Solved Random .exe installer popups/system restore issues
- Thread starter KKimble
- Start date
KKimble
Posts: 63 +0
Just in case 
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 05-07-2015
Ran by Dale (administrator) on DALE-PC on 07-07-2015 21:45:29
Running from C:\Users\Dale\Desktop
Loaded Profiles: Dale (Available Profiles: Dale)
Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: English (United States)
Internet Explorer Version 9 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool:
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Agere Systems) C:\Windows\System32\agrsmsvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
() C:\Acer\Mobility Center\MobilityService.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdSync.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Windows Mobile-based device management] => C:\Windows\WindowsMobile\wmdSync.exe [215552 2008-01-20] (Microsoft Corporation)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [978520 2015-01-30] (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=1009&s=2&o=vp32&d=0109&m=aspire_5735
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3144670501-793434127-3194825423-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://ca.yahoo.com/
HKU\S-1-5-21-3144670501-793434127-3194825423-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?source...nputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3144670501-793434127-3194825423-1000 -> Yahoo! URL = http://us.search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=iobit-trans
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-06-27] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-06-27] (Oracle Corporation)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_67-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0067-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_67-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_67-windows-i586.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2001-06-21] (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704 2011-08-30] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{30457C9A-20C9-42FD-BDBB-6845B050B2E7}: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{76F0C3E0-A6F7-40CE-AC3C-0BEFA97C9E57}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{E28A700D-C329-4ADB-9C7F-07830A324F9D}: [DhcpNameServer] 172.20.10.1
FireFox:
========
FF ProfilePath: C:\Users\Dale\AppData\Roaming\Mozilla\Firefox\Profiles\pawquoac.default
FF DefaultSearchEngine: Google
FF DefaultSearchEngine.US: Google
FF Homepage: hxxp://yahoo.ca/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_18_0_0_194.dll [2015-06-27] ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1213153.dll [2014-06-24] (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2014-02-18] ()
FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-06-27] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-06-27] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: @RIM.com/WebSLLauncher,version=1.0 -> C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll [2012-07-03] ()
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2015-04-29] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL [2006-10-26] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2015-04-29] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll [2014-11-12] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll [2014-11-12] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll [2014-11-12] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll [2014-11-12] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll [2014-11-12] (Apple Inc.)
FF Extension: Adblock Plus Pop-up Addon - C:\Users\Dale\AppData\Roaming\Mozilla\Firefox\Profiles\pawquoac.default\Extensions\adblockpopups@jessehakanen.net.xpi [2015-06-11]
FF Extension: Element Hiding Helper for Adblock Plus - C:\Users\Dale\AppData\Roaming\Mozilla\Firefox\Profiles\pawquoac.default\Extensions\elemhidehelper@adblockplus.org.xpi [2014-04-10]
FF Extension: Ghostery - C:\Users\Dale\AppData\Roaming\Mozilla\Firefox\Profiles\pawquoac.default\Extensions\firefox@ghostery.com.xpi [2014-08-29]
FF Extension: Adblock Plus - C:\Users\Dale\AppData\Roaming\Mozilla\Firefox\Profiles\pawquoac.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-06-16]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-15]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S4 BUNAgentSvc; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [16384 2008-03-03] (NewTech Infosystems, Inc.) [File not signed]
S3 EpsonBidirectionalService; C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe [94208 2006-12-19] (SEIKO EPSON CORPORATION) [File not signed]
S4 EpsonCustomerParticipation; C:\Program Files\EPSON\EpsonCustomerParticipation\EPCP.exe [577088 2014-06-25] (SEIKO EPSON CORPORATION)
S3 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [61440 2007-01-17] (Hewlett-Packard Company) [File not signed]
S3 LiveUpdateSvc; C:\Program Files\IObit\LiveUpdate\LiveUpdate.exe [2724128 2015-01-16] (IObit)
S4 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation)
U2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 MobilityService; C:\Acer\Mobility Center\MobilityService.exe [110592 2007-12-06] () [File not signed]
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22184 2015-01-30] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [284472 2015-01-30] (Microsoft Corporation)
S4 NTISchedulerSvc; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [131072 2008-04-04] () [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-20] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2008-12-13] () [File not signed]
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-06-18] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [98520 2015-07-01] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-06-18] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [239224 2014-11-15] (Microsoft Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-20] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-07 21:45 - 2015-07-07 21:45 - 00011215 _____ C:\Users\Dale\Desktop\FRST.txt
2015-07-07 21:45 - 2015-07-07 21:45 - 00000000 ____D C:\FRST
2015-07-07 21:44 - 2015-07-07 21:44 - 01636352 _____ (Farbar) C:\Users\Dale\Desktop\FRST.exe
2015-07-07 21:36 - 2015-07-07 21:36 - 00002989 _____ C:\Users\Dale\Desktop\Disk Doctor report.log
2015-07-03 18:36 - 2015-07-03 18:36 - 00001830 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2015-06-29 19:05 - 2015-06-29 19:05 - 00000000 _____ C:\Users\Dale\AppData\Roaming\wklnhst.dat
2015-06-27 15:07 - 2015-06-27 15:08 - 00002083 _____ C:\DelFix.txt
2015-06-27 15:07 - 2015-06-27 15:07 - 00000000 ____D C:\Windows\ERUNT
2015-06-27 14:59 - 2015-06-27 14:59 - 00000000 ____D C:\Program Files\Common Files\Java
2015-06-27 12:39 - 2015-06-27 12:40 - 00000000 ____D C:\ProgramData\Sophos
2015-06-27 12:37 - 2015-06-27 12:39 - 00002577 _____ C:\Users\Public\Desktop\Sophos Virus Removal Tool.lnk
2015-06-27 12:37 - 2015-06-27 12:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sophos
2015-06-27 12:36 - 2015-06-27 12:36 - 00000000 ____D C:\Program Files\Sophos
2015-06-25 00:28 - 2015-06-25 00:28 - 00000000 ____D C:\Users\Dale\AppData\Roaming\ProductData
2015-06-24 23:53 - 2015-06-25 00:43 - 00000000 ____D C:\Windows\erdnt
2015-06-24 22:17 - 2015-06-24 22:17 - 00000207 _____ C:\Windows\tweaking.com-regbackup-DALE-PC-Windows-Vista-(TM)-Home-Premium-(32-bit).dat
2015-06-24 22:04 - 2015-06-24 22:04 - 00001805 _____ C:\first scan.txt
2015-06-24 21:33 - 2015-07-01 03:03 - 00098520 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-06-24 21:32 - 2015-07-07 20:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-06-24 21:32 - 2015-07-07 20:14 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware
2015-06-24 21:32 - 2015-07-01 01:49 - 00000903 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-06-24 21:32 - 2015-06-24 21:32 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-06-24 21:32 - 2015-06-18 08:41 - 00094936 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-06-24 21:32 - 2015-06-18 08:41 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-06-24 21:32 - 2015-06-18 08:41 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-06-24 21:17 - 2015-06-24 21:53 - 00000000 ____D C:\ProgramData\RogueKiller
2015-06-24 21:17 - 2015-06-24 21:17 - 00035064 _____ C:\Windows\system32\Drivers\TrueSight.sys
2015-06-10 03:02 - 2015-04-24 11:54 - 00532480 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2015-06-10 03:01 - 2015-05-21 10:22 - 02066432 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-06-09 19:50 - 2015-05-08 19:08 - 00894464 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-06-09 19:47 - 2015-05-30 20:03 - 12385280 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-06-09 19:47 - 2015-05-30 19:55 - 01809920 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-06-09 19:47 - 2015-05-30 19:54 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-06-09 19:47 - 2015-05-30 19:53 - 09750528 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-06-09 19:47 - 2015-05-30 19:50 - 01139712 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-06-09 19:47 - 2015-05-30 19:49 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-06-09 19:47 - 2015-05-30 19:49 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-06-09 19:47 - 2015-05-30 19:49 - 00718336 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-06-09 19:47 - 2015-05-30 19:49 - 00421888 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-06-09 19:47 - 2015-05-30 19:48 - 01804288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-06-09 19:47 - 2015-05-30 19:48 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-06-09 19:47 - 2015-05-30 19:48 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-06-09 19:47 - 2015-05-30 19:48 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-06-09 19:47 - 2015-05-30 19:48 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-06-09 19:47 - 2015-05-30 19:48 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-06-09 19:47 - 2015-05-30 19:48 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-06-09 19:47 - 2015-05-30 19:48 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-06-09 19:47 - 2015-05-30 19:47 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-06-09 19:47 - 2015-05-30 19:47 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-06-09 19:47 - 2015-05-30 19:47 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-06-09 19:47 - 2015-05-30 19:47 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-06-09 19:47 - 2015-05-30 19:47 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-06-09 19:45 - 2015-05-04 18:51 - 10628608 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-06-09 19:45 - 2015-05-04 18:50 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-06-09 19:45 - 2015-05-04 18:50 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-06-09 19:45 - 2015-05-04 18:50 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-06-09 19:45 - 2015-05-04 17:21 - 08147456 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-07 21:33 - 2009-01-26 05:20 - 01547071 _____ C:\Windows\WindowsUpdate.log
2015-07-07 21:06 - 2014-12-12 00:30 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-07-07 20:23 - 2006-11-02 06:33 - 00759582 _____ C:\Windows\system32\PerfStringBackup.INI
2015-07-07 20:20 - 2006-11-02 08:47 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-07-07 20:20 - 2006-11-02 08:47 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-07-07 20:17 - 2011-02-05 23:19 - 00000000 ____D C:\Program Files\Microsoft Security Client
2015-07-07 20:17 - 2006-11-02 09:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-07 20:14 - 2014-09-20 00:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-07-07 20:14 - 2014-09-20 00:49 - 00000000 ____D C:\Program Files\Common Files\Skype
2015-07-07 20:14 - 2009-09-23 00:20 - 00000000 ___RD C:\Program Files\Skype
2015-07-07 20:14 - 2009-01-25 16:27 - 00000000 ____D C:\Users\Dale
2015-07-07 20:14 - 2006-11-02 07:18 - 00000000 ____D C:\Windows\system32\spool
2015-07-07 20:14 - 2006-11-02 07:18 - 00000000 ____D C:\Windows\registration
2015-07-07 20:14 - 2006-11-02 06:22 - 51642368 _____ C:\Windows\system32\config\software_previous
2015-07-07 20:14 - 2006-11-02 06:22 - 46399488 _____ C:\Windows\system32\config\components_previous
2015-07-07 20:14 - 2006-11-02 06:22 - 39321600 _____ C:\Windows\system32\config\system_previous
2015-07-07 20:14 - 2006-11-02 06:22 - 00524288 _____ C:\Windows\system32\config\default_previous
2015-07-07 20:14 - 2006-11-02 06:22 - 00057344 _____ C:\Windows\system32\config\sam_previous
2015-07-07 20:14 - 2006-11-02 06:22 - 00024576 _____ C:\Windows\system32\config\security_previous
2015-07-07 19:35 - 2015-06-02 22:58 - 00000000 ____D C:\Program Files\Mozilla Firefox
2015-07-07 19:30 - 2009-08-28 14:41 - 00000000 ____D C:\Program Files\Zune
2015-07-07 19:30 - 2008-04-30 05:37 - 00000000 ____D C:\ProgramData\SiteAdvisor
2015-07-07 19:30 - 2008-04-30 04:09 - 00000000 ____D C:\Acer
2015-07-07 19:20 - 2009-01-25 16:30 - 00000000 ____D C:\Users\Dale\AppData\Local\Google
2015-07-07 19:06 - 2009-09-23 00:20 - 00000000 ____D C:\ProgramData\Skype
2015-07-06 14:36 - 2014-12-02 19:02 - 00000000 ____D C:\Users\Dale\Desktop\Price Match
2015-07-05 06:11 - 2010-01-08 18:10 - 00246952 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-07-04 15:42 - 2012-09-20 14:14 - 00000000 ____D C:\Users\Dale\.frostwire5
2015-07-03 18:41 - 2006-11-02 09:01 - 00032646 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-07-03 18:38 - 2014-04-24 01:12 - 00001945 _____ C:\Windows\epplauncher.mif
2015-06-28 01:57 - 2008-04-30 05:38 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-06-28 00:04 - 2013-12-03 04:28 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-06-27 15:03 - 2014-07-17 00:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-06-27 15:02 - 2009-01-26 23:00 - 00000000 ____D C:\Users\Dale\AppData\Local\Adobe
2015-06-27 15:00 - 2014-10-28 03:12 - 00000000 ____D C:\ProgramData\Oracle
2015-06-27 14:58 - 2015-02-28 15:00 - 00096352 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2015-06-27 14:58 - 2012-12-18 21:04 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-06-27 14:58 - 2011-08-04 07:04 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-06-27 14:57 - 2010-06-18 17:25 - 00000000 ____D C:\Program Files\Java
2015-06-27 14:56 - 2012-12-18 21:40 - 00002425 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2015-06-27 14:55 - 2009-01-25 16:43 - 00000000 ____D C:\Program Files\Common Files\Adobe
2015-06-25 00:43 - 2011-07-17 07:44 - 00229980 _____ C:\Windows\PFRO.log
2015-06-25 00:43 - 2006-11-02 06:23 - 00000215 _____ C:\Windows\system.ini
2015-06-25 00:19 - 2006-11-02 07:18 - 00000000 __RHD C:\Users\Default
2015-06-25 00:19 - 2006-11-02 07:18 - 00000000 ___RD C:\Users\Public
2015-06-24 21:59 - 2015-04-10 16:22 - 00000000 ____D C:\Program Files\FrostWire
2015-06-24 21:59 - 2006-11-02 07:18 - 00000000 ____D C:\Windows\security
2015-06-24 20:54 - 2010-08-08 19:08 - 00000000 ____D C:\Program Files\AVG
2015-06-22 23:33 - 2006-11-02 07:18 - 00000000 ____D C:\Windows\rescache
2015-06-10 17:22 - 2006-11-02 08:47 - 00298656 _____ C:\Windows\system32\FNTCACHE.DAT
2015-06-09 19:46 - 2013-07-20 02:29 - 00000000 ____D C:\Windows\system32\MRT
2015-06-09 19:46 - 2006-11-02 06:24 - 136900096 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
==================== Files in the root of some directories =======
2015-06-29 19:05 - 2015-06-29 19:05 - 0000000 _____ () C:\Users\Dale\AppData\Roaming\wklnhst.dat
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-07-07 20:32
==================== End of log ============================
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 05-07-2015
Ran by Dale (administrator) on DALE-PC on 07-07-2015 21:45:29
Running from C:\Users\Dale\Desktop
Loaded Profiles: Dale (Available Profiles: Dale)
Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: English (United States)
Internet Explorer Version 9 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool:
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Agere Systems) C:\Windows\System32\agrsmsvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
() C:\Acer\Mobility Center\MobilityService.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdSync.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Windows Mobile-based device management] => C:\Windows\WindowsMobile\wmdSync.exe [215552 2008-01-20] (Microsoft Corporation)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [978520 2015-01-30] (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=1009&s=2&o=vp32&d=0109&m=aspire_5735
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3144670501-793434127-3194825423-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://ca.yahoo.com/
HKU\S-1-5-21-3144670501-793434127-3194825423-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?source...nputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3144670501-793434127-3194825423-1000 -> Yahoo! URL = http://us.search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=iobit-trans
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-06-27] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-06-27] (Oracle Corporation)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_67-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0067-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_67-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_67-windows-i586.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2001-06-21] (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704 2011-08-30] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{30457C9A-20C9-42FD-BDBB-6845B050B2E7}: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{76F0C3E0-A6F7-40CE-AC3C-0BEFA97C9E57}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{E28A700D-C329-4ADB-9C7F-07830A324F9D}: [DhcpNameServer] 172.20.10.1
FireFox:
========
FF ProfilePath: C:\Users\Dale\AppData\Roaming\Mozilla\Firefox\Profiles\pawquoac.default
FF DefaultSearchEngine: Google
FF DefaultSearchEngine.US: Google
FF Homepage: hxxp://yahoo.ca/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_18_0_0_194.dll [2015-06-27] ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1213153.dll [2014-06-24] (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2014-02-18] ()
FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-06-27] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-06-27] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: @RIM.com/WebSLLauncher,version=1.0 -> C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll [2012-07-03] ()
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2015-04-29] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL [2006-10-26] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2015-04-29] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll [2014-11-12] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll [2014-11-12] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll [2014-11-12] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll [2014-11-12] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll [2014-11-12] (Apple Inc.)
FF Extension: Adblock Plus Pop-up Addon - C:\Users\Dale\AppData\Roaming\Mozilla\Firefox\Profiles\pawquoac.default\Extensions\adblockpopups@jessehakanen.net.xpi [2015-06-11]
FF Extension: Element Hiding Helper for Adblock Plus - C:\Users\Dale\AppData\Roaming\Mozilla\Firefox\Profiles\pawquoac.default\Extensions\elemhidehelper@adblockplus.org.xpi [2014-04-10]
FF Extension: Ghostery - C:\Users\Dale\AppData\Roaming\Mozilla\Firefox\Profiles\pawquoac.default\Extensions\firefox@ghostery.com.xpi [2014-08-29]
FF Extension: Adblock Plus - C:\Users\Dale\AppData\Roaming\Mozilla\Firefox\Profiles\pawquoac.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-06-16]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-15]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S4 BUNAgentSvc; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [16384 2008-03-03] (NewTech Infosystems, Inc.) [File not signed]
S3 EpsonBidirectionalService; C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe [94208 2006-12-19] (SEIKO EPSON CORPORATION) [File not signed]
S4 EpsonCustomerParticipation; C:\Program Files\EPSON\EpsonCustomerParticipation\EPCP.exe [577088 2014-06-25] (SEIKO EPSON CORPORATION)
S3 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [61440 2007-01-17] (Hewlett-Packard Company) [File not signed]
S3 LiveUpdateSvc; C:\Program Files\IObit\LiveUpdate\LiveUpdate.exe [2724128 2015-01-16] (IObit)
S4 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation)
U2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 MobilityService; C:\Acer\Mobility Center\MobilityService.exe [110592 2007-12-06] () [File not signed]
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22184 2015-01-30] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [284472 2015-01-30] (Microsoft Corporation)
S4 NTISchedulerSvc; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [131072 2008-04-04] () [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-20] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2008-12-13] () [File not signed]
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-06-18] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [98520 2015-07-01] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-06-18] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [239224 2014-11-15] (Microsoft Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-20] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-07 21:45 - 2015-07-07 21:45 - 00011215 _____ C:\Users\Dale\Desktop\FRST.txt
2015-07-07 21:45 - 2015-07-07 21:45 - 00000000 ____D C:\FRST
2015-07-07 21:44 - 2015-07-07 21:44 - 01636352 _____ (Farbar) C:\Users\Dale\Desktop\FRST.exe
2015-07-07 21:36 - 2015-07-07 21:36 - 00002989 _____ C:\Users\Dale\Desktop\Disk Doctor report.log
2015-07-03 18:36 - 2015-07-03 18:36 - 00001830 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2015-06-29 19:05 - 2015-06-29 19:05 - 00000000 _____ C:\Users\Dale\AppData\Roaming\wklnhst.dat
2015-06-27 15:07 - 2015-06-27 15:08 - 00002083 _____ C:\DelFix.txt
2015-06-27 15:07 - 2015-06-27 15:07 - 00000000 ____D C:\Windows\ERUNT
2015-06-27 14:59 - 2015-06-27 14:59 - 00000000 ____D C:\Program Files\Common Files\Java
2015-06-27 12:39 - 2015-06-27 12:40 - 00000000 ____D C:\ProgramData\Sophos
2015-06-27 12:37 - 2015-06-27 12:39 - 00002577 _____ C:\Users\Public\Desktop\Sophos Virus Removal Tool.lnk
2015-06-27 12:37 - 2015-06-27 12:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sophos
2015-06-27 12:36 - 2015-06-27 12:36 - 00000000 ____D C:\Program Files\Sophos
2015-06-25 00:28 - 2015-06-25 00:28 - 00000000 ____D C:\Users\Dale\AppData\Roaming\ProductData
2015-06-24 23:53 - 2015-06-25 00:43 - 00000000 ____D C:\Windows\erdnt
2015-06-24 22:17 - 2015-06-24 22:17 - 00000207 _____ C:\Windows\tweaking.com-regbackup-DALE-PC-Windows-Vista-(TM)-Home-Premium-(32-bit).dat
2015-06-24 22:04 - 2015-06-24 22:04 - 00001805 _____ C:\first scan.txt
2015-06-24 21:33 - 2015-07-01 03:03 - 00098520 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-06-24 21:32 - 2015-07-07 20:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-06-24 21:32 - 2015-07-07 20:14 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware
2015-06-24 21:32 - 2015-07-01 01:49 - 00000903 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-06-24 21:32 - 2015-06-24 21:32 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-06-24 21:32 - 2015-06-18 08:41 - 00094936 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-06-24 21:32 - 2015-06-18 08:41 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-06-24 21:32 - 2015-06-18 08:41 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-06-24 21:17 - 2015-06-24 21:53 - 00000000 ____D C:\ProgramData\RogueKiller
2015-06-24 21:17 - 2015-06-24 21:17 - 00035064 _____ C:\Windows\system32\Drivers\TrueSight.sys
2015-06-10 03:02 - 2015-04-24 11:54 - 00532480 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2015-06-10 03:01 - 2015-05-21 10:22 - 02066432 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-06-09 19:50 - 2015-05-08 19:08 - 00894464 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-06-09 19:47 - 2015-05-30 20:03 - 12385280 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-06-09 19:47 - 2015-05-30 19:55 - 01809920 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-06-09 19:47 - 2015-05-30 19:54 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-06-09 19:47 - 2015-05-30 19:53 - 09750528 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-06-09 19:47 - 2015-05-30 19:50 - 01139712 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-06-09 19:47 - 2015-05-30 19:49 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-06-09 19:47 - 2015-05-30 19:49 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-06-09 19:47 - 2015-05-30 19:49 - 00718336 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-06-09 19:47 - 2015-05-30 19:49 - 00421888 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-06-09 19:47 - 2015-05-30 19:48 - 01804288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-06-09 19:47 - 2015-05-30 19:48 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-06-09 19:47 - 2015-05-30 19:48 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-06-09 19:47 - 2015-05-30 19:48 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-06-09 19:47 - 2015-05-30 19:48 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-06-09 19:47 - 2015-05-30 19:48 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-06-09 19:47 - 2015-05-30 19:48 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-06-09 19:47 - 2015-05-30 19:48 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-06-09 19:47 - 2015-05-30 19:47 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-06-09 19:47 - 2015-05-30 19:47 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-06-09 19:47 - 2015-05-30 19:47 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-06-09 19:47 - 2015-05-30 19:47 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-06-09 19:47 - 2015-05-30 19:47 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-06-09 19:45 - 2015-05-04 18:51 - 10628608 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-06-09 19:45 - 2015-05-04 18:50 - 00007680 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-06-09 19:45 - 2015-05-04 18:50 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-06-09 19:45 - 2015-05-04 18:50 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-06-09 19:45 - 2015-05-04 17:21 - 08147456 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-07 21:33 - 2009-01-26 05:20 - 01547071 _____ C:\Windows\WindowsUpdate.log
2015-07-07 21:06 - 2014-12-12 00:30 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-07-07 20:23 - 2006-11-02 06:33 - 00759582 _____ C:\Windows\system32\PerfStringBackup.INI
2015-07-07 20:20 - 2006-11-02 08:47 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-07-07 20:20 - 2006-11-02 08:47 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-07-07 20:17 - 2011-02-05 23:19 - 00000000 ____D C:\Program Files\Microsoft Security Client
2015-07-07 20:17 - 2006-11-02 09:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-07 20:14 - 2014-09-20 00:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-07-07 20:14 - 2014-09-20 00:49 - 00000000 ____D C:\Program Files\Common Files\Skype
2015-07-07 20:14 - 2009-09-23 00:20 - 00000000 ___RD C:\Program Files\Skype
2015-07-07 20:14 - 2009-01-25 16:27 - 00000000 ____D C:\Users\Dale
2015-07-07 20:14 - 2006-11-02 07:18 - 00000000 ____D C:\Windows\system32\spool
2015-07-07 20:14 - 2006-11-02 07:18 - 00000000 ____D C:\Windows\registration
2015-07-07 20:14 - 2006-11-02 06:22 - 51642368 _____ C:\Windows\system32\config\software_previous
2015-07-07 20:14 - 2006-11-02 06:22 - 46399488 _____ C:\Windows\system32\config\components_previous
2015-07-07 20:14 - 2006-11-02 06:22 - 39321600 _____ C:\Windows\system32\config\system_previous
2015-07-07 20:14 - 2006-11-02 06:22 - 00524288 _____ C:\Windows\system32\config\default_previous
2015-07-07 20:14 - 2006-11-02 06:22 - 00057344 _____ C:\Windows\system32\config\sam_previous
2015-07-07 20:14 - 2006-11-02 06:22 - 00024576 _____ C:\Windows\system32\config\security_previous
2015-07-07 19:35 - 2015-06-02 22:58 - 00000000 ____D C:\Program Files\Mozilla Firefox
2015-07-07 19:30 - 2009-08-28 14:41 - 00000000 ____D C:\Program Files\Zune
2015-07-07 19:30 - 2008-04-30 05:37 - 00000000 ____D C:\ProgramData\SiteAdvisor
2015-07-07 19:30 - 2008-04-30 04:09 - 00000000 ____D C:\Acer
2015-07-07 19:20 - 2009-01-25 16:30 - 00000000 ____D C:\Users\Dale\AppData\Local\Google
2015-07-07 19:06 - 2009-09-23 00:20 - 00000000 ____D C:\ProgramData\Skype
2015-07-06 14:36 - 2014-12-02 19:02 - 00000000 ____D C:\Users\Dale\Desktop\Price Match
2015-07-05 06:11 - 2010-01-08 18:10 - 00246952 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-07-04 15:42 - 2012-09-20 14:14 - 00000000 ____D C:\Users\Dale\.frostwire5
2015-07-03 18:41 - 2006-11-02 09:01 - 00032646 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-07-03 18:38 - 2014-04-24 01:12 - 00001945 _____ C:\Windows\epplauncher.mif
2015-06-28 01:57 - 2008-04-30 05:38 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-06-28 00:04 - 2013-12-03 04:28 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-06-27 15:03 - 2014-07-17 00:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-06-27 15:02 - 2009-01-26 23:00 - 00000000 ____D C:\Users\Dale\AppData\Local\Adobe
2015-06-27 15:00 - 2014-10-28 03:12 - 00000000 ____D C:\ProgramData\Oracle
2015-06-27 14:58 - 2015-02-28 15:00 - 00096352 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2015-06-27 14:58 - 2012-12-18 21:04 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-06-27 14:58 - 2011-08-04 07:04 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-06-27 14:57 - 2010-06-18 17:25 - 00000000 ____D C:\Program Files\Java
2015-06-27 14:56 - 2012-12-18 21:40 - 00002425 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2015-06-27 14:55 - 2009-01-25 16:43 - 00000000 ____D C:\Program Files\Common Files\Adobe
2015-06-25 00:43 - 2011-07-17 07:44 - 00229980 _____ C:\Windows\PFRO.log
2015-06-25 00:43 - 2006-11-02 06:23 - 00000215 _____ C:\Windows\system.ini
2015-06-25 00:19 - 2006-11-02 07:18 - 00000000 __RHD C:\Users\Default
2015-06-25 00:19 - 2006-11-02 07:18 - 00000000 ___RD C:\Users\Public
2015-06-24 21:59 - 2015-04-10 16:22 - 00000000 ____D C:\Program Files\FrostWire
2015-06-24 21:59 - 2006-11-02 07:18 - 00000000 ____D C:\Windows\security
2015-06-24 20:54 - 2010-08-08 19:08 - 00000000 ____D C:\Program Files\AVG
2015-06-22 23:33 - 2006-11-02 07:18 - 00000000 ____D C:\Windows\rescache
2015-06-10 17:22 - 2006-11-02 08:47 - 00298656 _____ C:\Windows\system32\FNTCACHE.DAT
2015-06-09 19:46 - 2013-07-20 02:29 - 00000000 ____D C:\Windows\system32\MRT
2015-06-09 19:46 - 2006-11-02 06:24 - 136900096 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
==================== Files in the root of some directories =======
2015-06-29 19:05 - 2015-06-29 19:05 - 0000000 _____ () C:\Users\Dale\AppData\Roaming\wklnhst.dat
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-07-07 20:32
==================== End of log ============================
KKimble
Posts: 63 +0
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 05-07-2015
Ran by Dale at 2015-07-07 21:46:21
Running from C:\Users\Dale\Desktop
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-3144670501-793434127-3194825423-500 - Administrator - Disabled)
Dale (S-1-5-21-3144670501-793434127-3194825423-1000 - Administrator - Enabled) => C:\Users\Dale
Guest (S-1-5-21-3144670501-793434127-3194825423-501 - Limited - Disabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Acer Crystal Eye Webcam 2.0.8 (HKLM\...\{A77255C4-AFCB-44A3-BF0F-2091A71FFD9E}) (Version: 2.0.8 - SuYin)
Acer Mobility Center Plug-In (HKLM\...\{11316260-6666-467B-AC34-183FCB5D4335}) (Version: 3.0.3000 - Acer Inc.)
Acer Registration (HKLM\...\Acer Registration) (Version: - Acer - Leader Technologies)
Adobe AIR (HKLM\...\Adobe AIR) (Version: 1.0.4990 - Adobe Systems Inc.)
Adobe Flash Player 10 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 10.0.42.34 - Adobe Systems Incorporated)
Adobe Flash Player 18 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 18.0.0.194 - Adobe Systems Incorporated)
Adobe Reader X (10.1.14) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.14 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM\...\Adobe Shockwave Player) (Version: 12.1.3.153 - Adobe Systems, Inc.)
Advanced SystemCare 3 (HKLM\...\Advanced SystemCare 3_is1) (Version: 3.7.3 - IObit)
Agere Systems HDA Modem (HKLM\...\Agere Systems Soft Modem) (Version: - Agere Systems)
Apple Application Support (HKLM\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{235EBB33-3DA1-46DF-AADE-9955123409CB}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
BearShare (HKLM\...\BearShare) (Version: 12.0.0.134600 - Musiclab, LLC)
BlackBerry Desktop Software 7.1 (HKLM\...\BlackBerry_Desktop) (Version: 7.1.0.32 - Research In Motion Ltd.)
BlackBerry Desktop Software 7.1 (Version: 7.1.0.32 - Research In Motion Ltd.) Hidden
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
EPSON Artisan 730 Series Printer Uninstall (HKLM\...\EPSON Artisan 730 Series) (Version: - SEIKO EPSON Corporation)
Epson Customer Participation (HKLM\...\{814FA673-A085-403C-9545-747FC1495069}) (Version: 1.0.0.0 - SEIKO EPSON CORPORATION)
Epson Event Manager (HKLM\...\{8ED43F7E-A8F6-4898-AF11-B6158F2EDF94}) (Version: 2.50.0000 - SEIKO EPSON CORPORATION)
EpsonNet Print (HKLM\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.4j - SEIKO EPSON CORPORATION)
Facebook Video Calling 2.0.0.447 (HKLM\...\{8DF41A9F-FE13-43E8-A003-5F9B55A011EE}) (Version: 2.0.447 - Skype Limited)
FrostWire 6.0.7 (HKLM\...\FrostWire 6) (Version: 6.0.7.4 - FrostWire LLC)
GearDrvs (Version: 1.00.0000 - GEAR Software) Hidden
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: - Intel Corporation)
iTunes (HKLM\...\{5D928931-D1D2-4A93-A82D-BF60D0E7CFA5}) (Version: 12.0.1.26 - Apple Inc.)
Java 8 Update 45 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
Launch Manager (HKLM\...\LManager) (Version: - )
LightScribe 1.4.142.1 (Version: 1.4.142.1 - http://www.lightscribe.com) Hidden
Malwarebytes Anti-Malware version 2.1.8.1057 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Marvell Miniport Driver (HKLM\...\Marvell Miniport Driver) (Version: 10.55.3.3 - Marvell)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.7.205.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Works (HKLM\...\{6D52C408-B09A-4520-9B18-475B81D393F1}) (Version: 08.05.0818 - Microsoft Corporation)
Mozilla Firefox 38.0.5 (x86 en-US) (HKLM\...\Mozilla Firefox 38.0.5 (x86 en-US)) (Version: 38.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
NTI Backup Now 5 (HKLM\...\InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}) (Version: 5.1.2.503 - NewTech Infosystems)
NTI Backup Now Standard (Version: 5.1.2.503 - NewTech Infosystems) Hidden
NTI Media Maker 8 (HKLM\...\InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}) (Version: 8.0.2.6322 - NewTech Infosystems)
NTI Media Maker 8 (Version: 8.0.2.6322 - NewTech Infosystems) Hidden
QuickTime 7 (HKLM\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6167 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM\...\{DC24971E-1946-445D-8A82-CE685433FA7D}) (Version: 3.0.1.3 - Realtek Semiconductor Corp.)
Skype™ 7.0 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Sophos Virus Removal Tool (HKLM\...\{B829E117-D072-41EA-9606-9826A38D34C1}) (Version: 2.5.4 - Sophos Limited)
StudioTax 2013 (HKLM\...\{8D18F314-6668-4E2F-936A-70025F2D40C7}) (Version: 9.1.7.0 - BHOK IT Consulting)
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 11.1.4.0 - Synaptics)
System Requirements Lab CYRI (HKLM\...\{1F77C418-2C90-459C-BD33-B56A4182B9FA}) (Version: 4.4.26.0 - Husdawg, LLC)
TeamViewer 9 (HKLM\...\TeamViewer 9) (Version: 9.0.32494 - TeamViewer)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Windows Media Player Firefox Plugin (HKLM\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
WinRAR archiver (HKLM\...\WinRAR archiver) (Version: - )
Zune (HKLM\...\Zune) (Version: 04.07.1404.01 - Microsoft Corporation)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== Restore Points =========================
27-06-2015 15:07:40 End of disinfection
28-06-2015 01:51:58 Windows Update
30-06-2015 01:02:36 Scheduled Checkpoint
02-07-2015 00:44:46 Scheduled Checkpoint
02-07-2015 01:54:15 Windows Update
03-07-2015 01:55:03 Scheduled Checkpoint
03-07-2015 18:17:42 Windows Update
04-07-2015 03:00:16 Windows Update
05-07-2015 03:36:01 Scheduled Checkpoint
05-07-2015 23:06:13 Scheduled Checkpoint
07-07-2015 00:40:50 Scheduled Checkpoint
07-07-2015 18:25:40 Windows Update
07-07-2015 19:01:07 Removed Facebook Video Calling 2.0.0.447
07-07-2015 19:03:03 Removed Facebook Video Calling 2.0.0.447
07-07-2015 19:05:33 Removed Skype™ 7.0
07-07-2015 19:07:17 Removed Facebook Video Calling 2.0.0.447
07-07-2015 19:41:44 Restore Operation
07-07-2015 20:00:19 Windows Update
07-07-2015 20:11:01 Restore Operation
07-07-2015 20:32:23 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2006-11-02 06:23 - 2015-06-25 00:43 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {014FD605-8F9E-48D2-B4DC-1AF40E6FC5B0} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-06-12] (Adobe Systems Incorporated)
Task: {88C17DE1-2F8C-4D25-A035-2067152EFB7C} - System32\Tasks\{459B19C3-ADE4-4DA6-AE75-AB606A76100D} => pcalua.exe -a C:\Users\Dale\Pictures\MP10Setup.exe -d "C:\Program Files\Mozilla Firefox"
Task: {8B138EAB-A157-41D7-B89A-C41E6A4D3492} - System32\Tasks\{AE2DA9EE-362D-4A49-8FE4-20E9561F5F22} => C:\Program Files\Skype\Phone\Skype.exe [2014-12-11] (Skype Technologies S.A.)
Task: {9CFFFDF0-6AF6-42B4-8AA9-AFABB39505E3} - System32\Tasks\{C6D949DF-AE47-48EF-87EE-B54BD9AC7D12} => pcalua.exe -a C:\Users\Dale\Pictures\MP10Setup.exe -d "C:\Program Files\Mozilla Firefox"
Task: {A462787A-EAA5-4DB5-879D-7CD2E66A4782} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Dale => C:\Program Files\Windows Calendar\WinCal.exe [2009-04-11] (Microsoft Corporation)
Task: {A4BADB48-0AFE-427C-9405-43F51308F095} - System32\Tasks\{FFF16A5D-303A-4AA0-AA20-82DC0D1E162E} => pcalua.exe -a E:\Sims2DoubleDeluxe_uninst.exe -d E:\
Task: {F060B5CD-AC9E-41AD-B482-DFB0C25E0373} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-06-27] (Adobe Systems Incorporated)
Task: {FE937C5B-BE95-47BC-95D4-149075CAA287} - System32\Tasks\{5BE699E8-84B5-4640-8E3C-B38EF1C0471C} => C:\Program Files\Skype\Phone\Skype.exe [2014-12-11] (Skype Technologies S.A.)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (Whitelisted) ==============
2009-01-25 16:42 - 2007-12-06 17:15 - 00110592 _____ () C:\Acer\Mobility Center\MobilityService.exe
2009-01-25 16:42 - 2007-11-27 16:08 - 00032768 _____ () C:\Acer\Mobility Center\MobilityInterface.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\008k.com -> 008k.com
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\00hq.com -> 00hq.com
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\0190-dialers.com -> 0190-dialers.com
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\01i.info -> 01i.info
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\05p.com -> 05p.com
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\0calories.net -> 0calories.net
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\0cj.net -> 0cj.net
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\0scan.com -> 0scan.com
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\1-britney-spears-nude.com -> 1-britney-spears-nude.com
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\1-domains-registrations.com -> 1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\1-se.com -> 1-se.com
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\1001movie.com -> 1001movie.com
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\1001night.biz -> 1001night.biz
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\100gal.net -> 100gal.net
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\100sexlinks.com -> 100sexlinks.com
There are 4952 more restricted sites.
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-3144670501-793434127-3194825423-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Dale\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
DNS Servers: 192.168.1.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\startupfolder: C:^Users^Dale^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^LimeWire On Startup.lnk => C:\Windows\pss\LimeWire On Startup.lnk.Startup
MSCONFIG\startupfolder: C:^Users^Dale^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk => C:\Windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
MSCONFIG\startupreg: Acer Product Registration => "C:\Program Files\Acer\Acer Registration\ACE1.exe" /startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: BkupTray => "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe"
MSCONFIG\startupreg: ehTray.exe => C:\Windows\ehome\ehTray.exe
MSCONFIG\startupreg: HotKeysCmds => C:\Windows\system32\hkcmd.exe
MSCONFIG\startupreg: IgfxTray => C:\Windows\system32\igfxtray.exe
MSCONFIG\startupreg: LManager => C:\PROGRA~1\LAUNCH~1\LManager.exe
MSCONFIG\startupreg: Persistence => C:\Windows\system32\igfxpers.exe
MSCONFIG\startupreg: PLFSetI => C:\Windows\PLFSetI.exe
MSCONFIG\startupreg: QuickTime Plugin Install => C:\Program Files\QuickTime\Plugins\DeleteMe1.exe
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: RtHDVCpl => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
MSCONFIG\startupreg: Speech Recognition => "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: SynTPEnh => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
MSCONFIG\startupreg: Windows Defender => %ProgramFiles%\Windows Defender\MSASCui.exe -hide
MSCONFIG\startupreg: Windows Mobile-based device management => %windir%\WindowsMobile\wmdSync.exe
MSCONFIG\startupreg: Zune Launcher => "C:\Program Files\Zune\ZuneLauncher.exe"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [WinCollab-Out-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-In-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-Out-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-In-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-DFSR-Out-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
FirewallRules: [WinCollab-DFSR-In-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
FirewallRules: [{55E5AC1D-E66C-4A6D-AB6E-40A1926AA6D5}] => (Allow) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
FirewallRules: [{5B94FB7E-4F9E-4B8F-BE1F-9FE57EAFC1EE}] => (Allow) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
FirewallRules: [{D96831D0-CC53-4431-93DF-12540E7B4B56}] => (Allow) C:\Program Files\Samsung\Samsung New PC Studio\npsasvr.exe
FirewallRules: [{A9040098-4CFE-4906-BCF6-B3995F1428DE}] => (Allow) C:\Program Files\Samsung\Samsung New PC Studio\npsasvr.exe
FirewallRules: [{43ED8461-8264-41CF-A543-E155F7D1C18B}] => (Allow) C:\Program Files\Samsung\Samsung New PC Studio\npsvsvr.exe
FirewallRules: [{7A345D19-4342-4FF5-9267-2E3B9E92DA01}] => (Allow) C:\Program Files\Samsung\Samsung New PC Studio\npsvsvr.exe
FirewallRules: [{0B538B91-DA99-4709-B4D4-0B6AC6ADA895}] => (Allow) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
FirewallRules: [{782B1532-616A-4555-933B-0D7A609CB435}] => (Allow) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
FirewallRules: [{CBFCEE09-B268-40D0-9B98-8253B9881C48}] => (Allow) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
FirewallRules: [{0F388B47-814E-4F3F-82B2-859760D32881}] => (Allow) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
FirewallRules: [TCP Query User{02A73F59-0CE5-42DA-9244-C1621584DC74}C:\program files\mozilla firefox\firefox.exe] => (Allow) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{A181BEE0-910D-45F5-9E76-4C52078BBA42}C:\program files\mozilla firefox\firefox.exe] => (Allow) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [{7ED23C7C-332C-46F3-B042-FC120E681AA2}] => (Allow) svchost.exe
FirewallRules: [{FD7E183A-BB57-40C8-BD78-3DB69DA0798A}] => (Allow) LPort=80
FirewallRules: [{CC526EDB-19C9-412B-9E36-7138A1F6EA0E}] => (Allow) LPort=80
FirewallRules: [{BEE08D17-F826-4F1A-B428-2F60F4A0F8D7}] => (Allow) LPort=80
FirewallRules: [{BACE67D1-27C4-4C2C-AD6B-0A434CB73BA8}] => (Allow) %ProgramFiles%\Zune\Zune.exe
FirewallRules: [{7BA2D625-8B4B-4FD9-9A0D-3AD3A9524404}] => (Allow) %ProgramFiles%\Zune\ZuneNSS.exe
FirewallRules: [{56336479-9737-4FFE-8855-918D7F9C9FBD}] => (Allow) %ProgramFiles%\Zune\ZuneNSS.exe
FirewallRules: [{DD607388-D62F-4111-AB7F-5F425F6834A5}] => (Allow) %ProgramFiles%\Zune\ZuneNSS.exe
FirewallRules: [{A387A9DE-08E2-4D72-B51E-9300D996A556}] => (Allow) %ProgramFiles%\Zune\ZuneNSS.exe
FirewallRules: [{7E086363-D096-4BC5-8180-A3282A5428AE}] => (Allow) %ProgramFiles%\Zune\ZuneNSS.exe
FirewallRules: [{D68679D9-B780-41DC-ADAF-6E612F319B8D}] => (Allow) %ProgramFiles%\Zune\ZuneNSS.exe
FirewallRules: [{C9CF640F-13DD-41A7-9D8F-CE726782E236}] => (Allow) %ProgramFiles%\Zune\ZuneNSS.exe
FirewallRules: [{B83F0FAC-1B5E-4F53-9F88-BA95E060C321}] => (Allow) %ProgramFiles%\Zune\ZuneNSS.exe
FirewallRules: [{E404DEC5-0DB3-4E68-8156-0EC707A5928D}] => (Allow) C:\Program Files\AVG\AVG10\avgdiagex.exe
FirewallRules: [{14D17D38-9566-45AA-A679-265382624BBC}] => (Allow) C:\Program Files\AVG\AVG10\avgdiagex.exe
FirewallRules: [{9E0B2BB4-38A8-4BC5-A1EE-8691BAB10217}] => (Allow) svchost.exe
FirewallRules: [{DE73DD72-30B0-4256-9A95-1D0A571254ED}] => (Allow) C:\Program Files\FrostWire\FrostWire.exe
FirewallRules: [{CB1F1EAA-FB90-4370-9B20-B67D151CB612}] => (Allow) C:\Program Files\FrostWire\FrostWire.exe
FirewallRules: [TCP Query User{26DEC40E-E861-40CB-A0FA-B97443253640}C:\program files\frostwire\frostwire.exe] => (Block) C:\program files\frostwire\frostwire.exe
FirewallRules: [UDP Query User{F85B39CE-932A-4367-83F0-E13A32D78027}C:\program files\frostwire\frostwire.exe] => (Block) C:\program files\frostwire\frostwire.exe
FirewallRules: [TCP Query User{4D72A92C-4A5E-463C-8B29-FB09E9D680CD}C:\program files\mozilla firefox\plugin-container.exe] => (Block) C:\program files\mozilla firefox\plugin-container.exe
FirewallRules: [UDP Query User{B12173E9-92A5-4E2A-B198-7E3C7831DE23}C:\program files\mozilla firefox\plugin-container.exe] => (Block) C:\program files\mozilla firefox\plugin-container.exe
FirewallRules: [TCP Query User{67EA706C-7BA4-4DCE-B03A-FFCE0B479A3D}C:\program files\frostwire 5\frostwire.exe] => (Block) C:\program files\frostwire 5\frostwire.exe
FirewallRules: [UDP Query User{5EED698D-66CD-4228-A3B5-E5D537431E5E}C:\program files\frostwire 5\frostwire.exe] => (Block) C:\program files\frostwire 5\frostwire.exe
FirewallRules: [{4C073957-B916-4F17-8810-BB6389DC9630}] => (Allow) C:\Program Files\FrostWire 5\FrostWire.exe
FirewallRules: [{7917CF22-5E36-453A-B6FE-B0BC8F582881}] => (Allow) C:\Program Files\FrostWire 5\FrostWire.exe
FirewallRules: [{C892A4BF-25B9-46E0-9B42-9F1FF1043691}] => (Allow) C:\Program Files\Research In Motion\BlackBerry Desktop\Rim.Desktop.exe
FirewallRules: [{99835B51-E93A-4807-824F-A29DAB4DBF88}] => (Allow) C:\Program Files\Research In Motion\BlackBerry Desktop\Rim.Desktop.exe
FirewallRules: [{2EBF4329-8003-4652-9484-B3066F935589}] => (Allow) LPort=4481
FirewallRules: [{8913A08E-A97D-4EB6-B123-7DCB9F3A6B57}] => (Allow) LPort=4481
FirewallRules: [{E9D1A187-D8FB-47BC-8EEC-3BAE32D766E0}] => (Allow) LPort=4482
FirewallRules: [{E7C22CAB-245F-4648-9F49-B88C118A1808}] => (Allow) LPort=4482
FirewallRules: [{F0997C44-BA8C-4AD2-89EB-894382A3EE6D}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe
FirewallRules: [{3FDC47B8-ED94-4701-B7A7-FCB0793A0E43}] => (Allow) C:\Users\Dale\AppData\Local\Facebook\Video\Skype\FacebookVideoCalling.exe
FirewallRules: [{50D1D51E-791B-4A31-B5A3-FF8BAC7650F6}] => (Allow) C:\Program Files\BearShare Applications\BearShare\BearShare.exe
FirewallRules: [{19D9DB35-8934-4977-B586-44719616AF34}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [{C7BB032C-B472-4EDB-9F69-4FB761F5FA94}] => (Allow) E:\Common\EpsonNet Setup\ENEasyApp.exe
FirewallRules: [{7DB59092-B79B-4746-BE7F-8669D8711736}] => (Allow) E:\Common\EpsonNet Setup\ENEasyApp.exe
FirewallRules: [TCP Query User{36669886-1431-4090-9800-B56130714205}C:\program files\epson software\event manager\eeventmanager.exe] => (Block) C:\program files\epson software\event manager\eeventmanager.exe
FirewallRules: [UDP Query User{1B40E914-45AB-49AF-A199-12F5B4A57C08}C:\program files\epson software\event manager\eeventmanager.exe] => (Block) C:\program files\epson software\event manager\eeventmanager.exe
FirewallRules: [{45CB51E0-CE17-4C92-8042-91CD5C870A84}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{1C3A1DF6-B549-4552-ADC9-16ECCFAB4479}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{5FB223C7-6C95-4756-A403-614196119A78}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{151A665F-9CCB-4E2D-8881-699B98A6E02F}] => (Allow) C:\Program Files\AVG\AVG10\avgdiagex.exe
FirewallRules: [{10A30EBE-D4BB-41E1-A806-6029CDD96ECC}] => (Allow) C:\Program Files\AVG\AVG10\avgdiagex.exe
FirewallRules: [{AF104022-6852-4DD6-9B67-1A89B0589D9F}] => (Allow) C:\Program Files\BearShare Applications\BearShare\BearShare.exe
FirewallRules: [{C4D0B3C2-63BD-4E34-872E-8B9C849387E0}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{42912EDA-30C2-485E-BBA9-A850B39160A9}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{C5650C9D-E200-4D22-A71A-96DC27E9718C}] => (Allow) C:\Users\Dale\AppData\Local\Facebook\Video\Skype\FacebookVideoCalling.exe
FirewallRules: [TCP Query User{006E1401-1F8F-4EF5-8EAD-6DB57ACDB3CA}C:\program files\rogers\rogers one number\rogersonenumber.exe] => (Allow) C:\program files\rogers\rogers one number\rogersonenumber.exe
FirewallRules: [UDP Query User{0AD2F68B-E1C6-45DE-890F-585FF498E92E}C:\program files\rogers\rogers one number\rogersonenumber.exe] => (Allow) C:\program files\rogers\rogers one number\rogersonenumber.exe
FirewallRules: [{156D555D-1624-4CB1-A2A8-8D051C6D5C7C}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{2F895A2B-F01F-4817-B905-68D51CF9EF76}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{6B63475E-135D-43CE-B1CB-7B7FB8E229B7}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{616B726B-BC02-413C-92CF-39FBF470CE8D}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (07/07/2015 08:18:03 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/07/2015 07:47:24 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/07/2015 07:07:37 PM) (Source: MsiInstaller) (EventID: 11316) (User: Dale-PC)
Description: Product: Facebook Video Calling 2.0.0.447 -- Error 1316. The specified account already exists.
Error: (07/07/2015 07:03:28 PM) (Source: MsiInstaller) (EventID: 11316) (User: Dale-PC)
Description: Product: Facebook Video Calling 2.0.0.447 -- Error 1316. The specified account already exists.
Error: (07/07/2015 07:02:58 PM) (Source: MsiInstaller) (EventID: 11316) (User: Dale-PC)
Description: Product: Facebook Video Calling 2.0.0.447 -- Error 1316. The specified account already exists.
Error: (07/07/2015 06:10:46 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/07/2015 00:04:00 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/06/2015 02:02:25 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/05/2015 10:29:16 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/05/2015 02:47:10 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (07/07/2015 08:21:56 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: 30000Microsoft .NET Framework NGEN v4.0.30319_X86
Error: (07/07/2015 08:19:25 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: cdrom
Error: (07/07/2015 08:19:24 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: MBAMService
Error: (07/07/2015 08:18:56 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT AUTHORITYLOCAL SERVICES-1-5-19LocalHost (Using LRPC)
Error: (07/07/2015 08:18:47 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)
Error: (07/07/2015 08:18:03 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058
Error: (07/07/2015 08:17:35 PM) (Source: Microsoft Antimalware) (EventID: 2004) (User: )
Description: %60 has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures.
Signatures Attempted: %24
Error Code: 0x80070002
Error description: The system cannot find the file specified.
Signature version: 0.0.0.0;0.0.0.0
Engine version: %600
Error: (07/07/2015 08:17:07 PM) (Source: volmgr) (EventID: 46) (User: )
Description: Crash dump initialization failed!
Error: (07/07/2015 08:15:19 PM) (Source: volmgr) (EventID: 46) (User: )
Description: Crash dump initialization failed!
Error: (07/07/2015 07:48:46 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: cdrom
Microsoft Office:
=========================
CodeIntegrity Errors:
===================================
Date: 2015-07-07 21:46:16.237
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.
Date: 2015-07-07 21:46:15.441
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.
Date: 2015-07-07 21:46:14.661
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.
Date: 2015-07-07 21:46:13.865
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.
Date: 2015-07-07 21:46:12.867
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.
Date: 2015-07-07 21:46:12.071
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.
Date: 2015-07-07 21:46:11.291
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.
Date: 2015-07-07 21:46:10.496
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.
Date: 2015-07-07 21:45:45.013
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.
Date: 2015-07-07 21:45:44.171
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.
==================== Memory info ===========================
Processor: Intel(R) Pentium(R) Dual CPU T3200 @ 2.00GHz
Percentage of memory in use: 45%
Total physical RAM: 3000.12 MB
Available physical RAM: 1640.85 MB
Total Virtual: 6250.48 MB
Available Virtual: 4897.39 MB
==================== Drives ================================
Drive c: (ACER) (Fixed) (Total:111.57 GB) (Free:38.49 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATA) (Fixed) (Total:111.55 GB) (Free:109.49 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 232.9 GB) (Disk ID: E199D812)
Partition 1: (Not Active) - (Size=9.8 GB) - (Type=27)
Partition 2: (Active) - (Size=111.6 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=111.6 GB) - (Type=07 NTFS)
==================== End of log ============================
Ran by Dale at 2015-07-07 21:46:21
Running from C:\Users\Dale\Desktop
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-3144670501-793434127-3194825423-500 - Administrator - Disabled)
Dale (S-1-5-21-3144670501-793434127-3194825423-1000 - Administrator - Enabled) => C:\Users\Dale
Guest (S-1-5-21-3144670501-793434127-3194825423-501 - Limited - Disabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Acer Crystal Eye Webcam 2.0.8 (HKLM\...\{A77255C4-AFCB-44A3-BF0F-2091A71FFD9E}) (Version: 2.0.8 - SuYin)
Acer Mobility Center Plug-In (HKLM\...\{11316260-6666-467B-AC34-183FCB5D4335}) (Version: 3.0.3000 - Acer Inc.)
Acer Registration (HKLM\...\Acer Registration) (Version: - Acer - Leader Technologies)
Adobe AIR (HKLM\...\Adobe AIR) (Version: 1.0.4990 - Adobe Systems Inc.)
Adobe Flash Player 10 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 10.0.42.34 - Adobe Systems Incorporated)
Adobe Flash Player 18 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 18.0.0.194 - Adobe Systems Incorporated)
Adobe Reader X (10.1.14) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.14 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM\...\Adobe Shockwave Player) (Version: 12.1.3.153 - Adobe Systems, Inc.)
Advanced SystemCare 3 (HKLM\...\Advanced SystemCare 3_is1) (Version: 3.7.3 - IObit)
Agere Systems HDA Modem (HKLM\...\Agere Systems Soft Modem) (Version: - Agere Systems)
Apple Application Support (HKLM\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{235EBB33-3DA1-46DF-AADE-9955123409CB}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
BearShare (HKLM\...\BearShare) (Version: 12.0.0.134600 - Musiclab, LLC)
BlackBerry Desktop Software 7.1 (HKLM\...\BlackBerry_Desktop) (Version: 7.1.0.32 - Research In Motion Ltd.)
BlackBerry Desktop Software 7.1 (Version: 7.1.0.32 - Research In Motion Ltd.) Hidden
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
EPSON Artisan 730 Series Printer Uninstall (HKLM\...\EPSON Artisan 730 Series) (Version: - SEIKO EPSON Corporation)
Epson Customer Participation (HKLM\...\{814FA673-A085-403C-9545-747FC1495069}) (Version: 1.0.0.0 - SEIKO EPSON CORPORATION)
Epson Event Manager (HKLM\...\{8ED43F7E-A8F6-4898-AF11-B6158F2EDF94}) (Version: 2.50.0000 - SEIKO EPSON CORPORATION)
EpsonNet Print (HKLM\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.4j - SEIKO EPSON CORPORATION)
Facebook Video Calling 2.0.0.447 (HKLM\...\{8DF41A9F-FE13-43E8-A003-5F9B55A011EE}) (Version: 2.0.447 - Skype Limited)
FrostWire 6.0.7 (HKLM\...\FrostWire 6) (Version: 6.0.7.4 - FrostWire LLC)
GearDrvs (Version: 1.00.0000 - GEAR Software) Hidden
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: - Intel Corporation)
iTunes (HKLM\...\{5D928931-D1D2-4A93-A82D-BF60D0E7CFA5}) (Version: 12.0.1.26 - Apple Inc.)
Java 8 Update 45 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
Launch Manager (HKLM\...\LManager) (Version: - )
LightScribe 1.4.142.1 (Version: 1.4.142.1 - http://www.lightscribe.com) Hidden
Malwarebytes Anti-Malware version 2.1.8.1057 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Marvell Miniport Driver (HKLM\...\Marvell Miniport Driver) (Version: 10.55.3.3 - Marvell)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.7.205.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Works (HKLM\...\{6D52C408-B09A-4520-9B18-475B81D393F1}) (Version: 08.05.0818 - Microsoft Corporation)
Mozilla Firefox 38.0.5 (x86 en-US) (HKLM\...\Mozilla Firefox 38.0.5 (x86 en-US)) (Version: 38.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
NTI Backup Now 5 (HKLM\...\InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}) (Version: 5.1.2.503 - NewTech Infosystems)
NTI Backup Now Standard (Version: 5.1.2.503 - NewTech Infosystems) Hidden
NTI Media Maker 8 (HKLM\...\InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}) (Version: 8.0.2.6322 - NewTech Infosystems)
NTI Media Maker 8 (Version: 8.0.2.6322 - NewTech Infosystems) Hidden
QuickTime 7 (HKLM\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6167 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM\...\{DC24971E-1946-445D-8A82-CE685433FA7D}) (Version: 3.0.1.3 - Realtek Semiconductor Corp.)
Skype™ 7.0 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Sophos Virus Removal Tool (HKLM\...\{B829E117-D072-41EA-9606-9826A38D34C1}) (Version: 2.5.4 - Sophos Limited)
StudioTax 2013 (HKLM\...\{8D18F314-6668-4E2F-936A-70025F2D40C7}) (Version: 9.1.7.0 - BHOK IT Consulting)
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 11.1.4.0 - Synaptics)
System Requirements Lab CYRI (HKLM\...\{1F77C418-2C90-459C-BD33-B56A4182B9FA}) (Version: 4.4.26.0 - Husdawg, LLC)
TeamViewer 9 (HKLM\...\TeamViewer 9) (Version: 9.0.32494 - TeamViewer)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Windows Media Player Firefox Plugin (HKLM\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
WinRAR archiver (HKLM\...\WinRAR archiver) (Version: - )
Zune (HKLM\...\Zune) (Version: 04.07.1404.01 - Microsoft Corporation)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== Restore Points =========================
27-06-2015 15:07:40 End of disinfection
28-06-2015 01:51:58 Windows Update
30-06-2015 01:02:36 Scheduled Checkpoint
02-07-2015 00:44:46 Scheduled Checkpoint
02-07-2015 01:54:15 Windows Update
03-07-2015 01:55:03 Scheduled Checkpoint
03-07-2015 18:17:42 Windows Update
04-07-2015 03:00:16 Windows Update
05-07-2015 03:36:01 Scheduled Checkpoint
05-07-2015 23:06:13 Scheduled Checkpoint
07-07-2015 00:40:50 Scheduled Checkpoint
07-07-2015 18:25:40 Windows Update
07-07-2015 19:01:07 Removed Facebook Video Calling 2.0.0.447
07-07-2015 19:03:03 Removed Facebook Video Calling 2.0.0.447
07-07-2015 19:05:33 Removed Skype™ 7.0
07-07-2015 19:07:17 Removed Facebook Video Calling 2.0.0.447
07-07-2015 19:41:44 Restore Operation
07-07-2015 20:00:19 Windows Update
07-07-2015 20:11:01 Restore Operation
07-07-2015 20:32:23 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2006-11-02 06:23 - 2015-06-25 00:43 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {014FD605-8F9E-48D2-B4DC-1AF40E6FC5B0} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-06-12] (Adobe Systems Incorporated)
Task: {88C17DE1-2F8C-4D25-A035-2067152EFB7C} - System32\Tasks\{459B19C3-ADE4-4DA6-AE75-AB606A76100D} => pcalua.exe -a C:\Users\Dale\Pictures\MP10Setup.exe -d "C:\Program Files\Mozilla Firefox"
Task: {8B138EAB-A157-41D7-B89A-C41E6A4D3492} - System32\Tasks\{AE2DA9EE-362D-4A49-8FE4-20E9561F5F22} => C:\Program Files\Skype\Phone\Skype.exe [2014-12-11] (Skype Technologies S.A.)
Task: {9CFFFDF0-6AF6-42B4-8AA9-AFABB39505E3} - System32\Tasks\{C6D949DF-AE47-48EF-87EE-B54BD9AC7D12} => pcalua.exe -a C:\Users\Dale\Pictures\MP10Setup.exe -d "C:\Program Files\Mozilla Firefox"
Task: {A462787A-EAA5-4DB5-879D-7CD2E66A4782} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Dale => C:\Program Files\Windows Calendar\WinCal.exe [2009-04-11] (Microsoft Corporation)
Task: {A4BADB48-0AFE-427C-9405-43F51308F095} - System32\Tasks\{FFF16A5D-303A-4AA0-AA20-82DC0D1E162E} => pcalua.exe -a E:\Sims2DoubleDeluxe_uninst.exe -d E:\
Task: {F060B5CD-AC9E-41AD-B482-DFB0C25E0373} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-06-27] (Adobe Systems Incorporated)
Task: {FE937C5B-BE95-47BC-95D4-149075CAA287} - System32\Tasks\{5BE699E8-84B5-4640-8E3C-B38EF1C0471C} => C:\Program Files\Skype\Phone\Skype.exe [2014-12-11] (Skype Technologies S.A.)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (Whitelisted) ==============
2009-01-25 16:42 - 2007-12-06 17:15 - 00110592 _____ () C:\Acer\Mobility Center\MobilityService.exe
2009-01-25 16:42 - 2007-11-27 16:08 - 00032768 _____ () C:\Acer\Mobility Center\MobilityInterface.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\008k.com -> 008k.com
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\00hq.com -> 00hq.com
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\0190-dialers.com -> 0190-dialers.com
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\01i.info -> 01i.info
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\05p.com -> 05p.com
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\0calories.net -> 0calories.net
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\0cj.net -> 0cj.net
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\0scan.com -> 0scan.com
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\1-britney-spears-nude.com -> 1-britney-spears-nude.com
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\1-domains-registrations.com -> 1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\1-se.com -> 1-se.com
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\1001movie.com -> 1001movie.com
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\1001night.biz -> 1001night.biz
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\100gal.net -> 100gal.net
IE restricted site: HKU\S-1-5-21-3144670501-793434127-3194825423-1000\...\100sexlinks.com -> 100sexlinks.com
There are 4952 more restricted sites.
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-3144670501-793434127-3194825423-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Dale\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
DNS Servers: 192.168.1.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\startupfolder: C:^Users^Dale^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^LimeWire On Startup.lnk => C:\Windows\pss\LimeWire On Startup.lnk.Startup
MSCONFIG\startupfolder: C:^Users^Dale^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk => C:\Windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
MSCONFIG\startupreg: Acer Product Registration => "C:\Program Files\Acer\Acer Registration\ACE1.exe" /startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: BkupTray => "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe"
MSCONFIG\startupreg: ehTray.exe => C:\Windows\ehome\ehTray.exe
MSCONFIG\startupreg: HotKeysCmds => C:\Windows\system32\hkcmd.exe
MSCONFIG\startupreg: IgfxTray => C:\Windows\system32\igfxtray.exe
MSCONFIG\startupreg: LManager => C:\PROGRA~1\LAUNCH~1\LManager.exe
MSCONFIG\startupreg: Persistence => C:\Windows\system32\igfxpers.exe
MSCONFIG\startupreg: PLFSetI => C:\Windows\PLFSetI.exe
MSCONFIG\startupreg: QuickTime Plugin Install => C:\Program Files\QuickTime\Plugins\DeleteMe1.exe
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: RtHDVCpl => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
MSCONFIG\startupreg: Speech Recognition => "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: SynTPEnh => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
MSCONFIG\startupreg: Windows Defender => %ProgramFiles%\Windows Defender\MSASCui.exe -hide
MSCONFIG\startupreg: Windows Mobile-based device management => %windir%\WindowsMobile\wmdSync.exe
MSCONFIG\startupreg: Zune Launcher => "C:\Program Files\Zune\ZuneLauncher.exe"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [WinCollab-Out-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-In-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-Out-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-In-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-DFSR-Out-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
FirewallRules: [WinCollab-DFSR-In-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
FirewallRules: [{55E5AC1D-E66C-4A6D-AB6E-40A1926AA6D5}] => (Allow) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
FirewallRules: [{5B94FB7E-4F9E-4B8F-BE1F-9FE57EAFC1EE}] => (Allow) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
FirewallRules: [{D96831D0-CC53-4431-93DF-12540E7B4B56}] => (Allow) C:\Program Files\Samsung\Samsung New PC Studio\npsasvr.exe
FirewallRules: [{A9040098-4CFE-4906-BCF6-B3995F1428DE}] => (Allow) C:\Program Files\Samsung\Samsung New PC Studio\npsasvr.exe
FirewallRules: [{43ED8461-8264-41CF-A543-E155F7D1C18B}] => (Allow) C:\Program Files\Samsung\Samsung New PC Studio\npsvsvr.exe
FirewallRules: [{7A345D19-4342-4FF5-9267-2E3B9E92DA01}] => (Allow) C:\Program Files\Samsung\Samsung New PC Studio\npsvsvr.exe
FirewallRules: [{0B538B91-DA99-4709-B4D4-0B6AC6ADA895}] => (Allow) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
FirewallRules: [{782B1532-616A-4555-933B-0D7A609CB435}] => (Allow) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
FirewallRules: [{CBFCEE09-B268-40D0-9B98-8253B9881C48}] => (Allow) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
FirewallRules: [{0F388B47-814E-4F3F-82B2-859760D32881}] => (Allow) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
FirewallRules: [TCP Query User{02A73F59-0CE5-42DA-9244-C1621584DC74}C:\program files\mozilla firefox\firefox.exe] => (Allow) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{A181BEE0-910D-45F5-9E76-4C52078BBA42}C:\program files\mozilla firefox\firefox.exe] => (Allow) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [{7ED23C7C-332C-46F3-B042-FC120E681AA2}] => (Allow) svchost.exe
FirewallRules: [{FD7E183A-BB57-40C8-BD78-3DB69DA0798A}] => (Allow) LPort=80
FirewallRules: [{CC526EDB-19C9-412B-9E36-7138A1F6EA0E}] => (Allow) LPort=80
FirewallRules: [{BEE08D17-F826-4F1A-B428-2F60F4A0F8D7}] => (Allow) LPort=80
FirewallRules: [{BACE67D1-27C4-4C2C-AD6B-0A434CB73BA8}] => (Allow) %ProgramFiles%\Zune\Zune.exe
FirewallRules: [{7BA2D625-8B4B-4FD9-9A0D-3AD3A9524404}] => (Allow) %ProgramFiles%\Zune\ZuneNSS.exe
FirewallRules: [{56336479-9737-4FFE-8855-918D7F9C9FBD}] => (Allow) %ProgramFiles%\Zune\ZuneNSS.exe
FirewallRules: [{DD607388-D62F-4111-AB7F-5F425F6834A5}] => (Allow) %ProgramFiles%\Zune\ZuneNSS.exe
FirewallRules: [{A387A9DE-08E2-4D72-B51E-9300D996A556}] => (Allow) %ProgramFiles%\Zune\ZuneNSS.exe
FirewallRules: [{7E086363-D096-4BC5-8180-A3282A5428AE}] => (Allow) %ProgramFiles%\Zune\ZuneNSS.exe
FirewallRules: [{D68679D9-B780-41DC-ADAF-6E612F319B8D}] => (Allow) %ProgramFiles%\Zune\ZuneNSS.exe
FirewallRules: [{C9CF640F-13DD-41A7-9D8F-CE726782E236}] => (Allow) %ProgramFiles%\Zune\ZuneNSS.exe
FirewallRules: [{B83F0FAC-1B5E-4F53-9F88-BA95E060C321}] => (Allow) %ProgramFiles%\Zune\ZuneNSS.exe
FirewallRules: [{E404DEC5-0DB3-4E68-8156-0EC707A5928D}] => (Allow) C:\Program Files\AVG\AVG10\avgdiagex.exe
FirewallRules: [{14D17D38-9566-45AA-A679-265382624BBC}] => (Allow) C:\Program Files\AVG\AVG10\avgdiagex.exe
FirewallRules: [{9E0B2BB4-38A8-4BC5-A1EE-8691BAB10217}] => (Allow) svchost.exe
FirewallRules: [{DE73DD72-30B0-4256-9A95-1D0A571254ED}] => (Allow) C:\Program Files\FrostWire\FrostWire.exe
FirewallRules: [{CB1F1EAA-FB90-4370-9B20-B67D151CB612}] => (Allow) C:\Program Files\FrostWire\FrostWire.exe
FirewallRules: [TCP Query User{26DEC40E-E861-40CB-A0FA-B97443253640}C:\program files\frostwire\frostwire.exe] => (Block) C:\program files\frostwire\frostwire.exe
FirewallRules: [UDP Query User{F85B39CE-932A-4367-83F0-E13A32D78027}C:\program files\frostwire\frostwire.exe] => (Block) C:\program files\frostwire\frostwire.exe
FirewallRules: [TCP Query User{4D72A92C-4A5E-463C-8B29-FB09E9D680CD}C:\program files\mozilla firefox\plugin-container.exe] => (Block) C:\program files\mozilla firefox\plugin-container.exe
FirewallRules: [UDP Query User{B12173E9-92A5-4E2A-B198-7E3C7831DE23}C:\program files\mozilla firefox\plugin-container.exe] => (Block) C:\program files\mozilla firefox\plugin-container.exe
FirewallRules: [TCP Query User{67EA706C-7BA4-4DCE-B03A-FFCE0B479A3D}C:\program files\frostwire 5\frostwire.exe] => (Block) C:\program files\frostwire 5\frostwire.exe
FirewallRules: [UDP Query User{5EED698D-66CD-4228-A3B5-E5D537431E5E}C:\program files\frostwire 5\frostwire.exe] => (Block) C:\program files\frostwire 5\frostwire.exe
FirewallRules: [{4C073957-B916-4F17-8810-BB6389DC9630}] => (Allow) C:\Program Files\FrostWire 5\FrostWire.exe
FirewallRules: [{7917CF22-5E36-453A-B6FE-B0BC8F582881}] => (Allow) C:\Program Files\FrostWire 5\FrostWire.exe
FirewallRules: [{C892A4BF-25B9-46E0-9B42-9F1FF1043691}] => (Allow) C:\Program Files\Research In Motion\BlackBerry Desktop\Rim.Desktop.exe
FirewallRules: [{99835B51-E93A-4807-824F-A29DAB4DBF88}] => (Allow) C:\Program Files\Research In Motion\BlackBerry Desktop\Rim.Desktop.exe
FirewallRules: [{2EBF4329-8003-4652-9484-B3066F935589}] => (Allow) LPort=4481
FirewallRules: [{8913A08E-A97D-4EB6-B123-7DCB9F3A6B57}] => (Allow) LPort=4481
FirewallRules: [{E9D1A187-D8FB-47BC-8EEC-3BAE32D766E0}] => (Allow) LPort=4482
FirewallRules: [{E7C22CAB-245F-4648-9F49-B88C118A1808}] => (Allow) LPort=4482
FirewallRules: [{F0997C44-BA8C-4AD2-89EB-894382A3EE6D}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe
FirewallRules: [{3FDC47B8-ED94-4701-B7A7-FCB0793A0E43}] => (Allow) C:\Users\Dale\AppData\Local\Facebook\Video\Skype\FacebookVideoCalling.exe
FirewallRules: [{50D1D51E-791B-4A31-B5A3-FF8BAC7650F6}] => (Allow) C:\Program Files\BearShare Applications\BearShare\BearShare.exe
FirewallRules: [{19D9DB35-8934-4977-B586-44719616AF34}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [{C7BB032C-B472-4EDB-9F69-4FB761F5FA94}] => (Allow) E:\Common\EpsonNet Setup\ENEasyApp.exe
FirewallRules: [{7DB59092-B79B-4746-BE7F-8669D8711736}] => (Allow) E:\Common\EpsonNet Setup\ENEasyApp.exe
FirewallRules: [TCP Query User{36669886-1431-4090-9800-B56130714205}C:\program files\epson software\event manager\eeventmanager.exe] => (Block) C:\program files\epson software\event manager\eeventmanager.exe
FirewallRules: [UDP Query User{1B40E914-45AB-49AF-A199-12F5B4A57C08}C:\program files\epson software\event manager\eeventmanager.exe] => (Block) C:\program files\epson software\event manager\eeventmanager.exe
FirewallRules: [{45CB51E0-CE17-4C92-8042-91CD5C870A84}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{1C3A1DF6-B549-4552-ADC9-16ECCFAB4479}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{5FB223C7-6C95-4756-A403-614196119A78}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{151A665F-9CCB-4E2D-8881-699B98A6E02F}] => (Allow) C:\Program Files\AVG\AVG10\avgdiagex.exe
FirewallRules: [{10A30EBE-D4BB-41E1-A806-6029CDD96ECC}] => (Allow) C:\Program Files\AVG\AVG10\avgdiagex.exe
FirewallRules: [{AF104022-6852-4DD6-9B67-1A89B0589D9F}] => (Allow) C:\Program Files\BearShare Applications\BearShare\BearShare.exe
FirewallRules: [{C4D0B3C2-63BD-4E34-872E-8B9C849387E0}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{42912EDA-30C2-485E-BBA9-A850B39160A9}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{C5650C9D-E200-4D22-A71A-96DC27E9718C}] => (Allow) C:\Users\Dale\AppData\Local\Facebook\Video\Skype\FacebookVideoCalling.exe
FirewallRules: [TCP Query User{006E1401-1F8F-4EF5-8EAD-6DB57ACDB3CA}C:\program files\rogers\rogers one number\rogersonenumber.exe] => (Allow) C:\program files\rogers\rogers one number\rogersonenumber.exe
FirewallRules: [UDP Query User{0AD2F68B-E1C6-45DE-890F-585FF498E92E}C:\program files\rogers\rogers one number\rogersonenumber.exe] => (Allow) C:\program files\rogers\rogers one number\rogersonenumber.exe
FirewallRules: [{156D555D-1624-4CB1-A2A8-8D051C6D5C7C}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{2F895A2B-F01F-4817-B905-68D51CF9EF76}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{6B63475E-135D-43CE-B1CB-7B7FB8E229B7}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{616B726B-BC02-413C-92CF-39FBF470CE8D}] => (Allow) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (07/07/2015 08:18:03 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/07/2015 07:47:24 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/07/2015 07:07:37 PM) (Source: MsiInstaller) (EventID: 11316) (User: Dale-PC)
Description: Product: Facebook Video Calling 2.0.0.447 -- Error 1316. The specified account already exists.
Error: (07/07/2015 07:03:28 PM) (Source: MsiInstaller) (EventID: 11316) (User: Dale-PC)
Description: Product: Facebook Video Calling 2.0.0.447 -- Error 1316. The specified account already exists.
Error: (07/07/2015 07:02:58 PM) (Source: MsiInstaller) (EventID: 11316) (User: Dale-PC)
Description: Product: Facebook Video Calling 2.0.0.447 -- Error 1316. The specified account already exists.
Error: (07/07/2015 06:10:46 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/07/2015 00:04:00 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/06/2015 02:02:25 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/05/2015 10:29:16 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/05/2015 02:47:10 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (07/07/2015 08:21:56 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: 30000Microsoft .NET Framework NGEN v4.0.30319_X86
Error: (07/07/2015 08:19:25 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: cdrom
Error: (07/07/2015 08:19:24 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: MBAMService
Error: (07/07/2015 08:18:56 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT AUTHORITYLOCAL SERVICES-1-5-19LocalHost (Using LRPC)
Error: (07/07/2015 08:18:47 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)
Error: (07/07/2015 08:18:03 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058
Error: (07/07/2015 08:17:35 PM) (Source: Microsoft Antimalware) (EventID: 2004) (User: )
Description: %60 has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures.
Signatures Attempted: %24
Error Code: 0x80070002
Error description: The system cannot find the file specified.
Signature version: 0.0.0.0;0.0.0.0
Engine version: %600
Error: (07/07/2015 08:17:07 PM) (Source: volmgr) (EventID: 46) (User: )
Description: Crash dump initialization failed!
Error: (07/07/2015 08:15:19 PM) (Source: volmgr) (EventID: 46) (User: )
Description: Crash dump initialization failed!
Error: (07/07/2015 07:48:46 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: cdrom
Microsoft Office:
=========================
CodeIntegrity Errors:
===================================
Date: 2015-07-07 21:46:16.237
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.
Date: 2015-07-07 21:46:15.441
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.
Date: 2015-07-07 21:46:14.661
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.
Date: 2015-07-07 21:46:13.865
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.
Date: 2015-07-07 21:46:12.867
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.
Date: 2015-07-07 21:46:12.071
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.
Date: 2015-07-07 21:46:11.291
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.
Date: 2015-07-07 21:46:10.496
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.
Date: 2015-07-07 21:45:45.013
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.
Date: 2015-07-07 21:45:44.171
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.
==================== Memory info ===========================
Processor: Intel(R) Pentium(R) Dual CPU T3200 @ 2.00GHz
Percentage of memory in use: 45%
Total physical RAM: 3000.12 MB
Available physical RAM: 1640.85 MB
Total Virtual: 6250.48 MB
Available Virtual: 4897.39 MB
==================== Drives ================================
Drive c: (ACER) (Fixed) (Total:111.57 GB) (Free:38.49 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATA) (Fixed) (Total:111.55 GB) (Free:109.49 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 232.9 GB) (Disk ID: E199D812)
Partition 1: (Not Active) - (Size=9.8 GB) - (Type=27)
Partition 2: (Active) - (Size=111.6 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=111.6 GB) - (Type=07 NTFS)
==================== End of log ============================
Latest posts
-
Asus releases firmware update to address game crashes on Intel CPUs- Malone12 replied
-
8BitDo updates gamepads with drift-proof hall-effect analog sticks- Daniel Sims replied