My Mom's Computer Has Been Infected - Ransomware - Virus, Spyware, Malware Removal

Hello, my mother's computer has been infected with a ransomware virus. Her files have been encrypted so nothing can be open and a "help_decrpyt.txt" as well as ".png" file with the same name is everywhere a file was. A copy of those files also open on boot. Sadly, I am visiting my mother from AZ and have a very limited time to help with her computer (like 48 hours) before my flight out of town. Any help would be appreciated. Here are the files requested.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:27-08-2015
Ran by Kathy (administrator) on KATHY-PC (28-08-2015 12:14:20)
Running from C:\Users\Kathy\Desktop
Loaded Profiles: Kathy (Available Profiles: Kathy)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgcsrva.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(COMPANYVERS_NAME) C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\39barsvc.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\17.7.0.12\ccsvchst.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.8.0\ToolbarUpdater.exe
() C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.8.0\loggingserver.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe
(Capital Intellect, Inc.) C:\Users\Kathy\AppData\Local\Programs\BeFrugal.com\Add-On\2013.3.18.4\BFHP.exe
() C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
( ) C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\AppIntegrator64.exe
(ShopAtHome.com) C:\Users\Kathy\AppData\Roaming\ShopAtHome\ShopAtHomeHelper\ShopAtHomeWatcher.exe
(ShopAtHome.com) C:\Users\Kathy\AppData\Roaming\ShopAtHome\ShopAtHomeHelper\ShopAtHomeUpdater.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.11.149\SSScheduler.exe
(ShopAtHome.com) C:\Users\Kathy\AppData\Roaming\ShopAtHome\ShopAtHomeHelper\ShopAtHomeHelper.exe
(Hewlett-Packard Company) C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe
(Hewlett-Packard) C:\Program Files (x86)\hp\HP Software Update\hpwuschd2.exe
() C:\Program Files (x86)\AVG Secure Search\vprot.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(VER_COMPANY_NAME) C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\39brmon.exe
(VER_COMPANY_NAME) C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\39brmon64.exe
(ShopAtHome.com) C:\Users\Kathy\AppData\Roaming\ShopAtHome\ShopAtHomeHelper\ShopAtHomeWatcher.exe
(ShopAtHome.com) C:\Users\Kathy\AppData\Roaming\ShopAtHome\ShopAtHomeHelper\ShopAtHomeUpdater.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Google Inc.) C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
(CyberLink) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Service.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [SmartMenu] => C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe [610360 2009-09-14] ()
HKLM\...\Run: [PC-Doctor for Windows localizer] => C:\Program Files\PC-Doctor for Windows\localizer.exe [95728 2009-09-17] (PC-Doctor, Inc.)
HKLM\...\Run: [MapsGalaxy Home Page Guard 64 bit] => C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\AppIntegrator64.exe [485960 2014-06-01] ( )
HKLM-x32\...\Run: [hpsysdrv] => c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard)
HKLM-x32\...\Run: [HP Remote Solution] => C:\Program Files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe [656896 2009-08-24] (Hewlett-Packard)
HKLM-x32\...\Run: [HP Software Update] => c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [54576 2008-12-08] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [vProt] => C:\Program Files (x86)\AVG Secure Search\vprot.exe [2567568 2015-08-17] ()
HKLM-x32\...\Run: [MapsGalaxy EPM Support] => C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\39medint.exe [12872 2014-06-01] (Mindspark Interactive Network, Inc.)
HKLM-x32\...\Run: [MapsGalaxy Search Scope Monitor] => C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\39SrchMn.exe [55368 2014-06-01] (Mindspark)
HKLM-x32\...\Run: [MapsGalaxy_39 Browser Plugin Loader] => C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\39brmon.exe [61512 2014-06-01] (VER_COMPANY_NAME)
HKLM-x32\...\Run: [MapsGalaxy_39 Browser Plugin Loader 64] => C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\39brmon64.exe [71752 2014-06-01] (VER_COMPANY_NAME)
HKLM-x32\...\Run: [ShopAtHomeWatcher] => C:\Users\Kathy\AppData\Roaming\ShopAtHome\ShopAtHomeHelper\ShopAtHomeWatcher.exe [129208 2014-08-25] (ShopAtHome.com)
HKLM-x32\...\Run: [ShopAtHomeUpdater] => C:\Users\Kathy\AppData\Roaming\ShopAtHome\ShopAtHomeHelper\ShopAtHomeUpdater.exe [199864 2014-08-25] (ShopAtHome.com)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3730344 2015-07-07] (AVG Technologies CZ, s.r.o.)
HKU\S-1-5-21-3818672058-1777476097-3871671752-1000\...\Run: [HPADVISOR] => C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN
HKU\S-1-5-21-3818672058-1777476097-3871671752-1000\...\Run: [ShopAtHomeWatcher] => C:\Users\Kathy\AppData\Roaming\ShopAtHome\ShopAtHomeHelper\ShopAtHomeWatcher.exe [129208 2014-08-25] (ShopAtHome.com)
HKU\S-1-5-21-3818672058-1777476097-3871671752-1000\...\Run: [ShopAtHomeUpdater] => C:\Users\Kathy\AppData\Roaming\ShopAtHome\ShopAtHomeHelper\ShopAtHomeUpdater.exe [199864 2014-08-25] (ShopAtHome.com)
HKU\S-1-5-21-3818672058-1777476097-3871671752-1000\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2014-06-04] (Google Inc.)
HKU\S-1-5-21-3818672058-1777476097-3871671752-1000\...\Run: [BFHP] => C:\Users\Kathy\AppData\Local\Programs\BeFrugal.com\Add-On\2013.3.18.4\BFHP.exe [415776 2015-03-10] (Capital Intellect, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2014-07-25]
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.149\SSScheduler.exe (McAfee, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\PictureMover.lnk [2010-04-07]
ShortcutTarget: PictureMover.lnk -> C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe (Hewlett-Packard Company)
Startup: C:\Users\Kathy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HELP_DECRYPT.HTML [2015-06-23] ()
Startup: C:\Users\Kathy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HELP_DECRYPT.PNG [2015-06-23] ()
Startup: C:\Users\Kathy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HELP_DECRYPT.TXT [2015-06-23] ()
InternetURL: C:\Users\Kathy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HELP_DECRYPT.URL -> hxxp://6i3cb6owitcouepv.payoptvars.com/1m8t526

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.yahoo.com/?fr=befhp&type=iehp-3.18-1503
HKU\S-1-5-21-3818672058-1777476097-3871671752-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/
HKU\S-1-5-21-3818672058-1777476097-3871671752-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.yahoo.com/?fr=befhp&type=iehp-3.18-1503
URLSearchHook: HKU\S-1-5-21-3818672058-1777476097-3871671752-1000 - (No Name) - {26842a09-ffa8-4e2c-ae12-0c80f01c3295} - C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\39SrcAs.dll (Mindspark)
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {5583FB26-E11D-46B7-A934-4BE69EF436E0} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {AAAE3095-7364-4C02-B611-04E58947159C} URL = hxxp://www.ask.com/web?q={searchterms}&l=dis&o=ushpd
SearchScopes: HKU\S-1-5-21-3818672058-1777476097-3871671752-1000 -> {F3816467-6A68-4193-8603-4CBBC9E3E231} URL = hxxp://isearch.shopathome.com?user_id={dcdbe2b8-1e25-4d26-9773-f45fefc1f17e}&q={searchTerms}
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-07-18] (Google Inc.)
BHO-x32: Toolbar BHO -> {1e91a655-bb4b-4693-a05e-2edebc4c9d89} -> C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\39bar.dll [2014-06-01] (Mindspark)
BHO-x32: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} -> No File
BHO-x32: Symantec NCO BHO -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine\17.7.0.12\coIEPlg.dll [2010-05-12] (Symantec Corporation)
BHO-x32: Symantec Intrusion Prevention -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\17.7.0.12\IPSBHO.DLL [2010-05-13] (Symantec Corporation)
BHO-x32: Search Assistant BHO -> {71c1d63a-c944-428a-a5bd-ba513190e5d2} -> C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\39SrcAs.dll [2014-06-01] (Mindspark)
BHO-x32: Windows Live Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22] (Microsoft Corporation)
BHO-x32: AVG Security Toolbar -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files (x86)\AVG Secure Search\18.8.0.180\AVG Secure Search_toolbar.dll [2015-08-17] (AVG Secure Search)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-07-18] (Google Inc.)
BHO-x32: Microsoft Live Search Toolbar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> c:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll [2009-07-16] (Microsoft Corp.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-07-18] (Google Inc.)
Toolbar: HKLM-x32 - Microsoft Live Search Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll [2009-07-16] (Microsoft Corp.)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\17.7.0.12\coIEPlg.dll [2010-05-12] (Symantec Corporation)
Toolbar: HKLM-x32 - No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
Toolbar: HKLM-x32 - AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\18.8.0.180\AVG Secure Search_toolbar.dll [2015-08-17] (AVG Secure Search)
Toolbar: HKLM-x32 - MapsGalaxy - {364ea597-e728-4ce4-bb4a-ed846ef47970} - C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\39bar.dll [2014-06-01] (Mindspark)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-07-18] (Google Inc.)
Toolbar: HKU\S-1-5-21-3818672058-1777476097-3871671752-1000 -> No Name - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
Toolbar: HKU\S-1-5-21-3818672058-1777476097-3871671752-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKU\S-1-5-21-3818672058-1777476097-3871671752-1000 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
Toolbar: HKU\S-1-5-21-3818672058-1777476097-3871671752-1000 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-07-18] (Google Inc.)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)
Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\18.8.0\ViProtocol.dll [2015-08-17] (AVG Secure Search)
Hosts: 0.0.0.1 mssplus.mcafee.com
Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76
Tcpip\..\Interfaces\{11B2AEBD-39B2-4AD7-A22F-EFA17DA3234E}: [DhcpNameServer] 75.75.75.75 75.75.76.76

FireFox:
========
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\18.8.0\\npsitesafety.dll [No File]
FF Plugin-x32: @MapsGalaxy_39.com/Plugin -> C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\NP39Stub.dll [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\3.0.40624.0\npctrl.dll [2009-06-24] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2009-07-10] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-15] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-15] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3818672058-1777476097-3871671752-1000: @citrixonline.com/appdetectorplugin -> C:\Users\Kathy\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2015-06-23] (Citrix Online)
FF Plugin HKU\S-1-5-21-3818672058-1777476097-3871671752-1000: @hulu.com/Hulu Desktop -> C:\Windows\..\Users\Default\AppData\Local\HuluDesktop\instances\0.9.9.1\npHDPlg.dll [2009-10-27] (Hulu LLC)
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\IPSFFPlgn
FF Extension: No Name - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\IPSFFPlgn [2010-08-02]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\coFFPlgn
FF Extension: No Name - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\coFFPlgn [2010-08-02]
FF HKLM-x32\...\Firefox\Extensions: [avg@toolbar] - C:\ProgramData\AVG Secure Search\FireFoxExt\17.3.0.49

Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [ndibdjnfmopecpmkdieinmbadjfpblof] - C:\ProgramData\AVG Secure Search\ChromeExt\17.3.0.49\avg.crx <not found>

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3518376 2015-07-07] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [314304 2015-07-07] (AVG Technologies CZ, s.r.o.)
R2 HP Health Check Service; C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe [125440 2009-09-24] (Hewlett-Packard) [File not signed]
R2 LightScribeService; c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2009-08-20] (Hewlett-Packard Company) [File not signed]
R2 MapsGalaxy_39Service; C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\39barsvc.exe [88648 2014-06-01] (COMPANYVERS_NAME)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.149\McCHSvc.exe [289256 2015-06-26] (McAfee, Inc.)
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\17.7.0.12\ccSvcHst.exe [126392 2010-02-25] (Symantec Corporation)
R2 vToolbarUpdater18.8.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.8.0\ToolbarUpdater.exe [1861520 2015-08-17] (AVG Secure Search)
S4 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S3 AVG Security Toolbar Service; C:\Program Files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe [X]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [162784 2015-03-11] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [293296 2015-06-26] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [253408 2015-05-12] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [259040 2015-06-16] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [378336 2015-05-07] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [226784 2015-06-10] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [40928 2015-03-20] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [281568 2015-05-12] (AVG Technologies CZ, s.r.o.)
S1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20100810.004\BHDrvx64.sys [945200 2010-08-09] (Symantec Corporation)
R1 ccHP; C:\Windows\system32\drivers\NISx64\1107000.00C\ccHPx64.sys [615040 2010-02-25] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [475696 2010-08-02] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100830.002\IDSvia64.sys [463408 2010-07-06] (Symantec Corporation)
S3 SRTSP; C:\Windows\System32\Drivers\NISx64\1107000.00C\SRTSP64.SYS [505392 2010-04-21] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1107000.00C\SRTSPX64.SYS [32304 2010-04-21] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1107000.00C\SYMDS64.SYS [433200 2009-08-29] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1107000.00C\SYMEFA64.SYS [221232 2010-04-21] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [173104 2010-08-02] (Symantec Corporation)
S1 SymIRON; C:\Windows\system32\drivers\NISx64\1107000.00C\Ironx64.SYS [150064 2010-04-29] (Symantec Corporation)
R1 SYMTDIv; C:\Windows\System32\Drivers\NISx64\1107000.00C\SYMTDIV.SYS [451120 2010-05-06] (Symantec Corporation)
S3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100902.004\ENG64.SYS [X]
S3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\VirusDefs\20100902.004\EX64.SYS [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-08-28 12:14 - 2015-08-28 12:14 - 00020512 _____ C:\Users\Kathy\Desktop\FRST.txt
2015-08-28 12:12 - 2015-08-28 12:14 - 00000000 ____D C:\FRST
2015-08-28 12:12 - 2015-08-28 12:12 - 02186752 _____ (Farbar) C:\Users\Kathy\Desktop\FRST64.exe
2015-08-28 12:11 - 2015-08-28 12:11 - 02186752 _____ (Farbar) C:\Users\Kathy\Downloads\FRST64.exe
2015-07-30 07:26 - 2015-07-30 07:26 - 00000000 ____D C:\Users\Kathy\AppData\Local\Avg

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-08-28 11:59 - 2009-07-14 00:45 - 00018736 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-08-28 11:59 - 2009-07-14 00:45 - 00018736 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-08-28 11:44 - 2014-06-04 10:00 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-08-28 11:28 - 2014-07-25 13:46 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-08-28 11:20 - 2015-06-23 11:29 - 00000538 _____ C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-3818672058-1777476097-3871671752-1000.job
2015-08-28 10:16 - 2015-06-23 11:29 - 00000634 _____ C:\Windows\Tasks\G2MUploadTask-S-1-5-21-3818672058-1777476097-3871671752-1000.job
2015-08-28 08:53 - 2010-08-31 18:36 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
2015-08-28 08:28 - 2010-11-18 16:20 - 00000000 ____D C:\ProgramData\MFAData
2015-08-28 08:24 - 2015-03-28 10:23 - 00000482 _____ C:\Windows\Tasks\BeFrugal.com Toolbar.job
2015-08-28 08:24 - 2014-06-04 10:00 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-08-28 08:24 - 2013-06-03 09:14 - 00000350 _____ C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job
2015-08-28 08:24 - 2010-04-07 02:39 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Help & Tools
2015-08-28 08:23 - 2009-07-14 01:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-08-28 08:23 - 2009-07-14 00:51 - 00053241 _____ C:\Windows\setupact.log
2015-08-17 14:17 - 2011-12-10 09:01 - 00000000 ____D C:\Program Files (x86)\AVG Secure Search
2015-08-11 16:44 - 2015-06-23 11:29 - 00003664 _____ C:\Windows\System32\Tasks\G2MUploadTask-S-1-5-21-3818672058-1777476097-3871671752-1000
2015-08-11 16:44 - 2015-06-23 11:29 - 00003568 _____ C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-3818672058-1777476097-3871671752-1000
2015-08-11 15:28 - 2014-07-25 13:46 - 00778440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-08-11 15:28 - 2014-07-25 13:46 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-08-11 15:28 - 2014-07-25 13:46 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-07-31 10:00 - 2010-08-02 11:19 - 00000544 _____ C:\Windows\Tasks\PCDRScheduledMaintenance.job
2015-07-30 07:28 - 2015-07-09 08:26 - 00001001 _____ C:\Users\Public\Desktop\AVG 2015.lnk
2015-07-30 07:28 - 2015-07-09 08:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG

==================== Files in the root of some directories =======

2015-06-23 00:45 - 2015-06-23 00:45 - 0008614 _____ () C:\Users\Kathy\AppData\Roaming\HELP_DECRYPT.HTML
2015-06-23 00:45 - 2015-06-23 00:45 - 0045661 _____ () C:\Users\Kathy\AppData\Roaming\HELP_DECRYPT.PNG
2015-06-23 00:45 - 2015-06-23 00:45 - 0004250 _____ () C:\Users\Kathy\AppData\Roaming\HELP_DECRYPT.TXT
2015-06-23 00:45 - 2015-06-23 00:45 - 0000284 _____ () C:\Users\Kathy\AppData\Roaming\HELP_DECRYPT.URL
2015-06-23 00:45 - 2015-06-23 00:45 - 0008614 _____ () C:\Users\Kathy\AppData\Local\HELP_DECRYPT.HTML
2015-06-23 00:45 - 2015-06-23 00:45 - 0045661 _____ () C:\Users\Kathy\AppData\Local\HELP_DECRYPT.PNG
2015-06-23 00:45 - 2015-06-23 00:45 - 0004250 _____ () C:\Users\Kathy\AppData\Local\HELP_DECRYPT.TXT
2015-06-23 00:45 - 2015-06-23 00:45 - 0000284 _____ () C:\Users\Kathy\AppData\Local\HELP_DECRYPT.URL
2014-09-08 12:41 - 2014-09-08 12:41 - 0007621 _____ () C:\Users\Kathy\AppData\Local\Resmon.ResmonCfg
2014-09-08 07:48 - 2014-09-08 07:48 - 0015788 _____ () C:\Users\Kathy\AppData\Local\tmpANDREW.0
2014-09-08 07:48 - 2014-09-08 07:48 - 0016064 _____ () C:\Users\Kathy\AppData\Local\tmpANDREW.JPG
2014-11-18 12:49 - 2014-11-18 12:49 - 0001040 _____ () C:\Users\Kathy\AppData\Local\tmpIMAGE006.0
2014-11-18 12:49 - 2014-11-18 12:49 - 0001328 _____ () C:\Users\Kathy\AppData\Local\tmpIMAGE006.JPG
2015-01-22 09:17 - 2015-01-22 09:17 - 0082014 _____ () C:\Users\Kathy\AppData\Local\tmpIMG_0277.0
2015-01-22 09:17 - 2015-01-22 09:17 - 0031584 _____ () C:\Users\Kathy\AppData\Local\tmpIMG_0277.JPG
2015-02-07 12:32 - 2015-02-07 12:34 - 0080024 _____ () C:\Users\Kathy\AppData\Local\tmpIMG_0280.0
2015-02-07 12:34 - 2015-02-07 12:34 - 0031104 _____ () C:\Users\Kathy\AppData\Local\tmpIMG_0280.JPG
2015-02-07 12:33 - 2015-02-07 12:33 - 0080209 _____ () C:\Users\Kathy\AppData\Local\tmpIMG_0281.0
2015-02-07 12:33 - 2015-02-07 12:33 - 0031136 _____ () C:\Users\Kathy\AppData\Local\tmpIMG_0281.JPG
2015-02-07 12:33 - 2015-02-07 12:34 - 0094519 _____ () C:\Users\Kathy\AppData\Local\tmpIMG_0286.0
2015-02-07 12:34 - 2015-02-07 12:34 - 0036816 _____ () C:\Users\Kathy\AppData\Local\tmpIMG_0286.JPG
2015-02-07 12:33 - 2015-02-07 12:33 - 0096575 _____ () C:\Users\Kathy\AppData\Local\tmpIMG_0287.0
2015-02-07 12:33 - 2015-02-07 12:33 - 0038048 _____ () C:\Users\Kathy\AppData\Local\tmpIMG_0287.JPG
2015-05-17 16:16 - 2015-05-17 16:16 - 0111593 _____ () C:\Users\Kathy\AppData\Local\tmpIMG_0359.0
2015-05-17 16:16 - 2015-05-17 16:16 - 0045584 _____ () C:\Users\Kathy\AppData\Local\tmpIMG_0359.JPG
2015-05-17 16:15 - 2015-05-17 16:15 - 0095613 _____ () C:\Users\Kathy\AppData\Local\tmpIMG_0363.0
2015-05-17 16:15 - 2015-05-17 16:15 - 0038736 _____ () C:\Users\Kathy\AppData\Local\tmpIMG_0363.JPG
2015-01-21 10:26 - 2015-01-21 10:26 - 0085688 _____ () C:\Users\Kathy\AppData\Local\tmpIMG_0499.0
2015-01-21 10:26 - 2015-01-21 10:26 - 0035568 _____ () C:\Users\Kathy\AppData\Local\tmpIMG_0499.JPG
2014-09-02 16:04 - 2014-09-02 16:04 - 0033546 _____ () C:\Users\Kathy\AppData\Local\tmpNAT BALLERINA.0
2014-09-02 16:04 - 2014-09-02 16:04 - 0011856 _____ () C:\Users\Kathy\AppData\Local\tmpNAT BALLERINA.JPG
2014-10-07 16:06 - 2014-11-14 06:37 - 0041296 _____ () C:\Users\Kathy\AppData\Local\tmpPHOTO 1 (2).0
2014-11-14 06:37 - 2014-11-14 06:37 - 0015760 _____ () C:\Users\Kathy\AppData\Local\tmpPHOTO 1 (2).JPG
2014-11-14 06:38 - 2014-11-14 06:38 - 0013584 _____ () C:\Users\Kathy\AppData\Local\tmpPHOTO 1 (2)_navi.JPG
2014-07-24 10:02 - 2014-10-07 16:00 - 0144678 _____ () C:\Users\Kathy\AppData\Local\tmpPHOTO 1.0
2014-10-07 16:00 - 2014-10-07 16:00 - 0054752 _____ () C:\Users\Kathy\AppData\Local\tmpPHOTO 1.JPG
2014-07-24 10:03 - 2014-11-14 06:34 - 0032795 _____ () C:\Users\Kathy\AppData\Local\tmpPHOTO 2.0
2014-11-14 06:35 - 2014-11-14 06:34 - 0012436 _____ () C:\Users\Kathy\AppData\Local\tmpPHOTO 2.1
2014-11-14 06:34 - 2014-11-14 06:35 - 0012704 _____ () C:\Users\Kathy\AppData\Local\tmpPHOTO 2.JPG
2014-11-14 06:35 - 2014-11-14 06:44 - 0033817 _____ () C:\Users\Kathy\AppData\Local\tmpPHOTO 3 (2).0
2014-11-14 06:44 - 2014-11-14 06:44 - 0012384 _____ () C:\Users\Kathy\AppData\Local\tmpPHOTO 3 (2).JPG
2014-07-24 10:03 - 2014-07-24 10:03 - 0033136 _____ () C:\Users\Kathy\AppData\Local\tmpPHOTO 3.0
2014-07-24 10:03 - 2014-07-24 10:03 - 0012960 _____ () C:\Users\Kathy\AppData\Local\tmpPHOTO 3.JPG
2014-11-14 08:01 - 2014-11-14 08:01 - 0034391 _____ () C:\Users\Kathy\AppData\Local\tmpPHOTO 5.0
2014-11-14 08:01 - 2014-11-14 08:01 - 0013537 _____ () C:\Users\Kathy\AppData\Local\tmpPHOTO 5.1
2014-11-14 08:01 - 2014-11-14 08:01 - 0014032 _____ () C:\Users\Kathy\AppData\Local\tmpPHOTO 5.JPG
2014-07-08 11:45 - 2014-11-24 14:08 - 0050130 _____ () C:\Users\Kathy\AppData\Local\tmpPHOTO.0
2014-07-08 11:45 - 2014-11-24 14:08 - 0018260 _____ () C:\Users\Kathy\AppData\Local\tmpPHOTO.1
2014-11-24 14:08 - 2014-11-24 14:08 - 0018528 _____ () C:\Users\Kathy\AppData\Local\tmpPHOTO.JPG
2015-06-23 00:44 - 2015-06-23 00:44 - 0008614 _____ () C:\ProgramData\HELP_DECRYPT.HTML
2015-06-23 00:44 - 2015-06-23 00:44 - 0045661 _____ () C:\ProgramData\HELP_DECRYPT.PNG
2015-06-23 00:44 - 2015-06-23 00:44 - 0004250 _____ () C:\ProgramData\HELP_DECRYPT.TXT
2015-06-23 00:44 - 2015-06-23 00:44 - 0000284 _____ () C:\ProgramData\HELP_DECRYPT.URL

Some files in TEMP:
====================
C:\Users\Kathy\AppData\Local\Temp\ose00000.exe
C:\Users\Kathy\AppData\Local\Temp\sp58915.exe
C:\Users\Kathy\AppData\Local\Temp\tsp_codec_install.exe
C:\Users\Kathy\AppData\Local\Temp\wmfdist.exe

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-08-28 08:47

==================== End of FRST.txt ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version:27-08-2015
Ran by Kathy (2015-08-28 12:15:07)
Running from C:\Users\Kathy\Desktop
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-3818672058-1777476097-3871671752-500 - Administrator - Disabled)
Guest (S-1-5-21-3818672058-1777476097-3871671752-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3818672058-1777476097-3871671752-1002 - Limited - Enabled)
Kathy (S-1-5-21-3818672058-1777476097-3871671752-1000 - Administrator - Enabled) => C:\Users\Kathy

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Norton Internet Security (Disabled - Up to date) {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}
AV: AVG Anti-Virus Free Edition 2011 (Enabled - Up to date) {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
AS: AVG Anti-Virus Free Edition 2011 (Enabled - Up to date) {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Norton Internet Security (Disabled - Up to date) {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}
FW: Norton Internet Security (Disabled) {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

2007 Microsoft Office system (HKLM-x32\...\PROHYBRIDR) (Version: 12.0.4518.1014 - Microsoft Corporation)
ActiveCheck component for HP Active Support Library (x32 Version: 3.0.0.2 - Hewlett-Packard) Hidden
Adobe Flash Player 18 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 18.0.0.232 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.12) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.12 - Adobe Systems Incorporated)
AVG 2015 (HKLM\...\AVG) (Version: 2015.0.6086 - AVG Technologies)
AVG 2015 (Version: 15.0.4409 - AVG Technologies) Hidden
AVG 2015 (Version: 15.0.6086 - AVG Technologies) Hidden
AVG Security Toolbar (HKLM-x32\...\AVG Secure Search) (Version: 18.8.0.180 - AVG Technologies)
Cash Back Assistant (HKU\S-1-5-21-3818672058-1777476097-3871671752-1000\...\{644CF48B-61FE-43E4-8B2E-7EAE916B49C4}_is1) (Version: 2013.3.18.4 - BeFrugal.com)
Citrix Online Launcher (HKLM-x32\...\{6740FE60-43C1-4D15-8C4A-001624134B14}) (Version: 1.0.312 - Citrix)
Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
CyberLink DVD Suite Deluxe (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 7.0.2115 - CyberLink Corp.)
DirectX for Managed Code Update (Summer 2004) (x32 Version: 9.02.2904 - Microsoft) Hidden
DVD Menu Pack for HP MediaSmart Video (HKLM-x32\...\InstallShield_{FB4BB287-37F9-4E27-9C4D-2D3882E08EFF}) (Version: 3.1.3224 - Hewlett-Packard)
DVD Menu Pack for HP MediaSmart Video (x32 Version: 3.1.3224 - Hewlett-Packard) Hidden
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6710.2136 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.28.1 - Google Inc.) Hidden
GoToMeeting 7.2.4.3164 (HKU\S-1-5-21-3818672058-1777476097-3871671752-1000\...\GoToMeeting) (Version: 7.2.4.3164 - CitrixOnline)
Hardware Diagnostic Tools (HKLM\...\PC-Doctor for Windows) (Version: 6.0.5247.34 - PC-Doctor, Inc.)
HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.0.71 - WildTangent)
HP MediaSmart DVD (HKLM-x32\...\InstallShield_{DCCAD079-F92C-44DA-B258-624FC6517A5A}) (Version: 3.1.3317 - Hewlett-Packard)
HP MediaSmart Music/Photo/Video (HKLM-x32\...\InstallShield_{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}) (Version: 3.1.3601 - Hewlett-Packard)
HP MediaSmart SmartMenu (HKLM\...\{88E60521-1E4E-4785-B9F1-1798A4BD0C30}) (Version: 3.1.0.1 - Hewlett-Packard)
HP MediaSmart/TouchSmart Netflix (HKLM-x32\...\{35021DFB-F9CA-402A-89A2-47F91E506465}) (Version: 1.0.2.0 - Hewlett-Packard)
HP Odometer (HKLM-x32\...\{B8AC1A89-FFD1-4F97-8051-E505A160F562}) (Version: 2.10.0000 - Hewlett-Packard)
HP Remote Solution (HKLM-x32\...\HP Remote Solution) (Version: 1.1.11.0 - Hewlett-Packard)
HP Setup (HKLM-x32\...\{17B4760F-334B-475D-829F-1A3E94A6A4E6}) (Version: 1.2.3560.3170 - Hewlett-Packard)
HP Support Assistant (HKLM-x32\...\{741CFE3A-1C0B-4A7D-8E08-5D78C911C09D}) (Version: 4.2.5.3 - Hewlett-Packard)
HP Support Information (HKLM-x32\...\{B9A03B7B-E0FF-4FB3-BA83-762E58A1B0AA}) (Version: 10.1.0002 - Hewlett-Packard)
HP Update (HKLM-x32\...\{D46D081B-F60E-467E-A7C4-117B70D76731}) (Version: 5.001.000.014 - Hewlett-Packard)
HPAsset component for HP Active Support Library (x32 Version: 3.0.2.2 - Hewlett-Packard) Hidden
Hulu Desktop (HKU\S-1-5-21-3818672058-1777476097-3871671752-1000\...\HuluDesktop) (Version: 0.9.9 - Hulu LLC)
Junk Mail filter update (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden
LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.2017 - CyberLink Corp.)
LabelPrint (x32 Version: 2.5.2017 - CyberLink Corp.) Hidden
LightScribe System Software (HKLM-x32\...\{CC8E94A2-55C7-4460-953C-2A790180578C}) (Version: 1.18.8.1 - LightScribe)
MapsGalaxy Internet Explorer Toolbar (HKLM-x32\...\MapsGalaxy_39bar Uninstall Internet Explorer) (Version: - Mindspark Interactive Network) <==== ATTENTION
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.11.149.2 - McAfee, Inc.)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Live Search Toolbar (HKLM-x32\...\{DF802C05-4660-418c-970C-B988ADB1D316}) (Version: 3.0.566.0 - Microsoft Live Search Toolbar)
Microsoft Office Sounds (HKLM-x32\...\{10CE1EA2-12E9-11D3-825E-00C04F6843FE}) (Version: 1.0.0.0 - Microsoft Corp)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 3.0.40624.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Works (HKLM-x32\...\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}) (Version: 9.7.0621 - Microsoft Corporation)
Movie Theme Pack for HP MediaSmart Video (HKLM-x32\...\InstallShield_{3023EBDA-BF1B-4831-B347-E5018555F26E}) (Version: 3.1.3310 - Hewlett-Packard)
Movie Theme Pack for HP MediaSmart Video (x32 Version: 3.1.3310 - Hewlett-Packard) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Norton Internet Security (HKLM-x32\...\NIS) (Version: 17.7.0.12 - Symantec Corporation)
Norton Online Backup (HKLM-x32\...\{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}) (Version: 1.2.20.0 - Symantec)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.5 - NVIDIA Corporation)
PictureMover (HKLM-x32\...\{1896E712-2B3D-45eb-BCE9-542742A51032}) (Version: 3.3.1.19 - Hewlett-Packard Company)
PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.3304 - CyberLink Corp.)
Power2Go (x32 Version: 6.0.3304 - CyberLink Corp.) Hidden
PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 7.0.3503 - CyberLink Corp.)
PowerDirector (x32 Version: 7.0.3503 - CyberLink Corp.) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5938 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 5.5.2216 - CyberLink Corp.) Hidden
ShopAtHome.com Helper (HKU\S-1-5-21-3818672058-1777476097-3871671752-1000\...\ShopAtHome.com Helper) (Version: 7.10.0.5 - ShopAtHome.com) <==== ATTENTION
ShopAtHome.com Toolbar (HKU\S-1-5-21-3818672058-1777476097-3871671752-1000\...\ShopAtHome.com Toolbar) (Version: 7.10.0.5 - ShopAtHome.com) <==== ATTENTION
Start Stop Universal Transcription System (HKLM-x32\...\Start Stop Universal Transcription System11.01.03) (Version: 11.01.03 - HTH Engineering, Inc)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.31064 - TeamViewer)
TSP_CODEC (HKLM-x32\...\{A90C03D6-08E1-4C59-B93B-6919A6C0AC19}) (Version: 1.00.0000 - Bytescribe)
Visual C++ 8.0 Runtime Setup Package (x64) (HKLM-x32\...\{2FDBBCEA-62DB-45F4-B6E5-0E1FB2A1F29D}) (Version: 9.0.0.623 - AVG Technologies CZ, s.r.o.)
Visual Studio 2008 x64 Redistributables (HKLM-x32\...\{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}) (Version: 10.0.0.2 - AVG Technologies)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Sign-in Assistant (HKLM-x32\...\{45338B07-A236-4270-9A77-EBB4115517B5}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Sync (HKLM-x32\...\{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live Upload Tool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-3818672058-1777476097-3871671752-1000_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Program Files (x86)\Citrix\GoToMeeting\2759\G2MOutlookAddin64.dll (Citrix Online, a division of Citrix Systems, Inc.)

==================== Restore Points =========================

09-07-2015 08:22:55 Installed AVG 2015
09-07-2015 08:24:04 Installed AVG 2015
17-07-2015 00:00:17 Scheduled Checkpoint
30-07-2015 08:11:53 Scheduled Checkpoint
10-08-2015 11:53:34 Scheduled Checkpoint
18-08-2015 14:46:36 Scheduled Checkpoint
28-08-2015 08:54:24 Scheduled Checkpoint

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 22:34 - 2015-07-22 06:48 - 00000854 ____A C:\Windows\system32\Drivers\etc\hosts
0.0.0.1 mssplus.mcafee.com

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {062EA6A7-C2C0-45C1-967B-0179EE49574D} - System32\Tasks\Registration => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2009-10-20] ()
Task: {08ACDBDE-3F30-4D14-988C-447FFB44FDEF} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)
Task: {177C0DCF-ADF3-4252-9C76-764135E1A91A} - System32\Tasks\CLMLSvc => c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe [2009-12-01] (CyberLink)
Task: {1AB2FFB8-B4C2-42BD-AE64-8342432E792D} - System32\Tasks\ExtendedServicePlan => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2009-10-20] ()
Task: {2DBF9664-8101-4580-A927-C09211F7E0A3} - System32\Tasks\DVDAgent => c:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe
Task: {3E74841F-C1D1-4878-A540-A31D68F4FFC6} - System32\Tasks\Symantec\Symantec Error Analyzer 17.7.0.12 => C:\Program Files (x86)\Norton Internet Security\Engine\17.7.0.12\SymErr.exe [2010-05-14] (Symantec Corporation)
Task: {4AB4B561-27BA-41AC-B641-EF532FCD6A8A} - System32\Tasks\PCDRScheduledMaintenance => C:\Program Files\PC-Doctor for Windows\pcdrcui.exe [2009-09-18] (PC-Doctor, Inc.)
Task: {4EF974DE-D5C2-496C-B4D4-D9B2672586A1} - System32\Tasks\Hewlett-Packard\HP Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2009-09-24] (Hewlett-Packard)
Task: {55378FFE-C147-44EC-8D09-16618681E092} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-06-04] (Google Inc.)
Task: {5910FAE4-63CD-4CDD-B888-AA6DA8837362} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Ghost Resign Task => c:\program files (x86)\hewlett-packard\hp health check\activecheck\product_line\HPResignFileLoader.exe [2015-08-27] (Microsoft)
Task: {6AB0DDC2-6F9E-418A-85E6-6B5EF6A620C9} - System32\Tasks\RecoveryCDWin7 => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2009-10-20] ()
Task: {6FAF81CF-DC45-4968-B256-87FC3F554026} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-08-11] (Adobe Systems Incorporated)
Task: {9640DAE5-F39E-41F9-BBFB-57CC40B63A02} - System32\Tasks\G2MUpdateTask-S-1-5-21-3818672058-1777476097-3871671752-1000 => C:\Program Files (x86)\Citrix\GoToMeeting\3164\g2mupdate.exe [2015-08-11] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {9BEE13E5-DB0B-4248-9A03-800B0D0B5666} - System32\Tasks\Symantec\Symantec Error Processor 17.7.0.12 => C:\Program Files (x86)\Norton Internet Security\Engine\17.7.0.12\SymErr.exe [2010-05-14] (Symantec Corporation)
Task: {B954C299-BEE3-46D4-BAFB-4692678BEF05} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv => C:\Windows\TEMP\{F78087D3-C1F7-4C66-A34E-EB122DED4528}.exe
Task: {BD3C2D8E-6A57-4255-9D1E-BB801844772B} - System32\Tasks\BeFrugal.com Toolbar => C:\Users\Kathy\AppData\Local\Programs\BeFrugal.com\Add-On\2013.3.18.4\BFHP.exe [2015-03-10] (Capital Intellect, Inc.)
Task: {C8AC469A-A46C-4261-8F6A-C453693390DB} - System32\Tasks\G2MUploadTask-S-1-5-21-3818672058-1777476097-3871671752-1000 => C:\Program Files (x86)\Citrix\GoToMeeting\3164\g2mupload.exe [2015-08-11] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {E4CD051B-9730-4DAE-824E-57C554C57D9F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HPSAObjUtilTask => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\UtilTask.exe [2015-08-27] (Microsoft)
Task: {EDEAC8D5-1D6D-45F7-AC21-36281E12F7E0} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-06-04] (Google Inc.)
Task: {F41B0F3D-6F60-4916-A52B-1EBB3F217682} - System32\Tasks\Hewlett-Packard\HP Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2009-09-24] (Hewlett-Packard)
Task: {F849BA1E-B4CC-4084-AE01-A07AE78E7C13} - System32\Tasks\ServicePlan => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2009-10-20] ()

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job => C:\Windows\TEMP\{F78087D3-C1F7-4C66-A34E-EB122DED4528}.exe <==== ATTENTION
Task: C:\Windows\Tasks\BeFrugal.com Toolbar.job => C:\Users\Kathy\AppData\Local\Programs\BeFrugal.com\Add-On\2013.3.18.4\BFHP.exeFC:\Users\Kathy\AppData\Local\Programs\BeFrugal.com\Add-On\2013.3.18.4BeFrugal.com
Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-3818672058-1777476097-3871671752-1000.job => C:\Program Files (x86)\Citrix\GoToMeeting\3164\g2mupdate.exe
Task: C:\Windows\Tasks\G2MUploadTask-S-1-5-21-3818672058-1777476097-3871671752-1000.job => C:\Program Files (x86)\Citrix\GoToMeeting\3164\g2mupload.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\PCDRScheduledMaintenance.job => C:\Program Files\PC-Doctor for Windows\pcdrcui.exe5-fh scripts\monthly.xml

==================== Loaded Modules (Whitelisted) ==============

2015-08-17 14:17 - 2015-08-17 14:17 - 00152064 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.8.0\loggingserver.exe
2009-09-14 19:17 - 2009-09-14 19:17 - 00610360 _____ () C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
2011-12-10 09:01 - 2015-08-17 14:17 - 02567568 _____ () C:\Program Files (x86)\AVG Secure Search\vprot.exe
2015-08-17 14:17 - 2015-08-17 14:17 - 00512000 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.8.0\log4cplusU.dll
2010-08-02 11:14 - 2009-06-03 15:34 - 03764224 _____ () C:\Users\Kathy\AppData\Roaming\PictureMover\Bin\Core.dll
2009-07-13 17:03 - 2009-07-13 21:15 - 00364544 _____ () C:\Windows\SysWOW64\msjetoledb40.dll
2010-08-02 11:14 - 2009-06-03 15:43 - 01703936 _____ () C:\Users\Kathy\AppData\Roaming\PictureMover\EN-US\Presentation.dll
2009-12-01 20:49 - 2009-12-01 20:49 - 00931112 ____N () c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMediaLibrary.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3818672058-1777476097-3871671752-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Kathy\AppData\Roaming\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
DNS Servers: 75.75.75.75 - 75.75.76.76
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: NortonOnlineBackupReminder => "C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{030C30DD-C61F-42C5-ACD8-25367C5B74C0}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDirector\PDR.EXE
FirewallRules: [{CF68334D-981B-44C6-ADDF-21C13D7BC68A}] => (Allow) c:\Program Files (x86)\Hewlett-Packard\Media\DVD\HPTouchSmartMusic.exe
FirewallRules: [{9537633B-A2F4-4948-B4F2-24C5C2D5DBC2}] => (Allow) c:\Program Files (x86)\Hewlett-Packard\Media\DVD\HPTouchSmartPhoto.exe
FirewallRules: [{07D99E28-9293-4464-B875-4EF7A7F71C8F}] => (Allow) c:\Program Files (x86)\Hewlett-Packard\Media\DVD\HPTouchSmartVideo.exe
FirewallRules: [{92637828-2695-416A-A2AC-BEE81F90D005}] => (Allow) c:\Program Files (x86)\Hewlett-Packard\Media\DVD\TSMAgent.exe
FirewallRules: [{FC07AB29-B5CE-4CBB-A620-A0FBB57BD612}] => (Allow) c:\Program Files (x86)\Hewlett-Packard\Media\DVD\Kernel\CLML\CLMLSvc.exe
FirewallRules: [{EE27E003-5EE3-451A-9198-7481CFC1E5DC}] => (Allow) c:\Program Files (x86)\Hewlett-Packard\Media\DVD\HPDVDSmart.exe
FirewallRules: [{63E9D43E-8D30-4B86-A8EC-2C9DCE3197DB}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\wlcsdk.exe
FirewallRules: [{2B83A7AB-3847-4D32-B4FB-E43D179708D9}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{24FD33E0-9787-4D7E-A77F-F4B7F24FE504}] => (Allow) svchost.exe
FirewallRules: [{40A63BE4-54FD-4DA9-9A45-57BCB3171489}] => (Allow) C:\Program Files (x86)\Windows Live\Sync\WindowsLiveSync.exe
FirewallRules: [{A44013A0-820A-4471-B63C-BD498421044F}] => (Allow) c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\HPTouchSmartMusic.exe
FirewallRules: [{B1B054E5-E3EF-43BF-910C-CE5D85A98ABE}] => (Allow) c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\HPTouchSmartPhoto.exe
FirewallRules: [{060C41E3-712A-4CDD-8AC1-A18D531201EB}] => (Allow) c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\HPTouchSmartVideo.exe
FirewallRules: [{780C1EB4-FC6A-458E-98B8-9793714AEA28}] => (Allow) c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe
FirewallRules: [{6C93AC1F-CAB6-4557-B623-AC32C1F1032A}] => (Allow) c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
FirewallRules: [{0B127B8F-C541-40C0-AFAD-00AB276238FB}] => (Allow) C:\Program Files (x86)\AVG\AVG10\avgmfapx.exe
FirewallRules: [{10E707F2-199F-44B0-BD4B-C3142E4056B6}] => (Allow) C:\Program Files (x86)\AVG\AVG10\avgmfapx.exe
FirewallRules: [{F909492A-DC4B-41FB-BC5D-B30B6352A076}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{8217FF3B-8555-4035-A5C0-2C1920390AAD}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{34178262-EEB4-43D6-8EA2-62D5D04FBC76}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{F0347EF4-4119-4EAD-BA66-14AAA1F45E03}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{F5E1154A-FA19-4F7A-A65C-027FEDA63EB0}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{11BBDAA3-4900-4081-8DD1-6BCFF9A68C5B}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{9DC8626B-EA07-416E-835A-A372EF51161E}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe
FirewallRules: [{2E3617C7-C79B-45EA-9220-86C61C71A9EC}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe
FirewallRules: [{297854EA-3865-4425-BB9B-5CC6A9C4D68F}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgdiagex.exe
FirewallRules: [{C7E63DCB-CD03-48C2-850A-74D9C4085CA5}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgdiagex.exe

==================== Faulty Device Manager Devices =============

Name: BHDrvx64
Description: BHDrvx64
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: BHDrvx64
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: Symantec Iron Driver
Description: Symantec Iron Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: SymIRON
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

==================== Event log errors: =========================

Application errors:
==================
Error: (08/25/2015 05:57:20 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: OUTLOOK.EXE, version: 12.0.4518.1014, time stamp: 0x4542840f
Faulting module name: ieframe.dll, version: 11.0.9600.17840, time stamp: 0x555fe598
Exception code: 0xc0000005
Fault offset: 0x0013c347
Faulting process id: 0xf14
Faulting application start time: 0xOUTLOOK.EXE0
Faulting application path: OUTLOOK.EXE1
Faulting module path: OUTLOOK.EXE2
Report Id: OUTLOOK.EXE3

Error: (08/01/2015 10:54:45 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: IEXPLORE.EXE, version: 11.0.9600.17840, time stamp: 0x555fe1bb
Faulting module name: ntdll.dll, version: 6.1.7601.18869, time stamp: 0x55636317
Exception code: 0xc0000005
Fault offset: 0x00039e33
Faulting process id: 0x150c
Faulting application start time: 0xIEXPLORE.EXE0
Faulting application path: IEXPLORE.EXE1
Faulting module path: IEXPLORE.EXE2
Report Id: IEXPLORE.EXE3

Error: (07/09/2015 08:41:57 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: avgui.exe, version: 15.0.0.6081, time stamp: 0x559241d1
Faulting module name: ieframe.dll, version: 11.0.9600.17840, time stamp: 0x555fe598
Exception code: 0xc0000005
Fault offset: 0x0013c345
Faulting process id: 0xc9c
Faulting application start time: 0xavgui.exe0
Faulting application path: avgui.exe1
Faulting module path: avgui.exe2
Report Id: avgui.exe3

Error: (07/06/2015 01:26:11 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: OUTLOOK.EXE, version: 12.0.4518.1014, time stamp: 0x4542840f
Faulting module name: ieframe.dll, version: 11.0.9600.17840, time stamp: 0x555fe598
Exception code: 0xc0000005
Fault offset: 0x0013c345
Faulting process id: 0xb08
Faulting application start time: 0xOUTLOOK.EXE0
Faulting application path: OUTLOOK.EXE1
Faulting module path: OUTLOOK.EXE2
Report Id: OUTLOOK.EXE3

Error: (06/28/2015 01:54:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: OUTLOOK.EXE, version: 12.0.4518.1014, time stamp: 0x4542840f
Faulting module name: ieframe.dll, version: 11.0.9600.17840, time stamp: 0x555fe598
Exception code: 0xc0000005
Fault offset: 0x0013c347
Faulting process id: 0x12b0
Faulting application start time: 0xOUTLOOK.EXE0
Faulting application path: OUTLOOK.EXE1
Faulting module path: OUTLOOK.EXE2
Report Id: OUTLOOK.EXE3

Error: (06/23/2015 06:01:01 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: OUTLOOK.EXE, version: 12.0.4518.1014, time stamp: 0x4542840f
Faulting module name: ieframe.dll, version: 11.0.9600.17840, time stamp: 0x555fe598
Exception code: 0xc0000005
Fault offset: 0x0013c347
Faulting process id: 0x1238
Faulting application start time: 0xOUTLOOK.EXE0
Faulting application path: OUTLOOK.EXE1
Faulting module path: OUTLOOK.EXE2
Report Id: OUTLOOK.EXE3

Error: (06/22/2015 06:06:35 PM) (Source: VSS) (EventID: 22) (User: )
Description: Volume Shadow Copy Service error: A critical component required by the Volume Shadow Copy service is not registered.
This might happened if an error occurred during Windows setup or during installation of a Shadow Copy provider.
The error returned from CoCreateInstance on class with CLSID {e579ab5f-1cc4-44b4-bed9-de0991ff0623} and Name Coordinator is [0x80040154, Class not registered
].

System errors:
=============
Error: (08/28/2015 08:24:48 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)

Error: (08/28/2015 08:23:45 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
BHDrvx64
SymIRON

Error: (08/27/2015 01:00:23 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)

Error: (08/27/2015 12:59:21 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
BHDrvx64
SymIRON

Error: (08/26/2015 06:41:12 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)

Error: (08/26/2015 06:40:13 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
BHDrvx64
SymIRON

Error: (08/25/2015 05:47:33 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)

Error: (08/25/2015 05:46:33 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
BHDrvx64
SymIRON

Error: (08/24/2015 05:24:41 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)

Error: (08/24/2015 05:23:41 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
BHDrvx64
SymIRON

Microsoft Office:
=========================
Error: (08/25/2015 05:57:19 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 617 seconds with 420 seconds of active time. This session ended with a crash.

Error: (07/06/2015 01:26:11 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 18 seconds with 0 seconds of active time. This session ended with a crash.

Error: (06/28/2015 01:54:00 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 890 seconds with 720 seconds of active time. This session ended with a crash.

Error: (06/23/2015 06:01:01 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 639 seconds with 540 seconds of active time. This session ended with a crash.

Error: (06/21/2015 10:35:30 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 532 seconds with 120 seconds of active time. This session ended with a crash.

Error: (06/20/2015 07:49:10 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 315 seconds with 300 seconds of active time. This session ended with a crash.

Error: (06/19/2015 04:41:36 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 3853 seconds with 1320 seconds of active time. This session ended with a crash.

Error: (06/19/2015 07:25:38 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 689 seconds with 60 seconds of active time. This session ended with a crash.

Error: (06/18/2015 05:56:47 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 169 seconds with 0 seconds of active time. This session ended with a crash.

Error: (06/17/2015 05:28:06 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 192 seconds with 60 seconds of active time. This session ended with a crash.

==================== Memory info ===========================

Processor: AMD Athlon™ II X2 240 Processor
Percentage of memory in use: 67%
Total physical RAM: 2814.49 MB
Available physical RAM: 924.5 MB
Total Virtual: 5627.19 MB
Available Virtual: 3401.04 MB

==================== Drives ================================

Drive c: (HP) (Fixed) (Total:585.13 GB) (Free:505.46 GB) NTFS
Drive d: (FACTORY_IMAGE) (Fixed) (Total:10.94 GB) (Free:1.58 GB) NTFS ==>[system with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 596.2 GB) (Disk ID: 1549F232)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=585.1 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=10.9 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

Security → Virus, Spyware, Malware Removal → Checkmate Ransomware detection / removal? Started by JcTcom , 18 Aug 2022 Checkmate, Ransomware, Virus and 5 more...	0 replies 1,864 views	JcTcom 18 Aug 2022
Security → Virus, Spyware, Malware Removal → What is this ransomware attack called and can it be repaired? Started by activenets , 28 Jul 2021 ransomware, decrypt, recovery	1 reply 1,849 views	zep516 29 Jul 2021
RANSOMWARE Security → Virus, Spyware, Malware Removal → CERBER RANSOMWARE Started by draftthoughts , 04 Apr 2017 RANSOMWARE, VIRUS	0 replies 2,707 views	draftthoughts 04 Apr 2017
Security → Virus, Spyware, Malware Removal → Verify Ransomware is totally gone [Closed] Started by MontySch , 31 Mar 2017 ransomware	2 replies 2,366 views	pystryker 04 Apr 2017
malware Security → Virus, Spyware, Malware Removal → Feasibility of a phishing scheme using botnets! Started by Izac_Stark , 27 Feb 2017 malware, botnets, ransomware and 3 more...	1 reply 2,392 views	azarl 21 Mar 2017

My Mom's Computer Has Been Infected - Ransomware

#1
murph1969

Posted 28 August 2015 - 10:37 AM

Advertisements

Similar Topics

Also tagged with one or more of these keywords: Ransomware

Checkmate Ransomware detection / removal?

What is this ransomware attack called and can it be repaired?

CERBER RANSOMWARE

Verify Ransomware is totally gone [Closed]

Feasibility of a phishing scheme using botnets!

0 user(s) are reading this topic

As Featured On:

Forums

Downloads

Members

Connect With Us

My Mom's Computer Has Been Infected - Ransomware

#1 murph1969 Posted 28 August 2015 - 10:37 AM

Advertisements

Similar Topics

Also tagged with one or more of these keywords: Ransomware

0 user(s) are reading this topic

As Featured On:

Connect With Us

Sign In

#1
murph1969

Posted 28 August 2015 - 10:37 AM