Solved Conhost.exe and fake Chrome.exe background processes

Eric Witzling · Apr 9, 2015

PC exhibiting some strange behavior, including Gmail text-replacement while writing email to others. Definitely spotted and removed malware crud, but noticed residual and reminiscent behavior in two unkillable conhost.exe processes and somewhere between 8-10 chrome.exe processes (which are killable and do not immediately come back) that start up in the background after a reboot, and make me think there's still something buried deep and mucking about.

Your instructions have changed a bit from previous, so I hope I'm giving you what you need. Avast Pro is already on the system and can run scans, but is not currently updating properly. (Mainly it's just been getting in the way of my own cleanup.)

FRST and Addition logs pasted below. Let me know if you want any further details of steps I've already taken and logs already collected.

--------------------------

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 11-03-2015
Ran by janice (administrator) on CFO-HP on 09-04-2015 15:16:16
Running from C:\downloads
Loaded Profiles: janice (Available profiles: janice & patty & cfo & Xerox)
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool:

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Hewlett-Packard) C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe
(McAfee, Inc.) C:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Cisco WebEx LLC) C:\Windows\System32\atashost.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc.exe
(ECi FMAudit) C:\Program Files\FMAuditOnsite\fmaonsite.exe
(HP) C:\Program Files\Hp\HPLaserJetService\HPLaserJetService.exe
(Hewlett-Packard Development Company, L.P) C:\Program Files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP SkyRoom\Hp.Skyroom.Windows.Service.exe
(LogMeIn, Inc.) C:\Users\janice\AppData\Local\LogMeIn Rescue Applet\LMIR0001.tmp\LMI_Rescue_srv.exe
(Intel Corporation) C:\Program Files\Intel\AMT\LMS.exe
(PDF Complete Inc) C:\Program Files\PDF Complete\pdfsvc.exe
() C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
(Silver Bullet Technologies, Inc.) C:\Program Files\Silver Bullet Technology\Ranger\Logging\SBTLogServiceWindows.exe
(SonicWALL, Inc.) C:\Program Files\SonicWALL\SonicWALL Global VPN Client\SWGVCSvc.exe
(Intel Corporation) C:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe
(Hewlett-Packard, Inc.) C:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\rgsendersvc.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\rgsender.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(LogMeIn, Inc.) C:\Users\janice\AppData\Local\LogMeIn Rescue Applet\LMIR0001.tmp\lmi_rescue.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Intel Corporation) C:\Program Files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\File Sanitizer\coreshredder.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(SHARP CORPORATION) C:\Program Files\Sharp\Sharpdesk\SharpTray.exe
(Hewlett-Packard) C:\Program Files\Hp\HP Software Update\hpwuschd2.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Epson Software\Event Manager\EEventManager.exe
(Nuance Communications, Inc.) C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
(Hewlett-Packard Company) C:\Program Files\Hp\Digital Imaging\Fax\Fax Driver 0.6 Base\hppfaxprintersrv.exe
(Hewlett-Packard Company) C:\Program Files\Hp\StatusAlerts\bin\HPStatusAlerts.exe
(Citrix Online, a division of Citrix Systems, Inc.) C:\Program Files\Citrix\GoToMeeting\1133\g2mstart.exe
(Google) C:\Program Files\Google\Drive\googledrivesync.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
() C:\Users\janice\AppData\Local\Amazon Music\Amazon Music Helper.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Dropbox, Inc.) C:\Users\janice\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Citrix Online, a division of Citrix Systems, Inc.) C:\Program Files\Citrix\GoToMeeting\1133\g2mcomm.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\rgsender_gui.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\Plugins\Ice\Hp.SkyRoom.Windows.RgsPlugin.Authentication\Hp.SkyRoom.Windows.RgsPlugin.Authentication.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\Plugins\Ice\Hp.SkyRoom.Windows.RgsPlugin.Lens\Hp.SkyRoom.Windows.RgsPlugin.Lens.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\Plugins\Ice\Hp.SkyRoom.Windows.RgsPlugin.Licensing\Hp.SkyRoom.Windows.RgsPlugin.Licensing.exe
(Google) C:\Program Files\Google\Drive\googledrivesync.exe
(Citrix Online, a division of Citrix Systems, Inc.) C:\Program Files\Citrix\GoToMeeting\1133\g2mlauncher.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(LogMeIn, Inc.) C:\Users\janice\AppData\Local\LogMeIn Rescue Applet\LMIR0001.tmp\LMI_Rescue_srv.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil32_17_0_0_134_ActiveX.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7596576 2009-07-02] (Realtek Semiconductor)
HKLM\...\Run: [picon] => C:\Program Files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe [796696 2009-07-24] (Intel Corporation)
HKLM\...\Run: [PDF Complete] => C:\Program Files\PDF Complete\pdfsty.exe [563736 2009-06-18] (PDF Complete Inc)
HKLM\...\Run: [File Sanitizer] => C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe [11268096 2010-05-06] (Hewlett-Packard)
HKLM\...\Run: [avast] => C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)
HKLM\...\Run: [SharpTray.exe] => C:\Program Files\Sharp\Sharpdesk\SharpTray.exe [131584 2009-12-08] (SHARP CORPORATION)
HKLM\...\Run: [IndexTray.exe] => C:\Program Files\Sharp\Sharpdesk\IndexTray.exe [395264 2009-12-08] (SHARP CORPORATION)
HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard)
HKLM\...\Run: [TkBellExe] => c:\program files\real\realplayer\Update\realsched.exe [295512 2013-04-24] (RealNetworks, Inc.)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-05-31] (Apple Inc.)
HKLM\...\Run: [EEventManager] => C:\Program Files\Epson Software\Event Manager\EEventManager.exe [1058912 2012-04-02] (SEIKO EPSON CORPORATION)
HKLM\...\Run: [SSBkgdUpdate] => C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [210472 2006-10-25] (Nuance Communications, Inc.)
HKLM\...\Run: [PaperPort PTD] => C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe [29984 2008-01-14] (Nuance Communications, Inc.)
HKLM\...\Run: [IndexSearch] => C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe [46368 2008-01-14] (Nuance Communications, Inc.)
HKLM\...\Run: [PPort11reminder] => C:\Program Files\ScanSoft\PaperPort\Ereg\Ereg.exe [328992 2007-08-31] (Nuance Communications, Inc.)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [HP LaserJet 400 MFP M425 Series Fax] => C:\Program Files\HP\Digital Imaging\Fax\Fax Driver 0.6 Base\hppfaxprintersrv.exe [2459888 2014-08-14] (Hewlett-Packard Company)
HKLM\...\Run: [StatusAlerts] => C:\Program Files\HP\StatusAlerts\bin\HPStatusAlerts.exe [313248 2012-07-18] (Hewlett-Packard Company)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,userinit.exe
Winlogon\Notify\DeviceNP: C:\Windows\system32\DeviceNP.dll (Hewlett-Packard Limited)
HKU\S-1-5-21-1614596209-2777662679-913267390-1001\...\Run: [AROReminder] => [X]
HKU\S-1-5-21-1614596209-2777662679-913267390-1001\...\Run: [AIM for Windows] => "C:\Users\janice\AppData\Local\AOL\AIM\aim.exe"
HKU\S-1-5-21-1614596209-2777662679-913267390-1001\...\Run: [GoToMeeting] => C:\Program Files\Citrix\GoToMeeting\1133\g2mstart.exe [40816 2013-04-30] (Citrix Online, a division of Citrix Systems, Inc.)
HKU\S-1-5-21-1614596209-2777662679-913267390-1001\...\Run: [GoogleDriveSync] => C:\Program Files\Google\Drive\googledrivesync.exe [26232152 2015-02-19] (Google)
HKU\S-1-5-21-1614596209-2777662679-913267390-1001\...\Run: [4903C05AE9AB57B53A27693FF7048D6A8B2DA265._service_run] => C:\Program Files\Google\Chrome\Application\chrome.exe [809288 2015-03-30] (Google Inc.)
HKU\S-1-5-21-1614596209-2777662679-913267390-1001\...\Run: [GoogleChromeAutoLaunch_41D9CE09389FE1B3294D13AB76B81B46] => C:\Program Files\Google\Chrome\Application\chrome.exe [809288 2015-03-30] (Google Inc.)
HKU\S-1-5-21-1614596209-2777662679-913267390-1001\...\Run: [Amazon Music] => C:\Users\janice\AppData\Local\Amazon Music\Amazon Music Helper.exe [5886272 2015-03-02] ()
Lsa: [Notification Packages] DPPassFilter scecli
Startup: C:\Users\janice\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\janice\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software)
ShellIconOverlayIdentifiers: [GDriveBlacklistedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSharedEditOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSharedViewOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSyncedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSyncingOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:55242;https=127.0.0.1:55242
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
HKU\S-1-5-21-1614596209-2777662679-913267390-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.lakelandbank.com/default.aspx
HKU\S-1-5-21-1614596209-2777662679-913267390-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
HKU\S-1-5-21-1614596209-2777662679-913267390-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
SearchScopes: HKLM -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL =
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1614596209-2777662679-913267390-1001 -> {A11B5998-39F5-42F5-B7DE-C12D15C43B18} URL = https://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=523482&p={searchTerms}
BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2013-03-06] (RealDownloader)
BHO: File Sanitizer for HP ProtectTools -> {3134413B-49B4-425C-98A5-893C1F195601} -> C:\Program Files\Hewlett-Packard\File Sanitizer\IEBHO.dll [2010-05-06] (Hewlett-Packard)
BHO: HP ProtectTools Security Manager Extension -> {395610AE-C624-4f58-B89E-23733EA00F9A} -> C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpOtsPluginIe8.dll [2010-04-22] (DigitalPersona, Inc.)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_40\bin\ssv.dll [2015-04-09] (Oracle Corporation)
BHO: avast! WebRep -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2013-05-09] (AVAST Software)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-04-09] (Oracle Corporation)
Toolbar: HKLM - avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2013-05-09] (AVAST Software)
Toolbar: HKU\S-1-5-21-1614596209-2777662679-913267390-1001 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKU\S-1-5-21-1614596209-2777662679-913267390-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKU\S-1-5-21-1614596209-2777662679-913267390-1001 -> No Name - {41565256-3700-A76A-76A7-7A786E7484D7} - No File
DPF: {106E49CF-797A-11D2-81A2-00E02C015623} https://merchant.lakelandbank.com/WebCaptureWeb/alternatiff_licensed.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: sds - {79E0F14C-9C52-4218-89A7-7C4B0563D121} - C:\Program Files\Sharp\Sharpdesk\ExplorerExtensions.dll [2009-12-08] (SHARP CORPORATION)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\..\Interfaces\{52760699-64C9-4F0F-8791-D1B6936A8915}: [NameServer] 151.198.0.39,204.117.214.10

FireFox:
========
FF ProfilePath: C:\Users\janice\AppData\Roaming\Mozilla\Firefox\Profiles\4n87uf9r.default
FF DefaultSearchEngine: Yahoo!
FF SelectedSearchEngine: Yahoo!
FF Keyword.URL: https://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=523482&p=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-03-27] ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2013-04-08] ()
FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Google\Picasa3\npPicasa3.dll [2014-01-03] (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\system32\npDeployJava1.dll [2014-09-04] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-04-09] (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-05] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-05] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin: Web Components -> C:\Program Files\Web Components\npWebVideoPlugin.dll [2013-07-01] ()
FF Plugin HKU\S-1-5-21-1614596209-2777662679-913267390-1001: @citrixonline.com/appdetectorplugin -> C:\Users\janice\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2013-04-30] (Citrix Online)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2013-12-21] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppl3260.dll [2013-04-24] (RealNetworks, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nprpplugin.dll [2013-04-24] (RealPlayer)
FF Plugin ProgramFiles/Appdata: C:\Users\janice\AppData\Roaming\mozilla\plugins\npatgpc.dll [2014-12-04] (Cisco WebEx LLC)
FF SearchPlugin: C:\Users\janice\AppData\Roaming\Mozilla\Firefox\Profiles\4n87uf9r.default\searchplugins\AOL Search.xml [2014-02-11]
FF Extension: AOL Messaging Toolbar - C:\Users\janice\AppData\Roaming\Mozilla\Firefox\Profiles\4n87uf9r.default\Extensions\{c2f863cd-0429-48c7-bb54-db756a951760} [2014-02-11]
FF HKLM\...\Firefox\Extensions: [otis@digitalpersona.com] - C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt
FF Extension: DigitalPersona Extension - C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt [2011-05-26]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2011-05-28]
FF HKLM\...\Firefox\Extensions: [{DAC3F861-B30D-40dd-9166-F4E75327FAC7}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013-04-24]
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: No Name - C:\Users\janice\AppData\Roaming\Mozilla\Firefox\Profiles\4n87uf9r.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8} [Not Found]
FF Extension: No Name - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.0.0.100\IPSFF [Not Found]
FF Extension: No Name - C:\Users\janice\AppData\Roaming\Mozilla\Firefox\Profiles\4n87uf9r.default\extensions\cda2aa03-4bc9-4ec7-9498-460a0930b748@ad411bc8-5385-474c-96ad-ae0bd30853a6.com [Not Found]

Chrome:
=======
CHR StartupUrls: Default -> "hxxp://www.gmail.com/", "https://drive.google.com/a/minehill.com/?usp=chrome_app#my-drive", "https://www.google.com/calendar/render"
CHR DefaultSearchKeyword: Default -> yahoo.com search
CHR DefaultSearchURL: Default -> https://search.yahoo.com/search?fr=chr-yo_gc&ei=utf-8&ilc=12&type=523482&p={searchTerms}
CHR DefaultSuggestURL: Default -> https://ff.search.yahoo.com/gossip?output=fxjson&command={searchTerms}
CHR Profile: C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Live Documents) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\amaifjdaecbdedhngkjojpkdnjndpcch [2013-03-15]
CHR Extension: (Google Drive) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-04]
CHR Extension: (RemindMe) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\dkbeopafgiefnlffkhmkhldcojehlgam [2013-06-17]
CHR Extension: (Google Calendar) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjicmeblgpmajnghnpcppodonldlgfn [2013-03-15]
CHR Extension: (Pandora) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbangkleohkafngihneedemihgfeikcl [2013-03-19]
CHR Extension: (Wunderlist Panel) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnkkhbbhipldmgjflneimpacklkiogpo [2013-11-18]
CHR Extension: (Google Play Music) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\icppfcnhkcmnfdhfhphakoifcfokfdhg [2013-03-19]
CHR Extension: (RealDownloader) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2014-09-02]
CHR Extension: (Google Voice Desktop Notifier) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\ijhfodlhanopbgfajnmcimljnakgioee [2013-03-15]
CHR Extension: (Simple Wunderlist Popup) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\imnncalpbcgmbdcbhcmlihhmgdmolegl [2013-11-18]
CHR Extension: (Todoist: To-Do list and Task Manager) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\jldhpllghnbhlbpcmnajkpdmadaolakh [2013-03-15]
CHR Extension: (HelloSign: Online signatures made easy) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\kajjckmbclbffbpecfbiecehkfgopppd [2014-09-09]
CHR Extension: (Google Voice (by Google)) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcnhkahnjcbndmmehfkdnkjomaanaooo [2013-03-15]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-13]
CHR Extension: (Google Mail Checker) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\mihcahmgecmbnbcchbopgniflfhgnkff [2013-03-15]
CHR Extension: (GroupDocs Signature plugin for Gmail) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\nhlbakmenmejflfilefakdjhfoiohggl [2014-09-09]
CHR Extension: (Google Wallet) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-26]
CHR Extension: (My Chrome Theme) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\oehpjpccmlcalbenfhnacjeocbjdonic [2013-03-15]
CHR Extension: (Outlook.com) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfpeapihoiogbcmdmnibeplnikfnhoge [2015-03-30]
CHR HKLM\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2013-03-06]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 atashost; C:\Windows\system32\atashost.exe [118568 2014-12-04] (Cisco WebEx LLC)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
R2 DpHost; C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [300808 2010-04-22] (DigitalPersona, Inc.)
R2 EpsonScanSvc; C:\Windows\system32\EscSvc.exe [122000 2011-12-12] (Seiko Epson Corporation)
S3 FLCDLOCK; C:\Windows\system32\flcdlock.exe [362040 2010-04-28] (Hewlett-Packard Ltd)
R2 FMAuditOnsite; C:\Program Files\FMAuditOnsite\fmaonsite.exe [67664 2015-03-11] (ECi FMAudit)
S3 HP DS Service; C:\Program Files\HP\HPBDSService\HPBDSService.exe [13824 2011-10-17] (Hewlett-Packard Company) [File not signed]
R2 HP Health Check Service; C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [120832 2009-10-15] (Hewlett-Packard) [File not signed]
R2 HP LaserJet Service; C:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe [164864 2012-05-02] (HP) [File not signed]
R2 HP ProtectTools Service; C:\Program Files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [36864 2010-03-16] (Hewlett-Packard Development Company, L.P) [File not signed]
R2 Hp.Skyroom.Windows.Service; C:\Program Files\Hewlett-Packard\HP SkyRoom\Hp.Skyroom.Windows.Service.exe [124472 2010-03-03] (Hewlett-Packard)
R2 HpFkCryptService; C:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [281192 2010-02-01] (McAfee, Inc.)
R2 HPFSService; C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe [298496 2010-05-06] (Hewlett-Packard) [File not signed]
R2 LMIRescue_64eaaef1-33c8-4935-b520-fc5098fb7598; C:\Users\janice\AppData\Local\LogMeIn Rescue Applet\LMIR0001.tmp\LMI_Rescue_srv.exe [3088688 2015-04-09] (LogMeIn, Inc.)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [45568 2011-04-13] (Hewlett-Packard) [File not signed]
R2 pdfcDispatcher; C:\Program Files\PDF Complete\pdfsvc.exe [635416 2009-06-18] (PDF Complete Inc)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [55808 2011-04-13] (Hewlett-Packard) [File not signed]
R2 RealNetworks Downloader Resolver Service; C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-03-06] ()
R2 rgsender; c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\rgsendersvc.exe [379904 2009-11-19] (Hewlett-Packard, Inc.) [File not signed]
R2 SBT Log; C:\Program Files\Silver Bullet Technology\Ranger\Logging\SBTLogServiceWindows.exe [42496 2013-07-29] (Silver Bullet Technologies, Inc.) [File not signed]
R2 SWGVCSvc; C:\Program Files\SonicWALL\SonicWALL Global VPN Client\SWGVCSvc.exe [227352 2009-03-05] (SonicWALL, Inc.)
R2 UNS; C:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe [2066968 2009-07-24] (Intel Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswFsBlk; C:\Windows\system32\Drivers\aswFsBlk.sys [29816 2013-05-09] (AVAST Software)
R0 aswKbd; C:\Windows\system32\Drivers\aswKbd.sys [21576 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [66336 2013-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [61680 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49376 2013-05-09] ()
R1 aswSnx; C:\Windows\system32\Drivers\aswSnx.sys [770344 2013-06-27] (AVAST Software)
R1 aswSP; C:\Windows\system32\Drivers\aswSP.sys [369584 2013-06-27] (AVAST Software)
R1 aswTdi; C:\Windows\system32\Drivers\aswTdi.sys [56080 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [175176 2013-06-27] ()
S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv.sys [32312 2010-03-08] (Hewlett-Packard Development Company L.P.)
R3 DNE; C:\Windows\System32\DRIVERS\dne2000.sys [131984 2008-11-16] (Deterministic Networks, Inc.)
S3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [92888 2015-04-09] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2015-04-09] (Malwarebytes Corporation)
R1 RsvLock; C:\Windows\system32\Drivers\RsvLock.sys [40088 2010-02-01] (McAfee, Inc.)
R0 SafeBoot; C:\Windows\system32\Drivers\SafeBoot.sys [110520 2010-02-01] () [File not signed]
R0 SbAlg; C:\Windows\system32\Drivers\SbAlg.sys [51800 2010-02-01] (McAfee, Inc.)
R0 SbFsLock; C:\Windows\system32\Drivers\SbFsLock.sys [13256 2010-02-01] (McAfee, Inc.)
R3 SmrtSrc; C:\Windows\System32\DRIVERS\SmrtSrc.sys [199904 2012-06-04] (Jungo)
S1 SWIPsec; C:\Windows\system32\Drivers\SWIPsec.sys [87064 2009-03-05] (SonicWALL, Inc.)
S3 SWVNIC; C:\Windows\System32\DRIVERS\swvnic.sys [21016 2009-03-04] (SonicWALL, Inc.)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

Eric Witzling · Apr 9, 2015

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-09 15:16 - 2015-04-09 15:16 - 00000000 ____D () C:\FRST
2015-04-09 14:46 - 2015-04-09 14:46 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-09 14:46 - 2015-04-09 14:46 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-04-09 14:44 - 2015-04-09 14:44 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-04-09 14:24 - 2015-04-09 14:25 - 00000000 ____D () C:\ProgramData\Oracle
2015-04-09 14:24 - 2015-04-09 14:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-04-09 14:24 - 2015-04-09 14:24 - 00000000 ____D () C:\Program Files\Common Files\Java
2015-04-09 14:24 - 2014-09-04 14:04 - 00867240 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2015-04-09 14:24 - 2014-09-04 14:04 - 00789416 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2015-04-09 14:11 - 2015-04-09 14:11 - 01528128 _____ (LogMeIn, Inc.) C:\Users\janice\Downloads\Support-LogMeInRescue (6).exe
2015-04-09 14:11 - 2015-04-09 14:11 - 00000000 ____D () C:\Users\janice\AppData\Local\LogMeIn Rescue Applet
2015-04-08 12:19 - 2015-04-08 12:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FMAudit Onsite
2015-04-08 12:17 - 2015-04-08 12:17 - 01528128 _____ (LogMeIn, Inc.) C:\Users\janice\Downloads\Support-LogMeInRescue (5).exe
2015-04-08 10:17 - 2015-04-08 10:17 - 00000806 _____ () C:\Users\janice\Downloads\OpenInvList_------------6339.csv
2015-04-08 03:00 - 2015-04-08 03:00 - 00000000 ___SD () C:\Windows\system32\GWX
2015-04-02 14:11 - 2015-04-02 14:11 - 00001131 _____ () C:\Users\janice\Desktop\Amazon Music.lnk
2015-04-02 13:56 - 2015-04-02 13:59 - 40776304 _____ (Amazon) C:\Users\janice\Downloads\AmazonMusicInstaller.exe
2015-03-31 11:31 - 2015-03-31 11:31 - 00023690 _____ () C:\Users\janice\Downloads\Dover Municipal Court Graph (1).xlsx
2015-03-31 11:31 - 2015-03-31 11:31 - 00022194 _____ () C:\Users\janice\Downloads\Dover Municipal Court Graph.xlsx
2015-03-30 11:30 - 2015-03-30 11:30 - 00022801 _____ () C:\Users\janice\Downloads\Fixed Asset Report (1).xlsx
2015-03-27 08:59 - 2015-04-09 14:48 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-27 08:59 - 2015-03-27 09:48 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-03-25 14:24 - 2015-03-27 12:59 - 00000000 ___RD () C:\Users\janice\Desktop\Purchase Orders
2015-03-25 09:22 - 2015-03-10 23:30 - 00623616 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-03-25 09:22 - 2015-03-10 23:30 - 00534528 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-03-25 09:22 - 2015-03-10 23:29 - 00818176 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-03-25 09:22 - 2015-03-10 23:29 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-03-25 09:22 - 2015-03-10 23:29 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-03-25 09:22 - 2015-03-10 23:29 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-03-25 09:22 - 2015-03-10 23:29 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-03-25 09:22 - 2015-03-10 23:26 - 00892928 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-03-24 14:38 - 2015-03-24 14:38 - 00007168 _____ () C:\Users\janice\Downloads\12010357 (2).xls
2015-03-24 12:46 - 2015-03-24 12:46 - 01528128 _____ (LogMeIn, Inc.) C:\Users\janice\Downloads\Support-LogMeInRescue (4).exe
2015-03-24 12:10 - 2015-03-24 12:10 - 00017643 _____ () C:\Users\janice\Downloads\Time Sheets, PTO 3-8-15 to 3-21-15.xlsx
2015-03-23 11:13 - 2015-03-23 11:13 - 00013160 _____ () C:\Users\janice\Downloads\RVRSA Flow chart.xlsx
2015-03-17 11:20 - 2015-04-08 12:19 - 00000000 ____D () C:\Program Files\FMAuditOnsite
2015-03-17 11:17 - 2015-04-08 12:17 - 08241152 _____ (Microsoft Corporation) C:\Users\janice\Desktop\FMAInstaller_3453.exe
2015-03-17 11:16 - 2015-03-17 11:16 - 01528128 _____ (LogMeIn, Inc.) C:\Users\janice\Downloads\Support-LogMeInRescue (3).exe
2015-03-11 15:27 - 2015-03-11 15:27 - 00000000 ___RD () C:\Users\janice\Desktop\New Briefcase (2)
2015-03-11 15:16 - 2015-03-11 15:21 - 00000000 ___RD () C:\Users\janice\Desktop\New Briefcase
2015-03-11 01:12 - 2015-02-02 23:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-03-11 01:11 - 2015-02-25 23:11 - 02381312 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-03-11 01:11 - 2015-02-23 22:32 - 00342696 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-03-11 01:11 - 2015-02-20 20:41 - 12827648 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-03-11 01:11 - 2015-02-20 20:27 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-03-11 01:11 - 2015-02-20 20:27 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-03-11 01:11 - 2015-02-20 20:25 - 19720192 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-03-11 01:11 - 2015-02-20 19:32 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-03-11 01:11 - 2015-02-19 22:22 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-03-11 01:11 - 2015-02-19 22:22 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-03-11 01:11 - 2015-02-19 22:09 - 00503296 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-03-11 01:11 - 2015-02-19 22:08 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-03-11 01:11 - 2015-02-19 22:08 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-03-11 01:11 - 2015-02-19 22:06 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-03-11 01:11 - 2015-02-19 22:03 - 02278400 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-03-11 01:11 - 2015-02-19 22:01 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-03-11 01:11 - 2015-02-19 22:00 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-03-11 01:11 - 2015-02-19 21:58 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-03-11 01:11 - 2015-02-19 21:56 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-03-11 01:11 - 2015-02-19 21:56 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-03-11 01:11 - 2015-02-19 21:56 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-03-11 01:11 - 2015-02-19 21:50 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-03-11 01:11 - 2015-02-19 21:41 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-03-11 01:11 - 2015-02-19 21:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-03-11 01:11 - 2015-02-19 21:30 - 04300288 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-03-11 01:11 - 2015-02-19 21:24 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-03-11 01:11 - 2015-02-19 21:24 - 00689152 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-03-11 01:11 - 2015-02-19 21:24 - 00684544 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-03-11 01:11 - 2015-02-19 21:23 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-03-11 01:11 - 2015-02-19 21:01 - 01888256 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-03-11 01:11 - 2015-02-19 20:57 - 01311232 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-03-11 01:11 - 2015-02-19 20:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-03-11 01:11 - 2015-02-13 01:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-03-11 01:11 - 2015-01-16 22:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-03-11 01:09 - 2015-03-06 01:15 - 00137656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-03-11 01:09 - 2015-03-06 01:15 - 00067512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-03-11 01:09 - 2015-03-06 01:10 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-03-11 01:09 - 2015-03-06 01:10 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-03-11 01:09 - 2015-03-06 01:10 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-03-11 01:09 - 2015-03-06 01:10 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-03-11 01:09 - 2015-03-06 01:10 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-03-11 01:09 - 2015-03-06 01:10 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-03-11 01:09 - 2015-03-06 01:10 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-03-11 01:09 - 2015-03-06 01:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-03-11 01:09 - 2015-03-06 01:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-03-11 01:09 - 2015-03-06 01:10 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-03-11 01:09 - 2015-03-06 01:10 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-03-11 01:09 - 2015-03-06 01:09 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-03-11 01:09 - 2015-03-06 01:09 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-03-11 01:09 - 2015-03-06 01:07 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-03-11 01:09 - 2015-03-06 01:07 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-03-11 01:09 - 2015-03-06 01:06 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-03-11 01:09 - 2015-02-20 00:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-03-11 01:09 - 2015-02-20 00:13 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-03-11 01:09 - 2015-02-20 00:13 - 00026624 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-03-11 01:09 - 2015-02-20 00:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-03-11 01:09 - 2015-02-19 23:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-03-11 01:09 - 2015-02-03 22:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-03-11 01:09 - 2015-02-02 23:16 - 03973048 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-03-11 01:09 - 2015-02-02 23:16 - 03917760 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-03-11 01:09 - 2015-02-02 23:16 - 00078784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-03-11 01:09 - 2015-02-02 23:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-03-11 01:09 - 2015-02-02 23:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-03-11 01:09 - 2015-02-02 23:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-03-11 01:09 - 2015-02-02 23:12 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-03-11 01:09 - 2015-02-02 23:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2015-03-11 01:09 - 2015-01-30 19:56 - 00370488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-03-11 01:09 - 2014-10-31 18:22 - 00521384 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2015-03-11 01:08 - 2015-02-02 23:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2015-03-11 01:08 - 2015-02-02 23:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2015-03-11 01:08 - 2015-02-02 23:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2015-03-11 01:08 - 2015-02-02 23:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2015-03-11 01:08 - 2015-02-02 23:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2015-03-11 01:08 - 2015-02-02 23:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2015-03-11 01:08 - 2015-02-02 23:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2015-03-11 01:08 - 2015-02-02 23:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2015-03-11 01:08 - 2015-02-02 23:12 - 00475136 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-03-11 01:08 - 2015-02-02 23:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-03-11 01:08 - 2015-02-02 23:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2015-03-11 01:08 - 2015-02-02 23:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-03-11 01:08 - 2015-02-02 23:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2015-03-11 01:08 - 2015-02-02 23:12 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-03-11 01:08 - 2015-02-02 23:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2015-03-11 01:08 - 2015-02-02 23:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-03-11 01:08 - 2015-02-02 23:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-03-11 01:08 - 2015-02-02 23:12 - 00157184 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2015-03-11 01:08 - 2015-02-02 23:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-03-11 01:08 - 2015-02-02 23:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-03-11 01:08 - 2015-02-02 23:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-03-11 01:08 - 2015-02-02 23:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2015-03-11 01:08 - 2015-02-02 23:12 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-03-11 01:08 - 2015-02-02 23:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-03-11 01:08 - 2015-02-02 23:12 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-03-11 01:08 - 2015-02-02 23:12 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-03-11 01:08 - 2015-02-02 23:12 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-03-11 01:08 - 2015-02-02 23:12 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
2015-03-11 01:08 - 2015-02-02 23:12 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-03-11 01:08 - 2015-02-02 23:12 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-03-11 01:08 - 2015-02-02 23:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-03-11 01:08 - 2015-02-02 23:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-03-11 01:08 - 2015-02-02 23:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-03-11 01:08 - 2015-02-02 23:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-03-11 01:08 - 2015-02-02 23:11 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-03-11 01:08 - 2015-02-02 23:11 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-03-11 01:08 - 2015-02-02 23:11 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-03-11 01:08 - 2015-02-02 23:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-03-11 01:08 - 2015-02-02 23:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-03-11 01:08 - 2015-02-02 23:11 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-03-11 01:08 - 2015-02-02 23:11 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
2015-03-11 01:08 - 2015-02-02 23:11 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
2015-03-11 01:08 - 2015-02-02 23:10 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
2015-03-11 01:08 - 2015-02-02 23:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-03-11 01:08 - 2015-02-02 23:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-03-11 01:08 - 2015-02-02 23:00 - 00593920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2015-03-11 01:08 - 2015-02-02 22:26 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-03-10 11:06 - 2015-03-10 11:06 - 01035696 _____ (Ask.com) C:\Users\janice\Downloads\OffercastInstaller_AVR_U-0270-01-P_.exe
2015-03-10 11:02 - 2015-03-10 11:02 - 01035696 _____ (Ask.com) C:\Users\janice\Downloads\OffercastInstaller_AVR_U-0269-01-P_.exe
2015-03-10 10:27 - 2015-03-10 10:27 - 00028668 _____ () C:\Users\janice\Downloads\fwdfemaprojectcompletioncertificationreport.zip
2015-03-10 09:52 - 2015-03-10 09:52 - 00025600 _____ () C:\Users\janice\Downloads\52Convert_Military_Time_to_Regular.xls

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-09 15:12 - 2009-07-14 00:34 - 00021680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-09 15:12 - 2009-07-14 00:34 - 00021680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-09 15:08 - 2011-05-26 15:38 - 01212467 _____ () C:\Windows\WindowsUpdate.log
2015-04-09 15:05 - 2014-12-04 16:50 - 00000000 ____D () C:\temp
2015-04-09 15:05 - 2014-09-02 10:04 - 00000000 ___RD () C:\Users\janice\Dropbox
2015-04-09 15:05 - 2014-09-02 10:00 - 00000000 ____D () C:\Users\janice\AppData\Roaming\Dropbox
2015-04-09 15:05 - 2014-03-26 09:19 - 00000000 ____D () C:\Users\janice\AppData\Local\CrashDumps
2015-04-09 15:05 - 2011-05-26 15:44 - 00000000 ____D () C:\ProgramData\HPQLOG
2015-04-09 15:04 - 2011-10-14 16:28 - 00000882 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-09 15:04 - 2009-07-14 00:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-09 15:04 - 2009-07-14 00:39 - 00091757 _____ () C:\Windows\setupact.log
2015-04-09 14:52 - 2011-10-14 16:28 - 00000886 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-09 14:50 - 2014-05-21 13:18 - 00000000 ____D () C:\AdwCleaner
2015-04-09 14:50 - 2014-05-14 09:56 - 00000568 _____ () C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-1614596209-2777662679-913267390-1001.job
2015-04-09 14:31 - 2011-10-14 16:28 - 00000000 ____D () C:\Program Files\Google
2015-04-09 14:31 - 2011-05-26 16:08 - 00878804 _____ () C:\Windows\PFRO.log
2015-04-09 14:25 - 2014-09-04 14:04 - 00000000 ____D () C:\Program Files\Java
2015-04-09 14:24 - 2014-09-04 14:04 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2015-04-09 14:21 - 2014-03-10 10:49 - 00000000 ____D () C:\RLDATA
2015-04-09 14:17 - 2011-10-14 16:28 - 00000000 ____D () C:\Users\janice\AppData\Local\Google
2015-04-09 14:17 - 2011-10-14 16:28 - 00000000 ____D () C:\ProgramData\Google
2015-04-08 16:30 - 2015-03-02 17:30 - 00000000 ___RD () C:\Users\janice\Desktop\Daily
2015-04-08 15:41 - 2015-01-14 10:45 - 00000000 ____D () C:\Users\janice\AppData\Roaming\Xerox
2015-04-08 03:00 - 2011-05-26 15:44 - 00000000 ____D () C:\ProgramData\PDFC
2015-04-07 10:10 - 2014-03-10 10:49 - 00000000 ____D () C:\RLEMAIL
2015-04-07 09:09 - 2009-07-25 08:54 - 00782510 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-02 16:37 - 2014-07-22 13:15 - 00000000 ___RD () C:\Users\janice\Desktop\KATELYN
2015-03-31 14:31 - 2015-01-14 10:41 - 00000000 ____D () C:\Xerox_Scans
2015-03-30 12:56 - 2013-10-31 15:20 - 00000000 ____D () C:\Users\janice\Documents\Outlook Files
2015-03-27 09:48 - 2011-06-06 12:16 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-03-26 03:02 - 2014-12-10 16:34 - 00000000 ____D () C:\Windows\system32\appraiser
2015-03-26 03:02 - 2014-05-06 03:00 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-03-19 03:22 - 2009-07-13 22:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-03-13 09:37 - 2014-09-02 10:04 - 00000000 ____D () C:\Users\janice\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-03-11 13:55 - 2009-07-13 22:37 - 00000000 ____D () C:\Windows\rescache
2015-03-11 03:24 - 2009-07-14 00:33 - 00426008 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-11 03:07 - 2011-05-26 15:41 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-03-11 03:06 - 2009-07-13 22:04 - 00000580 _____ () C:\Windows\win.ini
2015-03-10 05:55 - 2014-02-28 14:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive

==================== Files in the root of some directories =======

2014-01-30 14:31 - 2014-01-30 14:31 - 0000140 _____ () C:\Users\janice\AppData\Roaming\bibstats
2014-03-13 12:10 - 2014-03-24 10:10 - 0000080 _____ () C:\Users\janice\AppData\Roaming\WB.CFG
2012-02-24 12:36 - 2012-02-24 12:36 - 0000316 _____ () C:\ProgramData\hpzinstall.log

Some content of TEMP:
====================
C:\Users\janice\AppData\Local\Temp\1398328268_PCSpeedMaximizer_1.exe
C:\Users\janice\AppData\Local\Temp\17718uninstall.exe
C:\Users\janice\AppData\Local\Temp\air35CC.exe
C:\Users\janice\AppData\Local\Temp\air9118.exe
C:\Users\janice\AppData\Local\Temp\airC1B7.exe
C:\Users\janice\AppData\Local\Temp\airF18A.exe
C:\Users\janice\AppData\Local\Temp\airF69D.exe
C:\Users\janice\AppData\Local\Temp\airFF70.exe
C:\Users\janice\AppData\Local\Temp\aol-messaging_trioCD5D.exe
C:\Users\janice\AppData\Local\Temp\BackupSetup.exe
C:\Users\janice\AppData\Local\Temp\cloud_backup_setup.exe
C:\Users\janice\AppData\Local\Temp\desktopweatheralertssetup.exe
C:\Users\janice\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpoqn1ty.dll
C:\Users\janice\AppData\Local\Temp\FP_PL_PFS_INSTALLER.exe
C:\Users\janice\AppData\Local\Temp\freesofttoday.exe
C:\Users\janice\AppData\Local\Temp\GoogleToolbarInstaller_en32_signed.exe
C:\Users\janice\AppData\Local\Temp\HPQSi.exe
C:\Users\janice\AppData\Local\Temp\install_reader10_en_air_gtba_aih[1].exe
C:\Users\janice\AppData\Local\Temp\jre-8u40-windows-au.exe
C:\Users\janice\AppData\Local\Temp\lowproc.exe
C:\Users\janice\AppData\Local\Temp\newvideoplayersetup.exe
C:\Users\janice\AppData\Local\Temp\nscBC4B.exe
C:\Users\janice\AppData\Local\Temp\nsd7C8F.exe
C:\Users\janice\AppData\Local\Temp\nsl1CBF.exe
C:\Users\janice\AppData\Local\Temp\nsl21EE.exe
C:\Users\janice\AppData\Local\Temp\nsm2F73.exe
C:\Users\janice\AppData\Local\Temp\nsq63E1.exe
C:\Users\janice\AppData\Local\Temp\nssB50A.exe
C:\Users\janice\AppData\Local\Temp\nsv5DE7.exe
C:\Users\janice\AppData\Local\Temp\nsx268D.exe
C:\Users\janice\AppData\Local\Temp\oi_{9412D65A-F062-4C6B-A151-06DDE925876D}.exe
C:\Users\janice\AppData\Local\Temp\ose00000.exe
C:\Users\janice\AppData\Local\Temp\Quarantine.exe
C:\Users\janice\AppData\Local\Temp\safeguard.exe
C:\Users\janice\AppData\Local\Temp\SearchProtectionSetup.exe
C:\Users\janice\AppData\Local\Temp\sp-downloader.exe
C:\Users\janice\AppData\Local\Temp\speedupmypc.exe
C:\Users\janice\AppData\Local\Temp\spidentifierimpl.exe
C:\Users\janice\AppData\Local\Temp\spidentifierimpl2.exe
C:\Users\janice\AppData\Local\Temp\sqlite3.dll
C:\Users\janice\AppData\Local\Temp\stubhelper.dll
C:\Users\janice\AppData\Local\Temp\wajam_download.exe
C:\Users\janice\AppData\Local\Temp\_is220D.exe
C:\Users\janice\AppData\Local\Temp\_is2E4D.exe
C:\Users\patty\AppData\Local\Temp\SearchWithGoogleUpdate.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-04-07 11:57

==================== End Of Log ============================

Eric Witzling · Apr 9, 2015

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 11-03-2015
Ran by janice at 2015-04-09 15:16:54
Running from C:\downloads
Boot Mode: Normal
==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Disabled - Out of date) {2B2D1395-420B-D5C9-657E-930FE358FC3C}
AS: avast! Antivirus (Disabled - Out of date) {904CF271-6431-DA47-5FCE-A87D98DFB681}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

32 Bit HP CIO Components Installer (Version: 8.1.4 - Hewlett-Packard) Hidden
ACH Origination Application (Version: 1.3.0.37 - Information Technology Inc.) Hidden
Acrobat Reader Packages (HKU\S-1-5-21-1614596209-2777662679-913267390-1001\...\Acrobat Reader Packages) (Version: - ) <==== ATTENTION
ActiveCheck component for HP Active Support Library (Version: 3.0.0.1 - Hewlett-Packard) Hidden
Adobe AIR (HKLM\...\Adobe AIR) (Version: 3.0.0.4080 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 17 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 17.0.0.134 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Amazon Music (HKU\S-1-5-21-1614596209-2777662679-913267390-1001\...\Amazon Amazon Music) (Version: 3.8.1.754 - Amazon Services LLC)
Apple Application Support (HKLM\...\{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}) (Version: 2.3.4 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{E14ADE0E-75F3-4A46-87E5-26692DD626EC}) (Version: 6.1.0.13 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ARO 2013 (HKLM\...\ARO 2013_is1) (Version: 8.0 - Support.com)
avast! Pro Antivirus (HKLM\...\avast) (Version: 8.0.1489.0 - AVAST Software)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
Centra Client (HKLM\...\CentraClient) (Version: - )
Cisco WebEx Meetings (HKU\S-1-5-21-1614596209-2777662679-913267390-1001\...\ActiveTouchMeetingClient) (Version: - Cisco WebEx LLC)
Citrix Online Launcher (HKLM\...\{F17C3DC2-2ACA-4B0E-BDBF-ACE61B14E7CD}) (Version: 1.0.183 - Citrix)
Device Access Manager for HP ProtectTools (HKLM\...\{55B52830-024A-443E-AF61-61E1E71AFA1B}) (Version: 5.0.1.8 - Hewlett-Packard)
Drive Encryption for HP ProtectTools (HKLM\...\Drive Encryption) (Version: 5.0.6.0 - Hewlett-Packard)
Drive Encryption for HP ProtectTools (Version: 5.0.6.0 - Hewlett-Packard) Hidden
Dropbox (HKU\S-1-5-21-1614596209-2777662679-913267390-1001\...\Dropbox) (Version: 3.2.9 - Dropbox, Inc.)
Epson Copy Utility 3.5 (HKLM\...\{AA72FB28-73B4-49E5-B6B4-E78F44BBD0AD}) (Version: 3.5.0.0 - )
Epson Event Manager (HKLM\...\{8F01524C-0676-4CC1-B4AE-64753C723391}) (Version: 3.01.0005 - Seiko Epson Corporation)
EPSON Scan (HKLM\...\EPSON Scanner) (Version: - Seiko Epson Corporation)
EPSON Scan PDF EXtensions (HKLM\...\{F9956472-6E16-4F83-BF9A-F887EF4A45B7}) (Version: 1.03.0000 - SEIKO EPSON Corp.)
EPSON WorkForce GT-1500 Scanner Driver Update version 3.0.2.0 (HKLM\...\ScannerDriverUpdateEPSON WorkForce GT-1500_is1) (Version: 3.0.2.0 - Epson America Inc.)
Express-O-Pay (HKLM\...\{11AC9AE1-0A46-11D4-8A7C-00104B11E715}) (Version: - )
File Sanitizer For HP ProtectTools (HKLM\...\{6D6ADF03-B257-4EA5-BBC1-1D145AF8D514}) (Version: 5.0.1.4 - Hewlett-Packard)
FMAudit Onsite (HKLM\...\FMAudit Onsite3.1.0.50311) (Version: 3.1.0.50311 - FMAudit (ECi))
Fund Accounting 1.83 (HKU\S-1-5-21-1614596209-2777662679-913267390-1001\...\Fund Accounting) (Version: 1.83 - Municipal Software)
Google Chrome (HKLM\...\Google Chrome) (Version: 41.0.2272.118 - Google Inc.)
Google Drive (HKLM\...\{6C36881B-0E51-4231-9D02-BF2149664D34}) (Version: 1.20.8672.3137 - Google, Inc.)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.26.9 - Google Inc.) Hidden
Google+ Auto Backup (HKLM\...\{AF71B42D-3821-4376-9974-84E507F88EC0}) (Version: 1.0.20.80 - Google)
GoToMeeting 7.1.3.2457 (HKU\S-1-5-21-1614596209-2777662679-913267390-1001\...\GoToMeeting) (Version: 7.1.3.2457 - CitrixOnline)
HP LaserJet 400 MFP M425 (HKLM\...\{568705AA-DD8A-4134-B8B9-9609721FBBCE}) (Version: 5.0.12200.1138 - Hewlett-Packard)
HP LaserJet P3010 Series PCL 6 (HKLM\...\HP LaserJet P3010 Series PCL 6) (Version: 10/09/2008 61.083.41.03 - HP)
HP LaserJet P3010 Series Screen Fonts (HKLM\...\{CB71331A-9DCE-4A0D-B527-FD96BD5CFC4A}) (Version: 2.0.0.0 - Hewlett Packard, Co.)
HP LaserJet P3010 Series User Guide (HKLM\...\{06C4BA69-5210-4707-B5BE-E26D487E1854}) (Version: 1.0.0.0 - Hewlett Packard, Co.)
HP ProtectTools Security Manager (HKLM\...\HPProtectTools) (Version: 5.08.717 - Hewlett-Packard Company)
HP SkyRoom (HKLM\...\InstallShield_{0DEDF0B4-7737-447D-A705-A8E1831E3FCB}) (Version: 1.1.6.5201. - Hewlett-Packard)
HP Support Assistant (HKLM\...\{495A8A3C-8FD0-4C46-9979-95C26181A1AB}) (Version: 4.3.1.2 - Hewlett-Packard)
HP Update (HKLM\...\{6F1C00D2-25C2-4CBA-8126-AE9A6E2E9CD5}) (Version: 5.003.003.001 - Hewlett-Packard)
HPAsset component for HP Active Support Library (Version: 3.0.0.3 - Hewlett-Packard) Hidden
hpbDSService (Version: 002.002.07399 - Hewlett-Packard) Hidden
hpbM425DSService (Version: 001.001.05874 - Hewlett-Packard) Hidden
HPDXP (Version: 3.0.26.11 - HP) Hidden
HPLaserJet400MFP-M425_HelpLearnCenter_SI (HKLM\...\{55D8D1AB-94C2-498F-A165-608B834A30EA}) (Version: 1.01.0000 - Hewlett-Packard)
HPLJDXPHelper (Version: 020.021.004 - HP) Hidden
HPLJUTCore (Version: 004.005.0001 - HP) Hidden
HPLJUTM425 (Version: 3.00.0003 - HP) Hidden
hppFaxDrvM425 (Version: 003.000.00002 - Hewlett-Packard) Hidden
hppLaserJetService (Version: 009.027.00856 - Hewlett-Packard) Hidden
hppM425LaserJetService (Version: 001.019.00639 - Hewlett-Packard) Hidden
hppSendFaxM425 (Version: 003.000.00002 - Hewlett-Packard) Hidden
hpStatusAlerts (Version: 050.037.00142 - Hewlett Packard) Hidden
hpStatusAlertsM425 (Version: 050.034.00131 - Hewlett-Packard) Hidden
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: - Intel Corporation)
Intel® Active Management Technology (HKLM\...\MESOL) (Version: - Intel Corporation)
IP Office Admin Suite (HKLM\...\{30FBFB1E-0237-469E-930B-0DE4C286987D}) (Version: 9.0.300.941 - Avaya)
iTunes (HKLM\...\{91FD46D2-4FB7-4A51-8637-556E1BE1DB7C}) (Version: 11.0.4.4 - Apple Inc.)
Java 8 Update 40 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218040F0}) (Version: 8.0.400 - Oracle Corporation)
Java Card Security for HP ProtectTools (HKLM\...\{F4477CC0-7293-414A-93BC-20EE897A80F0}) (Version: 5.0.4.1 - Hewlett-Packard)
join.me (HKU\S-1-5-21-1614596209-2777662679-913267390-1001\...\JoinMe) (Version: 1.20.0.116 - LogMeIn, Inc.)
LJDXPHelperUI (Version: 020.021.004 - HP) Hidden
Malwarebytes' Anti-Malware version 1.51.2.1300 (HKLM\...\Malwarebytes' Anti-Malware_is1) (Version: 1.51.2.1300 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Home and Business 2010 (HKLM\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.8 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Thunderbird 14.0 (x86 en-US) (HKLM\...\Mozilla Thunderbird 14.0 (x86 en-US)) (Version: 14.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
PaperPort Image Printer (HKLM\...\{2BC2781A-F7F6-452E-95EB-018A522F1B2C}) (Version: 1.00.0000 - Nuance Communications, Inc.)
PDF Complete Special Edition (HKLM\...\PDF Complete) (Version: 3.5.109 - PDF Complete, Inc)
PDF Reader 2013 (HKLM\...\PDF Reader) (Version: 2013 - PDF Reader)
Personnel & Payroll 2.1 (HKU\S-1-5-21-1614596209-2777662679-913267390-1001\...\Personnel & Payroll) (Version: 2.1 - Municipal Software)
Picasa 3 (HKLM\...\Picasa 3) (Version: 3.9 - Google, Inc.)
PowerTerm 5.4 (HKLM\...\PowerTerm 5.4) (Version: - )
Privacy Manager for HP ProtectTools (HKLM\...\{350F790E-5C32-4B3A-8AAB-B0478BB76D11}) (Version: 5.10.796 - Hewlett-Packard)
Ranger (HKLM\...\Ranger) (Version: 4.2.3.0 - Silver Bullet Technology, Inc.)
Ranger plug-in: Burroughs-SmartPVA v2.0.3.0 (HKLM\...\Ranger Scanner Plug-in: Burroughs-SmartPVA) (Version: 2.0.3.0 - Silver Bullet Technology, Inc.)
RealDownloader (Version: 1.3.1 - RealNetworks, Inc.) Hidden
RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0 - RealNetworks, Inc) Hidden
RealPlayer (HKLM\...\RealPlayer 16.0) (Version: 16.0.0 - RealNetworks)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5886 - Realtek Semiconductor Corp.)
RealUpgrade 1.1 (Version: 1.1.0 - RealNetworks, Inc.) Hidden
Remote Graphics Receiver (HKLM\...\{16FC3056-90C0-4757-8A68-64D8DA846ADA}) (Version: 5.3.2 - Hewlett-Packard)
Remote Graphics Receiver (Version: 5.3.2 - Hewlett-Packard) Hidden
Remote Graphics Sender (HKLM\...\{2A08C71B-CC60-42EA-8DA2-FE5486E3B20B}) (Version: 5.3.2 - Hewlett-Packard)
Remote Graphics Sender (Version: 5.3.2 - Hewlett-Packard) Hidden
ScanSoft PaperPort 11 (HKLM\...\{DEA18FF6-D84A-4242-9663-692E5BA56805}) (Version: 11.1.0000 - Nuance Communications, Inc.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
SHARP MX/DX Series PCL/PS Printer Driver (HKLM\...\SHARP MX-2300 2700 3500 4500 Series PCL PS Printer Driver) (Version: 1.00.000 - SHARP)
Sharpdesk (HKLM\...\{8664FCE8-F91A-42BC-927C-AA318185E5EA}) (Version: 3.3 - SHARP CORPORATION)
SonicWALL Global VPN Client (HKLM\...\{40624553-811E-400E-B69B-38D8926A66BD}) (Version: 4.2.6 - SonicWALL)
Theft Recovery (HKLM\...\InstallShield_{33C9F24B-1D92-4632-A915-81E3BB1D5D6B}) (Version: 5.1.0.19 - Hewlett-Packard)
Theft Recovery (Version: 5.1.0.19 - Hewlett-Packard) Hidden
Web Components (HKLM\...\{03B13AF8-9625-478A-AF0E-205337B9415A}_is1) (Version: - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-1614596209-2777662679-913267390-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\janice\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1614596209-2777662679-913267390-1001_Classes\CLSID\{53B5243F-8302-4DAD-BE8F-1D0665E8225E}\InprocServer32 -> C:\Program Files\HP\Common\FWUpdateEDO3.dll (Hewlett-Packard Company)
CustomCLSID: HKU\S-1-5-21-1614596209-2777662679-913267390-1001_Classes\CLSID\{6d05bf60-3eaf-4a97-87c5-10cce505435b}\localserver32 -> C:\Users\janice\AppData\Local\Temp\{9c0ba3c1-2b67-45eb-bf69-bed9658d28d2}\IDriver.NonElevated.exe (InstallShield Software Corporation)
CustomCLSID: HKU\S-1-5-21-1614596209-2777662679-913267390-1001_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Program Files\Citrix\GoToMeeting\1133\G2MOutlookAddin.dll (Citrix Online, a division of Citrix Systems, Inc.)
CustomCLSID: HKU\S-1-5-21-1614596209-2777662679-913267390-1001_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1614596209-2777662679-913267390-1001_Classes\CLSID\{EEA0F5AD-B66A-25DD-2023-476B84882EB5}\InprocServer32 -> C:\Windows\system32\ole32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1614596209-2777662679-913267390-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1614596209-2777662679-913267390-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1614596209-2777662679-913267390-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1614596209-2777662679-913267390-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1614596209-2777662679-913267390-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1614596209-2777662679-913267390-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1614596209-2777662679-913267390-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1614596209-2777662679-913267390-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)

==================== Restore Points =========================

23-03-2015 09:13:25 Windows Update
26-03-2015 03:00:20 Windows Update
31-03-2015 09:01:29 Windows Update
07-04-2015 09:07:44 Windows Update
08-04-2015 03:00:26 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 22:04 - 2011-05-27 18:44 - 00000867 ____A C:\Windows\system32\Drivers\etc\hosts
192.130.235.1 minehill
192.130.235.2 tax

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {00246647-2862-453C-8282-E3863D77F53B} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1614596209-2777662679-913267390-1001 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2013-03-06] (RealNetworks, Inc.)
Task: {063AEBF6-278F-4736-9D11-0431309CFACA} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {07F792C9-5775-41F4-AD1B-CA93EAEE1EB5} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {1E5912E6-604E-4AD3-93A0-F0A3ED0CD094} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-12-16] (Google Inc.)
Task: {234DAD34-4758-420E-9430-90741DFD2F54} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {28425347-70AA-40C7-8BA9-67EC2F57E376} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1614596209-2777662679-913267390-1001 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2013-03-06] (RealNetworks, Inc.)
Task: {357F2CEC-3E73-4300-A560-D20204CC6EE6} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {38BA6EAC-5020-4EE0-BB6C-1F52EAD115FB} - System32\Tasks\Hewlett-Packard\HP Assistant\PC Health Analysis => C:\Program Files\Hewlett-Packard\HP Support Framework\HPSF.exe [2009-11-10] (Hewlett-Packard)
Task: {601D3505-2BD7-481C-80C6-58CB733ABF63} - System32\Tasks\Hewlett-Packard\HP Assistant\PC Tuneup => C:\Program Files\Hewlett-Packard\HP Support Framework\HPSF.exe [2009-11-10] (Hewlett-Packard)
Task: {7306FF23-269A-4084-AA6C-437DBD652AE3} - System32\Tasks\{404A01BB-5486-4DF4-BFBC-2B7A9BE23F02} => pcalua.exe -a C:\Users\janice\Desktop\msihelp(3).exe -d C:\Users\janice\Desktop
Task: {791A0856-A565-4E7E-AB5B-3DD9029FC54B} - System32\Tasks\{07FC2DD9-E393-44DB-BC29-855E3AE179E4} => pcalua.exe -a C:\Users\janice\Desktop\msihelp.exe -d C:\Users\janice\Desktop
Task: {9B1CA709-C89E-4465-9529-007B141598BC} - System32\Tasks\HPLJCustParticipation => C:\Program Files\HP\HPLJUT\HPLJUTSCH.exe [2012-06-15] (Hewlett Packard)
Task: {A4078892-EDE7-4D11-9F34-37994E31FC83} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {A5E18423-E8E3-4667-9548-3D0CCE175893} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-05-09] (AVAST Software)
Task: {B1D4F1ED-3794-4BB8-BC65-51A7A236B857} - System32\Tasks\Onsite_Watchdog => C:\Program Files\FMAuditOnsite\watchdog.bat [2015-03-11] ()
Task: {B636CBA4-0315-431F-9907-65C391EB3124} - System32\Tasks\{6FF187BE-1AEB-47AE-924C-0B6BA9D7086E} => pcalua.exe -a "C:\Program Files\Mozilla Thunderbird\uninstall\helper.exe" -d "C:\Program Files\Mozilla Thunderbird" -c /UpdateShortcutAppUserModelIds
Task: {DA18705A-3FD1-451F-90FE-B4E129A04D51} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-12-16] (Google Inc.)
Task: {DF7D764E-4A98-42A5-B5F7-64476B8E9082} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {EFD137E0-D576-4A12-AC7E-DAAD2749A0A9} - System32\Tasks\G2MUpdateTask-S-1-5-21-1614596209-2777662679-913267390-1001 => C:\Users\janice\AppData\Local\Citrix\GoToMeeting\2457\g2mupdate.exe [2015-03-18] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {F02D2948-DC35-4A0B-852B-52F8BF3C25B2} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-24] (Microsoft Corporation)
Task: {F0C05FCF-47ED-4580-AA58-29452DE099E2} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-03-27] (Adobe Systems Incorporated)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-1614596209-2777662679-913267390-1001.job => C:\Users\janice\AppData\Local\Citrix\GoToMeeting\2457\g2mupdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2014-05-21 05:46 - 2014-05-21 04:14 - 02293760 _____ () C:\Program Files\AVAST Software\Avast\defs\14052100\algo.dll
2013-04-21 21:44 - 2013-04-21 21:44 - 00087952 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2013-04-21 21:44 - 2013-04-21 21:44 - 01242952 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2009-07-13 17:03 - 2009-07-13 21:15 - 00364544 _____ () C:\Windows\system32\msjetoledb40.dll
2015-03-11 13:13 - 2015-03-11 13:12 - 00054784 _____ () C:\Program Files\FMAuditOnsite\Web\Bin\Toshiba.Tasks.dll
2009-06-19 12:21 - 2009-06-19 12:21 - 01249280 _____ () C:\Program Files\Hewlett-Packard\HP SkyRoom\ice32.dll
2009-06-19 12:21 - 2009-06-19 12:21 - 00159744 _____ () C:\Program Files\Hewlett-Packard\HP SkyRoom\iceutil32.dll
2009-06-19 12:21 - 2009-06-19 12:21 - 00065536 _____ () C:\Program Files\Hewlett-Packard\HP SkyRoom\bzip2.dll
2009-06-19 12:21 - 2009-06-19 12:21 - 00167936 _____ () C:\Program Files\Hewlett-Packard\HP SkyRoom\IceSSL32.dll
2013-03-06 02:21 - 2013-03-06 02:21 - 00039056 _____ () C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
2011-05-26 15:38 - 2009-07-24 07:29 - 00077824 _____ () C:\Program Files\Common Files\Intel\Privacy Icon\UNS\DTMessageLib.dll
2011-05-26 15:46 - 2009-07-24 15:10 - 02199552 ____R () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\QtCore4.dll
2011-05-26 15:46 - 2009-07-24 15:10 - 08024064 ____R () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\QtGui4.dll
2011-05-26 15:46 - 2008-01-09 14:08 - 01245184 ____R () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\ice32.dll
2011-05-26 15:46 - 2008-01-09 14:10 - 00159744 ____R () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\iceutil32.dll
2011-05-26 15:46 - 2008-01-09 14:06 - 00065536 ____R () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\bzip2.dll
2011-05-26 15:46 - 2008-01-09 14:10 - 00167936 ____R () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\IceSSL32.dll
2015-04-02 14:10 - 2015-03-02 18:44 - 05886272 _____ () C:\Users\janice\AppData\Local\Amazon Music\Amazon Music Helper.exe
2015-04-02 09:02 - 2015-03-30 17:07 - 01174856 _____ () C:\Program Files\Google\Chrome\Application\41.0.2272.118\libglesv2.dll
2015-04-02 09:02 - 2015-03-30 17:07 - 00080200 _____ () C:\Program Files\Google\Chrome\Application\41.0.2272.118\libegl.dll
2015-04-02 09:02 - 2015-03-30 17:07 - 09279304 _____ () C:\Program Files\Google\Chrome\Application\41.0.2272.118\pdf.dll
2015-03-04 18:08 - 2015-03-04 18:08 - 00750080 _____ () C:\Users\janice\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-04-09 15:05 - 2015-04-09 15:05 - 00043008 _____ () c:\users\janice\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpoqn1ty.dll
2015-03-04 18:08 - 2015-03-04 18:08 - 00047616 _____ () C:\Users\janice\AppData\Roaming\Dropbox\bin\libEGL.dll
2015-03-04 18:08 - 2015-03-04 18:08 - 00865280 _____ () C:\Users\janice\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2015-03-04 18:07 - 2015-03-04 18:07 - 00200704 _____ () C:\Users\janice\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2011-05-26 15:47 - 2009-06-19 12:21 - 01249280 _____ () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Authentication\ice32.dll
2011-05-26 15:47 - 2009-06-19 12:21 - 00159744 _____ () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Authentication\iceutil32.dll
2011-05-26 15:47 - 2009-06-19 12:21 - 00065536 _____ () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Authentication\bzip2.dll
2011-05-26 15:47 - 2009-06-19 12:21 - 00167936 _____ () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Authentication\IceSSL32.dll
2011-05-26 15:47 - 2009-06-19 12:21 - 01249280 _____ () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Lens\ice32.dll
2011-05-26 15:47 - 2009-06-19 12:21 - 00159744 _____ () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Lens\iceutil32.dll
2011-05-26 15:47 - 2009-06-19 12:21 - 00065536 _____ () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Lens\bzip2.dll
2011-05-26 15:47 - 2009-06-19 12:21 - 00167936 _____ () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Lens\IceSSL32.dll
2011-05-26 15:47 - 2009-06-19 12:21 - 01249280 _____ () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Licensing\ice32.dll
2011-05-26 15:47 - 2009-06-19 12:21 - 00159744 _____ () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Licensing\iceutil32.dll
2011-05-26 15:47 - 2009-06-19 12:21 - 00065536 _____ () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Licensing\bzip2.dll
2011-05-26 15:47 - 2009-06-19 12:21 - 00167936 _____ () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Licensing\IceSSL32.dll
2015-04-09 15:05 - 2015-04-09 15:05 - 00098816 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\win32api.pyd
2015-04-09 15:05 - 2015-04-09 15:05 - 00110080 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\pywintypes27.dll
2015-04-09 15:05 - 2015-04-09 15:05 - 00364544 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\pythoncom27.dll
2015-04-09 15:05 - 2015-04-09 15:05 - 00045568 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\_socket.pyd
2015-04-09 15:05 - 2015-04-09 15:05 - 01161216 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\_ssl.pyd
2015-04-09 15:05 - 2015-04-09 15:05 - 00320512 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\win32com.shell.shell.pyd
2015-04-09 15:05 - 2015-04-09 15:05 - 00713216 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\_hashlib.pyd
2015-04-09 15:05 - 2015-04-09 15:05 - 01175040 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\wx._core_.pyd
2015-04-09 15:05 - 2015-04-09 15:05 - 00805888 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\wx._gdi_.pyd
2015-04-09 15:05 - 2015-04-09 15:05 - 00811008 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\wx._windows_.pyd
2015-04-09 15:05 - 2015-04-09 15:05 - 01062400 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\wx._controls_.pyd
2015-04-09 15:05 - 2015-04-09 15:05 - 00735232 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\wx._misc_.pyd
2015-04-09 15:05 - 2015-04-09 15:05 - 00682496 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\pysqlite2._sqlite.pyd
2015-04-09 15:05 - 2015-04-09 15:05 - 00128512 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\_elementtree.pyd
2015-04-09 15:05 - 2015-04-09 15:05 - 00127488 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\pyexpat.pyd
2015-04-09 15:05 - 2015-04-09 15:05 - 00087552 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\_ctypes.pyd
2015-04-09 15:05 - 2015-04-09 15:05 - 00119808 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\win32file.pyd
2015-04-09 15:05 - 2015-04-09 15:05 - 00108544 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\win32security.pyd
2015-04-09 15:05 - 2015-04-09 15:05 - 00007168 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\hashobjs_ext.pyd
2015-04-09 15:05 - 2015-04-09 15:05 - 00167936 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\win32gui.pyd
2015-04-09 15:05 - 2015-04-09 15:05 - 00018432 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\win32event.pyd
2015-04-09 15:05 - 2015-04-09 15:05 - 00038912 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\win32inet.pyd
2015-04-09 15:05 - 2015-04-09 15:05 - 00011264 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\win32crypt.pyd
2015-04-09 15:05 - 2015-04-09 15:05 - 00070656 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\wx._html2.pyd
2015-04-09 15:05 - 2015-04-09 15:05 - 00027136 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\_multiprocessing.pyd
2015-04-09 15:05 - 2015-04-09 15:05 - 00020480 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\_yappi.pyd
2015-04-09 15:05 - 2015-04-09 15:05 - 00035840 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\win32process.pyd
2015-04-09 15:05 - 2015-04-09 15:05 - 00686080 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\unicodedata.pyd
2015-04-09 15:05 - 2015-04-09 15:05 - 00122368 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\wx._wizard.pyd
2015-04-09 15:05 - 2015-04-09 15:05 - 00024064 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\win32pipe.pyd
2015-04-09 15:05 - 2015-04-09 15:05 - 00010240 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\select.pyd
2015-04-09 15:05 - 2015-04-09 15:05 - 00025600 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\win32pdh.pyd
2015-04-09 15:05 - 2015-04-09 15:05 - 00525640 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\windows._lib_cacheinvalidation.pyd
2015-04-09 15:05 - 2015-04-09 15:05 - 00017408 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\win32profile.pyd
2015-04-09 15:05 - 2015-04-09 15:05 - 00022528 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\win32ts.pyd
2015-04-09 15:05 - 2015-04-09 15:05 - 00078336 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42642\wx._animate.pyd

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:373E1720
AlternateDataStreams: C:\Users\janice\Downloads\noname (1).eml:OECustomProperty
AlternateDataStreams: C:\Users\janice\Downloads\noname.eml:OECustomProperty

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\atashost => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\LMIRescue_64eaaef1-33c8-4935-b520-fc5098fb7598 => ""="Service"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1614596209-2777662679-913267390-1001\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 151.198.0.39 - 204.117.214.10

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

==================== Accounts: =============================

Administrator (S-1-5-21-1614596209-2777662679-913267390-500 - Administrator - Disabled)
cfo (S-1-5-21-1614596209-2777662679-913267390-1047 - Administrator - Enabled) => C:\Users\cfo
Guest (S-1-5-21-1614596209-2777662679-913267390-501 - Limited - Disabled)
janice (S-1-5-21-1614596209-2777662679-913267390-1001 - Administrator - Enabled) => C:\Users\janice
patty (S-1-5-21-1614596209-2777662679-913267390-1002 - Administrator - Enabled) => C:\Users\patty
Xerox (S-1-5-21-1614596209-2777662679-913267390-1151 - Administrator - Enabled) => C:\Users\Xerox

==================== Faulty Device Manager Devices =============

Name: SonicWALL Virtual NIC
Description: SonicWALL Virtual NIC
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: SonicWALL
Service: SWVNIC
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Microsoft Teredo Tunneling Adapter
Description: Microsoft Teredo Tunneling Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: PS/2 Compatible Mouse
Description: PS/2 Compatible Mouse
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: SonicWALL IPsec Driver
Description: SonicWALL IPsec Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: SWIPsec
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

==================== Event log errors: =========================

Application errors:
==================
Error: (04/09/2015 03:05:26 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: IndexTray.exe, version: 3.3.0.784, time stamp: 0x4b1e3bcf
Faulting module name: IndexTray.exe, version: 3.3.0.784, time stamp: 0x4b1e3bcf
Exception code: 0xc0000005
Fault offset: 0x0001d180
Faulting process id: 0xcb4
Faulting application start time: 0xIndexTray.exe0
Faulting application path: IndexTray.exe1
Faulting module path: IndexTray.exe2
Report Id: IndexTray.exe3

Error: (04/09/2015 02:34:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: IndexTray.exe, version: 3.3.0.784, time stamp: 0x4b1e3bcf
Faulting module name: IndexTray.exe, version: 3.3.0.784, time stamp: 0x4b1e3bcf
Exception code: 0xc0000005
Fault offset: 0x0001d180
Faulting process id: 0x10b4
Faulting application start time: 0xIndexTray.exe0
Faulting application path: IndexTray.exe1
Faulting module path: IndexTray.exe2
Report Id: IndexTray.exe3

Error: (04/09/2015 02:19:19 PM) (Source: MsiInstaller) (EventID: 10005) (User: CFO-HP)
Description: Product: Avery Toolbar -- Error 25001. The following applications must be closed before continuing the uninstall:

Google Chrome

Error: (04/09/2015 02:18:30 PM) (Source: MsiInstaller) (EventID: 10005) (User: CFO-HP)
Description: Product: Avery Toolbar -- Error 25001. The following applications must be closed before continuing the uninstall:

Google Chrome

Error: (04/09/2015 02:18:29 PM) (Source: MsiInstaller) (EventID: 10005) (User: CFO-HP)
Description: Product: Avery Toolbar -- Error 25001. The following applications must be closed before continuing the uninstall:

Google Chrome

Error: (04/09/2015 02:18:28 PM) (Source: MsiInstaller) (EventID: 10005) (User: CFO-HP)
Description: Product: Avery Toolbar -- Error 25001. The following applications must be closed before continuing the uninstall:

Google Chrome

Error: (04/09/2015 02:17:59 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: Toolbar.exe, version: 21.11.1.932, time stamp: 0x54c7216f
Faulting module name: so.dll_unloaded, version: 0.0.0.0, time stamp: 0x54c72164
Exception code: 0xc0000005
Fault offset: 0x55b38b7e
Faulting process id: 0x1b74
Faulting application start time: 0xToolbar.exe0
Faulting application path: Toolbar.exe1
Faulting module path: Toolbar.exe2
Report Id: Toolbar.exe3

Error: (04/09/2015 11:16:57 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3245

Error: (04/09/2015 11:16:57 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 3245

Error: (04/09/2015 11:16:57 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

System errors:
=============
Error: (04/09/2015 03:05:10 PM) (Source: DCOM) (EventID: 10000) (User: )
Description: "C:\Program Files\Sharp\Sharpdesk\Indexer.exe" -Embedding2{40650C99-8E52-46C6-8F21-3E96B478F87B}

Error: (04/09/2015 03:05:01 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
SWIPsec

Error: (04/09/2015 02:50:31 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Search service, but this action failed with the following error:
%%1056

Error: (04/09/2015 02:50:01 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The hpqwmiex service terminated unexpectedly. It has done this 2 time(s).

Error: (04/09/2015 02:50:01 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Search service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.

Error: (04/09/2015 02:50:01 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The HP ProtectTools Service service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 4000 milliseconds: Restart the service.

Error: (04/09/2015 02:49:49 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Media Player Network Sharing Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.

Error: (04/09/2015 02:49:48 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.

Error: (04/09/2015 02:49:48 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The iPod Service service terminated unexpectedly. It has done this 1 time(s).

Error: (04/09/2015 02:49:48 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The HP Health Check Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

Microsoft Office Sessions:
=========================
Error: (04/09/2015 03:05:26 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: IndexTray.exe3.3.0.7844b1e3bcfIndexTray.exe3.3.0.7844b1e3bcfc00000050001d180cb401d072f81930570bC:\Program Files\Sharp\Sharpdesk\IndexTray.exeC:\Program Files\Sharp\Sharpdesk\IndexTray.exe611e1aff-deeb-11e4-9547-d48564168fc1

Error: (04/09/2015 02:34:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: IndexTray.exe3.3.0.7844b1e3bcfIndexTray.exe3.3.0.7844b1e3bcfc00000050001d18010b401d072f3bb7a55a1C:\Program Files\Sharp\Sharpdesk\IndexTray.exeC:\Program Files\Sharp\Sharpdesk\IndexTray.exefd30832a-dee6-11e4-8dd0-d48564168fc1

Error: (04/09/2015 02:19:19 PM) (Source: MsiInstaller) (EventID: 10005) (User: CFO-HP)
Description: Product: Avery Toolbar -- Error 25001. The following applications must be closed before continuing the uninstall:

Google Chrome (NULL)(NULL)(NULL)(NULL)(NULL)

Error: (04/09/2015 02:18:30 PM) (Source: MsiInstaller) (EventID: 10005) (User: CFO-HP)
Description: Product: Avery Toolbar -- Error 25001. The following applications must be closed before continuing the uninstall:

Google Chrome (NULL)(NULL)(NULL)(NULL)(NULL)

Error: (04/09/2015 02:18:29 PM) (Source: MsiInstaller) (EventID: 10005) (User: CFO-HP)
Description: Product: Avery Toolbar -- Error 25001. The following applications must be closed before continuing the uninstall:

Google Chrome (NULL)(NULL)(NULL)(NULL)(NULL)

Error: (04/09/2015 02:18:28 PM) (Source: MsiInstaller) (EventID: 10005) (User: CFO-HP)
Description: Product: Avery Toolbar -- Error 25001. The following applications must be closed before continuing the uninstall:

Google Chrome (NULL)(NULL)(NULL)(NULL)(NULL)

Error: (04/09/2015 02:17:59 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Toolbar.exe21.11.1.93254c7216fso.dll_unloaded0.0.0.054c72164c000000555b38b7e1b7401d072f18010c216C:\Program Files\AskPartnerNetwork\Toolbar\Toolbar.exeso.dllc001afce-dee4-11e4-8e4d-d48564168fc1

Error: (04/09/2015 11:16:57 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3245

Error: (04/09/2015 11:16:57 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 3245

Error: (04/09/2015 11:16:57 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

==================== Memory info ===========================

Processor: Pentium(R) Dual-Core CPU E5500 @ 2.80GHz
Percentage of memory in use: 48%
Total physical RAM: 3543.25 MB
Available physical RAM: 1822.92 MB
Total Pagefile: 7084.79 MB
Available Pagefile: 5260.68 MB
Total Virtual: 2047.88 MB
Available Virtual: 1893.31 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:139.96 GB) (Free:65.72 GB) NTFS
Drive d: (HP_RECOVERY) (Fixed) (Total:7.08 GB) (Free:0.81 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149.1 GB) (Disk ID: FACCD561)
Partition 1: (Active) - (Size=2 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=140 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=7.1 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Broni · Apr 9, 2015

Please, observe following rules:

Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
If you're stuck, or you're not sure about certain step, always ask before doing anything else.
Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
Never run more than one scan at a time.
Keep updating me regarding your computer behavior, good, or bad.
The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

=============================

Running from C:\downloads

Please move FRST to proper location (Desktop).

Uninstall Acrobat Reader Packages.

Download RogueKiller from one of the following links and save it to your Desktop:

Link 1
Link 2

Close all the running programs
Windows Vista/7/8 users: right click on RogueKiller.exe, click Run as Administrator
Otherwise just double-click on RogueKiller.exe
Pre-scan will start. Let it finish.
Click on SCAN button.
Wait until the Status box shows Scan Finished
Click on Delete.
Wait until the Status box shows Deleting Finished.
Click on Report and copy/paste the content of the Notepad into your next reply.
RKreport.txt could also be found on your desktop.
If more than one log is produced post all logs.
If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again

Please download Malwarebytes Anti-Malware (MBAM) to your desktop.
NOTE. If you already have MBAM 2.0 installed scroll down.

Double-click mbam-setup-2.0.0.1000.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to the following:
- Launch Malwarebytes Anti-Malware
- A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
Click Finish.
On the Dashboard, click the 'Update Now >>' link
After the update completes, click the 'Scan Now >>' button.
Or, on the Dashboard, click the Scan Now >> button.
If an update is available, click the Update Now button.
A Threat Scan will begin.
When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
In most cases, a restart will be required.
Wait for the prompt to restart the computer to appear, then click on Yes.

If you already have MBAM 2.0 installed:

On the Dashboard, click the 'Update Now >>' link
After the update completes, click the 'Scan Now >>' button.
Or, on the Dashboard, click the Scan Now >> button.
If an update is available, click the Update Now button.
A Threat Scan will begin.
When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
In most cases, a restart will be required.
Wait for the prompt to restart the computer to appear, then click on Yes.

How to get logs:
(Export log to save as txt)

After the restart once you are back at your desktop, open MBAM once more.
Click on the History tab > Application Logs.
Double click on the Scan Log which shows the Date and time of the scan just performed.
Click 'Export'.
Click 'Text file (*.txt)'
In the Save File dialog box which appears, click on Desktop.
In the File name: box type a name for your scan log.
A message box named 'File Saved' should appear stating "Your file has been successfully exported".
Click Ok
Attach that saved log to your next reply.

(Copy to clipboard for pasting into forum replies or tickets)

After the restart once you are back at your desktop, open MBAM once more.
Click on the History tab > Application Logs.
Double click on the Scan Log which shows the Date and time of the scan just performed.
Click 'Copy to Clipboard'
Paste the contents of the clipboard into your reply.

Please download AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Double click on adwcleaner.exe to run the tool.
Click on Scan button.
When the scan has finished click on Clean button.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the contents of that logfile with your next reply.
You can find the logfile at C:\AdwCleaner[S1].txt as well.

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

Eric Witzling · Apr 10, 2015

I am assisting users remotely and will dial into the machine as I can. I should have free-er access to it in general without user interruption, but the reason I use a subfolder off C: and not the Desktop is because unrecognized icons tend to freak users on the other side out, so if I'm performing cleanup between their other tasks, it is usually better to mask it from them in some fashion. (Also so they don't delete anything accidentally.)

Can I continue to run from that directory? Is there anything that changes in the process, or is it mainly so your end-step cleanup script can properly find and delete everything? I am fine with manual cleanup of the apps we are using and the logs we are creating.

Eric Witzling · Apr 10, 2015

(Apparently the on-board Avast is in the middle of a boot scan that's only at 11%, so I may not be able to connect for a few hours.)

Eric Witzling · Apr 10, 2015

Following the above, and a reboot, the 6-8 chrome.exe processes have stopped launching in the background. I still see three conhost.exe processes (usually two, currently three) that are all unkillable ("access denied").

Logs posted below. MBAM was not run previously, but RogueKiller and adwcleaner and JRT were run yesterday before I started this thread. Let me know if you would like the logs from their first runs, too.

-------------------------------------------------

RogueKiller V10.5.9.0 [Apr 7 2015] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Normal mode
User : janice [Administrator]
Started from : C:\Users\janice\Desktop\RogueKiller.exe
Mode : Delete -- Date : 04/10/2015 13:06:37

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 14 ¤¤¤
[PUM.Proxy] HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Not selected
[PUM.Proxy] HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Not selected
[PUM.Proxy] HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:55242;https=127.0.0.1:55242 -> Not selected
[PUM.Proxy] HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:55242;https=127.0.0.1:55242 -> Not selected
[PUM.HomePage] HKEY_USERS\S-1-5-21-1614596209-2777662679-913267390-1001\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.lakelandbank.com/default.aspx -> Not selected
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{52760699-64C9-4F0F-8791-D1B6936A8915} | NameServer : 151.198.0.39,204.117.214.10 [UNITED STATES (US)][UNITED STATES (US)] -> Not selected
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{DF78B7D4-04C4-457C-8EBB-AB5BC2A39480} | DhcpNameServer : 172.20.10.1 [(Private Address) (XX)] -> Not selected
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{52760699-64C9-4F0F-8791-D1B6936A8915} | NameServer : 151.198.0.39,204.117.214.10 [UNITED STATES (US)][UNITED STATES (US)] -> Not selected
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{DF78B7D4-04C4-457C-8EBB-AB5BC2A39480} | DhcpNameServer : 172.20.10.1 [(Private Address) (XX)] -> Not selected
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{52760699-64C9-4F0F-8791-D1B6936A8915} | NameServer : 151.198.0.39,204.117.214.10 [UNITED STATES (US)][UNITED STATES (US)] -> Not selected
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{DF78B7D4-04C4-457C-8EBB-AB5BC2A39480} | DhcpNameServer : 172.20.10.1 [(Private Address) (XX)] -> Not selected
[PUM.StartMenu] HKEY_USERS\S-1-5-21-1614596209-2777662679-913267390-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0 -> Not selected
[PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Not selected
[PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Not selected

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ Hosts File : 2 ¤¤¤
[C:\Windows\System32\drivers\etc\hosts] 192.130.235.1 minehill
[C:\Windows\System32\drivers\etc\hosts] 192.130.235.2 tax

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: WDC WD1600HLHX-60JJPV0 +++++
--- User ---
[MBR] ff4afae6430f6dad3af287aaa8b40c93
[BSP] 572ab318581d0c0652b1ce698236a560 : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 2047 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 4194304 | Size: 143321 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 297715712 | Size: 7248 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK

============================================
RKreport_SCN_04092015_153704.log - RKreport_DEL_04092015_153837.log - RKreport_SCN_04102015_130015.log

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 4/10/2015
Scan Time: 11:56:50 AM
Logfile: MBAM.txt
Administrator: Yes

Version: 2.01.4.1018
Malware Database: v2015.04.10.05
Rootkit Database: v2015.03.31.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x86
File System: NTFS
User: janice

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 489697
Time Elapsed: 16 min, 21 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Warn
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 5
PUP.Optional.Spigot, HKU\S-1-5-21-1614596209-2777662679-913267390-1151\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5}, Quarantined, [8f5ec8a26a202c0a5a8c3e011ce70af6],
PUP.Optional.SearchProtect.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}, Quarantined, [2bc294d62862a59102412217659eed13],
PUP.Optional.Highlightly, HKLM\SOFTWARE\Highlightly, Quarantined, [9f4e2347fc8edc5ab71166d2887db34d],
PUP.Optional.PlusHD.A, HKU\S-1-5-18\SOFTWARE\APPDATALOW\SOFTWARE\HD-Plus10, Quarantined, [787578f24f3be4522fa4bb38cd365da3],
PUP.Optional.GlobalUpdate.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GOOGLEUPDATE.EXE, Quarantined, [0be23139dfab082e0a95dbc17e855da3],

Registry Values: 3
PUP.Optional.Avery.A, HKU\S-1-5-21-1614596209-2777662679-913267390-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER\{41565256-3700-A76A-76A7-7A786E7484D7}, Quarantined, [2ac3ff6bb3d7ea4caf1340f37390a65a],
PUP.Optional.Avery.A, HKU\S-1-5-21-1614596209-2777662679-913267390-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER|{41565256-3700-A76A-76A7-7A786E7484D7}, å??ä??ã??êªê¶ç¡ºç?®í??, Quarantined, [2ac3ff6bb3d7ea4caf1340f37390a65a]
PUP.Optional.Spigot.A, HKU\S-1-5-21-1614596209-2777662679-913267390-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{A11B5998-39F5-42F5-B7DE-C12D15C43B18}|URL, https://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=523482&p={searchTerms}, Quarantined, [fcf1c8a2c4c61125926ebc0051b2ba46]

Registry Data: 0
(No malicious items detected)

Folders: 10
PUP.Optional.MultiPlug.A, C:\Users\cfo\AppData\Local\Google\Chrome\User Data\Default\Extensions\gejnlocjakfnfmbdlkjoapldgdglfbno\1.6, Quarantined, [d716e981fd8d05317aacd47fec196898],
PUP.Optional.MultiPlug.A, C:\Users\cfo\AppData\Local\Google\Chrome\User Data\Default\Extensions\gejnlocjakfnfmbdlkjoapldgdglfbno, Quarantined, [d716e981fd8d05317aacd47fec196898],
PUP.Optional.MultiPlug.A, C:\Users\patty\AppData\Local\Google\Chrome\User Data\Default\Extensions\gejnlocjakfnfmbdlkjoapldgdglfbno\1.6, Quarantined, [6e7f83e7d5b5b383b670ce85a95cff01],
PUP.Optional.MultiPlug.A, C:\Users\patty\AppData\Local\Google\Chrome\User Data\Default\Extensions\gejnlocjakfnfmbdlkjoapldgdglfbno, Quarantined, [6e7f83e7d5b5b383b670ce85a95cff01],
PUP.Optional.DriverPerformer.A, C:\Users\janice\AppData\Local\Temp\DriverPerformer, Quarantined, [d914dd8d4b3f5dd934bcf393bb48e41c],
PUP.Optional.Extutil.A, C:\Users\janice\AppData\Local\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B, Quarantined, [07e6115913770c2a73d93d5e10f38779],
PUP.Optional.Managera.A, C:\Users\janice\AppData\Local\Temp\38fdaae5-8e0e-493c-88ec-e05c3be06e42, Quarantined, [39b4cf9b4b3f06306ae3adee976cc33d],
PUP.Optional.GlobalUpdate.A, C:\Users\janice\AppData\Local\Temp\comh.227225, Quarantined, [0be23139dfab082e0a95dbc17e855da3],
PUP.Optional.NewPlayer.A, C:\Users\janice\AppData\Local\com\NewPlayer.exe_Url_wmgtxqntq5fklrr4bpxvxljadclrhvq0, Quarantined, [a6472e3cccbecc6a62ff3b7611f255ab],
PUP.Optional.NewPlayer.A, C:\Users\janice\AppData\Local\com\NewPlayer.exe_Url_wmgtxqntq5fklrr4bpxvxljadclrhvq0\2.1.1.9, Quarantined, [a6472e3cccbecc6a62ff3b7611f255ab],

Files: 52
PUP.Optional.SearchProtect.A, C:\Users\janice\AppData\Local\Temp\sp-downloader.exe, Quarantined, [6687006aa9e1a0963c77c5ecd32eae52],
PUP.Optional.Conduit.A, C:\Users\janice\AppData\Local\Temp\spidentifierimpl.exe, Quarantined, [c22b65054b3fbc7a62d1852f2fd206fa],
PUP.Optional.Conduit.A, C:\Users\janice\AppData\Local\Temp\spidentifierimpl2.exe, Quarantined, [d8150664e1a9db5b64cfc3f10bf67e82],
PUP.Optional.WeatherAlerts.A, C:\Users\janice\AppData\Local\Temp\desktopweatheralertssetup.exe, Quarantined, [dc110d5d078383b31dd38c9ef214ee12],
PUP.Optional.Conduit.A, C:\Users\janice\AppData\Local\Temp\nsq63E1.exe, Quarantined, [af3e0169810977bf23a57c36877a946c],
PUP.Optional.SearchProtect.A, C:\Users\janice\AppData\Local\Temp\nsq96CD.tmp, Quarantined, [5796105a04861e1827bd36863fc2ac54],
PUP.Optional.Conduit.A, C:\Users\janice\AppData\Local\Temp\nssB50A.exe, Quarantined, [fdf06dfd1c6e1f17b711a80aab562cd4],
PUP.Optional.Conduit.A, C:\Users\janice\AppData\Local\Temp\nsv5DE7.exe, Quarantined, [cb22bab01e6c10264f795c5630d16d93],
PUP.Optional.Conduit.A, C:\Users\janice\AppData\Local\Temp\nsx268D.exe, Quarantined, [11dccf9b870343f302c6a50d29d83ec2],
PUP.Optional.Conduit.A, C:\Users\janice\AppData\Local\Temp\nsd7C8F.exe, Quarantined, [3eafc2a87515ac8adfe9664c976a9b65],
PUP.Optional.Conduit.A, C:\Users\janice\AppData\Local\Temp\nsl1CBF.exe, Quarantined, [8e5f204a7119a98d8444ffb30cf5e11f],
PUP.Optional.Conduit.A, C:\Users\janice\AppData\Local\Temp\nsl21EE.exe, Quarantined, [ed00501a3159b0861fa9f5bdff0246ba],
PUP.Optional.Conduit.A, C:\Users\janice\AppData\Local\Temp\nsm2F73.exe, Quarantined, [628b0664a8e2fa3c8e3af6bc56ab857b],
PUP.Optional.HighLightly.A, C:\Users\janice\AppData\Local\Temp\air35CC.exe, Quarantined, [d11ca5c52d5da88e5c2f019d44bd9868],
PUP.Optional.NewPlayer, C:\Users\janice\AppData\Local\Temp\newvideoplayersetup.exe, Quarantined, [67868dddccbe8caa05a57f56ff026799],
PUP.Optional.Conduit.A, C:\Users\janice\AppData\Local\Temp\nscBC4B.exe, Quarantined, [8e5f3535dab0df574c7ccce6f40d47b9],
PUP.Optional.Wajam.A, C:\Users\janice\AppData\Local\Temp\wajam_download.exe, Quarantined, [826bb0bafe8c6ccafc1e65e48d734db3],
PUP.Optional.Spigot.SID, C:\Users\janice\AppData\Local\Temp\SearchProtectionSetup.exe, Quarantined, [f4f92149305a4ceab72d2019f313a45c],
PUP.Optional.Spigot.A, C:\Users\janice\AppData\Local\Temp\~sp9B7C.tmp, Quarantined, [608db4b62d5d83b33018ac8816f0fd03],
PUP.Optional.MyPCBackup.A, C:\Users\janice\AppData\Local\Temp\BackupSetup.exe, Quarantined, [3db05416e8a249edec49de179f6247b9],
PUP.Optional.Spigot.SID, C:\Users\janice\AppData\Local\Temp\{7F188756-0938-4A51-B83B-6AC00DC03BA9}\BrowserExtensionsSetup.exe, Quarantined, [30bd73f72169c175d014e257df27b64a],
PUP.Optional.SearchProtect.A, C:\Users\janice\AppData\Local\Temp\nsx83D8\SpSetup.exe, Quarantined, [599478f2f9915ed829bb4d6f1ae732ce],
PUP.Optional.Spigot.SID, C:\Users\janice\AppData\Local\Temp\{FB0D50CA-74AC-41D1-B938-DD5143B6F86A}\BrowserExtensionsSetup.exe, Quarantined, [0fde3a30e1a9290d6b795ddcfc0ad030],
PUP.Optional.Installcore, C:\Users\janice\AppData\Local\Temp\is1597349865\8330030_stp\HomePageDLL.dll, Quarantined, [eeff105ad9b1b284cb7ff2bab74e7c84],
PUP.Optional.MegaBrowse.A, C:\Users\janice\AppData\Local\Temp\is1597349865\8330108_stp\MegaBrowseSetup.exe, Quarantined, [6c815a106d1dc373e30f54593dc86d93],
PUP.Optional.MySearchDial.A, C:\Users\janice\AppData\Local\Temp\is8554704\mysearchdial.dll, Quarantined, [16d7e288a8e27bbbde0b82000cf558a8],
PUP.Optional.InstallBrain.A, C:\Users\janice\Downloads\FreePDFReaderSetup.exe, Quarantined, [e10c88e2f694d56183cd7e20827ff907],
PUP.Optional.MultiPlug.A, C:\Users\cfo\AppData\Local\Google\Chrome\User Data\Default\Extensions\gejnlocjakfnfmbdlkjoapldgdglfbno\1.6\lsdb.js, Quarantined, [d716e981fd8d05317aacd47fec196898],
PUP.Optional.MultiPlug.A, C:\Users\cfo\AppData\Local\Google\Chrome\User Data\Default\Extensions\gejnlocjakfnfmbdlkjoapldgdglfbno\1.6\background.html, Quarantined, [d716e981fd8d05317aacd47fec196898],
PUP.Optional.MultiPlug.A, C:\Users\cfo\AppData\Local\Google\Chrome\User Data\Default\Extensions\gejnlocjakfnfmbdlkjoapldgdglfbno\1.6\content.js, Quarantined, [d716e981fd8d05317aacd47fec196898],
PUP.Optional.MultiPlug.A, C:\Users\cfo\AppData\Local\Google\Chrome\User Data\Default\Extensions\gejnlocjakfnfmbdlkjoapldgdglfbno\1.6\manifest.json, Quarantined, [d716e981fd8d05317aacd47fec196898],
PUP.Optional.MultiPlug.A, C:\Users\patty\AppData\Local\Google\Chrome\User Data\Default\Extensions\gejnlocjakfnfmbdlkjoapldgdglfbno\1.6\lsdb.js, Quarantined, [6e7f83e7d5b5b383b670ce85a95cff01],
PUP.Optional.MultiPlug.A, C:\Users\patty\AppData\Local\Google\Chrome\User Data\Default\Extensions\gejnlocjakfnfmbdlkjoapldgdglfbno\1.6\background.html, Quarantined, [6e7f83e7d5b5b383b670ce85a95cff01],
PUP.Optional.MultiPlug.A, C:\Users\patty\AppData\Local\Google\Chrome\User Data\Default\Extensions\gejnlocjakfnfmbdlkjoapldgdglfbno\1.6\content.js, Quarantined, [6e7f83e7d5b5b383b670ce85a95cff01],
PUP.Optional.MultiPlug.A, C:\Users\patty\AppData\Local\Google\Chrome\User Data\Default\Extensions\gejnlocjakfnfmbdlkjoapldgdglfbno\1.6\manifest.json, Quarantined, [6e7f83e7d5b5b383b670ce85a95cff01],
PUP.Optional.Extutil.A, C:\Users\janice\AppData\Local\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B\bk.js, Quarantined, [07e6115913770c2a73d93d5e10f38779],
PUP.Optional.Extutil.A, C:\Users\janice\AppData\Local\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B\cs.js, Quarantined, [07e6115913770c2a73d93d5e10f38779],
PUP.Optional.Extutil.A, C:\Users\janice\AppData\Local\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B\manifest.json, Quarantined, [07e6115913770c2a73d93d5e10f38779],
PUP.Optional.Managera.A, C:\Users\janice\AppData\Local\Temp\38fdaae5-8e0e-493c-88ec-e05c3be06e42\cs.js, Quarantined, [39b4cf9b4b3f06306ae3adee976cc33d],
PUP.Optional.Managera.A, C:\Users\janice\AppData\Local\Temp\38fdaae5-8e0e-493c-88ec-e05c3be06e42\manifest.json, Quarantined, [39b4cf9b4b3f06306ae3adee976cc33d],
PUP.Optional.GlobalUpdate.A, C:\Users\janice\AppData\Local\Temp\comh.227225\GoogleCrashHandler.exe, Quarantined, [0be23139dfab082e0a95dbc17e855da3],
PUP.Optional.GlobalUpdate.A, C:\Users\janice\AppData\Local\Temp\comh.227225\GoogleUpdate.exe, Quarantined, [0be23139dfab082e0a95dbc17e855da3],
PUP.Optional.GlobalUpdate.A, C:\Users\janice\AppData\Local\Temp\comh.227225\GoogleUpdateBroker.exe, Quarantined, [0be23139dfab082e0a95dbc17e855da3],
PUP.Optional.GlobalUpdate.A, C:\Users\janice\AppData\Local\Temp\comh.227225\GoogleUpdateHelper.msi, Quarantined, [0be23139dfab082e0a95dbc17e855da3],
PUP.Optional.GlobalUpdate.A, C:\Users\janice\AppData\Local\Temp\comh.227225\GoogleUpdateOnDemand.exe, Quarantined, [0be23139dfab082e0a95dbc17e855da3],
PUP.Optional.GlobalUpdate.A, C:\Users\janice\AppData\Local\Temp\comh.227225\goopdate.dll, Quarantined, [0be23139dfab082e0a95dbc17e855da3],
PUP.Optional.GlobalUpdate.A, C:\Users\janice\AppData\Local\Temp\comh.227225\goopdateres_en.dll, Quarantined, [0be23139dfab082e0a95dbc17e855da3],
PUP.Optional.GlobalUpdate.A, C:\Users\janice\AppData\Local\Temp\comh.227225\npGoogleUpdate4.dll, Quarantined, [0be23139dfab082e0a95dbc17e855da3],
PUP.Optional.GlobalUpdate.A, C:\Users\janice\AppData\Local\Temp\comh.227225\psmachine.dll, Quarantined, [0be23139dfab082e0a95dbc17e855da3],
PUP.Optional.GlobalUpdate.A, C:\Users\janice\AppData\Local\Temp\comh.227225\psuser.dll, Quarantined, [0be23139dfab082e0a95dbc17e855da3],
PUP.Optional.NewPlayer.A, C:\Users\janice\AppData\Local\com\NewPlayer.exe_Url_wmgtxqntq5fklrr4bpxvxljadclrhvq0\2.1.1.9\user.config, Quarantined, [a6472e3cccbecc6a62ff3b7611f255ab],
PUP.Optional.Spigot.A, C:\Users\janice\AppData\Roaming\Mozilla\Firefox\Profiles\4n87uf9r.default\prefs.js, Good: (), Bad: (user_pref("keyword.URL", "https://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=523482&p=")

, Replaced,[6489c2a88604dd5982511723cd3960a0]

Physical Sectors: 0
(No malicious items detected)

(end)

# AdwCleaner v4.201 - Logfile created 10/04/2015 at 12:33:38
# Updated 08/04/2015 by Xplode
# Database : 2015-04-08.1 [Server]
# Operating system : Windows 7 Professional Service Pack 1 (x86)
# Username : janice - CFO-HP
# Running from : C:\Users\janice\Desktop\adwcleaner_4.201.exe
# Option : Cleaning

***** [ Services ] *****

***** [ Files / Folders ] *****

***** [ Scheduled tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Data Deleted : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyServer] - hxxp=127.0.0.1:55242;hxxps=127.0.0.1:55242
Data Deleted : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyEnable] - 1
Data Deleted : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - <-loopback>

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17689

-\\ Mozilla Firefox v

-\\ Google Chrome v41.0.2272.118

*************************

AdwCleaner[R0].txt - [19147 bytes] - [21/05/2014 13:18:30]
AdwCleaner[R1].txt - [10973 bytes] - [09/04/2015 14:46:39]
AdwCleaner[R2].txt - [1615 bytes] - [10/04/2015 12:27:41]
AdwCleaner[S0].txt - [19027 bytes] - [21/05/2014 13:32:16]
AdwCleaner[S1].txt - [11076 bytes] - [09/04/2015 14:49:49]
AdwCleaner[S2].txt - [1320 bytes] - [10/04/2015 12:33:38]

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [1379 bytes] ##########

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.5.3 (04.07.2015:1)
OS: Windows 7 Professional x86
Ran by janice on Fri 04/10/2015 at 12:38:12.24
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

~~~ Files

~~~ Folders

Successfully deleted: [Folder] "C:\ai_recyclebin"

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Fri 04/10/2015 at 12:40:35.96
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Eric Witzling · Apr 10, 2015

After an additional reboot, the three conhost.exe processes are back, and there are eight chrome.exe ones again, too.

Eric Witzling · Apr 10, 2015

Avast Pro (8.0.1489) is still failing to connect to its update server (23.67.250.120:80)

Says it's running on Engine and definitions (140521-0) which corresponds to 5/21/14. Looks like it's had issues for a while.

The boot scan did pull off some items anyway, which I'll list below in cast it's of any help.

------------------------------------------

04/09/2015 18:09
Scan of all local drives

File C:\Users\janice\AppData\Local\Temp\freesofttoday.exe|>{localappdata}\fst_us_68\upfst_us_68.exe is infected by Win32

UP-gen [PUP], Moved to chest
File C:\Users\janice\AppData\Local\Temp\freesofttoday.exe|>{pf}\fst_us_68\predm.exe is infected by Win32:Adware-ASG [PUP], Moved to chest
File C:\Users\janice\Downloads\picasa setup.exe|>$[34]\DownloadManager.exe is infected by Win32

ownloader-TOV [PUP], Moved to chest
File C:\Users\janice\Downloads\picasa setup.exe is infected by Win32

ownloader-TOV [PUP], Moved to chest
File C:\AdwCleaner\Quarantine\C\Program Files\fst_us_68\predm.exe.vir is infected by Win32:Adware-ASG [PUP], Moved to chest
File C:\AdwCleaner\Quarantine\C\ProgramData\FolashhCooupon\EOI.dll.vir is infected by Win32

UP-gen [PUP], Moved to chest
File C:\AdwCleaner\Quarantine\C\ProgramData\FolashhCooupon\EOI.exe.vir is infected by Win32:MultiPlug-AD [PUP], Moved to chest
File C:\AdwCleaner\Quarantine\C\Users\janice\AppData\Local\fst_us_68\upfst_us_68.exe.vir is infected by Win32

UP-gen [PUP], Moved to chest
File C:\downloads\ComboFix.exe|>$0\AppDataFile.cfx is infected by AutoIt:Banker-BG [Trj], Moved to chest
File C:\Program Files\Java\jre1.8.0_40\lib\ext\nashorn.jar|>jdk\nashorn\internal\runtime\linker\LinkerCallSite$TracingLinkerCallSite.class is infected by Java:CVE-2013-0422-CH [Expl], Moved to chest
Number of searched folders: 37133
Number of tested files: 1193135
Number of infected files: 10

Broni · Apr 10, 2015

Can I continue to run from that directory?

Yes but you'll have to remember to move all tools to Desktop before we'll run DelFix in the very last step of our procedure. DelFix will remove all tools we've been using.

Reinstall Avast and see if it'll update.
Let me know and continue with next step.

Please download ComboFix from Here, Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Never rename Combofix unless instructed.
Close any open browsers.
Very Important! Temporarily disable your anti-virus and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
Close any open browsers.
WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
If the connection is not there use restore point you created prior to running Combofix.
Double click on combofix.exe & follow the prompts.

NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.

When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
Use AppRemover to uninstall it: https://www.techspot.com/downloads/5514-appremover.html
We can reinstall it when we're done with CF.
**Note 3: If you receive an error Illegal operation attempted on a registery key that has been marked for deletion, restart computer to fix the issue.
**Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try the following...

Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.
Download Rkill (courtesy of BleepingComputer.com) to your desktop.
There are 2 different versions. If one of them won't run then download and try to run the other one.
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

Restart computer in safe mode

Double-click on the Rkill desktop icon to run the tool.
If using Windows Vista, 7 or 8 right-click on it and choose Run As Administrator.
A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
If not, delete the file, then download and use the one provided in Link 2.
Do not reboot until instructed.
If the tool does not run from any of the links provided, please let me know.

When the scan is done Notepad will open with rKill.txt log.
NOTE. rKill.txt log will also be present on your desktop.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.

Eric Witzling · Apr 13, 2015

Actually I figured out one neat trick as far as keeping this hidden from users goes. On Windows 7 I just launch a Sticky with a message on it, and cover all the desktop icons with it. ;-)

Avast Pro uninstalled cleanly, and Avast Free installed fine and updates fine. Quick Scan quarantined one random item.

Combofix cleared a whole lot more. But I am still seeing the name number of chrome.exe and conhost.exe processes running

ComboFix 15-04-09.01 - janice 04/13/2015 9:09.1.2 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.3543.1696 [GMT -4:00]
Running from: c:\downloads\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\178C.tmp
C:\57A5.tmp
C:\749D.tmp
C:\8947.tmp
c:\users\janice\AppData\Local\Temp\_MEI28402\_ctypes.pyd
c:\users\janice\AppData\Local\Temp\_MEI28402\_elementtree.pyd
c:\users\janice\AppData\Local\Temp\_MEI28402\_hashlib.pyd
c:\users\janice\AppData\Local\Temp\_MEI28402\_multiprocessing.pyd
c:\users\janice\AppData\Local\Temp\_MEI28402\_socket.pyd
c:\users\janice\AppData\Local\Temp\_MEI28402\_ssl.pyd
c:\users\janice\AppData\Local\Temp\_MEI28402\_yappi.pyd
c:\users\janice\AppData\Local\Temp\_MEI28402\hashobjs_ext.pyd
c:\users\janice\AppData\Local\Temp\_MEI28402\pyexpat.pyd
c:\users\janice\AppData\Local\Temp\_MEI28402\pysqlite2._sqlite.pyd
c:\users\janice\AppData\Local\Temp\_MEI28402\python27.dll
c:\users\janice\AppData\Local\Temp\_MEI28402\pythoncom27.dll
c:\users\janice\AppData\Local\Temp\_MEI28402\PyWinTypes27.dll
c:\users\janice\AppData\Local\Temp\_MEI28402\select.pyd
c:\users\janice\AppData\Local\Temp\_MEI28402\unicodedata.pyd
c:\users\janice\AppData\Local\Temp\_MEI28402\win32api.pyd
c:\users\janice\AppData\Local\Temp\_MEI28402\win32com.shell.shell.pyd
c:\users\janice\AppData\Local\Temp\_MEI28402\win32crypt.pyd
c:\users\janice\AppData\Local\Temp\_MEI28402\win32event.pyd
c:\users\janice\AppData\Local\Temp\_MEI28402\win32file.pyd
c:\users\janice\AppData\Local\Temp\_MEI28402\win32gui.pyd
c:\users\janice\AppData\Local\Temp\_MEI28402\win32inet.pyd
c:\users\janice\AppData\Local\Temp\_MEI28402\win32pdh.pyd
c:\users\janice\AppData\Local\Temp\_MEI28402\win32pipe.pyd
c:\users\janice\AppData\Local\Temp\_MEI28402\win32process.pyd
c:\users\janice\AppData\Local\Temp\_MEI28402\win32profile.pyd
c:\users\janice\AppData\Local\Temp\_MEI28402\win32security.pyd
c:\users\janice\AppData\Local\Temp\_MEI28402\win32ts.pyd
c:\users\janice\AppData\Local\Temp\_MEI28402\windows._lib_cacheinvalidation.pyd
c:\users\janice\AppData\Local\Temp\_MEI28402\wx._animate.pyd
c:\users\janice\AppData\Local\Temp\_MEI28402\wx._controls_.pyd
c:\users\janice\AppData\Local\Temp\_MEI28402\wx._core_.pyd
c:\users\janice\AppData\Local\Temp\_MEI28402\wx._gdi_.pyd
c:\users\janice\AppData\Local\Temp\_MEI28402\wx._html2.pyd
c:\users\janice\AppData\Local\Temp\_MEI28402\wx._misc_.pyd
c:\users\janice\AppData\Local\Temp\_MEI28402\wx._windows_.pyd
c:\users\janice\AppData\Local\Temp\_MEI28402\wx._wizard.pyd
c:\users\janice\AppData\Local\Temp\_MEI28402\wxbase294u_net_vc90.dll
c:\users\janice\AppData\Local\Temp\_MEI28402\wxbase294u_vc90.dll
c:\users\janice\AppData\Local\Temp\_MEI28402\wxmsw294u_adv_vc90.dll
c:\users\janice\AppData\Local\Temp\_MEI28402\wxmsw294u_core_vc90.dll
c:\users\janice\AppData\Local\Temp\_MEI28402\wxmsw294u_html_vc90.dll
c:\users\janice\AppData\Local\Temp\_MEI28402\wxmsw294u_webview_vc90.dll
c:\users\janice\AppData\Roaming\Mozilla\Firefox\Profiles\4n87uf9r.default\extensions\staged\q8xu@ayivpz.org
c:\users\janice\AppData\Roaming\Mozilla\Firefox\Profiles\4n87uf9r.default\extensions\staged\q8xu@ayivpz.org\bootstrap.js
c:\users\janice\AppData\Roaming\Mozilla\Firefox\Profiles\4n87uf9r.default\extensions\staged\q8xu@ayivpz.org\chrome.manifest
c:\users\janice\AppData\Roaming\Mozilla\Firefox\Profiles\4n87uf9r.default\extensions\staged\q8xu@ayivpz.org\content\bg.js
c:\users\janice\AppData\Roaming\Mozilla\Firefox\Profiles\4n87uf9r.default\extensions\staged\q8xu@ayivpz.org\install.rdf
c:\users\janice\AppData\Roaming\Mozilla\Firefox\Profiles\4n87uf9r.default\extensions\staged\wohoayibjf5@ye-aaoy.net
c:\users\janice\AppData\Roaming\Mozilla\Firefox\Profiles\4n87uf9r.default\extensions\staged\wohoayibjf5@ye-aaoy.net\bootstrap.js
c:\users\janice\AppData\Roaming\Mozilla\Firefox\Profiles\4n87uf9r.default\extensions\staged\wohoayibjf5@ye-aaoy.net\chrome.manifest
c:\users\janice\AppData\Roaming\Mozilla\Firefox\Profiles\4n87uf9r.default\extensions\staged\wohoayibjf5@ye-aaoy.net\content\bg.js
c:\users\janice\AppData\Roaming\Mozilla\Firefox\Profiles\4n87uf9r.default\extensions\staged\wohoayibjf5@ye-aaoy.net\install.rdf
c:\users\janice\AppData\Roaming\Mozilla\Firefox\Profiles\4n87uf9r.default\extensions\staged\yuxh@tdpcfrzd.net
c:\users\janice\AppData\Roaming\Mozilla\Firefox\Profiles\4n87uf9r.default\extensions\staged\yuxh@tdpcfrzd.net\bootstrap.js
c:\users\janice\AppData\Roaming\Mozilla\Firefox\Profiles\4n87uf9r.default\extensions\staged\yuxh@tdpcfrzd.net\chrome.manifest
c:\users\janice\AppData\Roaming\Mozilla\Firefox\Profiles\4n87uf9r.default\extensions\staged\yuxh@tdpcfrzd.net\content\bg.js
c:\users\janice\AppData\Roaming\Mozilla\Firefox\Profiles\4n87uf9r.default\extensions\staged\yuxh@tdpcfrzd.net\install.rdf
c:\users\janice\g2mdlhlpx.exe
c:\users\patty\AppData\Roaming\Mozilla\Firefox\Profiles\jvuhw2ky.default\extensions\staged\q8xu@ayivpz.org
c:\users\patty\AppData\Roaming\Mozilla\Firefox\Profiles\jvuhw2ky.default\extensions\staged\q8xu@ayivpz.org\bootstrap.js
c:\users\patty\AppData\Roaming\Mozilla\Firefox\Profiles\jvuhw2ky.default\extensions\staged\q8xu@ayivpz.org\chrome.manifest
c:\users\patty\AppData\Roaming\Mozilla\Firefox\Profiles\jvuhw2ky.default\extensions\staged\q8xu@ayivpz.org\content\bg.js
c:\users\patty\AppData\Roaming\Mozilla\Firefox\Profiles\jvuhw2ky.default\extensions\staged\q8xu@ayivpz.org\install.rdf
c:\users\patty\AppData\Roaming\Mozilla\Firefox\Profiles\jvuhw2ky.default\extensions\staged\wohoayibjf5@ye-aaoy.net
c:\users\patty\AppData\Roaming\Mozilla\Firefox\Profiles\jvuhw2ky.default\extensions\staged\wohoayibjf5@ye-aaoy.net\bootstrap.js
c:\users\patty\AppData\Roaming\Mozilla\Firefox\Profiles\jvuhw2ky.default\extensions\staged\wohoayibjf5@ye-aaoy.net\chrome.manifest
c:\users\patty\AppData\Roaming\Mozilla\Firefox\Profiles\jvuhw2ky.default\extensions\staged\wohoayibjf5@ye-aaoy.net\content\bg.js
c:\users\patty\AppData\Roaming\Mozilla\Firefox\Profiles\jvuhw2ky.default\extensions\staged\wohoayibjf5@ye-aaoy.net\install.rdf
c:\users\patty\AppData\Roaming\Mozilla\Firefox\Profiles\jvuhw2ky.default\extensions\staged\yuxh@tdpcfrzd.net
c:\users\patty\AppData\Roaming\Mozilla\Firefox\Profiles\jvuhw2ky.default\extensions\staged\yuxh@tdpcfrzd.net\bootstrap.js
c:\users\patty\AppData\Roaming\Mozilla\Firefox\Profiles\jvuhw2ky.default\extensions\staged\yuxh@tdpcfrzd.net\chrome.manifest
c:\users\patty\AppData\Roaming\Mozilla\Firefox\Profiles\jvuhw2ky.default\extensions\staged\yuxh@tdpcfrzd.net\content\bg.js
c:\users\patty\AppData\Roaming\Mozilla\Firefox\Profiles\jvuhw2ky.default\extensions\staged\yuxh@tdpcfrzd.net\install.rdf
c:\windows\msdownld.tmp
c:\windows\security\Database\tmp.edb
c:\windows\system32\pt
c:\windows\system32\pt\DPCont32.dll.mui
.
.
((((((((((((((((((((((((( Files Created from 2015-03-13 to 2015-04-13 )))))))))))))))))))))))))))))))
.
.
2015-04-13 13:24 . 2015-04-13 13:24 -------- d-----w- c:\users\Xerox\AppData\Local\temp
2015-04-13 13:24 . 2015-04-13 13:24 -------- d-----w- c:\users\patty\AppData\Local\temp
2015-04-13 13:24 . 2015-04-13 13:24 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-04-13 13:01 . 2015-04-13 13:01 -------- d-----w- c:\users\janice\AppData\Roaming\AVAST Software
2015-04-13 13:01 . 2015-04-13 13:02 -------- d-----w- c:\windows\system32\vbox
2015-04-13 13:00 . 2015-04-13 13:00 81728 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2015-04-13 13:00 . 2015-04-13 13:00 73440 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2015-04-13 13:00 . 2015-04-13 13:00 49904 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2015-04-13 13:00 . 2015-04-13 13:00 427736 ----a-w- c:\windows\system32\drivers\aswSP.sys
2015-04-13 13:00 . 2015-04-13 13:00 24144 ----a-w- c:\windows\system32\drivers\aswHwid.sys
2015-04-13 13:00 . 2015-04-13 13:00 208024 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2015-04-13 13:00 . 2015-04-13 13:00 106912 ----a-w- c:\windows\system32\drivers\aswStm.sys
2015-04-13 13:00 . 2015-04-13 13:00 788272 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2015-04-13 13:00 . 2015-04-13 13:00 291312 ----a-w- c:\windows\system32\aswBoot.exe
2015-04-13 13:00 . 2015-04-13 13:00 43112 ----a-w- c:\windows\avastSS.scr
2015-04-13 12:57 . 2015-04-13 12:57 -------- d-----w- c:\program files\AVAST Software
2015-04-10 16:48 . 2015-02-16 22:10 86912 ----a-w- c:\windows\system32\LMIRfsClientNP.dll
2015-04-10 16:48 . 2015-02-16 22:10 53096 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\LMIproc.dll
2015-04-10 16:48 . 2015-02-16 22:09 31592 ----a-w- c:\windows\system32\LMIport.dll
2015-04-10 16:48 . 2015-02-16 21:59 47640 ----a-w- c:\windows\system32\drivers\LMIRfsDriver.sys
2015-04-10 16:48 . 2015-02-16 22:09 85864 ----a-w- c:\windows\system32\LMIinit.dll
2015-04-10 16:47 . 2015-04-10 17:32 -------- d-----w- c:\program files\LogMeIn
2015-04-10 16:42 . 2015-04-13 13:25 -------- d-----w- c:\program files\SAAZOD
2015-04-10 16:42 . 2015-04-10 16:59 -------- d-----w- c:\program files\SetupLogs
2015-04-10 16:42 . 2015-04-10 16:42 407104 ----a-w- c:\windows\system32\mshflxgd.ocx
2015-04-10 16:42 . 2015-04-10 16:42 203976 ----a-w- c:\windows\system32\richtx32.ocx
2015-04-10 16:42 . 2015-04-10 16:42 185344 ----a-w- c:\windows\system32\wbem\framedyn.dll
2015-04-10 16:42 . 2015-04-10 16:42 290816 ----a-w- c:\windows\system32\WINHTTP5.DLL
2015-04-10 16:42 . 2015-04-10 16:42 102912 ----a-w- c:\windows\system32\VB6STKIT.DLL
2015-04-10 15:56 . 2015-04-10 16:25 119512 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-04-10 15:25 . 2015-04-10 15:25 -------- d-----w- c:\program files\Malwarebytes Anti-Malware
2015-04-10 15:25 . 2015-03-17 10:15 51928 ----a-w- c:\windows\system32\drivers\mwac.sys
2015-04-10 15:15 . 2015-03-14 10:06 9119072 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{427D94E4-D9C5-4633-AD08-876A4919DDD3}\mpengine.dll
2015-04-09 19:31 . 2015-04-10 16:54 35064 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2015-04-09 19:31 . 2015-04-09 19:38 -------- d-----w- c:\programdata\RogueKiller
2015-04-09 19:28 . 2015-04-09 19:28 -------- d-----w- C:\RegBackup
2015-04-09 19:22 . 2015-04-09 19:26 -------- d-----w- C:\KVRT_Data
2015-04-09 19:16 . 2015-04-09 19:18 -------- d-----w- C:\FRST
2015-04-09 18:46 . 2015-04-09 21:12 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2015-04-09 18:44 . 2015-03-17 10:15 92888 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-04-09 18:41 . 2015-04-13 12:59 -------- d-----w- C:\downloads
2015-04-09 18:24 . 2014-09-04 18:04 867240 ----a-w- c:\windows\system32\npDeployJava1.dll
2015-04-09 18:24 . 2014-09-04 18:04 789416 ----a-w- c:\windows\system32\deployJava1.dll
2015-04-09 18:24 . 2015-04-09 18:24 -------- d-----w- c:\program files\Common Files\Java
2015-04-09 18:24 . 2015-04-09 18:25 -------- d-----w- c:\programdata\Oracle
2015-04-09 18:11 . 2015-04-09 18:11 -------- d-----w- c:\users\janice\AppData\Local\LogMeIn Rescue Applet
2015-04-08 07:00 . 2015-04-08 07:00 -------- d-s---w- c:\windows\system32\GWX
2015-04-02 18:10 . 2015-04-02 18:11 -------- d-----w- c:\users\janice\AppData\Local\Amazon Music
2015-03-27 12:59 . 2015-03-27 13:48 701616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2015-03-25 13:22 . 2015-03-11 03:30 534528 ----a-w- c:\windows\system32\generaltel.dll
2015-03-25 13:22 . 2015-03-11 03:30 623616 ----a-w- c:\windows\system32\invagent.dll
2015-03-25 13:22 . 2015-03-11 03:29 327168 ----a-w- c:\windows\system32\devinv.dll
2015-03-25 13:22 . 2015-03-11 03:29 818176 ----a-w- c:\windows\system32\appraiser.dll
2015-03-25 13:22 . 2015-03-11 03:29 26112 ----a-w- c:\windows\system32\acmigration.dll
2015-03-25 13:22 . 2015-03-11 03:26 892928 ----a-w- c:\windows\system32\aeinv.dll
2015-03-25 13:22 . 2015-03-11 03:29 202752 ----a-w- c:\windows\system32\aepdu.dll
2015-03-25 13:22 . 2015-03-11 03:29 159744 ----a-w- c:\windows\system32\aepic.dll
2015-03-17 15:20 . 2015-04-08 16:19 -------- d-----w- c:\program files\FMAuditOnsite
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-04-09 18:24 . 2014-09-04 18:04 96680 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2015-03-27 13:48 . 2011-06-06 16:16 71344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2015-03-06 05:15 . 2015-03-11 05:09 67512 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2015-03-06 05:15 . 2015-03-11 05:09 137656 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2015-03-06 05:10 . 2015-03-11 05:09 172032 ----a-w- c:\windows\system32\wdigest.dll
2015-03-06 05:10 . 2015-03-11 05:09 65536 ----a-w- c:\windows\system32\TSpkg.dll
2015-03-06 05:10 . 2015-03-11 05:09 15872 ----a-w- c:\windows\system32\sspisrv.dll
2015-03-06 05:10 . 2015-03-11 05:09 100352 ----a-w- c:\windows\system32\sspicli.dll
2015-03-06 05:10 . 2015-03-11 05:09 248832 ----a-w- c:\windows\system32\schannel.dll
2015-03-06 05:10 . 2015-03-11 05:09 22016 ----a-w- c:\windows\system32\secur32.dll
2015-03-06 05:10 . 2015-03-11 05:09 259584 ----a-w- c:\windows\system32\msv1_0.dll
2015-03-06 05:10 . 2015-03-11 05:09 221184 ----a-w- c:\windows\system32\ncrypt.dll
2015-03-06 05:10 . 2015-03-11 05:09 550912 ----a-w- c:\windows\system32\kerberos.dll
2015-03-06 05:10 . 2015-03-11 05:09 1061376 ----a-w- c:\windows\system32\lsasrv.dll
2015-03-06 05:10 . 2015-03-11 05:09 17408 ----a-w- c:\windows\system32\credssp.dll
2015-03-06 05:09 . 2015-03-11 05:09 22528 ----a-w- c:\windows\system32\lsass.exe
2015-03-06 05:09 . 2015-03-11 05:09 50176 ----a-w- c:\windows\system32\auditpol.exe
2015-03-06 05:07 . 2015-03-11 05:09 60416 ----a-w- c:\windows\system32\msobjs.dll
2015-03-06 05:07 . 2015-03-11 05:09 146432 ----a-w- c:\windows\system32\msaudite.dll
2015-03-06 05:06 . 2015-03-11 05:09 686080 ----a-w- c:\windows\system32\adtschema.dll
2015-02-26 03:11 . 2015-03-11 05:11 2381312 ----a-w- c:\windows\system32\win32k.sys
2015-02-24 08:23 . 2011-05-27 22:40 246920 ------w- c:\windows\system32\MpSigStub.exe
2015-02-20 04:13 . 2015-03-11 05:09 26624 ----a-w- c:\windows\system32\lpk.dll
2015-02-20 04:13 . 2015-03-11 05:09 70656 ----a-w- c:\windows\system32\fontsub.dll
2015-02-20 04:13 . 2015-03-11 05:09 10240 ----a-w- c:\windows\system32\dciman32.dll
2015-02-20 04:13 . 2015-03-11 05:09 34304 ----a-w- c:\windows\system32\atmlib.dll
2015-02-20 03:09 . 2015-03-11 05:09 299008 ----a-w- c:\windows\system32\atmfd.dll
2015-02-20 02:22 . 2015-03-11 05:11 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2015-02-20 02:22 . 2015-03-11 05:11 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll
2015-02-20 02:09 . 2015-03-11 05:11 503296 ----a-w- c:\windows\system32\vbscript.dll
2015-02-20 02:08 . 2015-03-11 05:11 62464 ----a-w- c:\windows\system32\iesetup.dll
2015-02-20 02:08 . 2015-03-11 05:11 47616 ----a-w- c:\windows\system32\ieetwproxystub.dll
2015-02-20 02:06 . 2015-03-11 05:11 64000 ----a-w- c:\windows\system32\MshtmlDac.dll
2015-02-20 01:56 . 2015-03-11 05:11 115712 ----a-w- c:\windows\system32\ieUnatt.exe
2015-02-20 01:56 . 2015-03-11 05:11 102912 ----a-w- c:\windows\system32\ieetwcollector.exe
2015-02-20 01:56 . 2015-03-11 05:11 620032 ----a-w- c:\windows\system32\jscript9diag.dll
2015-02-20 01:50 . 2015-03-11 05:11 667648 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2015-02-20 01:41 . 2015-03-11 05:11 60416 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2015-02-20 01:30 . 2015-03-11 05:11 4300288 ----a-w- c:\windows\system32\jscript9.dll
2015-02-20 01:24 . 2015-03-11 05:11 2052608 ----a-w- c:\windows\system32\inetcpl.cpl
2015-02-20 01:23 . 2015-03-11 05:11 1155072 ----a-w- c:\windows\system32\mshtmlmedia.dll
2015-02-20 01:01 . 2015-03-11 05:11 1888256 ----a-w- c:\windows\system32\wininet.dll
2015-02-17 19:26 . 2015-02-17 19:26 1217184 ----a-w- c:\windows\system32\FM20.DLL
2015-02-16 21:58 . 2015-02-16 21:58 25248 ----a-w- c:\windows\system32\lmimirr.dll
2015-02-16 21:58 . 2015-02-16 21:58 11552 ----a-w- c:\windows\system32\lmimirr2.dll
2015-02-16 21:58 . 2015-02-16 21:58 10144 ----a-w- c:\windows\system32\drivers\lmimirr.sys
2015-02-04 02:54 . 2015-03-11 05:09 417792 ----a-w- c:\windows\system32\WMPhoto.dll
2015-02-03 03:16 . 2015-03-11 05:09 3973048 ----a-w- c:\windows\system32\ntkrnlpa.exe
2015-02-03 03:16 . 2015-03-11 05:09 3917760 ----a-w- c:\windows\system32\ntoskrnl.exe
2015-02-03 03:16 . 2015-03-11 05:09 78784 ----a-w- c:\windows\system32\drivers\mountmgr.sys
2015-02-03 03:12 . 2015-03-11 05:08 617984 ----a-w- c:\windows\system32\wmdrmsdk.dll
2015-02-03 03:12 . 2015-03-11 05:08 179200 ----a-w- c:\windows\system32\wintrust.dll
2015-02-03 03:12 . 2015-03-11 05:12 1230848 ----a-w- c:\windows\system32\WindowsCodecs.dll
2015-02-03 03:12 . 2015-03-11 05:09 171520 ----a-w- c:\windows\system32\ubpm.dll
2015-02-03 03:12 . 2015-03-11 05:09 400896 ----a-w- c:\windows\system32\srcore.dll
2015-02-03 03:12 . 2015-03-11 05:08 43008 ----a-w- c:\windows\system32\srclient.dll
2015-02-03 03:12 . 2015-03-11 05:08 4096 ----a-w- c:\windows\system32\dxmasf.dll
2015-02-03 03:12 . 2015-03-11 05:08 4096 ----a-w- c:\windows\system32\msdxm.ocx
2015-02-03 03:12 . 2015-03-11 05:08 50176 ----a-w- c:\windows\system32\setbcdlocale.dll
2015-02-03 03:12 . 2015-03-11 05:08 1329664 ----a-w- c:\windows\system32\quartz.dll
2015-02-03 03:12 . 2015-03-11 05:08 519680 ----a-w- c:\windows\system32\qdvd.dll
2015-02-03 03:12 . 2015-03-11 05:08 442880 ----a-w- c:\windows\system32\AUDIOKSE.dll
2015-02-03 03:12 . 2015-03-11 05:08 157184 ----a-w- c:\windows\system32\pcasvc.dll
2015-02-03 03:12 . 2015-03-11 05:08 28160 ----a-w- c:\windows\system32\pcadm.dll
2015-02-03 03:12 . 2015-03-11 05:08 8192 ----a-w- c:\windows\system32\spwmp.dll
2015-02-03 03:12 . 2015-03-11 05:08 504320 ----a-w- c:\windows\system32\msscp.dll
2015-02-03 03:12 . 2015-03-11 05:08 265216 ----a-w- c:\windows\system32\msnetobj.dll
2015-02-03 03:12 . 2015-03-11 05:08 10752 ----a-w- c:\windows\system32\msmmsp.dll
2015-02-03 03:12 . 2015-03-11 05:09 3209728 ----a-w- c:\windows\system32\mf.dll
2015-02-03 03:12 . 2015-03-11 05:08 354816 ----a-w- c:\windows\system32\mfplat.dll
2015-02-03 03:12 . 2015-03-11 05:08 103424 ----a-w- c:\windows\system32\mfps.dll
2015-02-03 03:12 . 2015-03-11 05:08 489984 ----a-w- c:\windows\system32\evr.dll
2015-02-03 03:12 . 2015-03-11 05:08 275968 ----a-w- c:\windows\system32\EncDump.dll
2015-02-03 03:12 . 2015-03-11 05:08 988160 ----a-w- c:\windows\system32\drmv2clt.dll
2015-02-03 03:12 . 2015-03-11 05:08 406016 ----a-w- c:\windows\system32\drmmgrtn.dll
2015-02-03 03:12 . 2015-03-11 05:09 1174528 ----a-w- c:\windows\system32\crypt32.dll
2015-02-03 03:12 . 2015-03-11 05:08 1005056 ----a-w- c:\windows\system32\cryptui.dll
2015-02-03 03:12 . 2015-03-11 05:08 103936 ----a-w- c:\windows\system32\cryptnet.dll
2015-02-03 03:12 . 2015-03-11 05:08 143872 ----a-w- c:\windows\system32\cryptsvc.dll
2015-02-03 03:12 . 2015-03-11 05:08 81408 ----a-w- c:\windows\system32\cryptsp.dll
2015-02-03 03:12 . 2015-03-11 05:08 38912 ----a-w- c:\windows\system32\csrsrv.dll
2015-02-03 03:12 . 2015-03-11 05:08 744960 ----a-w- c:\windows\system32\blackbox.dll
2015-02-03 03:12 . 2015-03-11 05:08 475136 ----a-w- c:\windows\system32\audiosrv.dll
2015-02-03 03:12 . 2015-03-11 05:08 374784 ----a-w- c:\windows\system32\AudioEng.dll
2015-02-03 03:12 . 2015-03-11 05:08 50688 ----a-w- c:\windows\system32\appidapi.dll
2015-02-03 03:12 . 2015-03-11 05:08 27648 ----a-w- c:\windows\system32\appidsvc.dll
2015-02-03 03:12 . 2015-03-11 05:08 195584 ----a-w- c:\windows\system32\AudioSes.dll
2015-02-03 03:12 . 2015-03-11 05:08 69632 ----a-w- c:\windows\system32\smss.exe
2015-02-03 03:11 . 2015-03-11 05:08 262656 ----a-w- c:\windows\system32\rstrui.exe
2015-02-03 03:11 . 2015-03-11 05:08 50176 ----a-w- c:\windows\system32\rrinstaller.exe
2015-02-03 03:11 . 2015-03-11 05:08 9728 ----a-w- c:\windows\system32\pcawrk.exe
2015-02-03 03:11 . 2015-03-11 05:08 8192 ----a-w- c:\windows\system32\pcalua.exe
2015-02-03 03:11 . 2015-03-11 05:08 23040 ----a-w- c:\windows\system32\mfpmp.exe
2015-02-03 03:11 . 2015-03-11 05:08 100864 ----a-w- c:\windows\system32\audiodg.exe
2015-02-03 03:11 . 2015-03-11 05:08 96768 ----a-w- c:\windows\system32\appidpolicyconverter.exe
2015-02-03 03:11 . 2015-03-11 05:08 16896 ----a-w- c:\windows\system32\appidcertstorecheck.exe
2015-02-03 03:11 . 2015-03-11 05:08 12625408 ----a-w- c:\windows\system32\wmploc.DLL
2015-02-03 03:10 . 2015-03-11 05:08 8704 ----a-w- c:\windows\system32\pcaevts.dll
2015-02-03 03:09 . 2015-03-11 05:08 2048 ----a-w- c:\windows\system32\mferror.dll
2015-02-03 03:08 . 2015-03-11 05:08 6656 ----a-w- c:\windows\system32\apisetschema.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 152544 ----a-w- c:\users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 152544 ----a-w- c:\users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"]
@="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 152544 ----a-w- c:\users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"]
@="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 152544 ----a-w- c:\users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 152544 ----a-w- c:\users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"]
@="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 152544 ----a-w- c:\users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 152544 ----a-w- c:\users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"]
@="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 152544 ----a-w- c:\users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2015-04-13 13:00 644608 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2015-02-19 18:24 576840 ----a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2015-02-19 18:24 576840 ----a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2015-02-19 18:24 576840 ----a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2015-02-19 18:24 576840 ----a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2015-02-19 18:24 576840 ----a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GoToMeeting"="c:\program files\Citrix\GoToMeeting\1133\g2mstart.exe" [2013-04-30 40816]
"GoogleDriveSync"="c:\program files\Google\Drive\googledrivesync.exe" [2015-02-19 26232152]
"4903C05AE9AB57B53A27693FF7048D6A8B2DA265._service_run"="c:\program files\Google\Chrome\Application\chrome.exe" [2015-03-30 809288]
"GoogleChromeAutoLaunch_41D9CE09389FE1B3294D13AB76B81B46"="c:\program files\Google\Chrome\Application\chrome.exe" [2015-03-30 809288]
"RESTART_STICKY_NOTES"="c:\windows\System32\StikyNot.exe" [2009-07-14 354304]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-08-10 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-08-10 174104]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-08-10 151064]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-07-02 7596576]
"picon"="c:\program files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe" [2009-07-24 796696]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2009-06-18 563736]
"File Sanitizer"="c:\program files\Hewlett-Packard\File Sanitizer\CoreShredder.exe" [2010-05-06 11268096]
"SharpTray.exe"="c:\program files\Sharp\Sharpdesk\SharpTray.exe" [2009-12-08 131584]
"IndexTray.exe"="c:\program files\Sharp\Sharpdesk\IndexTray.exe" [2009-12-08 395264]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]
"TkBellExe"="c:\program files\real\realplayer\Update\realsched.exe" [2013-04-24 295512]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-22 59720]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2013-05-31 152392]
"EEventManager"="c:\program files\Epson Software\Event Manager\EEventManager.exe" [2012-04-02 1058912]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2008-01-14 29984]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2008-01-14 46368]
"HP LaserJet 400 MFP M425 Series Fax"="c:\program files\HP\Digital Imaging\Fax\Fax Driver 0.6 Base\hppfaxprintersrv.exe" [2014-08-14 2459888]
"StatusAlerts"="c:\program files\HP\StatusAlerts\bin\HPStatusAlerts.exe" [2012-07-18 313248]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2015-02-16 63048]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2015-04-13 5512912]
.
c:\users\janice\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\janice\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2015-4-2 43382072]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"SoftwareSASGeneration"= 3 (0x3)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"0"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DeviceNP]
2010-04-28 17:39 75320 ----a-w- c:\windows\System32\DeviceNP.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ DPPassFilter scecli
.
R1 SWIPsec;SonicWALL IPsec Driver;c:\windows\system32\Drivers\SWIPsec.sys [2009-03-06 87064]
R3 DAMDrv;DAMDrv;c:\windows\system32\DRIVERS\DAMDrv.sys [2010-03-09 32312]
R3 FLCDLOCK;HP ProtectTools Device Locking / Auditing;c:\windows\system32\flcdlock.exe [2010-04-28 362040]
R3 HP DS Service;HP DS Service;c:\program files\HP\HPBDSService\HPBDSService.exe [2011-10-17 13824]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2015-02-20 102912]
R3 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys [2015-03-17 92888]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys [2015-03-17 51928]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl.sys [2012-09-10 18432]
R3 SWVNIC;SonicWALL Virtual Miniport;c:\windows\system32\DRIVERS\swvnic.sys [2009-03-04 21016]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-05-28 1343400]
R3 WSDScan;WSD Scan Support via UMB;c:\windows\system32\DRIVERS\WSDScan.sys [2009-07-14 20480]
R4 SAAZapsc;SAAZ RMM Agent Presence-SC;c:\progra~1\SAAZOD\zRealTime\SAAZapsc.exe [2012-06-27 85296]
R4 SAAZRemoteSupport;SAAZRemoteSupport;c:\progra~1\SAAZOD\SAAZRemoteSupport.exe [2012-06-27 81200]
R4 zEvtSVC;zEvtSVC;c:\progra~1\SAAZOD\zSCC\zEvtSVC.exe [2015-01-14 237288]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S0 SafeBoot;SafeBoot; [x]
S0 SbAlg;SbAlg; [x]
S0 SbFsLock;SbFsLock; [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2015-04-13 788272]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2015-04-13 427736]
S1 RsvLock;RsvLock; [x]
S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys [2015-04-13 24144]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2015-04-13 73440]
S2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys [2015-04-13 106912]
S2 atashost;WebEx Service Host for Support Center;c:\windows\system32\atashost.exe [2014-12-04 118568]
S2 EpsonScanSvc;Epson Scanner Service;c:\windows\system32\EscSvc.exe [2011-12-12 122000]
S2 FMAuditOnsite;FMAudit Onsite;c:\program files\FMAuditOnsite\fmaonsite.exe [2015-03-11 67664]
S2 HP LaserJet Service;HP LaserJet Service;c:\program files\HP\HPLaserJetService\HPLaserJetService.exe [2012-05-03 164864]
S2 HP ProtectTools Service;HP ProtectTools Service;c:\program files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [2010-03-17 36864]
S2 Hp.Skyroom.Windows.Service;HP SkyRoom;c:\program files\Hewlett-Packard\HP SkyRoom\Hp.Skyroom.Windows.Service.exe [2010-03-03 124472]
S2 HpFkCryptService;Drive Encryption Service;c:\program files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [2010-02-02 281192]
S2 HPFSService;File Sanitizer for HP ProtectTools;c:\program files\Hewlett-Packard\File Sanitizer\HPFSService.exe [2010-05-06 298496]
S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\LogMeIn\x86\LMIGuardianSvc.exe [2015-02-16 412008]
S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [2015-02-16 13624]
S2 LMIRescue_64eaaef1-33c8-4935-b520-fc5098fb7598;LogMeIn Rescue (64eaaef1-33c8-4935-b520-fc5098fb7598);c:\users\janice\AppData\Local\LOGMEI~1\LMIR0001.tmp\LMI_Rescue_srv.exe [2015-04-09 3088688]
S2 MBAMScheduler;MBAMScheduler;c:\progra~1\SAAZOD\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-04-04 418376]
S2 MBAMService;MBAMService;c:\progra~1\SAAZOD\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]
S2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [2009-06-18 635416]
S2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files\RealNetworks\RealDownloader\rndlresolversvc.exe [2013-03-06 39056]
S2 rgsender;Remote Graphics Sender Service;c:\program files\Hewlett-Packard\HP SkyRoom\remote graphics sender\rgsendersvc.exe [2009-11-19 379904]
S2 SAAZappr;SAAZ RMM Agent Presence-PR;c:\progra~1\SAAZOD\zRealTime\SAAZappr.exe SAAZappr [x]
S2 SAAZDPMACTL;SAAZDPMACTL;c:\progra~1\SAAZOD\SAAZDPMACTL.exe [2012-06-27 89392]
S2 SAAZScheduler;SAAZScheduler;c:\progra~1\SAAZOD\SAAZScheduler.exe [2015-04-10 85296]
S2 SAAZServerPlus;SAAZServerPlus;c:\progra~1\SAAZOD\SAAZServerPlus.exe [2012-06-27 85296]
S2 SAAZWatchDog;SAAZWatchDog;c:\progra~1\SAAZOD\SAAZWatchDog.exe [2012-06-27 89392]
S2 SBT Log;SBT Log;c:\program files\Silver Bullet Technology\Ranger\Logging\SBTLogServiceWindows.exe [2013-07-29 42496]
S2 SWGVCSvc;SonicWALL Global VPN Client Service;c:\program files\SonicWALL\SonicWALL Global VPN Client\SWGVCSvc.exe [2009-03-06 227352]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files\Common Files\Intel\Privacy Icon\UNS\UNS.exe [2009-07-24 2066968]
S2 VBoxAswDrv;VBoxAsw Support Driver;c:\program files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [2015-04-13 220240]
S3 AvastVBoxSvc;AvastVBox COM Service;c:\program files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [2015-04-13 3205216]
S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k6232.sys [2009-10-01 206304]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-04-04 22856]
S3 SmrtSrc;SmrtSrc;c:\windows\system32\DRIVERS\SmrtSrc.sys [2012-06-04 199904]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-04-02 13:02 1061704 ----a-w- c:\program files\Google\Chrome\Application\41.0.2272.118\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2015-04-13 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-03-27 13:48]
.
2015-04-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-10-14 21:42]
.
2015-04-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-10-14 21:42]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.lakelandbank.com/default.aspx
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://www.google.com
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
Trusted Zone: adp.com
Trusted Zone: lakelandbank.com\merchant
Trusted Zone: lakelandbank.com\www
TCP: Interfaces\{52760699-64C9-4F0F-8791-D1B6936A8915}: NameServer = 151.198.0.39,204.117.214.10
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-AROReminder - (no file)
AddRemove-RealPlayer 16.0 - c:\program files\real\realplayer\Update\r1puninst.exe
AddRemove-{495A8A3C-8FD0-4C46-9979-95C26181A1AB} - c:\program files\InstallShield Installation Information\{495A8A3C-8FD0-4C46-9979-95C26181A1AB}\setup.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\pdfcDispatcher]
"ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'lsass.exe'(640)
c:\windows\system32\DPFPApi.DLL
.
------------------------ Other Running Processes ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\windows\system32\taskhost.exe
c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\LogMeIn\x86\RaMaint.exe
c:\program files\Intel\AMT\LMS.exe
c:\progra~1\SAAZOD\Malwarebytes' Anti-Malware\mbamgui.exe
c:\progra~1\SAAZOD\zRealTime\SAAZappr.exe
c:\progra~1\SAAZOD\zRealTime\rtHlpDk.exe
c:\users\janice\AppData\Local\LOGMEI~1\LMIR0001.tmp\LMI_Rescue.exe
c:\program files\Hewlett-Packard\HP SkyRoom\remote graphics sender\rgsender.exe
c:\program files\Hewlett-Packard\HP SkyRoom\remote graphics sender\rgsender_gui.exe
c:\program files\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Authentication\Hp.SkyRoom.Windows.RgsPlugin.Authentication.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\system32\conhost.exe
c:\program files\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Lens\Hp.SkyRoom.Windows.RgsPlugin.Lens.exe
c:\windows\system32\conhost.exe
c:\windows\system32\conhost.exe
c:\program files\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Licensing\Hp.SkyRoom.Windows.RgsPlugin.Licensing.exe
c:\windows\system32\conhost.exe
c:\windows\servicing\TrustedInstaller.exe
c:\windows\system32\igfxsrvc.exe
c:\users\janice\AppData\Roaming\Dropbox\bin\Dropbox.exe
c:\program files\Citrix\GoToMeeting\1133\g2mcomm.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Citrix\GoToMeeting\1133\g2mlauncher.exe
c:\progra~1\SAAZOD\BaseComponents\PatchManagement\ZPMGmt.exe
c:\progra~1\SAAZOD\zSCC\zInCCM.exe
c:\progra~1\SAAZOD\zSCC\zCCM.exe
c:\windows\system32\UI0Detect.exe
c:\program files\LogMeIn\x86\LogMeIn.exe
c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
c:\windows\system32\sppsvc.exe
c:\program files\HP\HPLJUT\HPLJUTSCH.exe
.
**************************************************************************
.
Completion time: 2015-04-13 09:32:42 - machine was rebooted
ComboFix-quarantined-files.txt 2015-04-13 13:32
.
Pre-Run: 78,302,433,280 bytes free
Post-Run: 78,624,231,424 bytes free
.
- - End Of File - - 3D53F89D9492D6931665082766DD4C60
A36C5E4F47E84449FF07ED3517B43A31

Broni · Apr 13, 2015

Re-run Farbar Recovery Scan Tool (FRST/FRST64) you ran at the very beginning of this topic.

Double-click to run it. When the tool opens click Yes to disclaimer.
Make sure you checkmark Addition.txt box.
Press Scan button.
Scan will create two logs, FRST.txt and Addition.txt in the same directory the tool is run. Please copy and paste them to your reply.

Eric Witzling · Apr 14, 2015

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 13-04-2015
Ran by janice (administrator) on CFO-HP on 14-04-2015 13:04:55
Running from C:\Users\janice\Desktop
Loaded Profiles: janice (Available profiles: janice & patty & cfo & Xerox)
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool:

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Hewlett-Packard) C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe
(McAfee, Inc.) C:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Cisco WebEx LLC) C:\Windows\System32\atashost.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc.exe
(ECi FMAudit) C:\Program Files\FMAuditOnsite\fmaonsite.exe
(HP) C:\Program Files\Hp\HPLaserJetService\HPLaserJetService.exe
(Hewlett-Packard Development Company, L.P) C:\Program Files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP SkyRoom\Hp.Skyroom.Windows.Service.exe
(LogMeIn, Inc.) C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe
(LogMeIn, Inc.) C:\Program Files\LogMeIn\x86\ramaint.exe
(LogMeIn, Inc.) C:\Users\janice\AppData\Local\LogMeIn Rescue Applet\LMIR0001.tmp\LMI_Rescue_srv.exe
(Intel Corporation) C:\Program Files\Intel\AMT\LMS.exe
(Malwarebytes Corporation) C:\Program Files\SAAZOD\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\SAAZOD\Malwarebytes' Anti-Malware\mbamservice.exe
(PDF Complete Inc) C:\Program Files\PDF Complete\pdfsvc.exe
() C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
(Malwarebytes Corporation) C:\Program Files\SAAZOD\Malwarebytes' Anti-Malware\mbamgui.exe
(Continuum Managed Services LLC.) C:\Program Files\SAAZOD\zRealTime\SAAZappr.exe
(Continuum Managed Services LLC.) C:\Program Files\SAAZOD\SAAZDPMACTL.exe
(Continuum Managed Service LLC.) C:\Program Files\SAAZOD\SAAZScheduler.exe
(Continuum Managed Services LLC.) C:\Program Files\SAAZOD\zRealTime\rtHlpDk.exe
(Continuum Managed Services LLC.) C:\Program Files\SAAZOD\SAAZServerPlus.exe
(Continuum Managed Services LLC.) C:\Program Files\SAAZOD\SAAZWatchDog.exe
(Silver Bullet Technologies, Inc.) C:\Program Files\Silver Bullet Technology\Ranger\Logging\SBTLogServiceWindows.exe
(SonicWALL, Inc.) C:\Program Files\SonicWALL\SonicWALL Global VPN Client\SWGVCSvc.exe
(LogMeIn, Inc.) C:\Users\janice\AppData\Local\LogMeIn Rescue Applet\LMIR0001.tmp\lmi_rescue.exe
(Intel Corporation) C:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe
(Hewlett-Packard, Inc.) C:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\rgsendersvc.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\rgsender.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\rgsender_gui.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\Plugins\Ice\Hp.SkyRoom.Windows.RgsPlugin.Authentication\Hp.SkyRoom.Windows.RgsPlugin.Authentication.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\Plugins\Ice\Hp.SkyRoom.Windows.RgsPlugin.Lens\Hp.SkyRoom.Windows.RgsPlugin.Lens.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\Plugins\Ice\Hp.SkyRoom.Windows.RgsPlugin.Licensing\Hp.SkyRoom.Windows.RgsPlugin.Licensing.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Intel Corporation) C:\Program Files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\File Sanitizer\coreshredder.exe
(SHARP CORPORATION) C:\Program Files\Sharp\Sharpdesk\SharpTray.exe
(Hewlett-Packard) C:\Program Files\Hp\HP Software Update\hpwuschd2.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Epson Software\Event Manager\EEventManager.exe
(Nuance Communications, Inc.) C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
(Hewlett-Packard Company) C:\Program Files\Hp\Digital Imaging\Fax\Fax Driver 0.6 Base\hppfaxprintersrv.exe
(Hewlett-Packard Company) C:\Program Files\Hp\StatusAlerts\bin\HPStatusAlerts.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Citrix Online, a division of Citrix Systems, Inc.) C:\Program Files\Citrix\GoToMeeting\1133\g2mstart.exe
(Google) C:\Program Files\Google\Drive\googledrivesync.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Dropbox, Inc.) C:\Users\janice\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Citrix Online, a division of Citrix Systems, Inc.) C:\Program Files\Citrix\GoToMeeting\1133\g2mcomm.exe
(Google) C:\Program Files\Google\Drive\googledrivesync.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Citrix Online, a division of Citrix Systems, Inc.) C:\Program Files\Citrix\GoToMeeting\1133\g2mlauncher.exe
(Continuum Managed Services LLC.) C:\Program Files\SAAZOD\zSCC\zCCM.exe
(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe
(LogMeIn, Inc.) C:\Program Files\LogMeIn\x86\LogMeIn.exe
(LogMeIn, Inc.) C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
(Continuum Managed Services LLC.) C:\Program Files\SAAZOD\zSCC\zInCCM.exe
(LogMeIn, Inc.) C:\Program Files\LogMeIn\x86\LogMeIn.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7596576 2009-07-02] (Realtek Semiconductor)
HKLM\...\Run: [picon] => C:\Program Files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe [796696 2009-07-24] (Intel Corporation)
HKLM\...\Run: [PDF Complete] => C:\Program Files\PDF Complete\pdfsty.exe [563736 2009-06-18] (PDF Complete Inc)
HKLM\...\Run: [File Sanitizer] => C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe [11268096 2010-05-06] (Hewlett-Packard)
HKLM\...\Run: [SharpTray.exe] => C:\Program Files\Sharp\Sharpdesk\SharpTray.exe [131584 2009-12-08] (SHARP CORPORATION)
HKLM\...\Run: [IndexTray.exe] => C:\Program Files\Sharp\Sharpdesk\IndexTray.exe [395264 2009-12-08] (SHARP CORPORATION)
HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard)
HKLM\...\Run: [TkBellExe] => c:\program files\real\realplayer\Update\realsched.exe [295512 2013-04-24] (RealNetworks, Inc.)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-05-31] (Apple Inc.)
HKLM\...\Run: [EEventManager] => C:\Program Files\Epson Software\Event Manager\EEventManager.exe [1058912 2012-04-02] (SEIKO EPSON CORPORATION)
HKLM\...\Run: [SSBkgdUpdate] => C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [210472 2006-10-25] (Nuance Communications, Inc.)
HKLM\...\Run: [PaperPort PTD] => C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe [29984 2008-01-14] (Nuance Communications, Inc.)
HKLM\...\Run: [IndexSearch] => C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe [46368 2008-01-14] (Nuance Communications, Inc.)
HKLM\...\Run: [HP LaserJet 400 MFP M425 Series Fax] => C:\Program Files\HP\Digital Imaging\Fax\Fax Driver 0.6 Base\hppfaxprintersrv.exe [2459888 2014-08-14] (Hewlett-Packard Company)
HKLM\...\Run: [StatusAlerts] => C:\Program Files\HP\StatusAlerts\bin\HPStatusAlerts.exe [313248 2012-07-18] (Hewlett-Packard Company)
HKLM\...\Run: [LogMeIn GUI] => C:\Program Files\LogMeIn\x86\LogMeInSystray.exe [63048 2015-02-16] (LogMeIn, Inc.)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5512912 2015-04-13] (Avast Software s.r.o.)
Winlogon\Notify\DeviceNP: C:\Windows\system32\DeviceNP.dll (Hewlett-Packard Limited)
HKLM\...\Policies\Explorer: [0] 0
HKU\S-1-5-21-1614596209-2777662679-913267390-1001\...\Run: [GoToMeeting] => C:\Program Files\Citrix\GoToMeeting\1133\g2mstart.exe [40816 2013-04-30] (Citrix Online, a division of Citrix Systems, Inc.)
HKU\S-1-5-21-1614596209-2777662679-913267390-1001\...\Run: [GoogleDriveSync] => C:\Program Files\Google\Drive\googledrivesync.exe [26232152 2015-02-19] (Google)
HKU\S-1-5-21-1614596209-2777662679-913267390-1001\...\Run: [4903C05AE9AB57B53A27693FF7048D6A8B2DA265._service_run] => C:\Program Files\Google\Chrome\Application\chrome.exe [809288 2015-03-30] (Google Inc.)
HKU\S-1-5-21-1614596209-2777662679-913267390-1001\...\Run: [GoogleChromeAutoLaunch_41D9CE09389FE1B3294D13AB76B81B46] => C:\Program Files\Google\Chrome\Application\chrome.exe [809288 2015-03-30] (Google Inc.)
HKU\S-1-5-21-1614596209-2777662679-913267390-1001\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [354304 2009-07-13] (Microsoft Corporation)
IFEO\ehshell.exe: [Debugger] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe" -MceShellRedirect
Lsa: [Notification Packages] DPPassFilter scecli
Startup: C:\Users\janice\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\janice\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (Avast Software s.r.o.)
ShellIconOverlayIdentifiers: [GDriveBlacklistedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSharedEditOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSharedViewOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSyncedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSyncingOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1614596209-2777662679-913267390-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:55242;https=127.0.0.1:55242
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1614596209-2777662679-913267390-1001\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1614596209-2777662679-913267390-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.lakelandbank.com/default.aspx
HKU\S-1-5-21-1614596209-2777662679-913267390-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1614596209-2777662679-913267390-1001 -> {A11B5998-39F5-42F5-B7DE-C12D15C43B18} URL =
BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2013-03-06] (RealDownloader)
BHO: File Sanitizer for HP ProtectTools -> {3134413B-49B4-425C-98A5-893C1F195601} -> C:\Program Files\Hewlett-Packard\File Sanitizer\IEBHO.dll [2010-05-06] (Hewlett-Packard)
BHO: HP ProtectTools Security Manager Extension -> {395610AE-C624-4f58-B89E-23733EA00F9A} -> C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpOtsPluginIe8.dll [2010-04-22] (DigitalPersona, Inc.)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_40\bin\ssv.dll [2015-04-09] (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-04-13] (Avast Software s.r.o.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-04-09] (Oracle Corporation)
Toolbar: HKU\S-1-5-21-1614596209-2777662679-913267390-1001 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKU\S-1-5-21-1614596209-2777662679-913267390-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
DPF: {106E49CF-797A-11D2-81A2-00E02C015623} https://merchant.lakelandbank.com/WebCaptureWeb/alternatiff_licensed.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: sds - {79E0F14C-9C52-4218-89A7-7C4B0563D121} - C:\Program Files\Sharp\Sharpdesk\ExplorerExtensions.dll [2009-12-08] (SHARP CORPORATION)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\..\Interfaces\{52760699-64C9-4F0F-8791-D1B6936A8915}: [NameServer] 151.198.0.39,204.117.214.10

FireFox:
========
FF ProfilePath: C:\Users\janice\AppData\Roaming\Mozilla\Firefox\Profiles\4n87uf9r.default
FF DefaultSearchEngine: Yahoo!
FF SelectedSearchEngine: Yahoo!
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-03-27] ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2013-04-08] ()
FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Google\Picasa3\npPicasa3.dll [2014-01-03] (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\system32\npDeployJava1.dll [2014-09-04] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-04-09] (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-05] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-05] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin: Web Components -> C:\Program Files\Web Components\npWebVideoPlugin.dll [2013-07-01] ()
FF Plugin HKU\S-1-5-21-1614596209-2777662679-913267390-1001: @citrixonline.com/appdetectorplugin -> C:\Users\janice\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2013-04-30] (Citrix Online)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2013-12-21] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppl3260.dll [2013-04-24] (RealNetworks, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nprpplugin.dll [2013-04-24] (RealPlayer)
FF Plugin ProgramFiles/Appdata: C:\Users\janice\AppData\Roaming\mozilla\plugins\npatgpc.dll [2014-12-04] (Cisco WebEx LLC)
FF SearchPlugin: C:\Users\janice\AppData\Roaming\Mozilla\Firefox\Profiles\4n87uf9r.default\searchplugins\AOL Search.xml [2014-02-11]
FF Extension: AOL Messaging Toolbar - C:\Users\janice\AppData\Roaming\Mozilla\Firefox\Profiles\4n87uf9r.default\Extensions\{c2f863cd-0429-48c7-bb54-db756a951760} [2014-02-11]
FF HKLM\...\Firefox\Extensions: [otis@digitalpersona.com] - C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt
FF Extension: DigitalPersona Extension - C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt [2011-05-26]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-04-13]
FF HKLM\...\Firefox\Extensions: [{DAC3F861-B30D-40dd-9166-F4E75327FAC7}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013-04-24]
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: No Name - C:\Users\janice\AppData\Roaming\Mozilla\Firefox\Profiles\4n87uf9r.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8} [Not Found]
FF Extension: No Name - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.0.0.100\IPSFF [Not Found]
FF Extension: No Name - C:\Users\janice\AppData\Roaming\Mozilla\Firefox\Profiles\4n87uf9r.default\extensions\cda2aa03-4bc9-4ec7-9498-460a0930b748@ad411bc8-5385-474c-96ad-ae0bd30853a6.com [Not Found]

Chrome:
=======
CHR StartupUrls: Default -> "hxxp://www.gmail.com/", "https://drive.google.com/a/minehill.com/?usp=chrome_app#my-drive", "https://www.google.com/calendar/render"
CHR DefaultSearchKeyword: Default -> yahoo.com search
CHR DefaultSearchURL: Default -> https://search.yahoo.com/search?fr=chr-yo_gc&ei=utf-8&ilc=12&type=523482&p={searchTerms}
CHR DefaultSuggestURL: Default -> https://ff.search.yahoo.com/gossip?output=fxjson&command={searchTerms}
CHR Profile: C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Live Documents) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\amaifjdaecbdedhngkjojpkdnjndpcch [2013-03-15]
CHR Extension: (Google Drive) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-04]
CHR Extension: (RemindMe) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\dkbeopafgiefnlffkhmkhldcojehlgam [2013-06-17]
CHR Extension: (Google Calendar) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjicmeblgpmajnghnpcppodonldlgfn [2013-03-15]
CHR Extension: (Pandora) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbangkleohkafngihneedemihgfeikcl [2013-03-19]
CHR Extension: (Avast Online Security) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-04-13]
CHR Extension: (Wunderlist Panel) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnkkhbbhipldmgjflneimpacklkiogpo [2013-11-18]
CHR Extension: (Google Play Music) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\icppfcnhkcmnfdhfhphakoifcfokfdhg [2013-03-19]
CHR Extension: (RealDownloader) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2014-09-02]
CHR Extension: (Google Voice Desktop Notifier) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\ijhfodlhanopbgfajnmcimljnakgioee [2013-03-15]
CHR Extension: (Simple Wunderlist Popup) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\imnncalpbcgmbdcbhcmlihhmgdmolegl [2013-11-18]
CHR Extension: (Todoist: To-Do list and Task Manager) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\jldhpllghnbhlbpcmnajkpdmadaolakh [2013-03-15]
CHR Extension: (HelloSign: Online signatures made easy) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\kajjckmbclbffbpecfbiecehkfgopppd [2014-09-09]
CHR Extension: (Google Voice (by Google)) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcnhkahnjcbndmmehfkdnkjomaanaooo [2013-03-15]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-13]
CHR Extension: (Google Mail Checker) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\mihcahmgecmbnbcchbopgniflfhgnkff [2013-03-15]
CHR Extension: (GroupDocs Signature plugin for Gmail) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\nhlbakmenmejflfilefakdjhfoiohggl [2014-09-09]
CHR Extension: (Google Wallet) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-26]
CHR Extension: (My Chrome Theme) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\oehpjpccmlcalbenfhnacjeocbjdonic [2013-03-15]
CHR Extension: (Outlook.com) - C:\Users\janice\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfpeapihoiogbcmdmnibeplnikfnhoge [2015-03-30]
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-04-13]
CHR HKLM\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2013-03-06]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 atashost; C:\Windows\system32\atashost.exe [118568 2014-12-04] (Cisco WebEx LLC)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-04-13] (Avast Software s.r.o.)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [3205216 2015-04-13] (Avast Software)
R2 DpHost; C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [300808 2010-04-22] (DigitalPersona, Inc.)
R2 EpsonScanSvc; C:\Windows\system32\EscSvc.exe [122000 2011-12-12] (Seiko Epson Corporation)
S3 FLCDLOCK; C:\Windows\system32\flcdlock.exe [362040 2010-04-28] (Hewlett-Packard Ltd)
R2 FMAuditOnsite; C:\Program Files\FMAuditOnsite\fmaonsite.exe [67664 2015-03-11] (ECi FMAudit)
S3 HP DS Service; C:\Program Files\HP\HPBDSService\HPBDSService.exe [13824 2011-10-17] (Hewlett-Packard Company) [File not signed]
R2 HP Health Check Service; C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [120832 2009-10-15] (Hewlett-Packard) [File not signed]
R2 HP LaserJet Service; C:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe [164864 2012-05-02] (HP) [File not signed]
R2 HP ProtectTools Service; C:\Program Files\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [36864 2010-03-16] (Hewlett-Packard Development Company, L.P) [File not signed]
R2 Hp.Skyroom.Windows.Service; C:\Program Files\Hewlett-Packard\HP SkyRoom\Hp.Skyroom.Windows.Service.exe [124472 2010-03-03] (Hewlett-Packard)
R2 HpFkCryptService; C:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [281192 2010-02-01] (McAfee, Inc.)
R2 HPFSService; C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe [298496 2010-05-06] (Hewlett-Packard) [File not signed]
R2 LMIRescue_64eaaef1-33c8-4935-b520-fc5098fb7598; C:\Users\janice\AppData\Local\LogMeIn Rescue Applet\LMIR0001.tmp\LMI_Rescue_srv.exe [3088688 2015-04-09] (LogMeIn, Inc.)
R2 MBAMScheduler; C:\Program Files\SAAZOD\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\SAAZOD\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [45568 2011-04-13] (Hewlett-Packard) [File not signed]
R2 pdfcDispatcher; C:\Program Files\PDF Complete\pdfsvc.exe [635416 2009-06-18] (PDF Complete Inc)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [55808 2011-04-13] (Hewlett-Packard) [File not signed]
R2 RealNetworks Downloader Resolver Service; C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-03-06] ()
R2 rgsender; c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\rgsendersvc.exe [379904 2009-11-19] (Hewlett-Packard, Inc.) [File not signed]
R2 SAAZappr; C:\Program Files\SAAZOD\zRealTime\SAAZappr.exe [85296 2012-06-26] (Continuum Managed Services LLC.)
S4 SAAZapsc; C:\Program Files\SAAZOD\zRealTime\SAAZapsc.exe [85296 2012-06-26] (Continuum Managed Services LLC.)
R2 SAAZDPMACTL; C:\Program Files\SAAZOD\SAAZDPMACTL.exe [89392 2012-06-26] (Continuum Managed Services LLC.)
S4 SAAZRemoteSupport; C:\Program Files\SAAZOD\SAAZRemoteSupport.exe [81200 2012-06-26] (Continuum Managed Services LLC.)
R2 SAAZScheduler; C:\Program Files\SAAZOD\SAAZScheduler.exe [85296 2015-04-10] (Continuum Managed Service LLC.)
R2 SAAZServerPlus; C:\Program Files\SAAZOD\SAAZServerPlus.exe [85296 2012-06-26] (Continuum Managed Services LLC.)
R2 SAAZWatchDog; C:\Program Files\SAAZOD\SAAZWatchDog.exe [89392 2012-06-26] (Continuum Managed Services LLC.)
R2 SBT Log; C:\Program Files\Silver Bullet Technology\Ranger\Logging\SBTLogServiceWindows.exe [42496 2013-07-29] (Silver Bullet Technologies, Inc.) [File not signed]
R2 SWGVCSvc; C:\Program Files\SonicWALL\SonicWALL Global VPN Client\SWGVCSvc.exe [227352 2009-03-05] (SonicWALL, Inc.)
R2 UNS; C:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe [2066968 2009-07-24] (Intel Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
S4 zEvtSVC; C:\Program Files\SAAZOD\zSCC\zEvtSVC.exe [237288 2015-01-14] (Continuum Managed Services LLC)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24144 2015-04-13] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [73440 2015-04-13] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [81728 2015-04-13] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49904 2015-04-13] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [788272 2015-04-13] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427736 2015-04-13] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [106912 2015-04-13] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [208024 2015-04-13] ()
S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv.sys [32312 2010-03-08] (Hewlett-Packard Development Company L.P.)
R3 DNE; C:\Windows\System32\DRIVERS\dne2000.sys [131984 2008-11-16] (Deterministic Networks, Inc.)
S3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [92888 2015-03-17] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-03-17] (Malwarebytes Corporation)
R1 RsvLock; C:\Windows\system32\Drivers\RsvLock.sys [40088 2010-02-01] (McAfee, Inc.)
R0 SafeBoot; C:\Windows\system32\Drivers\SafeBoot.sys [110520 2010-02-01] () [File not signed]
R0 SbAlg; C:\Windows\system32\Drivers\SbAlg.sys [51800 2010-02-01] (McAfee, Inc.)
R0 SbFsLock; C:\Windows\system32\Drivers\SbFsLock.sys [13256 2010-02-01] (McAfee, Inc.)
R3 SmrtSrc; C:\Windows\System32\DRIVERS\SmrtSrc.sys [199904 2012-06-04] (Jungo)
S1 SWIPsec; C:\Windows\system32\Drivers\SWIPsec.sys [87064 2009-03-05] (SonicWALL, Inc.)
S3 SWVNIC; C:\Windows\System32\DRIVERS\swvnic.sys [21016 2009-03-04] (SonicWALL, Inc.)
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [220240 2015-04-13] (Avast Software)
S3 catchme; \??\C:\Users\janice\AppData\Local\Temp\catchme.sys [X]
S4 LMIRfsClientNP; No ImagePath
U3 mbr; \??\C:\Users\janice\AppData\Local\Temp\mbr.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-14 13:04 - 2015-04-14 13:05 - 00032299 _____ () C:\Users\janice\Desktop\FRST.txt
2015-04-14 13:04 - 2015-04-14 13:04 - 00000000 ____D () C:\Users\janice\Desktop\FRST-OlderVersion
2015-04-13 13:31 - 2015-04-13 13:31 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-13 09:32 - 2015-04-13 09:32 - 00039766 _____ () C:\ComboFix.txt
2015-04-13 09:05 - 2011-06-26 02:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-04-13 09:05 - 2010-11-07 13:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-04-13 09:05 - 2009-04-20 00:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-04-13 09:05 - 2000-08-30 20:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-04-13 09:05 - 2000-08-30 20:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-04-13 09:05 - 2000-08-30 20:00 - 00098816 _____ () C:\Windows\sed.exe
2015-04-13 09:05 - 2000-08-30 20:00 - 00080412 _____ () C:\Windows\grep.exe
2015-04-13 09:05 - 2000-08-30 20:00 - 00068096 _____ () C:\Windows\zip.exe
2015-04-13 09:04 - 2015-04-13 09:32 - 00000000 ____D () C:\Qoobox
2015-04-13 09:04 - 2015-04-13 09:30 - 00000000 ____D () C:\Windows\erdnt
2015-04-13 09:01 - 2015-04-13 09:02 - 00000000 ____D () C:\Windows\system32\vbox
2015-04-13 09:01 - 2015-04-13 09:01 - 00002077 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-04-13 09:01 - 2015-04-13 09:01 - 00000000 ____D () C:\Users\janice\AppData\Roaming\AVAST Software
2015-04-13 09:01 - 2015-04-13 09:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-04-13 09:00 - 2015-04-13 09:00 - 00788272 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSnx.sys
2015-04-13 09:00 - 2015-04-13 09:00 - 00427736 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSP.sys
2015-04-13 09:00 - 2015-04-13 09:00 - 00291312 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe
2015-04-13 09:00 - 2015-04-13 09:00 - 00208024 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-04-13 09:00 - 2015-04-13 09:00 - 00106912 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswStm.sys
2015-04-13 09:00 - 2015-04-13 09:00 - 00081728 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswRdr2.sys
2015-04-13 09:00 - 2015-04-13 09:00 - 00073440 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-04-13 09:00 - 2015-04-13 09:00 - 00049904 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-04-13 09:00 - 2015-04-13 09:00 - 00043112 _____ (Avast Software s.r.o.) C:\Windows\avastSS.scr
2015-04-13 09:00 - 2015-04-13 09:00 - 00024144 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2015-04-13 08:57 - 2015-04-13 08:57 - 00000000 ____D () C:\Program Files\AVAST Software
2015-04-13 08:55 - 2015-04-13 08:55 - 05481336 _____ (Avast Software s.r.o.) C:\Users\janice\Downloads\avast_free_antivirus_setup_online_cnet.exe
2015-04-10 13:07 - 2015-04-10 13:07 - 00004250 _____ () C:\Users\janice\Desktop\RKreport_DEL_04102015_130636.log
2015-04-10 12:48 - 2015-04-13 09:31 - 00000960 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Control Panel.lnk
2015-04-10 12:48 - 2015-04-13 09:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
2015-04-10 12:48 - 2015-02-16 18:10 - 00086912 _____ (LogMeIn, Inc.) C:\Windows\system32\LMIRfsClientNP.dll
2015-04-10 12:48 - 2015-02-16 18:09 - 00085864 _____ (LogMeIn, Inc.) C:\Windows\system32\LMIinit.dll
2015-04-10 12:48 - 2015-02-16 18:09 - 00031592 _____ (LogMeIn, Inc.) C:\Windows\system32\LMIport.dll
2015-04-10 12:48 - 2015-02-16 17:59 - 00047640 _____ (LogMeIn, Inc.) C:\Windows\system32\Drivers\LMIRfsDriver.sys
2015-04-10 12:47 - 2015-04-10 13:32 - 00000000 ____D () C:\Program Files\LogMeIn
2015-04-10 12:47 - 2015-04-10 12:47 - 00001024 _____ () C:\.rnd
2015-04-10 12:43 - 2015-04-13 00:21 - 00001112 _____ () C:\Windows\system32\ipstuffNew.txt
2015-04-10 12:42 - 2015-04-14 13:01 - 00000000 ____D () C:\Program Files\SAAZOD
2015-04-10 12:42 - 2015-04-10 12:42 - 00407104 _____ (Microsoft Corporation) C:\Windows\system32\mshflxgd.ocx
2015-04-10 12:42 - 2015-04-10 12:42 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\WINHTTP5.DLL
2015-04-10 12:42 - 2015-04-10 12:42 - 00203976 _____ (Microsoft Corporation) C:\Windows\system32\richtx32.ocx
2015-04-10 12:42 - 2015-04-10 12:42 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\VB6STKIT.DLL
2015-04-10 12:42 - 2015-04-10 12:42 - 00000539 _____ () C:\Windows\KB893803v2.log
2015-04-10 12:40 - 2015-04-10 12:40 - 00000687 _____ () C:\Users\janice\Desktop\JRT.txt
2015-04-10 12:35 - 2015-04-10 12:35 - 00001459 _____ () C:\Users\janice\Desktop\AdwCleaner[S2].txt
2015-04-10 12:26 - 2015-04-10 12:26 - 00012083 _____ () C:\Users\janice\Desktop\MBAM.txt
2015-04-10 11:25 - 2015-04-10 11:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-04-10 11:25 - 2015-04-10 11:25 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2015-04-10 11:25 - 2015-03-17 06:15 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-04-10 11:24 - 2015-04-10 11:24 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\janice\Desktop\mbam-setup-2.1.4.1018.exe
2015-04-10 11:24 - 2015-04-10 11:24 - 02686959 _____ (Thisisu) C:\Users\janice\Desktop\JRT.exe
2015-04-10 11:24 - 2015-04-10 11:24 - 02217984 _____ () C:\Users\janice\Desktop\adwcleaner_4.201.exe
2015-04-10 11:23 - 2015-04-14 13:04 - 01135616 _____ (Farbar) C:\Users\janice\Desktop\FRST.exe
2015-04-10 11:22 - 2015-04-10 11:23 - 16849496 _____ () C:\Users\janice\Desktop\RogueKiller.exe
2015-04-09 15:31 - 2015-04-10 12:54 - 00035064 _____ () C:\Windows\system32\Drivers\TrueSight.sys
2015-04-09 15:31 - 2015-04-09 15:38 - 00000000 ____D () C:\ProgramData\RogueKiller
2015-04-09 15:28 - 2015-04-09 15:28 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-CFO-HP-Windows-7-Professional-(32-bit).dat
2015-04-09 15:28 - 2015-04-09 15:28 - 00000000 ____D () C:\RegBackup
2015-04-09 15:22 - 2015-04-09 15:26 - 00000000 ____D () C:\KVRT_Data
2015-04-09 15:16 - 2015-04-14 13:04 - 00000000 ____D () C:\FRST
2015-04-09 14:46 - 2015-04-09 17:12 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-04-09 14:44 - 2015-03-17 06:15 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-04-09 14:24 - 2015-04-09 14:25 - 00000000 ____D () C:\ProgramData\Oracle
2015-04-09 14:24 - 2015-04-09 14:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-04-09 14:24 - 2015-04-09 14:24 - 00000000 ____D () C:\Program Files\Common Files\Java
2015-04-09 14:24 - 2014-09-04 14:04 - 00867240 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2015-04-09 14:24 - 2014-09-04 14:04 - 00789416 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2015-04-09 14:11 - 2015-04-09 14:11 - 01528128 _____ (LogMeIn, Inc.) C:\Users\janice\Downloads\Support-LogMeInRescue (6).exe
2015-04-09 14:11 - 2015-04-09 14:11 - 00000000 ____D () C:\Users\janice\AppData\Local\LogMeIn Rescue Applet
2015-04-08 12:19 - 2015-04-08 12:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FMAudit Onsite
2015-04-08 12:17 - 2015-04-08 12:17 - 01528128 _____ (LogMeIn, Inc.) C:\Users\janice\Downloads\Support-LogMeInRescue (5).exe
2015-04-08 10:17 - 2015-04-08 10:17 - 00000806 _____ () C:\Users\janice\Downloads\OpenInvList_------------6339.csv
2015-04-08 03:00 - 2015-04-08 03:00 - 00000000 ___SD () C:\Windows\system32\GWX
2015-04-02 14:11 - 2015-04-02 14:11 - 00001131 _____ () C:\Users\janice\Desktop\Amazon Music.lnk
2015-04-02 13:56 - 2015-04-02 13:59 - 40776304 _____ (Amazon) C:\Users\janice\Downloads\AmazonMusicInstaller.exe
2015-03-31 11:31 - 2015-03-31 11:31 - 00023690 _____ () C:\Users\janice\Downloads\Dover Municipal Court Graph (1).xlsx
2015-03-31 11:31 - 2015-03-31 11:31 - 00022194 _____ () C:\Users\janice\Downloads\Dover Municipal Court Graph.xlsx
2015-03-30 11:30 - 2015-03-30 11:30 - 00022801 _____ () C:\Users\janice\Downloads\Fixed Asset Report (1).xlsx
2015-03-27 08:59 - 2015-04-14 12:48 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-27 08:59 - 2015-03-27 09:48 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-03-25 14:24 - 2015-03-27 12:59 - 00000000 ___RD () C:\Users\janice\Desktop\Purchase Orders
2015-03-25 09:22 - 2015-03-10 23:30 - 00623616 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-03-25 09:22 - 2015-03-10 23:30 - 00534528 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-03-25 09:22 - 2015-03-10 23:29 - 00818176 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-03-25 09:22 - 2015-03-10 23:29 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-03-25 09:22 - 2015-03-10 23:29 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-03-25 09:22 - 2015-03-10 23:29 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-03-25 09:22 - 2015-03-10 23:29 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-03-25 09:22 - 2015-03-10 23:26 - 00892928 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-03-24 14:38 - 2015-03-24 14:38 - 00007168 _____ () C:\Users\janice\Downloads\12010357 (2).xls
2015-03-24 12:46 - 2015-03-24 12:46 - 01528128 _____ (LogMeIn, Inc.) C:\Users\janice\Downloads\Support-LogMeInRescue (4).exe
2015-03-24 12:10 - 2015-03-24 12:10 - 00017643 _____ () C:\Users\janice\Downloads\Time Sheets, PTO 3-8-15 to 3-21-15.xlsx
2015-03-23 11:13 - 2015-03-23 11:13 - 00013160 _____ () C:\Users\janice\Downloads\RVRSA Flow chart.xlsx
2015-03-17 11:20 - 2015-04-08 12:19 - 00000000 ____D () C:\Program Files\FMAuditOnsite
2015-03-17 11:16 - 2015-03-17 11:16 - 01528128 _____ (LogMeIn, Inc.) C:\Users\janice\Downloads\Support-LogMeInRescue (3).exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-14 12:52 - 2011-10-14 16:28 - 00000886 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-14 12:48 - 2014-09-08 14:31 - 00000000 ____D () C:\ProgramData\LogMeIn
2015-04-14 03:25 - 2009-07-14 00:34 - 00021680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-14 03:25 - 2009-07-14 00:34 - 00021680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-14 00:46 - 2011-05-26 15:38 - 01852350 _____ () C:\Windows\WindowsUpdate.log
2015-04-13 14:52 - 2011-10-14 16:28 - 00000882 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-13 11:42 - 2011-05-27 18:36 - 00000000 ____D () C:\Users\janice\AppData\Roaming\Malwarebytes
2015-04-13 10:07 - 2009-07-25 08:54 - 00782510 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-13 09:32 - 2009-07-13 22:37 - 00000000 __RHD () C:\Users\Default
2015-04-13 09:32 - 2009-07-13 22:37 - 00000000 ___RD () C:\Users\Public
2015-04-13 09:28 - 2014-09-02 10:04 - 00000000 ___RD () C:\Users\janice\Dropbox
2015-04-13 09:28 - 2014-09-02 10:00 - 00000000 ____D () C:\Users\janice\AppData\Roaming\Dropbox
2015-04-13 09:28 - 2014-03-26 09:19 - 00000000 ____D () C:\Users\janice\AppData\Local\CrashDumps
2015-04-13 09:27 - 2014-12-04 16:50 - 00000000 ____D () C:\temp
2015-04-13 09:26 - 2011-05-26 15:44 - 00000000 ____D () C:\ProgramData\HPQLOG
2015-04-13 09:26 - 2009-07-13 22:04 - 00000215 _____ () C:\Windows\system.ini
2015-04-13 09:25 - 2009-07-14 00:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-13 09:24 - 2011-05-26 16:08 - 00899166 _____ () C:\Windows\PFRO.log
2015-04-13 09:24 - 2009-07-14 00:39 - 00092149 _____ () C:\Windows\setupact.log
2015-04-13 09:23 - 2011-05-26 16:36 - 00000000 ____D () C:\Users\janice
2015-04-13 08:55 - 2011-05-28 07:41 - 00000000 ____D () C:\ProgramData\AVAST Software
2015-04-13 08:44 - 2011-05-27 18:45 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird
2015-04-10 15:25 - 2009-07-13 22:04 - 00000635 _____ () C:\Windows\win.ini
2015-04-10 12:48 - 2011-05-27 18:36 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-04-10 12:33 - 2014-05-21 13:18 - 00000000 ____D () C:\AdwCleaner
2015-04-10 12:22 - 2014-09-02 10:04 - 00000000 ____D () C:\Users\janice\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-04-10 12:19 - 2011-05-27 18:36 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2015-04-10 12:19 - 2009-07-25 09:42 - 00000000 ____D () C:\Windows\Panther
2015-04-10 12:15 - 2014-05-21 09:32 - 00000000 ____D () C:\Users\janice\AppData\Local\com
2015-04-09 14:31 - 2011-10-14 16:28 - 00000000 ____D () C:\Program Files\Google
2015-04-09 14:25 - 2014-09-04 14:04 - 00000000 ____D () C:\Program Files\Java
2015-04-09 14:24 - 2014-09-04 14:04 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2015-04-09 14:21 - 2014-03-10 10:49 - 00000000 ____D () C:\RLDATA
2015-04-09 14:17 - 2011-10-14 16:28 - 00000000 ____D () C:\Users\janice\AppData\Local\Google
2015-04-09 14:17 - 2011-10-14 16:28 - 00000000 ____D () C:\ProgramData\Google
2015-04-08 16:30 - 2015-03-02 17:30 - 00000000 ___RD () C:\Users\janice\Desktop\Daily
2015-04-08 15:41 - 2015-01-14 10:45 - 00000000 ____D () C:\Users\janice\AppData\Roaming\Xerox
2015-04-08 03:00 - 2011-05-26 15:44 - 00000000 ____D () C:\ProgramData\PDFC
2015-04-07 10:10 - 2014-03-10 10:49 - 00000000 ____D () C:\RLEMAIL
2015-04-02 16:37 - 2014-07-22 13:15 - 00000000 ___RD () C:\Users\janice\Desktop\KATELYN
2015-03-31 14:31 - 2015-01-14 10:41 - 00000000 ____D () C:\Xerox_Scans
2015-03-30 12:56 - 2013-10-31 15:20 - 00000000 ____D () C:\Users\janice\Documents\Outlook Files
2015-03-27 09:48 - 2011-06-06 12:16 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-03-26 03:02 - 2014-12-10 16:34 - 00000000 ____D () C:\Windows\system32\appraiser
2015-03-26 03:02 - 2014-05-06 03:00 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-03-19 03:22 - 2009-07-13 22:37 - 00000000 ____D () C:\Windows\Microsoft.NET

==================== Files in the root of some directories =======

2015-03-09 03:20 - 2012-10-05 04:14 - 0003774 _____ () C:\Program Files\desktop.ico
2014-01-30 14:31 - 2014-01-30 14:31 - 0000140 _____ () C:\Users\janice\AppData\Roaming\bibstats
2014-03-13 12:10 - 2014-03-24 10:10 - 0000080 _____ () C:\Users\janice\AppData\Roaming\WB.CFG
2012-02-24 12:36 - 2012-02-24 12:36 - 0000316 _____ () C:\ProgramData\hpzinstall.log

Some content of TEMP:
====================
C:\Users\janice\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmppsdxjc.dll

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-04-07 11:57

==================== End Of Log ============================

Eric Witzling · Apr 14, 2015

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 13-04-2015
Ran by janice at 2015-04-14 13:05:36
Running from C:\Users\janice\Desktop
Boot Mode: Normal
==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

32 Bit HP CIO Components Installer (Version: 8.1.4 - Hewlett-Packard) Hidden
ACH Origination Application (Version: 1.3.0.37 - Information Technology Inc.) Hidden
ActiveCheck component for HP Active Support Library (Version: 3.0.0.1 - Hewlett-Packard) Hidden
Adobe AIR (HKLM\...\Adobe AIR) (Version: 3.0.0.4080 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 17 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 17.0.0.134 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Amazon Music (HKU\S-1-5-21-1614596209-2777662679-913267390-1001\...\Amazon Amazon Music) (Version: 3.8.1.754 - Amazon Services LLC)
Apple Application Support (HKLM\...\{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}) (Version: 2.3.4 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{E14ADE0E-75F3-4A46-87E5-26692DD626EC}) (Version: 6.1.0.13 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ARO 2013 (HKLM\...\ARO 2013_is1) (Version: 8.0 - Support.com)
Avast Free Antivirus (HKLM\...\Avast) (Version: 10.2.2215 - AVAST Software)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
Centra Client (HKLM\...\CentraClient) (Version: - )
Cisco WebEx Meetings (HKU\S-1-5-21-1614596209-2777662679-913267390-1001\...\ActiveTouchMeetingClient) (Version: - Cisco WebEx LLC)
Citrix Online Launcher (HKLM\...\{F17C3DC2-2ACA-4B0E-BDBF-ACE61B14E7CD}) (Version: 1.0.183 - Citrix)
Device Access Manager for HP ProtectTools (HKLM\...\{55B52830-024A-443E-AF61-61E1E71AFA1B}) (Version: 5.0.1.8 - Hewlett-Packard)
Drive Encryption for HP ProtectTools (HKLM\...\Drive Encryption) (Version: 5.0.6.0 - Hewlett-Packard)
Drive Encryption for HP ProtectTools (Version: 5.0.6.0 - Hewlett-Packard) Hidden
Dropbox (HKU\S-1-5-21-1614596209-2777662679-913267390-1001\...\Dropbox) (Version: 3.4.3 - Dropbox, Inc.)
Epson Copy Utility 3.5 (HKLM\...\{AA72FB28-73B4-49E5-B6B4-E78F44BBD0AD}) (Version: 3.5.0.0 - )
Epson Event Manager (HKLM\...\{8F01524C-0676-4CC1-B4AE-64753C723391}) (Version: 3.01.0005 - Seiko Epson Corporation)
EPSON Scan (HKLM\...\EPSON Scanner) (Version: - Seiko Epson Corporation)
EPSON Scan PDF EXtensions (HKLM\...\{F9956472-6E16-4F83-BF9A-F887EF4A45B7}) (Version: 1.03.0000 - SEIKO EPSON Corp.)
EPSON WorkForce GT-1500 Scanner Driver Update version 3.0.2.0 (HKLM\...\ScannerDriverUpdateEPSON WorkForce GT-1500_is1) (Version: 3.0.2.0 - Epson America Inc.)
Express-O-Pay (HKLM\...\{11AC9AE1-0A46-11D4-8A7C-00104B11E715}) (Version: - )
File Sanitizer For HP ProtectTools (HKLM\...\{6D6ADF03-B257-4EA5-BBC1-1D145AF8D514}) (Version: 5.0.1.4 - Hewlett-Packard)
FMAudit Onsite (HKLM\...\FMAudit Onsite3.1.0.50311) (Version: 3.1.0.50311 - FMAudit (ECi))
Fund Accounting 1.83 (HKU\S-1-5-21-1614596209-2777662679-913267390-1001\...\Fund Accounting) (Version: 1.83 - Municipal Software)
Google Chrome (HKLM\...\Google Chrome) (Version: 41.0.2272.118 - Google Inc.)
Google Drive (HKLM\...\{6C36881B-0E51-4231-9D02-BF2149664D34}) (Version: 1.20.8672.3137 - Google, Inc.)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.26.9 - Google Inc.) Hidden
Google+ Auto Backup (HKLM\...\{AF71B42D-3821-4376-9974-84E507F88EC0}) (Version: 1.0.20.80 - Google)
GoToMeeting 7.1.3.2457 (HKU\S-1-5-21-1614596209-2777662679-913267390-1001\...\GoToMeeting) (Version: 7.1.3.2457 - CitrixOnline)
HP LaserJet 400 MFP M425 (HKLM\...\{568705AA-DD8A-4134-B8B9-9609721FBBCE}) (Version: 5.0.12200.1138 - Hewlett-Packard)
HP LaserJet P3010 Series PCL 6 (HKLM\...\HP LaserJet P3010 Series PCL 6) (Version: 10/09/2008 61.083.41.03 - HP)
HP LaserJet P3010 Series Screen Fonts (HKLM\...\{CB71331A-9DCE-4A0D-B527-FD96BD5CFC4A}) (Version: 2.0.0.0 - Hewlett Packard, Co.)
HP LaserJet P3010 Series User Guide (HKLM\...\{06C4BA69-5210-4707-B5BE-E26D487E1854}) (Version: 1.0.0.0 - Hewlett Packard, Co.)
HP ProtectTools Security Manager (HKLM\...\HPProtectTools) (Version: 5.08.717 - Hewlett-Packard Company)
HP SkyRoom (HKLM\...\InstallShield_{0DEDF0B4-7737-447D-A705-A8E1831E3FCB}) (Version: 1.1.6.5201. - Hewlett-Packard)
HP Update (HKLM\...\{6F1C00D2-25C2-4CBA-8126-AE9A6E2E9CD5}) (Version: 5.003.003.001 - Hewlett-Packard)
HPAsset component for HP Active Support Library (Version: 3.0.0.3 - Hewlett-Packard) Hidden
hpbDSService (Version: 002.002.07399 - Hewlett-Packard) Hidden
hpbM425DSService (Version: 001.001.05874 - Hewlett-Packard) Hidden
HPDXP (Version: 3.0.26.11 - HP) Hidden
HPLaserJet400MFP-M425_HelpLearnCenter_SI (HKLM\...\{55D8D1AB-94C2-498F-A165-608B834A30EA}) (Version: 1.01.0000 - Hewlett-Packard)
HPLJDXPHelper (Version: 020.021.004 - HP) Hidden
HPLJUTCore (Version: 004.005.0001 - HP) Hidden
HPLJUTM425 (Version: 3.00.0003 - HP) Hidden
hppFaxDrvM425 (Version: 003.000.00002 - Hewlett-Packard) Hidden
hppLaserJetService (Version: 009.027.00856 - Hewlett-Packard) Hidden
hppM425LaserJetService (Version: 001.019.00639 - Hewlett-Packard) Hidden
hppSendFaxM425 (Version: 003.000.00002 - Hewlett-Packard) Hidden
hpStatusAlerts (Version: 050.037.00142 - Hewlett Packard) Hidden
hpStatusAlertsM425 (Version: 050.034.00131 - Hewlett-Packard) Hidden
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: - Intel Corporation)
Intel® Active Management Technology (HKLM\...\MESOL) (Version: - Intel Corporation)
IP Office Admin Suite (HKLM\...\{30FBFB1E-0237-469E-930B-0DE4C286987D}) (Version: 9.0.300.941 - Avaya)
ITSupport247- DPMA (HKLM\...\SAAZOD) (Version: 5.2.7 - Continuum Managed Services LLC)
iTunes (HKLM\...\{91FD46D2-4FB7-4A51-8637-556E1BE1DB7C}) (Version: 11.0.4.4 - Apple Inc.)
Java 8 Update 40 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218040F0}) (Version: 8.0.400 - Oracle Corporation)
Java Card Security for HP ProtectTools (HKLM\...\{F4477CC0-7293-414A-93BC-20EE897A80F0}) (Version: 5.0.4.1 - Hewlett-Packard)
join.me (HKU\S-1-5-21-1614596209-2777662679-913267390-1001\...\JoinMe) (Version: 1.20.0.116 - LogMeIn, Inc.)
LJDXPHelperUI (Version: 020.021.004 - HP) Hidden
LogMeIn (HKLM\...\{A8E20B99-B1A2-4FC0-B38A-A255033D339A}) (Version: 4.1.5022 - LogMeIn, Inc.)
Malwarebytes Anti-Malware version 1.75.0.1300 (HKLM\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)
Malwarebytes Anti-Malware version 2.1.4.1018 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.4.1018 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Home and Business 2010 (HKLM\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.8 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Thunderbird 14.0 (x86 en-US) (HKLM\...\Mozilla Thunderbird 14.0 (x86 en-US)) (Version: 14.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
PaperPort Image Printer (HKLM\...\{2BC2781A-F7F6-452E-95EB-018A522F1B2C}) (Version: 1.00.0000 - Nuance Communications, Inc.)
PDF Complete Special Edition (HKLM\...\PDF Complete) (Version: 3.5.109 - PDF Complete, Inc)
PDF Reader 2013 (HKLM\...\PDF Reader) (Version: 2013 - PDF Reader)
Personnel & Payroll 2.1 (HKU\S-1-5-21-1614596209-2777662679-913267390-1001\...\Personnel & Payroll) (Version: 2.1 - Municipal Software)
Picasa 3 (HKLM\...\Picasa 3) (Version: 3.9 - Google, Inc.)
PowerTerm 5.4 (HKLM\...\PowerTerm 5.4) (Version: - )
Privacy Manager for HP ProtectTools (HKLM\...\{350F790E-5C32-4B3A-8AAB-B0478BB76D11}) (Version: 5.10.796 - Hewlett-Packard)
Ranger (HKLM\...\Ranger) (Version: 4.2.3.0 - Silver Bullet Technology, Inc.)
Ranger plug-in: Burroughs-SmartPVA v2.0.3.0 (HKLM\...\Ranger Scanner Plug-in: Burroughs-SmartPVA) (Version: 2.0.3.0 - Silver Bullet Technology, Inc.)
RealDownloader (Version: 1.3.1 - RealNetworks, Inc.) Hidden
RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0 - RealNetworks, Inc) Hidden
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5886 - Realtek Semiconductor Corp.)
RealUpgrade 1.1 (Version: 1.1.0 - RealNetworks, Inc.) Hidden
Remote Graphics Receiver (HKLM\...\{16FC3056-90C0-4757-8A68-64D8DA846ADA}) (Version: 5.3.2 - Hewlett-Packard)
Remote Graphics Receiver (Version: 5.3.2 - Hewlett-Packard) Hidden
Remote Graphics Sender (HKLM\...\{2A08C71B-CC60-42EA-8DA2-FE5486E3B20B}) (Version: 5.3.2 - Hewlett-Packard)
Remote Graphics Sender (Version: 5.3.2 - Hewlett-Packard) Hidden
ScanSoft PaperPort 11 (HKLM\...\{DEA18FF6-D84A-4242-9663-692E5BA56805}) (Version: 11.1.0000 - Nuance Communications, Inc.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
SHARP MX/DX Series PCL/PS Printer Driver (HKLM\...\SHARP MX-2300 2700 3500 4500 Series PCL PS Printer Driver) (Version: 1.00.000 - SHARP)
Sharpdesk (HKLM\...\{8664FCE8-F91A-42BC-927C-AA318185E5EA}) (Version: 3.3 - SHARP CORPORATION)
SonicWALL Global VPN Client (HKLM\...\{40624553-811E-400E-B69B-38D8926A66BD}) (Version: 4.2.6 - SonicWALL)
Theft Recovery (HKLM\...\InstallShield_{33C9F24B-1D92-4632-A915-81E3BB1D5D6B}) (Version: 5.1.0.19 - Hewlett-Packard)
Theft Recovery (Version: 5.1.0.19 - Hewlett-Packard) Hidden
Web Components (HKLM\...\{03B13AF8-9625-478A-AF0E-205337B9415A}_is1) (Version: - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-1614596209-2777662679-913267390-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\janice\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1614596209-2777662679-913267390-1001_Classes\CLSID\{53B5243F-8302-4DAD-BE8F-1D0665E8225E}\InprocServer32 -> C:\Program Files\HP\Common\FWUpdateEDO3.dll (Hewlett-Packard Company)
CustomCLSID: HKU\S-1-5-21-1614596209-2777662679-913267390-1001_Classes\CLSID\{6d05bf60-3eaf-4a97-87c5-10cce505435b}\localserver32 -> C:\Users\janice\AppData\Local\Temp\{9c0ba3c1-2b67-45eb-bf69-bed9658d28d2}\IDriver.NonElevated.exe No (the data entry has 5 more characters).
CustomCLSID: HKU\S-1-5-21-1614596209-2777662679-913267390-1001_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Program Files\Citrix\GoToMeeting\1133\G2MOutlookAddin.dll (Citrix Online, a division of Citrix Systems, Inc.)
CustomCLSID: HKU\S-1-5-21-1614596209-2777662679-913267390-1001_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1614596209-2777662679-913267390-1001_Classes\CLSID\{EEA0F5AD-B66A-25DD-2023-476B84882EB5}\InprocServer32 -> C:\Windows\system32\ole32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1614596209-2777662679-913267390-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1614596209-2777662679-913267390-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1614596209-2777662679-913267390-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1614596209-2777662679-913267390-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1614596209-2777662679-913267390-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1614596209-2777662679-913267390-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1614596209-2777662679-913267390-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1614596209-2777662679-913267390-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\janice\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)

==================== Restore Points =========================

26-03-2015 03:00:20 Windows Update
31-03-2015 09:01:29 Windows Update
07-04-2015 09:07:44 Windows Update
08-04-2015 03:00:26 Windows Update
13-04-2015 08:44:26 avast! Pro Antivirus Setup
13-04-2015 08:56:52 avast! antivirus system restore point

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 22:04 - 2015-04-13 09:26 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {063AEBF6-278F-4736-9D11-0431309CFACA} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {07F792C9-5775-41F4-AD1B-CA93EAEE1EB5} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {1E5912E6-604E-4AD3-93A0-F0A3ED0CD094} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-12-16] (Google Inc.)
Task: {234DAD34-4758-420E-9430-90741DFD2F54} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {357F2CEC-3E73-4300-A560-D20204CC6EE6} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {38BA6EAC-5020-4EE0-BB6C-1F52EAD115FB} - System32\Tasks\Hewlett-Packard\HP Assistant\PC Health Analysis => C:\Program Files\Hewlett-Packard\HP Support Framework\HPSF.exe [2009-11-10] (Hewlett-Packard)
Task: {601D3505-2BD7-481C-80C6-58CB733ABF63} - System32\Tasks\Hewlett-Packard\HP Assistant\PC Tuneup => C:\Program Files\Hewlett-Packard\HP Support Framework\HPSF.exe [2009-11-10] (Hewlett-Packard)
Task: {7306FF23-269A-4084-AA6C-437DBD652AE3} - System32\Tasks\{404A01BB-5486-4DF4-BFBC-2B7A9BE23F02} => pcalua.exe -a C:\Users\janice\Desktop\msihelp(3).exe -d C:\Users\janice\Desktop
Task: {78B0935B-7713-43CA-B3A9-AC6031831825} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1614596209-2777662679-913267390-1001 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2013-03-06] (RealNetworks, Inc.)
Task: {791A0856-A565-4E7E-AB5B-3DD9029FC54B} - System32\Tasks\{07FC2DD9-E393-44DB-BC29-855E3AE179E4} => pcalua.exe -a C:\Users\janice\Desktop\msihelp.exe -d C:\Users\janice\Desktop
Task: {8755D5D3-7558-45C5-BA3F-5A742A25F890} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1614596209-2777662679-913267390-1001 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2013-03-06] (RealNetworks, Inc.)
Task: {9B1CA709-C89E-4465-9529-007B141598BC} - System32\Tasks\HPLJCustParticipation => C:\Program Files\HP\HPLJUT\HPLJUTSCH.exe [2012-06-15] (Hewlett Packard)
Task: {A4078892-EDE7-4D11-9F34-37994E31FC83} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {B1D4F1ED-3794-4BB8-BC65-51A7A236B857} - System32\Tasks\Onsite_Watchdog => C:\Program Files\FMAuditOnsite\watchdog.bat [2015-03-11] ()
Task: {B636CBA4-0315-431F-9907-65C391EB3124} - System32\Tasks\{6FF187BE-1AEB-47AE-924C-0B6BA9D7086E} => pcalua.exe -a "C:\Program Files\Mozilla Thunderbird\uninstall\helper.exe" -d "C:\Program Files\Mozilla Thunderbird" -c /UpdateShortcutAppUserModelIds
Task: {DA18705A-3FD1-451F-90FE-B4E129A04D51} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-12-16] (Google Inc.)
Task: {DF7D764E-4A98-42A5-B5F7-64476B8E9082} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {E4CC7B56-2B5D-4224-BF11-FA57650C144D} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-04-13] (Avast Software s.r.o.)
Task: {F02D2948-DC35-4A0B-852B-52F8BF3C25B2} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-24] (Microsoft Corporation)
Task: {F0C05FCF-47ED-4580-AA58-29452DE099E2} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-03-27] (Adobe Systems Incorporated)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2015-04-13 09:00 - 2015-04-13 09:00 - 00104400 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2015-04-13 09:00 - 2015-04-13 09:00 - 00081728 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2015-04-13 09:00 - 2015-04-13 09:00 - 02925568 _____ () C:\Program Files\AVAST Software\Avast\defs\15041300\algo.dll
2015-04-13 13:27 - 2015-04-13 13:27 - 02925568 _____ () C:\Program Files\AVAST Software\Avast\defs\15041301\algo.dll
2015-04-14 05:29 - 2015-04-14 05:29 - 02925568 _____ () C:\Program Files\AVAST Software\Avast\defs\15041400\algo.dll
2013-04-21 21:44 - 2013-04-21 21:44 - 00087952 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2013-04-21 21:44 - 2013-04-21 21:44 - 01242952 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2009-07-13 17:03 - 2009-07-13 21:15 - 00364544 _____ () C:\Windows\system32\msjetoledb40.dll
2015-03-11 13:13 - 2015-03-11 13:12 - 00054784 _____ () C:\Program Files\FMAuditOnsite\Web\Bin\Toshiba.Tasks.dll
2015-04-08 12:19 - 2015-04-08 12:19 - 00353280 _____ () C:\Windows\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\root\6126b2ab\a6dcea3f\assembly\dl3\bac4bcdf\801f979f_1e5cd001\Fmao_compiled.DLL
2009-06-19 12:21 - 2009-06-19 12:21 - 01249280 _____ () C:\Program Files\Hewlett-Packard\HP SkyRoom\ice32.dll
2009-06-19 12:21 - 2009-06-19 12:21 - 00159744 _____ () C:\Program Files\Hewlett-Packard\HP SkyRoom\iceutil32.dll
2009-06-19 12:21 - 2009-06-19 12:21 - 00065536 _____ () C:\Program Files\Hewlett-Packard\HP SkyRoom\bzip2.dll
2009-06-19 12:21 - 2009-06-19 12:21 - 00167936 _____ () C:\Program Files\Hewlett-Packard\HP SkyRoom\IceSSL32.dll
2013-03-06 02:21 - 2013-03-06 02:21 - 00039056 _____ () C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
2011-05-26 15:38 - 2009-07-24 07:29 - 00077824 _____ () C:\Program Files\Common Files\Intel\Privacy Icon\UNS\DTMessageLib.dll
2011-05-26 15:46 - 2009-07-24 15:10 - 02199552 ____R () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\QtCore4.dll
2011-05-26 15:46 - 2009-07-24 15:10 - 08024064 ____R () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\QtGui4.dll
2011-05-26 15:46 - 2008-01-09 14:08 - 01245184 ____R () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\ice32.dll
2011-05-26 15:46 - 2008-01-09 14:10 - 00159744 ____R () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\iceutil32.dll
2011-05-26 15:46 - 2008-01-09 14:06 - 00065536 ____R () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\bzip2.dll
2011-05-26 15:46 - 2008-01-09 14:10 - 00167936 ____R () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\IceSSL32.dll
2011-05-26 15:47 - 2009-06-19 12:21 - 01249280 _____ () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Authentication\ice32.dll
2011-05-26 15:47 - 2009-06-19 12:21 - 00159744 _____ () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Authentication\iceutil32.dll
2011-05-26 15:47 - 2009-06-19 12:21 - 00065536 _____ () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Authentication\bzip2.dll
2011-05-26 15:47 - 2009-06-19 12:21 - 00167936 _____ () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Authentication\IceSSL32.dll
2011-05-26 15:47 - 2009-06-19 12:21 - 01249280 _____ () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Lens\ice32.dll
2011-05-26 15:47 - 2009-06-19 12:21 - 00159744 _____ () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Lens\iceutil32.dll
2011-05-26 15:47 - 2009-06-19 12:21 - 00065536 _____ () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Lens\bzip2.dll
2011-05-26 15:47 - 2009-06-19 12:21 - 00167936 _____ () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Lens\IceSSL32.dll
2011-05-26 15:47 - 2009-06-19 12:21 - 01249280 _____ () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Licensing\ice32.dll
2011-05-26 15:47 - 2009-06-19 12:21 - 00159744 _____ () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Licensing\iceutil32.dll
2011-05-26 15:47 - 2009-06-19 12:21 - 00065536 _____ () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Licensing\bzip2.dll
2011-05-26 15:47 - 2009-06-19 12:21 - 00167936 _____ () c:\Program Files\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Licensing\IceSSL32.dll
2015-04-13 09:00 - 2015-04-13 09:00 - 40540672 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2015-04-13 09:27 - 2015-04-13 09:27 - 00043008 _____ () c:\users\janice\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmppsdxjc.dll
2015-03-04 17:45 - 2015-03-04 17:45 - 00750080 _____ () C:\Users\janice\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-03-04 17:45 - 2015-03-04 17:45 - 00047616 _____ () C:\Users\janice\AppData\Roaming\Dropbox\bin\libEGL.dll
2015-03-04 17:45 - 2015-03-04 17:45 - 00865280 _____ () C:\Users\janice\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2015-03-04 17:45 - 2015-03-04 17:45 - 00200704 _____ () C:\Users\janice\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2015-04-13 09:27 - 2015-04-13 09:27 - 00098816 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\win32api.pyd
2015-04-13 09:27 - 2015-04-13 09:27 - 00110080 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\pywintypes27.dll
2015-04-13 09:27 - 2015-04-13 09:27 - 00364544 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\pythoncom27.dll
2015-04-13 09:27 - 2015-04-13 09:27 - 00045568 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\_socket.pyd
2015-04-13 09:27 - 2015-04-13 09:27 - 01161216 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\_ssl.pyd
2015-04-13 09:27 - 2015-04-13 09:27 - 00320512 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\win32com.shell.shell.pyd
2015-04-13 09:27 - 2015-04-13 09:27 - 00713216 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\_hashlib.pyd
2015-04-13 09:27 - 2015-04-13 09:27 - 01175040 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\wx._core_.pyd
2015-04-13 09:27 - 2015-04-13 09:27 - 00805888 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\wx._gdi_.pyd
2015-04-13 09:27 - 2015-04-13 09:27 - 00811008 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\wx._windows_.pyd
2015-04-13 09:27 - 2015-04-13 09:27 - 01062400 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\wx._controls_.pyd
2015-04-13 09:27 - 2015-04-13 09:27 - 00735232 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\wx._misc_.pyd
2015-04-13 09:27 - 2015-04-13 09:27 - 00682496 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\pysqlite2._sqlite.pyd
2015-04-13 09:27 - 2015-04-13 09:27 - 00128512 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\_elementtree.pyd
2015-04-13 09:27 - 2015-04-13 09:27 - 00127488 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\pyexpat.pyd
2015-04-13 09:27 - 2015-04-13 09:27 - 00087552 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\_ctypes.pyd
2015-04-13 09:27 - 2015-04-13 09:27 - 00119808 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\win32file.pyd
2015-04-13 09:27 - 2015-04-13 09:27 - 00108544 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\win32security.pyd
2015-04-13 09:27 - 2015-04-13 09:27 - 00007168 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\hashobjs_ext.pyd
2015-04-13 09:27 - 2015-04-13 09:27 - 00167936 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\win32gui.pyd
2015-04-13 09:27 - 2015-04-13 09:27 - 00018432 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\win32event.pyd
2015-04-13 09:27 - 2015-04-13 09:27 - 00038912 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\win32inet.pyd
2015-04-13 09:27 - 2015-04-13 09:27 - 00011264 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\win32crypt.pyd
2015-04-13 09:27 - 2015-04-13 09:27 - 00070656 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\wx._html2.pyd
2015-04-13 09:27 - 2015-04-13 09:27 - 00027136 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\_multiprocessing.pyd
2015-04-13 09:27 - 2015-04-13 09:27 - 00020480 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\_yappi.pyd
2015-04-13 09:27 - 2015-04-13 09:27 - 00035840 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\win32process.pyd
2015-04-13 09:27 - 2015-04-13 09:27 - 00686080 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\unicodedata.pyd
2015-04-13 09:27 - 2015-04-13 09:27 - 00122368 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\wx._wizard.pyd
2015-04-13 09:27 - 2015-04-13 09:27 - 00024064 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\win32pipe.pyd
2015-04-13 09:27 - 2015-04-13 09:27 - 00010240 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\select.pyd
2015-04-13 09:27 - 2015-04-13 09:27 - 00025600 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\win32pdh.pyd
2015-04-13 09:27 - 2015-04-13 09:27 - 00525640 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\windows._lib_cacheinvalidation.pyd
2015-04-13 09:27 - 2015-04-13 09:27 - 00017408 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\win32profile.pyd
2015-04-13 09:27 - 2015-04-13 09:27 - 00022528 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\win32ts.pyd
2015-04-13 09:27 - 2015-04-13 09:27 - 00078336 _____ () C:\Users\janice\AppData\Local\Temp\_MEI42122\wx._animate.pyd
2015-04-02 09:02 - 2015-03-30 17:07 - 01174856 _____ () C:\Program Files\Google\Chrome\Application\41.0.2272.118\libglesv2.dll
2015-04-02 09:02 - 2015-03-30 17:07 - 00080200 _____ () C:\Program Files\Google\Chrome\Application\41.0.2272.118\libegl.dll
2015-04-02 09:02 - 2015-03-30 17:07 - 09279304 _____ () C:\Program Files\Google\Chrome\Application\41.0.2272.118\pdf.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:373E1720
AlternateDataStreams: C:\Users\janice\Downloads\noname (1).eml:OECustomProperty
AlternateDataStreams: C:\Users\janice\Downloads\noname.eml:OECustomProperty

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\atashost => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\LMIRescue_64eaaef1-33c8-4935-b520-fc5098fb7598 => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SAAZappr => "imagepath"=""C:\PROGRA~1\SAAZOD\zRealTime\SAAZappr.exe" SAAZappr"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SAAZappr => "ObjectName"="LocalSystem"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SAAZappr => "Start"="2"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SAAZappr => "type"="110"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SAAZapsc => "imagepath"=""C:\PROGRA~1\SAAZOD\zRealTime\SAAZapsc.exe" SAAZapsc"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SAAZapsc => "ObjectName"="LocalSystem"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SAAZapsc => "Start"="2"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SAAZapsc => "type"="110"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1614596209-2777662679-913267390-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\janice\AppData\Roaming\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
DNS Servers: 151.198.0.39 - 204.117.214.10

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

==================== Accounts: =============================

Administrator (S-1-5-21-1614596209-2777662679-913267390-500 - Administrator - Disabled)
cfo (S-1-5-21-1614596209-2777662679-913267390-1047 - Administrator - Enabled) => C:\Users\cfo
Guest (S-1-5-21-1614596209-2777662679-913267390-501 - Limited - Disabled)
janice (S-1-5-21-1614596209-2777662679-913267390-1001 - Administrator - Enabled) => C:\Users\janice
patty (S-1-5-21-1614596209-2777662679-913267390-1002 - Administrator - Enabled) => C:\Users\patty
Xerox (S-1-5-21-1614596209-2777662679-913267390-1151 - Administrator - Enabled) => C:\Users\Xerox

==================== Faulty Device Manager Devices =============

Name: SonicWALL Virtual NIC
Description: SonicWALL Virtual NIC
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: SonicWALL
Service: SWVNIC
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: SonicWALL IPsec Driver
Description: SonicWALL IPsec Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: SWIPsec
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: Microsoft Teredo Tunneling Adapter
Description: Microsoft Teredo Tunneling Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: PS/2 Compatible Mouse
Description: PS/2 Compatible Mouse
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

==================== Event log errors: =========================

Application errors:
==================
Error: (04/13/2015 09:28:13 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: IndexTray.exe, version: 3.3.0.784, time stamp: 0x4b1e3bcf
Faulting module name: IndexTray.exe, version: 3.3.0.784, time stamp: 0x4b1e3bcf
Exception code: 0xc0000005
Fault offset: 0x0001d180
Faulting process id: 0xd7c
Faulting application start time: 0xIndexTray.exe0
Faulting application path: IndexTray.exe1
Faulting module path: IndexTray.exe2
Report Id: IndexTray.exe3

Error: (04/13/2015 08:56:50 AM) (Source: VSS) (EventID: 8194) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied.
.
This is often caused by incorrect security settings in either the writer or requestor process.

Operation:
Gathering Writer Data

Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {0fca8b53-f932-46eb-9f31-33c7caccfc26}

Error: (04/13/2015 08:49:02 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: IndexTray.exe, version: 3.3.0.784, time stamp: 0x4b1e3bcf
Faulting module name: IndexTray.exe, version: 3.3.0.784, time stamp: 0x4b1e3bcf
Exception code: 0xc0000005
Fault offset: 0x0001d180
Faulting process id: 0x9a4
Faulting application start time: 0xIndexTray.exe0
Faulting application path: IndexTray.exe1
Faulting module path: IndexTray.exe2
Report Id: IndexTray.exe3

Error: (04/13/2015 00:22:24 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: zSmart.exe, version: 1.0.0.3, time stamp: 0x524ff9c3
Faulting module name: ntdll.dll, version: 6.1.7601.18247, time stamp: 0x521ea91c
Exception code: 0xc0000374
Fault offset: 0x000c3873
Faulting process id: 0x155c
Faulting application start time: 0xzSmart.exe0
Faulting application path: zSmart.exe1
Faulting module path: zSmart.exe2
Report Id: zSmart.exe3

Error: (04/10/2015 01:24:06 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: IndexTray.exe, version: 3.3.0.784, time stamp: 0x4b1e3bcf
Faulting module name: IndexTray.exe, version: 3.3.0.784, time stamp: 0x4b1e3bcf
Exception code: 0xc0000005
Fault offset: 0x0001d180
Faulting process id: 0x490
Faulting application start time: 0xIndexTray.exe0
Faulting application path: IndexTray.exe1
Faulting module path: IndexTray.exe2
Report Id: IndexTray.exe3

Error: (04/10/2015 00:42:50 PM) (Source: Windows Installer 3.1) (EventID: 4373) (User: )
Description: WindowsNot enough storage is available to process this command.

System errors:
=============
Error: (04/13/2015 10:04:14 AM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk1\DR1.

Error: (04/13/2015 10:04:13 AM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk1\DR1.

Error: (04/13/2015 10:04:12 AM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk1\DR1.

Error: (04/13/2015 10:04:12 AM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk1\DR1.

Error: (04/13/2015 09:27:39 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Windows Search service failed to start due to the following error:
%%1053

Error: (04/13/2015 09:27:39 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Windows Search service to connect.

Error: (04/13/2015 09:27:39 AM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1053WSearch{9E175B6D-F52A-11D8-B9A5-505054503030}

Error: (04/13/2015 09:27:06 AM) (Source: DCOM) (EventID: 10000) (User: )
Description: "C:\Program Files\Sharp\Sharpdesk\Indexer.exe" -Embedding2{40650C99-8E52-46C6-8F21-3E96B478F87B}

Error: (04/13/2015 09:26:07 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
SWIPsec

Error: (04/13/2015 09:24:54 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 9:24:14 AM on ‎4/‎13/‎2015 was unexpected.

Microsoft Office Sessions:
=========================
Error: (04/13/2015 09:28:13 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: IndexTray.exe3.3.0.7844b1e3bcfIndexTray.exe3.3.0.7844b1e3bcfc00000050001d180d7c01d075ed888908efC:\Program Files\Sharp\Sharpdesk\IndexTray.exeC:\Program Files\Sharp\Sharpdesk\IndexTray.exeeee2cf6f-e1e0-11e4-91ab-d48564168fc1

Error: (04/13/2015 08:56:50 AM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Access is denied.

Operation:
Gathering Writer Data

Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {0fca8b53-f932-46eb-9f31-33c7caccfc26}

Error: (04/13/2015 08:49:02 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: IndexTray.exe3.3.0.7844b1e3bcfIndexTray.exe3.3.0.7844b1e3bcfc00000050001d1809a401d075e828e7f352C:\Program Files\Sharp\Sharpdesk\IndexTray.exeC:\Program Files\Sharp\Sharpdesk\IndexTray.exe75c3fc21-e1db-11e4-914b-d48564168fc1

Error: (04/13/2015 00:22:24 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: zSmart.exe1.0.0.3524ff9c3ntdll.dll6.1.7601.18247521ea91cc0000374000c3873155c01d075a170761161C:\PROGRA~1\SAAZOD\zSmart.exeC:\Windows\SYSTEM32\ntdll.dllaee6e92a-e194-11e4-9065-d48564168fc1

Error: (04/10/2015 01:24:06 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: IndexTray.exe3.3.0.7844b1e3bcfIndexTray.exe3.3.0.7844b1e3bcfc00000050001d18049001d073b320ff20bfC:\Program Files\Sharp\Sharpdesk\IndexTray.exeC:\Program Files\Sharp\Sharpdesk\IndexTray.exe633c1991-dfa6-11e4-9065-d48564168fc1

Error: (04/10/2015 00:42:50 PM) (Source: Windows Installer 3.1) (EventID: 4373) (User: )
Description: WindowsNot enough storage is available to process this command.

==================== Memory info ===========================

Processor: Pentium(R) Dual-Core CPU E5500 @ 2.80GHz
Percentage of memory in use: 43%
Total physical RAM: 3543.25 MB
Available physical RAM: 1992.32 MB
Total Pagefile: 7084.79 MB
Available Pagefile: 4780.61 MB
Total Virtual: 2047.88 MB
Available Virtual: 1911.34 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:139.96 GB) (Free:72.88 GB) NTFS
Drive d: (HP_RECOVERY) (Fixed) (Total:7.08 GB) (Free:0.81 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149.1 GB) (Disk ID: FACCD561)
Partition 1: (Active) - (Size=2 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=140 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=7.1 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Broni · Apr 14, 2015

Download attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST(FRST64) and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

Eric Witzling · Apr 15, 2015

Chrome.exe processes disappeared after running FRST, conhost.exe remained

eight chrome.exe processes returned after a reboot, and the conhosts remain unkillable

-----------------------

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 14-04-2015
Ran by janice at 2015-04-15 04:37:56 Run:1
Running from C:\Users\janice\Desktop
Loaded Profiles: janice (Available profiles: janice & patty & cfo & Xerox)
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1614596209-2777662679-913267390-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:55242;https=127.0.0.1:55242
RemoveProxy:
SearchScopes: HKU\S-1-5-21-1614596209-2777662679-913267390-1001 -> {A11B5998-39F5-42F5-B7DE-C12D15C43B18} URL =
Toolbar: HKU\S-1-5-21-1614596209-2777662679-913267390-1001 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKU\S-1-5-21-1614596209-2777662679-913267390-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
FF Extension: No Name - C:\Users\janice\AppData\Roaming\Mozilla\Firefox\Profiles\4n87uf9r.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8} [Not Found]
FF Extension: No Name - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.0.0.100\IPSFF [Not Found]
FF Extension: No Name - C:\Users\janice\AppData\Roaming\Mozilla\Firefox\Profiles\4n87uf9r.default\extensions\cda2aa03-4bc9-4ec7-9498-460a0930b748@ad411bc8-5385-474c-96ad-ae0bd30853a6.com [Not Found]
S3 catchme; \??\C:\Users\janice\AppData\Local\Temp\catchme.sys [X]
S4 LMIRfsClientNP; No ImagePath
U3 mbr; \??\C:\Users\janice\AppData\Local\Temp\mbr.sys [X]
2015-03-09 03:20 - 2012-10-05 04:14 - 0003774 _____ () C:\Program Files\desktop.ico
2014-01-30 14:31 - 2014-01-30 14:31 - 0000140 _____ () C:\Users\janice\AppData\Roaming\bibstats
2014-03-13 12:10 - 2014-03-24 10:10 - 0000080 _____ () C:\Users\janice\AppData\Roaming\WB.CFG
2012-02-24 12:36 - 2012-02-24 12:36 - 0000316 _____ () C:\ProgramData\hpzinstall.log
C:\Users\janice\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmppsdxjc.dll
AlternateDataStreams: C:\ProgramData\TEMP:373E1720
AlternateDataStreams: C:\Users\janice\Downloads\noname (1).eml:OECustomProperty
AlternateDataStreams: C:\Users\janice\Downloads\noname.eml:OECustomProperty

*****************

"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
"HKU\S-1-5-21-1614596209-2777662679-913267390-1001\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value deleted successfully.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.

========= RemoveProxy: =========

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value deleted successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value deleted successfully.
HKU\S-1-5-21-1614596209-2777662679-913267390-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value deleted successfully.
HKU\S-1-5-21-1614596209-2777662679-913267390-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value deleted successfully.

========= End of RemoveProxy: =========

"HKU\S-1-5-21-1614596209-2777662679-913267390-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{A11B5998-39F5-42F5-B7DE-C12D15C43B18}" => Key deleted successfully.
HKCR\CLSID\{A11B5998-39F5-42F5-B7DE-C12D15C43B18} => Key not found.
HKU\S-1-5-21-1614596209-2777662679-913267390-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => value deleted successfully.
HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Key not found.
HKU\S-1-5-21-1614596209-2777662679-913267390-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => value deleted successfully.
"HKCR\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}" => Key deleted successfully.
C:\Users\janice\AppData\Roaming\Mozilla\Firefox\Profiles\4n87uf9r.default\extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8} => not found.
C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.0.0.100\IPSFF => not found.
C:\Users\janice\AppData\Roaming\Mozilla\Firefox\Profiles\4n87uf9r.default\extensions\cda2aa03-4bc9-4ec7-9498-460a0930b748@ad411bc8-5385-474c-96ad-ae0bd30853a6.com => not found.
catchme => Service deleted successfully.
LMIRfsClientNP => Service deleted successfully.
mbr => Service deleted successfully.
C:\Program Files\desktop.ico => Moved successfully.
C:\Users\janice\AppData\Roaming\bibstats => Moved successfully.
C:\Users\janice\AppData\Roaming\WB.CFG => Moved successfully.
C:\ProgramData\hpzinstall.log => Moved successfully.
C:\Users\janice\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmppsdxjc.dll => Moved successfully.
C:\ProgramData\TEMP => ":373E1720" ADS removed successfully.
C:\Users\janice\Downloads\noname (1).eml => ":OECustomProperty" ADS removed successfully.
C:\Users\janice\Downloads\noname.eml => ":OECustomProperty" ADS removed successfully.

==== End of Fixlog 04:37:57 ====

Broni · Apr 15, 2015

Conhost.exe is a legit file: http://www.howtogeek.com/howto/4996/what-is-conhost.exe-and-why-is-it-running/

Last scans...

Download Security Check from here or here and save it to your Desktop.

Double-click SecurityCheck.exe
Follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
NOTE 2. SecurityCheck may produce some false warning(s), so leave the results reading to me.
NOTE 3. If you receive UNSUPPORTED OPERATING SYSTEM! ABORTED! message restart computer and Security Check should run

Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.

Make sure the following options are checked:
- Internet Services
- Windows Firewall
- System Restore
- Security Center
- Windows Update
- Windows Defender
- Other Services
Press "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.
Please copy and paste the log to your reply.

Download Temp File Cleaner (TFC)
Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe

Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.

Download Sophos Free Virus Removal Tool and save it to your desktop.

Double click the icon and select Run
Click Next
Select I accept the terms in this license agreement, then click Next twice
Click Install
Click Finish to launch the program
Once the virus database has been updated click Start Scanning
If any threats are found click Details, then View log file... (bottom left hand corner)
Copy and paste the results in your reply
Close the Notepad document, close the Threat Details screen, then click Start cleanup
Click Exit to close the program

Eric Witzling · Apr 16, 2015

I know Conhost is a legit file, but so is Chrome.exe, under normal circumstances. And that many unkillable conhosts running seems anomalous to me.

There was a thread last year (that you also helped me on, in fact - https://www.techspot.com/community/topics/that-fake-chrome-browser-exe-infection.204781/ ) where we were similarly trying to hunt down what was launching as "browser.exe" but I have seen more of all of the above.

I am getting to the point of thinking in this case we're getting side-tracked by a combination of Google services that do launch in this fashion, however. Like Google Docs, Google Drive syncing, Google Desktop, etc. What seems anomalous and conceivably malicious may instead be correlation, not causation.

Will perform your above tasks when I can get back into the system.

Broni · Apr 16, 2015

At this point I don't even see any "conhost" running (according to FRST logs).

Eric Witzling · Apr 17, 2015

I can't get back into the system yet to run the above tests, but I can look at the running processes on the back end.

Interestingly I can kill them from there, so it seems like LogMeIn Pro can get under them. It's only Windows Task Manager that doesn't allow me to kill them. (One of the other reasons I'm concerned with their presence. Because all legit running of that I've seen before are able to be ended normally.)

I can kill the stack of chrome.exe's as well, but one of them would come back right away. However I also noticed googledrivesync.exe processes running, and after I killed those, not even the single chrome.exe would show up, so I do think those, at least, are bundled together.

Not that I know why it would feel bound and determined to launch that many separate processes taking up that much memory right away. (But then, when is Chrome not a RAM hog? ;-) )

Broni · Apr 17, 2015

I don't see anything suspicious there. I don't see any CPU usage by those processes.
The reason you can't kill conhost process is that it's a "child" process lunched by csrss. You'd have to kill csrss process first.
conhost file in correct location as well.

Unless your computer displays some ill behavior....continue with prescribed scans.

Eric Witzling · Apr 20, 2015

Apologies for the delay. I haven't been able to get back in for a bit--work at the site had kept the PC offline.

Broni · Apr 20, 2015

Eric Witzling · Apr 25, 2015

Continue to be still here. Will check if the system is available over the weekend.

Broni · Apr 25, 2015

Solved Conhost.exe and fake Chrome.exe background processes

Posts: 120 +2

Posts: 120 +2

Posts: 120 +2

Posts: 56,041 +516

Posts: 120 +2

Posts: 120 +2

Posts: 120 +2

Posts: 120 +2

Posts: 120 +2

Posts: 56,041 +516

Posts: 120 +2

Posts: 56,041 +516

Posts: 120 +2

Posts: 120 +2

Posts: 56,041 +516

Attachments

Posts: 120 +2

Posts: 56,041 +516

Posts: 120 +2

Posts: 56,041 +516

Posts: 120 +2

Posts: 56,041 +516

Posts: 120 +2

Posts: 56,041 +516

Posts: 120 +2

Posts: 56,041 +516

Similar threads