[Ricky_22]

At first, same 'gateway' signal came up ..... I just followed the instruction to close and reopen browser. functions okay at present.

 

****

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.2.9 (07.04.2015:1)
OS: Windows 7 Home Premium x86
Ran by Owner on Sat 04/07/2015 at 23:30:09.77
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

~~~ Services

Successfully deleted: [Service] swdumon [Reboot required]

 

~~~ Tasks

 

~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\\SearchAssistant

 

~~~ Registry Keys

 

~~~ Files

Successfully deleted: [File] C:\Windows\System32\drivers\swdumon.sys

 

~~~ Folders

Successfully deleted: [Folder] C:\Program Files\xtab
Successfully deleted: [Folder] C:\ProgramData\sparktrust
Successfully deleted: [Folder] C:\ProgramData\tuneup software
Successfully deleted: [Folder] C:\Users\Owner\AppData\Roaming\sparktrust
Successfully deleted: [Folder] C:\Users\Owner\local settings\application data\iac
Successfully deleted: [Folder] C:\Users\Owner\local settings\application data\zbanalyticscore
Successfully deleted: [Folder] C:\Users\Owner\local settings\application data\zeoinsight
Successfully deleted: [Folder] C:\users\public\documents\downloaded installers

 

~~~ Chrome

[C:\Users\Owner\appdata\local\Google\Chrome\User Data\Default\Preferences] - default search provider reset

[C:\Users\Owner\appdata\local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:

[C:\Users\Owner\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset

[C:\Users\Owner\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
[
  amfclgbdpgndipgoegfpkkgobahigbcl
]

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sat 04/07/2015 at 23:31:17.86
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[Advertisements]

# AdwCleaner v4.207 - Logfile created 04/07/2015 at 23:40:42
# Updated 21/06/2015 by Xplode
# Database : 2015-07-02.1 [Server]
# Operating system : Windows 7 Home Premium Service Pack 1 (x86)
# Username : Owner - OWNER-PC
# Running from : C:\Users\Owner\Desktop\AdwCleaner.exe
# Option : Cleaning

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\Program Files\DriverToolkit
Folder Deleted : C:\Users\Owner\AppData\Local\DriverToolkit
File Deleted : C:\Windows\Reimage.ini

***** [ Scheduled tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\TelevisionFanatic.ToolbarProtector
Key Deleted : HKLM\SOFTWARE\Classes\TelevisionFanatic.ToolbarProtector.1
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2FF49ED5-A3EF-410B-918E-97DECEB5996D}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{10ECCE17-29B5-4880-A8F5-EAD298611484}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{2FF49ED5-A3EF-410B-918E-97DECEB5996D}
Key Deleted : HKCU\Software\IM
Key Deleted : HKCU\Software\InstallCore
Key Deleted : HKCU\Software\Reimage
Key Deleted : HKCU\Software\Kromtech
Key Deleted : HKLM\SOFTWARE\Reimage
Key Deleted : HKLM\SOFTWARE\{12A61307-94CD-4F8E-94BC-918E511FAA81}
Key Deleted : HKLM\SOFTWARE\Kromtech
Key Deleted : HKU\.DEFAULT\Software\AVG Secure Search
Key Deleted : HKU\.DEFAULT\Software\AVG Security Toolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}
Data Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - local

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17840

-\\ Google Chrome v43.0.2357.130

[C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://feed.snapdo.com/?publisher=AdKnowledgeYB&dpid=AdKnowledgeYB&co=AU&userid=128fdd60-6c38-f628-e0ea-0ea49c63a322&searchtype=ds&q={searchTerms}&installDate=24/08/2013

*************************

AdwCleaner[R0].txt - [2320 bytes] - [04/07/2015 23:38:47]
AdwCleaner[S0].txt - [2287 bytes] - [04/07/2015 23:40:42]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2346  bytes] ##########

[Ricky_22]

# AdwCleaner v4.207 - Logfile created 04/07/2015 at 23:40:42
# Updated 21/06/2015 by Xplode
# Database : 2015-07-02.1 [Server]
# Operating system : Windows 7 Home Premium Service Pack 1 (x86)
# Username : Owner - OWNER-PC
# Running from : C:\Users\Owner\Desktop\AdwCleaner.exe
# Option : Cleaning

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\Program Files\DriverToolkit
Folder Deleted : C:\Users\Owner\AppData\Local\DriverToolkit
File Deleted : C:\Windows\Reimage.ini

***** [ Scheduled tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\TelevisionFanatic.ToolbarProtector
Key Deleted : HKLM\SOFTWARE\Classes\TelevisionFanatic.ToolbarProtector.1
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2FF49ED5-A3EF-410B-918E-97DECEB5996D}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{10ECCE17-29B5-4880-A8F5-EAD298611484}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{2FF49ED5-A3EF-410B-918E-97DECEB5996D}
Key Deleted : HKCU\Software\IM
Key Deleted : HKCU\Software\InstallCore
Key Deleted : HKCU\Software\Reimage
Key Deleted : HKCU\Software\Kromtech
Key Deleted : HKLM\SOFTWARE\Reimage
Key Deleted : HKLM\SOFTWARE\{12A61307-94CD-4F8E-94BC-918E511FAA81}
Key Deleted : HKLM\SOFTWARE\Kromtech
Key Deleted : HKU\.DEFAULT\Software\AVG Secure Search
Key Deleted : HKU\.DEFAULT\Software\AVG Security Toolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}
Data Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - local

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17840

-\\ Google Chrome v43.0.2357.130

[C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://feed.snapdo.com/?publisher=AdKnowledgeYB&dpid=AdKnowledgeYB&co=AU&userid=128fdd60-6c38-f628-e0ea-0ea49c63a322&searchtype=ds&q={searchTerms}&installDate=24/08/2013

*************************

AdwCleaner[R0].txt - [2320 bytes] - [04/07/2015 23:38:47]
AdwCleaner[S0].txt - [2287 bytes] - [04/07/2015 23:40:42]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2346  bytes] ##########

[Dakeyras]

Hi.

The answer here may be of assistance as this does not appear to be a actual malware related issue. So if able after completing the below do try some of them and let myself know the outcome please.

Anyway lets continue the malware removal process shall we...

Malwarebytes Anti-Malware:

Please download Malwarebytes Anti-Malware to your desktop

• Right-click mbam-setup-version.exe and select Run as Administrator then follow the prompts to install the program.
• At the end, be sure a check-mark is placed next to the following only:

Launch Malwarebytes Anti-Malware

• Then click Finish.
• If an update is found, you will be prompted to download and install the latest version.
• Once the program has loaded, select Scan now. Or select the Threat Scan from the Scan menu.
• When the scan is complete , make sure that everything is set to "Quarantine", and click Apply Actions.
• Reboot your computer if prompted.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

The log is available throughout History > >Application logs. Please post it contents in your next reply.

Scan with Panda Cloud Cleaner:

Please download Panda Cloud Cleaner and save to your desktop.

Alternate downloads are here and here.

• Right-click on PandaCloudCleaner.exe and select Run as Administrator >> Next > >> >> Next >
• Ensure Launch Panda Cloud Cleaner is selected >> Finish >> once the GUI(graphical user interface) appears >> click on Accept and Scan
• Please be patient as the scan may take some time to complete depending on your system's specifications.
• Once the scan has completed, if Scan finished with detections is denoted in the GUI do not take any action and or have Panda Cloud Cleaner clean absolutely anything!
• Now within the GUI click on the > tab >> then on View Report >> a notepad file should now open called PCloudCleaner.txt
• Save this to your desktop and post the contents in your next reply.
• Then click on Back >> Exit

Note: When I give the all clear feel free to uninstall Panda Cloud Cleaner if you so wish.

[Ricky_22]

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 5/07/2015
Scan Time: 10:26 AM
Logfile:
Administrator: Yes

Version: 2.1.8.1057
Malware Database: v2015.06.03.03
Rootkit Database: v2015.07.03.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x86
File System: NTFS
User: Owner

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 343937
Time Elapsed: 10 min, 19 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)

(end)

[Ricky_22]

. FILE: C:\PROGRAM FILES\INCREDIMAIL\BIN\INCMAIL.EXE to be deleted.

. FILE: C:\Users\Public\Desktop\IncrediMail.lnk to be deleted.

. FILE: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IncrediMail\IncrediMail.lnk to be deleted.

. FILE: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IncrediMail.lnk to be deleted.

. FILE: C:\Users\Owner\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\IncrediMail 2.0.lnk to be deleted.

. FILE: C:\Users\Owner\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\IncrediMail.lnk to be deleted.

. TASK: Task\[{0368CC1F-3E0C-49C3-9E79-F6923D8A3D4E}]. Task to be deleted.

. TASK: Task\[{04EB4926-E829-487F-A4A3-F39F51CB7E1E}]. Task to be deleted.

. TASK: Task\[{2962B57C-4766-426A-8887-D12E28116F4B}]. Task to be deleted.

. TASK: Task\[{3BF27CA2-D8CC-48B6-98DC-2B89B8593AEC}]. Task to be deleted.

. TASK: Task\[{ADFFAF74-7253-4F28-A492-3BD29A94D612}]. Task to be deleted.

. TASK: Task\[{C7C592A1-4609-49D9-8CAB-B26A0395DBCE}]. Task to be deleted.

. TASK: Task\[{D5C773BB-EDAA-434D-84F5-BAFDD84D48C6}]. Task to be deleted.

. TASK: Task\[{FB687851-6320-4D70-A607-9ED3EA25F95F}]. Task to be deleted.

. REGKEY: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IncMail.exe. Key to be deleted.

. REGKEY: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IncMailU.exe. Key to be deleted.

. REGKEY: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IncrediMail.exe. Key to be deleted.

. REGKEY: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList[MRUList]. Value: MRUList To be deleted.

. REGKEY: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList[e]. Value: e To be deleted.

. FILE: C:\PROGRAM FILES\INCREDIMAIL\BIN\IMPCNT.EXE to be deleted.

. REGKEY: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ImpCnt.exe. Key to be deleted.

. REGKEY: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ImpCntU.exe. Key to be deleted.

. REGKEY: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ImpContent.exe. Key to be deleted.

. FILE: C:\PROGRAM FILES\INCREDIMAIL\BIN\IMBPP.EXE to be deleted.

. REGKEY: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ImBpp.exe. Key to be deleted.

. FILE: C:\PROGRAM FILES\INCREDIMAIL\BIN\IMLC.EXE to be deleted.

. FILE: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IncrediMail\Letter Creator.lnk to be deleted.

. REGKEY: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ImLc.exe. Key to be deleted.

. REGKEY: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ImLcU.exe. Key to be deleted.

. FILE: C:\PROGRAM FILES\INCREDIMAIL\BIN\IMPACKR.EXE to be deleted.

. REGKEY: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ImPackr.exe. Key to be deleted.

. REGKEY: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\impackrU.exe. Key to be deleted.

. FILE: C:\PROGRAM FILES\INCREDIMAIL\BIN\IMLPP.EXE to be deleted.

. REGKEY: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ImLpp.exe. Key to be deleted.

. FILE: C:\PROGRAM FILES\INCREDIMAIL\BIN\IMSETUP.EXE to be deleted.

. FILE: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IncrediMail\Uninstall IncrediMail.lnk to be deleted.

. REGKEY: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\ImSetup.exe. Key to be deleted.

. REGKEY: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IncrediMail. Key to be deleted.

Malware. REGKEY: HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM[DISABLEREGISTRYTOOLS]. Value: DISABLEREGISTRYTOOLS To be deleted.

Malware. REGKEY: HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM[DISABLETASKMGR]. Value: DISABLETASKMGR To be deleted.

Suspicious Policy. POLICY: HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED[HIDEFILEEXT] to be changed to: 0

[Ricky_22]

Presently very sluggish performance and slow getting to webpages - often receiving the 'Gateway' notification, but as you say, that is probably my server - as my telephone line has been giving some problems this past week - they're supposedly fixing it, and have given me "an interim phone" until it's fixed lolz ....  just so you know  Hope you had a great holiday w/e.

 

 

.

P.S.

They have actually fixed my telephone line - this morning 'yippeeee' such a difference.

Edited by Ricky_22, 05 July 2015 - 08:49 PM.

[ruggie_uk]

Hi there, Dakeyras is currently unavailable so I am here to continue with your case.

 

So is everything running well right now?

 

If so we can proceed to clean up, if not we can look at further options.

[Ricky_22]

Hi ruggie_uk - everything is well right now, and ready to proceed with clean up, thanks ...

[ruggie_uk]

OK here we go.

Good news, it looks like your system is now clean. A good workman cleans up after himself so let's now attend to that

Tool Removal

We need to remove the tools we've used during cleaning your machine

• Download Delfix from here
• Ensure Remove disinfection tools is ticked
  Also tick:
  • Activate UAC
  • Create registry backup
  • Purge system restore
  • Reset System Settings
• Click Run
• The program will run for a few moments and then notepad will open with a log. Please paste the log in your next reply
  
  We need to uninstall a program
  Open Programs and Features by clicking the Start button, clicking Control Panel, clicking Programs, and then clicking Programs and Features.
  Select the following programs from the list below, one at a time and click Uninstall.Delete the following Files and Folders (If Present):
  C:\Program Files (x86)\ESET
  Delete any other .bat, .log, .reg, .txt, and any other files created during this process, and left on the desktop and empty the Recycle Bin.
  
  
  
  Keep your machine updated
  
  Due to the ever-present tide of malware, it is important to ensure your computer is kept up-to-date to minimize the risk of future infection. An important step is to ensure that automatic updates are enabled.
  
  
  To enable automatic updates:
  
  Windows 7
  To turn on Automatic Updates yourself, follow these steps:It is recommended to install an anti-malware to help prevent reinfection.
  Below are some free ones that can help keep you clean.
  
  Malwarebytes AntiMalware
  
  As you have installed Malwarebytes, I recommend that you keep this program and use it to help you stay clean.
  
  The free version will scan your computer and fix the problems it finds but will not provide real-time protection. You must scan regularly to find any threats.
  Consider purchasing the full version for active monitoring of threats.
  
  JAVA Advice
  WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java
  See this article and this article.
  I would recommend that you completely uninstall Java unless you need it to run an important software or need it to play games on-line.
  In that instance I would recommend that you only use Firefox or Chrome to visit those sites and do the following:If you still want to update your Java, follow the instructions below:
  
  A.
  Your version of Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older versions of Java components and update:B.
  Uninstall all versions of JavaC.
  Install the latest JAVA
  
  Back on your desktop:[Note:] The Java Quick Starter (JQS.exe) adds a service to improve the initial start up time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > You will have to be in Classic View to see Java(It looks like a coffee cup). Double-click on Java click the Advanced Tab click Miscellaneous and uncheck the box for Java Quick Starter. Click OK and reboot your computer.
  
  
  Update Adobe Flash Player
  
  NOTE: Depending on your settings, you may have to temporarily disable your antivirus software and firewall.Cryptolocker Warning
  Go here for information about CryptoLocker Ransomeware.
  The main thing with this infection is ~ Backup.
  If you're using an external hard drive, keep it unplugged from the computer when you're not backing up files or using it. This will prevent the infection from getting to your backed up files if you ever do come across it.
  
  Recommended Programs
  Unchecky is a small service that runs in the background to help keep those "extra toolbars" and tag along search engines from automatically installing. By automatically directing you to a custom install with all the options unchecked, only what you manually choose and confirm gets installed.
  • ESET Online Scanner
  • Click Start, type Windows update in the search box, and then click Windows Update in the Programs list.
  • In the left pane, click Change settings.
  • Select the option that you want.
  • Under Recommended updates, select the Give me recommended updates the same way I receive important updates or Include recommended updates when downloading, installing, or notifying me about updates check box, and then click OK.
  • For Firefox, install the NoScript add-on.
  • For Chrome, install the ScriptSafe add-on.
    -->IMPORTANT<--: After installing the add-ons you will need to tell them that the site you are visiting is allowed to run Javascript. If you don't, the sites won't work properly. Or not at all. You can go to the NoScript home page here to learn how to use the add-on.
  • Disable Java in your browsers until you need it for that software and then enable it. (See How to disable Java in your web browser or How to unplug Java from the browser)
  • Download the latest version of the Java Runtime Environment (JRE) Version from Here and save it to your desktop.
  • Look for "Java Platform, Standard Edition". You will see the current Java version and update number under listed under the heading. Example: The newest update is Java SE 8u25
  • Click the "Download button under "JRE".
  • On the Java SE Runtime Environment page, click the button to "Accept License Agreement".
  • Under the Java SE Runtime Environment 8u25 heading:
    To install the version for your system:
    • For Windows 64bit systems, look for Windows x64 - 88.37MB, click the jre-8u25-windows-64.exe file and save it to your desktop. Do Not run it from the Java site.
  • Close any programs you may have running - especially your web browser.
  • Click Start > Control Panel > Add/Remove Programs. The list of installed programs will populate.
  • Click the Start Orb, then Control Panel. Under the Programs or Programs and Features section click Uninstall a program. The list of installed programs will populate.
  • Remove all older versions of Java. These may call themselves: Java Runtime, Runtime Environment, Runtime, JRE, Java Virtual Machine, Virtual Machine, Java VM, JVM, VM, J2RE or J2SE
    The versions I see on the computer are:
    • Java 7 Update
    • Java 8 (64-bit)
    • Java SE Development Kit 8
  • Right click each program and click Uninstall and follow the on screen instructions for the Java uninstaller.
  • Repeat as many times as necessary to remove each Java version.
  • Reboot your computer once all Java components are removed.
  • Right click the  jre-8u25-windows-x64.exe file, click Run as Administrator and OK the UAC prompt to install the newest version.
  • When the Java Setup - Welcome window opens, click the Install > button.
  • If offered to install a Toolbar, just uncheck the box before continuing unless you want it.
  • Please click here to go to the FlashPlayer Installation page.
  • In the first column, Adobe Flash Player, make sure the system version (64bit) and the browser are correct.
    • Note: If you use IE and other browsers you will need to install both Flash Player for IE and Flash Player for Other Browsers.
  • In the middle column, Optional offer:, UNCHECK the box next to Yes, install free McAfee Security Scan Plus
  • Click the Install now button. A download window for the install_flashplayer15x64_mssd_aaa_aih.exe file will open. Save it to the desktop.
  • Close the browser and all open windows.
  • Back on the desktop, right click the install_flashplayer15x64_mssd_aaa_aih.exe file and click Run as Administrator to install Flash Player.

Cryptoprevent is a free program that prevents CryptoLocker / ransomware from infecting your PC by locking down the OS so the malware can not get a grip on your system.

Web Of Trust is a browser add-on designed to alert the user before interacting with a potentially malicious website. It will highlight green if a site is known to be safe.

Adblock is a firefox browser add-on that blocks annoying banners, pop-ups and video ads.

General Advice

• When browsing the internet, look closely at the links you click on. Some aren't always what they seem
• Avoid Peer to Peer file sharing utilities, these are a minefield of malware infections.
• Don't open email attachments unless you are expecting them. Even an email from your best friend can be infected, they might not have sent it.
• Pay attention when installing a program to your computer, particularly to any check boxes that may appear during installation, it is common for unwanted software to be installed in this way.

[Ricky_22]

FYI On start up, I proceeded to d/l delfix, as I started to tick the boxes, my system froze - I had to restart -

Delfix results:

# DelFix v1.010 - Logfile created 07/07/2015 at 14:30:42
# Updated 26/04/2015 by Xplode
# Username : Owner - OWNER-PC
# Operating System : Windows 7 Home Premium Service Pack 1 (32 bits)

~ Activating UAC ... OK

~ Removing disinfection tools ...

Deleted : C:\FRST
Deleted : C:\AdwCleaner
Deleted : C:\RegBackup
Deleted : C:\Users\Owner\Desktop\Addition.txt
Deleted : C:\Users\Owner\Desktop\AdwCleaner.exe
Deleted : C:\Users\Owner\Desktop\aswmbr.exe
Deleted : C:\Users\Owner\Desktop\aswMBR.txt
Deleted : C:\Users\Owner\Desktop\Fixlog.txt
Deleted : C:\Users\Owner\Desktop\FRST.exe
Deleted : C:\Users\Owner\Desktop\FRST.txt
Deleted : C:\Users\Owner\Desktop\JRT.exe
Deleted : C:\Users\Owner\Desktop\JRT.txt
Deleted : C:\Users\Owner\Desktop\MBR.dat
Deleted : HKLM\SOFTWARE\AdwCleaner
Deleted : HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ASWMBR

~ Creating registry backup ... OK

~ Cleaning system restore ...

Deleted : RP #624 [Windows Update | 06/13/2015 22:50:48]
Deleted : RP #625 [Windows Update | 06/17/2015 04:35:14]
Deleted : RP #627 [Revo Uninstaller Pro's restore point - Auslogics BoostSpeed 8 | 06/18/2015 19:20:39]
Deleted : RP #629 [Revo Uninstaller Pro's restore point - Auslogics Anti-Malware | 06/18/2015 19:25:38]
Deleted : RP #630 [Restore Operation | 06/19/2015 05:49:04]
Deleted : RP #631 [Windows Update | 06/19/2015 06:28:39]
Deleted : RP #632 [Windows Update | 06/19/2015 07:19:02]
Deleted : RP #634 [Revo Uninstaller Pro's restore point - Auslogics BoostSpeed 7 | 06/21/2015 06:31:04]
Deleted : RP #636 [Revo Uninstaller Pro's restore point - Auslogics DiskDefrag | 06/21/2015 06:37:29]
Deleted : RP #637 [Windows Update | 06/23/2015 01:51:10]
Deleted : RP #639 [Revo Uninstaller Pro's restore point - Auslogics Anti-Malware | 06/24/2015 23:00:20]
Deleted : RP #641 [Revo Uninstaller Pro's restore point - Auslogics BoostSpeed 7 | 06/24/2015 23:04:38]
Deleted : RP #643 [Revo Uninstaller Pro's restore point - BitComet 1.38 | 06/24/2015 23:08:54]
Deleted : RP #645 [Revo Uninstaller Pro's restore point - Malwarebytes Anti-Malware version 2.1.4.1018 | 06/24/2015 23:11:05]
Deleted : RP #647 [Revo Uninstaller Pro's restore point - Auslogics BoostSpeed 7 | 06/25/2015 02:47:14]
Deleted : RP #649 [Revo Uninstaller Pro's restore point - Auslogics DiskDefrag | 06/25/2015 02:49:51]
Deleted : RP #650 [Restore Operation | 06/25/2015 07:12:51]
Deleted : RP #652 [Revo Uninstaller Pro's restore point - My Online Toolkit | 06/25/2015 09:27:17]
Deleted : RP #654 [Revo Uninstaller Pro's restore point - MpcStar 5.3 | 06/25/2015 09:30:08]
Deleted : RP #655 [Installed DriverUpdate | 06/25/2015 09:34:03]
Deleted : RP #657 [Revo Uninstaller Pro's restore point - Windows Driver Package - 2Wire (2WIREPCP) Net  (03/22/2007 2.0) | 06/25/2015 09:36:44]
Deleted : RP #659 [Revo Uninstaller Pro's restore point - Auslogics BoostSpeed 7 | 06/25/2015 09:38:48]
Deleted : RP #661 [Revo Uninstaller Pro's restore point - Auslogics DiskDefrag | 06/25/2015 09:41:09]
Deleted : RP #663 [Revo Uninstaller Pro's restore point - DriverUpdate | 06/25/2015 09:42:37]
Deleted : RP #664 [Removed DriverUpdate | 06/25/2015 09:42:59]
Deleted : RP #666 [Revo Uninstaller Pro's restore point - Malwarebytes Anti-Malware version 2.1.4.1018 | 06/25/2015 09:44:59]
Deleted : RP #668 [Revo Uninstaller Pro's restore point - Realtek 8169, 8168, 8101E and 8102E Ethernet Network Card Driver for Windows Vista | 06/25/2015 09:46:26]
Deleted : RP #669 [Windows Update | 06/25/2015 09:57:25]
Deleted : RP #670 [Windows Update | 06/25/2015 15:49:08]
Deleted : RP #671 [Windows Update | 06/29/2015 04:44:56]
Deleted : RP #673 [Revo Uninstaller Pro's restore point - BitComet 1.38 | 06/30/2015 21:21:55]
Deleted : RP #675 [avast! antivirus system restore point | 07/02/2015 01:34:00]
Deleted : RP #677 [Revo Uninstaller Pro's restore point - Avast Free Antivirus | 07/02/2015 03:22:14]
Deleted : RP #679 [Revo Uninstaller Pro's restore point - Avast Free Antivirus | 07/02/2015 03:26:29]
Deleted : RP #681 [avast! antivirus system restore point | 07/02/2015 03:27:28]
Deleted : RP #682 [Restore Operation | 07/02/2015 06:09:22]
Deleted : RP #683 [Windows Update | 07/02/2015 06:26:52]
Deleted : RP #685 [Revo Uninstaller Pro's restore point - YTD Video Downloader 4.9 | 07/02/2015 15:47:22]
Deleted : RP #687 [Restore Point Created by FRST | 07/02/2015 22:03:56]
Deleted : RP #688 [GTG Backup | 07/04/2015 00:18:39]
Deleted : RP #689 [Windows Update | 07/05/2015 11:56:13]

New restore point created !

~ Resetting system settings ... OK

########## - EOF - ##########

 

 

*

Could find no such file as 'C:\Program Files (x86)\ESET'

all other bats, txts etc deleted from desktop and waste basket emptied!

 

How do I uninstall Java? I cannot find it  though I know I had it, it's possible I may have already uninstalled it . -

 

Your other instructions I find confusing, I can't follow them, cause I really don't understand them or figure which is what - sorry

Edited by Ricky_22, 07 July 2015 - 01:18 AM.

[ruggie_uk]

Hi, don't worry about them. It is a standard speech I use for cleaning up and as I have joined late to the party - different tools have been used so it won't match up exactly.

 

See how you get on for a day or two, see if the freezing was an isolated incident and if you have any further issues, post back in this thread - I will leave it open for a couple of days to see how you go.

[Ricky_22]

Hi, don't worry about them. It is a standard speech I use for cleaning up and as I have joined late to the party - different tools have been used so it won't match up exactly.

 

See how you get on for a day or two, see if the freezing was an isolated incident and if you have any further issues, post back in this thread - I will leave it open for a couple of days to see how you go.

 

i just started up my computer and was reading a news article, when it froze ... then screened black, but did not crash immediately, it tried 3 times to bring the browser back and failed each time ... after a while i again restarted .....

 

I fear that the freezing is still there, and apparently the black screen

Edited by Ricky_22, 07 July 2015 - 03:10 AM.

[ruggie_uk]

Ok, firstly let's take a fresh FRST look. After that we can look at some hardware testing.
 
FRST Scan

Please download Farbar Recovery Scan Tool and save it to your Desktop. There will be 2 versions offered, if you know which version is the one you need, download that one, if not, download both, only one will work on your computer, that is the one you need.

• Right click to run as administrator. When the tool opens click Yes to the disclaimer.
• Ensure that the following are ticked as in the image below
  Addition.txt
  
• Press Scan button.
• It will produce a log called FRST.txt in the same directory the tool is run from.
• Please copy and paste log back here.
• This will also generate another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

[Ricky_22]

After d/l Farbar my computer blackscreened and crashed - I restarted - whilst typing this my comp froze, and I had to restart again, and it takes such a long time for the comp to load and then start windows anyhow, 3rd time lucky lolz

 

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 05-07-2015
Ran by Owner (administrator) on OWNER-PC on 07-07-2015 19:59:02
Running from C:\Users\Owner\Desktop
Loaded Profiles: Owner (Available Profiles: Owner)
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Alcatel-Lucent) C:\Program Files\Common Files\Motive\pcCMService.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(Alcatel-Lucent) C:\Program Files\Telstra Broadband Assistant\1.0.2.45\ma\bin\MAHostService.exe
(RaMMicHaeL) C:\Program Files\Unchecky\bin\unchecky_svc.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(RaMMicHaeL) C:\Program Files\Unchecky\bin\unchecky_bg.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(Joyent, Inc) C:\Program Files\Telstra Broadband Assistant\1.0.2.45\ma\bin\node.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Telstra Corporation Ltd.) C:\Program Files\Telstra Broadband Assistant\1.0.2.45\ma\bin\pcTrayApp.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Siber Systems) C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [4915200 2008-02-13] (Realtek Semiconductor)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [981688 2015-04-30] (Microsoft Corporation)
HKLM\...\Run: [Telstra_McciTrayApp] => C:\Program Files\Telstra Broadband Assistant\1.0.2.45\ma\bin\pcTrayApp.exe [2013696 2014-09-11] (Telstra Corporation Ltd.)
HKU\S-1-5-21-754179056-1382982999-2036298953-1000\...\Run: [RoboForm] => C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe [110160 2015-06-26] (Siber Systems)
BootExecute: dfboottime \??\C:\Windows\System32\dfboottime.cfgautocheck autochk *

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-754179056-1382982999-2036298953-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com.au/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-754179056-1382982999-2036298953-1000 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = http://www.google.co...?q={searchTerms}
SearchScopes: HKU\S-1-5-21-754179056-1382982999-2036298953-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = https://www.google.c...?q={searchTerms}
SearchScopes: HKU\S-1-5-21-754179056-1382982999-2036298953-1000 -> {A10DB92A-868F-465D-A02D-318698A6C189} URL = https://www.google.c...?q={searchTerms}
SearchScopes: HKU\S-1-5-21-754179056-1382982999-2036298953-1000 -> {B157E6A5-6063-4608-85AB-AA683985F058} URL = https://www.google.c...?q={searchTerms}
BHO: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll [2013-11-28] (CANON INC.)
BHO: RoboForm Toolbar Helper -> {724d43a9-0d85-11d4-9908-00400523e39a} -> C:\Program Files\Siber Systems\AI RoboForm\roboform.dll [2015-06-26] (Siber Systems Inc.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
Toolbar: HKLM - &RoboForm Toolbar - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll [2015-06-26] (Siber Systems Inc.)
Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll [2013-11-28] (CANON INC.)
Toolbar: HKU\S-1-5-21-754179056-1382982999-2036298953-1000 -> &RoboForm Toolbar - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll [2015-06-26] (Siber Systems Inc.)
Toolbar: HKU\S-1-5-21-754179056-1382982999-2036298953-1000 -> Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll [2013-11-28] (CANON INC.)
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset...lineScanner.cab
Hosts: There are more than one entry in Hosts. See Hosts section of  Addition.txt
Tcpip\Parameters: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{246842DE-797F-4BF9-9856-10622A84D292}: [DhcpNameServer] 10.0.0.138
Tcpip\..\Interfaces\{AF11A9A5-305F-4BAA-B81A-A5817B67F463}: [DhcpNameServer] 10.0.0.138

FireFox:
========
FF Plugin: @canon.com/EPPEX -> C:\Program Files\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll [2011-11-30] (CANON INC.)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: @Motive.com/NpMotive,version=1.0 -> C:\Program Files\Telstra Broadband Assistant\1.0.2.45\ma\bin\npMotive.dll [2014-09-11] (Telstra Corporation Ltd.)
FF Plugin: @Motive.com/npMotiveRequest,version=1.0 -> C:\Program Files\Common Files\Motive\npMotiveRequest.dll [2014-09-11] (Telstra Corporation Ltd.)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-31] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-31] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.8 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2010-02-01]

Chrome:
=======
CHR Profile: C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-05-11]
CHR Extension: (Google Docs) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-05-11]
CHR Extension: (Google Drive) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-05-11]
CHR Extension: (YouTube) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-05-11]
CHR Extension: (Google Search) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-05-11]
CHR Extension: (Google Sheets) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-05-11]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-05-12]
CHR Extension: (Google Wallet) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-05-11]
CHR Extension: (Gmail) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-05-11]
CHR Extension: (RoboForm Password Manager) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pnlccmojcmeohlpggmfnbbiapkmbliob [2015-05-11]
CHR HKLM\...\Chrome\Extension: [edmgmpmklgfbohogafcfobonnkogchec] - C:\Program Files\Common Files\Motive\extensions\MotiveRequest.crx [2015-07-05]
CHR HKLM\...\Chrome\Extension: [pnlccmojcmeohlpggmfnbbiapkmbliob] - C:\Program Files\Siber Systems\AI RoboForm\Chrome\rf-chrome.crx [2014-03-15]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22216 2015-04-30] (Microsoft Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44544 2008-12-03] (Hewlett-Packard) [File not signed]
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [284504 2015-04-30] (Microsoft Corporation)
R2 pcCMService; C:\Program Files\Common Files\Motive\pcCMService.exe [369152 2013-10-23] (Alcatel-Lucent) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2008-12-03] (Hewlett-Packard) [File not signed]
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2007-05-14] ()
R2 Telstra MAHostService; C:\Program Files\Telstra Broadband Assistant\1.0.2.45\ma\bin\MAHostService.exe [321024 2014-09-11] (Alcatel-Lucent) [File not signed]
R2 Unchecky; C:\Program Files\Unchecky\bin\Unchecky_svc.exe [164600 2015-07-07] (RaMMicHaeL)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 2WIREPCP; C:\Windows\System32\DRIVERS\2WirePCP.sys [60768 2007-03-23] (2Wire, Inc.) [File not signed]
R3 anvsnddrv; C:\Windows\System32\drivers\anvsnddrv.sys [32896 2011-11-28] (AnvSoft Inc.) [File not signed]
R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [26984 2012-11-05] (AVG Technologies)
S3 gdrv; C:\Windows\gdrv.sys [16608 2010-02-01] (Windows ® 2000 DDK provider)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-06-18] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-06-18] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [245096 2015-03-04] (Microsoft Corporation)
S3 MREMP50; C:\Program Files\Common Files\Motive\MREMP50.sys [21248 2010-02-03] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
S3 MRESP50; C:\Program Files\Common Files\Motive\MRESP50.sys [20096 2010-02-03] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
S0 sptd; C:\Windows\System32\Drivers\sptd.sys [717296 2010-02-03] (Duplex Secure Ltd.)
S3 U2800Vid; C:\Windows\System32\DRIVERS⠀Vid.sys [347904 2009-08-19] (Compro Technology, Inc.)
S3 cpuz134; \??\C:\Users\Owner\AppData\Local\Temp\cpuz134\cpuz134_x32.sys [X]
S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [X]
S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-07 19:59 - 2015-07-07 19:59 - 00013370 _____ C:\Users\Owner\Desktop\FRST.txt
2015-07-07 19:57 - 2015-07-07 19:57 - 00000252 _____ C:\Users\Owner\Documents\FRSK.txtFRSK
2015-07-07 19:45 - 2015-07-07 19:59 - 00000000 ____D C:\FRST
2015-07-07 19:44 - 2015-07-07 19:44 - 01636352 _____ (Farbar) C:\Users\Owner\Desktop\FRST.exe
2015-07-07 15:08 - 2015-07-07 15:08 - 00000949 _____ C:\Users\Public\Desktop\Unchecky.lnk
2015-07-07 15:08 - 2015-07-07 15:08 - 00000000 ____D C:\ProgramData\Unchecky
2015-07-07 15:08 - 2015-07-07 15:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Unchecky
2015-07-07 15:08 - 2015-07-07 15:08 - 00000000 ____D C:\Program Files\Unchecky
2015-07-06 15:14 - 2015-07-06 15:14 - 00141348 ____N C:\Windows\Minidump\070615-31637-01.dmp
2015-07-06 03:19 - 2015-07-06 03:22 - 00000484 _____ C:\Users\Owner\Documents\HARRY.txt
2015-07-05 20:35 - 2015-07-05 20:35 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Motive
2015-07-05 20:34 - 2015-07-05 20:34 - 00002733 _____ C:\Users\Public\Desktop\Telstra Broadband Assistant.lnk
2015-07-05 20:34 - 2015-07-05 20:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Telstra
2015-07-05 20:10 - 2015-07-05 20:34 - 00000000 ____D C:\ProgramData\Motive
2015-07-05 20:10 - 2015-07-05 20:15 - 00000000 ____D C:\Program Files\Common Files\Motive
2015-07-05 19:18 - 2015-07-07 19:53 - 00652666 _____ C:\Windows\setupact.log
2015-07-05 19:18 - 2015-07-05 19:18 - 00000000 _____ C:\Windows\setuperr.log
2015-07-05 19:16 - 2015-07-05 19:16 - 00000083 _____ C:\Users\Owner\Documents\telstra.txt
2015-07-05 10:58 - 2015-07-05 10:58 - 00001220 _____ C:\Users\Public\Desktop\Panda Cloud Cleaner.lnk
2015-07-05 10:58 - 2015-07-05 10:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2015-07-05 10:44 - 2015-07-05 10:57 - 33065512 _____ (Panda Security ) C:\Users\Owner\Desktop\PandaCloudCleaner.exe
2015-07-05 10:38 - 2015-07-05 10:38 - 00001059 _____ C:\MBAM july2.txt
2015-07-05 10:24 - 2015-07-05 10:24 - 00001058 _____ C:\MBAM july.txt
2015-07-05 09:58 - 2015-07-05 09:58 - 00001036 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-07-05 09:58 - 2015-07-05 09:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-07-04 23:30 - 2015-07-04 23:30 - 00000207 _____ C:\Windows\tweaking.com-regbackup-OWNER-PC-Windows-7-Home-Premium-(32-bit).dat
2015-07-03 06:34 - 2015-07-03 06:34 - 00000439 _____ C:\Windows\system32\gateway.txt
2015-07-02 20:15 - 2015-07-02 23:43 - 00000000 ____D C:\Users\Owner\AppData\Roaming\BitComet
2015-07-02 11:57 - 2015-07-05 09:58 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware
2015-07-02 09:47 - 2015-07-02 09:47 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Google
2015-06-30 19:23 - 2015-07-03 05:37 - 00000000 ____D C:\Program Files\BitComet
2015-06-28 15:18 - 2015-06-28 15:18 - 65485636 _____ C:\Users\Owner\Documents\Pianist and singer Isaac melts the Judges' hearts _ Britain's Got Talent 2015.mp4
2015-06-28 15:16 - 2015-06-28 15:16 - 48641146 _____ C:\Users\Owner\Documents\Musician Isaac Waddington can't make you love him _ Semi-Final 4 _ Britain's Got Talent 2015.mp4
2015-06-28 15:09 - 2015-06-28 15:09 - 55459990 _____ C:\Users\Owner\Documents\Britain's Got Talent 2015 S09E03 Isaac Waddington Sings Heartfelt Rendition of She's Always A Woman.mp4
2015-06-27 03:42 - 2015-06-27 03:42 - 00000119 _____ C:\Users\Owner\Documents\email adds.txt
2015-06-26 20:47 - 2015-06-26 20:47 - 00000543 _____ C:\Users\Owner\Documents\my gov user name.txt
2015-06-26 13:09 - 2015-06-26 13:09 - 00000286 _____ C:\Users\Owner\Documents\cc_20150626_130859.reg
2015-06-26 09:24 - 2015-06-26 09:24 - 00011782 _____ C:\Users\Owner\Documents\cc_z20150626_092343.reg
2015-06-25 18:20 - 2015-06-03 03:35 - 00342728 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-06-25 18:20 - 2015-05-26 01:00 - 02384384 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-06-25 18:20 - 2015-05-23 11:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-06-25 18:20 - 2015-05-23 11:15 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-06-25 18:20 - 2015-05-23 11:15 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-06-25 18:20 - 2015-05-23 11:09 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-06-25 18:20 - 2015-05-23 11:08 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-06-25 18:20 - 2015-05-23 11:05 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-06-25 18:20 - 2015-05-23 11:05 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-06-25 18:20 - 2015-05-23 11:04 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-06-25 18:20 - 2015-05-23 11:00 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-06-25 18:20 - 2015-05-23 10:57 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-06-25 18:20 - 2015-05-23 10:52 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-06-25 18:20 - 2015-05-23 10:38 - 00689152 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-06-25 18:20 - 2015-05-23 10:38 - 00685568 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-06-25 18:20 - 2015-05-23 10:16 - 01309696 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-06-25 18:20 - 2015-05-23 10:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-06-25 18:20 - 2015-05-23 02:03 - 00571392 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-06-25 18:20 - 2015-05-23 02:02 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-06-25 18:20 - 2015-05-23 02:02 - 00621568 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-06-25 18:20 - 2015-05-23 02:02 - 00333824 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-06-25 18:20 - 2015-05-23 02:02 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-06-25 18:20 - 2015-05-23 02:02 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-06-25 18:20 - 2015-05-23 01:58 - 00901120 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-06-25 18:20 - 2015-05-21 21:20 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-06-25 18:19 - 2015-05-27 22:08 - 19607040 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-06-25 18:19 - 2015-05-23 11:28 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-06-25 18:19 - 2015-05-23 11:15 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-06-25 18:19 - 2015-05-23 11:14 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-06-25 18:19 - 2015-05-23 11:13 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-06-25 18:19 - 2015-05-23 11:10 - 02278912 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-06-25 18:19 - 2015-05-23 11:06 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-06-25 18:19 - 2015-05-23 11:05 - 00664064 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-06-25 18:19 - 2015-05-23 10:49 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-06-25 18:19 - 2015-05-23 10:48 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-06-25 18:19 - 2015-05-23 10:47 - 04305920 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-06-25 18:19 - 2015-05-23 10:47 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-06-25 18:19 - 2015-05-23 10:37 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-06-25 18:19 - 2015-05-23 10:37 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-06-25 18:19 - 2015-05-23 10:28 - 12829696 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-06-25 18:19 - 2015-05-23 10:20 - 01950720 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-06-25 18:17 - 2015-05-26 02:07 - 03989440 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-06-25 18:17 - 2015-05-26 02:07 - 03934144 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-06-25 18:17 - 2015-05-26 02:07 - 00137664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-06-25 18:17 - 2015-05-26 02:07 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-06-25 18:17 - 2015-05-26 02:04 - 01307648 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-06-25 18:17 - 2015-05-26 02:01 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-06-25 18:17 - 2015-05-26 02:01 - 00853504 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-06-25 18:17 - 2015-05-26 02:01 - 00641536 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-06-25 18:17 - 2015-05-26 02:01 - 00635392 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-06-25 18:17 - 2015-05-26 02:01 - 00551424 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-06-25 18:17 - 2015-05-26 02:01 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-06-25 18:17 - 2015-05-26 02:01 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-06-25 18:17 - 2015-05-26 02:01 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-06-25 18:17 - 2015-05-26 02:01 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-06-25 18:17 - 2015-05-26 02:01 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-06-25 18:17 - 2015-05-26 02:01 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-06-25 18:17 - 2015-05-26 02:01 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-06-25 18:17 - 2015-05-26 02:01 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-06-25 18:17 - 2015-05-26 02:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-06-25 18:17 - 2015-05-26 02:01 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-06-25 18:17 - 2015-05-26 02:01 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-06-25 18:17 - 2015-05-26 02:01 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-06-25 18:17 - 2015-05-26 02:01 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-06-25 18:17 - 2015-05-26 02:00 - 00364544 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-06-25 18:17 - 2015-05-26 02:00 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-06-25 18:17 - 2015-05-26 02:00 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-06-25 18:17 - 2015-05-26 02:00 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-06-25 18:17 - 2015-05-26 02:00 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-06-25 18:17 - 2015-05-26 02:00 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-06-25 18:17 - 2015-05-26 02:00 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-06-25 18:17 - 2015-05-26 02:00 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-06-25 18:17 - 2015-05-26 02:00 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-06-25 18:17 - 2015-05-26 01:57 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-06-25 18:17 - 2015-05-26 01:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-06-25 18:17 - 2015-05-26 01:55 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-06-25 18:17 - 2015-05-26 01:55 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-06-25 18:17 - 2015-05-26 00:53 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-06-25 18:12 - 2015-05-09 11:14 - 00169984 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-06-25 18:12 - 2015-05-09 11:13 - 00868352 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-06-25 18:12 - 2015-05-09 11:13 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-06-25 18:12 - 2015-05-09 11:12 - 00271360 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-06-25 18:12 - 2015-05-09 11:08 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-25 18:12 - 2015-05-09 11:08 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-25 18:12 - 2015-05-09 11:08 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-06-25 18:12 - 2015-05-09 11:08 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-06-25 18:12 - 2015-05-09 11:08 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-25 18:12 - 2015-05-09 11:08 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-25 18:12 - 2015-05-09 11:08 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-25 18:12 - 2015-05-09 11:08 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-06-25 18:12 - 2015-05-09 11:08 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-25 18:12 - 2015-05-09 11:08 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-25 18:12 - 2015-05-09 11:08 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-06-25 18:12 - 2015-05-09 11:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-06-25 18:12 - 2015-05-09 11:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-25 18:12 - 2015-05-09 11:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-06-25 18:12 - 2015-05-09 11:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-06-25 18:12 - 2015-05-09 11:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-06-25 18:12 - 2015-05-09 11:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-06-25 18:12 - 2015-04-30 02:07 - 11411456 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-06-25 18:12 - 2015-04-30 02:07 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-06-25 18:12 - 2015-04-30 02:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-06-25 18:12 - 2015-04-30 02:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-06-25 18:12 - 2015-04-30 02:05 - 12625408 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-06-25 18:11 - 2015-05-09 11:08 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-06-25 18:11 - 2015-05-09 11:08 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-06-25 18:11 - 2015-05-09 11:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-06-25 18:11 - 2015-05-09 11:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-25 18:11 - 2015-05-09 11:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-06-25 18:11 - 2015-05-09 11:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-06-25 18:11 - 2015-05-09 11:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-06-25 18:11 - 2015-05-09 09:59 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-06-25 18:11 - 2015-05-09 09:59 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-25 18:11 - 2015-05-09 09:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-06-25 18:11 - 2015-05-09 09:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-06-25 18:11 - 2015-04-25 01:56 - 00530432 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2015-06-20 05:53 - 2015-06-20 05:53 - 00002732 _____ C:\Users\Owner\Documents\collabro.txt
2015-06-19 14:39 - 2015-06-19 14:39 - 00000000 ____D C:\eb3fe3f8d4cd1ec3b5e698b3
2015-06-17 07:02 - 2015-06-17 07:02 - 00000468 _____ C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Google.website
2015-06-15 22:48 - 2015-06-26 20:45 - 00000187 _____ C:\Users\Owner\Documents\Incredimail licence.txt
2015-06-14 06:45 - 2015-06-14 06:45 - 36382247 _____ C:\Users\Owner\Documents\One direction - No control (Music video).mp4
2015-06-13 20:51 - 2015-06-13 20:51 - 00004032 _____ C:\Users\Owner\Documents\stere kicks.txt
2015-06-13 03:24 - 2015-06-19 14:01 - 00000000 ____D C:\Windows\MATS
2015-06-13 03:24 - 2015-06-19 14:01 - 00000000 ____D C:\Program Files\Microsoft Fix it Center
2015-06-12 13:23 - 2015-06-12 13:23 - 00000017 _____ C:\Users\Owner\AppData\Local\resmon.resmoncfg

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-07 19:56 - 2014-07-16 07:39 - 01311659 _____ C:\Windows\WindowsUpdate.log
2015-07-07 19:54 - 2015-03-14 11:42 - 00000000 ____D C:\Program Files\Telstra Broadband Assistant
2015-07-07 19:53 - 2009-07-14 12:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-07 17:09 - 2011-07-16 00:44 - 00018864 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-07-07 17:09 - 2011-07-16 00:44 - 00018864 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-07-07 15:39 - 2015-01-29 05:27 - 00000000 ____D C:\Users\Owner\Desktop\Autoruns
2015-07-07 15:38 - 2015-05-31 04:17 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-07-07 15:04 - 2015-05-31 04:17 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-07-07 15:04 - 2015-05-31 04:17 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-07-07 15:03 - 2010-02-02 11:42 - 00000000 ____D C:\Users\Owner\AppData\Local\Adobe
2015-07-07 14:40 - 2015-01-16 16:04 - 00004628 _____ C:\DelFix.txt
2015-07-07 14:30 - 2015-01-14 22:35 - 00000000 ____D C:\Windows\ERUNT
2015-07-06 15:16 - 2011-07-30 19:29 - 00000000 ____D C:\Windows\Minidump
2015-07-06 03:01 - 2015-01-19 04:44 - 00000000 ____D C:\Users\Owner\AppData\Local\CrashDumps
2015-07-06 02:47 - 2015-01-22 19:36 - 00000000 ____D C:\Users\Owner\Desktop\Receipts
2015-07-05 18:11 - 2010-02-02 10:55 - 00246952 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-07-05 17:54 - 2009-07-14 10:37 - 00000000 ____D C:\Windows\system32\NDF
2015-07-05 10:26 - 2015-04-09 08:21 - 00098520 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-07-02 14:14 - 2011-07-16 00:48 - 00000000 ____D C:\Users\Owner
2015-07-02 14:13 - 2009-07-14 10:37 - 00000000 ____D C:\Windows\system32\wfp
2015-07-02 14:12 - 2015-04-06 23:47 - 00000000 ___SD C:\Windows\system32\GWX
2015-07-02 14:12 - 2010-02-01 13:26 - 00000000 ____D C:\Windows\system32\Macromed
2015-07-02 14:12 - 2009-07-14 10:37 - 00000000 ____D C:\Windows\registration
2015-07-02 14:11 - 2015-05-31 04:18 - 00000000 ____D C:\ProgramData\Google
2015-07-02 14:11 - 2011-11-17 02:19 - 00000000 ____D C:\Program Files\Google
2015-07-02 14:11 - 2010-02-03 01:04 - 00000000 ____D C:\Users\Owner\AppData\Local\Google
2015-07-02 11:57 - 2010-02-02 13:20 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-07-02 04:33 - 2009-07-14 10:37 - 00000000 ____D C:\Windows\system32\LogFiles
2015-07-01 06:54 - 2015-02-08 08:41 - 00013824 ___SH C:\Users\Owner\AppData\Thumbs.db
2015-06-26 12:53 - 2012-11-29 03:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RoboForm
2015-06-26 09:21 - 2015-05-31 05:51 - 00000925 _____ C:\Users\Public\Desktop\CCleaner.lnk
2015-06-26 09:21 - 2015-05-31 05:51 - 00000000 ____D C:\Program Files\CCleaner
2015-06-26 02:00 - 2009-07-14 10:37 - 00000000 ____D C:\Windows\rescache
2015-06-26 00:22 - 2014-11-13 03:30 - 00000000 __SHD C:\Users\Owner\AppData\Local\EmieBrowserModeList
2015-06-26 00:22 - 2014-05-07 07:50 - 00000000 __SHD C:\Users\Owner\AppData\Local\EmieUserList
2015-06-26 00:22 - 2014-05-07 07:50 - 00000000 __SHD C:\Users\Owner\AppData\Local\EmieSiteList
2015-06-26 00:20 - 2011-07-16 01:37 - 00781346 _____ C:\Windows\system32\PerfStringBackup.INI
2015-06-26 00:14 - 2009-07-14 12:33 - 00269880 _____ C:\Windows\system32\FNTCACHE.DAT
2015-06-26 00:11 - 2014-05-07 03:20 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-06-26 00:10 - 2014-12-11 03:18 - 00000000 ____D C:\Windows\system32\appraiser
2015-06-25 23:56 - 2013-08-16 03:10 - 00000000 ____D C:\Windows\system32\MRT
2015-06-25 23:50 - 2011-08-12 14:59 - 136900096 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-06-25 23:37 - 2015-05-31 04:19 - 00002091 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-06-25 17:48 - 2010-02-01 12:09 - 00000000 ____D C:\Program Files\Realtek
2015-06-25 17:48 - 2010-02-01 12:09 - 00000000 ____D C:\Program Files\InstallShield Installation Information
2015-06-25 17:42 - 2011-11-11 16:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Auslogics
2015-06-25 17:38 - 2010-02-01 13:27 - 00000000 ____D C:\Program Files\DIFX
2015-06-25 17:11 - 2015-05-31 04:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-06-25 17:11 - 2010-11-29 10:45 - 00000000 ____D C:\Users\Owner\AppData\Roaming\vlc
2015-06-25 17:11 - 2010-02-01 19:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IncrediMail
2015-06-25 17:11 - 2009-07-14 12:52 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-06-25 17:10 - 2010-02-01 19:31 - 00000000 ____D C:\Users\Owner\AppData\Local\IM
2015-06-25 17:10 - 2009-07-14 10:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2015-06-24 07:19 - 2015-01-21 02:02 - 00000000 ____D C:\ProgramData\boost_interprocess
2015-06-18 08:41 - 2015-04-09 08:21 - 00094936 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-06-18 08:41 - 2015-04-09 08:21 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-06-18 08:41 - 2015-04-09 08:21 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-06-12 14:39 - 2015-04-15 13:28 - 00338620 _____ C:\Users\Owner\AppData\Local\census.cache
2015-06-12 14:39 - 2015-04-15 13:28 - 00146372 _____ C:\Users\Owner\AppData\Local\ars.cache
2015-06-07 03:51 - 2009-07-14 12:53 - 00032626 _____ C:\Windows\Tasks\SCHEDLGU.TXT

==================== Files in the root of some directories =======

2015-04-07 22:44 - 2015-04-07 23:06 - 0000115 _____ () C:\Users\Owner\AppData\Roaming\LogFile.txt
2013-04-01 19:07 - 2013-04-01 19:07 - 0026108 _____ () C:\Users\Owner\AppData\Roaming\UserTile.png
2015-04-07 21:45 - 2015-05-07 03:27 - 0000436 _____ () C:\Users\Owner\AppData\Roaming\Weather Meter_Settings.ini
2015-04-15 13:28 - 2015-06-12 14:39 - 0146372 _____ () C:\Users\Owner\AppData\Local\ars.cache
2015-04-15 13:28 - 2015-06-12 14:39 - 0338620 _____ () C:\Users\Owner\AppData\Local\census.cache
2014-09-11 19:44 - 2014-09-11 19:44 - 0003584 _____ () C:\Users\Owner\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-04-15 08:28 - 2015-04-15 08:28 - 0000036 _____ () C:\Users\Owner\AppData\Local\housecall.guid.cache
2015-06-12 13:23 - 2015-06-12 13:23 - 0000017 _____ () C:\Users\Owner\AppData\Local\resmon.resmoncfg
2014-02-11 09:56 - 2015-01-22 05:42 - 0010278 _____ () C:\ProgramData\hpzinstall.log

Some files in TEMP:
====================
C:\Users\Owner\AppData\Local\Temp\pcDesktopAlertNotifierX.dll
C:\Users\Owner\AppData\Local\Temp\Quarantine.exe
C:\Users\Owner\AppData\Local\Temp\sqlite3.dll

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-07-03 07:14

==================== End of log ============================

 

 

 

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 05-07-2015
Ran by Owner at 2015-07-07 19:59:51
Running from C:\Users\Owner\Desktop
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-754179056-1382982999-2036298953-500 - Administrator - Disabled)
Guest (S-1-5-21-754179056-1382982999-2036298953-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-754179056-1382982999-2036298953-1002 - Limited - Enabled)
Owner (S-1-5-21-754179056-1382982999-2036298953-1000 - Administrator - Enabled) => C:\Users\Owner

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

32 Bit HP CIO Components Installer (Version: 6.1.1 - Hewlett-Packard) Hidden
Adobe Acrobat 4.0 (HKLM\...\Adobe Acrobat 4.0) (Version: 4.0 - Adobe Systems, Inc.)
Adobe Flash Player 18 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 18.0.0.194 - Adobe Systems Incorporated)
Any Video Converter 5.7.3 (HKLM\...\Any Video Converter_is1) (Version:  - Any-Video-Converter.com)
Any Video Converter Ultimate 4.6.0 (HKLM\...\Any Video Converter Ultimate_is1) (Version:  - Any-Video-Converter.com)
Ashampoo Burning Studio 14 (HKLM\...\{91B33C97-7BCF-CDFE-4321-58EBF3E8641C}_is1) (Version: 14.0.9 - Ashampoo GmbH & Co. KG)
Ashampoo Burning Studio 8.09 (HKLM\...\Ashampoo Burning Studio 8_is1) (Version: 8.0.9 - ashampoo GmbH & Co. KG)
BufferChm (Version: 130.0.331.000 - Hewlett-Packard) Hidden
Canon Easy-WebPrint EX (HKLM\...\Easy-WebPrint EX) (Version: 1.4.0.0 - Canon Inc.)
Canon IJ Scan Utility (HKLM\...\Canon_IJ_Scan_Utility) (Version:  - Canon Inc.)
Canon MG2500 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG2500_series) (Version: 1.00 - Canon Inc.)
Canon MG2500 series On-screen Manual (HKLM\...\Canon MG2500 series On-screen Manual) (Version: 7.6.1 - Canon Inc.)
Canon My Image Garden (HKLM\...\Canon My Image Garden) (Version: 2.0.1 - Canon Inc.)
Canon My Image Garden Design Files (HKLM\...\Canon My Image Garden Design Files) (Version: 2.0.0 - Canon Inc.)
Canon My Printer (HKLM\...\CanonMyPrinter) (Version: 3.1.0 - Canon Inc.)
Canon Quick Menu (HKLM\...\CanonQuickMenu) (Version: 2.2.1 - Canon Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 5.07 - Piriform)
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
Data Lifeguard Diagnostic for Windows (HKLM\...\{75B61CF0-B8A8-46E2-8709-C4A79898AC1D}) (Version: 1.17 - Western Digital Corporation)
Defraggler (HKLM\...\Defraggler) (Version: 2.19 - Piriform)
Easy Thumbnails (Remove only) (HKLM\...\Easy Thumbnails_is1) (Version: 3.0 - Fookes Software)
Go PDF Reader (HKLM\...\GoPDFReader) (Version:  - )
Google Chrome (HKLM\...\Google Chrome) (Version: 43.0.2357.130 - Google Inc.)
Google Update Helper (Version: 1.3.24.7 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.27.5 - Google Inc.) Hidden
IncrediMail (Version: 6.6.0.5288 - IncrediMail) Hidden
IncrediMail 2.5 (HKLM\...\IncrediMail) (Version: 6.6.0.5288 - IncrediMail Ltd.)
Junk Mail filter update (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware version 2.1.8.1057 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Calculator Plus (HKLM\...\{83073C45-3003-4671-9A86-243AAADD915A}) (Version: 1.0.0 - Microsoft)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.8.204.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Maker (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Panda Cloud Cleaner (HKLM\...\{92B2B132-C7F0-43DC-921A-4493C04F78A4}_is1) (Version: 1.0.107 - Panda Security)
PhotoMail Maker (Version: 6.0.0.1007 - IncrediMail) Hidden
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version:  - )
Revo Uninstaller Pro 3.1.2 (HKLM\...\{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1) (Version: 3.1.2 - VS Revo Group, Ltd.)
RoboForm 7-9-14-4 (All Users) (HKLM\...\AI RoboForm) (Version: 7-9-14-4 - Siber Systems)
Speccy (HKLM\...\Speccy) (Version: 1.28 - Piriform)
SumatraPDF (HKLM\...\SumatraPDF) (Version: 2.4 - Krzysztof Kowalczyk)
Telstra Broadband Assistant (HKLM\...\Telstra-Telstra Broadband Assistant) (Version: 1.0.2.45 - Telstra Corporation Ltd.)
Unchecky v0.3.7.5 (HKLM\...\Unchecky) (Version: 0.3.7.5 - RaMMicHaeL)
UnloadSupport (Version: 11.0.0 - Hewlett-Packard) Hidden
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Windows 7 Upgrade Advisor (HKLM\...\{AB05F2C8-F608-403b-95E1-FD8ADFACD31E}) (Version: 2.0.5000.0 - Microsoft Corporation)
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-754179056-1382982999-2036298953-1000_Classes\CLSID\{00B7E0AB-817A-44AD-A04B-D1148D524136}\InprocServer32 -> C:\Windows\system32\msxml4.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-754179056-1382982999-2036298953-1000_Classes\CLSID\{3A999A50-AB25-4A20-90A9-08F71FCE320F}\InprocServer32 -> C:\Windows\system32\spool\DRIVERS\W32X86\3\hpcdmc32.dll (HP)
CustomCLSID: HKU\S-1-5-21-754179056-1382982999-2036298953-1000_Classes\CLSID\{7C6E29BC-8B8B-4C3D-859E-AF6CD158BE0F}\InprocServer32 -> C:\Windows\system32\msxml4.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-754179056-1382982999-2036298953-1000_Classes\CLSID\{88D969C0-F192-11D4-A65F-0040963251E5}\InprocServer32 -> C:\Windows\system32\msxml4.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-754179056-1382982999-2036298953-1000_Classes\CLSID\{88D969C1-F192-11D4-A65F-0040963251E5}\InprocServer32 -> C:\Windows\system32\msxml4.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-754179056-1382982999-2036298953-1000_Classes\CLSID\{88D969C2-F192-11D4-A65F-0040963251E5}\InprocServer32 -> C:\Windows\system32\msxml4.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-754179056-1382982999-2036298953-1000_Classes\CLSID\{88D969C3-F192-11D4-A65F-0040963251E5}\InprocServer32 -> C:\Windows\system32\msxml4.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-754179056-1382982999-2036298953-1000_Classes\CLSID\{88D969C4-F192-11D4-A65F-0040963251E5}\InprocServer32 -> C:\Windows\system32\msxml4.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-754179056-1382982999-2036298953-1000_Classes\CLSID\{88D969C5-F192-11D4-A65F-0040963251E5}\InprocServer32 -> C:\Windows\system32\msxml4.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-754179056-1382982999-2036298953-1000_Classes\CLSID\{88D969C6-F192-11D4-A65F-0040963251E5}\InprocServer32 -> C:\Windows\system32\msxml4.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-754179056-1382982999-2036298953-1000_Classes\CLSID\{88D969C8-F192-11D4-A65F-0040963251E5}\InprocServer32 -> C:\Windows\system32\msxml4.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-754179056-1382982999-2036298953-1000_Classes\CLSID\{88D969C9-F192-11D4-A65F-0040963251E5}\InprocServer32 -> C:\Windows\system32\msxml4.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-754179056-1382982999-2036298953-1000_Classes\CLSID\{88D969CA-F192-11D4-A65F-0040963251E5}\InprocServer32 -> C:\Windows\system32\msxml4.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-754179056-1382982999-2036298953-1000_Classes\CLSID\{88D969D6-F192-11D4-A65F-0040963251E5}\InprocServer32 -> C:\Windows\system32\msxml4.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-754179056-1382982999-2036298953-1000_Classes\CLSID\{98087D89-B93F-4BCF-A998-AE4D9F607C14}\InprocServer32 -> C:\Windows\system32\spool\DRIVERS\W32X86\3\hpcdmc32.dll (HP)
CustomCLSID: HKU\S-1-5-21-754179056-1382982999-2036298953-1000_Classes\CLSID\{B286F068-5B17-4AE8-989B-8F9A199C47BA}\InprocServer32 -> C:\Windows\system32\spool\DRIVERS\W32X86\3\hpcdmc32.dll (HP)

==================== Restore Points =========================

07-07-2015 14:40:11 End of disinfection

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 18:23 - 2015-07-07 19:53 - 00001204 ____A C:\Windows\system32\Drivers\etc\hosts
0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomaly
0.0.0.0 tracking.opencandy.com.s3.amazonaws.com
0.0.0.0 media.opencandy.com
0.0.0.0 cdn.opencandy.com
0.0.0.0 tracking.opencandy.com
0.0.0.0 api.opencandy.com
0.0.0.0 installer.betterinstaller.com
0.0.0.0 installer.filebulldog.com
0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net
0.0.0.0 inno.bisrv.com
0.0.0.0 nsis.bisrv.com
0.0.0.0 cdn.file2desktop.com
0.0.0.0 cdn.goateastcach.us
0.0.0.0 cdn.guttastatdk.us
0.0.0.0 cdn.inskinmedia.com
0.0.0.0 cdn.insta.oibundles2.com
0.0.0.0 cdn.insta.playbryte.com
0.0.0.0 cdn.llogetfastcach.us
0.0.0.0 cdn.montiera.com
0.0.0.0 cdn.msdwnld.com
0.0.0.0 cdn.mypcbackup.com
0.0.0.0 cdn.ppdownload.com
0.0.0.0 cdn.riceateastcach.us
0.0.0.0 cdn.shyapotato.us
0.0.0.0 cdn.solimba.com
0.0.0.0 cdn.tuto4pc.com
0.0.0.0 cdn.appround.biz
0.0.0.0 cdn.bigspeedpro.com
0.0.0.0 cdn.bispd.com

There are 4 more lines.

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0DC0B543-5117-4B29-8FDD-6B8D699FB33B} - System32\Tasks\{FB687851-6320-4D70-A607-9ED3EA25F95F} => C:\Program Files\IncrediMail\Bin\IncMail.exe [2015-06-05] (IncrediMail, Ltd.)
Task: {1260FC21-28CB-409A-AFE8-4A8B73884E21} - System32\Tasks\Open URL by RoboForm => Rundll32.exe url.dll,FileProtocolHandler "http://www.roboform....IGJKJMIBNKJHIKJ"
Task: {14FF1700-BA4C-4FC0-A89D-96D97D103D00} - System32\Tasks\Go to RoboForm Install page => Rundll32.exe url.dll,FileProtocolHandler "http://www.roboform....NNICMJNDJCMKJBJ"
Task: {1946ADEB-A7AD-4E17-9A7F-E9280DA1CC6A} - System32\Tasks\{54FFE30A-7439-482D-8E6F-497ABD851E8D} => C:\Program Files\Microsoft Silverlight\5.1.40416.0\Silverlight.Configuration.exe [2015-04-15] (Microsoft Corporation)
Task: {1C4A8493-30A2-47E5-9BE8-C1D793217A0D} - System32\Tasks\{C7C592A1-4609-49D9-8CAB-B26A0395DBCE} => C:\Program Files\IncrediMail\Bin\IncMail.exe [2015-06-05] (IncrediMail, Ltd.)
Task: {21E9703A-B00E-4010-811A-36A6A6E08D9B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-05-31] (Google Inc.)
Task: {3043F7F1-BD5D-4537-9DAD-CDDE8B72A895} - System32\Tasks\{DED62F59-5C9E-4A85-8440-E42E28096822} => C:\Users\Owner\Downloads\OneDriveSetup.exe
Task: {4B39CC67-88E0-42F3-9EEB-BE01803A9BA9} - System32\Tasks\{F4C92BD5-C5A1-4437-AAC2-A55EBA33700D} => C:\Program Files\BitComet\BitComet.exe
Task: {561375CB-FF5A-417B-B297-BA73DE149581} - System32\Tasks\Microsoft\Windows\Wired\GatherWiredInfo => C:\Windows\system32\gatherWiredInfo.vbs
Task: {56D3ABCE-0501-46AD-8FFF-C6F0785C6142} - System32\Tasks\{04EB4926-E829-487F-A4A3-F39F51CB7E1E} => C:\Program Files\IncrediMail\Bin\IncMail.exe [2015-06-05] (IncrediMail, Ltd.)
Task: {6C83EC53-B13A-438A-8638-8834A4CE0298} - System32\Tasks\{55CFA1BF-88EC-4F09-A741-ECE129A83AA2} => C:\Program Files\IncrediMail\Bin\IncMail.exe [2015-06-05] (IncrediMail, Ltd.)
Task: {722FE130-101A-4D9D-B93B-1A7689E69BC2} - System32\Tasks\{59AA7BD3-977B-4885-84EA-CF910E51577C} => C:\Program Files\IncrediMail\Bin\IncMail.exe [2015-06-05] (IncrediMail, Ltd.)
Task: {76121EEE-434C-42DF-AC87-7EB6999EFA2E} - System32\Tasks\Google Update => C:\Users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe
Task: {82A24E69-122A-4F51-B583-A348C7372769} - System32\Tasks\{2962B57C-4766-426A-8887-D12E28116F4B} => C:\Program Files\IncrediMail\Bin\IncMail.exe [2015-06-05] (IncrediMail, Ltd.)
Task: {92672263-E352-43F9-94CC-2FB6436D6351} - System32\Tasks\{D5C773BB-EDAA-434D-84F5-BAFDD84D48C6} => C:\Program Files\IncrediMail\Bin\IncMail.exe [2015-06-05] (IncrediMail, Ltd.)
Task: {ABA65842-BE6F-4CFB-8112-13781F34B3D5} - System32\Tasks\{0368CC1F-3E0C-49C3-9E79-F6923D8A3D4E} => C:\Program Files\IncrediMail\Bin\IncMail.exe [2015-06-05] (IncrediMail, Ltd.)
Task: {BB4D7F4C-5DF5-4F47-BD33-CF71A35D2D87} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-05-31] (Google Inc.)
Task: {BBBAC0F0-1E55-4F45-953E-ADC4A1C6253F} - System32\Tasks\Run RoboForm TaskBar Icon => C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe [2015-06-26] (Siber Systems)
Task: {BF95D427-4AA6-4CD3-AFE4-20795D2A668A} - System32\Tasks\{91B9C5A7-30E2-4EF3-A54B-EE275C8D90F3} => C:\Program Files\BitComet\BitComet.exe
Task: {DDB87CEA-DAEF-4B84-9B1F-52D4370730F4} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-07-07] (Adobe Systems Incorporated)
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs
Task: {E6934196-7C8F-4304-BD9A-B013A451D3CB} - System32\Tasks\{BEEFDE71-9ADA-4208-AFA6-8591F44844C2} => pcalua.exe -a C:\Users\Owner\Downloads\pctum_setup_dmp_.exe -d C:\Users\Owner\Downloads
Task: {F4711B03-C555-43F9-8896-D90E8FD6D1D3} - System32\Tasks\{ADFFAF74-7253-4F28-A492-3BD29A94D612} => C:\Program Files\IncrediMail\Bin\IncMail.exe [2015-06-05] (IncrediMail, Ltd.)
Task: {FAE80FFA-2754-4FCF-A51D-945991F8B0F9} - System32\Tasks\{3BF27CA2-D8CC-48B6-98DC-2B89B8593AEC} => C:\Program Files\IncrediMail\Bin\IncMail.exe [2015-06-05] (IncrediMail, Ltd.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2010-02-01 12:20 - 2007-05-14 10:54 - 00272024 _____ () C:\Program Files\CyberLink\Shared Files\RichVideo.exe
2013-11-08 07:58 - 2013-11-08 07:58 - 00244736 _____ () C:\Program Files\Telstra Broadband Assistant\1.0.2.45\ma\node_modules\motive-activex-wrapper\build\Release\NodeActiveXWrapper.node
2013-11-08 07:58 - 2013-11-08 07:58 - 00271360 _____ () C:\Program Files\Telstra Broadband Assistant\1.0.2.45\ma\node_modules\motive-osbridge\build\Release\MotiveOSBridgeNodeModule.node
2013-11-08 07:57 - 2013-11-08 07:57 - 00237056 _____ () C:\Program Files\Telstra Broadband Assistant\1.0.2.45\ma\node_modules\motive-xmpps\build\Release\MotiveXMPPSNode.node
2013-04-24 21:55 - 2013-04-24 21:55 - 01581056 _____ () C:\Program Files\Telstra Broadband Assistant\1.0.2.45\ma\node_modules\libxmljs\build\Release\xmljs.node
2013-04-19 06:55 - 2013-04-19 06:55 - 00068608 _____ () C:\Program Files\Telstra Broadband Assistant\1.0.2.45\ma\node_modules\dnode\node_modules\weak\build\Release\weakref.node

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-754179056-1382982999-2036298953-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 10.0.0.138

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^Users^Owner^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Canon IJ Status Monitor Canon iP4500 series.lnk => C:\Windows\pss\Canon IJ Status Monitor Canon iP4500 series.lnk.Startup

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{E8E4F3A2-1D60-4009-A4C1-17202F1A55E3}] => (Allow) C:\Program Files\IncrediMail\Bin\IncMail.exe
FirewallRules: [{8021867A-EB34-48D1-B77E-947A47D776D5}] => (Allow) C:\Program Files\IncrediMail\Bin\IncMail.exe
FirewallRules: [{C9A97C09-0619-4AFA-BA0A-E703E3217AD9}] => (Allow) C:\Program Files\IncrediMail\Bin\ImApp.exe
FirewallRules: [{1FDC084E-4D56-405E-8D60-36928B1A7FA8}] => (Allow) C:\Program Files\IncrediMail\Bin\ImApp.exe

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (07/07/2015 07:54:38 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/07/2015 07:53:31 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT AUTHORITY)
Description: Windows cannot load classes registry file.
 DETAIL - Unspecified error

Error: (07/07/2015 07:53:30 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT AUTHORITY)
Description: Windows cannot load classes registry file.
 DETAIL - Unspecified error

Error: (07/07/2015 07:49:51 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/07/2015 07:48:40 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT AUTHORITY)
Description: Windows cannot load classes registry file.
 DETAIL - Unspecified error

Error: (07/07/2015 07:48:39 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT AUTHORITY)
Description: Windows cannot load classes registry file.
 DETAIL - Unspecified error

Error: (07/07/2015 07:41:28 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/07/2015 07:41:24 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT AUTHORITY)
Description: Windows cannot load classes registry file.
 DETAIL - Unspecified error

Error: (07/07/2015 07:41:24 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT AUTHORITY)
Description: Windows cannot load classes registry file.
 DETAIL - Unspecified error

Error: (07/07/2015 05:01:53 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

System errors:
=============
Error: (07/07/2015 07:53:44 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
sptd

Error: (07/07/2015 07:52:57 PM) (Source: volmgr) (EventID: 46) (User: )
Description: Crash dump initialization failed!

Error: (07/07/2015 07:53:05 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 7:51:02 PM on ‎7/‎7/‎2015 was unexpected.

Error: (07/07/2015 07:52:49 PM) (Source: volmgr) (EventID: 46) (User: )
Description: Crash dump initialization failed!

Error: (07/07/2015 07:52:49 PM) (Source: volmgr) (EventID: 46) (User: )
Description: Crash dump initialization failed!

Error: (07/07/2015 07:52:41 PM) (Source: sptd) (EventID: 4) (User: )
Description: Driver detected an internal error in its data structures for .

Error: (07/07/2015 07:48:59 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
sptd

Error: (07/07/2015 07:48:11 PM) (Source: volmgr) (EventID: 46) (User: )
Description: Crash dump initialization failed!

Error: (07/07/2015 07:48:21 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 7:45:40 PM on ‎7/‎7/‎2015 was unexpected.

Error: (07/07/2015 07:47:59 PM) (Source: volmgr) (EventID: 46) (User: )
Description: Crash dump initialization failed!

Microsoft Office:
=========================
Error: (07/07/2015 07:54:38 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/07/2015 07:53:31 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT AUTHORITY)
Description: Unspecified error

Error: (07/07/2015 07:53:30 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT AUTHORITY)
Description: Unspecified error

Error: (07/07/2015 07:49:51 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/07/2015 07:48:40 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT AUTHORITY)
Description: Unspecified error

Error: (07/07/2015 07:48:39 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT AUTHORITY)
Description: Unspecified error

Error: (07/07/2015 07:41:28 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/07/2015 07:41:24 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT AUTHORITY)
Description: Unspecified error

Error: (07/07/2015 07:41:24 PM) (Source: Microsoft-Windows-User Profiles Service) (EventID: 1542) (User: NT AUTHORITY)
Description: Unspecified error

Error: (07/07/2015 05:01:53 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

CodeIntegrity Errors:
===================================
  Date: 2015-06-08 01:20:59.996
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows.old\Windows\winsxs\x86_microsoft-windows-tpm-driver-wmi_31bf3856ad364e35_6.0.6001.18000_none_6f8d0e60c043c672\Win32_Tpm.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-06-08 01:20:59.963
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows.old\Windows\winsxs\x86_microsoft-windows-tpm-driver-wmi_31bf3856ad364e35_6.0.6001.18000_none_6f8d0e60c043c672\Win32_Tpm.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-06-08 01:05:54.256
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows.old\Windows\winsxs\x86_microsoft-windows-bcrypt-dll_31bf3856ad364e35_6.0.6001.18000_none_ee8c936cef65a88f\bcrypt.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-06-08 01:05:54.226
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows.old\Windows\winsxs\x86_microsoft-windows-bcrypt-dll_31bf3856ad364e35_6.0.6001.18000_none_ee8c936cef65a88f\bcrypt.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-06-08 01:03:29.035
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows.old\Windows\winsxs\Temp\PendingDeletes\$$DeleteMe.bcrypt.dll.01c85bd5f6054314.0033 because the set of per-page image hashes could not be found on the system.

  Date: 2015-06-08 01:03:28.999
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows.old\Windows\winsxs\Temp\PendingDeletes\$$DeleteMe.bcrypt.dll.01c85bd5f6054314.0033 because the set of per-page image hashes could not be found on the system.

  Date: 2015-06-08 00:57:42.766
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows.old\Windows\winsxs\Backup\x86_microsoft-windows-bcrypt-dll_31bf3856ad364e35_6.0.6001.18000_none_ee8c936cef65a88f_bcrypt.dll_e2f091ac because the set of per-page image hashes could not be found on the system.

  Date: 2015-06-08 00:57:42.736
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows.old\Windows\winsxs\Backup\x86_microsoft-windows-bcrypt-dll_31bf3856ad364e35_6.0.6001.18000_none_ee8c936cef65a88f_bcrypt.dll_e2f091ac because the set of per-page image hashes could not be found on the system.

  Date: 2015-06-08 00:56:55.888
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows.old\Windows\System32\wbem\Win32_Tpm.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-06-08 00:56:55.844
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows.old\Windows\System32\wbem\Win32_Tpm.dll because the set of per-page image hashes could not be found on the system.

==================== Memory info ===========================

Processor: Intel® Core™2 Duo CPU E8500 @ 3.16GHz
Percentage of memory in use: 38%
Total physical RAM: 2046.49 MB
Available physical RAM: 1252.82 MB
Total Virtual: 4092.98 MB
Available Virtual: 2989.7 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:931.51 GB) (Free:860.81 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 31AF88A9)
Partition 1: (Active) - (Size=931.5 GB) - (Type=07 NTFS)

==================== End of log ============================

[ruggie_uk]

Hi, well your logs look great so I don't think malware is an issue here. Time to look at your memory and hard drive I think.
 
Memory Check

• Open Memory Diagnostics Tool by clicking the Start button , and then clicking Control Panel. In the search box, type Memory, and then click Diagnose your computer's memory problems.‌ If you're prompted for an administrator password or confirmation, type the password or provide confirmation.
• Choose when to run the tool.
• Please report back once completed with any information.