[cctexun]

Thanks so much for taking the time to assist old folks such as myself. I need a 6 year old to make sure I follow your instructions to the tee. Okie Dokie here we go. Startup may take up to 5 minutes before I can open a browser. Takes forever to load pages okay maybe 30-45 seconds but if the page has scripts all bets are off, the debug box comes up and I get to wait for that to clear. If I have several tabs open invariably the debug box will take me to one of the other tabs. Then my typing sometimes delays as do any selecting with the pointer. So I have something going on.

 

I have run malwarebytes religiously and in the last year of so it has found absolutely no threats. So today I thought I might have installed it incorrectly and about an hour ago uninstalled it. So this FRST scan is without it. I have kept Avast updated and scanned and it has found nothing in a long time either.

 

I blew out the tower  a week ago and hoped to magically wake up and find all was hunky dory, no such luck. Videos on youtube lag or buffer for a while. I have been having a time with Windows Update. Long download and install waits if it even completes. I am holding out on the win 10 change till I get these issues addressed.

 

There are other things going on but right now this is all that stands out.

 

So folks here are the FRST logs and I eagerly await your guidance. D

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 17-07-2016
Ran by VV(administrator) on vv-PC (16-07-2016 14:55:43)
Running from C:\Users\vv\Desktop
Loaded Profiles: vv (Available Profiles: vv)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Acer Incorporated) C:\Program Files (x86)\eMachines\Registration\GREGsvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Acer Group) C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe
(CANON INC.) C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.30.3\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.30.3\GoogleCrashHandler64.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8312352 2009-11-02] (Realtek Semiconductor)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2782096 2010-07-25] (CANON INC.)
HKLM-x32\...\Run: [IJNetworkScanUtility] => C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE [124512 2007-05-21] (CANON INC.)
HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1213848 2010-09-14] (CANON INC.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [8900328 2016-07-11] (AVAST Software)
HKLM-x32\...\Run: [DivXMediaServer] => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [1010144 2016-05-31] (DivX, LLC)
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe [37232 2008-06-12] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2016-06-30] (AVAST Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 66.90.130.101 216.82.201.11
Tcpip\..\Interfaces\{BCDA8412-3128-41BF-A242-FD5B7F32D39A}: [DhcpNameServer] 66.90.130.101 216.82.201.11

Internet Explorer:
==================
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxps://search.yahoo.com/yhs/search?type=odc198&hspart=avast&hsimp=yhs-001&p={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-617015327-2867507804-3021834350-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://search.yahoo.com/yhs/search?type=odc198&hspart=avast&hsimp=yhs-001&p={searchTerms}
SearchScopes: HKLM-x32 -> {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxps://search.yahoo.com/yhs/search?type=odc198&hspart=avast&hsimp=yhs-001&p={searchTerms}
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2016-06-30] (AVAST Software)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-06-30] (AVAST Software)
BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2008-06-11] (Adobe Systems Incorporated)
BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2008-06-11] (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2008-06-11] (Adobe Systems Incorporated)

FireFox:
========
FF ProfilePath: C:\Users\vv vv\AppData\Roaming\Mozilla\Firefox\Profiles\n60g2t04.default-1463113826783
FF Homepage: hxxps://www.google.com/advanced_search
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_22_0_0_209.dll [2016-07-13] ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\system32\npDeployJava1.dll [2013-08-04] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_22_0_0_209.dll [2016-07-13] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1224194.dll [2016-02-19] (Adobe Systems, Inc.)
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL [2010-04-14] (CANON INC.)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll [2014-05-22] (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll [2016-05-13] (DivX, LLC)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll [2013-06-28] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-09-23] (Microsoft Corporation)
FF Plugin-x32: @real.com/nprpchromebrowserrecordext;version=15.0.4.53 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll [2012-05-27] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprphtml5videoshim;version=15.0.4.53 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll [2012-05-27] (RealNetworks, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-10] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-10] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-06-30] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-617015327-2867507804-3021834350-1000: @citrixonline.com/appdetectorplugin -> C:\Users\vv vv\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2013-10-24] (Citrix Online)
FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-06-30]
FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF Extension: Avast SafePrice - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2016-06-30]
FF HKLM-x32\...\Firefox\Extensions: [{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012-10-05] [not signed]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\SafePrice\FF

Chrome:
=======
CHR HomePage: Default -> hxxps://www.google.com/advanced_search
CHR StartupUrls: Default -> "hxxps://www.google.com/advanced_search","hxxps://www.google.com/advanced_search"
CHR Plugin: (Widevine Content Decryption Module) - C:\Users\vv vv\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.8.866\_platform_specific\win_x86\widevinecdmadapter.dll (Google Inc.)
CHR Plugin: (Shockwave Flash) - C:\Users\vv vv\AppData\Local\Google\Chrome\User Data\PepperFlash\21.0.0.216\pepflashplayer.dll ()
CHR Profile: C:\Users\vv vv\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\vv vv\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-03-06]
CHR Extension: (Google Docs) - C:\Users\vv vv\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-03-07]
CHR Extension: (Google Drive) - C:\Users\vv vv\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-03-07]
CHR Extension: (YouTube) - C:\Users\vv vv\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-03-07]
CHR Extension: (Google Docs Offline) - C:\Users\vv vv\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-27]
CHR Extension: (Avast Online Security) - C:\Users\vv vv\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2016-04-08]
CHR Extension: (RealPlayer HTML5Video Downloader Extension) - C:\Users\vv vv\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk [2016-03-06]
CHR Extension: (Chrome Web Store Payments) - C:\Users\vv vv\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-03]
CHR Extension: (Gmail) - C:\Users\vv vv\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-03-07]
CHR HKLM-x32\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx [2012-05-27]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [197128 2016-06-30] (AVAST Software)
R2 GREGService; C:\Program Files (x86)\eMachines\Registration\GREGsvc.exe [23584 2010-01-08] (Acer Incorporated)
R2 Updater Service; C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe [243232 2010-01-28] (Acer Group)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [37656 2016-06-30] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [108304 2016-06-30] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [103064 2016-06-30] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [74544 2016-06-30] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1070904 2016-06-30] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [473592 2016-07-13] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [162904 2016-06-30] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [290088 2016-06-30] (AVAST Software)
S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R3 netr28x; C:\Windows\System32\DRIVERS\netr28x.sys [2473616 2014-12-10] (MediaTek Inc.)
S3 rt70x64; C:\Windows\System32\DRIVERS\netr7064.sys [388448 2010-04-27] (Ralink Technology Corp.)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-07-16 14:55 - 2016-07-16 15:03 - 00013962 _____ C:\Users\vv vv\Desktop\FRST.txt
2016-07-16 14:44 - 2016-07-16 14:45 - 02391040 _____ (Farbar) C:\Users\vv vv\Desktop\FRST64.exe
2016-07-13 10:56 - 2016-07-13 10:56 - 00000472 _____ C:\Users\vv vv\Desktop\Facebook comments not posted.txt
2016-07-07 02:44 - 2016-07-07 02:44 - 00000000 ____D C:\55ff6579bb8bd443920e179d0de1
2016-07-07 02:42 - 2016-07-07 02:42 - 01683754 _____ C:\Users\vv vv\Downloads\Windows6.1-KB3161664-x64.msu
2016-07-07 02:14 - 2016-07-07 02:14 - 22851472 _____ (Malwarebytes ) C:\Users\vv vv\Downloads\mbam-setup-bc.1878-2.2.1.1043.exe
2016-07-07 01:48 - 2016-05-13 17:15 - 00382184 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2016-07-07 01:48 - 2016-05-13 17:09 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2016-07-07 01:48 - 2016-05-13 17:09 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2016-07-07 01:48 - 2016-05-13 17:09 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2016-07-07 01:48 - 2016-05-13 17:09 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2016-07-07 01:48 - 2016-05-13 16:54 - 00308456 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2016-07-07 01:48 - 2016-05-13 16:50 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2016-07-07 01:48 - 2016-05-13 16:49 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2016-07-07 01:48 - 2016-05-13 16:49 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2016-07-07 01:48 - 2016-05-13 16:27 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2016-07-07 00:03 - 2016-07-07 00:03 - 00000000 ____D C:\50866e340b62eb65c9
2016-07-06 23:25 - 2016-05-12 12:15 - 00105472 _____ (Microsoft Corporation) C:\Windows\system32\winipsec.dll
2016-07-06 23:25 - 2016-05-12 12:14 - 00794624 _____ (Microsoft Corporation) C:\Windows\system32\gpsvc.dll
2016-07-06 23:25 - 2016-05-12 12:14 - 00502272 _____ (Microsoft Corporation) C:\Windows\system32\IPSECSVC.DLL
2016-07-06 23:25 - 2016-05-12 12:14 - 00373760 _____ (Microsoft Corporation) C:\Windows\system32\polstore.dll
2016-07-06 23:25 - 2016-05-12 12:14 - 00096256 _____ (Microsoft Corporation) C:\Windows\system32\gpapi.dll
2016-07-06 23:25 - 2016-05-12 12:14 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\FwRemoteSvr.dll
2016-07-06 23:25 - 2016-05-12 10:18 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\polstore.dll
2016-07-06 23:25 - 2016-05-12 10:18 - 00079360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gpapi.dll
2016-07-06 23:25 - 2016-05-12 10:18 - 00070144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winipsec.dll
2016-07-06 23:25 - 2016-05-12 10:18 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FwRemoteSvr.dll
2016-07-06 23:24 - 2016-05-23 17:54 - 00346312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2016-07-06 23:24 - 2016-05-21 11:57 - 20341248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-07-06 23:24 - 2016-05-20 17:27 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2016-07-06 23:24 - 2016-05-20 17:09 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2016-07-06 23:24 - 2016-05-20 16:59 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2016-07-06 23:24 - 2016-05-20 16:57 - 00497664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2016-07-06 23:24 - 2016-05-20 16:57 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2016-07-06 23:24 - 2016-05-20 16:55 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2016-07-06 23:24 - 2016-05-20 16:54 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2016-07-06 23:24 - 2016-05-20 16:48 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2016-07-06 23:24 - 2016-05-20 16:33 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2016-07-06 23:24 - 2016-05-20 16:32 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2016-07-06 23:24 - 2016-05-20 16:27 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2016-07-06 23:24 - 2016-05-20 16:26 - 00091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2016-07-06 23:24 - 2016-05-20 16:23 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2016-07-06 23:24 - 2016-05-20 16:21 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2016-07-06 23:24 - 2016-05-20 16:19 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2016-07-06 23:24 - 2016-05-20 16:09 - 00725504 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2016-07-06 23:24 - 2016-05-20 16:09 - 00693248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2016-07-06 23:24 - 2016-05-20 15:38 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-07-06 23:23 - 2016-05-23 18:37 - 00394960 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2016-07-06 23:23 - 2016-05-21 12:28 - 25802752 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-07-06 23:23 - 2016-05-20 17:27 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2016-07-06 23:23 - 2016-05-20 17:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2016-07-06 23:23 - 2016-05-20 17:10 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2016-07-06 23:23 - 2016-05-20 17:09 - 00572416 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-07-06 23:23 - 2016-05-20 17:09 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2016-07-06 23:23 - 2016-05-20 17:08 - 02895360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-07-06 23:23 - 2016-05-20 17:08 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2016-07-06 23:23 - 2016-05-20 17:02 - 06051328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-07-06 23:23 - 2016-05-20 17:00 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2016-07-06 23:23 - 2016-05-20 16:57 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2016-07-06 23:23 - 2016-05-20 16:56 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2016-07-06 23:23 - 2016-05-20 16:56 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2016-07-06 23:23 - 2016-05-20 16:54 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-07-06 23:23 - 2016-05-20 16:54 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2016-07-06 23:23 - 2016-05-20 16:54 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2016-07-06 23:23 - 2016-05-20 16:50 - 02287104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2016-07-06 23:23 - 2016-05-20 16:49 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2016-07-06 23:23 - 2016-05-20 16:45 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2016-07-06 23:23 - 2016-05-20 16:45 - 00476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2016-07-06 23:23 - 2016-05-20 16:44 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2016-07-06 23:23 - 2016-05-20 16:44 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2016-07-06 23:23 - 2016-05-20 16:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2016-07-06 23:23 - 2016-05-20 16:41 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2016-07-06 23:23 - 2016-05-20 16:33 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2016-07-06 23:23 - 2016-05-20 16:29 - 13815808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-07-06 23:23 - 2016-05-20 16:28 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2016-07-06 23:23 - 2016-05-20 16:27 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2016-07-06 23:23 - 2016-05-20 16:25 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2016-07-06 23:23 - 2016-05-20 16:23 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2016-07-06 23:23 - 2016-05-20 16:22 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2016-07-06 23:23 - 2016-05-20 16:14 - 04610048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-07-06 23:23 - 2016-05-20 16:12 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2016-07-06 23:23 - 2016-05-20 16:11 - 15420928 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-07-06 23:23 - 2016-05-20 16:11 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2016-07-06 23:23 - 2016-05-20 16:08 - 02055680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2016-07-06 23:23 - 2016-05-20 16:08 - 00806400 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-07-06 23:23 - 2016-05-20 16:07 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2016-07-06 23:23 - 2016-05-20 16:07 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2016-07-06 23:23 - 2016-05-20 16:06 - 02131968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-07-06 23:23 - 2016-05-20 15:46 - 02597888 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-07-06 23:23 - 2016-05-20 15:42 - 02121216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2016-07-06 23:23 - 2016-05-20 15:38 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2016-07-06 23:23 - 2016-05-20 15:34 - 01544192 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-07-06 23:23 - 2016-05-20 15:23 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2016-07-06 23:21 - 2016-05-12 12:15 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2016-07-06 23:21 - 2016-05-12 10:18 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2016-07-06 23:20 - 2016-05-12 12:20 - 00154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2016-07-06 23:20 - 2016-05-12 12:20 - 00095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2016-07-06 23:20 - 2016-05-12 12:15 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2016-07-06 23:20 - 2016-05-12 12:15 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2016-07-06 23:20 - 2016-05-12 12:15 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2016-07-06 23:20 - 2016-05-12 12:15 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2016-07-06 23:20 - 2016-05-12 12:14 - 01464320 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2016-07-06 23:20 - 2016-05-12 12:14 - 01212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2016-07-06 23:20 - 2016-05-12 12:14 - 00730624 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2016-07-06 23:20 - 2016-05-12 12:14 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2016-07-06 23:20 - 2016-05-12 12:14 - 00463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2016-07-06 23:20 - 2016-05-12 12:14 - 00344064 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2016-07-06 23:20 - 2016-05-12 12:14 - 00316416 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2016-07-06 23:20 - 2016-05-12 12:14 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2016-07-06 23:20 - 2016-05-12 12:14 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2016-07-06 23:20 - 2016-05-12 12:14 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2016-07-06 23:20 - 2016-05-12 12:14 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2016-07-06 23:20 - 2016-05-12 12:14 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2016-07-06 23:20 - 2016-05-12 12:14 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2016-07-06 23:20 - 2016-05-12 12:14 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2016-07-06 23:20 - 2016-05-12 10:18 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2016-07-06 23:20 - 2016-05-12 10:18 - 00666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2016-07-06 23:20 - 2016-05-12 10:18 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2016-07-06 23:20 - 2016-05-12 10:18 - 00342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2016-07-06 23:20 - 2016-05-12 10:18 - 00260608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2016-07-06 23:20 - 2016-05-12 10:18 - 00251392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2016-07-06 23:20 - 2016-05-12 10:18 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2016-07-06 23:20 - 2016-05-12 10:18 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2016-07-06 23:20 - 2016-05-12 10:18 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2016-07-06 23:20 - 2016-05-12 10:18 - 00141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2016-07-06 23:20 - 2016-05-12 10:18 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2016-07-06 23:20 - 2016-05-12 10:18 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2016-07-06 23:20 - 2016-05-12 10:18 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2016-07-06 23:20 - 2016-05-12 10:18 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2016-07-06 23:20 - 2016-05-12 10:18 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2016-07-06 23:20 - 2016-05-12 10:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2016-07-06 23:20 - 2016-05-12 09:58 - 00464896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2016-07-06 23:20 - 2016-05-12 09:58 - 00405504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2016-07-06 23:20 - 2016-05-12 09:58 - 00291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2016-07-06 23:20 - 2016-05-12 09:58 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2016-07-06 23:20 - 2016-05-12 09:58 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2016-07-06 23:20 - 2016-05-12 09:58 - 00129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2016-07-06 23:20 - 2016-05-12 09:57 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2016-07-06 23:20 - 2016-05-12 09:56 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2016-07-06 23:20 - 2016-05-12 09:51 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2016-07-06 23:20 - 2016-05-12 08:05 - 00459640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2016-07-06 23:20 - 2016-05-12 08:05 - 00297984 _____ (Microsoft Corporation) C:\Windows\system32\bcryptprimitives.dll
2016-07-06 23:20 - 2016-05-12 08:04 - 00249352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcryptprimitives.dll
2016-07-06 23:20 - 2016-05-11 12:02 - 00444928 _____ (Microsoft Corporation) C:\Windows\system32\winhttp.dll
2016-07-06 23:20 - 2016-05-11 12:02 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2016-07-06 23:20 - 2016-05-11 12:02 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\ws2_32.dll
2016-07-06 23:20 - 2016-05-11 10:19 - 00351744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winhttp.dll
2016-07-06 23:20 - 2016-05-11 10:19 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2016-07-06 23:20 - 2016-05-11 10:19 - 00206336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ws2_32.dll
2016-07-06 23:20 - 2016-05-11 10:11 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\netbtugc.exe
2016-07-06 23:20 - 2016-05-11 10:01 - 00026624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netbtugc.exe
2016-07-06 23:20 - 2016-05-11 09:58 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbt.sys
2016-07-06 23:18 - 2016-06-06 11:58 - 00041704 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2016-07-06 23:18 - 2016-06-06 11:50 - 01204224 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2016-07-06 23:18 - 2016-06-03 08:05 - 01413120 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2016-07-06 23:18 - 2016-05-27 08:06 - 00569856 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2016-07-06 23:18 - 2016-05-27 08:06 - 00544256 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2016-07-06 23:18 - 2016-05-27 08:06 - 00276480 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2016-07-06 23:18 - 2016-05-27 08:06 - 00265216 _____ (Microsoft Corporation) C:\Windows\system32\centel.dll
2016-07-06 23:18 - 2016-05-22 08:06 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2016-07-06 23:18 - 2016-05-12 10:03 - 03217408 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-07-06 23:01 - 2016-05-18 11:10 - 00312832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2016-07-06 23:01 - 2016-05-18 11:09 - 00405504 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2016-07-06 23:01 - 2016-05-11 12:02 - 00483840 _____ (Microsoft Corporation) C:\Windows\system32\StructuredQuery.dll
2016-07-06 23:01 - 2016-05-11 10:19 - 00363520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\StructuredQuery.dll
2016-07-04 12:39 - 2016-07-04 12:39 - 00495908 _____ C:\Users\vv vv\Downloads\2016-July4th-ParadeMap.pdf
2016-07-04 12:38 - 2016-07-04 12:39 - 00961902 _____ C:\Users\vv vv\Downloads\Big-Bang-2016-Map.pdf
2016-07-01 13:35 - 2016-07-01 13:35 - 10097992 _____ C:\Users\vv vv\Downloads\WORLD_DRUG_REPORT_2016_web.pdf
2016-07-01 13:35 - 2016-07-01 13:35 - 00834220 _____ C:\Users\vv vv\Downloads\90cdd4fdc9b54e5cb5b4d2ed8ed87c59_100.pdf
2016-06-30 07:43 - 2016-06-30 07:43 - 00390984 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2016-06-30 07:43 - 2016-06-30 07:43 - 00053208 _____ (AVAST Software) C:\Windows\avastSS.scr
2016-06-24 17:12 - 2016-07-12 11:01 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-06-24 17:12 - 2016-07-12 10:18 - 00000000 ____D C:\Program Files\Mozilla Firefox
2016-06-24 16:44 - 2016-06-24 16:45 - 47230264 _____ C:\Users\vv vv\Downloads\Firefox Setup 47.0.exe
2016-06-23 14:59 - 2016-07-07 01:03 - 00055110 _____ C:\Windows\ntbtlog.txt
2016-06-23 09:21 - 2016-06-23 09:22 - 00347816 _____ (Microsoft Corporation) C:\Users\vv vv\Downloads\MicrosoftFixit.wu.MATSKB.Run.exe
2016-06-23 08:41 - 2016-06-23 08:41 - 00985600 _____ C:\Users\vv vv\Downloads\MicrosoftFixit50123.msi
2016-06-22 23:40 - 2016-06-23 00:41 - 00000894 _____ C:\Users\vv vv\Desktop\Boat repairs.txt
2016-06-21 04:05 - 2016-06-21 04:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Seagate
2016-06-17 13:38 - 2016-06-17 13:38 - 00431833 _____ C:\Users\vv vv\Downloads\472053_T-S20_PROOF.pdf
2016-06-17 13:38 - 2016-06-17 13:38 - 00403411 _____ C:\Users\vv vv\Downloads\Accents_Credit_Card_Form_Michelle.pdf
2016-06-17 13:38 - 2016-06-17 13:38 - 00400078 _____ C:\Users\vv vv\Downloads\472053_T-S16_PROOF.pdf
2016-06-17 13:38 - 2016-06-17 13:38 - 00321550 _____ C:\Users\vv vv\Downloads\472053_T-S12_PROOF.pdf
2016-06-17 13:38 - 2016-06-17 13:38 - 00234123 _____ C:\Users\vv vv\Downloads\472053_cover.pdf
2016-06-17 13:38 - 2016-06-17 13:38 - 00041042 _____ C:\Users\vv vv\Downloads\472053 OA #1.pdf

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-07-16 15:09 - 2014-08-19 11:00 - 00000598 _____ C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-617015327-2867507804-3021834350-1000.job
2016-07-16 15:01 - 2011-08-20 08:27 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-07-16 14:55 - 2015-01-07 00:03 - 00000000 ____D C:\FRST
2016-07-16 14:52 - 2009-07-13 23:45 - 00018736 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-07-16 14:52 - 2009-07-13 23:45 - 00018736 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-07-16 14:50 - 2015-10-22 05:06 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-07-16 14:48 - 2016-05-25 16:03 - 00000000 ____D C:\Users\vv vv\Desktop\5.25.16 Cleaning
2016-07-16 14:28 - 2015-05-30 17:17 - 00000694 _____ C:\Windows\Tasks\G2MUploadTask-S-1-5-21-617015327-2867507804-3021834350-1000.job
2016-07-16 12:48 - 2011-08-20 08:27 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-07-16 12:47 - 2009-07-14 00:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-07-15 13:36 - 2014-12-24 10:32 - 00004476 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2016-07-15 13:28 - 2016-05-06 14:27 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-07-15 04:11 - 2011-07-30 21:22 - 00000000 ____D C:\Users\vv vv\AppData\Local\ElevatedDiagnostics
2016-07-15 04:11 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\system32\NDF
2016-07-14 17:34 - 2009-07-14 00:08 - 00032630 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2016-07-14 17:19 - 2012-10-05 22:05 - 00004180 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2016-07-13 06:54 - 2015-10-22 05:06 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2016-07-13 06:54 - 2015-10-14 17:00 - 00796352 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-07-13 06:54 - 2015-10-14 17:00 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-07-13 06:52 - 2012-10-05 22:05 - 00473592 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2016-07-13 06:52 - 2011-10-14 07:46 - 00000000 ____D C:\Windows\system32\Macromed
2016-07-13 06:51 - 2010-09-02 04:49 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2016-07-07 11:27 - 2012-09-01 08:26 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2016-07-07 11:27 - 2012-09-01 08:26 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2016-07-07 05:28 - 2013-07-17 20:53 - 00000000 ____D C:\Windows\system32\MRT
2016-07-07 05:15 - 2011-07-30 20:15 - 142482544 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-07-07 05:14 - 2012-09-01 08:27 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2016-07-07 04:54 - 2009-07-13 23:45 - 03014592 _____ C:\Windows\system32\FNTCACHE.DAT
2016-07-07 04:52 - 2014-12-09 23:18 - 00000000 ____D C:\Windows\system32\appraiser
2016-07-06 09:23 - 2015-11-29 08:14 - 00007628 _____ C:\Users\vv vv\AppData\Local\Resmon.ResmonCfg
2016-07-04 03:58 - 2012-03-09 08:38 - 00000000 ____D C:\Users\vv vv\Documents\Word Docs
2016-07-01 22:03 - 2015-05-30 17:17 - 00003742 _____ C:\Windows\System32\Tasks\G2MUploadTask-S-1-5-21-617015327-2867507804-3021834350-1000
2016-07-01 22:03 - 2014-08-19 11:00 - 00003646 _____ C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-617015327-2867507804-3021834350-1000
2016-07-01 17:22 - 2009-07-14 00:13 - 00782510 _____ C:\Windows\system32\PerfStringBackup.INI
2016-07-01 17:22 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\inf
2016-06-30 07:43 - 2014-05-08 23:58 - 00037656 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2016-06-30 07:43 - 2014-01-08 18:15 - 00162904 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2016-06-30 07:43 - 2013-03-19 19:59 - 00290088 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
2016-06-30 07:43 - 2013-03-19 19:58 - 00074544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2016-06-30 07:43 - 2012-10-05 22:05 - 01070904 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2016-06-30 07:43 - 2012-10-05 22:05 - 00473592 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.146729077009602
2016-06-30 07:43 - 2012-10-05 22:05 - 00108304 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2016-06-30 07:43 - 2012-10-05 22:05 - 00103064 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2016-06-30 00:30 - 2011-07-30 22:56 - 00000000 ____D C:\Users\vv vv\Documents\Business 1dt
2016-06-24 17:13 - 2011-07-29 20:33 - 00000896 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-06-21 12:13 - 2011-07-29 20:36 - 00485032 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2016-06-21 04:09 - 2015-06-08 12:05 - 00000000 ____D C:\ProgramData\Package Cache

==================== Files in the root of some directories =======

2015-11-29 08:14 - 2016-07-06 09:23 - 0007628 _____ () C:\Users\vv vv\AppData\Local\Resmon.ResmonCfg

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-06-11 07:25

==================== End of FRST.txt ============================

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-07-2016
Ran by vv vv (2016-07-16 15:22:34)
Running from C:\Users\vv vv\Desktop
Windows 7 Home Premium Service Pack 1 (X64) (2011-07-30 00:14:21)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-617015327-2867507804-3021834350-500 - Administrator - Disabled)
vv vv (S-1-5-21-617015327-2867507804-3021834350-1000 - Administrator - Enabled) => C:\Users\vv vv
Guest (S-1-5-21-617015327-2867507804-3021834350-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-617015327-2867507804-3021834350-1002 - Limited - Enabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 15.12 (HKLM-x32\...\{23170F69-40C1-2701-1512-000001000000}) (Version: 15.12.00.0 - Igor Pavlov)
Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.017.20050 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 21.0.0.215 - Adobe Systems Incorporated)
Adobe Anchor Service x64 CS4 (Version: 2.0 - Adobe Systems Incorporated) Hidden
Adobe CMaps x64 CS4 (Version: 2.0 - Adobe Systems Incorporated) Hidden
Adobe Creative Suite 4 Master Collection (HKLM-x32\...\Adobe_b2d6abde968e6f277ddbfd501383e02) (Version: 4.0 - Adobe Systems Incorporated)
Adobe CSI CS4 x64 (Version: 1 - Adobe Systems Incorporated) Hidden
Adobe Digital Editions 2.0 (HKLM-x32\...\Adobe Digital Editions 2.0) (Version: 2.0 - Adobe Systems Incorporated)
Adobe Drive CS4 x64 (Version: 1 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 22 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 22.0.0.209 - Adobe Systems Incorporated)
Adobe Linguistics CS4 x64 (Version: 4.0.0 - Adobe Systems Incorporated) Hidden
Adobe PDF Library Files x64 CS4 (Version: 9.0 - Adobe Systems Incorporated) Hidden
Adobe Photoshop CS4 (64 Bit) (Version: 11.0 - Adobe Systems Incorporated) Hidden
Adobe Shockwave Player 12.2 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.2.4.194 - Adobe Systems, Inc.)
Adobe Type Support x64 CS4 (Version: 9.0 - Adobe Systems Incorporated) Hidden
Adobe WinSoft Linguistics Plugin x64 (Version: 1.1 - Adobe Systems Incorporated) Hidden
Advertising Center (x32 Version: 0.0.0.2 - Nero AG) Hidden
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 12.1.2272 - AVAST Software)
Canon Easy-PhotoPrint EX (HKLM-x32\...\Easy-PhotoPrint EX) (Version:  - )
Canon IJ Network Scan Utility (HKLM-x32\...\Canon_IJ_Network_Scan_UTILITY) (Version:  - )
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version:  - )
Canon MP Navigator EX 4.1 (HKLM-x32\...\MP Navigator EX 4.1) (Version:  - )
Canon MX880 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX880_series) (Version:  - )
Canon MX880 series User Registration (HKLM-x32\...\Canon MX880 series User Registration) (Version:  - )
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version:  - )
Canon Solution Menu EX (HKLM-x32\...\CanonSolutionMenuEX) (Version:  - )
Canon Speed Dial Utility (HKLM-x32\...\Speed Dial Utility) (Version:  - )
Citrix Online Launcher (HKLM-x32\...\{DB014C85-A264-4BCA-A66F-6DD1FCF8EC36}) (Version: 1.0.335 - Citrix)
Connect (x32 Version: 1.0.0.1 - Adobe Systems Incorporated) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DivX Setup (HKLM\...\DivX Setup) (Version: 3.0.0.58 - DivX, LLC)
eMachines Recovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3013 - Acer Incorporated)
eMachines Registration (HKLM-x32\...\eMachines Registration) (Version: 1.03.3003 - Acer Incorporated)
Google Earth (HKLM-x32\...\{817750FA-EC6A-485D-9901-0683AE6FFDF1}) (Version: 7.1.5.1557 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.30.3 - Google Inc.) Hidden
GoToMeeting 7.20.0.5174 (HKU\S-1-5-21-617015327-2867507804-3021834350-1000\...\GoToMeeting) (Version: 7.20.0.5174 - CitrixOnline)
Hotkey Utility (HKLM-x32\...\Hotkey Utility) (Version: 2.05.3009 - Acer Incorporated)
Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3003 - Acer Incorporated)
ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden
Intel® Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.0.1006 - Intel Corporation)
Intel® Graphics Media Accelerator Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.1968 - Intel Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
kuler (x32 Version: 2.0 - Adobe Systems Incorporated) Hidden
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.6.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50428.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Mozilla Firefox 47.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 47.0 (x86 en-US)) (Version: 47.0 - Mozilla)
Mozilla Firefox 47.0.1 (x64 en-US) (HKLM\...\Mozilla Firefox 47.0.1 (x64 en-US)) (Version: 47.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 47.0.1.6018 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
Nero 9 Essentials (HKLM-x32\...\{cab2e8d7-08e4-42d2-a676-ddf729a26522}) (Version:  - Nero AG)
PDF Settings CS4 (x32 Version: 9.0 - Adobe Systems Incorporated) Hidden
Photoshop Camera Raw (x32 Version: 5.0 - Adobe Systems Incorporated) Hidden
Photoshop Camera Raw_x64 (Version: 5.0 - Adobe Systems Incorporated) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5972 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
SafeZone Stable 1.48.2066.44 (x32 Version: 1.48.2066.44 - Avast Software) Hidden
SeaTools for Windows 1.4.0.4 (HKLM-x32\...\SeaTools for Windows) (Version: 1.4.0.4 - Seagate Technology)
Speccy (HKLM\...\Speccy) (Version: 1.29 - Piriform)
Suite Shared Configuration CS4 (x32 Version: 1.0 - Adobe Systems Incorporated) Hidden
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
Welcome Center (HKLM-x32\...\eMachines Welcome Center) (Version: 1.02.3005 - Acer Incorporated)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-617015327-2867507804-3021834350-1000_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Users\vv vv\AppData\Local\Citrix\GoToMeeting\1468\G2MOutlookAddin64.dll => No File

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {01D239B6-D729-44C3-9E63-130D4EDA6005} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2016-06-10] (AVAST Software)
Task: {0455CE68-CA8B-4AD4-B1D7-0A905455568D} - System32\Tasks\{3B4AF946-5B1D-4D7C-860B-354479CCDBE0} => Firefox.exe
Task: {0A4C63C5-9DC5-4777-8DC5-AB93D395446F} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-617015327-2867507804-3021834350-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe
Task: {0B231669-ECFD-4A50-90C3-141B21AE99BD} - System32\Tasks\{802E66F5-3F33-44A2-A451-F2BCCFB57410} => C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
Task: {15B742F4-E5FF-4149-BA17-BB8A7E062A46} - System32\Tasks\G2MUpdateTask-S-1-5-21-617015327-2867507804-3021834350-1000 => C:\Users\vv vv\AppData\Local\Citrix\GoToMeeting\5174\g2mupdate.exe [2016-07-01] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {33874A02-42FA-4D47-B463-AE096F312D39} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2016-06-30] (AVAST Software)
Task: {7C6DED95-47F0-4A4F-AB89-788F32E65FCF} - System32\Tasks\{881A017E-F29F-47CF-9432-5AB6CFC5284D} => pcalua.exe -a "C:\Users\vv vv\Desktop\esetsmartinstaller_enu.exe" -d "C:\Users\vv vv\Desktop"
Task: {907378C4-3F82-4CC6-9C11-9A44E5040563} - System32\Tasks\DivXUpdate => C:\Program Files (x86)\Common Files\DivX Shared\Qt4.8\DivXUpdate.exe [2016-04-13] (DivX, LLC)
Task: {9482176E-F2F3-4171-9029-A581EBFC4E76} - System32\Tasks\{BDDE6396-9D5F-449C-B93D-FA1BA4D790F0} => Firefox.exe
Task: {AABCAD20-9EEC-4B60-BE8D-C32388E79060} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)
Task: {AC7E8EE1-C278-4C4C-A448-A96A3AC61D36} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)
Task: {B9EC1F19-4486-4882-ADE7-ED44987F1540} - System32\Tasks\G2MUploadTask-S-1-5-21-617015327-2867507804-3021834350-1000 => C:\Users\vv vv\AppData\Local\Citrix\GoToMeeting\5174\g2mupload.exe [2016-07-01] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {C34A187E-BB03-4912-BCD3-7C63A5BC2E78} - System32\Tasks\SafeZone scheduled Autoupdate 1458727563 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe
Task: {D59446B4-957C-4475-AD56-AA35BA357B0E} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-06-25] (Adobe Systems Incorporated)
Task: {F03CC05A-7FDD-46DF-85E8-D9BF277F6384} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-617015327-2867507804-3021834350-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe
Task: {FD6C42CF-372E-4D5D-9D46-5FB204E37566} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-07-13] (Adobe Systems Incorporated)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-617015327-2867507804-3021834350-1000.job => C:\Users\vv vv\AppData\Local\Citrix\GoToMeeting\5174\g2mupdate.exe
Task: C:\Windows\Tasks\G2MUploadTask-S-1-5-21-617015327-2867507804-3021834350-1000.job => C:\Users\vv vv\AppData\Local\Citrix\GoToMeeting\5174\g2mupload.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2016-06-30 07:43 - 2016-06-30 07:43 - 00146232 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2016-07-16 07:09 - 2016-07-16 07:09 - 03000832 _____ () C:\Program Files\AVAST Software\Avast\defs\16071600\algo.dll
2016-06-30 07:43 - 2016-06-30 07:43 - 00479288 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2016-06-30 07:43 - 2016-06-30 07:43 - 48936448 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE restricted site: HKU\S-1-5-21-617015327-2867507804-3021834350-1000\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-617015327-2867507804-3021834350-1000\...\008k.com -> 008k.com
IE restricted site: HKU\S-1-5-21-617015327-2867507804-3021834350-1000\...\00hq.com -> 00hq.com
IE restricted site: HKU\S-1-5-21-617015327-2867507804-3021834350-1000\...\0190-dialers.com -> 0190-dialers.com
IE restricted site: HKU\S-1-5-21-617015327-2867507804-3021834350-1000\...\01i.info -> 01i.info
IE restricted site: HKU\S-1-5-21-617015327-2867507804-3021834350-1000\...\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com
IE restricted site: HKU\S-1-5-21-617015327-2867507804-3021834350-1000\...\05p.com -> 05p.com
IE restricted site: HKU\S-1-5-21-617015327-2867507804-3021834350-1000\...\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com
IE restricted site: HKU\S-1-5-21-617015327-2867507804-3021834350-1000\...\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com
IE restricted site: HKU\S-1-5-21-617015327-2867507804-3021834350-1000\...\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com
IE restricted site: HKU\S-1-5-21-617015327-2867507804-3021834350-1000\...\0calories.net -> 0calories.net
IE restricted site: HKU\S-1-5-21-617015327-2867507804-3021834350-1000\...\0cj.net -> 0cj.net
IE restricted site: HKU\S-1-5-21-617015327-2867507804-3021834350-1000\...\0scan.com -> 0scan.com
IE restricted site: HKU\S-1-5-21-617015327-2867507804-3021834350-1000\...\1-britney-spears-nude.com -> 1-britney-spears-nude.com
IE restricted site: HKU\S-1-5-21-617015327-2867507804-3021834350-1000\...\1-domains-registrations.com -> 1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-617015327-2867507804-3021834350-1000\...\1-se.com -> 1-se.com
IE restricted site: HKU\S-1-5-21-617015327-2867507804-3021834350-1000\...\1001movie.com -> 1001movie.com
IE restricted site: HKU\S-1-5-21-617015327-2867507804-3021834350-1000\...\1001night.biz -> 1001night.biz
IE restricted site: HKU\S-1-5-21-617015327-2867507804-3021834350-1000\...\100gal.net -> 100gal.net
IE restricted site: HKU\S-1-5-21-617015327-2867507804-3021834350-1000\...\100sexlinks.com -> 100sexlinks.com

There are 5317 more sites.


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 21:34 - 2015-10-22 05:08 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-617015327-2867507804-3021834350-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\vv vv\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 66.90.130.101 - 216.82.201.11
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: Adobe Acrobat Speed Launcher => "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
MSCONFIG\startupreg: AdobeCS4ServiceManager => "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
MSCONFIG\startupreg: Hotkey Utility => C:\Program Files (x86)\eMachines\Hotkey Utility\HotkeyUtility.exe

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{DC79DD1F-269B-479C-825C-6DF3CC7CC174}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{430A8B25-689C-47B2-B478-62CF32F98A5C}] => (Allow) LPort=2869
FirewallRules: [{B2C51341-016C-49B1-8E6D-E1DEF450FE2D}] => (Allow) LPort=1900
FirewallRules: [{769EE53E-2109-4297-AD6E-D7B7965CD4B6}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{453C4856-4195-4499-8730-111ED29B3BCA}] => (Allow) C:\Program Files (x86)\Windows Live\Mesh\MOE.exe
FirewallRules: [{5D255F9E-F737-45DF-BC28-88AD923A5EC0}] => (Allow) C:\Program Files (x86)\Symantec AntiVirus\Rtvscan.exe
FirewallRules: [{59FB6BD1-4234-4346-BC28-13F4BAC6E15B}] => (Allow) C:\Program Files (x86)\Symantec AntiVirus\Rtvscan.exe
FirewallRules: [{E60FB44B-EF03-4ABD-95EE-235F804D9E7E}] => (Allow) C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe
FirewallRules: [{8F1986EC-A921-4AE0-AE09-DAA8ED60BA38}] => (Allow) C:\Program Files (x86)\Common Files\Symantec Shared\ccApp.exe
FirewallRules: [{80C6D978-78E0-461C-A31A-44D3D389872E}] => (Allow) LPort=5353
FirewallRules: [{63A5AA35-56BE-4040-9ABE-6166A363CCA5}] => (Allow) C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe
FirewallRules: [{9D5156B2-DAFC-41CE-A8EE-E7711E25C021}] => (Allow) C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe
FirewallRules: [TCP Query User{5F753EB0-6CF0-41A9-8998-4E94BD408B17}C:\program files (x86)\google\google earth\plugin\geplugin.exe] => (Allow) C:\program files (x86)\google\google earth\plugin\geplugin.exe
FirewallRules: [UDP Query User{FFE25D0E-45EB-4A6B-A9A1-D1AC6BDF6FC7}C:\program files (x86)\google\google earth\plugin\geplugin.exe] => (Allow) C:\program files (x86)\google\google earth\plugin\geplugin.exe
FirewallRules: [TCP Query User{E7FACFD6-D809-4D96-BE65-FEB90A27F184}C:\program files (x86)\google\google earth\client\googleearth.exe] => (Allow) C:\program files (x86)\google\google earth\client\googleearth.exe
FirewallRules: [UDP Query User{583508C4-E694-4B95-9457-3B3211D333C5}C:\program files (x86)\google\google earth\client\googleearth.exe] => (Allow) C:\program files (x86)\google\google earth\client\googleearth.exe
FirewallRules: [{C61D63CD-BF1F-4D5B-BA3B-C99A130E28E9}] => (Allow) C:\Users\vv vv\AppData\Local\Temp\7zSF823.tmp\SymNRT.exe
FirewallRules: [{2CC423E0-31C1-4870-A5E5-164AAA67C492}] => (Allow) C:\Users\vv vv\AppData\Local\Temp\7zSF823.tmp\SymNRT.exe
FirewallRules: [{8CA42AE3-5ED4-4C8A-862E-C4BA6CB3302F}] => (Allow) C:\Users\vv vv\AppData\Local\Temp\7zSEEB2.tmp\SymNRT.exe
FirewallRules: [{788C636C-651F-4685-B05D-DECD87AA05B0}] => (Allow) C:\Users\vv vv\AppData\Local\Temp\7zSEEB2.tmp\SymNRT.exe
FirewallRules: [{6D34AB7E-9917-4355-82BE-7BF364789DF7}] => (Allow) C:\Users\vv vv\AppData\Local\Temp\7zS7223.tmp\SymNRT.exe
FirewallRules: [{A505EFF5-8B8C-48AE-A84E-77B6DAAE1EAD}] => (Allow) C:\Users\vv vv\AppData\Local\Temp\7zS7223.tmp\SymNRT.exe
FirewallRules: [{A34EEE06-19EA-46F2-AD7D-408FDE37F3ED}] => (Allow) C:\Users\vv vv\AppData\Local\Temp\7zS53DA.tmp\SymNRT.exe
FirewallRules: [{FAFA67FD-A996-4EEC-A174-9EC21729126F}] => (Allow) C:\Users\vv vv\AppData\Local\Temp\7zS53DA.tmp\SymNRT.exe
FirewallRules: [{9F9C26C7-F134-4BF5-B99E-77ED051B909E}] => (Allow) C:\Users\vv vv\AppData\Local\Temp\7zS1CA4.tmp\SymNRT.exe
FirewallRules: [{FA9FB201-B27F-4096-B794-C403532C2F24}] => (Allow) C:\Users\vv vv\AppData\Local\Temp\7zS1CA4.tmp\SymNRT.exe
FirewallRules: [{02EA9B11-B832-4C5E-A93C-87199680D184}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{17091FC6-6107-465E-9ECD-36F358033C44}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{78223628-14AD-4D71-A7C8-61B8EAF5C828}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{60505E42-234D-4283-88A0-DD5D97B8E056}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{B4C71838-0759-49F7-AAB1-ED16C249B9D8}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{4C823FF8-101C-4FDE-B68B-85B57BF6F33B}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{2B7A0559-C423-4387-8562-81DDF9AFB3F0}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{608D1E47-D05E-4208-865A-ACA052950F4F}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe

==================== Restore Points =========================

12-06-2016 06:43:13 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501
21-06-2016 04:06:02 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
23-06-2016 08:42:24 Installed Microsoft Fix it 50123
07-07-2016 03:05:46 Windows Update
07-07-2016 03:31:17 Windows Update
07-07-2016 05:07:53 Windows Update
07-07-2016 05:34:07 Windows Update

==================== Faulty Device Manager Devices =============

Name: Microsoft PS/2 Mouse
Description: Microsoft PS/2 Mouse
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (07/16/2016 02:53:39 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program FRST64.exe version 17.7.2016.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 1340

Start Time: 01d1df9b1badbf9f

Termination Time: 184

Application Path: C:\Users\vv vv\Desktop\FRST64.exe

Report Id: f2f1ec44-4b8e-11e6-93ce-1078d2e36adb

Error: (06/28/2016 11:09:09 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program WINWORD.EXE version 12.0.6748.5000 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 170

Start Time: 01d1d1563a177c34

Termination Time: 0

Application Path: C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE

Report Id: 7c4c8fa7-3d4a-11e6-9be5-1078d2e36adb

Error: (06/24/2016 06:52:28 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program WINWORD.EXE version 12.0.6748.5000 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: cec

Start Time: 01d1ce731c61371c

Termination Time: 0

Application Path: C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE

Report Id: a4ee8c63-3a66-11e6-9a7c-1078d2e36adb

Error: (06/23/2016 09:09:00 AM) (Source: ESENT) (EventID: 490) (User: )
Description: wuaueng.dll (324) SUS20ClientDataStore: An attempt to open the file "C:\Windows\SoftwareDistribution\DataStore\DataStore.edb" for read / write access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ".  The open file operation will fail with error -1032 (0xfffffbf8).

Error: (06/23/2016 09:08:50 AM) (Source: ESENT) (EventID: 490) (User: )
Description: wuaueng.dll (324) SUS20ClientDataStore: An attempt to open the file "C:\Windows\SoftwareDistribution\DataStore\DataStore.edb" for read / write access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ".  The open file operation will fail with error -1032 (0xfffffbf8).

Error: (06/23/2016 09:08:40 AM) (Source: ESENT) (EventID: 490) (User: )
Description: wuaueng.dll (324) SUS20ClientDataStore: An attempt to open the file "C:\Windows\SoftwareDistribution\DataStore\DataStore.edb" for read / write access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ".  The open file operation will fail with error -1032 (0xfffffbf8).

Error: (06/23/2016 09:08:30 AM) (Source: ESENT) (EventID: 490) (User: )
Description: wuaueng.dll (324) SUS20ClientDataStore: An attempt to open the file "C:\Windows\SoftwareDistribution\DataStore\DataStore.edb" for read / write access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ".  The open file operation will fail with error -1032 (0xfffffbf8).

Error: (06/19/2016 10:22:35 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: plugin-container.exe, version: 47.0.0.5999, time stamp: 0x5753660e
Faulting module name: mozglue.dll, version: 47.0.0.5999, time stamp: 0x57535438
Exception code: 0x80000003
Fault offset: 0x0000f3ad
Faulting process id: 0x1360
Faulting application start time: 0xplugin-container.exe0
Faulting application path: plugin-container.exe1
Faulting module path: plugin-container.exe2
Report Id: plugin-container.exe3

Error: (06/13/2016 03:16:25 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program DivX Player.exe version 11.6.0.10 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 13ac

Start Time: 01d1c5b03c383dda

Termination Time: 49

Application Path: C:\Program Files (x86)\DivX\DivX Player\DivX Player.exe

Report Id: 95579d48-31a3-11e6-95b2-1078d2e36adb

Error: (06/09/2016 01:49:55 PM) (Source: ESENT) (EventID: 490) (User: )
Description: Windows (628) Windows: An attempt to open the file "C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk" for read / write access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ".  The open file operation will fail with error -1032 (0xfffffbf8).


System errors:
=============
Error: (07/16/2016 07:00:31 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Multimedia Class Scheduler service failed to start due to the following error:
%%1053 = The service did not respond to the start or control request in a timely fashion.


Error: (07/16/2016 07:00:31 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the MMCSS service.

Error: (07/16/2016 07:00:01 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Multimedia Class Scheduler service failed to start due to the following error:
%%1053 = The service did not respond to the start or control request in a timely fashion.


Error: (07/16/2016 07:00:01 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the MMCSS service.

Error: (07/16/2016 06:10:04 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Application Experience service failed to start due to the following error:
%%1053 = The service did not respond to the start or control request in a timely fashion.


Error: (07/16/2016 06:10:04 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the AeLookupSvc service.

Error: (07/16/2016 06:09:34 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.

Error: (07/16/2016 06:08:21 AM) (Source: Server) (EventID: 2505) (User: )
Description: The server could not bind to the transport \Device\NetBT_Tcpip_{BCDA8412-3128-41BF-A242-FD5B7F32D39A} because another computer on the network has the same name.  The server could not start.

Error: (07/16/2016 06:08:14 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (07/16/2016 06:08:08 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.


CodeIntegrity:
===================================
  Date: 2016-07-16 12:47:33.239
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.

  Date: 2016-07-16 02:56:12.958
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.

  Date: 2016-07-16 01:34:06.864
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.

  Date: 2016-07-15 21:27:00.254
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.

  Date: 2016-07-15 18:59:11.863
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.

  Date: 2016-07-15 09:09:37.864
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.

  Date: 2016-07-15 02:58:58.239
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.

  Date: 2016-07-14 17:34:28.786
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.

  Date: 2016-07-14 17:08:49.989
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.

  Date: 2016-07-14 15:36:41.613
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Processor: Intel® Celeron® CPU 450 @ 2.20GHz
Percentage of memory in use: 57%
Total physical RAM: 2013.24 MB
Available physical RAM: 859.5 MB
Total Virtual: 4026.48 MB
Available Virtual: 2345.19 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:451.16 GB) (Free:352.84 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: A19F180C)
Partition 1: (Not Active) - (Size=14.5 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=451.2 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

Edited by cctexun, 18 July 2016 - 05:28 PM.

[Advertisements]

Hi. My name is Brian, and I would be happy to look into your issue.
 

- General Instructions -

• Please read all instructions and fixes thoroughly. Read the ENTIRE post BEFORE performing any steps so you understand all that needs to be done.
• I would advise printing any instructions for easy reference as some of the fixes may require you to boot in Safe mode. Access to these instructions may not be available in Safe Mode.
• Any fixes provided by myself are for this log file only and should not be used on any other systems.
• Do not run any other removal software or perform updates other than the ones I provide, as it will complicate the cleaning process.
• It's very likely that part of our cleanup will include emptying your recycle bin. If you use your recycle bin as an archive and do not wish this to be emptied, please let me know.
• It is also likely during our cleaning process that your internet browsing history will be removed. Your favorites will be untouched. If you don't want this to happen you need to let me know before running any steps so I can adjust my fixes accordingly.
• You have 4 days to reply to each post or the topic will be closed. You will be able to request that the topic be re-opened by sending me a PM (Personal Message) or PM a moderator.
• Please feel free to ask any questions, especially if you are having problems with my instructions.

- Save ALL Tools to your Desktop-

All tools that I have you download should be placed on the desktop unless otherwise stated. If you are familiar with how to save files to the desktop then you can skip this step.
 
Since you are continuing with this step then I assume you are unfamiliar with saving files to your desktop. As a result it's easiest if you configure your browser(s) to download any tools to the desktop by default. Please use the appropriate instructions below depending on the browser you are using.
Google Chrome - Click the "Customize and control Google Chrome" button in the upper right-corner of the browser. Choose Settings. at the bottom of the screen click the
"Show advanced settings..." link. Scroll down to find the Downloads section and click the Change... button. Select your desktop and click OK.
Mozilla Firefox - Click the "Open Menu" button in the upper right-corner of the browser. Choose Options. In the downloads section, click the Browse button, click on the Desktop folder
and the click the "Select Folder" button. Click OK to get out of the Options menu.
Internet Explorer - Click the Tools menu in the upper right-corner of the browser. Select View downloads. Select the Options link in the lower left of the window. Click Browse and
select the Desktop and then choose the Select Folder button. Click OK to get out of the download options screen and then click Close to get out of the View Downloads screen.
NOTE: IE8 Does not support changing download locations in this manner. You will need to download the tool(s) to the default folder, usually Downloads, then copy them to the desktop.
 

- Finally Before We Start-

 
Removing malware is a complicated multiple step process, Please stay with me until I have declared your system clean. I strongly recommend you backup your personal files and folders. Although rare, attempting to remove malware can render your machine unbootable or cause data loss. Having backups of your data is your responsibility. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.

 

 

I'm reviewing your logs now.

[BrianDrab]

Hi. My name is Brian, and I would be happy to look into your issue.
 

- General Instructions -

• Please read all instructions and fixes thoroughly. Read the ENTIRE post BEFORE performing any steps so you understand all that needs to be done.
• I would advise printing any instructions for easy reference as some of the fixes may require you to boot in Safe mode. Access to these instructions may not be available in Safe Mode.
• Any fixes provided by myself are for this log file only and should not be used on any other systems.
• Do not run any other removal software or perform updates other than the ones I provide, as it will complicate the cleaning process.
• It's very likely that part of our cleanup will include emptying your recycle bin. If you use your recycle bin as an archive and do not wish this to be emptied, please let me know.
• It is also likely during our cleaning process that your internet browsing history will be removed. Your favorites will be untouched. If you don't want this to happen you need to let me know before running any steps so I can adjust my fixes accordingly.
• You have 4 days to reply to each post or the topic will be closed. You will be able to request that the topic be re-opened by sending me a PM (Personal Message) or PM a moderator.
• Please feel free to ask any questions, especially if you are having problems with my instructions.

- Save ALL Tools to your Desktop-

All tools that I have you download should be placed on the desktop unless otherwise stated. If you are familiar with how to save files to the desktop then you can skip this step.
 
Since you are continuing with this step then I assume you are unfamiliar with saving files to your desktop. As a result it's easiest if you configure your browser(s) to download any tools to the desktop by default. Please use the appropriate instructions below depending on the browser you are using.
Google Chrome - Click the "Customize and control Google Chrome" button in the upper right-corner of the browser. Choose Settings. at the bottom of the screen click the
"Show advanced settings..." link. Scroll down to find the Downloads section and click the Change... button. Select your desktop and click OK.
Mozilla Firefox - Click the "Open Menu" button in the upper right-corner of the browser. Choose Options. In the downloads section, click the Browse button, click on the Desktop folder
and the click the "Select Folder" button. Click OK to get out of the Options menu.
Internet Explorer - Click the Tools menu in the upper right-corner of the browser. Select View downloads. Select the Options link in the lower left of the window. Click Browse and
select the Desktop and then choose the Select Folder button. Click OK to get out of the download options screen and then click Close to get out of the View Downloads screen.
NOTE: IE8 Does not support changing download locations in this manner. You will need to download the tool(s) to the default folder, usually Downloads, then copy them to the desktop.
 

- Finally Before We Start-

 
Removing malware is a complicated multiple step process, Please stay with me until I have declared your system clean. I strongly recommend you backup your personal files and folders. Although rare, attempting to remove malware can render your machine unbootable or cause data loss. Having backups of your data is your responsibility. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.

 

 

I'm reviewing your logs now.

[BrianDrab]

After reviewing your logs I don't believe you have a malware issue. I believe you have a known issue which is causing your slowness. It appears you suspected as much as well as I see you downloaded the following update.

 

2016-07-07 02:42 - 2016-07-07 02:42 - 01683754 _____ C:\Users\vv\Downloads\Windows6.1-KB3161664-x64.msu

 

Please follow the instructions in the following link and let me know if this resolves your issue.

http://wu.krelay.de/en/

[cctexun]

brian you are correct I thought I had found the update to correct the issues and it seemed to do so

for a day or two and all the same slowness n such came back  I started on the krelay page by clicking on KB3168965 Win7x64. That opened a box that reads "windows update standalone installer"  it says it is searching for updates on this computer, n the green light has been  sliding across the bar from 6.00am to now 6.25am so I will give it somemore time. It seems to me I have used this installer before and it takes forever is that normal? Alrighty now it is 1'20pm and the standalone installer is still searchin. So i am cancelling it. I will go back to the krelay page and try the download again.

By the way I have hit the cancel button 4 times now and it is still checking for updates so I guess task manager here I come?

Any suggestions will be heeded.

[BrianDrab]

I would perform a clean boot of your machine following the instructions below and then attempt the download and install of the update.

https://support.micr...en-us/kb/929135

[cctexun]

Wow I just love the clean boot start up. I was able to open my browser page in under a minute. Unfortunately I was not able to download the update.

The standalone installer box continues to declare it is "searching for updates on this computer".

So I will try to again to do the clean boot and subsequent install by opening the the krelay page and clicking on KB3168965 Win7x64. Instead of selecting the option to open with standalone installer as offered I downloaded the file. But when clicking on the file in my download folder the wusa opened and started its endless search.

 Round 2, Lets see if it will install  this time.

Ah heck here we go with this "Windows update standalone installer and the dreaded searching for updates on this computer, popup box" it is 6;53 am. Oh well I will give it another hour to complete.

 Okay here we are at 8:52am and it is still searching for updates on this computer even though I thought I had clicked on and am downloading a specific update file KB3168965, why is that?

 

I see in my installed updates list I have KB2881030 for Microsoft Office 2010 32 bit edition. Since my office suite is not 2010 nor is my system 32 bit should I uninstall that update and if yes then what are the instructions to uninstall and update.

 

By the way lest I forget Thank you so much for the invaluable service you and the others give to we the technically challenged. I sincerely appreciate your patience and assistance.

[BrianDrab]

No problem. Let's address one issue at a time. Let's attack this another way. Please make sure that you are still in a "Clean Boot" state. Then do the following.

 

1. Download Update.zip and save it to your desktop.

2. Right-click on Update.zip and select Extract all...

3. Keep the default extract path and ensure that "Show extracted files when complete" is checked. Click the Extract button.

4. Once extracted you will see 6 update files and a script file named InstallPrereqMsu. Right-click on this script file and choose Run as administrator. Answer Yes if the UAC prompt comes up.

5. Allow this script to finish and then reboot your machine.

 

 

Let me know when complete.

[cctexun]

Big fella when you say "allow the script to finish".

 

Were you referring to the black box opening with 6 lines of copy and on the 7th line would be a blinkin _, if so then I waited the correct amount of time, before rebooting. So iffen I have done right I am prepared to proceed to the next step.

 

Pods you are good, I like this surround an conquer idea.

[BrianDrab]

You will know you waited long enough when it says the following at the bottom of the command-prompt window.

 

Press any key to continue . . .

[cctexun]

Okie dokie back to the drawing board time to retrace that last step.

 

Heck that post wasn't up two seconds n you were right on it. Thanks

[cctexun]

BrianD have I told you thank you lately. if not then with a boomingly boisterous voice I bid you "Thank You".

 

Manochevitz this baby got internet access pretty fast this startup. Must still be in clean boot status, Not that I would know what that meant.

 

Aha that there dog is hunting. The "Press any key" came up in a few minutes so here we go, NEXT.
 

[BrianDrab]

No problem at all. Follow the instructions in the following article (same one as previous) to reverse the Clean Boot so you are back to normal. Let me know once this is complete.

https://support.micr...en-us/kb/929135

[cctexun]

Shucks I had forgotten the purpose of this exercise was to  load some updates.

Presto change-o. It is time let the cornpruter restart to complete the updates. Alrighty Trudy went thru the restart and updates were configured.

Got access to internet faster than in some time.

Aww man do I hafta get outta clean boot mode I was getting enamored with that filly.

Okay Off to the reversal.

Brian after the clean boot reversal and restart now I see, on the bar on bottom left, a new symbol "Hotkey Utility"? What is it should I uninstall it?

Edited by cctexun, 18 July 2016 - 02:34 PM.

[BrianDrab]

It's a program that came preloaded from Acer. Yes you can uninstall it. Anything you don't use should be uninstalled given the low amount of physical memory that you have available.

[cctexun]

Brian You are good. Wowee Whoopie Yabba dabba do.

 

The cpu is now spiking to 100 sometimes but not the steady 100 from before. Memory usage is about half of what it was.

 

I am no longer having the lagging and debug script problems that brought me to the edge for the last year. It seems like the updates have cleared my problems. I thought In one of your posts you stated these problems will prolly return about the time of the next update release. Now I cannot find that statement so I guess it was on another site.

 

How can I find the updates I need to download if they do not appear when I go to windows update and search. Is there something I can do to head these problems off at the pass?

 

In my initial post I stated "I have run malwarebytes religiously and in the last year of so it has found absolutely no threats. So today I thought I might have installed it incorrectly and about an hour ago uninstalled it. I have kept Avast updated and scanned and it has found nothing in a long time either." 

 

Shouldn't they have found something, anything. I will download and use malwarebytes antimalware.  I will be using the free edition when cashflow improves I will get the full program. Is there a certain way to load it to help it to do the best job?

 

Can you scan my FRST log again and see if there are other things we need to tend to before we proclaim me healed?

 

I must say I am impressed with the speed with which you got on my original post and each subsequent new post. By the way what magic did you use in that black box to get those updates to load?

 

Thank you kind sir this has been an education.