Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Cleaned Malware now very slow [Closed]

malware slow

  • This topic is locked This topic is locked

#1
bhzendner

bhzendner

    Member

  • Member
  • PipPipPip
  • 219 posts

I cleaned my machine of several malware infections with your methods and it seems they are all gone but the machine is very slow on and off. 

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version:07-01-2015
Ran by Mike Howell (2016-01-08 07:27:08)
Running from C:\Users\Mike Howell\Desktop
Windows 8.1 Pro with Media Center (X64) (2014-02-17 18:45:27)
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-815769884-4045366474-2365471170-500 - Administrator - Disabled)
Caloffice (S-1-5-21-815769884-4045366474-2365471170-1001 - Administrator - Enabled) => C:\Users\Caloffice
Guest (S-1-5-21-815769884-4045366474-2365471170-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-815769884-4045366474-2365471170-1003 - Limited - Enabled)
Mike Howell (S-1-5-21-815769884-4045366474-2365471170-1004 - Administrator - Enabled) => C:\Users\Mike Howell
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: "Endpoint Antivirus" (Enabled - Up to date) {57B5C44D-AAB5-DBC9-741B-542BE5A132EA}
AS: "Endpoint Antivirus" (Enabled - Up to date) {ECD425A9-8C8F-D447-4EAB-6F599E267857}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
64 Bit HP CIO Components Installer (Version: 15.2.1 - Hewlett-Packard) Hidden
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Reader XI (11.0.12) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.12 - Adobe Systems Incorporated)
Alcor Micro USB Card Reader Driver  (HKLM-x32\...\AmUStor) (Version: 20.21.3317.03861 - Alcor Micro Corp.)
Alcor Micro USB Card Reader Driver  (x32 Version: 20.21.3317.03861 - Alcor Micro Corp.) Hidden
AlphaCom (HKLM-x32\...\AlphaCom) (Version:  - )
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.11 - Piriform)
Classic Shell (HKLM\...\{2368907C-E8F6-4750-A023-254C3E2B5E8D}) (Version: 4.0.4 - IvoSoft)
CleanUp! (HKLM-x32\...\CleanUp!) (Version:  - )
CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.5.6805 - CyberLink Corp.)
CyberLink Media Suite 10 (HKLM-x32\...\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.5.3103 - CyberLink Corp.)
Cyberlink PhotoDirector (HKLM-x32\...\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.3.4323 - CyberLink Corp.)
CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.5.3215 - CyberLink Corp.)
CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.5.3215 - CyberLink Corp.)
CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.2.3212 - CyberLink Corp.)
Defraggler (HKLM\...\Defraggler) (Version: 2.19 - Piriform)
Endpoint Antivirus 64b (HKLM\...\{62E0EDA5-EC2F-481D-8A3E-CF79A925B3B4}) (Version: 5.0.2 - Total Defense)
Endpoint Security (HKLM-x32\...\{6D3687A4-4F95-4144-9B81-6FE6DA532013}) (Version: 5.0.8.0202 - Cloud Security Team)
HitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.12.253 - SurfRight B.V.)
HP Officejet 6700 Basic Device Software (HKLM\...\{A1CFA587-90D4-4DE6-B200-68CC0F92252F}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Officejet 6700 Help (HKLM-x32\...\{E1AE0CB7-1333-4728-8520-CB3F88A252B4}) (Version: 140.0.2.2 - Hewlett Packard)
HP Officejet 6700 Product Improvement Study (HKLM\...\{988D55BB-08DE-43C9-8D16-3751361E2A79}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Support Information (HKLM-x32\...\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 13.00.0000 - Hewlett-Packard)
HP Support Solutions Framework (HKLM-x32\...\{55065080-504F-43BB-BE00-36B80D7D39A5}) (Version: 12.0.30.219 - Hewlett-Packard Company)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
Inst5675 (Version: 8.00.51 - Softex Inc.) Hidden
Inst5676 (Version: 8.00.51 - Softex Inc.) Hidden
Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.13.1706 - Intel Corporation)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.14.4029 - Intel Corporation)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.670 - Oracle)
Kyocera Product Library (HKLM\...\Kyocera Product Library) (Version: 4.2.1909 - KYOCERA Document Solutions Inc.)
LogMeIn (HKLM-x32\...\{F8511796-1457-4A92-BEF7-71080FCF297A}) (Version: 4.1.4132 - LogMeIn, Inc.)
LogMeIn Client (HKLM-x32\...\{D2300C4F-CC9B-4D00-BC53-B4C806A6C7AB}) (Version: 1.3.1675 - LogMeIn, Inc.)
Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
Microsoft Office 365 Small Business Premium - en-us (HKLM\...\O365SmallBusPremRetail - en-us) (Version: 15.0.4779.1002 - Microsoft Corporation)
Microsoft Office 365 Support and Recovery Assistant (HKU\S-1-5-21-815769884-4045366474-2365471170-1004\...\4415f693b586d348) (Version: 16.0.847.11 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41105.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 27.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 27.0.1 (x86 en-US)) (Version: 27.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 27.0.1 - Mozilla)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4779.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4779.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4779.1002 - Microsoft Corporation) Hidden
Passport Software 12.X Thin Client (HKLM-x32\...\PBS-12.X-ThinClient) (Version:  - )
PST Walker 5.38 (HKLM-x32\...\PST Walker_is1) (Version:  - PST Walker Software)
Qualcomm Atheros Driver Installation Program (HKLM-x32\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 10.0 - Qualcomm Atheros)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.30164 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 5.5.0.7001 - CyberLink Corp.) Hidden
Skype™ 7.3 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.3.101 - Skype Technologies S.A.)
SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 5.7.1018 - SUPERAntiSpyware.com)
Window Web Access (HKLM-x32\...\Window Web Access) (Version: 1.41 - Grayscale LLC)
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
CustomCLSID: HKU\S-1-5-21-815769884-4045366474-2365471170-1004_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\windows\system32\igfxEM.exe (Intel Corporation)
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {02FE3CC3-187E-49E9-8FED-73260D03536B} - System32\Tasks\HPGenoobeReminder => C:\Program Files (x86)\Hewlett-Packard\HP Registration Service\HP GenOOBE\HPGenOOBE.exe
Task: {05C4E563-F738-4C5B-9D60-11495B6AA56A} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_CN366B5GMC => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe
Task: {0DC76852-BEE9-402A-8061-BF237CFF616C} - System32\Tasks\MyDailyBackup => C:\Windows\system32\winupd.exe <==== ATTENTION
Task: {148A4E21-E018-4907-B4E3-4BFFD8626229} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-10-19] (Piriform Ltd)
Task: {36958D60-AF31-496D-813A-F6A7AE985B2B} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-10-13] (Microsoft Corporation)
Task: {3968B5B5-D6F3-42D5-9A3D-684555C06977} - System32\Tasks\GoogleUp => C:\Windows\system32\hsysinfo.exe
Task: {6AE9664F-0B98-4A0C-B9B2-0397FB5E0E57} - System32\Tasks\import => C:\Windows\system32\Mint.exe
Task: {6B0A711F-395E-4478-82D3-75BE4EE89909} - System32\Tasks\CLVDLauncher => c:\Program Files (x86)\CyberLink\Power2Go8\CLVDLauncher.exe [2013-03-12] (CyberLink Corp.)
Task: {6E495B3D-3E8E-4BB9-8E22-E2944085CD45} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime => C:\Windows\system32\GWX\GWXUXWorker.exe [2015-12-04] (Microsoft Corporation)
Task: {704D72EA-81E5-4210-8A7E-2FA540F49BDE} - System32\Tasks\HPCustParticipation HP Officejet 6700 => C:\Program Files\HP\HP Officejet 6700\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)
Task: {7AE04947-24C4-4EA3-90FA-9E2B4D21AF0B} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-12-14] (Microsoft Corporation)
Task: {830FD91B-4D69-43EF-ACD7-7F60E8D689B8} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)
Task: {8553BD83-5B7C-4056-9F51-286603327726} - System32\Tasks\Googleuptodate => C:\Windows\system32\Wimboldon.exe
Task: {9478F4EE-3E37-4A51-A0BF-4FB4BEC798F7} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2015-09-27] (Hewlett-Packard)
Task: {9AD9D894-6DA6-437C-A71F-39A997B754BC} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe
Task: {A3A56F32-AE86-4D5E-B57C-75D2ACDDB8D1} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime => C:\Windows\system32\GWX\GWXUXWorker.exe [2015-12-04] (Microsoft Corporation)
Task: {BA1A16DF-A353-4AD7-B80E-D3B1410816C5} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-10-13] (Microsoft Corporation)
Task: {BA3B3C28-3D73-427B-8867-2D3F5288DA0B} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\windows\system32\MRT.exe [2015-12-08] (Microsoft Corporation)
Task: {BA48FCCD-F364-42BF-B684-E7B4DCC4D3D1} - System32\Tasks\Microsoft\Windows\UPnP\UPnPHostConfig => config upnphost start= auto
Task: {BBD42757-46FF-4E8C-BABA-101F9BDD4B4B} - System32\Tasks\CLMLSvc_P2G8 => c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [2013-08-04] (CyberLink)
Task: {CC2840BB-2E7A-49B4-9CB5-817021BCCB56} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_CN527464H3 => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe
Task: {E41C34FD-24E9-4A31-B222-D624AA0C1B0F} - \impo -> No File <==== ATTENTION
Task: {E6737F98-F68F-4E83-A95C-10EEE7FBBDC0} - System32\Tasks\win => C:\Windows\system32\win.exe
Task: {E8CC2AAF-5AC5-4344-AD27-75D87CACBC92} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe
Task: {F6F406BD-6536-4DC5-BF41-2DE029DAB83C} - \ReimageUpdater -> No File <==== ATTENTION
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
 
==================== Shortcuts =============================
 
(The entries could be listed to be restored or removed.)
 
==================== Loaded Modules (Whitelisted) ==============
 
2015-08-05 17:15 - 2015-10-13 04:34 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2015-08-05 17:19 - 2015-09-01 08:04 - 08901184 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2011-08-12 22:23 - 2011-08-12 22:23 - 00118784 _____ () C:\Program Files (x86)\OmniCom\AlphaCom\lpd.exe
2013-11-08 13:00 - 2013-08-12 01:53 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\ACE.dll
2013-11-08 13:03 - 2013-08-04 23:49 - 00627672 _____ () c:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2013-08-05 15:48 - 2013-08-05 15:48 - 00016856 _____ () c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2015-08-05 17:15 - 2015-08-05 17:15 - 00316576 _____ () C:\Program Files\Microsoft Office 15\root\office15\AppVIsvStream32.dll
2015-08-05 17:17 - 2015-09-01 04:25 - 08901184 _____ () C:\Program Files\Microsoft Office 15\root\office15\1033\GrooveIntlResource.dll
2015-11-24 10:26 - 2015-12-14 14:21 - 01032360 _____ () C:\Program Files\Microsoft Office 15\Root\Office15\ADDINS\UmOutlookAddin.dll
2015-08-05 17:17 - 2015-09-01 04:25 - 08901184 _____ () C:\Program Files\Microsoft Office 15\root\Office15\1033\GrooveIntlResource.dll
2015-12-06 01:42 - 2015-12-06 01:42 - 53432832 _____ () C:\Program Files (x86)\WinWebUse\libcef.dll
2015-01-14 02:55 - 2015-01-14 02:55 - 00386560 _____ () C:\Program Files (x86)\WinWebUse\log4cplusU.dll
2015-12-06 01:42 - 2015-12-06 01:42 - 01976832 _____ () C:\Program Files (x86)\WinWebUse\libglesv2.dll
2015-12-06 01:42 - 2015-12-06 01:42 - 00075264 _____ () C:\Program Files (x86)\WinWebUse\libegl.dll
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
 
==================== EXE Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
IE trusted site: HKU\S-1-5-21-815769884-4045366474-2365471170-1004\...\sharepoint.com -> hxxps://controlswitchesinc.sharepoint.com
 
==================== Hosts content: ===============================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2013-08-22 05:25 - 2015-12-10 14:08 - 00000862 ____A C:\windows\system32\Drivers\etc\hosts
 
127.0.0.1       down.baidu2016.com
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-815769884-4045366474-2365471170-1001\Control Panel\Desktop\\Wallpaper -> C:\windows\web\wallpaper\HP\HP_Svinoya_Norway_Sunset.jpg
HKU\S-1-5-21-815769884-4045366474-2365471170-1004\Control Panel\Desktop\\Wallpaper -> C:\Users\Mike Howell\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
DNS Servers: 8.8.8.8 - 192.168.0.254
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
(Currently there is no automatic fix for this section.)
 
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{7CF44B8B-BAA9-4004-BF55-3C34D10D8815}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDirector10\PDR10.EXE
FirewallRules: [{7DDB96CD-7983-43EE-AC9B-E12659C05E38}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12.exe
FirewallRules: [{BAE8B6F5-B63A-4464-9F14-63697A26F2D6}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
FirewallRules: [{292855D7-D6BB-4F72-B508-DD4BA8620127}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12ML.exe
FirewallRules: [{703ABC63-DD7D-405F-A06E-D8DC24B28496}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\Movie\PowerDVD.exe
FirewallRules: [{45A8E48D-9561-42A0-B36F-2FA49C85B8C8}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{839F2F33-C45C-43CD-B37A-854F3D28706F}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{E684DB5E-5C19-489E-9CDD-CE1427BDE3EE}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{C021F997-E6A7-4ADA-B32A-EAB0AB10C544}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{8A3B13A5-8688-4821-A2B7-4A54A8E88183}] => (Allow) C:\Program Files (x86)\CloudClient\isfacs.exe
FirewallRules: [{7B3D31CA-DDB6-4D47-9C4C-11DFAE9BD45A}] => (Allow) C:\Program Files (x86)\CloudClient\isfacs.exe
FirewallRules: [{6FE123B9-7902-4E36-9FF9-29713167528B}] => (Allow) C:\Program Files (x86)\CloudClient\isfacs.exe
FirewallRules: [{25DE7E37-05A9-4D5D-B24C-5B3FB7277A17}] => (Allow) C:\Program Files (x86)\CloudClient\isfacs.exe
FirewallRules: [TCP Query User{F8D52464-AF84-49EC-BE5D-1D2939CF6745}C:\program files (x86)\omnicom\alphacom\lpd.exe] => (Allow) C:\program files (x86)\omnicom\alphacom\lpd.exe
FirewallRules: [UDP Query User{6F27A041-42FD-4FA1-ACDB-1CF9FC1161AD}C:\program files (x86)\omnicom\alphacom\lpd.exe] => (Allow) C:\program files (x86)\omnicom\alphacom\lpd.exe
FirewallRules: [{D4C3830F-8B4C-4776-AE38-F5BDA0D16FD7}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [TCP Query User{98011763-36C6-403B-842C-3EAFCA69D6FE}C:\program files (x86)\omnicom\alphacom\lpd.exe] => (Allow) C:\program files (x86)\omnicom\alphacom\lpd.exe
FirewallRules: [UDP Query User{D7B4B9CC-A94A-4205-BF91-D926E63A45E4}C:\program files (x86)\omnicom\alphacom\lpd.exe] => (Allow) C:\program files (x86)\omnicom\alphacom\lpd.exe
FirewallRules: [TCP Query User{528FA8DF-F68E-46A6-987A-E682F576F930}C:\users\mike howell\appdata\local\temp\7zs313c\enterprisedu.exe] => (Allow) C:\users\mike howell\appdata\local\temp\7zs313c\enterprisedu.exe
FirewallRules: [UDP Query User{324573B0-1B29-4902-8D48-4C40DBC00E7E}C:\users\mike howell\appdata\local\temp\7zs313c\enterprisedu.exe] => (Allow) C:\users\mike howell\appdata\local\temp\7zs313c\enterprisedu.exe
FirewallRules: [{E396751B-0F50-4C74-B5A0-1F0B2EF7F45A}] => (Allow) C:\Users\Mike Howell\AppData\Local\Temp\7zS34E8\HPDiagnosticCoreUI.exe
FirewallRules: [{C1E0A9E4-7901-4D8F-A2FC-4F6C1FB8AC26}] => (Allow) C:\Users\Mike Howell\AppData\Local\Temp\7zS34E8\HPDiagnosticCoreUI.exe
FirewallRules: [{D0443B02-C0A8-4830-A857-E95A283FB067}] => (Allow) C:\Users\Mike Howell\AppData\Local\Temp\7zS38F0\HPDiagnosticCoreUI.exe
FirewallRules: [{120DFDAF-2533-433F-9D1E-C9724E1B98EF}] => (Allow) C:\Users\Mike Howell\AppData\Local\Temp\7zS38F0\HPDiagnosticCoreUI.exe
FirewallRules: [{7927271C-1977-44D4-B0B4-42F2FBB40E4C}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe
FirewallRules: [{68446980-8E60-4CF7-BF8C-BED8CAE8ABBB}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe
FirewallRules: [{4224207A-43B9-4247-8515-7813C4E79F27}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe
FirewallRules: [{BA980717-6129-4E9C-9B07-FC6BEAE71AD7}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe
FirewallRules: [{59B1201C-8825-45A4-AE37-E669BE19EADF}] => (Allow) C:\Users\Mike Howell\AppData\Local\Temp\7zS0BAA\HPDiagnosticCoreUI.exe
FirewallRules: [{61E803CD-BDDA-4A93-90F3-99F33D035FC3}] => (Allow) C:\Users\Mike Howell\AppData\Local\Temp\7zS0BAA\HPDiagnosticCoreUI.exe
FirewallRules: [{416C530A-C692-4188-8873-F90A6E1F4BAA}] => (Allow) C:\Users\Mike Howell\AppData\Local\Temp\7zS2013\HPDiagnosticCoreUI.exe
FirewallRules: [{23D264EE-953F-4BD9-AF11-F2254B97044B}] => (Allow) C:\Users\Mike Howell\AppData\Local\Temp\7zS2013\HPDiagnosticCoreUI.exe
FirewallRules: [{2D848790-3099-49EB-9068-527563DBB682}] => (Allow) C:\Users\Mike Howell\AppData\Local\Temp\7zS22D4\HPDiagnosticCoreUI.exe
FirewallRules: [{F9B137AC-F0D1-4010-B239-8A691B164A51}] => (Allow) C:\Users\Mike Howell\AppData\Local\Temp\7zS22D4\HPDiagnosticCoreUI.exe
FirewallRules: [{8CA1A6FB-A83D-4DDC-B1FE-FC0DA09ADF7A}] => (Allow) C:\Program Files\HP\HP Officejet 6700\bin\FaxApplications.exe
FirewallRules: [{8CBC43FA-F259-4024-B42F-44DAC845B7FA}] => (Allow) C:\Program Files\HP\HP Officejet 6700\bin\DigitalWizards.exe
FirewallRules: [{08E6F859-622C-49D7-A4B1-9F2494C87346}] => (Allow) C:\Program Files\HP\HP Officejet 6700\bin\SendAFax.exe
FirewallRules: [{6BA521A0-8ABA-4FBD-B356-00A2FFB5DD64}] => (Allow) C:\Program Files\HP\HP Officejet 6700\Bin\DeviceSetup.exe
FirewallRules: [{3CDA4E9A-38DD-4484-A69F-30EFA3A09884}] => (Allow) C:\Program Files\HP\HP Officejet 6700\Bin\HPNetworkCommunicator.exe
FirewallRules: [{37E4C96F-1B6C-4F2D-BB0D-E7FC39EF9B06}] => (Allow) C:\Program Files\HP\HP Officejet 6700\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [{684CF0AC-3B33-4120-9A20-7F2B1A3BC847}] => (Allow) 㩃停潲牧浡䘠汩獥⠠㡸⤶睜湩敷畢敳睜湩敷畢敳攮數
FirewallRules: [{9D38006A-EA04-4C44-9A4B-DC7703F19D1C}] => (Allow) 㩃停潲牧浡䘠汩獥⠠㡸⤶睜湩敷畢敳睜湩敷畢敳⹟硥e
 
==================== Restore Points =========================
 
22-12-2015 07:13:11 Windows Update
30-12-2015 02:43:13 Windows Update
06-01-2016 13:38:33 Scheduled Checkpoint
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (01/08/2016 07:29:11 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Faulting module name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Exception code: 0xc0000005
Fault offset: 0x000020c0
Faulting process id: 0x18c4
Faulting application start time: 0xwinwebtask_.exe0
Faulting application path: winwebtask_.exe1
Faulting module path: winwebtask_.exe2
Report Id: winwebtask_.exe3
Faulting package full name: winwebtask_.exe4
Faulting package-relative application ID: winwebtask_.exe5
 
Error: (01/08/2016 07:22:33 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Faulting module name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Exception code: 0xc0000005
Fault offset: 0x000020c0
Faulting process id: 0x129c
Faulting application start time: 0xwinwebtask_.exe0
Faulting application path: winwebtask_.exe1
Faulting module path: winwebtask_.exe2
Report Id: winwebtask_.exe3
Faulting package full name: winwebtask_.exe4
Faulting package-relative application ID: winwebtask_.exe5
 
Error: (01/08/2016 07:18:06 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Faulting module name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Exception code: 0xc0000005
Fault offset: 0x000020c0
Faulting process id: 0x1648
Faulting application start time: 0xwinwebtask_.exe0
Faulting application path: winwebtask_.exe1
Faulting module path: winwebtask_.exe2
Report Id: winwebtask_.exe3
Faulting package full name: winwebtask_.exe4
Faulting package-relative application ID: winwebtask_.exe5
 
Error: (01/08/2016 07:17:49 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Faulting module name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Exception code: 0xc0000005
Fault offset: 0x000020c0
Faulting process id: 0x1134
Faulting application start time: 0xwinwebtask_.exe0
Faulting application path: winwebtask_.exe1
Faulting module path: winwebtask_.exe2
Report Id: winwebtask_.exe3
Faulting package full name: winwebtask_.exe4
Faulting package-relative application ID: winwebtask_.exe5
 
Error: (01/08/2016 07:17:03 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Faulting module name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Exception code: 0xc0000005
Fault offset: 0x000020c0
Faulting process id: 0x1cf4
Faulting application start time: 0xwinwebtask_.exe0
Faulting application path: winwebtask_.exe1
Faulting module path: winwebtask_.exe2
Report Id: winwebtask_.exe3
Faulting package full name: winwebtask_.exe4
Faulting package-relative application ID: winwebtask_.exe5
 
Error: (01/08/2016 07:10:47 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Faulting module name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Exception code: 0xc0000005
Fault offset: 0x000020c0
Faulting process id: 0x1670
Faulting application start time: 0xwinwebtask_.exe0
Faulting application path: winwebtask_.exe1
Faulting module path: winwebtask_.exe2
Report Id: winwebtask_.exe3
Faulting package full name: winwebtask_.exe4
Faulting package-relative application ID: winwebtask_.exe5
 
Error: (01/08/2016 07:04:07 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Faulting module name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Exception code: 0xc0000005
Fault offset: 0x000020c0
Faulting process id: 0x11a0
Faulting application start time: 0xwinwebtask_.exe0
Faulting application path: winwebtask_.exe1
Faulting module path: winwebtask_.exe2
Report Id: winwebtask_.exe3
Faulting package full name: winwebtask_.exe4
Faulting package-relative application ID: winwebtask_.exe5
 
Error: (01/08/2016 06:58:25 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Faulting module name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Exception code: 0xc0000005
Fault offset: 0x000020c0
Faulting process id: 0x1d08
Faulting application start time: 0xwinwebtask_.exe0
Faulting application path: winwebtask_.exe1
Faulting module path: winwebtask_.exe2
Report Id: winwebtask_.exe3
Faulting package full name: winwebtask_.exe4
Faulting package-relative application ID: winwebtask_.exe5
 
Error: (01/08/2016 06:52:52 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Faulting module name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Exception code: 0xc0000005
Fault offset: 0x000020c0
Faulting process id: 0x136c
Faulting application start time: 0xwinwebtask_.exe0
Faulting application path: winwebtask_.exe1
Faulting module path: winwebtask_.exe2
Report Id: winwebtask_.exe3
Faulting package full name: winwebtask_.exe4
Faulting package-relative application ID: winwebtask_.exe5
 
Error: (01/08/2016 06:52:37 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Faulting module name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Exception code: 0xc0000005
Fault offset: 0x000020c0
Faulting process id: 0x16e4
Faulting application start time: 0xwinwebtask_.exe0
Faulting application path: winwebtask_.exe1
Faulting module path: winwebtask_.exe2
Report Id: winwebtask_.exe3
Faulting package full name: winwebtask_.exe4
Faulting package-relative application ID: winwebtask_.exe5
 
 
System errors:
=============
Error: (01/08/2016 05:35:49 AM) (Source: DCOM) (EventID: 10010) (User: CS-08)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
 
Error: (01/08/2016 05:35:19 AM) (Source: DCOM) (EventID: 10010) (User: CS-08)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
 
Error: (01/07/2016 09:15:09 PM) (Source: DCOM) (EventID: 10010) (User: CS-08)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
 
Error: (01/07/2016 11:09:43 AM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 10. The Windows SChannel error state is 10.
 
Error: (01/07/2016 11:09:43 AM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 10. The Windows SChannel error state is 10.
 
Error: (01/06/2016 05:23:23 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The CyberLink PowerDVD 12 Media Server Service service terminated unexpectedly.  It has done this 2 time(s).
 
Error: (01/06/2016 05:01:50 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 10. The Windows SChannel error state is 10.
 
Error: (01/06/2016 05:01:49 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 10. The Windows SChannel error state is 10.
 
Error: (01/06/2016 02:48:49 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 10. The Windows SChannel error state is 10.
 
Error: (01/06/2016 02:48:49 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 10. The Windows SChannel error state is 10.
 
 
CodeIntegrity:
===================================
  Date: 2015-12-10 14:30:09.440
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-10 14:29:45.525
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-10 14:29:45.402
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-10 14:29:45.297
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-10 14:28:50.371
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-10 14:28:50.269
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-10 14:27:26.121
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-10 14:26:43.869
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-10 14:26:43.753
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-10 14:26:26.584
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.
 
 
==================== Memory info =========================== 
 
Processor: Intel® Core™ i5-4430 CPU @ 3.00GHz
Percentage of memory in use: 67%
Total physical RAM: 8097.27 MB
Available physical RAM: 2597.59 MB
Total Virtual: 17929.69 MB
Available Virtual: 10222.75 MB
 
==================== Drives ================================
 
Drive c: (Windows) (Fixed) (Total:914.92 GB) (Free:849.56 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive d: (Recovery Image) (Fixed) (Total:15.11 GB) (Free:1.83 GB) NTFS ==>[system with boot components (obtained from drive)]
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: E0708284)
 
Partition: GPT.
 
==================== End of Addition.txt ============================
 
Additional scan result of Farbar Recovery Scan Tool (x64) Version:07-01-2015
Ran by Mike Howell (2016-01-08 07:27:08)
Running from C:\Users\Mike Howell\Desktop
Windows 8.1 Pro with Media Center (X64) (2014-02-17 18:45:27)
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-815769884-4045366474-2365471170-500 - Administrator - Disabled)
Caloffice (S-1-5-21-815769884-4045366474-2365471170-1001 - Administrator - Enabled) => C:\Users\Caloffice
Guest (S-1-5-21-815769884-4045366474-2365471170-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-815769884-4045366474-2365471170-1003 - Limited - Enabled)
Mike Howell (S-1-5-21-815769884-4045366474-2365471170-1004 - Administrator - Enabled) => C:\Users\Mike Howell
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: "Endpoint Antivirus" (Enabled - Up to date) {57B5C44D-AAB5-DBC9-741B-542BE5A132EA}
AS: "Endpoint Antivirus" (Enabled - Up to date) {ECD425A9-8C8F-D447-4EAB-6F599E267857}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
64 Bit HP CIO Components Installer (Version: 15.2.1 - Hewlett-Packard) Hidden
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Reader XI (11.0.12) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.12 - Adobe Systems Incorporated)
Alcor Micro USB Card Reader Driver  (HKLM-x32\...\AmUStor) (Version: 20.21.3317.03861 - Alcor Micro Corp.)
Alcor Micro USB Card Reader Driver  (x32 Version: 20.21.3317.03861 - Alcor Micro Corp.) Hidden
AlphaCom (HKLM-x32\...\AlphaCom) (Version:  - )
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.11 - Piriform)
Classic Shell (HKLM\...\{2368907C-E8F6-4750-A023-254C3E2B5E8D}) (Version: 4.0.4 - IvoSoft)
CleanUp! (HKLM-x32\...\CleanUp!) (Version:  - )
CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.5.6805 - CyberLink Corp.)
CyberLink Media Suite 10 (HKLM-x32\...\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.5.3103 - CyberLink Corp.)
Cyberlink PhotoDirector (HKLM-x32\...\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.3.4323 - CyberLink Corp.)
CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.5.3215 - CyberLink Corp.)
CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.5.3215 - CyberLink Corp.)
CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.2.3212 - CyberLink Corp.)
Defraggler (HKLM\...\Defraggler) (Version: 2.19 - Piriform)
Endpoint Antivirus 64b (HKLM\...\{62E0EDA5-EC2F-481D-8A3E-CF79A925B3B4}) (Version: 5.0.2 - Total Defense)
Endpoint Security (HKLM-x32\...\{6D3687A4-4F95-4144-9B81-6FE6DA532013}) (Version: 5.0.8.0202 - Cloud Security Team)
HitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.12.253 - SurfRight B.V.)
HP Officejet 6700 Basic Device Software (HKLM\...\{A1CFA587-90D4-4DE6-B200-68CC0F92252F}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Officejet 6700 Help (HKLM-x32\...\{E1AE0CB7-1333-4728-8520-CB3F88A252B4}) (Version: 140.0.2.2 - Hewlett Packard)
HP Officejet 6700 Product Improvement Study (HKLM\...\{988D55BB-08DE-43C9-8D16-3751361E2A79}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Support Information (HKLM-x32\...\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 13.00.0000 - Hewlett-Packard)
HP Support Solutions Framework (HKLM-x32\...\{55065080-504F-43BB-BE00-36B80D7D39A5}) (Version: 12.0.30.219 - Hewlett-Packard Company)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
Inst5675 (Version: 8.00.51 - Softex Inc.) Hidden
Inst5676 (Version: 8.00.51 - Softex Inc.) Hidden
Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.13.1706 - Intel Corporation)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.14.4029 - Intel Corporation)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.670 - Oracle)
Kyocera Product Library (HKLM\...\Kyocera Product Library) (Version: 4.2.1909 - KYOCERA Document Solutions Inc.)
LogMeIn (HKLM-x32\...\{F8511796-1457-4A92-BEF7-71080FCF297A}) (Version: 4.1.4132 - LogMeIn, Inc.)
LogMeIn Client (HKLM-x32\...\{D2300C4F-CC9B-4D00-BC53-B4C806A6C7AB}) (Version: 1.3.1675 - LogMeIn, Inc.)
Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
Microsoft Office 365 Small Business Premium - en-us (HKLM\...\O365SmallBusPremRetail - en-us) (Version: 15.0.4779.1002 - Microsoft Corporation)
Microsoft Office 365 Support and Recovery Assistant (HKU\S-1-5-21-815769884-4045366474-2365471170-1004\...\4415f693b586d348) (Version: 16.0.847.11 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41105.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 27.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 27.0.1 (x86 en-US)) (Version: 27.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 27.0.1 - Mozilla)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4779.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4779.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4779.1002 - Microsoft Corporation) Hidden
Passport Software 12.X Thin Client (HKLM-x32\...\PBS-12.X-ThinClient) (Version:  - )
PST Walker 5.38 (HKLM-x32\...\PST Walker_is1) (Version:  - PST Walker Software)
Qualcomm Atheros Driver Installation Program (HKLM-x32\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 10.0 - Qualcomm Atheros)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.30164 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 5.5.0.7001 - CyberLink Corp.) Hidden
Skype™ 7.3 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.3.101 - Skype Technologies S.A.)
SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 5.7.1018 - SUPERAntiSpyware.com)
Window Web Access (HKLM-x32\...\Window Web Access) (Version: 1.41 - Grayscale LLC)
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
CustomCLSID: HKU\S-1-5-21-815769884-4045366474-2365471170-1004_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\windows\system32\igfxEM.exe (Intel Corporation)
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {02FE3CC3-187E-49E9-8FED-73260D03536B} - System32\Tasks\HPGenoobeReminder => C:\Program Files (x86)\Hewlett-Packard\HP Registration Service\HP GenOOBE\HPGenOOBE.exe
Task: {05C4E563-F738-4C5B-9D60-11495B6AA56A} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_CN366B5GMC => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe
Task: {0DC76852-BEE9-402A-8061-BF237CFF616C} - System32\Tasks\MyDailyBackup => C:\Windows\system32\winupd.exe <==== ATTENTION
Task: {148A4E21-E018-4907-B4E3-4BFFD8626229} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-10-19] (Piriform Ltd)
Task: {36958D60-AF31-496D-813A-F6A7AE985B2B} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-10-13] (Microsoft Corporation)
Task: {3968B5B5-D6F3-42D5-9A3D-684555C06977} - System32\Tasks\GoogleUp => C:\Windows\system32\hsysinfo.exe
Task: {6AE9664F-0B98-4A0C-B9B2-0397FB5E0E57} - System32\Tasks\import => C:\Windows\system32\Mint.exe
Task: {6B0A711F-395E-4478-82D3-75BE4EE89909} - System32\Tasks\CLVDLauncher => c:\Program Files (x86)\CyberLink\Power2Go8\CLVDLauncher.exe [2013-03-12] (CyberLink Corp.)
Task: {6E495B3D-3E8E-4BB9-8E22-E2944085CD45} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime => C:\Windows\system32\GWX\GWXUXWorker.exe [2015-12-04] (Microsoft Corporation)
Task: {704D72EA-81E5-4210-8A7E-2FA540F49BDE} - System32\Tasks\HPCustParticipation HP Officejet 6700 => C:\Program Files\HP\HP Officejet 6700\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)
Task: {7AE04947-24C4-4EA3-90FA-9E2B4D21AF0B} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-12-14] (Microsoft Corporation)
Task: {830FD91B-4D69-43EF-ACD7-7F60E8D689B8} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)
Task: {8553BD83-5B7C-4056-9F51-286603327726} - System32\Tasks\Googleuptodate => C:\Windows\system32\Wimboldon.exe
Task: {9478F4EE-3E37-4A51-A0BF-4FB4BEC798F7} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2015-09-27] (Hewlett-Packard)
Task: {9AD9D894-6DA6-437C-A71F-39A997B754BC} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe
Task: {A3A56F32-AE86-4D5E-B57C-75D2ACDDB8D1} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime => C:\Windows\system32\GWX\GWXUXWorker.exe [2015-12-04] (Microsoft Corporation)
Task: {BA1A16DF-A353-4AD7-B80E-D3B1410816C5} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-10-13] (Microsoft Corporation)
Task: {BA3B3C28-3D73-427B-8867-2D3F5288DA0B} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\windows\system32\MRT.exe [2015-12-08] (Microsoft Corporation)
Task: {BA48FCCD-F364-42BF-B684-E7B4DCC4D3D1} - System32\Tasks\Microsoft\Windows\UPnP\UPnPHostConfig => config upnphost start= auto
Task: {BBD42757-46FF-4E8C-BABA-101F9BDD4B4B} - System32\Tasks\CLMLSvc_P2G8 => c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [2013-08-04] (CyberLink)
Task: {CC2840BB-2E7A-49B4-9CB5-817021BCCB56} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_CN527464H3 => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe
Task: {E41C34FD-24E9-4A31-B222-D624AA0C1B0F} - \impo -> No File <==== ATTENTION
Task: {E6737F98-F68F-4E83-A95C-10EEE7FBBDC0} - System32\Tasks\win => C:\Windows\system32\win.exe
Task: {E8CC2AAF-5AC5-4344-AD27-75D87CACBC92} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe
Task: {F6F406BD-6536-4DC5-BF41-2DE029DAB83C} - \ReimageUpdater -> No File <==== ATTENTION
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
 
==================== Shortcuts =============================
 
(The entries could be listed to be restored or removed.)
 
==================== Loaded Modules (Whitelisted) ==============
 
2015-08-05 17:15 - 2015-10-13 04:34 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2015-08-05 17:19 - 2015-09-01 08:04 - 08901184 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2011-08-12 22:23 - 2011-08-12 22:23 - 00118784 _____ () C:\Program Files (x86)\OmniCom\AlphaCom\lpd.exe
2013-11-08 13:00 - 2013-08-12 01:53 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\ACE.dll
2013-11-08 13:03 - 2013-08-04 23:49 - 00627672 _____ () c:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2013-08-05 15:48 - 2013-08-05 15:48 - 00016856 _____ () c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2015-08-05 17:15 - 2015-08-05 17:15 - 00316576 _____ () C:\Program Files\Microsoft Office 15\root\office15\AppVIsvStream32.dll
2015-08-05 17:17 - 2015-09-01 04:25 - 08901184 _____ () C:\Program Files\Microsoft Office 15\root\office15\1033\GrooveIntlResource.dll
2015-11-24 10:26 - 2015-12-14 14:21 - 01032360 _____ () C:\Program Files\Microsoft Office 15\Root\Office15\ADDINS\UmOutlookAddin.dll
2015-08-05 17:17 - 2015-09-01 04:25 - 08901184 _____ () C:\Program Files\Microsoft Office 15\root\Office15\1033\GrooveIntlResource.dll
2015-12-06 01:42 - 2015-12-06 01:42 - 53432832 _____ () C:\Program Files (x86)\WinWebUse\libcef.dll
2015-01-14 02:55 - 2015-01-14 02:55 - 00386560 _____ () C:\Program Files (x86)\WinWebUse\log4cplusU.dll
2015-12-06 01:42 - 2015-12-06 01:42 - 01976832 _____ () C:\Program Files (x86)\WinWebUse\libglesv2.dll
2015-12-06 01:42 - 2015-12-06 01:42 - 00075264 _____ () C:\Program Files (x86)\WinWebUse\libegl.dll
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
 
==================== EXE Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
IE trusted site: HKU\S-1-5-21-815769884-4045366474-2365471170-1004\...\sharepoint.com -> hxxps://controlswitchesinc.sharepoint.com
 
==================== Hosts content: ===============================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2013-08-22 05:25 - 2015-12-10 14:08 - 00000862 ____A C:\windows\system32\Drivers\etc\hosts
 
127.0.0.1       down.baidu2016.com
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-815769884-4045366474-2365471170-1001\Control Panel\Desktop\\Wallpaper -> C:\windows\web\wallpaper\HP\HP_Svinoya_Norway_Sunset.jpg
HKU\S-1-5-21-815769884-4045366474-2365471170-1004\Control Panel\Desktop\\Wallpaper -> C:\Users\Mike Howell\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
DNS Servers: 8.8.8.8 - 192.168.0.254
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
(Currently there is no automatic fix for this section.)
 
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{7CF44B8B-BAA9-4004-BF55-3C34D10D8815}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDirector10\PDR10.EXE
FirewallRules: [{7DDB96CD-7983-43EE-AC9B-E12659C05E38}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12.exe
FirewallRules: [{BAE8B6F5-B63A-4464-9F14-63697A26F2D6}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
FirewallRules: [{292855D7-D6BB-4F72-B508-DD4BA8620127}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12ML.exe
FirewallRules: [{703ABC63-DD7D-405F-A06E-D8DC24B28496}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\Movie\PowerDVD.exe
FirewallRules: [{45A8E48D-9561-42A0-B36F-2FA49C85B8C8}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{839F2F33-C45C-43CD-B37A-854F3D28706F}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{E684DB5E-5C19-489E-9CDD-CE1427BDE3EE}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{C021F997-E6A7-4ADA-B32A-EAB0AB10C544}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{8A3B13A5-8688-4821-A2B7-4A54A8E88183}] => (Allow) C:\Program Files (x86)\CloudClient\isfacs.exe
FirewallRules: [{7B3D31CA-DDB6-4D47-9C4C-11DFAE9BD45A}] => (Allow) C:\Program Files (x86)\CloudClient\isfacs.exe
FirewallRules: [{6FE123B9-7902-4E36-9FF9-29713167528B}] => (Allow) C:\Program Files (x86)\CloudClient\isfacs.exe
FirewallRules: [{25DE7E37-05A9-4D5D-B24C-5B3FB7277A17}] => (Allow) C:\Program Files (x86)\CloudClient\isfacs.exe
FirewallRules: [TCP Query User{F8D52464-AF84-49EC-BE5D-1D2939CF6745}C:\program files (x86)\omnicom\alphacom\lpd.exe] => (Allow) C:\program files (x86)\omnicom\alphacom\lpd.exe
FirewallRules: [UDP Query User{6F27A041-42FD-4FA1-ACDB-1CF9FC1161AD}C:\program files (x86)\omnicom\alphacom\lpd.exe] => (Allow) C:\program files (x86)\omnicom\alphacom\lpd.exe
FirewallRules: [{D4C3830F-8B4C-4776-AE38-F5BDA0D16FD7}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [TCP Query User{98011763-36C6-403B-842C-3EAFCA69D6FE}C:\program files (x86)\omnicom\alphacom\lpd.exe] => (Allow) C:\program files (x86)\omnicom\alphacom\lpd.exe
FirewallRules: [UDP Query User{D7B4B9CC-A94A-4205-BF91-D926E63A45E4}C:\program files (x86)\omnicom\alphacom\lpd.exe] => (Allow) C:\program files (x86)\omnicom\alphacom\lpd.exe
FirewallRules: [TCP Query User{528FA8DF-F68E-46A6-987A-E682F576F930}C:\users\mike howell\appdata\local\temp\7zs313c\enterprisedu.exe] => (Allow) C:\users\mike howell\appdata\local\temp\7zs313c\enterprisedu.exe
FirewallRules: [UDP Query User{324573B0-1B29-4902-8D48-4C40DBC00E7E}C:\users\mike howell\appdata\local\temp\7zs313c\enterprisedu.exe] => (Allow) C:\users\mike howell\appdata\local\temp\7zs313c\enterprisedu.exe
FirewallRules: [{E396751B-0F50-4C74-B5A0-1F0B2EF7F45A}] => (Allow) C:\Users\Mike Howell\AppData\Local\Temp\7zS34E8\HPDiagnosticCoreUI.exe
FirewallRules: [{C1E0A9E4-7901-4D8F-A2FC-4F6C1FB8AC26}] => (Allow) C:\Users\Mike Howell\AppData\Local\Temp\7zS34E8\HPDiagnosticCoreUI.exe
FirewallRules: [{D0443B02-C0A8-4830-A857-E95A283FB067}] => (Allow) C:\Users\Mike Howell\AppData\Local\Temp\7zS38F0\HPDiagnosticCoreUI.exe
FirewallRules: [{120DFDAF-2533-433F-9D1E-C9724E1B98EF}] => (Allow) C:\Users\Mike Howell\AppData\Local\Temp\7zS38F0\HPDiagnosticCoreUI.exe
FirewallRules: [{7927271C-1977-44D4-B0B4-42F2FBB40E4C}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe
FirewallRules: [{68446980-8E60-4CF7-BF8C-BED8CAE8ABBB}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe
FirewallRules: [{4224207A-43B9-4247-8515-7813C4E79F27}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe
FirewallRules: [{BA980717-6129-4E9C-9B07-FC6BEAE71AD7}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe
FirewallRules: [{59B1201C-8825-45A4-AE37-E669BE19EADF}] => (Allow) C:\Users\Mike Howell\AppData\Local\Temp\7zS0BAA\HPDiagnosticCoreUI.exe
FirewallRules: [{61E803CD-BDDA-4A93-90F3-99F33D035FC3}] => (Allow) C:\Users\Mike Howell\AppData\Local\Temp\7zS0BAA\HPDiagnosticCoreUI.exe
FirewallRules: [{416C530A-C692-4188-8873-F90A6E1F4BAA}] => (Allow) C:\Users\Mike Howell\AppData\Local\Temp\7zS2013\HPDiagnosticCoreUI.exe
FirewallRules: [{23D264EE-953F-4BD9-AF11-F2254B97044B}] => (Allow) C:\Users\Mike Howell\AppData\Local\Temp\7zS2013\HPDiagnosticCoreUI.exe
FirewallRules: [{2D848790-3099-49EB-9068-527563DBB682}] => (Allow) C:\Users\Mike Howell\AppData\Local\Temp\7zS22D4\HPDiagnosticCoreUI.exe
FirewallRules: [{F9B137AC-F0D1-4010-B239-8A691B164A51}] => (Allow) C:\Users\Mike Howell\AppData\Local\Temp\7zS22D4\HPDiagnosticCoreUI.exe
FirewallRules: [{8CA1A6FB-A83D-4DDC-B1FE-FC0DA09ADF7A}] => (Allow) C:\Program Files\HP\HP Officejet 6700\bin\FaxApplications.exe
FirewallRules: [{8CBC43FA-F259-4024-B42F-44DAC845B7FA}] => (Allow) C:\Program Files\HP\HP Officejet 6700\bin\DigitalWizards.exe
FirewallRules: [{08E6F859-622C-49D7-A4B1-9F2494C87346}] => (Allow) C:\Program Files\HP\HP Officejet 6700\bin\SendAFax.exe
FirewallRules: [{6BA521A0-8ABA-4FBD-B356-00A2FFB5DD64}] => (Allow) C:\Program Files\HP\HP Officejet 6700\Bin\DeviceSetup.exe
FirewallRules: [{3CDA4E9A-38DD-4484-A69F-30EFA3A09884}] => (Allow) C:\Program Files\HP\HP Officejet 6700\Bin\HPNetworkCommunicator.exe
FirewallRules: [{37E4C96F-1B6C-4F2D-BB0D-E7FC39EF9B06}] => (Allow) C:\Program Files\HP\HP Officejet 6700\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [{684CF0AC-3B33-4120-9A20-7F2B1A3BC847}] => (Allow) 㩃停潲牧浡䘠汩獥⠠㡸⤶睜湩敷畢敳睜湩敷畢敳攮數
FirewallRules: [{9D38006A-EA04-4C44-9A4B-DC7703F19D1C}] => (Allow) 㩃停潲牧浡䘠汩獥⠠㡸⤶睜湩敷畢敳睜湩敷畢敳⹟硥e
 
==================== Restore Points =========================
 
22-12-2015 07:13:11 Windows Update
30-12-2015 02:43:13 Windows Update
06-01-2016 13:38:33 Scheduled Checkpoint
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (01/08/2016 07:29:11 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Faulting module name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Exception code: 0xc0000005
Fault offset: 0x000020c0
Faulting process id: 0x18c4
Faulting application start time: 0xwinwebtask_.exe0
Faulting application path: winwebtask_.exe1
Faulting module path: winwebtask_.exe2
Report Id: winwebtask_.exe3
Faulting package full name: winwebtask_.exe4
Faulting package-relative application ID: winwebtask_.exe5
 
Error: (01/08/2016 07:22:33 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Faulting module name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Exception code: 0xc0000005
Fault offset: 0x000020c0
Faulting process id: 0x129c
Faulting application start time: 0xwinwebtask_.exe0
Faulting application path: winwebtask_.exe1
Faulting module path: winwebtask_.exe2
Report Id: winwebtask_.exe3
Faulting package full name: winwebtask_.exe4
Faulting package-relative application ID: winwebtask_.exe5
 
Error: (01/08/2016 07:18:06 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Faulting module name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Exception code: 0xc0000005
Fault offset: 0x000020c0
Faulting process id: 0x1648
Faulting application start time: 0xwinwebtask_.exe0
Faulting application path: winwebtask_.exe1
Faulting module path: winwebtask_.exe2
Report Id: winwebtask_.exe3
Faulting package full name: winwebtask_.exe4
Faulting package-relative application ID: winwebtask_.exe5
 
Error: (01/08/2016 07:17:49 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Faulting module name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Exception code: 0xc0000005
Fault offset: 0x000020c0
Faulting process id: 0x1134
Faulting application start time: 0xwinwebtask_.exe0
Faulting application path: winwebtask_.exe1
Faulting module path: winwebtask_.exe2
Report Id: winwebtask_.exe3
Faulting package full name: winwebtask_.exe4
Faulting package-relative application ID: winwebtask_.exe5
 
Error: (01/08/2016 07:17:03 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Faulting module name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Exception code: 0xc0000005
Fault offset: 0x000020c0
Faulting process id: 0x1cf4
Faulting application start time: 0xwinwebtask_.exe0
Faulting application path: winwebtask_.exe1
Faulting module path: winwebtask_.exe2
Report Id: winwebtask_.exe3
Faulting package full name: winwebtask_.exe4
Faulting package-relative application ID: winwebtask_.exe5
 
Error: (01/08/2016 07:10:47 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Faulting module name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Exception code: 0xc0000005
Fault offset: 0x000020c0
Faulting process id: 0x1670
Faulting application start time: 0xwinwebtask_.exe0
Faulting application path: winwebtask_.exe1
Faulting module path: winwebtask_.exe2
Report Id: winwebtask_.exe3
Faulting package full name: winwebtask_.exe4
Faulting package-relative application ID: winwebtask_.exe5
 
Error: (01/08/2016 07:04:07 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Faulting module name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Exception code: 0xc0000005
Fault offset: 0x000020c0
Faulting process id: 0x11a0
Faulting application start time: 0xwinwebtask_.exe0
Faulting application path: winwebtask_.exe1
Faulting module path: winwebtask_.exe2
Report Id: winwebtask_.exe3
Faulting package full name: winwebtask_.exe4
Faulting package-relative application ID: winwebtask_.exe5
 
Error: (01/08/2016 06:58:25 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Faulting module name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Exception code: 0xc0000005
Fault offset: 0x000020c0
Faulting process id: 0x1d08
Faulting application start time: 0xwinwebtask_.exe0
Faulting application path: winwebtask_.exe1
Faulting module path: winwebtask_.exe2
Report Id: winwebtask_.exe3
Faulting package full name: winwebtask_.exe4
Faulting package-relative application ID: winwebtask_.exe5
 
Error: (01/08/2016 06:52:52 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Faulting module name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Exception code: 0xc0000005
Fault offset: 0x000020c0
Faulting process id: 0x136c
Faulting application start time: 0xwinwebtask_.exe0
Faulting application path: winwebtask_.exe1
Faulting module path: winwebtask_.exe2
Report Id: winwebtask_.exe3
Faulting package full name: winwebtask_.exe4
Faulting package-relative application ID: winwebtask_.exe5
 
Error: (01/08/2016 06:52:37 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Faulting module name: winwebtask_.exe, version: 1.3.2.9, time stamp: 0x56681513
Exception code: 0xc0000005
Fault offset: 0x000020c0
Faulting process id: 0x16e4
Faulting application start time: 0xwinwebtask_.exe0
Faulting application path: winwebtask_.exe1
Faulting module path: winwebtask_.exe2
Report Id: winwebtask_.exe3
Faulting package full name: winwebtask_.exe4
Faulting package-relative application ID: winwebtask_.exe5
 
 
System errors:
=============
Error: (01/08/2016 05:35:49 AM) (Source: DCOM) (EventID: 10010) (User: CS-08)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
 
Error: (01/08/2016 05:35:19 AM) (Source: DCOM) (EventID: 10010) (User: CS-08)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
 
Error: (01/07/2016 09:15:09 PM) (Source: DCOM) (EventID: 10010) (User: CS-08)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
 
Error: (01/07/2016 11:09:43 AM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 10. The Windows SChannel error state is 10.
 
Error: (01/07/2016 11:09:43 AM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 10. The Windows SChannel error state is 10.
 
Error: (01/06/2016 05:23:23 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The CyberLink PowerDVD 12 Media Server Service service terminated unexpectedly.  It has done this 2 time(s).
 
Error: (01/06/2016 05:01:50 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 10. The Windows SChannel error state is 10.
 
Error: (01/06/2016 05:01:49 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 10. The Windows SChannel error state is 10.
 
Error: (01/06/2016 02:48:49 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 10. The Windows SChannel error state is 10.
 
Error: (01/06/2016 02:48:49 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 10. The Windows SChannel error state is 10.
 
 
CodeIntegrity:
===================================
  Date: 2015-12-10 14:30:09.440
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-10 14:29:45.525
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-10 14:29:45.402
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-10 14:29:45.297
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-10 14:28:50.371
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-10 14:28:50.269
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-10 14:27:26.121
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-10 14:26:43.869
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-10 14:26:43.753
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-10 14:26:26.584
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\SpaceSoundPro\SpaceSoundPro.dll because the set of per-page image hashes could not be found on the system.
 
 
==================== Memory info =========================== 
 
Processor: Intel® Core™ i5-4430 CPU @ 3.00GHz
Percentage of memory in use: 67%
Total physical RAM: 8097.27 MB
Available physical RAM: 2597.59 MB
Total Virtual: 17929.69 MB
Available Virtual: 10222.75 MB
 
==================== Drives ================================
 
Drive c: (Windows) (Fixed) (Total:914.92 GB) (Free:849.56 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive d: (Recovery Image) (Fixed) (Total:15.11 GB) (Free:1.83 GB) NTFS ==>[system with boot components (obtained from drive)]
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: E0708284)
 
Partition: GPT.
 
==================== End of Addition.txt ============================
 

  • 0

Advertisements


#2
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Hi you have posted the addition log twice.. I will need the main FRST log
  • 0

#3
bhzendner

bhzendner

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 219 posts

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:07-01-2015
Ran by Mike Howell (administrator) on CS-08 (08-01-2016 07:25:42)
Running from C:\Users\Mike Howell\Desktop
Loaded Profiles: Caloffice & Mike Howell (Available Profiles: Caloffice & Mike Howell)
Platform: Windows 8.1 Pro with Media Center (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\ramaint.exe
(Grayscale LLC) C:\Program Files (x86)\winwebuse\WinWebSync.exe
(Grayscale LLC) C:\Program Files (x86)\winwebuse\WinWebSync_.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(iSheriff security from the cloud) C:\Program Files (x86)\CloudClient\isfacs.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
() C:\Program Files (x86)\OmniCom\AlphaCom\lpd.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\GROOVE.EXE
(iSheriff Cloud Security) C:\Program Files (x86)\CloudClient\isfagent.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\OUTLOOK.EXE
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(iSheriff Cloud Security) C:\Program Files (x86)\CloudClient\ccavona64.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeInRC.exe
(Piriform Ltd) C:\Program Files\Defraggler\Defraggler64.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
(Grayscale LLC) C:\Program Files (x86)\winwebuse\WinWebUse_.exe
(Grayscale LLC) C:\Program Files (x86)\winwebuse\WinWebUse_.exe
(Grayscale LLC) C:\Program Files (x86)\winwebuse\WinWebUse_.exe
(Grayscale LLC) C:\Program Files (x86)\winwebuse\WinWebUse_.exe
(Grayscale LLC) C:\Program Files (x86)\winwebuse\WinWebUse.exe
(Grayscale LLC) C:\Program Files (x86)\winwebuse\WinWebUse.exe
(Grayscale LLC) C:\Program Files (x86)\winwebuse\WinWebUse.exe
(Grayscale LLC) C:\Program Files (x86)\winwebuse\WinWebUse.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [161984 2014-01-18] (IvoSoft)
HKLM\...\Run: [LogMeIn GUI] => C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe [57928 2013-12-11] (LogMeIn, Inc.)
HKLM-x32\...\Run: [CloudClient] => C:\Program Files (x86)\CloudClient\isfagent.exe [2381784 2015-11-04] (iSheriff Cloud Security)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKU\S-1-5-21-815769884-4045366474-2365471170-1001\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7935904 2015-12-10] (SUPERAntiSpyware)
HKU\S-1-5-21-815769884-4045366474-2365471170-1004\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [31682144 2015-03-25] (Skype Technologies S.A.)
HKU\S-1-5-21-815769884-4045366474-2365471170-1004\...\MountPoints2: {b76db0bb-f500-11e4-82a7-ddd8d5e0976f} - "G:\VZW_Software_upgrade_assistant.exe"
IFEO\ehshell.exe: [Debugger] "C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe" -MceShellRedirect
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-12-14] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-12-14] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-12-14] (Microsoft Corporation)
Startup: C:\Users\Mike Howell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lpd.lnk [2015-12-11]
ShortcutTarget: lpd.lnk -> C:\Program Files (x86)\OmniCom\AlphaCom\lpd.exe ()
Startup: C:\Users\Mike Howell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Officejet 6700.lnk [2015-12-11]
ShortcutTarget: Monitor Ink Alerts - HP Officejet 6700.lnk ->  (No File)
Startup: C:\Users\Mike Howell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive for Business.lnk [2015-12-11]
ShortcutTarget: OneDrive for Business.lnk -> C:\Program Files\Microsoft Office 15\root\office15\GROOVE.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: 127.0.0.1       down.baidu2016.com
Tcpip\..\Interfaces\{684C560E-4C29-4F8B-9FA8-1D0EED44C6FA}: [NameServer] 8.8.8.8,192.168.0.254
Tcpip\..\Interfaces\{A71AAAEA-C9B2-4B5A-B21F-A303B046921D}: [DhcpNameServer] 208.67.222.222 206.13.29.12

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-815769884-4045366474-2365471170-1004\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.msn.com/HPDSK14/1
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.msn.com/HPDSK14/1
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPDSK14/1
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPDSK14/1
HKU\S-1-5-21-815769884-4045366474-2365471170-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.msn.com/HPDSK14/1
HKU\S-1-5-21-815769884-4045366474-2365471170-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPDSK14/1
SearchScopes: HKLM -> {46D7C5EC-3C85-422E-B8BA-27C7124A51DD} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKLM-x32 -> {46D7C5EC-3C85-422E-B8BA-27C7124A51DD} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKU\S-1-5-21-815769884-4045366474-2365471170-1001 -> {46D7C5EC-3C85-422E-B8BA-27C7124A51DD} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-815769884-4045366474-2365471170-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKU\S-1-5-21-815769884-4045366474-2365471170-1004 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-815769884-4045366474-2365471170-1004 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-815769884-4045366474-2365471170-1004 -> {46D7C5EC-3C85-422E-B8BA-27C7124A51DD} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-815769884-4045366474-2365471170-1004 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-12-14] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-12-14] (Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll [2015-12-14] (Microsoft Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-07-25] (Oracle Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-12-14] (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-07-25] (Oracle Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-08-05] (Microsoft Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-08-05] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Mike Howell\AppData\Roaming\Mozilla\Firefox\Profiles\j2idhdrn.default
FF Homepage: hxxps://www.malwarebytes.org/restorebrowser/.com/?site=shyosffdefault&prd=set&s=FCAzbwybl01,23e0efd1-d60e-460e-919b-1420bef3d280,
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41105.0\npctrl.dll [2015-11-04] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-08-05] (Microsoft Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-08-12] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-08-12] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-07-25] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-07-25] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-11-03] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41105.0\npctrl.dll [2015-11-04] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-08-05] (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\isheriff.cfg [2014-02-18] <==== ATTENTION

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-08-28] (SUPERAntiSpyware.com)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2802360 2015-11-24] (Microsoft Corporation)
R2 Cloud Client Service; C:\Program Files (x86)\CloudClient\isfacs.exe [754392 2016-01-06] (iSheriff security from the cloud)
R2 CyberLink PowerDVD 12 Media Server Monitor Service; c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [77576 2013-08-12] (CyberLink)
R2 CyberLink PowerDVD 12 Media Server Service; c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [298760 2013-08-12] (CyberLink)
R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [127752 2015-12-14] (SurfRight B.V.)
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [25800 2015-09-28] (Hewlett-Packard Company)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [329104 2015-01-27] (Intel Corporation)
R2 Intel® Capability Licensing Service Interface; c:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel® Corporation) [File not signed]
S3 Intel® Capability Licensing Service TCP IP Interface; c:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel® Corporation)
R2 Intel® ME Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-08-12] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [169432 2013-08-12] (Intel Corporation)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [417288 2015-12-09] (LogMeIn, Inc.)
R2 LMIMaint; C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe [507400 2015-12-09] (LogMeIn, Inc.)
R2 LogMeIn; C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe [407424 2013-12-11] (LogMeIn, Inc.)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
S2 Net Driver HPZ12; C:\Windows\System32\HPZinw12.dll [50688 2013-05-16] (Hewlett-Packard) [File not signed]
S2 Pml Driver HPZ12; C:\Windows\System32\HPZipm12.dll [66048 2013-05-16] (Hewlett-Packard) [File not signed]
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)
R2 WinTaskSvc; C:\Program Files (x86)\winwebuse\WinWebSync.exe [140992 2015-12-09] (Grayscale LLC)
R2 WinTaskSvc2; C:\Program Files (x86)\winwebuse\WinWebSync_.exe [140992 2015-12-09] (Grayscale LLC)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [4265984 2014-12-22] (Qualcomm Atheros Communications, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
R3 gzflt; C:\Program Files (x86)\CloudClient\avbdapi\gzflt.sys [138232 2012-04-26] (BitDefender LLC)
R2 LMIInfo; C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [16056 2013-12-11] (LogMeIn, Inc.)
S4 LMIRfsClientNP; no ImagePath
S3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [192216 2016-01-08] (Malwarebytes)
S3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [64216 2015-10-05] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\System32\drivers\TeeDriverx64.sys [99288 2013-08-12] (Intel Corporation)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [30848 2015-12-22] ()
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)
U3 McMPFSvc; no ImagePath
U3 McNaiAnn; no ImagePath
U3 mcpltsvc; no ImagePath
U3 McProxy; no ImagePath
U3 mfecore; no ImagePath
U3 mfefire; no ImagePath
U3 MSK80Service; no ImagePath
S3 STHDA; \SystemRoot\system32\DRIVERS\stwrt64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-01-08 07:25 - 2016-01-08 07:25 - 00018981 _____ C:\Users\Mike Howell\Desktop\FRST.txt
2016-01-08 07:25 - 2016-01-08 07:25 - 00000000 ____D C:\FRST
2016-01-08 07:23 - 2016-01-08 07:23 - 02370560 _____ (Farbar) C:\Users\Mike Howell\Desktop\FRST64.exe
2016-01-08 06:15 - 2016-01-08 06:19 - 00002332 _____ C:\Users\Mike Howell\Desktop\Rkill.txt
2016-01-07 17:30 - 2016-01-08 06:19 - 00192216 _____ (Malwarebytes) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2016-01-07 17:29 - 2016-01-07 17:29 - 00001081 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-01-07 17:29 - 2016-01-07 17:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-01-07 17:29 - 2016-01-07 17:29 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-01-07 17:29 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\windows\system32\Drivers\mbamchameleon.sys
2016-01-07 17:29 - 2015-10-05 09:50 - 00064216 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2016-01-07 17:29 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\windows\system32\Drivers\mbam.sys
2016-01-06 16:24 - 2016-01-06 16:24 - 00028672 _____ C:\Users\Mike Howell\OneDrive - Control Switches Inc-\Documents\Copy of PURCHASE REQUEST-2008 (Autosaved).xls
2015-12-23 10:07 - 2015-12-23 10:07 - 00769370 _____ C:\Users\Mike Howell\OneDrive - Control Switches Inc-\Documents\FANOX 2016 PRICE LIST.pdf
2015-12-22 09:17 - 2016-01-08 07:22 - 00000000 ____D C:\Users\Mike Howell\AppData\Local\CrashDumps
2015-12-22 09:09 - 2015-12-22 10:03 - 00000000 ____D C:\ProgramData\RogueKiller
2015-12-22 09:09 - 2015-12-22 09:09 - 20834888 _____ C:\Users\Mike Howell\Downloads\RogueKiller.exe
2015-12-22 09:09 - 2015-12-22 09:09 - 00030848 _____ C:\windows\system32\Drivers\TrueSight.sys
2015-12-22 08:36 - 2015-12-22 08:36 - 00001670 _____ C:\Users\Mike Howell\Desktop\Procmon.exe - Shortcut.lnk
2015-12-22 08:35 - 2015-12-22 08:35 - 00000000 ____D C:\Users\Mike Howell\AppData\Local\pinger.com
2015-12-18 21:07 - 2015-12-18 21:07 - 00000000 ____D C:\Users\Mike Howell\Downloads\sysint
2015-12-18 21:05 - 2015-12-18 21:05 - 14881191 _____ C:\Users\Mike Howell\Downloads\SysinternalsSuite.zip
2015-12-14 14:12 - 2015-12-14 14:12 - 00117425 _____ C:\Users\Mike Howell\OneDrive - Control Switches Inc-\Documents\MARINCO POWER PRODUCTS.xlsx
2015-12-11 14:22 - 2015-12-18 21:15 - 00000316 _____ C:\windows\system32\.crusader
2015-12-11 13:23 - 2015-12-11 14:21 - 00000000 ____D C:\ProgramData\HitmanPro
2015-12-11 13:23 - 2015-12-11 13:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
2015-12-11 13:23 - 2015-12-11 13:23 - 00000000 ____D C:\Program Files\HitmanPro
2015-12-11 13:22 - 2015-12-11 13:23 - 11337112 _____ (SurfRight B.V.) C:\Users\Mike Howell\Downloads\HitmanPro_x64.exe
2015-12-11 10:45 - 2015-12-11 16:42 - 00000000 ____D C:\windows\Minidump
2015-12-11 10:43 - 2015-12-10 16:55 - 00933888 _____ C:\windows\Minidump\snapshot.etl
2015-12-10 17:04 - 2015-12-10 17:04 - 02032072 _____ (Bleeping Computer, LLC) C:\Users\Mike Howell\Desktop\iExplore.exe
2015-12-10 15:52 - 2015-12-10 15:52 - 00000008 _____ C:\END
2015-12-10 14:50 - 2015-12-10 14:50 - 00000248 _____ C:\rescue.info
2015-12-10 14:49 - 2015-12-11 14:33 - 00002284 _____ C:\Users\Mike Howell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\247techcenter.lnk
2015-12-10 14:19 - 2015-12-10 14:19 - 00003590 _____ C:\windows\System32\Tasks\GoogleUp
2015-12-10 14:19 - 2015-12-10 14:19 - 00003582 _____ C:\windows\System32\Tasks\import
2015-12-10 14:19 - 2015-12-10 14:19 - 00003472 _____ C:\windows\System32\Tasks\Googleuptodate
2015-12-10 14:19 - 2015-12-10 14:19 - 00003464 _____ C:\windows\System32\Tasks\MyDailyBackup
2015-12-10 14:19 - 2015-12-10 14:19 - 00003460 _____ C:\windows\System32\Tasks\win
2015-12-10 14:13 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\windows\SysWOW64\D3DX9_43.dll
2015-12-10 14:09 - 2015-12-10 16:14 - 00000000 ____D C:\Users\Mike Howell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ASPackage
2015-12-10 14:09 - 2015-12-10 14:09 - 00000000 ____D C:\Users\Mike Howell\AppData\Local\CEF
2015-12-10 14:09 - 2015-12-10 14:09 - 00000000 ____D C:\Program Files (x86)\winwebuse
2015-12-10 14:09 - 2015-12-10 14:08 - 00000862 _____ C:\windows\system32\Drivers\etc\hp.bak
2015-12-09 10:26 - 2015-12-09 10:26 - 00000000 ____D C:\Program Files (x86)\LogMeIn Ignition

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-01-08 07:25 - 2013-08-22 05:36 - 00000000 ____D C:\Windows
2016-01-08 07:20 - 2014-02-17 14:41 - 00000000 ____D C:\Users\Mike Howell\AppData\Roaming\ClassicShell
2016-01-08 07:05 - 2014-02-17 16:18 - 00000000 ____D C:\Program Files (x86)\CloudClient
2016-01-08 06:14 - 2014-02-17 14:32 - 00000000 ____D C:\ProgramData\LogMeIn
2016-01-08 05:37 - 2013-08-22 07:36 - 00000000 ____D C:\windows\AppReadiness
2016-01-08 05:04 - 2014-02-17 14:39 - 00003938 _____ C:\windows\System32\Tasks\User_Feed_Synchronization-{B55DD8D3-E5F1-4BFE-8707-490DAF4D7F80}
2016-01-07 21:20 - 2014-02-17 14:45 - 00003596 _____ C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-815769884-4045366474-2365471170-1004
2016-01-07 10:23 - 2013-08-22 07:36 - 00000000 ___HD C:\Program Files\WindowsApps
2016-01-07 10:04 - 2013-08-22 05:36 - 00000000 ____D C:\windows\Inf
2016-01-06 17:21 - 2014-02-17 14:39 - 00000000 ____D C:\Users\Mike Howell\AppData\Local\Packages
2016-01-06 16:13 - 2015-11-24 11:18 - 00000000 ____D C:\SCANS
2016-01-06 11:40 - 2013-08-22 07:36 - 00000000 ____D C:\windows\system32\NDF
2016-01-05 16:11 - 2014-02-17 14:32 - 00000971 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Control Panel.lnk
2016-01-05 16:11 - 2013-08-22 06:45 - 00000006 ____H C:\windows\Tasks\SA.DAT
2015-12-30 02:46 - 2013-08-22 07:20 - 00000000 ____D C:\windows\CbsTemp
2015-12-26 00:48 - 2013-08-22 07:38 - 00826872 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-12-26 00:48 - 2013-08-22 07:38 - 00176632 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-12-22 08:37 - 2013-11-08 12:57 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2015-12-22 08:35 - 2015-11-24 10:55 - 00000000 ____D C:\windows\system32\appmgmt
2015-12-22 08:35 - 2013-11-08 13:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Communication and Chat
2015-12-22 08:33 - 2013-11-08 13:00 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Music, Photos and Videos
2015-12-17 16:31 - 2015-04-07 10:27 - 00000000 ___SD C:\windows\SysWOW64\GWX
2015-12-17 16:31 - 2015-04-07 10:27 - 00000000 ___SD C:\windows\system32\GWX
2015-12-17 15:43 - 2013-08-22 05:25 - 00262144 ___SH C:\windows\system32\config\BBI
2015-12-17 14:41 - 2014-06-06 09:18 - 00002016 _____ C:\Users\Mike Howell\Desktop\PBS 12.0.lnk
2015-12-17 12:52 - 2013-08-24 13:38 - 00891920 _____ C:\windows\system32\PerfStringBackup.INI
2015-12-14 15:11 - 2013-08-22 07:36 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2015-12-14 14:05 - 2015-12-04 12:30 - 00042496 ___SH C:\Users\Mike Howell\Desktop\Thumbs.db
2015-12-11 14:33 - 2015-11-24 11:19 - 00000667 _____ C:\Users\Mike Howell\Desktop\SCANS.lnk
2015-12-11 14:33 - 2015-11-24 11:16 - 00002131 _____ C:\Users\Public\Desktop\HP Officejet 6700.lnk
2015-12-11 14:33 - 2015-11-24 11:16 - 00000966 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\I.R.I.S. OCR Registration.lnk
2015-12-11 14:33 - 2015-08-05 16:35 - 00002284 _____ C:\Users\Mike Howell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft Support.lnk
2015-12-11 14:33 - 2015-07-13 14:59 - 00002707 _____ C:\Users\Public\Desktop\Skype.lnk
2015-12-11 14:33 - 2014-03-06 12:31 - 00001985 _____ C:\Users\Public\Desktop\HP Print and Scan Doctor.lnk
2015-12-11 14:33 - 2014-03-04 09:50 - 00000424 _____ C:\Users\Mike Howell\Desktop\This PC.lnk
2015-12-11 14:33 - 2014-02-17 17:07 - 00001166 _____ C:\Users\Mike Howell\Desktop\Mozilla Firefox.lnk
2015-12-11 14:33 - 2014-02-17 17:06 - 00001987 _____ C:\Users\Mike Howell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AlphaCom.lnk
2015-12-11 14:33 - 2014-02-17 14:39 - 00001425 _____ C:\Users\Mike Howell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-12-11 14:33 - 2014-02-17 14:33 - 00001919 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Client.lnk
2015-12-11 14:33 - 2014-02-17 11:36 - 00002445 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-12-11 14:33 - 2014-02-17 11:22 - 00001166 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-12-11 14:28 - 2013-08-24 14:31 - 00000000 ____D C:\windows\Panther
2015-12-11 10:59 - 2013-08-22 07:36 - 00000000 ____D C:\windows\LiveKernelReports
2015-12-11 04:44 - 2013-08-22 07:36 - 00000000 ____D C:\windows\rescache
2015-12-10 16:55 - 2014-02-17 11:36 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
2015-12-10 14:31 - 2013-08-22 06:44 - 00610616 _____ C:\windows\system32\FNTCACHE.DAT
2015-12-09 10:26 - 2014-02-17 14:32 - 00000000 ____D C:\Program Files (x86)\LogMeIn
2015-12-09 10:25 - 2014-02-17 14:32 - 00122400 _____ (LogMeIn, Inc.) C:\windows\system32\LMIRfsClientNP.dll
2015-12-09 10:25 - 2014-02-17 14:32 - 00107008 _____ (LogMeIn, Inc.) C:\windows\system32\LMIinit.dll
2015-12-09 10:25 - 2014-02-17 14:32 - 00035328 _____ (LogMeIn, Inc.) C:\windows\system32\LMIport.dll
2015-12-09 10:22 - 2014-02-17 11:24 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-12-09 10:22 - 2014-02-17 11:24 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

==================== Files in the root of some directories =======

2015-01-05 13:05 - 2015-01-05 13:05 - 0000042 _____ () C:\Users\Mike Howell\AppData\Roaming\WB.CFG
2014-03-04 12:27 - 2014-03-04 12:27 - 0000057 _____ () C:\ProgramData\Ament.ini

Some files in TEMP:
====================
C:\Users\Caloffice\AppData\Local\Temp\OfficeSetup.exe

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\explorer.exe => File is digitally signed
C:\windows\SysWOW64\explorer.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\SysWOW64\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\SysWOW64\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\SysWOW64\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\dnsapi.dll => File is digitally signed
C:\windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2016-01-08 05:35

==================== End of FRST.txt ============================


  • 0

#4
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Could you let me know how the system is after this

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:
 

CreateRestorePoint:
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-815769884-4045366474-2365471170-1004\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
R2 WinTaskSvc; C:\Program Files (x86)\winwebuse\WinWebSync.exe [140992 2015-12-09] (Grayscale LLC)
R2 WinTaskSvc2; C:\Program Files (x86)\winwebuse\WinWebSync_.exe [140992 2015-12-09] (Grayscale LLC)
U3 McMPFSvc; no ImagePath
U3 McNaiAnn; no ImagePath
U3 mcpltsvc; no ImagePath
U3 McProxy; no ImagePath
U3 mfecore; no ImagePath
U3 mfefire; no ImagePath
U3 MSK80Service; no ImagePath
2015-12-10 15:52 - 2015-12-10 15:52 - 00000008 _____ C:\END
2015-12-10 14:19 - 2015-12-10 14:19 - 00003590 _____ C:\windows\System32\Tasks\GoogleUp
2015-12-10 14:19 - 2015-12-10 14:19 - 00003582 _____ C:\windows\System32\Tasks\import
2015-12-10 14:19 - 2015-12-10 14:19 - 00003472 _____ C:\windows\System32\Tasks\Googleuptodate
2015-12-10 14:19 - 2015-12-10 14:19 - 00003464 _____ C:\windows\System32\Tasks\MyDailyBackup
2015-12-10 14:19 - 2015-12-10 14:19 - 00003460 _____ C:\windows\System32\Tasks\win
2015-12-10 14:09 - 2015-12-10 14:09 - 00000000 ____D C:\Program Files (x86)\winwebuse
Task: {0DC76852-BEE9-402A-8061-BF237CFF616C} - System32\Tasks\MyDailyBackup => C:\Windows\system32\winupd.exe <==== ATTENTION
Task: {3968B5B5-D6F3-42D5-9A3D-684555C06977} - System32\Tasks\GoogleUp => C:\Windows\system32\hsysinfo.exe
Task: {6AE9664F-0B98-4A0C-B9B2-0397FB5E0E57} - System32\Tasks\import => C:\Windows\system32\Mint.exe
Task: {8553BD83-5B7C-4056-9F51-286603327726} - System32\Tasks\Googleuptodate => C:\Windows\system32\Wimboldon.exe
Task: {E41C34FD-24E9-4A31-B222-D624AA0C1B0F} - \impo -> No File <==== ATTENTION
Task: {E6737F98-F68F-4E83-A95C-10EEE7FBBDC0} - System32\Tasks\win => C:\Windows\system32\win.exe
Task: {F6F406BD-6536-4DC5-BF41-2DE029DAB83C} - \ReimageUpdater -> No File <==== ATTENTION
C:\Windows\system32\Wimboldon.exe
C:\Windows\system32\Mint.exe
C:\Windows\system32\hsysinfo.exe
C:\Windows\system32\winupd.exe
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
RemoveProxy:
EmptyTemp:
CMD: bitsadmin /reset /allusers


Save this as fixlist.txt, in the same location as FRST.exe
FRSTfix.JPG
Run FRST and press Fix
On completion a log will be generated please post that

THEN

Please download AdwCleaner by Xplode onto your desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Scan.
  • After the scan is complete click on "Clean"
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next answer.
  • You can find the logfile at C:\AdwCleaner[S0].txt as well.

  • 0

#5
bhzendner

bhzendner

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 219 posts

First program crashed?

 

# AdwCleaner v5.028 - Logfile created 08/01/2016 at 13:13:57
# Updated 04/01/2016 by Xplode
# Database : 2016-01-04.2 [Server]
# Operating system : Windows 8.1 Pro with Media Center  (x64)
# Username : Mike Howell - CS-08
# Running from : C:\Users\Mike Howell\Desktop\AdwCleaner.exe
# Option : Scan
# Support : http://toolslib.net/forum

***** [ Services ] *****

***** [ Folders ] *****

Folder Found : C:\Users\Mike Howell\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ASPackage

***** [ Files ] *****

***** [ DLL ] *****

***** [ Shortcuts ] *****

***** [ Scheduled tasks ] *****

***** [ Registry ] *****

Key Found : HKCU\Software\Classes\CLSID\{17EF1FFB-0545-4C9A-BE64-78FF53338475}
Key Found : HKCU\Software\DAILYPCCLEAN
Key Found : HKCU\Software\tstamptoken
Key Found : HKCU\Software\Microsoft\Tinstalls
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SU

***** [ Web browsers ] *****

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [968 bytes] ##########


  • 0

#6
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
At what stage did it crash ?

Could you try to run the FRST fix from safe mode please
  • 0

#7
bhzendner

bhzendner

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 219 posts

It seem to be running like its old self, do you want me to do safe mode?


  • 0

#8
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
No run a fresh FRST please as it may have removed the bad stuff already
  • 0

#9
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.


  • 0






Similar Topics


Also tagged with one or more of these keywords: malware, slow

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP