dennis pengelly
Posts: 34 +0
Hello guys
I just received a used netbook (Toshiba NB305-N410BL) which is running VERY slow (sometimes minutes to open a window). You fixed my problems with my old desktop last year (thank you) so I thought I would try again. I am sending the results of FRST as instructed.
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:21-02-2016 01
Ran by Owner (administrator) on OWNER-PC (22-02-2016 12:43:21)
Running from C:\Users\Owner\Downloads
Loaded Profiles: Owner (Available Profiles: Owner)
Platform: Microsoft Windows 7 Starter Service Pack 1 (X86) Language: English (United States)
Internet Explorer Version 10 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool:
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Malwarebytes) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
(Malwarebytes) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
(TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_20_0_0_306.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_20_0_0_306.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8555040 2010-04-13] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1697064 2010-03-10] (Synaptics Incorporated)
HKLM\...\Run: [GIDDesktop] => C:\Program Files\SFT\GuardedID\gidd.exe [395528 2011-07-05] (StrikeForce Technologies Inc.)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [7139768 2016-02-17] (AVAST Software)
HKU\S-1-5-21-955303298-3134083887-1062901272-1000\...\Run: [ComcastAntispyClient] => "C:\Program Files\comcasttb\ComcastSpywareScan\ComcastAntispy.exe" /hide
HKU\S-1-5-21-955303298-3134083887-1062901272-1000\...\Policies\Explorer: [NoDesktopCleanupWizard] 1
HKU\S-1-5-21-955303298-3134083887-1062901272-1000\...\MountPoints2: D - D:\LaunchU3.exe -a
HKU\S-1-5-21-955303298-3134083887-1062901272-1000\...\MountPoints2: {e4f48816-1b4f-11e0-a68e-fc79065da9a5} - D:\Customizer.exe
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2016-02-17] (AVAST Software)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 71.10.216.1 71.10.216.2
Tcpip\..\Interfaces\{C148E439-7338-4DCE-AEED-00CA63CA8E59}: [DhcpNameServer] 71.10.216.1 71.10.216.2
Internet Explorer:
==================
HKU\S-1-5-21-955303298-3134083887-1062901272-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/Toshiba/en-us
HKU\S-1-5-21-955303298-3134083887-1062901272-1000\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://laptops.toshiba.com/adps/deals-and-offers
SearchScopes: HKLM -> DefaultScope {0FDB1AB3-CAF2-46B6-97B7-8B4FB35F1931} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHTDF&pc=MATB&src=IE-SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {0FDB1AB3-CAF2-46B6-97B7-8B4FB35F1931} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHTDF&pc=MATB&src=IE-SearchBox
SearchScopes: HKU\.DEFAULT -> DefaultScope {0FDB1AB3-CAF2-46B6-97B7-8B4FB35F1931} URL =
SearchScopes: HKU\S-1-5-21-955303298-3134083887-1062901272-1000 -> DefaultScope {0B38A49E-33F2-4ABE-8B29-D4DB83E0E1A5} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHTDF&pc=MATB&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-955303298-3134083887-1062901272-1000 -> {0B38A49E-33F2-4ABE-8B29-D4DB83E0E1A5} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHTDF&pc=MATB&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-955303298-3134083887-1062901272-1000 -> {0FDB1AB3-CAF2-46B6-97B7-8B4FB35F1931} URL =
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-02-17] (AVAST Software)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-12-21] (Microsoft Corporation)
BHO: No Name -> {bb46be07-13eb-4c49-b0f0-fc78b9ea4983} -> No File
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2007-06-08] (Microsoft Corporation)
FireFox:
========
FF ProfilePath: C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\zjckzo3q.default
FF Homepage: hxxp://google.com/
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF32_20_0_0_306.dll [2016-02-15] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll [2013-01-24] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MIF5BA~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MIF5BA~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-02-17]
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2016-02-17]
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [237096 2016-02-17] (AVAST Software)
R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1513784 2015-10-05] (Malwarebytes)
R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
S3 TMachInfo; C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [51512 2009-10-06] (TOSHIBA Corporation)
R2 TOSHIBA eco Utility Service; C:\Program Files\TOSHIBA\TECO\TecoService.exe [189808 2010-04-06] (TOSHIBA Corporation)
S3 TOSHIBA HDD SSD Alert Service; C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [111960 2010-02-05] (TOSHIBA Corporation)
S3 TPCHSrv; C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe [685424 2010-03-31] (TOSHIBA Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2009-07-13] (Microsoft Corporation)
S2 AntiSpywareService; C:\Program Files\comcasttb\ComcastSpywareScan\ComcastAntiSpyService.exe [X]
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 aswHwid; C:\windows\system32\drivers\aswHwid.sys [32792 2016-02-17] (AVAST Software)
R2 aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [91168 2016-02-17] (AVAST Software)
R1 aswRdr; C:\windows\system32\drivers\aswRdr2.sys [91232 2016-02-17] (AVAST Software)
R0 aswRvrt; C:\windows\system32\Drivers\aswRvrt.sys [58776 2016-02-17] (AVAST Software)
R1 aswSnx; C:\windows\system32\drivers\aswSnx.sys [812720 2016-02-17] (AVAST Software)
R1 aswSP; C:\windows\system32\drivers\aswSP.sys [447848 2016-02-17] (AVAST Software)
R2 aswStm; C:\windows\system32\drivers\aswStm.sys [127432 2016-02-17] (AVAST Software)
R0 aswVmm; C:\windows\system32\Drivers\aswVmm.sys [221240 2016-02-17] (AVAST Software)
R1 GIDv2; C:\windows\system32\Drivers\GIDv2.sys [25232 2011-07-05] (StrikeForce Technologies, Inc.)
R0 LPCFilter; C:\windows\System32\DRIVERS\LPCFilter.sys [36208 2009-07-30] (COMPAL ELECTRONIC INC.)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [23256 2015-10-05] (Malwarebytes)
R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [170200 2016-02-22] (Malwarebytes)
R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [51928 2015-10-05] (Malwarebytes Corporation)
R3 PGEffect; C:\windows\System32\DRIVERS\pgeffect.sys [24064 2009-06-22] (TOSHIBA Corporation)
R2 TVALZFL; C:\windows\System32\DRIVERS\TVALZFL.sys [12920 2009-06-19] (TOSHIBA Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-02-22 12:21 - 2016-02-22 12:23 - 00022175 _____ C:\Users\Owner\Downloads\Addition.txt
2016-02-22 12:18 - 2016-02-22 12:43 - 00011382 _____ C:\Users\Owner\Downloads\FRST.txt
2016-02-22 12:18 - 2016-02-22 12:43 - 00000000 ____D C:\FRST
2016-02-22 12:17 - 2016-02-22 12:17 - 01722368 _____ (Farbar) C:\Users\Owner\Downloads\FRST.exe
2016-02-21 15:25 - 2016-02-21 15:25 - 00002096 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows 7 Upgrade Advisor.lnk
2016-02-21 15:25 - 2016-02-21 15:25 - 00002084 _____ C:\Users\Public\Desktop\Windows 7 Upgrade Advisor.lnk
2016-02-21 15:25 - 2016-02-21 15:25 - 00000000 ____D C:\Program Files\Microsoft Windows 7 Upgrade Advisor
2016-02-21 15:01 - 2016-02-21 15:01 - 00000000 ____D C:\Users\Owner\AppData\Local\Microsoft Corporation
2016-02-21 10:28 - 2016-02-21 10:28 - 00000000 ____D C:\Users\Owner\AppData\Roaming\HD Tune Pro
2016-02-21 10:26 - 2016-02-21 10:26 - 00001002 _____ C:\Users\Owner\Desktop\HD Tune Pro.lnk
2016-02-21 10:26 - 2016-02-21 10:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HD Tune Pro
2016-02-21 10:25 - 2016-02-21 10:26 - 00000000 ____D C:\Program Files\HD Tune Pro
2016-02-18 09:48 - 2016-02-18 09:48 - 00003544 ____N C:\bootsqm.dat
2016-02-18 08:01 - 2016-02-18 08:01 - 00000000 ____D C:\Users\Owner\AppData\Roaming\toshiba
2016-02-17 14:23 - 2016-02-17 14:23 - 01505280 _____ (Microsoft Corporation) C:\windows\system32\d3d11.dll
2016-02-17 13:27 - 2016-02-22 12:30 - 00170200 _____ (Malwarebytes) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2016-02-17 13:20 - 2016-02-17 13:20 - 00001071 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-02-17 13:20 - 2016-02-17 13:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-02-17 13:20 - 2015-10-05 09:50 - 00094936 _____ (Malwarebytes) C:\windows\system32\Drivers\mbamchameleon.sys
2016-02-17 13:20 - 2015-10-05 09:50 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2016-02-17 13:20 - 2015-10-05 09:50 - 00023256 _____ (Malwarebytes) C:\windows\system32\Drivers\mbam.sys
2016-02-17 13:19 - 2016-02-17 13:20 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware
2016-02-17 13:19 - 2016-02-17 13:19 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-02-17 13:11 - 2016-02-17 13:12 - 22908888 _____ (Malwarebytes ) C:\Users\Owner\Downloads\mbam-setup-2.2.0.1024.exe
2016-02-17 12:02 - 2016-02-21 12:44 - 00000000 ____D C:\Program Files\Google
2016-02-17 12:02 - 2016-02-21 12:43 - 00000000 ____D C:\Users\Owner\AppData\Local\Google
2016-02-17 11:55 - 2016-02-17 11:45 - 00334280 _____ (AVAST Software) C:\windows\system32\aswBoot.exe
2016-02-17 11:49 - 2016-02-17 11:49 - 00000000 ____D C:\Users\Owner\AppData\Roaming\AVAST Software
2016-02-17 11:47 - 2016-02-17 11:47 - 00002086 _____ C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2016-02-17 11:47 - 2016-02-17 11:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2016-02-17 11:46 - 2016-02-17 11:46 - 00221240 _____ (AVAST Software) C:\windows\system32\Drivers\aswVmm.sys
2016-02-17 11:46 - 2016-02-17 11:46 - 00000000 ____D C:\Program Files\Common Files\AV
2016-02-17 11:46 - 2016-02-17 11:45 - 00812720 _____ (AVAST Software) C:\windows\system32\Drivers\aswSnx.sys
2016-02-17 11:46 - 2016-02-17 11:45 - 00447848 _____ (AVAST Software) C:\windows\system32\Drivers\aswSP.sys
2016-02-17 11:46 - 2016-02-17 11:45 - 00127432 _____ (AVAST Software) C:\windows\system32\Drivers\aswStm.sys
2016-02-17 11:46 - 2016-02-17 11:45 - 00091232 _____ (AVAST Software) C:\windows\system32\Drivers\aswRdr2.sys
2016-02-17 11:46 - 2016-02-17 11:45 - 00091168 _____ (AVAST Software) C:\windows\system32\Drivers\aswMonFlt.sys
2016-02-17 11:46 - 2016-02-17 11:45 - 00058776 _____ (AVAST Software) C:\windows\system32\Drivers\aswRvrt.sys
2016-02-17 11:46 - 2016-02-17 11:45 - 00032792 _____ (AVAST Software) C:\windows\system32\Drivers\aswHwid.sys
2016-02-17 11:45 - 2016-02-17 11:45 - 00052184 _____ (AVAST Software) C:\windows\avastSS.scr
2016-02-17 11:43 - 2016-02-17 11:43 - 00000000 ____D C:\ProgramData\AVAST Software
2016-02-17 11:43 - 2016-02-17 11:43 - 00000000 ____D C:\Program Files\AVAST Software
2016-02-17 11:42 - 2016-02-17 11:42 - 05207096 _____ (AVAST Software) C:\Users\Owner\Downloads\avast_free_antivirus_setup_online.exe
2016-02-15 16:49 - 2016-02-15 16:49 - 00001826 _____ C:\Users\Public\Desktop\QuickTime Player.lnk
2016-02-15 16:49 - 2016-02-15 16:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2016-02-15 16:49 - 2016-02-15 16:49 - 00000000 ____D C:\Program Files\QuickTime
2016-02-15 16:47 - 2016-02-15 16:47 - 00000000 ____D C:\Users\Owner\AppData\LocalLow\Apple Computer
2016-02-15 16:45 - 2016-02-15 16:45 - 41896256 _____ (Apple Inc.) C:\Users\Owner\Downloads\QuickTimeInstaller.exe
2016-02-15 13:41 - 2016-02-15 13:42 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Apple Computer
2016-02-15 13:41 - 2016-02-15 13:41 - 00000000 ____D C:\Users\Owner\AppData\Local\Apple Computer
2016-02-15 13:40 - 2016-02-15 13:40 - 00000000 ____D C:\ProgramData\Apple Computer
2016-02-15 13:30 - 2016-02-15 13:30 - 00000000 ____D C:\Users\Owner\AppData\Local\Apple
2016-02-15 13:29 - 2016-02-21 12:07 - 00000000 ____D C:\ProgramData\Apple
2016-02-15 12:35 - 2016-02-15 12:35 - 00000000 ____D C:\Users\Owner\AppData\Local\Macromedia
2016-02-06 21:02 - 2016-02-15 12:22 - 00000000 ____D C:\Users\Owner\AppData\Local\Mozilla
2016-02-06 21:02 - 2016-02-06 21:02 - 00001128 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-02-06 21:02 - 2016-02-06 21:02 - 00001116 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2016-02-06 21:02 - 2016-02-06 21:02 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2016-02-06 21:01 - 2016-02-06 21:02 - 00000000 ____D C:\Program Files\Mozilla Firefox
2016-02-06 20:42 - 2014-05-14 11:23 - 01973728 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
2016-02-06 20:42 - 2014-05-14 11:23 - 00581600 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
2016-02-06 20:42 - 2014-05-14 11:23 - 00054240 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
2016-02-06 20:42 - 2014-05-14 11:23 - 00045536 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll
2016-02-06 20:42 - 2014-05-14 11:23 - 00036320 _____ (Microsoft Corporation) C:\windows\system32\wups.dll
2016-02-06 20:42 - 2014-05-14 11:17 - 02425856 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2016-02-06 20:42 - 2014-05-14 11:17 - 00092672 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
2016-02-06 20:42 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll
2016-02-06 20:42 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe
2016-02-06 19:05 - 2016-02-21 15:33 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Skype
2016-02-06 19:04 - 2016-02-06 19:05 - 00000000 ____D C:\ProgramData\Skype
2016-02-06 19:04 - 2016-02-06 19:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2016-02-06 19:04 - 2016-02-06 19:04 - 00002685 _____ C:\Users\Public\Desktop\Skype.lnk
2016-02-06 19:04 - 2016-02-06 19:04 - 00000000 ___RD C:\Program Files\Skype
2016-02-06 19:04 - 2016-02-06 19:04 - 00000000 ____D C:\Program Files\Common Files\Skype
2016-02-06 18:46 - 2016-02-06 18:46 - 00000104 _____ C:\Users\Owner\Desktop\Control Panel.lnk
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-02-22 11:55 - 2009-07-13 23:53 - 00000006 ____H C:\windows\Tasks\SA.DAT
2016-02-22 11:54 - 2009-07-13 23:53 - 00032610 _____ C:\windows\Tasks\SCHEDLGU.TXT
2016-02-22 11:45 - 2012-05-06 13:54 - 00000830 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2016-02-22 11:40 - 2009-07-13 23:34 - 00014304 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-02-22 11:40 - 2009-07-13 23:34 - 00014304 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-02-21 12:54 - 2011-11-24 11:52 - 00000000 ____D C:\Program Files\Common Files\scanner
2016-02-21 12:39 - 2009-07-13 21:37 - 00000000 ____D C:\windows\inf
2016-02-18 12:03 - 2010-05-09 07:51 - 00727182 _____ C:\windows\system32\PerfStringBackup.INI
2016-02-17 12:21 - 2011-01-08 02:01 - 00000000 ____D C:\Users\Owner\AppData\Local\VirtualStore
2016-02-16 18:55 - 2012-03-04 13:39 - 00000000 ____D C:\Users\Owner\AppData\Roaming\SoftGrid Client
2016-02-15 12:34 - 2012-05-06 13:54 - 00796864 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe
2016-02-15 12:34 - 2012-03-05 18:56 - 00000000 ____D C:\Users\Owner\AppData\Local\Adobe
2016-02-15 12:34 - 2011-11-24 11:49 - 00142528 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl
2016-02-06 21:08 - 2009-07-13 23:33 - 00417432 _____ C:\windows\system32\FNTCACHE.DAT
2016-02-06 21:02 - 2012-05-06 13:45 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Mozilla
2016-02-06 18:55 - 2011-11-24 12:00 - 00000000 ____D C:\Users\Owner\AppData\Local\ID Vault
2016-02-06 18:55 - 2011-11-24 11:55 - 00000000 ____D C:\Users\Owner\AppData\Roaming\ID Vault
2016-02-06 18:55 - 2011-11-24 11:51 - 00000000 ____D C:\Program Files\Constant Guard Protection Suite
2016-02-06 18:36 - 2010-06-14 01:15 - 00000000 ____D C:\ProgramData\Norton
==================== Files in the root of some directories =======
2016-02-16 18:42 - 2016-02-16 18:42 - 0008440 _____ () C:\Users\Owner\AppData\Roaming\UserTile.png
2012-05-14 17:47 - 2012-05-14 17:47 - 0000000 _____ () C:\Users\Owner\AppData\Roaming\wklnhst.dat
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\dnsapi.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2013-03-06 16:58
==================== End of FRST.txt ============================
Additional scan result of Farbar Recovery Scan Tool (x86) Version:21-02-2016 01
Ran by Owner (2016-02-22 12:45:15)
Running from C:\Users\Owner\Downloads
Microsoft Windows 7 Starter Service Pack 1 (X86) (2011-01-08 07:01:34)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-955303298-3134083887-1062901272-500 - Administrator - Disabled)
Guest (S-1-5-21-955303298-3134083887-1062901272-501 - Limited - Disabled)
Owner (S-1-5-21-955303298-3134083887-1062901272-1000 - Administrator - Enabled) => C:\Users\Owner
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: avast! Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 20 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 20.0.0.306 - Adobe Systems Incorporated)
Adobe Flash Player 20 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 20.0.0.306 - Adobe Systems Incorporated)
Adobe Reader 9.3 (HKLM\...\{AC76BA86-7AD7-1033-7B44-A93000000001}) (Version: 9.3.0 - Adobe Systems Incorporated)
Atheros Driver Installation Program (HKLM\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 5.2 - Atheros)
Avast Free Antivirus (HKLM\...\Avast) (Version: 11.1.2253 - AVAST Software)
Canon MX340 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX340_series) (Version: - )
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
GuardedID (HKLM\...\{9191979D-821C-4EA8-B021-2DA1D859A7C5}) (Version: 0.03.1038 - StrikeForce Technologies, Inc)
HD Tune Pro 5.60 (HKLM\...\HD Tune Pro_is1) (Version: - EFD Software)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.14.10.2117 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - Intel Corporation)
Java(TM) 6 Update 14 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216014FF}) (Version: 6.0.140 - Sun Microsystems, Inc.)
Junk Mail filter update (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office 2010 Service Pack 1 (SP1) (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{047B0968-E622-4FAA-9B4B-121FA109EDDE}) (Version: - Microsoft)
Microsoft Office Click-to-Run 2010 (HKLM\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2010 - English (HKLM\...\{90140011-0061-0409-0000-0000000FF1CE}) (Version: 14.0.6114.5002 - Microsoft Corporation)
Microsoft Office Home and Student 2010 (HKLM\...\Office14.SingleImage) (Version: 14.0.6029.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.20125.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Works (HKLM\...\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}) (Version: 9.7.0621 - Microsoft Corporation)
Mozilla Firefox 44.0.2 (x86 en-US) (HKLM\...\Mozilla Firefox 44.0.2 (x86 en-US)) (Version: 44.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 44.0.2 - Mozilla)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
QuickTime 7 (HKLM\...\{FF59BD75-466A-4D5A-AD23-AAD87C5FD44C}) (Version: 7.79.80.95 - Apple Inc.)
Realtek Ethernet Controller Driver For Windows 7 (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.17.304.2010 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6088 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30116 - Realtek Semiconductor Corp.)
Skype™ 7.18 (HKLM\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.18.112 - Skype Technologies S.A.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.8.1 - Synaptics Incorporated)
TOSHIBA Application and Driver Installer (HKLM\...\{970472D0-F5F9-4158-A6E3-1AE49EFEF2D3}) (Version: 9.0.1.2 - TOSHIBA)
TOSHIBA Assist (HKLM\...\{12B3A009-A080-4619-9A2A-C6DB151D8D67}) (Version: 2.01.12 - TOSHIBA)
TOSHIBA Bulletin Board (HKLM\...\InstallShield_{B2FB7DBA-CEEC-41F1-BC23-3323D96290F6}) (Version: 1.6.07.32 - TOSHIBA Corporation)
TOSHIBA eco Utility (HKLM\...\InstallShield_{53536479-DFB0-47ED-9D10-43F3708C222D}) (Version: 1.2.11.0 - TOSHIBA Corporation)
TOSHIBA Flash Cards Support Utility (HKLM\...\InstallShield_{620BBA5E-F848-4D56-8BDA-584E44584C5E}) (Version: 1.63.0.5C - TOSHIBA CORPORATION)
TOSHIBA Hardware Setup (HKLM\...\InstallShield_{5279374D-87FE-4879-9385-F17278EBB9D3}) (Version: 1.63.1.19C - TOSHIBA CORPORATION)
TOSHIBA HDD Protection (HKLM\...\{94A90C69-71C1-470A-88F5-AA47ECC96B40}) (Version: 2.2.0.4 - TOSHIBA Corporation)
TOSHIBA HDD/SSD Alert (HKLM\...\InstallShield_{D4322448-B6AF-4316-B859-D8A0E84DCB38}) (Version: 3.1.0.6 - TOSHIBA Corporation)
TOSHIBA Media Controller (HKLM\...\{C7A4F26F-F9B0-41B2-8659-99181108CDE3}) (Version: 1.0.80.5 - TOSHIBA CORPORATION)
TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.6.1.0 - TOSHIBA Corporation)
TOSHIBA Quality Application (HKLM\...\{E69992ED-A7F6-406C-9280-1C156417BC49}) (Version: 1.0.3 - TOSHIBA)
TOSHIBA Recovery Media Creator (HKLM\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.1.0.4 - TOSHIBA Corporation)
TOSHIBA ReelTime (HKLM\...\InstallShield_{B894522E-C079-4DC8-A305-30BA6E2F4459}) (Version: 1.6.06.32 - TOSHIBA Corporation)
TOSHIBA Service Station (HKLM\...\{AC6569FA-6919-442A-8552-073BE69E247A}) (Version: 2.1.40 - TOSHIBA)
TOSHIBA Supervisor Password (HKLM\...\InstallShield_{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}) (Version: 1.63.0.9C - TOSHIBA CORPORATION)
TOSHIBA USB Sleep and Charge Utility (HKLM\...\{E487EE7D-EAAA-4E2A-9116-E3B477D8A74F}) (Version: 1.3.4.0 - TOSHIBA Corporation)
TOSHIBA Value Added Package (HKLM\...\InstallShield_{FEDD27A0-B306-45EF-BF58-B527406B42C8}) (Version: 1.3.6 - TOSHIBA Corporation)
TOSHIBA Web Camera Application (HKLM\...\{5E6F6CF3-BACC-4144-868C-E14622C658F3}) (Version: 1.1.1.15 - TOSHIBA Corporation)
ToshibaRegistration (HKLM\...\{5AF550B4-BB67-4E7E-82F1-2C4300279050}) (Version: 1.0.4 - Toshiba)
Utility Common Driver (Version: 1.0.52.1C - TOSHIBA) Hidden
Windows 7 Upgrade Advisor (HKLM\...\{AB05F2C8-F608-403b-95E1-FD8ADFACD31E}) (Version: 2.0.5000.0 - Microsoft Corporation)
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation)
Windows Live Sync (HKLM\...\{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}) (Version: 14.0.8089.726 - Microsoft Corporation)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {367691E2-C3F5-4B32-A02D-FF101625AA65} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2016-02-17] (AVAST Software)
Task: {39FFC4EC-002B-4C14-9875-318774CF1C73} - System32\Tasks\{070B30BE-2293-4D66-8200-71962BB2A0B6} => C:\Program Files\Common Files\microsoft shared\Virtualization Handler\CVH.EXE [2012-01-04] (Microsoft Corporation)
Task: {4DC89307-2C09-4DAD-B946-A96FE7C04CA5} - System32\Tasks\Adobe Flash Player Updater => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2016-02-15] (Adobe Systems Incorporated)
Task: {62083812-0DCA-44C1-9122-C128BD3850BB} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2016-02-17] (AVAST Software)
Task: {9DF0C236-22C7-4350-B3C8-7AD100CDAFA8} - System32\Tasks\{8AB54262-FA9A-4FBC-BDF1-F2D787F346AF} => C:\Program Files\Common Files\microsoft shared\Virtualization Handler\CVH.EXE [2012-01-04] (Microsoft Corporation)
Task: {9FD21BEE-0F47-4BCF-BA51-2C973FA9EF55} - System32\Tasks\{D3E32B6F-FF9D-45FF-BCF8-D30CFFF78069} => C:\Program Files\Common Files\microsoft shared\Virtualization Handler\CVH.EXE [2012-01-04] (Microsoft Corporation)
Task: {B55B7024-72D4-471C-8FA0-8DEA6C80CAB9} - System32\Tasks\{F896C774-270C-408E-858C-4C922E986611} => C:\Program Files\Common Files\microsoft shared\Virtualization Handler\CVH.EXE [2012-01-04] (Microsoft Corporation)
Task: {C0B1B5CF-A972-4464-AAF4-5E2F0F2D0AEB} - System32\Tasks\{B24EC4C1-67AB-47FE-B72C-BC175843088B} => Iexplore.exe hxxp://ui.skype.com/ui/0/7.18.0.112/en/abandoninstall?source=lightinstaller&page=tsBing
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
==================== Loaded Modules (Whitelisted) ==============
2016-02-17 11:45 - 2016-02-17 11:45 - 00113496 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2016-02-17 11:45 - 2016-02-17 11:45 - 00133768 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2016-02-22 11:10 - 2016-02-22 11:10 - 02835968 _____ () C:\Program Files\AVAST Software\Avast\defs\16022200\algo.dll
2016-02-17 11:45 - 2016-02-17 11:45 - 00480760 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2016-02-17 11:45 - 2016-02-17 11:45 - 40539648 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2016-02-15 12:34 - 2016-02-15 12:34 - 17891008 _____ () C:\windows\system32\Macromed\Flash\NPSWF32_20_0_0_306.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-13 21:04 - 2011-03-24 16:18 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-955303298-3134083887-1062901272-1000\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 71.10.216.1 - 71.10.216.2
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\startupreg: 00TCrdMain => %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
MSCONFIG\startupreg: HWSetup => C:\Program Files\TOSHIBA\Utilities\HWSetup.exe hwSetUP
MSCONFIG\startupreg: KeNotify => C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
MSCONFIG\startupreg: SmoothView => %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
MSCONFIG\startupreg: SVPWUTIL => C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL
MSCONFIG\startupreg: Teco => "%ProgramFiles%\TOSHIBA\TECO\Teco.exe" /r
MSCONFIG\startupreg: ThpSrv => C:\windows\system32\thpsrv /logon
MSCONFIG\startupreg: ToshibaServiceStation => "C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60
MSCONFIG\startupreg: TosNC => %ProgramFiles%\Toshiba\BulletinBoard\TosNcCore.exe
MSCONFIG\startupreg: TosReelTimeMonitor => %ProgramFiles%\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
MSCONFIG\startupreg: TosSENotify => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe
MSCONFIG\startupreg: TosVolRegulator => C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe
MSCONFIG\startupreg: TosWaitSrv => %ProgramFiles%\TOSHIBA\TPHM\TosWaitSrv.exe
MSCONFIG\startupreg: TPwrMain => %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
MSCONFIG\startupreg: TUSBSleepChargeSrv => %ProgramFiles%\TOSHIBA\TOSHIBA USB Sleep and Charge Utility\TUSBSleepChargeSrv.exe
MSCONFIG\startupreg: TWebCamera => "C:\Program Files\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{E225C826-0893-4E4C-90D9-B43F77BEA0F9}] => (Allow) C:\Program Files\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{63A385C6-CDB7-4996-9B11-8056D24F6A16}] => (Allow) svchost.exe
FirewallRules: [{34C3D07D-C033-43C1-8812-4A8179A9A5AB}] => (Allow) C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe
FirewallRules: [{D0100A44-B018-4DE2-BFE3-21337C6D13D0}] => (Allow) C:\Program Files\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{80510E33-E112-4BAF-8F20-C3108230C6F0}] => (Allow) LPort=2869
FirewallRules: [{9B5D8146-9563-4DFA-9CA9-38DB9063E131}] => (Allow) LPort=1900
FirewallRules: [{9D1EF425-2677-41AE-9B35-79D40BAA09F9}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe
FirewallRules: [{07472889-DFE1-4529-8E3E-EC56DD39519F}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{00F333B2-5739-40AC-9354-3B4F9BDBF2F7}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
==================== Restore Points =========================
17-02-2016 14:21:15 Windows Modules Installer
21-02-2016 12:05:01 Removed Apple Application Support (32-bit)
21-02-2016 12:08:13 Removed iTunes
21-02-2016 12:38:14 Removed Apple Mobile Device Support
21-02-2016 12:40:15 Removed Apple Software Update
21-02-2016 12:46:05 Removed CA Pest Patrol Realtime Protection
21-02-2016 12:48:28 Removed Bonjour
21-02-2016 14:58:30 Installed Windows 7 Upgrade Advisor
21-02-2016 15:16:29 Removed Windows 7 Upgrade Advisor
21-02-2016 15:23:57 Installed Windows 7 Upgrade Advisor
==================== Faulty Device Manager Devices =============
Could not list Devices. Check "winmgmt" service or repair WMI.
==================== Event log errors: =========================
Application errors:
==================
Error: (02/22/2016 11:08:01 AM) (Source: AntiSpywareService) (EventID: 0) (User: )
Description: Service failed on stop: Access violation at address 0047E52D in module 'ComcastAntiSpyService.exe'. Read of address 0000000C
Error: (02/21/2016 07:03:47 PM) (Source: AntiSpywareService) (EventID: 0) (User: )
Description: Service failed on shutdown: Access violation at address 0047E52D in module 'ComcastAntiSpyService.exe'. Read of address 0000000C
Error: (02/21/2016 03:12:28 PM) (Source: AntiSpywareService) (EventID: 0) (User: )
Description: Service failed on stop: Access violation at address 0047E52D in module 'ComcastAntiSpyService.exe'. Read of address 0000000C
Error: (02/21/2016 03:10:40 PM) (Source: AntiSpywareService) (EventID: 0) (User: )
Description: Service failed on shutdown: Access violation at address 0047E52D in module 'ComcastAntiSpyService.exe'. Read of address 0000000C
Error: (02/21/2016 12:54:24 PM) (Source: AntiSpywareService) (EventID: 0) (User: )
Description: Service failed on stop: Access violation at address 0047E52D in module 'ComcastAntiSpyService.exe'. Read of address 0000000C
Error: (02/21/2016 12:07:39 PM) (Source: Microsoft-Windows-RestartManager) (EventID: 10007) (User: Owner-PC)
Description: Application or service 'Apple Mobile Device' could not be restarted.
Error: (02/18/2016 12:01:20 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 713143
Error: (02/18/2016 12:01:20 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 713143
Error: (02/18/2016 12:01:20 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (02/18/2016 11:49:44 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 16411
System errors:
=============
Error: (02/22/2016 11:59:14 AM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Management Instrumentation service, but this action failed with the following error:
%%1056
Error: (02/22/2016 11:54:56 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Defender service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
Error: (02/22/2016 11:54:32 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Server service terminated unexpectedly. It has done this 3 time(s).
Error: (02/22/2016 11:54:14 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Windows Update service terminated unexpectedly. It has done this 2 time(s).
Error: (02/22/2016 11:54:14 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Management Instrumentation service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 300000 milliseconds: Restart the service.
Error: (02/22/2016 11:54:14 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Themes service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
Error: (02/22/2016 11:54:14 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The System Event Notification Service service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 300000 milliseconds: Restart the service.
Error: (02/22/2016 11:54:14 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Task Scheduler service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
Error: (02/22/2016 11:54:14 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The User Profile Service service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 300000 milliseconds: Restart the service.
Error: (02/22/2016 11:54:13 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Server service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
==================== Memory info ===========================
Processor: Intel(R) Atom(TM) CPU N455 @ 1.66GHz
Percentage of memory in use: 88%
Total physical RAM: 1013.42 MB
Available physical RAM: 116.32 MB
Total Virtual: 2189.42 MB
Available Virtual: 757.64 MB
==================== Drives ================================
Drive c: (TI105860W0F) (Fixed) (Total:223.64 GB) (Free:189.96 GB) NTFS ==>[system with boot components (obtained from drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 232.9 GB) (Disk ID: 3125EBE5)
Partition 1: (Active) - (Size=1.5 GB) - (Type=27)
Partition 2: (Not Active) - (Size=223.6 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=7.8 GB) - (Type=17)
==================== End of Addition.txt ============================
Thank you, Dennis
I just received a used netbook (Toshiba NB305-N410BL) which is running VERY slow (sometimes minutes to open a window). You fixed my problems with my old desktop last year (thank you) so I thought I would try again. I am sending the results of FRST as instructed.
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:21-02-2016 01
Ran by Owner (administrator) on OWNER-PC (22-02-2016 12:43:21)
Running from C:\Users\Owner\Downloads
Loaded Profiles: Owner (Available Profiles: Owner)
Platform: Microsoft Windows 7 Starter Service Pack 1 (X86) Language: English (United States)
Internet Explorer Version 10 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool:
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Malwarebytes) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
(Malwarebytes) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
(TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_20_0_0_306.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_20_0_0_306.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8555040 2010-04-13] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1697064 2010-03-10] (Synaptics Incorporated)
HKLM\...\Run: [GIDDesktop] => C:\Program Files\SFT\GuardedID\gidd.exe [395528 2011-07-05] (StrikeForce Technologies Inc.)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [7139768 2016-02-17] (AVAST Software)
HKU\S-1-5-21-955303298-3134083887-1062901272-1000\...\Run: [ComcastAntispyClient] => "C:\Program Files\comcasttb\ComcastSpywareScan\ComcastAntispy.exe" /hide
HKU\S-1-5-21-955303298-3134083887-1062901272-1000\...\Policies\Explorer: [NoDesktopCleanupWizard] 1
HKU\S-1-5-21-955303298-3134083887-1062901272-1000\...\MountPoints2: D - D:\LaunchU3.exe -a
HKU\S-1-5-21-955303298-3134083887-1062901272-1000\...\MountPoints2: {e4f48816-1b4f-11e0-a68e-fc79065da9a5} - D:\Customizer.exe
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2016-02-17] (AVAST Software)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 71.10.216.1 71.10.216.2
Tcpip\..\Interfaces\{C148E439-7338-4DCE-AEED-00CA63CA8E59}: [DhcpNameServer] 71.10.216.1 71.10.216.2
Internet Explorer:
==================
HKU\S-1-5-21-955303298-3134083887-1062901272-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/Toshiba/en-us
HKU\S-1-5-21-955303298-3134083887-1062901272-1000\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://laptops.toshiba.com/adps/deals-and-offers
SearchScopes: HKLM -> DefaultScope {0FDB1AB3-CAF2-46B6-97B7-8B4FB35F1931} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHTDF&pc=MATB&src=IE-SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {0FDB1AB3-CAF2-46B6-97B7-8B4FB35F1931} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHTDF&pc=MATB&src=IE-SearchBox
SearchScopes: HKU\.DEFAULT -> DefaultScope {0FDB1AB3-CAF2-46B6-97B7-8B4FB35F1931} URL =
SearchScopes: HKU\S-1-5-21-955303298-3134083887-1062901272-1000 -> DefaultScope {0B38A49E-33F2-4ABE-8B29-D4DB83E0E1A5} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHTDF&pc=MATB&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-955303298-3134083887-1062901272-1000 -> {0B38A49E-33F2-4ABE-8B29-D4DB83E0E1A5} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHTDF&pc=MATB&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-955303298-3134083887-1062901272-1000 -> {0FDB1AB3-CAF2-46B6-97B7-8B4FB35F1931} URL =
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-02-17] (AVAST Software)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-12-21] (Microsoft Corporation)
BHO: No Name -> {bb46be07-13eb-4c49-b0f0-fc78b9ea4983} -> No File
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2007-06-08] (Microsoft Corporation)
FireFox:
========
FF ProfilePath: C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\zjckzo3q.default
FF Homepage: hxxp://google.com/
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF32_20_0_0_306.dll [2016-02-15] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll [2013-01-24] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MIF5BA~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MIF5BA~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-02-17]
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2016-02-17]
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [237096 2016-02-17] (AVAST Software)
R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1513784 2015-10-05] (Malwarebytes)
R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
S3 TMachInfo; C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [51512 2009-10-06] (TOSHIBA Corporation)
R2 TOSHIBA eco Utility Service; C:\Program Files\TOSHIBA\TECO\TecoService.exe [189808 2010-04-06] (TOSHIBA Corporation)
S3 TOSHIBA HDD SSD Alert Service; C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [111960 2010-02-05] (TOSHIBA Corporation)
S3 TPCHSrv; C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe [685424 2010-03-31] (TOSHIBA Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2009-07-13] (Microsoft Corporation)
S2 AntiSpywareService; C:\Program Files\comcasttb\ComcastSpywareScan\ComcastAntiSpyService.exe [X]
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 aswHwid; C:\windows\system32\drivers\aswHwid.sys [32792 2016-02-17] (AVAST Software)
R2 aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [91168 2016-02-17] (AVAST Software)
R1 aswRdr; C:\windows\system32\drivers\aswRdr2.sys [91232 2016-02-17] (AVAST Software)
R0 aswRvrt; C:\windows\system32\Drivers\aswRvrt.sys [58776 2016-02-17] (AVAST Software)
R1 aswSnx; C:\windows\system32\drivers\aswSnx.sys [812720 2016-02-17] (AVAST Software)
R1 aswSP; C:\windows\system32\drivers\aswSP.sys [447848 2016-02-17] (AVAST Software)
R2 aswStm; C:\windows\system32\drivers\aswStm.sys [127432 2016-02-17] (AVAST Software)
R0 aswVmm; C:\windows\system32\Drivers\aswVmm.sys [221240 2016-02-17] (AVAST Software)
R1 GIDv2; C:\windows\system32\Drivers\GIDv2.sys [25232 2011-07-05] (StrikeForce Technologies, Inc.)
R0 LPCFilter; C:\windows\System32\DRIVERS\LPCFilter.sys [36208 2009-07-30] (COMPAL ELECTRONIC INC.)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [23256 2015-10-05] (Malwarebytes)
R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [170200 2016-02-22] (Malwarebytes)
R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [51928 2015-10-05] (Malwarebytes Corporation)
R3 PGEffect; C:\windows\System32\DRIVERS\pgeffect.sys [24064 2009-06-22] (TOSHIBA Corporation)
R2 TVALZFL; C:\windows\System32\DRIVERS\TVALZFL.sys [12920 2009-06-19] (TOSHIBA Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-02-22 12:21 - 2016-02-22 12:23 - 00022175 _____ C:\Users\Owner\Downloads\Addition.txt
2016-02-22 12:18 - 2016-02-22 12:43 - 00011382 _____ C:\Users\Owner\Downloads\FRST.txt
2016-02-22 12:18 - 2016-02-22 12:43 - 00000000 ____D C:\FRST
2016-02-22 12:17 - 2016-02-22 12:17 - 01722368 _____ (Farbar) C:\Users\Owner\Downloads\FRST.exe
2016-02-21 15:25 - 2016-02-21 15:25 - 00002096 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows 7 Upgrade Advisor.lnk
2016-02-21 15:25 - 2016-02-21 15:25 - 00002084 _____ C:\Users\Public\Desktop\Windows 7 Upgrade Advisor.lnk
2016-02-21 15:25 - 2016-02-21 15:25 - 00000000 ____D C:\Program Files\Microsoft Windows 7 Upgrade Advisor
2016-02-21 15:01 - 2016-02-21 15:01 - 00000000 ____D C:\Users\Owner\AppData\Local\Microsoft Corporation
2016-02-21 10:28 - 2016-02-21 10:28 - 00000000 ____D C:\Users\Owner\AppData\Roaming\HD Tune Pro
2016-02-21 10:26 - 2016-02-21 10:26 - 00001002 _____ C:\Users\Owner\Desktop\HD Tune Pro.lnk
2016-02-21 10:26 - 2016-02-21 10:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HD Tune Pro
2016-02-21 10:25 - 2016-02-21 10:26 - 00000000 ____D C:\Program Files\HD Tune Pro
2016-02-18 09:48 - 2016-02-18 09:48 - 00003544 ____N C:\bootsqm.dat
2016-02-18 08:01 - 2016-02-18 08:01 - 00000000 ____D C:\Users\Owner\AppData\Roaming\toshiba
2016-02-17 14:23 - 2016-02-17 14:23 - 01505280 _____ (Microsoft Corporation) C:\windows\system32\d3d11.dll
2016-02-17 13:27 - 2016-02-22 12:30 - 00170200 _____ (Malwarebytes) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2016-02-17 13:20 - 2016-02-17 13:20 - 00001071 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-02-17 13:20 - 2016-02-17 13:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-02-17 13:20 - 2015-10-05 09:50 - 00094936 _____ (Malwarebytes) C:\windows\system32\Drivers\mbamchameleon.sys
2016-02-17 13:20 - 2015-10-05 09:50 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2016-02-17 13:20 - 2015-10-05 09:50 - 00023256 _____ (Malwarebytes) C:\windows\system32\Drivers\mbam.sys
2016-02-17 13:19 - 2016-02-17 13:20 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware
2016-02-17 13:19 - 2016-02-17 13:19 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-02-17 13:11 - 2016-02-17 13:12 - 22908888 _____ (Malwarebytes ) C:\Users\Owner\Downloads\mbam-setup-2.2.0.1024.exe
2016-02-17 12:02 - 2016-02-21 12:44 - 00000000 ____D C:\Program Files\Google
2016-02-17 12:02 - 2016-02-21 12:43 - 00000000 ____D C:\Users\Owner\AppData\Local\Google
2016-02-17 11:55 - 2016-02-17 11:45 - 00334280 _____ (AVAST Software) C:\windows\system32\aswBoot.exe
2016-02-17 11:49 - 2016-02-17 11:49 - 00000000 ____D C:\Users\Owner\AppData\Roaming\AVAST Software
2016-02-17 11:47 - 2016-02-17 11:47 - 00002086 _____ C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2016-02-17 11:47 - 2016-02-17 11:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2016-02-17 11:46 - 2016-02-17 11:46 - 00221240 _____ (AVAST Software) C:\windows\system32\Drivers\aswVmm.sys
2016-02-17 11:46 - 2016-02-17 11:46 - 00000000 ____D C:\Program Files\Common Files\AV
2016-02-17 11:46 - 2016-02-17 11:45 - 00812720 _____ (AVAST Software) C:\windows\system32\Drivers\aswSnx.sys
2016-02-17 11:46 - 2016-02-17 11:45 - 00447848 _____ (AVAST Software) C:\windows\system32\Drivers\aswSP.sys
2016-02-17 11:46 - 2016-02-17 11:45 - 00127432 _____ (AVAST Software) C:\windows\system32\Drivers\aswStm.sys
2016-02-17 11:46 - 2016-02-17 11:45 - 00091232 _____ (AVAST Software) C:\windows\system32\Drivers\aswRdr2.sys
2016-02-17 11:46 - 2016-02-17 11:45 - 00091168 _____ (AVAST Software) C:\windows\system32\Drivers\aswMonFlt.sys
2016-02-17 11:46 - 2016-02-17 11:45 - 00058776 _____ (AVAST Software) C:\windows\system32\Drivers\aswRvrt.sys
2016-02-17 11:46 - 2016-02-17 11:45 - 00032792 _____ (AVAST Software) C:\windows\system32\Drivers\aswHwid.sys
2016-02-17 11:45 - 2016-02-17 11:45 - 00052184 _____ (AVAST Software) C:\windows\avastSS.scr
2016-02-17 11:43 - 2016-02-17 11:43 - 00000000 ____D C:\ProgramData\AVAST Software
2016-02-17 11:43 - 2016-02-17 11:43 - 00000000 ____D C:\Program Files\AVAST Software
2016-02-17 11:42 - 2016-02-17 11:42 - 05207096 _____ (AVAST Software) C:\Users\Owner\Downloads\avast_free_antivirus_setup_online.exe
2016-02-15 16:49 - 2016-02-15 16:49 - 00001826 _____ C:\Users\Public\Desktop\QuickTime Player.lnk
2016-02-15 16:49 - 2016-02-15 16:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2016-02-15 16:49 - 2016-02-15 16:49 - 00000000 ____D C:\Program Files\QuickTime
2016-02-15 16:47 - 2016-02-15 16:47 - 00000000 ____D C:\Users\Owner\AppData\LocalLow\Apple Computer
2016-02-15 16:45 - 2016-02-15 16:45 - 41896256 _____ (Apple Inc.) C:\Users\Owner\Downloads\QuickTimeInstaller.exe
2016-02-15 13:41 - 2016-02-15 13:42 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Apple Computer
2016-02-15 13:41 - 2016-02-15 13:41 - 00000000 ____D C:\Users\Owner\AppData\Local\Apple Computer
2016-02-15 13:40 - 2016-02-15 13:40 - 00000000 ____D C:\ProgramData\Apple Computer
2016-02-15 13:30 - 2016-02-15 13:30 - 00000000 ____D C:\Users\Owner\AppData\Local\Apple
2016-02-15 13:29 - 2016-02-21 12:07 - 00000000 ____D C:\ProgramData\Apple
2016-02-15 12:35 - 2016-02-15 12:35 - 00000000 ____D C:\Users\Owner\AppData\Local\Macromedia
2016-02-06 21:02 - 2016-02-15 12:22 - 00000000 ____D C:\Users\Owner\AppData\Local\Mozilla
2016-02-06 21:02 - 2016-02-06 21:02 - 00001128 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-02-06 21:02 - 2016-02-06 21:02 - 00001116 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2016-02-06 21:02 - 2016-02-06 21:02 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2016-02-06 21:01 - 2016-02-06 21:02 - 00000000 ____D C:\Program Files\Mozilla Firefox
2016-02-06 20:42 - 2014-05-14 11:23 - 01973728 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
2016-02-06 20:42 - 2014-05-14 11:23 - 00581600 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
2016-02-06 20:42 - 2014-05-14 11:23 - 00054240 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
2016-02-06 20:42 - 2014-05-14 11:23 - 00045536 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll
2016-02-06 20:42 - 2014-05-14 11:23 - 00036320 _____ (Microsoft Corporation) C:\windows\system32\wups.dll
2016-02-06 20:42 - 2014-05-14 11:17 - 02425856 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2016-02-06 20:42 - 2014-05-14 11:17 - 00092672 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
2016-02-06 20:42 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll
2016-02-06 20:42 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe
2016-02-06 19:05 - 2016-02-21 15:33 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Skype
2016-02-06 19:04 - 2016-02-06 19:05 - 00000000 ____D C:\ProgramData\Skype
2016-02-06 19:04 - 2016-02-06 19:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2016-02-06 19:04 - 2016-02-06 19:04 - 00002685 _____ C:\Users\Public\Desktop\Skype.lnk
2016-02-06 19:04 - 2016-02-06 19:04 - 00000000 ___RD C:\Program Files\Skype
2016-02-06 19:04 - 2016-02-06 19:04 - 00000000 ____D C:\Program Files\Common Files\Skype
2016-02-06 18:46 - 2016-02-06 18:46 - 00000104 _____ C:\Users\Owner\Desktop\Control Panel.lnk
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-02-22 11:55 - 2009-07-13 23:53 - 00000006 ____H C:\windows\Tasks\SA.DAT
2016-02-22 11:54 - 2009-07-13 23:53 - 00032610 _____ C:\windows\Tasks\SCHEDLGU.TXT
2016-02-22 11:45 - 2012-05-06 13:54 - 00000830 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2016-02-22 11:40 - 2009-07-13 23:34 - 00014304 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-02-22 11:40 - 2009-07-13 23:34 - 00014304 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-02-21 12:54 - 2011-11-24 11:52 - 00000000 ____D C:\Program Files\Common Files\scanner
2016-02-21 12:39 - 2009-07-13 21:37 - 00000000 ____D C:\windows\inf
2016-02-18 12:03 - 2010-05-09 07:51 - 00727182 _____ C:\windows\system32\PerfStringBackup.INI
2016-02-17 12:21 - 2011-01-08 02:01 - 00000000 ____D C:\Users\Owner\AppData\Local\VirtualStore
2016-02-16 18:55 - 2012-03-04 13:39 - 00000000 ____D C:\Users\Owner\AppData\Roaming\SoftGrid Client
2016-02-15 12:34 - 2012-05-06 13:54 - 00796864 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe
2016-02-15 12:34 - 2012-03-05 18:56 - 00000000 ____D C:\Users\Owner\AppData\Local\Adobe
2016-02-15 12:34 - 2011-11-24 11:49 - 00142528 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl
2016-02-06 21:08 - 2009-07-13 23:33 - 00417432 _____ C:\windows\system32\FNTCACHE.DAT
2016-02-06 21:02 - 2012-05-06 13:45 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Mozilla
2016-02-06 18:55 - 2011-11-24 12:00 - 00000000 ____D C:\Users\Owner\AppData\Local\ID Vault
2016-02-06 18:55 - 2011-11-24 11:55 - 00000000 ____D C:\Users\Owner\AppData\Roaming\ID Vault
2016-02-06 18:55 - 2011-11-24 11:51 - 00000000 ____D C:\Program Files\Constant Guard Protection Suite
2016-02-06 18:36 - 2010-06-14 01:15 - 00000000 ____D C:\ProgramData\Norton
==================== Files in the root of some directories =======
2016-02-16 18:42 - 2016-02-16 18:42 - 0008440 _____ () C:\Users\Owner\AppData\Roaming\UserTile.png
2012-05-14 17:47 - 2012-05-14 17:47 - 0000000 _____ () C:\Users\Owner\AppData\Roaming\wklnhst.dat
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\dnsapi.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2013-03-06 16:58
==================== End of FRST.txt ============================
Additional scan result of Farbar Recovery Scan Tool (x86) Version:21-02-2016 01
Ran by Owner (2016-02-22 12:45:15)
Running from C:\Users\Owner\Downloads
Microsoft Windows 7 Starter Service Pack 1 (X86) (2011-01-08 07:01:34)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-955303298-3134083887-1062901272-500 - Administrator - Disabled)
Guest (S-1-5-21-955303298-3134083887-1062901272-501 - Limited - Disabled)
Owner (S-1-5-21-955303298-3134083887-1062901272-1000 - Administrator - Enabled) => C:\Users\Owner
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: avast! Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 20 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 20.0.0.306 - Adobe Systems Incorporated)
Adobe Flash Player 20 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 20.0.0.306 - Adobe Systems Incorporated)
Adobe Reader 9.3 (HKLM\...\{AC76BA86-7AD7-1033-7B44-A93000000001}) (Version: 9.3.0 - Adobe Systems Incorporated)
Atheros Driver Installation Program (HKLM\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 5.2 - Atheros)
Avast Free Antivirus (HKLM\...\Avast) (Version: 11.1.2253 - AVAST Software)
Canon MX340 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX340_series) (Version: - )
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
GuardedID (HKLM\...\{9191979D-821C-4EA8-B021-2DA1D859A7C5}) (Version: 0.03.1038 - StrikeForce Technologies, Inc)
HD Tune Pro 5.60 (HKLM\...\HD Tune Pro_is1) (Version: - EFD Software)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.14.10.2117 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - Intel Corporation)
Java(TM) 6 Update 14 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216014FF}) (Version: 6.0.140 - Sun Microsystems, Inc.)
Junk Mail filter update (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office 2010 Service Pack 1 (SP1) (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{047B0968-E622-4FAA-9B4B-121FA109EDDE}) (Version: - Microsoft)
Microsoft Office Click-to-Run 2010 (HKLM\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2010 - English (HKLM\...\{90140011-0061-0409-0000-0000000FF1CE}) (Version: 14.0.6114.5002 - Microsoft Corporation)
Microsoft Office Home and Student 2010 (HKLM\...\Office14.SingleImage) (Version: 14.0.6029.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.20125.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Works (HKLM\...\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}) (Version: 9.7.0621 - Microsoft Corporation)
Mozilla Firefox 44.0.2 (x86 en-US) (HKLM\...\Mozilla Firefox 44.0.2 (x86 en-US)) (Version: 44.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 44.0.2 - Mozilla)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
QuickTime 7 (HKLM\...\{FF59BD75-466A-4D5A-AD23-AAD87C5FD44C}) (Version: 7.79.80.95 - Apple Inc.)
Realtek Ethernet Controller Driver For Windows 7 (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.17.304.2010 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6088 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30116 - Realtek Semiconductor Corp.)
Skype™ 7.18 (HKLM\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.18.112 - Skype Technologies S.A.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.8.1 - Synaptics Incorporated)
TOSHIBA Application and Driver Installer (HKLM\...\{970472D0-F5F9-4158-A6E3-1AE49EFEF2D3}) (Version: 9.0.1.2 - TOSHIBA)
TOSHIBA Assist (HKLM\...\{12B3A009-A080-4619-9A2A-C6DB151D8D67}) (Version: 2.01.12 - TOSHIBA)
TOSHIBA Bulletin Board (HKLM\...\InstallShield_{B2FB7DBA-CEEC-41F1-BC23-3323D96290F6}) (Version: 1.6.07.32 - TOSHIBA Corporation)
TOSHIBA eco Utility (HKLM\...\InstallShield_{53536479-DFB0-47ED-9D10-43F3708C222D}) (Version: 1.2.11.0 - TOSHIBA Corporation)
TOSHIBA Flash Cards Support Utility (HKLM\...\InstallShield_{620BBA5E-F848-4D56-8BDA-584E44584C5E}) (Version: 1.63.0.5C - TOSHIBA CORPORATION)
TOSHIBA Hardware Setup (HKLM\...\InstallShield_{5279374D-87FE-4879-9385-F17278EBB9D3}) (Version: 1.63.1.19C - TOSHIBA CORPORATION)
TOSHIBA HDD Protection (HKLM\...\{94A90C69-71C1-470A-88F5-AA47ECC96B40}) (Version: 2.2.0.4 - TOSHIBA Corporation)
TOSHIBA HDD/SSD Alert (HKLM\...\InstallShield_{D4322448-B6AF-4316-B859-D8A0E84DCB38}) (Version: 3.1.0.6 - TOSHIBA Corporation)
TOSHIBA Media Controller (HKLM\...\{C7A4F26F-F9B0-41B2-8659-99181108CDE3}) (Version: 1.0.80.5 - TOSHIBA CORPORATION)
TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.6.1.0 - TOSHIBA Corporation)
TOSHIBA Quality Application (HKLM\...\{E69992ED-A7F6-406C-9280-1C156417BC49}) (Version: 1.0.3 - TOSHIBA)
TOSHIBA Recovery Media Creator (HKLM\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.1.0.4 - TOSHIBA Corporation)
TOSHIBA ReelTime (HKLM\...\InstallShield_{B894522E-C079-4DC8-A305-30BA6E2F4459}) (Version: 1.6.06.32 - TOSHIBA Corporation)
TOSHIBA Service Station (HKLM\...\{AC6569FA-6919-442A-8552-073BE69E247A}) (Version: 2.1.40 - TOSHIBA)
TOSHIBA Supervisor Password (HKLM\...\InstallShield_{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}) (Version: 1.63.0.9C - TOSHIBA CORPORATION)
TOSHIBA USB Sleep and Charge Utility (HKLM\...\{E487EE7D-EAAA-4E2A-9116-E3B477D8A74F}) (Version: 1.3.4.0 - TOSHIBA Corporation)
TOSHIBA Value Added Package (HKLM\...\InstallShield_{FEDD27A0-B306-45EF-BF58-B527406B42C8}) (Version: 1.3.6 - TOSHIBA Corporation)
TOSHIBA Web Camera Application (HKLM\...\{5E6F6CF3-BACC-4144-868C-E14622C658F3}) (Version: 1.1.1.15 - TOSHIBA Corporation)
ToshibaRegistration (HKLM\...\{5AF550B4-BB67-4E7E-82F1-2C4300279050}) (Version: 1.0.4 - Toshiba)
Utility Common Driver (Version: 1.0.52.1C - TOSHIBA) Hidden
Windows 7 Upgrade Advisor (HKLM\...\{AB05F2C8-F608-403b-95E1-FD8ADFACD31E}) (Version: 2.0.5000.0 - Microsoft Corporation)
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation)
Windows Live Sync (HKLM\...\{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}) (Version: 14.0.8089.726 - Microsoft Corporation)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {367691E2-C3F5-4B32-A02D-FF101625AA65} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2016-02-17] (AVAST Software)
Task: {39FFC4EC-002B-4C14-9875-318774CF1C73} - System32\Tasks\{070B30BE-2293-4D66-8200-71962BB2A0B6} => C:\Program Files\Common Files\microsoft shared\Virtualization Handler\CVH.EXE [2012-01-04] (Microsoft Corporation)
Task: {4DC89307-2C09-4DAD-B946-A96FE7C04CA5} - System32\Tasks\Adobe Flash Player Updater => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2016-02-15] (Adobe Systems Incorporated)
Task: {62083812-0DCA-44C1-9122-C128BD3850BB} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2016-02-17] (AVAST Software)
Task: {9DF0C236-22C7-4350-B3C8-7AD100CDAFA8} - System32\Tasks\{8AB54262-FA9A-4FBC-BDF1-F2D787F346AF} => C:\Program Files\Common Files\microsoft shared\Virtualization Handler\CVH.EXE [2012-01-04] (Microsoft Corporation)
Task: {9FD21BEE-0F47-4BCF-BA51-2C973FA9EF55} - System32\Tasks\{D3E32B6F-FF9D-45FF-BCF8-D30CFFF78069} => C:\Program Files\Common Files\microsoft shared\Virtualization Handler\CVH.EXE [2012-01-04] (Microsoft Corporation)
Task: {B55B7024-72D4-471C-8FA0-8DEA6C80CAB9} - System32\Tasks\{F896C774-270C-408E-858C-4C922E986611} => C:\Program Files\Common Files\microsoft shared\Virtualization Handler\CVH.EXE [2012-01-04] (Microsoft Corporation)
Task: {C0B1B5CF-A972-4464-AAF4-5E2F0F2D0AEB} - System32\Tasks\{B24EC4C1-67AB-47FE-B72C-BC175843088B} => Iexplore.exe hxxp://ui.skype.com/ui/0/7.18.0.112/en/abandoninstall?source=lightinstaller&page=tsBing
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
==================== Loaded Modules (Whitelisted) ==============
2016-02-17 11:45 - 2016-02-17 11:45 - 00113496 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2016-02-17 11:45 - 2016-02-17 11:45 - 00133768 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2016-02-22 11:10 - 2016-02-22 11:10 - 02835968 _____ () C:\Program Files\AVAST Software\Avast\defs\16022200\algo.dll
2016-02-17 11:45 - 2016-02-17 11:45 - 00480760 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2016-02-17 11:45 - 2016-02-17 11:45 - 40539648 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2016-02-15 12:34 - 2016-02-15 12:34 - 17891008 _____ () C:\windows\system32\Macromed\Flash\NPSWF32_20_0_0_306.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-13 21:04 - 2011-03-24 16:18 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-955303298-3134083887-1062901272-1000\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 71.10.216.1 - 71.10.216.2
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\startupreg: 00TCrdMain => %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
MSCONFIG\startupreg: HWSetup => C:\Program Files\TOSHIBA\Utilities\HWSetup.exe hwSetUP
MSCONFIG\startupreg: KeNotify => C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
MSCONFIG\startupreg: SmoothView => %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
MSCONFIG\startupreg: SVPWUTIL => C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL
MSCONFIG\startupreg: Teco => "%ProgramFiles%\TOSHIBA\TECO\Teco.exe" /r
MSCONFIG\startupreg: ThpSrv => C:\windows\system32\thpsrv /logon
MSCONFIG\startupreg: ToshibaServiceStation => "C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60
MSCONFIG\startupreg: TosNC => %ProgramFiles%\Toshiba\BulletinBoard\TosNcCore.exe
MSCONFIG\startupreg: TosReelTimeMonitor => %ProgramFiles%\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
MSCONFIG\startupreg: TosSENotify => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe
MSCONFIG\startupreg: TosVolRegulator => C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe
MSCONFIG\startupreg: TosWaitSrv => %ProgramFiles%\TOSHIBA\TPHM\TosWaitSrv.exe
MSCONFIG\startupreg: TPwrMain => %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
MSCONFIG\startupreg: TUSBSleepChargeSrv => %ProgramFiles%\TOSHIBA\TOSHIBA USB Sleep and Charge Utility\TUSBSleepChargeSrv.exe
MSCONFIG\startupreg: TWebCamera => "C:\Program Files\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{E225C826-0893-4E4C-90D9-B43F77BEA0F9}] => (Allow) C:\Program Files\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{63A385C6-CDB7-4996-9B11-8056D24F6A16}] => (Allow) svchost.exe
FirewallRules: [{34C3D07D-C033-43C1-8812-4A8179A9A5AB}] => (Allow) C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe
FirewallRules: [{D0100A44-B018-4DE2-BFE3-21337C6D13D0}] => (Allow) C:\Program Files\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{80510E33-E112-4BAF-8F20-C3108230C6F0}] => (Allow) LPort=2869
FirewallRules: [{9B5D8146-9563-4DFA-9CA9-38DB9063E131}] => (Allow) LPort=1900
FirewallRules: [{9D1EF425-2677-41AE-9B35-79D40BAA09F9}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe
FirewallRules: [{07472889-DFE1-4529-8E3E-EC56DD39519F}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{00F333B2-5739-40AC-9354-3B4F9BDBF2F7}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
==================== Restore Points =========================
17-02-2016 14:21:15 Windows Modules Installer
21-02-2016 12:05:01 Removed Apple Application Support (32-bit)
21-02-2016 12:08:13 Removed iTunes
21-02-2016 12:38:14 Removed Apple Mobile Device Support
21-02-2016 12:40:15 Removed Apple Software Update
21-02-2016 12:46:05 Removed CA Pest Patrol Realtime Protection
21-02-2016 12:48:28 Removed Bonjour
21-02-2016 14:58:30 Installed Windows 7 Upgrade Advisor
21-02-2016 15:16:29 Removed Windows 7 Upgrade Advisor
21-02-2016 15:23:57 Installed Windows 7 Upgrade Advisor
==================== Faulty Device Manager Devices =============
Could not list Devices. Check "winmgmt" service or repair WMI.
==================== Event log errors: =========================
Application errors:
==================
Error: (02/22/2016 11:08:01 AM) (Source: AntiSpywareService) (EventID: 0) (User: )
Description: Service failed on stop: Access violation at address 0047E52D in module 'ComcastAntiSpyService.exe'. Read of address 0000000C
Error: (02/21/2016 07:03:47 PM) (Source: AntiSpywareService) (EventID: 0) (User: )
Description: Service failed on shutdown: Access violation at address 0047E52D in module 'ComcastAntiSpyService.exe'. Read of address 0000000C
Error: (02/21/2016 03:12:28 PM) (Source: AntiSpywareService) (EventID: 0) (User: )
Description: Service failed on stop: Access violation at address 0047E52D in module 'ComcastAntiSpyService.exe'. Read of address 0000000C
Error: (02/21/2016 03:10:40 PM) (Source: AntiSpywareService) (EventID: 0) (User: )
Description: Service failed on shutdown: Access violation at address 0047E52D in module 'ComcastAntiSpyService.exe'. Read of address 0000000C
Error: (02/21/2016 12:54:24 PM) (Source: AntiSpywareService) (EventID: 0) (User: )
Description: Service failed on stop: Access violation at address 0047E52D in module 'ComcastAntiSpyService.exe'. Read of address 0000000C
Error: (02/21/2016 12:07:39 PM) (Source: Microsoft-Windows-RestartManager) (EventID: 10007) (User: Owner-PC)
Description: Application or service 'Apple Mobile Device' could not be restarted.
Error: (02/18/2016 12:01:20 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 713143
Error: (02/18/2016 12:01:20 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 713143
Error: (02/18/2016 12:01:20 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (02/18/2016 11:49:44 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 16411
System errors:
=============
Error: (02/22/2016 11:59:14 AM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Management Instrumentation service, but this action failed with the following error:
%%1056
Error: (02/22/2016 11:54:56 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Defender service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
Error: (02/22/2016 11:54:32 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Server service terminated unexpectedly. It has done this 3 time(s).
Error: (02/22/2016 11:54:14 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Windows Update service terminated unexpectedly. It has done this 2 time(s).
Error: (02/22/2016 11:54:14 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Management Instrumentation service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 300000 milliseconds: Restart the service.
Error: (02/22/2016 11:54:14 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Themes service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
Error: (02/22/2016 11:54:14 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The System Event Notification Service service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 300000 milliseconds: Restart the service.
Error: (02/22/2016 11:54:14 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Task Scheduler service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
Error: (02/22/2016 11:54:14 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The User Profile Service service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 300000 milliseconds: Restart the service.
Error: (02/22/2016 11:54:13 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Server service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
==================== Memory info ===========================
Processor: Intel(R) Atom(TM) CPU N455 @ 1.66GHz
Percentage of memory in use: 88%
Total physical RAM: 1013.42 MB
Available physical RAM: 116.32 MB
Total Virtual: 2189.42 MB
Available Virtual: 757.64 MB
==================== Drives ================================
Drive c: (TI105860W0F) (Fixed) (Total:223.64 GB) (Free:189.96 GB) NTFS ==>[system with boot components (obtained from drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 232.9 GB) (Disk ID: 3125EBE5)
Partition 1: (Active) - (Size=1.5 GB) - (Type=27)
Partition 2: (Not Active) - (Size=223.6 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=7.8 GB) - (Type=17)
==================== End of Addition.txt ============================
Thank you, Dennis
