc.)
R0 SDDToki; C:\Windows\System32\DRIVERS\SDDToki.sys [114688 2010-01-20] (WinMagic Inc.)
R0 SDDVD; C:\Windows\System32\DRIVERS\SDDVD.sys [70656 2009-09-25] (WinMagic Inc.)
R0 SDUPC; C:\Windows\System32\DRIVERS\SDUPC.sys [20992 2009-03-05] (WinMagic Inc.)
S3 Sockblkd; C:\Program Files\Extegrity\Exam4\Sockblkd.sys [6784 2010-10-04] (DataWizard Technologies, Inc.) [File not signed]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 RimUsb; System32\Drivers\RimUsb_AMD64.sys [X]
R4 SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-06 21:05 - 2015-05-06 21:06 - 00026853 _____ () C:\Users\jamesrturpen\Desktop\FRST.txt
2015-05-06 21:05 - 2015-05-06 21:06 - 00000000 ____D () C:\FRST
2015-05-06 21:04 - 2015-05-06 21:04 - 02482688 _____ () C:\Users\jamesrturpen\Desktop\JsipUninstaller.exe
2015-05-06 20:59 - 2015-05-06 20:59 - 02102272 _____ (Farbar) C:\Users\jamesrturpen\Desktop\FRST64.exe
2015-05-06 20:54 - 2015-05-06 20:54 - 00002548 _____ () C:\ProgramData\LUUnInstall.LiveUpdate
2015-04-18 12:35 - 2015-04-18 12:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-04-18 12:33 - 2015-04-18 12:35 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-04-18 12:33 - 2015-04-18 12:35 - 00000000 ____D () C:\Program Files\iTunes
2015-04-18 12:33 - 2015-04-18 12:33 - 00000000 ____D () C:\Program Files\iPod
2015-04-18 12:33 - 2015-04-18 12:33 - 00000000 ____D () C:\Program Files (x86)\iTunes
2015-04-15 12:42 - 2015-03-24 22:24 - 03298816 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-04-15 12:42 - 2015-03-24 22:24 - 02553856 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-04-15 12:42 - 2015-03-24 22:24 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-04-15 12:42 - 2015-03-24 22:24 - 00191488 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-04-15 12:42 - 2015-03-24 22:24 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-04-15 12:42 - 2015-03-24 22:24 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-04-15 12:42 - 2015-03-24 22:24 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-04-15 12:42 - 2015-03-24 22:24 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-04-15 12:42 - 2015-03-24 22:23 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-04-15 12:42 - 2015-03-24 22:23 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-04-15 12:42 - 2015-03-24 22:23 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-04-15 12:42 - 2015-03-24 22:00 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-04-15 12:42 - 2015-03-24 22:00 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-04-15 12:42 - 2015-03-24 22:00 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-04-15 12:42 - 2015-03-24 22:00 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-04-15 12:42 - 2015-03-24 22:00 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-04-15 12:42 - 2015-03-22 22:25 - 00769536 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-04-15 12:42 - 2015-03-22 22:25 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-04-15 12:42 - 2015-03-22 22:24 - 00957952 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-04-15 12:42 - 2015-03-22 22:24 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-04-15 12:42 - 2015-03-22 22:24 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-04-15 12:42 - 2015-03-22 22:24 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-04-15 12:42 - 2015-03-22 22:24 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-04-15 12:42 - 2015-03-22 22:17 - 01111552 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-04-15 12:42 - 2015-03-05 00:12 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-04-15 12:42 - 2015-03-04 23:05 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-04-15 12:42 - 2015-02-24 22:18 - 00754688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2015-04-15 12:41 - 2015-03-17 00:22 - 05557696 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-04-15 12:41 - 2015-03-17 00:22 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-04-15 12:41 - 2015-03-17 00:22 - 00095672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-04-15 12:41 - 2015-03-17 00:19 - 01727904 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-04-15 12:41 - 2015-03-17 00:17 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-04-15 12:41 - 2015-03-17 00:17 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-04-15 12:41 - 2015-03-17 00:17 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-04-15 12:41 - 2015-03-17 00:16 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-04-15 12:41 - 2015-03-17 00:16 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-04-15 12:41 - 2015-03-17 00:16 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-04-15 12:41 - 2015-03-17 00:16 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-04-15 12:41 - 2015-03-17 00:16 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-04-15 12:41 - 2015-03-17 00:16 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-04-15 12:41 - 2015-03-17 00:16 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-04-15 12:41 - 2015-03-17 00:16 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-04-15 12:41 - 2015-03-17 00:16 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-04-15 12:41 - 2015-03-17 00:16 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-04-15 12:41 - 2015-03-17 00:16 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-04-15 12:41 - 2015-03-17 00:16 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-04-15 12:41 - 2015-03-17 00:16 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-04-15 12:41 - 2015-03-17 00:16 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-04-15 12:41 - 2015-03-17 00:16 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-04-15 12:41 - 2015-03-17 00:16 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-04-15 12:41 - 2015-03-17 00:16 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-04-15 12:41 - 2015-03-17 00:16 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-04-15 12:41 - 2015-03-17 00:16 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-04-15 12:41 - 2015-03-17 00:16 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-04-15 12:41 - 2015-03-17 00:15 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-04-15 12:41 - 2015-03-17 00:15 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-04-15 12:41 - 2015-03-17 00:15 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-04-15 12:41 - 2015-03-17 00:13 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-04-15 12:41 - 2015-03-17 00:13 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-04-15 12:41 - 2015-03-17 00:11 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-04-15 12:41 - 2015-03-17 00:11 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-04-15 12:41 - 2015-03-17 00:11 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-04-15 12:41 - 2015-03-17 00:11 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-04-15 12:41 - 2015-03-17 00:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-04-15 12:41 - 2015-03-17 00:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-04-15 12:41 - 2015-03-17 00:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-04-15 12:41 - 2015-03-17 00:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-04-15 12:41 - 2015-03-17 00:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-04-15 12:41 - 2015-03-17 00:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-04-15 12:41 - 2015-03-17 00:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-04-15 12:41 - 2015-03-17 00:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-04-15 12:41 - 2015-03-17 00:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-04-15 12:41 - 2015-03-17 00:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-04-15 12:41 - 2015-03-17 00:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-04-15 12:41 - 2015-03-17 00:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-04-15 12:41 - 2015-03-17 00:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-04-15 12:41 - 2015-03-17 00:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-04-15 12:41 - 2015-03-17 00:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-04-15 12:41 - 2015-03-17 00:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-04-15 12:41 - 2015-03-17 00:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-04-15 12:41 - 2015-03-17 00:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-04-15 12:41 - 2015-03-17 00:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-04-15 12:41 - 2015-03-17 00:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-04-15 12:41 - 2015-03-17 00:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-04-15 12:41 - 2015-03-17 00:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-04-15 12:41 - 2015-03-17 00:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-04-15 12:41 - 2015-03-17 00:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-04-15 12:41 - 2015-03-17 00:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-04-15 12:41 - 2015-03-17 00:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-04-15 12:41 - 2015-03-17 00:01 - 03976632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-04-15 12:41 - 2015-03-17 00:01 - 03920824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-04-15 12:41 - 2015-03-16 23:59 - 01309696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-04-15 12:41 - 2015-03-16 23:57 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-04-15 12:41 - 2015-03-16 23:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-04-15 12:41 - 2015-03-16 23:57 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-04-15 12:41 - 2015-03-16 23:57 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-04-15 12:41 - 2015-03-16 23:57 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-04-15 12:41 - 2015-03-16 23:57 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-04-15 12:41 - 2015-03-16 23:57 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-04-15 12:41 - 2015-03-16 23:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-04-15 12:41 - 2015-03-16 23:57 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-04-15 12:41 - 2015-03-16 23:56 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-04-15 12:41 - 2015-03-16 23:56 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-04-15 12:41 - 2015-03-16 23:56 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-04-15 12:41 - 2015-03-16 23:56 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-04-15 12:41 - 2015-03-16 23:56 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-04-15 12:41 - 2015-03-16 23:56 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-04-15 12:41 - 2015-03-16 23:56 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-04-15 12:41 - 2015-03-16 23:53 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-04-15 12:41 - 2015-03-16 23:53 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-04-15 12:41 - 2015-03-16 23:50 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-04-15 12:41 - 2015-03-16 23:50 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-04-15 12:41 - 2015-03-16 23:50 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-04-15 12:41 - 2015-03-16 23:50 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-04-15 12:41 - 2015-03-16 23:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-04-15 12:41 - 2015-03-16 23:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-04-15 12:41 - 2015-03-16 23:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-04-15 12:41 - 2015-03-16 23:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-04-15 12:41 - 2015-03-16 23:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-04-15 12:41 - 2015-03-16 23:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-04-15 12:41 - 2015-03-16 23:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-04-15 12:41 - 2015-03-16 23:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-04-15 12:41 - 2015-03-16 23:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-04-15 12:41 - 2015-03-16 23:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-04-15 12:41 - 2015-03-16 23:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-04-15 12:41 - 2015-03-16 23:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-04-15 12:41 - 2015-03-16 23:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-04-15 12:41 - 2015-03-16 23:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-04-15 12:41 - 2015-03-16 23:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-04-15 12:41 - 2015-03-16 23:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-04-15 12:41 - 2015-03-16 23:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-04-15 12:41 - 2015-03-16 23:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-04-15 12:41 - 2015-03-16 23:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-04-15 12:41 - 2015-03-16 23:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-04-15 12:41 - 2015-03-16 23:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-04-15 12:41 - 2015-03-16 23:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-04-15 12:41 - 2015-03-16 22:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-04-15 12:41 - 2015-03-16 22:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-04-15 12:41 - 2015-03-16 22:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-04-15 12:41 - 2015-03-16 22:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-04-15 12:41 - 2015-03-16 22:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-04-15 12:41 - 2015-03-16 22:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-04-15 12:41 - 2015-03-09 22:25 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-04-15 12:40 - 2015-04-01 19:17 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-04-15 12:40 - 2015-04-01 18:49 - 00342704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-04-15 12:40 - 2015-03-12 23:32 - 24980480 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-04-15 12:40 - 2015-03-12 23:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-04-15 12:40 - 2015-03-12 23:25 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-04-15 12:40 - 2015-03-12 23:09 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-04-15 12:40 - 2015-03-12 23:08 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-04-15 12:40 - 2015-03-12 23:08 - 00417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-04-15 12:40 - 2015-03-12 23:08 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-04-15 12:40 - 2015-03-12 23:07 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-04-15 12:40 - 2015-03-12 23:06 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-04-15 12:40 - 2015-03-12 23:00 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-04-15 12:40 - 2015-03-12 22:59 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-04-15 12:40 - 2015-03-12 22:55 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-04-15 12:40 - 2015-03-12 22:54 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-04-15 12:40 - 2015-03-12 22:54 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-04-15 12:40 - 2015-03-12 22:53 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-04-15 12:40 - 2015-03-12 22:50 - 06025216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-04-15 12:40 - 2015-03-12 22:44 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-04-15 12:40 - 2015-03-12 22:42 - 19695616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-04-15 12:40 - 2015-03-12 22:42 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-04-15 12:40 - 2015-03-12 22:40 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-04-15 12:40 - 2015-03-12 22:32 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-04-15 12:40 - 2015-03-12 22:28 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-04-15 12:40 - 2015-03-12 22:28 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-04-15 12:40 - 2015-03-12 22:27 - 00340992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-04-15 12:40 - 2015-03-12 22:27 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-04-15 12:40 - 2015-03-12 22:27 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-04-15 12:40 - 2015-03-12 22:26 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-04-15 12:40 - 2015-03-12 22:26 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-04-15 12:40 - 2015-03-12 22:23 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-04-15 12:40 - 2015-03-12 22:22 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-04-15 12:40 - 2015-03-12 22:20 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-04-15 12:40 - 2015-03-12 22:20 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-04-15 12:40 - 2015-03-12 22:17 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-04-15 12:40 - 2015-03-12 22:16 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-04-15 12:40 - 2015-03-12 22:15 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-04-15 12:40 - 2015-03-12 22:08 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-04-15 12:40 - 2015-03-12 22:07 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-04-15 12:40 - 2015-03-12 22:06 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-04-15 12:40 - 2015-03-12 22:05 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-04-15 12:40 - 2015-03-12 22:05 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-04-15 12:40 - 2015-03-12 22:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-04-15 12:40 - 2015-03-12 22:00 - 14397440 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-04-15 12:40 - 2015-03-12 21:57 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-04-15 12:40 - 2015-03-12 21:56 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-04-15 12:40 - 2015-03-12 21:54 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-04-15 12:40 - 2015-03-12 21:49 - 04305408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-04-15 12:40 - 2015-03-12 21:45 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-04-15 12:40 - 2015-03-12 21:44 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-04-15 12:40 - 2015-03-12 21:43 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-04-15 12:40 - 2015-03-12 21:42 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-04-15 12:40 - 2015-03-12 21:34 - 12825600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-04-15 12:40 - 2015-03-12 21:33 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-04-15 12:40 - 2015-03-12 21:22 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-04-15 12:40 - 2015-03-12 21:20 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-04-15 12:40 - 2015-03-12 21:16 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-04-15 12:40 - 2015-03-12 21:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-04-15 12:40 - 2015-03-09 22:21 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-04-15 12:40 - 2015-03-09 22:08 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2015-04-15 12:40 - 2015-03-09 22:05 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2015-04-15 12:39 - 2015-03-03 23:55 - 00367552 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2015-04-15 12:39 - 2015-03-03 23:41 - 00079360 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
2015-04-15 12:39 - 2015-03-03 23:10 - 00058880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clfsw32.dll
2015-04-11 15:10 - 2015-04-11 15:10 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-06 21:02 - 2014-11-28 13:57 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-06 21:01 - 2014-03-24 12:40 - 00000008 _____ () C:\Windows\FTIS.log
2015-05-06 21:01 - 2009-05-10 14:15 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-05-06 20:54 - 2012-01-03 11:26 - 00000000 ____D () C:\ProgramData\Symantec
2015-05-06 20:54 - 2012-01-03 11:26 - 00000000 ____D () C:\Program Files (x86)\Symantec
2015-05-06 20:20 - 2011-09-23 18:51 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-05-06 19:24 - 2009-12-04 03:43 - 01770054 _____ () C:\Windows\WindowsUpdate.log
2015-05-06 00:20 - 2011-09-23 18:51 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-30 07:53 - 2009-12-04 02:58 - 00019664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-30 07:53 - 2009-12-04 02:58 - 00019664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-30 07:40 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-30 07:39 - 2014-07-02 18:15 - 00014056 _____ () C:\Windows\setupact.log
2015-04-18 12:33 - 2011-10-03 22:19 - 00000000 ____D () C:\Program Files\Common Files\Apple
2015-04-16 21:21 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\rescache
2015-04-16 20:18 - 2014-07-02 13:58 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-16 19:51 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\AppCompat
2015-04-16 19:38 - 2014-08-14 10:10 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-04-15 21:17 - 2014-12-10 04:40 - 00000000 ____D () C:\Windows\system32\appraiser
2015-04-15 21:17 - 2014-04-30 03:01 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-04-15 21:17 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-04-15 20:03 - 2009-08-17 18:10 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-04-15 20:00 - 2011-06-28 13:09 - 00775192 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2015-04-15 20:00 - 2009-07-14 00:13 - 00775192 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-15 19:52 - 2013-07-23 12:35 - 00000000 ____D () C:\Windows\system32\MRT
2015-04-15 19:36 - 2009-12-08 20:10 - 128913832 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-04-15 13:02 - 2014-11-28 13:57 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-04-15 13:02 - 2012-04-02 12:49 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-04-15 13:02 - 2011-05-20 15:02 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-04-10 06:38 - 2009-12-04 03:21 - 00614296 _____ () C:\Windows\PFRO.log

==================== Files in the root of some directories =======

2013-05-04 20:45 - 2013-05-04 20:47 - 0000004 _____ () C:\Users\jamesrturpen\AppData\Roaming\skype.ini
2012-12-22 15:28 - 2012-12-22 15:28 - 0018252 _____ () C:\Users\jamesrturpen\AppData\Roaming\sound.mp3
2014-05-14 16:06 - 2014-05-14 16:25 - 0035328 ___SH () C:\Users\jamesrturpen\AppData\Roaming\Thumbs.db
2011-12-17 13:56 - 2011-12-19 10:18 - 0012136 ___SH () C:\Users\jamesrturpen\AppData\Local\0o3f77o81upvx0vurq2i2o5wa60uk7527132rx
2011-12-30 18:33 - 2011-12-30 18:35 - 0012732 ___SH () C:\Users\jamesrturpen\AppData\Local\8hg05m6im1
2011-12-17 13:56 - 2011-12-19 10:18 - 0012136 ___SH () C:\ProgramData\0o3f77o81upvx0vurq2i2o5wa60uk7527132rx
2013-01-18 00:55 - 2013-01-18 00:55 - 0751078 _____ () C:\ProgramData\1.bmp
2013-01-18 00:55 - 2013-01-18 00:55 - 0114890 _____ () C:\ProgramData\1.jpg
2011-12-30 18:33 - 2011-12-30 18:35 - 0012732 ___SH () C:\ProgramData\8hg05m6im1
2009-12-22 13:21 - 2014-06-12 17:48 - 0016362 _____ () C:\ProgramData\hpzinstall.log
2015-05-06 20:54 - 2015-05-06 20:54 - 0002548 _____ () C:\ProgramData\LUUnInstall.LiveUpdate
2014-05-06 12:34 - 2014-05-06 12:38 - 0000298 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
2013-01-18 00:55 - 2013-01-18 00:55 - 0018252 _____ () C:\ProgramData\sound.mp3

ZeroAccess:
C:\Windows\assembly\tmp
C:\Windows\assembly\tmp\@
C:\Windows\assembly\tmp\bckfg.tmp
C:\Windows\assembly\tmp\cfg.ini
C:\Windows\assembly\tmp\keywords
C:\Windows\assembly\tmp\lsflt7.ver

ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-3124041595-2245722441-2419751327-1000\$3b75540adbbdacf373836bb4b95f9b71

Files to move or delete:
====================
C:\Users\jamesrturpen\subinacl.exe
C:\Users\jamesrturpen\AppData\Roaming\skype.ini
C:\Users\Public\dcmsvcsetup.exe


Some content of TEMP:
====================
C:\Users\jamesrturpen\AppData\Local\Temp\SEVINST64x86.EXE


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-05-04 09:22

==================== End Of Log ============================

[Advertisements]

Frst should have generated a second log called additions, could you post that please

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:
 

CreateRestorePoint:
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] fastprox.dll ATTENTION! ====> ZeroAccess?
HKU\S-1-5-19\...\Winlogon: [Shell] C:\Windows\Explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-20\...\Winlogon: [Shell] C:\Windows\Explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\...409d6c4515e9\InprocServer32: [Default-shell32] C:\$Recycle.Bin\S-1-5-21-3124041595-2245722441-2419751327-1000\$3b75540adbbdacf373836bb4b95f9b71\n. ATTENTION! ====> ZeroAccess?
HKU\S-1-5-18\...\Winlogon: [Shell] C:\Windows\Explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:13091
ProxyEnable: [S-1-5-21-3124041595-2245722441-2419751327-1000] => Internet Explorer proxy is enabled.
ProxyServer: [S-1-5-21-3124041595-2245722441-2419751327-1000] => http=127.0.0.1:13091;
SearchScopes: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000 -> {195EF21C-18F4-4DC4-A1CA-617D1D77C479} URL = http://search.genieo...q={searchTerms}
SearchScopes: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000 -> {A1805FC6-4A09-46B4-875B-05E03CE9C26A} URL = http://search.condui...q={searchTerms}
SearchScopes: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000 -> {B42FF0B8-6B7F-58A0-3465-D8FA89BD9731} URL = http://indyd.asksear...}&cfg=2-571-0-0
Toolbar: HKU\.DEFAULT -> No Name - {58BECA16-CAE6-4B7A-A0E8-153D0CBBA63A} - No File
Toolbar: HKU\.DEFAULT -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000 -> No Name - {58BECA16-CAE6-4B7A-A0E8-153D0CBBA63A} - No File
Winsock: Catalog5 03 C:\Windows\SysWOW64\mswsock.dll [231424 2013-10-10] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5 04 %SystemRoot%\System32\nwprovau.dll File Not found
Winsock: Catalog5-x64 01 mswsock.dll File Not found ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5-x64 05 mswsock.dll File Not found ATTENTION: The LibraryPath should be "%SystemRoot%\System32\mswsock.dll"
FF Plugin HKU\S-1-5-21-3124041595-2245722441-2419751327-1000: @movenetworks.com/Quantum Media Player -> C:\Users\jamesrturpen\AppData\Roaming\Move Networks\plugins\npqmp071705000014.dll No File
R2 Jsip; C:\Program Files (x86)\Jsip\Jsip.exe [390144 2014-06-06] () [File not signed] <==== ATTENTION
2015-05-06 21:04 - 2015-05-06 21:04 - 02482688 _____ () C:\Users\jamesrturpen\Desktop\JsipUninstaller.exe
2013-05-04 20:45 - 2013-05-04 20:47 - 0000004 _____ () C:\Users\jamesrturpen\AppData\Roaming\skype.ini
2011-12-17 13:56 - 2011-12-19 10:18 - 0012136 ___SH () C:\Users\jamesrturpen\AppData\Local\0o3f77o81upvx0vurq2i2o5wa60uk7527132rx
2011-12-30 18:33 - 2011-12-30 18:35 - 0012732 ___SH () C:\Users\jamesrturpen\AppData\Local\8hg05m6im1
2011-12-17 13:56 - 2011-12-19 10:18 - 0012136 ___SH () C:\ProgramData\0o3f77o81upvx0vurq2i2o5wa60uk7527132r
2011-12-30 18:33 - 2011-12-30 18:35 - 0012732 ___SH () C:\ProgramData\8hg05m6im1
C:\$Recycle.Bin\S-1-5-21-3124041595-2245722441-2419751327-1000
C:\Users\jamesrturpen\subinacl.exe
C:\Users\jamesrturpen\AppData\Roaming\skype.ini
C:\Users\Public\dcmsvcsetup.exe
C:\Windows\assembly\tmp
C:\Program Files (x86)\Jsip
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
RemoveProxy:
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: ipconfig /flushdns
CMD: netsh winsock reset catalog
CMD: netsh int ip reset c:\resetlog.txt
CMD: ipconfig /release
CMD: ipconfig /renew
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
EmptyTemp:
CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

Run FRST and press Fix
On completion a log will be generated please post that

THEN

Download aswMBR.exe ( 4.5mb ) to your desktop.
Double click the aswMBR.exe to run it.
You may be offered the option of using virtualisation, accept that
When it offers to download the virus database allow that as well
Click the "Scan" button to start scan




On completion of the scan click save log, save it to your desktop and post in your next reply

[Essexboy]

Frst should have generated a second log called additions, could you post that please

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:
 

CreateRestorePoint:
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] fastprox.dll ATTENTION! ====> ZeroAccess?
HKU\S-1-5-19\...\Winlogon: [Shell] C:\Windows\Explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-20\...\Winlogon: [Shell] C:\Windows\Explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\...409d6c4515e9\InprocServer32: [Default-shell32] C:\$Recycle.Bin\S-1-5-21-3124041595-2245722441-2419751327-1000\$3b75540adbbdacf373836bb4b95f9b71\n. ATTENTION! ====> ZeroAccess?
HKU\S-1-5-18\...\Winlogon: [Shell] C:\Windows\Explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:13091
ProxyEnable: [S-1-5-21-3124041595-2245722441-2419751327-1000] => Internet Explorer proxy is enabled.
ProxyServer: [S-1-5-21-3124041595-2245722441-2419751327-1000] => http=127.0.0.1:13091;
SearchScopes: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000 -> {195EF21C-18F4-4DC4-A1CA-617D1D77C479} URL = http://search.genieo...q={searchTerms}
SearchScopes: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000 -> {A1805FC6-4A09-46B4-875B-05E03CE9C26A} URL = http://search.condui...q={searchTerms}
SearchScopes: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000 -> {B42FF0B8-6B7F-58A0-3465-D8FA89BD9731} URL = http://indyd.asksear...}&cfg=2-571-0-0
Toolbar: HKU\.DEFAULT -> No Name - {58BECA16-CAE6-4B7A-A0E8-153D0CBBA63A} - No File
Toolbar: HKU\.DEFAULT -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000 -> No Name - {58BECA16-CAE6-4B7A-A0E8-153D0CBBA63A} - No File
Winsock: Catalog5 03 C:\Windows\SysWOW64\mswsock.dll [231424 2013-10-10] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5 04 %SystemRoot%\System32\nwprovau.dll File Not found
Winsock: Catalog5-x64 01 mswsock.dll File Not found ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5-x64 05 mswsock.dll File Not found ATTENTION: The LibraryPath should be "%SystemRoot%\System32\mswsock.dll"
FF Plugin HKU\S-1-5-21-3124041595-2245722441-2419751327-1000: @movenetworks.com/Quantum Media Player -> C:\Users\jamesrturpen\AppData\Roaming\Move Networks\plugins\npqmp071705000014.dll No File
R2 Jsip; C:\Program Files (x86)\Jsip\Jsip.exe [390144 2014-06-06] () [File not signed] <==== ATTENTION
2015-05-06 21:04 - 2015-05-06 21:04 - 02482688 _____ () C:\Users\jamesrturpen\Desktop\JsipUninstaller.exe
2013-05-04 20:45 - 2013-05-04 20:47 - 0000004 _____ () C:\Users\jamesrturpen\AppData\Roaming\skype.ini
2011-12-17 13:56 - 2011-12-19 10:18 - 0012136 ___SH () C:\Users\jamesrturpen\AppData\Local\0o3f77o81upvx0vurq2i2o5wa60uk7527132rx
2011-12-30 18:33 - 2011-12-30 18:35 - 0012732 ___SH () C:\Users\jamesrturpen\AppData\Local\8hg05m6im1
2011-12-17 13:56 - 2011-12-19 10:18 - 0012136 ___SH () C:\ProgramData\0o3f77o81upvx0vurq2i2o5wa60uk7527132r
2011-12-30 18:33 - 2011-12-30 18:35 - 0012732 ___SH () C:\ProgramData\8hg05m6im1
C:\$Recycle.Bin\S-1-5-21-3124041595-2245722441-2419751327-1000
C:\Users\jamesrturpen\subinacl.exe
C:\Users\jamesrturpen\AppData\Roaming\skype.ini
C:\Users\Public\dcmsvcsetup.exe
C:\Windows\assembly\tmp
C:\Program Files (x86)\Jsip
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
RemoveProxy:
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: ipconfig /flushdns
CMD: netsh winsock reset catalog
CMD: netsh int ip reset c:\resetlog.txt
CMD: ipconfig /release
CMD: ipconfig /renew
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
EmptyTemp:
CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

Run FRST and press Fix
On completion a log will be generated please post that

THEN

Download aswMBR.exe ( 4.5mb ) to your desktop.
Double click the aswMBR.exe to run it.
You may be offered the option of using virtualisation, accept that
When it offers to download the virus database allow that as well
Click the "Scan" button to start scan




On completion of the scan click save log, save it to your desktop and post in your next reply

[jamesrturpen]

Haven't taken any of the other steps yet, but here's the addition file...not sure if you needed that first....

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 06-05-2015 01
Ran by jamesrturpen at 2015-05-06 21:07:59
Running from C:\Users\jamesrturpen\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3124041595-2245722441-2419751327-500 - Administrator - Disabled)
Guest (S-1-5-21-3124041595-2245722441-2419751327-501 - Limited - Enabled)
HomeGroupUser$ (S-1-5-21-3124041595-2245722441-2419751327-1003 - Limited - Enabled)
jamesrturpen (S-1-5-21-3124041595-2245722441-2419751327-1000 - Administrator - Enabled) => C:\Users\jamesrturpen
Mcx1-JAMESRTURPEN-PC (S-1-5-21-3124041595-2245722441-2419751327-1001 - Administrator - Enabled) => C:\Users\Mcx1-JAMESRTURPEN-PC

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

64 Bit HP CIO Components Installer (Version: 1.2.0 - Hewlett-Packard) Hidden
64 Bit HP CIO Components Installer (Version: 6.2.1 - Hewlett-Packard) Hidden
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
ActiveX Safe for Scripting (HKLM-x32\...\{12FF4497-E886-4811-B1A4-2392B33B6EAB}) (Version:  - )
Adobe Flash Player 17 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
ALPS Touch Pad Driver (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 7.105.303.105 - ALPS ELECTRIC CO., LTD.)
Apple Application Support (32-bit) (HKLM-x32\...\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{D7B824DE-DA32-4772-9E5E-39C5158136A7}) (Version: 3.1.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{C4123106-B685-48E6-B9BD-E4F911841EB4}) (Version: 8.1.1.3 - Apple Inc.)
BitTorrent (HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\...\BitTorrent) (Version: 7.9.2.34026 - BitTorrent Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Dolby Control Center (HKLM\...\{20387B45-18A4-4D48-ABD9-A23D2CBE42B3}) (Version: 2.2.1 - Dolby)
Field Technology Messaging (HKLM-x32\...\{0ED42109-1A62-499F-AB4B-982F23DBD6F8}) (Version: 14.20.0112 - New York Life)
FIFA 12 © EA version 1 (HKLM-x32\...\FIFA 12 © EA_is1) (Version: 1 - )
FTIS 2014.1.1 Update (HKLM-x32\...\FTIS 2014.1.1 Update) (Version:  - )
FTIS 2014.1.2 Update (HKLM-x32\...\FTIS 2014.1.2 Update) (Version:  - )
FTIS 2014.1.3 Update (HKLM-x32\...\FTIS 2014.1.3 Update) (Version:  - )
FTIS 2014.1.4 Update (HKLM-x32\...\FTIS 2014.1.4 Update) (Version:  - )
FTIS 2014.1.5 Update (HKLM-x32\...\FTIS 2014.1.5 Update) (Version:  - )
FTIS 2014.1.6 Update (HKLM-x32\...\FTIS 2014.1.6 Update) (Version:  - )
FTIS 2014.1.7 Update (HKLM-x32\...\FTIS 2014.1.7 Update) (Version:  - )
FTIS 2014.1.8 Update (HKLM-x32\...\FTIS 2014.1.8 Update) (Version:  - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 42.0.2311.135 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
GoToMeeting 4.5.0.457 (HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\...\GoToMeeting) (Version:  - )
Havka FOkm (HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\...\Havka FOkm) (Version:  - Tanna OKf)
HP Photosmart C309a All-In-One Driver Software 12.0 Rel .5 (HKLM\...\{2D250E57-9890-44a6-B08F-5C02C991EF24}) (Version: 12.0 - HP)
HP Photosmart Essential 3.5 (HKLM\...\HP Photosmart Essential) (Version: 3.5 - HP)
Intel® Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1883 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
iTunes (HKLM\...\{93F2A022-6C37-48B8-B241-FFABD9F60C30}) (Version: 12.1.2.27 - Apple Inc.)
Java 7 Update 60 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217060FF}) (Version: 7.0.600 - Oracle)
Java 8 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218000FF}) (Version: 8.0.0 - Oracle Corporation)
Jsip (HKLM-x32\...\Jsip) (Version:  - )
LSI V92 MOH Application (HKLM\...\LTMOH) (Version:  - LSI Corporation)
Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\...\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.31211.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\...\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Move Media Player (HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\...\Move Media Player) (Version:  - Move Networks)
Mozilla Firefox 37.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 37.0.1 (x86 en-US)) (Version: 37.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 35.0 - Mozilla)
MozyHome (HKLM\...\{8F41F431-071E-5B44-2EEE-5C51173D6498}) (Version: 2.6.7.0 - Mozy, Inc.)
PlayReady PC runtime (HKLM\...\{704ABF63-B0B1-446B-9D92-C5D06AFCE7B6}) (Version: 1 - Microsoft Corporation)
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
SecureDoc Disk Encryption (x64) (HKLM\...\{89322526-66A6-4EF4-B1F2-C58527938A79}) (Version: 4.91.0001 - WinMagic)
SHARP MX/DX Series PCL/PS Printer Driver (HKLM-x32\...\SHARP MX-2300 2700 3500 4500 Series PCL PS Printer Driver) (Version: 1.00.000 - SHARP)
Star wars Battlefront II Ultimate Pack (HKLM-x32\...\Star wars Battlefront II Ultimate Pack) (Version:  - )
TiVo Desktop 2.8.2 (HKLM-x32\...\{4E839090-3B68-436A-B3CF-A2A08C38DD26}) (Version: 2.8.412.369 - TiVo Inc.)
TOSHIBA Disc Creator (HKLM\...\{5DA0E02F-970B-424B-BF41-513A5018E4C0}) (Version: 2.1.0.1 for x64 - TOSHIBA Corporation)
TOSHIBA HDD Protection (HKLM\...\{94A90C69-71C1-470A-88F5-AA47ECC96B40}) (Version: 2.2.0.1 - TOSHIBA Corporation)
TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.3.1.64 - TOSHIBA Corporation)
TOSHIBA Recovery Disc Creator (HKLM\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.0.0.2 for x64 - TOSHIBA Corporation)
TOSHIBA Software Modem (HKLM\...\TOSHIBA Software Modem) (Version: 2.2.97 - LSI Corporation)
TurboTax 2013 (HKLM-x32\...\TurboTax 2013) (Version: 2013.0 - Intuit, Inc)
Zune (HKLM\...\Zune) (Version: 04.08.2345.00 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 -> C:\$Recycle.Bin ()

==================== Restore Points  =========================

10-03-2015 20:16:12 Windows Update
18-03-2015 00:00:13 Scheduled Checkpoint
25-03-2015 03:00:19 Windows Update
02-04-2015 00:00:14 Scheduled Checkpoint
05-04-2015 03:00:19 Windows Update
15-04-2015 12:17:41 Scheduled Checkpoint
15-04-2015 18:32:47 Windows Update
23-04-2015 00:00:13 Scheduled Checkpoint
05-05-2015 00:00:14 Scheduled Checkpoint
06-05-2015 20:49:16 Removed Field Technology Messaging.
06-05-2015 20:50:52 Removed Symantec Endpoint Protection.
06-05-2015 21:01:12 Removed FTIS

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2011-12-30 18:53 - 2012-03-01 21:45 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {1443EA3F-BFFC-465B-ADB5-18883DF4AF50} - System32\Tasks\{1A559631-473F-41C7-BC3F-554A82D1BFAA} => pcalua.exe -a "C:\Users\jamesrturpen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H7CUXX5J\zunesetuppkg-x86[1].exe" -d C:\Users\jamesrturpen\Desktop
Task: {185D7261-DEC2-4326-9914-21460995E580} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {1B22B8E7-A6E9-45BF-9447-83E89F0D06D2} - System32\Tasks\{026FFF77-E3B7-47C7-B9B9-2B826A0FEDA5} => pcalua.exe -a "C:\Users\jamesrturpen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CMX0JZIB\Setup.exe" -d C:\Users\jamesrturpen\Desktop
Task: {2FD65FB0-D64B-4714-AD4E-63E9BBF1DBC9} - System32\Tasks\{D5C21A01-D4FF-49A7-AD30-011612818CDC} => pcalua.exe -a "C:\Users\jamesrturpen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DLCGW929\desktopsp2_StubInstaller[1].exe" -d C:\Users\jamesrturpen\Desktop
Task: {31B0B20D-E3BD-499C-ACD6-9C73947AC0A0} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-18] (Google Inc.)
Task: {388F4770-7E80-4627-B977-E1B29DA35C54} - System32\Tasks\{EB66F056-EFB2-4BEA-A296-8B9BCE4FD723} => pcalua.exe -a C:\Users\jamesrturpen\Downloads\eauninstall.exe -d C:\Users\jamesrturpen\Downloads
Task: {475AFCD8-AD03-4AC4-8778-7C76E295A916} - System32\Tasks\{C039E128-45FE-4F27-B938-F0CB1AF7E6BE} => pcalua.exe -a "C:\Users\jamesrturpen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1JHMMEOZ\AmazonUnboxVideo[1].exe"
Task: {54068220-1610-4766-9628-A1AE8DC22AA6} - System32\Tasks\SidebarExecute => C:\Program Files (x86)\Windows Sidebar\sidebar.exe [2010-11-20] (Microsoft Corporation)
Task: {573FB68C-B304-41E7-9C35-E4E5D0F56E71} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {6252F51E-2BF0-4943-94B8-B99FB8734C84} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-18] (Google Inc.)
Task: {66ACAC06-9B65-4434-858E-2EC8D27B5BF3} - System32\Tasks\934ad7e0 => C:\Users\JAMESR~1\AppData\Local\Temp\\setup1515508608.exe <==== ATTENTION
Task: {712C6861-2B14-4E72-92BA-22B6921FE2B7} - System32\Tasks\Microsoft\Windows\Wired\GatherWiredInfo => C:\Windows\system32\gatherWiredInfo.vbs
Task: {71FC81BC-3BE3-4F26-A378-E90EBAB0908E} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {A1E59603-4F0E-4C98-B421-B8B64407D3F5} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {BD587E05-D07D-41AA-A292-2C9FEA032EED} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-15] (Adobe Systems Incorporated)
Task: {C608D04F-C4C6-40E5-85C4-6E58CA7E2472} - System32\Tasks\ConfigFree Startup Programs => C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe [2009-09-03] (TOSHIBA CORPORATION)
Task: {C61C5307-6E52-44F7-A1CF-E569C8736614} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {E31F2240-34F2-42C4-AAD5-60BEDAF0A26B} - System32\Tasks\{804E90E9-E929-4124-BE1B-E2BBA87AF8BB} => pcalua.exe -a D:\Setup.exe -d D:\
Task: {E5DEDD84-8F81-414C-B8C5-6F8052513206} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-24] (Microsoft Corporation)
Task: {E91D6474-70CC-42BE-80FF-8BED8AF557ED} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2015-01-20 23:35 - 2015-01-20 23:35 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-01-20 23:35 - 2015-01-20 23:35 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2011-02-07 18:06 - 2011-02-07 18:06 - 01289728 _____ () C:\Program Files\MozyHome\LIBEAY32.dll
2014-06-06 08:07 - 2014-06-06 08:07 - 00390144 _____ () C:\Program Files (x86)\Jsip\Jsip.exe
2011-02-07 18:06 - 2011-02-07 18:06 - 00249856 _____ () C:\Program Files\MozyHome\SSLEAY32.dll
2010-09-13 12:48 - 2010-09-13 12:48 - 00097384 ____R () C:\Program Files (x86)\Amazon\Amazon Unbox Video\LimelightDownloadManager.dll
2015-04-15 13:02 - 2015-04-15 13:02 - 16863920 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\GoToAssist => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, the associated entry will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\...\genieo.com -> hxxp://search.genieo.com
IE trusted site: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\...\gotoassist.com -> hxxps://broker.gotoassist.com
IE trusted site: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\...\hola.org -> hxxp://hola.org
IE trusted site: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\...\internet -> internet
IE trusted site: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\...\mcafee.com -> hxxp://mcafee.com
IE trusted site: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\...\mcafee.com -> hxxps://mcafee.com
IE trusted site: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\...\newyorklife.com -> hxxps://newyorklife.com
IE trusted site: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\...\newyorklife.com -> hxxp://newyorklife.com


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\jamesrturpen\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.0.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Amazon Unbox.lnk => C:\Windows\pss\Amazon Unbox.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk => C:\Windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^MozyHome Status.lnk => C:\Windows\pss\MozyHome Status.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^jamesrturpen^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Warner Bros.lnk => C:\Windows\pss\Warner Bros.lnk.Startup
MSCONFIG\startupreg: 00TCrdMain => %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
MSCONFIG\startupreg: 3RVX => C:\Program Files (x86)\3RVX\3RVX.exe
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: BingDesktop => C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe /fromkey
MSCONFIG\startupreg: CLMLServer => "C:\Program Files (x86)\CyberLink\PowerCinema for TOSHIBA\Kernel\CLML\CLMLSvc.exe"
MSCONFIG\startupreg: dcmsvc => C:\Program Files (x86)\dcmsvc\dcmsvc.exe
MSCONFIG\startupreg: hola => C:\Program Files\Hola\app\hola.exe --tray --autorun
MSCONFIG\startupreg: HotKeysCmds => C:\Windows\system32\hkcmd.exe
MSCONFIG\startupreg: HP Software Update => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: hpqSRMon => C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe
MSCONFIG\startupreg: HSON => %ProgramFiles%\TOSHIBA\TBS\HSON.exe
MSCONFIG\startupreg: IgfxTray => C:\Windows\system32\igfxtray.exe
MSCONFIG\startupreg: ISUSPM => "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: Malwarebytes' Anti-Malware => "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
MSCONFIG\startupreg: Messenger (Yahoo!) => "C:\PROGRA~2\Yahoo!\Messenger\YahooMessenger.exe" -quiet
MSCONFIG\startupreg: Online News Screensaver => C:\Program Files (x86)\Online News Screensaver\onsagent.exe
MSCONFIG\startupreg: PCMAgent => "C:\Program Files (x86)\CyberLink\PowerCinema for TOSHIBA\PCMAgent.exe"
MSCONFIG\startupreg: Persistence => C:\Windows\system32\igfxpers.exe
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: SmartFaceVWatcher => %ProgramFiles%\Toshiba\SmartFaceV\SmartFaceVWatcher.exe
MSCONFIG\startupreg: SmoothView => %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
MSCONFIG\startupreg: StartNowToolbarHelper => "C:\Program Files (x86)\StartNow Toolbar\ToolbarHelper.exe"
MSCONFIG\startupreg: swg => "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
MSCONFIG\startupreg: Teco => "%ProgramFiles%\TOSHIBA\TECO\Teco.exe" /r
MSCONFIG\startupreg: TivoNotify => C:\Program Files (x86)\TiVo\Desktop\TiVoNotify.exe /service /registry /auto:TivoNotify
MSCONFIG\startupreg: TivoServer => C:\Program Files (x86)\TiVo\Desktop\TiVoServer.exe /service /registry /auto:TivoServer
MSCONFIG\startupreg: TivoTransfer => C:\Program Files (x86)\TiVo\Desktop\TiVoTransfer.exe
MSCONFIG\startupreg: ToshibaServiceStation => "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60
MSCONFIG\startupreg: TPCHWMsg => %ProgramFiles%\TOSHIBA\TPHM\TPCHWMsg.exe
MSCONFIG\startupreg: TPwrMain => %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
MSCONFIG\startupreg: TranscodingService => C:\Program Files (x86)\TiVo\Desktop\Plus\\TranscodingService.exe
MSCONFIG\startupreg: TWebCamera => "%ProgramFiles(x86)%\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun
MSCONFIG\startupreg: Zune Launcher => "c:\Program Files\Zune\ZuneLauncher.exe"

==================== FirewallRules (whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

FirewallRules: [TCP Query User{A914E0CE-2E6D-432B-BCAA-17E66DFC9D26}C:\users\jamesrturpen\appdata\roaming\bittorrent\bittorrent.exe] => (Allow) C:\users\jamesrturpen\appdata\roaming\bittorrent\bittorrent.exe
FirewallRules: [UDP Query User{313DAAFB-36E6-4D4D-B2EA-F1F15868A469}C:\users\jamesrturpen\appdata\roaming\bittorrent\bittorrent.exe] => (Allow) C:\users\jamesrturpen\appdata\roaming\bittorrent\bittorrent.exe
FirewallRules: [{951A5B8F-4892-40F4-9BA1-7DE6BBC7E2E4}] => (Allow) LPort=5353
FirewallRules: [{F68829F0-1022-4840-A0A0-D5248179D9F9}] => (Allow) LPort=7288
FirewallRules: [{337F6CCC-CDD4-4173-854B-EEC853B831D5}] => (Allow) C:\Program Files (x86)\TiVo\Desktop\TiVoTransfer.exe
FirewallRules: [{A1536A60-E3E8-433E-B0C7-033D1F5FE129}] => (Allow) C:\Program Files (x86)\TiVo\Desktop\TiVoTransfer.exe
FirewallRules: [{129CAFF6-2EEC-44D2-992D-CAE16FFFDFE3}] => (Allow) C:\Program Files (x86)\TiVo\Desktop\TiVoServer.exe
FirewallRules: [{88F83BDD-FC58-48CC-BD63-2BE8504BE072}] => (Allow) C:\Program Files (x86)\TiVo\Desktop\TiVoServer.exe
FirewallRules: [{FDF56606-A6DA-46BF-8EFD-FDBFBB8D1C07}] => (Allow) C:\Program Files (x86)\TiVo\Desktop\TiVoDesktop.exe
FirewallRules: [{0C1E6B39-3DFE-4869-A1C6-5D3B64E27626}] => (Allow) C:\Program Files (x86)\TiVo\Desktop\TiVoDesktop.exe
FirewallRules: [{87520683-42E9-47E5-9862-D55D25DE03B8}] => (Allow) C:\Program Files (x86)\TiVo\Desktop\curl.exe
FirewallRules: [{EA2D6002-87C6-4412-B09C-32A15D0AF6EA}] => (Allow) C:\Program Files (x86)\TiVo\Desktop\curl.exe
FirewallRules: [{846F649A-5CE3-4D46-8E1C-9DC85AA41B0F}] => (Allow) C:\Program Files (x86)\TiVo\Desktop\TiVoBeacon.exe
FirewallRules: [{654E542F-B622-4E79-BE33-E93208ED0DC5}] => (Allow) C:\Program Files (x86)\TiVo\Desktop\TiVoBeacon.exe
FirewallRules: [{DC58D900-B32B-4F15-9CA9-8CF31ED3D3EB}] => (Allow) C:\Program Files (x86)\TiVo\Desktop\TiVoDiag.exe
FirewallRules: [{9C26F06D-B2D5-40DE-9215-C8E23DB7B52A}] => (Allow) C:\Program Files (x86)\TiVo\Desktop\TiVoDiag.exe
FirewallRules: [{C28CA382-2CAE-489C-952D-E61F33574DB7}] => (Allow) LPort=5353
FirewallRules: [{A6BED028-D720-4EBB-AA6D-E4C88E9CA1D1}] => (Allow) LPort=7288
FirewallRules: [{EE140FAF-9295-4F5A-BA6F-39D6F6A539D5}] => (Allow) C:\Program Files (x86)\TiVo\Desktop\TiVoTransfer.exe
FirewallRules: [{C4008EDA-A2D9-44C1-AB00-20405F2CB890}] => (Allow) C:\Program Files (x86)\TiVo\Desktop\TiVoTransfer.exe
FirewallRules: [{D6C38270-72EF-4E90-88B6-DA9E46975EED}] => (Allow) C:\Program Files (x86)\TiVo\Desktop\TiVoServer.exe
FirewallRules: [{CDE7AD39-4E3E-4DD3-8094-F114848F3F5C}] => (Allow) C:\Program Files (x86)\TiVo\Desktop\TiVoServer.exe
FirewallRules: [{CAC3B085-11FF-4C5E-BD7D-C8E02D873000}] => (Allow) C:\Program Files (x86)\TiVo\Desktop\TiVoDesktop.exe
FirewallRules: [{D3CA186B-A7C7-4301-9C57-77923AC3F4C9}] => (Allow) C:\Program Files (x86)\TiVo\Desktop\TiVoDesktop.exe
FirewallRules: [{A970A34A-2E7D-4CE2-95A0-17AE3CC93610}] => (Allow) C:\Program Files (x86)\TiVo\Desktop\curl.exe
FirewallRules: [{29EEFCA0-8C2D-442B-BB76-90B400CAC6E3}] => (Allow) C:\Program Files (x86)\TiVo\Desktop\curl.exe
FirewallRules: [{2B0705FB-AA83-4BA6-B1EE-796BBABA1DD7}] => (Allow) C:\Program Files (x86)\TiVo\Desktop\TiVoBeacon.exe
FirewallRules: [{7FCD1391-4ADB-4FE0-9F25-54349B251504}] => (Allow) C:\Program Files (x86)\TiVo\Desktop\TiVoBeacon.exe
FirewallRules: [{A9D68B43-76EB-4EB3-AA24-E9F954405198}] => (Allow) C:\Program Files (x86)\TiVo\Desktop\TiVoDiag.exe
FirewallRules: [{252B06B8-062D-4BBE-93A2-2B6369E6B8CB}] => (Allow) C:\Program Files (x86)\TiVo\Desktop\TiVoDiag.exe
FirewallRules: [TCP Query User{FE1A3C75-878F-4A32-B4A0-C0AAA306BEF2}C:\program files (x86)\sybase\sql anywhere 9\win32\dbeng9.exe] => (Allow) C:\program files (x86)\sybase\sql anywhere 9\win32\dbeng9.exe
FirewallRules: [UDP Query User{140AB991-801A-4CC2-9225-8C53822B80E4}C:\program files (x86)\sybase\sql anywhere 9\win32\dbeng9.exe] => (Allow) C:\program files (x86)\sybase\sql anywhere 9\win32\dbeng9.exe
FirewallRules: [{5CB44095-AD57-4AAB-8853-26B673EFFD5B}] => (Allow) C:\Users\jamesrturpen\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{FA4FB464-E0F3-4123-82CE-B3F69C7AE834}] => (Allow) C:\Users\jamesrturpen\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [TCP Query User{918F6157-FECA-428E-A2D9-C81139B2F650}C:\users\jamesrturpen\downloads\fifa 12\fifa 12\game\fifa.exe] => (Allow) C:\users\jamesrturpen\downloads\fifa 12\fifa 12\game\fifa.exe
FirewallRules: [UDP Query User{DD1D7952-C3BF-44FF-A13E-A38411B8FAF5}C:\users\jamesrturpen\downloads\fifa 12\fifa 12\game\fifa.exe] => (Allow) C:\users\jamesrturpen\downloads\fifa 12\fifa 12\game\fifa.exe
FirewallRules: [TCP Query User{D126CA83-6E60-4A11-97E7-9153A1BED7F7}C:\users\jamesrturpen\downloads\fifa 12\fifa 12\game\fifa.exe] => (Allow) C:\users\jamesrturpen\downloads\fifa 12\fifa 12\game\fifa.exe
FirewallRules: [UDP Query User{F0A978E1-D46D-4681-903E-8D5DB4F9CFC6}C:\users\jamesrturpen\downloads\fifa 12\fifa 12\game\fifa.exe] => (Allow) C:\users\jamesrturpen\downloads\fifa 12\fifa 12\game\fifa.exe
FirewallRules: [{362A10C0-600A-48DE-A5DC-D14B4E7D0541}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{99E0C5EB-4DD1-4794-88AC-99C2C554172C}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{7125934D-7738-4580-AFC8-30204959BC2E}C:\program files (x86)\sybase\sql anywhere 9\win32\dbeng9.exe] => (Allow) C:\program files (x86)\sybase\sql anywhere 9\win32\dbeng9.exe
FirewallRules: [UDP Query User{E9E04A5E-3FEF-4294-8F63-5C558CF88612}C:\program files (x86)\sybase\sql anywhere 9\win32\dbeng9.exe] => (Allow) C:\program files (x86)\sybase\sql anywhere 9\win32\dbeng9.exe
FirewallRules: [TCP Query User{6E2B2272-038C-4DA8-8208-6DFBCE632D5C}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{9DCD8697-B3C4-4C5F-93E5-0867FB64A00C}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{507311E7-944F-47FF-9705-0A6126899264}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{F6E991A6-66E9-4739-B9C5-97B1B79E1CC2}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Faulty Device Manager Devices =============

Name: Photosmart C309a series
Description: Photosmart C309a series
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Officejet Pro L7500
Description: Officejet Pro L7500
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Officejet 6700
Description: Officejet 6700
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Officejet Pro 8000 A809
Description: Officejet Pro 8000 A809
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (04/30/2015 03:17:05 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 15944

Error: (04/30/2015 03:17:05 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 15944

Error: (04/30/2015 03:17:05 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (04/30/2015 07:40:39 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (04/29/2015 10:26:51 AM) (Source: SescLU) (EventID: 13) (User: )
Description: LiveUpdate returned a non-critical error.  Available content updates may have failed to install.

Error: (04/29/2015 09:26:38 AM) (Source: SescLU) (EventID: 13) (User: )
Description: LiveUpdate returned a non-critical error.  Available content updates may have failed to install.

Error: (04/29/2015 08:26:50 AM) (Source: SescLU) (EventID: 13) (User: )
Description: LiveUpdate returned a non-critical error.  Available content updates may have failed to install.

Error: (04/29/2015 07:26:38 AM) (Source: SescLU) (EventID: 13) (User: )
Description: LiveUpdate returned a non-critical error.  Available content updates may have failed to install.

Error: (04/29/2015 06:26:38 AM) (Source: SescLU) (EventID: 13) (User: )
Description: LiveUpdate returned a non-critical error.  Available content updates may have failed to install.

Error: (04/29/2015 05:26:06 AM) (Source: SescLU) (EventID: 13) (User: )
Description: LiveUpdate returned a non-critical error.  Available content updates may have failed to install.


System errors:
=============
Error: (04/30/2015 07:48:33 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (60000 milliseconds) was reached while waiting for a transaction response from the eventlog service.

Error: (04/30/2015 07:48:27 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The Security Center service hung on starting.

Error: (04/30/2015 07:47:33 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (60000 milliseconds) was reached while waiting for a transaction response from the eventlog service.

Error: (04/30/2015 07:41:39 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
cdrom

Error: (04/30/2015 07:40:14 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The Media Center Extender Service service depends on the Remote Desktop Services service which failed to start because of the following error:
%%1058

Error: (04/18/2015 06:51:35 PM) (Source: Server) (EventID: 2505) (User: )
Description: The server could not bind to the transport \Device\NetBT_Tcpip_{878CC645-9601-4654-89A8-6879B555A2B5} because another computer on the network has the same name.  The server could not start.

Error: (04/18/2015 06:50:32 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (60000 milliseconds) was reached while waiting for a transaction response from the Netman service.

Error: (04/18/2015 02:49:26 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The ConfigFree Gadget Service service failed to start due to the following error:
%%1053

Error: (04/18/2015 02:49:26 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (60000 milliseconds) while waiting for the ConfigFree Gadget Service service to connect.

Error: (04/18/2015 02:43:43 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
cdrom


Microsoft Office Sessions:
=========================
Error: (04/08/2014 11:05:43 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6600.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 1559 seconds with 1380 seconds of active time.  This session ended with a crash.


CodeIntegrity Errors:
===================================
  Date: 2013-08-23 23:34:04.535
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2013-08-23 23:34:04.389
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2013-08-23 23:33:41.496
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2013-08-23 23:33:41.192
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2013-08-23 23:33:31.954
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2013-08-23 23:33:31.570
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2013-08-23 23:32:56.477
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2013-08-23 23:32:56.317
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2012-05-07 19:42:21.050
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2012-05-07 19:42:20.985
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info ===========================

Processor: Intel® Core™2 Duo CPU P7350 @ 2.00GHz
Percentage of memory in use: 50%
Total physical RAM: 4059.18 MB
Available physical RAM: 2021.54 MB
Total Pagefile: 8116.54 MB
Available Pagefile: 5809.11 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (TI100518V0K) (Fixed) (Total:360.72 GB) (Free:151.13 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 372.6 GB) (Disk ID: 3FE44202)
Partition 1: (Not Active) - (Size=1.5 GB) - (Type=27)
Partition 2: (Active) - (Size=360.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=10.4 GB) - (Type=17)

==================== End Of Log ============================

[Essexboy]

If you have not yet run the fixlist then please use this one instead

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:
 

CreateRestorePoint:
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] fastprox.dll ATTENTION! ====> ZeroAccess?
HKU\S-1-5-19\...\Winlogon: [Shell] C:\Windows\Explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-20\...\Winlogon: [Shell] C:\Windows\Explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\...409d6c4515e9\InprocServer32: [Default-shell32] C:\$Recycle.Bin\S-1-5-21-3124041595-2245722441-2419751327-1000\$3b75540adbbdacf373836bb4b95f9b71\n. ATTENTION! ====> ZeroAccess?
HKU\S-1-5-18\...\Winlogon: [Shell] C:\Windows\Explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:13091
ProxyEnable: [S-1-5-21-3124041595-2245722441-2419751327-1000] => Internet Explorer proxy is enabled.
ProxyServer: [S-1-5-21-3124041595-2245722441-2419751327-1000] => http=127.0.0.1:13091;
SearchScopes: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000 -> {195EF21C-18F4-4DC4-A1CA-617D1D77C479} URL = http://search.genieo...q={searchTerms}
SearchScopes: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000 -> {A1805FC6-4A09-46B4-875B-05E03CE9C26A} URL = http://search.condui...q={searchTerms}
SearchScopes: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000 -> {B42FF0B8-6B7F-58A0-3465-D8FA89BD9731} URL = http://indyd.asksear...}&cfg=2-571-0-0
Toolbar: HKU\.DEFAULT -> No Name - {58BECA16-CAE6-4B7A-A0E8-153D0CBBA63A} - No File
Toolbar: HKU\.DEFAULT -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000 -> No Name - {58BECA16-CAE6-4B7A-A0E8-153D0CBBA63A} - No File
Winsock: Catalog5 03 C:\Windows\SysWOW64\mswsock.dll [231424 2013-10-10] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5 04 %SystemRoot%\System32\nwprovau.dll File Not found
Winsock: Catalog5-x64 01 mswsock.dll File Not found ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5-x64 05 mswsock.dll File Not found ATTENTION: The LibraryPath should be "%SystemRoot%\System32\mswsock.dll"
FF Plugin HKU\S-1-5-21-3124041595-2245722441-2419751327-1000: @movenetworks.com/Quantum Media Player -> C:\Users\jamesrturpen\AppData\Roaming\Move Networks\plugins\npqmp071705000014.dll No File
R2 Jsip; C:\Program Files (x86)\Jsip\Jsip.exe [390144 2014-06-06] () [File not signed] <==== ATTENTION
2015-05-06 21:04 - 2015-05-06 21:04 - 02482688 _____ () C:\Users\jamesrturpen\Desktop\JsipUninstaller.exe
2013-05-04 20:45 - 2013-05-04 20:47 - 0000004 _____ () C:\Users\jamesrturpen\AppData\Roaming\skype.ini
2011-12-17 13:56 - 2011-12-19 10:18 - 0012136 ___SH () C:\Users\jamesrturpen\AppData\Local\0o3f77o81upvx0vurq2i2o5wa60uk7527132rx
2011-12-30 18:33 - 2011-12-30 18:35 - 0012732 ___SH () C:\Users\jamesrturpen\AppData\Local\8hg05m6im1
2011-12-17 13:56 - 2011-12-19 10:18 - 0012136 ___SH () C:\ProgramData\0o3f77o81upvx0vurq2i2o5wa60uk7527132r
2011-12-30 18:33 - 2011-12-30 18:35 - 0012732 ___SH () C:\ProgramData\8hg05m6im1
Task: {1443EA3F-BFFC-465B-ADB5-18883DF4AF50} - System32\Tasks\{1A559631-473F-41C7-BC3F-554A82D1BFAA} => pcalua.exe -a "C:\Users\jamesrturpen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H7CUXX5J\zunesetuppkg-x86[1].exe" -d C:\Users\jamesrturpen\Desktop
Task: {1B22B8E7-A6E9-45BF-9447-83E89F0D06D2} - System32\Tasks\{026FFF77-E3B7-47C7-B9B9-2B826A0FEDA5} => pcalua.exe -a "C:\Users\jamesrturpen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CMX0JZIB\Setup.exe" -d C:\Users\jamesrturpen\Desktop
Task: {2FD65FB0-D64B-4714-AD4E-63E9BBF1DBC9} - System32\Tasks\{D5C21A01-D4FF-49A7-AD30-011612818CDC} => pcalua.exe -a "C:\Users\jamesrturpen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DLCGW929\desktopsp2_StubInstaller[1].exe" -d C:\Users\jamesrturpen\Desktop
Task: {388F4770-7E80-4627-B977-E1B29DA35C54} - System32\Tasks\{EB66F056-EFB2-4BEA-A296-8B9BCE4FD723} => pcalua.exe -a C:\Users\jamesrturpen\Downloads\eauninstall.exe -d C:\Users\jamesrturpen\Downloads
Task: {475AFCD8-AD03-4AC4-8778-7C76E295A916} - System32\Tasks\{C039E128-45FE-4F27-B938-F0CB1AF7E6BE} => pcalua.exe -a "C:\Users\jamesrturpen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1JHMMEOZ\AmazonUnboxVideo[1].exe"
Task: {66ACAC06-9B65-4434-858E-2EC8D27B5BF3} - System32\Tasks\934ad7e0 => C:\Users\JAMESR~1\AppData\Local\Temp\\setup1515508608.exe <==== ATTENTION
C:\$Recycle.Bin\S-1-5-21-3124041595-2245722441-2419751327-1000
C:\Users\jamesrturpen\subinacl.exe
C:\Users\jamesrturpen\AppData\Roaming\skype.ini
C:\Users\Public\dcmsvcsetup.exe
C:\Windows\assembly\tmp
C:\Program Files (x86)\Jsip
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
RemoveProxy:
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: ipconfig /flushdns
CMD: netsh winsock reset catalog
CMD: netsh int ip reset c:\resetlog.txt
CMD: ipconfig /release
CMD: ipconfig /renew
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
EmptyTemp:
CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

Run FRST and press Fix
On completion a log will be generated please post that

[jamesrturpen]

Here's the log, still not getting Defender to work...

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 06-05-2015 01
Ran by jamesrturpen at 2015-05-08 17:38:28 Run:1
Running from C:\Users\jamesrturpen\Desktop
Loaded Profiles: jamesrturpen (Available profiles: jamesrturpen & Mcx1-JAMESRTURPEN-PC)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
CreateRestorePoint:
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] fastprox.dll ATTENTION! ====> ZeroAccess?
HKU\S-1-5-19\...\Winlogon: [Shell] C:\Windows\Explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-20\...\Winlogon: [Shell] C:\Windows\Explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\...409d6c4515e9\InprocServer32: [Default-shell32] C:\$Recycle.Bin\S-1-5-21-3124041595-2245722441-2419751327-1000\$3b75540adbbdacf373836bb4b95f9b71\n. ATTENTION! ====> ZeroAccess?
HKU\S-1-5-18\...\Winlogon: [Shell] C:\Windows\Explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:13091
ProxyEnable: [S-1-5-21-3124041595-2245722441-2419751327-1000] => Internet Explorer proxy is enabled.
ProxyServer: [S-1-5-21-3124041595-2245722441-2419751327-1000] => http=127.0.0.1:13091;
SearchScopes: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000 -> {195EF21C-18F4-4DC4-A1CA-617D1D77C479} URL = http://search.genieo...q={searchTerms}
SearchScopes: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000 -> {A1805FC6-4A09-46B4-875B-05E03CE9C26A} URL = http://search.condui...q={searchTerms}
SearchScopes: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000 -> {B42FF0B8-6B7F-58A0-3465-D8FA89BD9731} URL = http://indyd.asksear...}&cfg=2-571-0-0
Toolbar: HKU\.DEFAULT -> No Name - {58BECA16-CAE6-4B7A-A0E8-153D0CBBA63A} - No File
Toolbar: HKU\.DEFAULT -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKU\S-1-5-21-3124041595-2245722441-2419751327-1000 -> No Name - {58BECA16-CAE6-4B7A-A0E8-153D0CBBA63A} - No File
Winsock: Catalog5 03 C:\Windows\SysWOW64\mswsock.dll [231424 2013-10-10] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5 04 %SystemRoot%\System32\nwprovau.dll File Not found
Winsock: Catalog5-x64 01 mswsock.dll File Not found ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5-x64 05 mswsock.dll File Not found ATTENTION: The LibraryPath should be "%SystemRoot%\System32\mswsock.dll"
FF Plugin HKU\S-1-5-21-3124041595-2245722441-2419751327-1000: @movenetworks.com/Quantum Media Player -> C:\Users\jamesrturpen\AppData\Roaming\Move Networks\plugins\npqmp071705000014.dll No File
R2 Jsip; C:\Program Files (x86)\Jsip\Jsip.exe [390144 2014-06-06] () [File not signed] <==== ATTENTION
2015-05-06 21:04 - 2015-05-06 21:04 - 02482688 _____ () C:\Users\jamesrturpen\Desktop\JsipUninstaller.exe
2013-05-04 20:45 - 2013-05-04 20:47 - 0000004 _____ () C:\Users\jamesrturpen\AppData\Roaming\skype.ini
2011-12-17 13:56 - 2011-12-19 10:18 - 0012136 ___SH () C:\Users\jamesrturpen\AppData\Local\0o3f77o81upvx0vurq2i2o5wa60uk7527132rx
2011-12-30 18:33 - 2011-12-30 18:35 - 0012732 ___SH () C:\Users\jamesrturpen\AppData\Local\8hg05m6im1
2011-12-17 13:56 - 2011-12-19 10:18 - 0012136 ___SH () C:\ProgramData\0o3f77o81upvx0vurq2i2o5wa60uk7527132r
2011-12-30 18:33 - 2011-12-30 18:35 - 0012732 ___SH () C:\ProgramData\8hg05m6im1
Task: {1443EA3F-BFFC-465B-ADB5-18883DF4AF50} - System32\Tasks\{1A559631-473F-41C7-BC3F-554A82D1BFAA} => pcalua.exe -a "C:\Users\jamesrturpen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H7CUXX5J\zunesetuppkg-x86[1].exe" -d C:\Users\jamesrturpen\Desktop
Task: {1B22B8E7-A6E9-45BF-9447-83E89F0D06D2} - System32\Tasks\{026FFF77-E3B7-47C7-B9B9-2B826A0FEDA5} => pcalua.exe -a "C:\Users\jamesrturpen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CMX0JZIB\Setup.exe" -d C:\Users\jamesrturpen\Desktop
Task: {2FD65FB0-D64B-4714-AD4E-63E9BBF1DBC9} - System32\Tasks\{D5C21A01-D4FF-49A7-AD30-011612818CDC} => pcalua.exe -a "C:\Users\jamesrturpen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DLCGW929\desktopsp2_StubInstaller[1].exe" -d C:\Users\jamesrturpen\Desktop
Task: {388F4770-7E80-4627-B977-E1B29DA35C54} - System32\Tasks\{EB66F056-EFB2-4BEA-A296-8B9BCE4FD723} => pcalua.exe -a C:\Users\jamesrturpen\Downloads\eauninstall.exe -d C:\Users\jamesrturpen\Downloads
Task: {475AFCD8-AD03-4AC4-8778-7C76E295A916} - System32\Tasks\{C039E128-45FE-4F27-B938-F0CB1AF7E6BE} => pcalua.exe -a "C:\Users\jamesrturpen\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1JHMMEOZ\AmazonUnboxVideo[1].exe"
Task: {66ACAC06-9B65-4434-858E-2EC8D27B5BF3} - System32\Tasks\934ad7e0 => C:\Users\JAMESR~1\AppData\Local\Temp\\setup1515508608.exe <==== ATTENTION
C:\$Recycle.Bin\S-1-5-21-3124041595-2245722441-2419751327-1000
C:\Users\jamesrturpen\subinacl.exe
C:\Users\jamesrturpen\AppData\Roaming\skype.ini
C:\Users\Public\dcmsvcsetup.exe
C:\Windows\assembly\tmp
C:\Program Files (x86)\Jsip
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
RemoveProxy:
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: ipconfig /flushdns
CMD: netsh winsock reset catalog
CMD: netsh int ip reset c:\resetlog.txt
CMD: ipconfig /release
CMD: ipconfig /renew
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
EmptyTemp:
CMD: bitsadmin /reset /allusers
*****************

Restore point was successfully created.
HKLM\Software\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\\Default => Value was restored successfully.
HKU\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => value deleted successfully.
HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => value deleted successfully.
"HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\Software\Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}" => Key deleted successfully.
HKU\S-1-5-18\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => value deleted successfully.
C:\Windows\system32\GroupPolicy\Machine => Moved successfully.
C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully.
C:\Windows\SysWOW64\GroupPolicy\GPT.ini => Moved successfully.
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
"HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value deleted successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value deleted successfully.
HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => Value not found.
"HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{195EF21C-18F4-4DC4-A1CA-617D1D77C479}" => Key deleted successfully.
HKCR\CLSID\{195EF21C-18F4-4DC4-A1CA-617D1D77C479} => Key not found.
"HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A1805FC6-4A09-46B4-875B-05E03CE9C26A}" => Key deleted successfully.
HKCR\CLSID\{A1805FC6-4A09-46B4-875B-05E03CE9C26A} => Key not found.
"HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B42FF0B8-6B7F-58A0-3465-D8FA89BD9731}" => Key deleted successfully.
HKCR\CLSID\{B42FF0B8-6B7F-58A0-3465-D8FA89BD9731} => Key not found.
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{58BECA16-CAE6-4B7A-A0E8-153D0CBBA63A} => value deleted successfully.
HKCR\CLSID\{58BECA16-CAE6-4B7A-A0E8-153D0CBBA63A} => Key not found.
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => value deleted successfully.
HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Key not found.
HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => value deleted successfully.
HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Key not found.
HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{58BECA16-CAE6-4B7A-A0E8-153D0CBBA63A} => value deleted successfully.
HKCR\CLSID\{58BECA16-CAE6-4B7A-A0E8-153D0CBBA63A} => Key not found.
Winsock: Catalog5 entry 000000000003\\LibraryPath  was set successfully to %SystemRoot%\system32\NLAapi.dll
Winsock: Catalog entry 000000000004 => Deleted successfully.
Winsock: Catalog5-x64 entry 000000000001\\LibraryPath  was set successfully to %SystemRoot%\system32\NLAapi.dll
Winsock: Catalog5-x64 entry 000000000005\\LibraryPath  was set successfully to %SystemRoot%\System32\mswsock.dll
"HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player" => Key deleted successfully.
C:\Users\jamesrturpen\AppData\Roaming\Move Networks\plugins\npqmp071705000014.dll not found.
Jsip => Service not found.
"C:\Users\jamesrturpen\Desktop\JsipUninstaller.exe" => File/Directory not found.
C:\Users\jamesrturpen\AppData\Roaming\skype.ini => Moved successfully.
C:\Users\jamesrturpen\AppData\Local\0o3f77o81upvx0vurq2i2o5wa60uk7527132rx => Moved successfully.
C:\Users\jamesrturpen\AppData\Local\8hg05m6im1 => Moved successfully.
"C:\ProgramData\0o3f77o81upvx0vurq2i2o5wa60uk7527132r" => File/Directory not found.
C:\ProgramData\8hg05m6im1 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{1443EA3F-BFFC-465B-ADB5-18883DF4AF50}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1443EA3F-BFFC-465B-ADB5-18883DF4AF50}" => Key deleted successfully.
C:\Windows\System32\Tasks\{1A559631-473F-41C7-BC3F-554A82D1BFAA} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{1A559631-473F-41C7-BC3F-554A82D1BFAA}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{1B22B8E7-A6E9-45BF-9447-83E89F0D06D2}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1B22B8E7-A6E9-45BF-9447-83E89F0D06D2}" => Key deleted successfully.
C:\Windows\System32\Tasks\{026FFF77-E3B7-47C7-B9B9-2B826A0FEDA5} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{026FFF77-E3B7-47C7-B9B9-2B826A0FEDA5}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2FD65FB0-D64B-4714-AD4E-63E9BBF1DBC9}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2FD65FB0-D64B-4714-AD4E-63E9BBF1DBC9}" => Key deleted successfully.
C:\Windows\System32\Tasks\{D5C21A01-D4FF-49A7-AD30-011612818CDC} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{D5C21A01-D4FF-49A7-AD30-011612818CDC}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{388F4770-7E80-4627-B977-E1B29DA35C54}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{388F4770-7E80-4627-B977-E1B29DA35C54}" => Key deleted successfully.
C:\Windows\System32\Tasks\{EB66F056-EFB2-4BEA-A296-8B9BCE4FD723} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{EB66F056-EFB2-4BEA-A296-8B9BCE4FD723}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{475AFCD8-AD03-4AC4-8778-7C76E295A916}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{475AFCD8-AD03-4AC4-8778-7C76E295A916}" => Key deleted successfully.
C:\Windows\System32\Tasks\{C039E128-45FE-4F27-B938-F0CB1AF7E6BE} => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{C039E128-45FE-4F27-B938-F0CB1AF7E6BE}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{66ACAC06-9B65-4434-858E-2EC8D27B5BF3}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{66ACAC06-9B65-4434-858E-2EC8D27B5BF3}" => Key deleted successfully.
C:\Windows\System32\Tasks\934ad7e0 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\934ad7e0" => Key deleted successfully.
C:\$Recycle.Bin\S-1-5-21-3124041595-2245722441-2419751327-1000 => Moved successfully.
C:\Users\jamesrturpen\subinacl.exe => Moved successfully.
"C:\Users\jamesrturpen\AppData\Roaming\skype.ini" => File/Directory not found.
C:\Users\Public\dcmsvcsetup.exe => Moved successfully.
C:\Windows\assembly\tmp => Moved successfully.
"C:\Program Files (x86)\Jsip" => File/Directory not found.

========= reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========

The operation completed successfully.



========= End of Reg: =========


========= reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========

The operation completed successfully.



========= End of Reg: =========


========= RemoveProxy: =========

HKLM\SYSTEM\CurrentControlSet\services\NlaSvc\Parameters\Internet\ManualProxies\\ => value deleted successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value deleted successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value deleted successfully.
HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value deleted successfully.
HKU\S-1-5-21-3124041595-2245722441-2419751327-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value deleted successfully.


========= End of RemoveProxy: =========


=========  netsh advfirewall reset =========

Ok.


========= End of CMD: =========


=========  netsh advfirewall set allprofiles state ON =========

Ok.


========= End of CMD: =========


=========  ipconfig /flushdns =========


Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========


=========  netsh winsock reset catalog =========


Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.


========= End of CMD: =========


=========  netsh int ip reset c:\resetlog.txt =========

Reseting Global, OK!
Reseting Interface, OK!
Restart the computer to complete this action.


========= End of CMD: =========


=========  ipconfig /release =========


Windows IP Configuration

No operation can be performed on Wireless Network Connection 2 while it has its media disconnected.
No operation can be performed on Local Area Connection while it has its media disconnected.

Wireless LAN adapter Wireless Network Connection 2:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Wireless LAN adapter Wireless Network Connection:

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::35a9:9f80:87b8:9077%11
   Default Gateway . . . . . . . . . :

Ethernet adapter Local Area Connection:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Tunnel adapter isatap.{878CC645-9601-4654-89A8-6879B555A2B5}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Tunnel adapter isatap.{9E19D339-03CF-45E4-9935-8B2CAE347173}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Tunnel adapter isatap.{74CF8C3F-80B8-4646-BCE6-1620B9E2CDCD}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Tunnel adapter isatap.om.cox.net:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Tunnel adapter Local Area Connection* 34:

   Connection-specific DNS Suffix  . :
   IPv6 Address. . . . . . . . . . . : 2001:0:5cf2:8c02:28a5:276e:3f57:ff99
   Link-local IPv6 Address . . . . . : fe80::28a5:276e:3f57:ff99%47
   Default Gateway . . . . . . . . . : ::

========= End of CMD: =========


=========  ipconfig /renew =========


Windows IP Configuration

No operation can be performed on Wireless Network Connection 2 while it has its media disconnected.
No operation can be performed on Local Area Connection while it has its media disconnected.

Wireless LAN adapter Wireless Network Connection 2:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Wireless LAN adapter Wireless Network Connection:

   Connection-specific DNS Suffix  . : om.cox.net
   Link-local IPv6 Address . . . . . : fe80::35a9:9f80:87b8:9077%11
   IPv4 Address. . . . . . . . . . . : 192.168.0.102
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.0.1

Ethernet adapter Local Area Connection:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Tunnel adapter isatap.{878CC645-9601-4654-89A8-6879B555A2B5}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Tunnel adapter isatap.{9E19D339-03CF-45E4-9935-8B2CAE347173}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Tunnel adapter isatap.{74CF8C3F-80B8-4646-BCE6-1620B9E2CDCD}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Tunnel adapter isatap.om.cox.net:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Tunnel adapter Local Area Connection* 34:

   Connection-specific DNS Suffix  . :
   IPv6 Address. . . . . . . . . . . : 2001:0:5cf2:8c02:3424:1f91:3f57:ff99
   Link-local IPv6 Address . . . . . : fe80::3424:1f91:3f57:ff99%47
   Default Gateway . . . . . . . . . : ::

========= End of CMD: =========


=========  netsh int ipv4 reset =========

Reseting Interface, OK!
Restart the computer to complete this action.


========= End of CMD: =========


=========  netsh int ipv6 reset =========

Reseting Interface, OK!
Restart the computer to complete this action.


========= End of CMD: =========


=========  bitsadmin /reset /allusers =========


BITSADMIN version 3.0 [ 7.5.7601 ]
BITS administration utility.
© Copyright 2000-2006 Microsoft Corp.

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

0 out of 0 jobs canceled.

========= End of CMD: =========

EmptyTemp: => Removed 1.9 GB temporary data.


The system needed a reboot.

==== End of Fixlog 17:42:13 ====

[Essexboy]

I believe I know what it may be as you had zeroaccess

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.
• Accept the disclaimer and allow to update if it asks
  
  http://img.photobuck...claimer_ENG.png

• When finished, it shall produce a log for you.
• Please include the C:\ComboFix.txt in your next reply.
• Notes:
  1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
  2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
  3. If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.
  
  
  Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now
  
  THEN
  
  
  Download and run farbar service scanner
  
  
  
  Tick "All" options.
  Press "Scan".
  It will create a log (FSS.txt) in the same directory the tool is run.
  
  Please copy and paste the log to your reply.

[jamesrturpen]

Windows Defender is back and my computer seems to be running way better...startup is way less cumbersome! Here's the combofix log:

 

ComboFix 15-05-09.01 - jamesrturpen 05/09/2015  15:48:08.10.2 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.4059.2927 [GMT -5:00]
Running from: c:\users\jamesrturpen\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\ntuser.pol
C:\UNWISE.EXE
c:\users\jamesrturpen\GoToAssistDownloadHelper.exe
.
.
(((((((((((((((((((((((((   Files Created from 2015-04-09 to 2015-05-09  )))))))))))))))))))))))))))))))
.
.
2015-05-09 21:03 . 2015-05-09 21:03    --------    d-----w-    c:\users\Public\AppData\Local\temp
2015-05-09 21:03 . 2015-05-09 21:03    --------    d-----w-    c:\users\Mcx1-JAMESRTURPEN-PC\AppData\Local\temp
2015-05-09 21:03 . 2015-05-09 21:03    --------    d-----w-    c:\users\Default\AppData\Local\temp
2015-05-08 09:29 . 2015-04-20 05:58    12032440    ----a-w-    c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{EAA5E018-34EE-4027-9210-A63B22830192}\mpengine.dll    ERROR(0x00000005)
2015-05-07 18:17 . 2015-04-20 05:58    12032440    ------w-    c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Updates\mpengine.dll    ERROR(0x00000005)
2015-05-07 02:05 . 2015-05-08 22:47    --------    d-----w-    C:\FRST
2015-04-18 17:33 . 2015-04-18 17:33    --------    d-----w-    c:\program files (x86)\iTunes
2015-04-18 17:33 . 2015-04-18 17:33    --------    d-----w-    c:\program files\iPod
2015-04-18 17:33 . 2015-04-18 17:35    --------    d-----w-    c:\program files\iTunes
2015-04-15 17:41 . 2015-03-17 05:22    5557696    ----a-w-    c:\windows\system32\ntoskrnl.exe
2015-04-15 17:40 . 2015-03-10 03:21    2048    ----a-w-    c:\windows\system32\msxml3r.dll
2015-04-15 17:39 . 2015-03-04 04:55    367552    ----a-w-    c:\windows\system32\clfs.sys
2015-04-15 17:39 . 2015-03-04 04:41    79360    ----a-w-    c:\windows\system32\clfsw32.dll
2015-04-15 17:39 . 2015-03-04 04:10    58880    ----a-w-    c:\windows\SysWow64\clfsw32.dll
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-04-20 05:58 . 2015-05-09 21:09    12032440    ----a-w-    c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{DFD7E810-B27A-4298-AB93-ACED19032C6E}\mpengine.dll    ERROR(0x00000005)
2015-04-20 05:58 . 2011-10-06 10:06    12032440    ----a-w-    c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll    ERROR(0x00000005)
2015-04-17 01:18 . 2014-07-02 18:58    129752    ----a-w-    c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-04-16 00:36 . 2009-12-09 01:10    128913832    ----a-w-    c:\windows\system32\MRT.exe
2015-04-15 18:02 . 2012-04-02 17:49    778416    ----a-w-    c:\windows\SysWow64\FlashPlayerApp.exe
2015-04-15 18:02 . 2011-05-20 20:02    142512    ----a-w-    c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-03-17 04:56 . 2015-04-15 17:41    44032    ----a-w-    c:\windows\apppatch\acwow64.dll
2015-02-26 03:25 . 2015-03-10 21:04    3204096    ----a-w-    c:\windows\system32\win32k.sys
2015-02-24 09:17 . 2009-10-03 02:58    295552    ------w-    c:\windows\system32\MpSigStub.exe
2015-02-20 04:41 . 2015-03-10 21:10    41984    ----a-w-    c:\windows\system32\lpk.dll
2015-02-20 04:40 . 2015-03-10 21:10    100864    ----a-w-    c:\windows\system32\fontsub.dll
2015-02-20 04:40 . 2015-03-10 21:10    14336    ----a-w-    c:\windows\system32\dciman32.dll
2015-02-20 04:40 . 2015-03-10 21:10    46080    ----a-w-    c:\windows\system32\atmlib.dll
2015-02-20 04:13 . 2015-03-10 21:10    70656    ----a-w-    c:\windows\SysWow64\fontsub.dll
2015-02-20 04:13 . 2015-03-10 21:10    10240    ----a-w-    c:\windows\SysWow64\dciman32.dll
2015-02-20 04:13 . 2015-03-10 21:10    34304    ----a-w-    c:\windows\SysWow64\atmlib.dll
2015-02-20 04:12 . 2015-03-10 21:10    25600    ----a-w-    c:\windows\SysWow64\lpk.dll
2015-02-20 03:29 . 2015-03-10 21:10    372224    ----a-w-    c:\windows\system32\atmfd.dll
2015-02-20 03:09 . 2015-03-10 21:10    299008    ----a-w-    c:\windows\SysWow64\atmfd.dll
2015-02-17 21:04 . 2015-02-17 21:04    1202848    ----a-w-    c:\windows\SysWow64\FM20.DLL
2015-02-13 05:22 . 2015-03-10 21:05    14177280    ----a-w-    c:\windows\system32\shell32.dll
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\WMAllKey]
@="{5028CECA-A6C3-4D9C-BA25-6C04D8C3ED80}"
[HKEY_CLASSES_ROOT\CLSID\{5028CECA-A6C3-4D9C-BA25-6C04D8C3ED80}]
2010-07-25 18:33    291912    ----a-w-    c:\program files (x86)\WinMagic\SecureDoc-NT\SDContext.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\WMNoKey]
@="{2659CB3D-3D6E-42CE-AD9D-FE41C3617CC1}"
[HKEY_CLASSES_ROOT\CLSID\{2659CB3D-3D6E-42CE-AD9D-FE41C3617CC1}]
2010-07-25 18:33    291912    ----a-w-    c:\program files (x86)\WinMagic\SecureDoc-NT\SDContext.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\WMNotTransformed]
@="{01DBDE7E-2D13-4495-BE04-12AA56CC2751}"
[HKEY_CLASSES_ROOT\CLSID\{01DBDE7E-2D13-4495-BE04-12AA56CC2751}]
2010-07-25 18:33    291912    ----a-w-    c:\program files (x86)\WinMagic\SecureDoc-NT\SDContext.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\WMPartialKey]
@="{5133E633-CFED-4043-9971-38936512E6D4}"
[HKEY_CLASSES_ROOT\CLSID\{5133E633-CFED-4043-9971-38936512E6D4}]
2010-07-25 18:33    291912    ----a-w-    c:\program files (x86)\WinMagic\SecureDoc-NT\SDContext.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2010-11-20 163328]
"TranscodingService"="c:\program files (x86)\TiVo\Desktop\Plus\\TranscodingService.exe" [2010-08-24 856336]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartSecurDoc"="c:\program files (x86)\WinMagic\SecureDoc-NT\SDPin.exe" [2010-07-25 2184264]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2014-10-02 421888]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"HideFastUserSwitching"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"UseDefaultTile"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_Dlls"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 0119701324248277mcinstcleanup;McAfee Application Installer Cleanup (0119701324248277);c:\users\JAMESR~1\AppData\Local\Temp\011970~1.EXE;c:\users\JAMESR~1\AppData\Local\Temp\011970~1.EXE [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys;c:\windows\SYSNATIVE\DRIVERS\netw5v64.sys [x]
R3 Sockblkd;Sockblkd;c:\program files\Extegrity\Exam4\Sockblkd.sys;c:\program files\Extegrity\Exam4\Sockblkd.sys [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssadbus.sys [x]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 TivoBeacon2;TiVo Beacon Service;c:\program files (x86)\TiVo\Desktop\TiVoBeacon.exe;c:\program files (x86)\TiVo\Desktop\TiVoBeacon.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 PinFile;PinFile;c:\windows\system32\DRIVERS\PinFile.sys;c:\windows\SYSNATIVE\DRIVERS\PinFile.sys [x]
S0 SDDisk2K;SDDisk2K;c:\windows\system32\DRIVERS\SDDisk2K.sys;c:\windows\SYSNATIVE\DRIVERS\SDDisk2K.sys [x]
S0 SDDToki;SDDToki;c:\windows\system32\DRIVERS\SDDToki.sys;c:\windows\SYSNATIVE\DRIVERS\SDDToki.sys [x]
S0 SDDVD;SDDVD;c:\windows\system32\DRIVERS\SDDVD.sys;c:\windows\SYSNATIVE\DRIVERS\SDDVD.sys [x]
S0 SDUPC;SDUPC;c:\windows\system32\DRIVERS\SDUPC.sys;c:\windows\SYSNATIVE\DRIVERS\SDUPC.sys [x]
S0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\DRIVERS\thpdrv.sys;c:\windows\SYSNATIVE\DRIVERS\thpdrv.sys [x]
S0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\DRIVERS\Thpevm.SYS;c:\windows\SYSNATIVE\DRIVERS\Thpevm.SYS [x]
S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys;c:\windows\SYSNATIVE\DRIVERS\tos_sps64.sys [x]
S1 PMCF;PMCF;c:\windows\system32\drivers\PMCF.sys;c:\windows\SYSNATIVE\drivers\PMCF.sys [x]
S2 Apple Mobile Device Service;Apple Mobile Device Service;c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe;c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [x]
S2 camsvc;TOSHIBA Web Camera Service;c:\program files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCameraSrv.exe;c:\program files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCameraSrv.exe [x]
S2 cfWiMAXService;ConfigFree WiMAX Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe;c:\program files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe [x]
S2 ConfigFree Gadget Service;ConfigFree Gadget Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe;c:\program files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe [x]
S2 ConfigFree Service;ConfigFree Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [x]
S2 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe;c:\program files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [x]
S2 rimspci;rimspci;c:\windows\system32\DRIVERS\rimspe64.sys;c:\windows\SYSNATIVE\DRIVERS\rimspe64.sys [x]
S2 risdpcie;risdpcie;c:\windows\system32\DRIVERS\risdpe64.sys;c:\windows\SYSNATIVE\DRIVERS\risdpe64.sys [x]
S2 rixdpcie;rixdpcie;c:\windows\system32\DRIVERS\rixdpe64.sys;c:\windows\SYSNATIVE\DRIVERS\rixdpe64.sys [x]
S2 RSELSVC;TOSHIBA Modem region select service;c:\program files\TOSHIBA\rselect\RSelSvc.exe;c:\program files\TOSHIBA\rselect\RSelSvc.exe [x]
S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe;c:\program files\TOSHIBA\TECO\TecoService.exe [x]
S2 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [x]
S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys;c:\windows\SYSNATIVE\DRIVERS\TVALZFL.sys [x]
S2 WinMagic SecureDoc Service;WinMagic SecureDoc Service;c:\program files (x86)\WinMagic\SecureDoc-NT\SDService.exe;c:\program files (x86)\WinMagic\SecureDoc-NT\SDService.exe [x]
S3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys;c:\windows\SYSNATIVE\drivers\IntcHdmi.sys [x]
S3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETw5s64.sys;c:\windows\SYSNATIVE\DRIVERS\NETw5s64.sys [x]
S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys;c:\windows\SYSNATIVE\DRIVERS\pgeffect.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - mfeavfk
*Deregistered* - mfehidk
*Deregistered* - MPFP
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-04-30 18:21    988488    ----a-w-    c:\program files (x86)\Google\Chrome\Application\42.0.2311.135\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2015-05-09 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 18:02]
.
2015-05-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-23 07:02]
.
2015-05-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-23 07:02]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy2]
@="{747E722C-CB46-4a9d-BDFE-192AAD5099B1}"
[HKEY_CLASSES_ROOT\CLSID\{747E722C-CB46-4a9d-BDFE-192AAD5099B1}]
2011-02-08 19:24    4368184    ----a-w-    c:\program files\MozyHome\mozyshell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy3]
@="{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20}"
[HKEY_CLASSES_ROOT\CLSID\{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20}]
2011-02-08 19:24    4368184    ----a-w-    c:\program files\MozyHome\mozyshell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThpSrv"="c:\windows\system32\thpsrv" [X]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2009-04-03 308736]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-08-24 8081952]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2015-04-07 169768]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.bing.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
Trusted Zone: genieo.com\search
Trusted Zone: gotoassist.com\broker
Trusted Zone: hola.org
Trusted Zone: internet
Trusted Zone: mcafee.com
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\jamesrturpen\AppData\Roaming\Mozilla\Firefox\Profiles\u27gjy1u.default\
FF - prefs.js: browser.startup.homepage - my.yahoo.com
FF - user.js: extensions.shownSelectionUI - true
.
- - - - ORPHANS REMOVED - - - -
.
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
AddRemove-{1B9604EE-B104-45C8-8551-5F63BA631E23} - c:\programdata\{E0A9340B-C01B-42C1-9910-C307D7BE4756}\WeatherBugSetup.exe
AddRemove-Havka FOkm - c:\windows\system32\javaws.exe
AddRemove-Move Media Player - c:\users\jamesrturpen\AppData\Roaming\Move Networks\uninstall.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064}"=hex:51,66,7a,6c,4c,1d,38,12,26,bd,a8,
   0a,e6,f4,22,0e,f1,4c,12,2a,bb,94,a4,70
"{2318C2B1-4965-11D4-9B18-009027A5CD4F}"=hex:51,66,7a,6c,4c,1d,38,12,df,c1,0b,
   27,57,07,ba,54,e4,0e,43,d0,22,fb,89,5b
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}"=hex:51,66,7a,6c,4c,1d,38,12,5c,be,8a,
   eb,c9,8f,bc,54,f6,39,43,d0,22,43,0b,9c
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=hex:51,66,7a,6c,4c,1d,38,12,11,7f,11,
   d0,78,5b,08,05,de,bb,01,03,dd,4c,30,54
"{58BECA16-CAE6-4B7A-A0E8-153D0CBBA63A}"=hex:51,66,7a,6c,4c,1d,38,12,78,c9,ad,
   5c,d4,84,14,0e,df,fe,56,7d,09,e5,e2,2e
"{30F9B915-B755-4826-820B-08FBA6BD249D}"=hex:51,66,7a,6c,4c,1d,38,12,7b,ba,ea,
   34,67,f9,48,0d,fd,1d,4b,bb,a3,e3,60,89
"{88C7F2AA-F93F-432C-8F0E-B7D85967A527}"=hex:51,66,7a,6c,4c,1d,38,12,c4,f1,d4,
   8c,0d,b7,42,06,f0,18,f4,98,5c,39,e1,33
"{8DCB7100-DF86-4384-8842-8FA844297B3F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,72,d8,
   89,b4,91,ea,06,f7,54,cc,e8,41,77,3f,2b
"{02478D38-C3F9-4EFB-9B51-7695ECA05670}"=hex:51,66,7a,6c,4c,1d,38,12,56,8e,54,
   06,cb,8d,95,0b,e4,47,35,d5,e9,fe,12,64
"{0347C33E-8762-4905-BF09-768834316C61}"=hex:51,66,7a,6c,4c,1d,38,12,50,c0,54,
   07,50,c9,6b,0c,c0,1f,35,c8,31,6f,28,75
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
   1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,38,12,d5,94,07,
   72,c2,98,42,03,c9,fd,97,9a,f4,87,69,57
"{7DB2D5A0-7241-4E79-B68D-6309F01C5231}"=hex:51,66,7a,6c,4c,1d,38,12,ce,d6,a1,
   79,73,3c,17,0b,c9,9b,20,49,f5,42,16,25
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
   94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
"{AA58ED58-01DD-4D91-8333-CF10577473F7}"=hex:51,66,7a,6c,4c,1d,38,12,36,ee,4b,
   ae,ef,4f,ff,08,fc,25,8c,50,52,2a,37,e3
"{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}"=hex:51,66,7a,6c,4c,1d,38,12,2d,dd,7a,
   ab,6a,33,56,03,c9,ec,8d,26,b0,f3,64,49
"{B164E929-A1B6-4A06-B104-2CD0E90A88FF}"=hex:51,66,7a,6c,4c,1d,38,12,47,ea,77,
   b5,84,ef,68,0f,ce,12,6f,90,ec,54,cc,eb
"{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}"=hex:51,66,7a,6c,4c,1d,38,12,90,71,5e,
   cc,4f,af,fb,04,c4,32,35,80,2b,70,38,5a
"{D2CE3E00-F94A-4740-988E-03DC2F38C34F}"=hex:51,66,7a,6c,4c,1d,38,12,6e,3d,dd,
   d6,78,b7,2e,02,e7,98,40,9c,2a,66,87,5b
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
   df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856}"=hex:51,66,7a,6c,4c,1d,38,12,91,fc,ec,
   fb,7c,81,45,0a,c2,d4,4d,32,e4,48,ec,42
"{555D4D79-4BD2-4094-A395-CFC534424A05}"=hex:51,66,7a,6c,4c,1d,38,12,17,4e,4e,
   51,e0,05,fa,05,dc,83,8c,85,31,1c,0e,11
"{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16,
   fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17
"{B4716D33-CEDB-41BC-8FBF-28CEFB9C2CAB}"=hex:51,66,7a,6c,4c,1d,38,12,5d,6e,62,
   b0,e9,80,d2,04,f0,a9,6b,8e,fe,c2,68,bf
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:4d,6d,06,3c,e0,77,cc,01
.
[HKEY_USERS\S-1-5-21-3124041595-2245722441-2419751327-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-3124041595-2245722441-2419751327-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_17_0_0_169_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_17_0_0_169_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_17_0_0_169_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_17_0_0_169_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_169.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.17"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_169.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_169.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_169.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
   00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\DbgagD\1*]
"value"="?\05\06\05\16\0e+z"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000001
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe
c:\program files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe
c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE
c:\program files (x86)\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe
c:\program files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
.
**************************************************************************
.
Completion time: 2015-05-09  16:21:37 - machine was rebooted
ComboFix-quarantined-files.txt  2015-05-09 21:21
ComboFix2.txt  2012-08-03 06:34
ComboFix3.txt  2012-03-23 03:43
ComboFix4.txt  2012-03-07 03:01
ComboFix5.txt  2015-05-09 20:42
.
Pre-Run: 160,162,799,616 bytes free
Post-Run: 160,367,972,352 bytes free
.
- - End Of File - - 8104F4EA50A09975FC97F2B3220BE2A5
A36C5E4F47E84449FF07ED3517B43A31
 

And the Farbar Service Scan report:

 

Farbar Service Scanner Version: 17-01-2015
Ran by jamesrturpen (administrator) on 09-05-2015 at 16:26:31
Running from "C:\Users\jamesrturpen\Desktop"
Microsoft Windows 7 Home Premium  Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Policy:
========================


Action Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============

Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcore.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****

 

Let me know if there are any other steps I should take, otherwise thank you very much for your help! This site is awesome!

 

Regards,

Jay

[Essexboy]

Nope I reckon we are done

Subject to no further problems

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:

Remove Combofix

Click Start then Run.
On Windows7 or Vista you may use Start Search field if Run is not available.
In the box copy/paste the following command:

ComboFix /Uninstall

Note that there is a space between " ComboFix " and " /Uninstall " .

Then click OK (or press Enter ).
Wait for the uninstall process to complete.

Remove tools

Download and run Delfix
Select the options as shown



: Keep Java Updated :

WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java
See this article

I would recommend that you completely uninstall Java unless you need it to run an important software.
In that instance I would recommend that you disable Java in your browsers until you need it for that software and then enable it. (See How to diasble Java in your web browser and How to unplug Java from the browser)

If you do need to keep Java then download JavaRa
Run the programme and select Remove Java Runtime. Uninstall all versions of Java present
Once done then run it again and select Update Java runtime > Download and install Latest version



Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

Malwarebytes.

Update and run weekly to keep your system clean

Unchecky

Click on the link above to be taken to Unchecky.com
click the very large Download button.
click Save
Click Open folder
Right click on the Unchecky_setup and choose to Run as Administrator
Once open click the Install button.
Then click on Finish
Unchecky is now installed and will help you keep unwanted check boxes unchecked, this is a fire and forget programme

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To learn more about how to protect yourself while on the internet read this little guide Best security practices Keep safe

[Essexboy]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.