Solved SoftwareBundler:Win32/Stallmonitz Farbar FRST Log (Part 1)

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

There are 7915 more sites.

IE trusted site: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000\...\dell.com -> dell.com
IE trusted site: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000\...\localhost -> localhost
IE trusted site: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000\...\webcompanion.com -> hxxp://webcompanion.com
IE restricted site: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000\...\0190-dialers.com -> 0190-dialers.com
IE restricted site: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000\...\01i.info -> 01i.info
IE restricted site: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000\...\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com
IE restricted site: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000\...\0411dd.com -> 0411dd.com
IE restricted site: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000\...\0511zfhl.com -> 0511zfhl.com
IE restricted site: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000\...\05p.com -> 05p.com
IE restricted site: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000\...\0632qyw.com -> 0632qyw.com
IE restricted site: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000\...\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com
IE restricted site: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000\...\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com
IE restricted site: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000\...\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com
IE restricted site: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000\...\0calories.net -> 0calories.net
IE restricted site: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000\...\0cj.net -> 0cj.net
IE restricted site: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000\...\1-2005-search.com -> www.1-2005-search.com

There are 12730 more sites.


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 22:34 - 2016-10-15 12:09 - 00452470 ____R C:\Windows\system32\Drivers\etc\hosts

127.0.0.1 localhost127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123haustiereundmehr.com
127.0.0.1 123moviedownload.com
127.0.0.1 www.123moviedownload.com

There are 15554 more lines.


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1645592776-1552282287-2170224798-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Trevor\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

MSCONFIG\Services: AdvancedSystemCareService9 => 2
MSCONFIG\Services: Apple Mobile Device => 2
MSCONFIG\Services: ArcService => 3
MSCONFIG\Services: Bonjour Service => 2
MSCONFIG\Services: DAUpdaterSvc => 3
MSCONFIG\Services: DragonSvc => 2
MSCONFIG\Services: hidserv => 3
MSCONFIG\Services: HitmanProScheduler => 2
MSCONFIG\Services: LiveUpdateSvc => 2
MSCONFIG\Services: Nero BackItUp Scheduler 4.0 => 2
MSCONFIG\Services: Origin Client Service => 3
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk => C:\Windows\pss\Adobe Gamma Loader.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk => C:\Windows\pss\Bluetooth.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk => C:\Windows\pss\Microsoft Office.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^PrivateTunnel.lnk => C:\Windows\pss\PrivateTunnel.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Trevor^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.3.lnk => C:\Windows\pss\OpenOffice.org 3.3.lnk.Startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Advanced SystemCare 9 => "C:\Program Files (x86)\IObit\Advanced SystemCare\ASCTray.exe" /Auto
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: BDRegion => c:\Program Files (x86)\Cyberlink\Shared Files\brs.exe
MSCONFIG\startupreg: CCleaner Monitoring => "C:\Program Files (x86)\CCleaner\CCleaner64.exe" /MONITOR
MSCONFIG\startupreg: CyberGhost => "C:\Program Files\CyberGhost 5\CyberGhost.exe" /autostart /min
MSCONFIG\startupreg: DNS7reminder => "C:\Program Files (x86)\Nuance\NaturallySpeaking11\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\NaturallySpeaking11\Ereg.ini"
MSCONFIG\startupreg: Everything => "C:\Program Files (x86)\Everything\Everything.exe" -startup
MSCONFIG\startupreg: FreeAC => C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe -autorun
MSCONFIG\startupreg: GalaxyClient => C:\Program Files (x86)\GalaxyClient\GalaxyClient.exe /launchViaAutoStart
MSCONFIG\startupreg: Google Update => "C:\Users\Trevor\AppData\Local\Google\Update\GoogleUpdate.exe" /c
MSCONFIG\startupreg: ISUSPM => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: msnmsgr => "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
MSCONFIG\startupreg: PDVD8LanguageShortcut => "c:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe"
MSCONFIG\startupreg: Reader Application Helper => C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe
MSCONFIG\startupreg: RemoteControl8 => "c:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe"
MSCONFIG\startupreg: RemoveShowDesktopButton => C:\Windows\sdbr.exe hide
MSCONFIG\startupreg: ROC_roc_dec12 => "C:\Program Files (x86)\AVG Secure Search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12
MSCONFIG\startupreg: Skytel => C:\Program Files\Realtek\Audio\HDA\Skytel.exe
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: uTorrent => "C:\Users\Trevor\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED
MSCONFIG\startupreg: vProt => "C:\Program Files (x86)\AVG Secure Search\vprot.exe"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{49E30BC1-9815-4CAD-BE99-6AF03CD6EAE9}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD8\PowerDVD8.EXE
FirewallRules: [{AF810A37-5BA0-454A-86D7-13D735076CA9}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{AED9E667-EF42-4C11-A805-1903AA5369DB}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [TCP Query User{4C4DFEC9-2BFC-4D40-BA0E-BC716CA064E4}C:\program files (x86)\mirc\mirc.exe] => (Allow) C:\program files (x86)\mirc\mirc.exe
FirewallRules: [UDP Query User{72F3BEB7-BD0C-4B84-8566-63767B0523C1}C:\program files (x86)\mirc\mirc.exe] => (Allow) C:\program files (x86)\mirc\mirc.exe
FirewallRules: [{07F5419F-F03E-4E7E-9EE3-761EEEE4F899}] => (Allow) C:\Program Files (x86)\Windows Live\Sync\WindowsLiveSync.exe
FirewallRules: [TCP Query User{55E689D4-018C-47FC-B72B-9DDD64AD3F51}C:\program files (x86)\curious labs\poser 6\poser.exe] => (Block) C:\program files (x86)\curious labs\poser 6\poser.exe
FirewallRules: [UDP Query User{4B23FF6B-8222-4A9E-9039-27D844BCC8DB}C:\program files (x86)\curious labs\poser 6\poser.exe] => (Block) C:\program files (x86)\curious labs\poser 6\poser.exe
FirewallRules: [{22C8EAB4-EFDF-4401-9B76-D9707C7F7F4A}] => (Allow) E:\Program Files\uTorrent\uTorrent.exe
FirewallRules: [{AF311194-3B36-4301-ACFA-97A298669C99}] => (Allow) E:\Program Files\uTorrent\uTorrent.exe
FirewallRules: [{9A127494-6F1B-4DD4-9B1F-A82E9DC72DD2}] => (Allow) C:\Program Files (x86)\Dragon Age\bin_ship\daorigins.exe
FirewallRules: [{F1EF0F05-7AF0-4105-BB61-F5FAD3A3E6EA}] => (Allow) C:\Program Files (x86)\Dragon Age\bin_ship\daorigins.exe
FirewallRules: [{09494011-F99F-403B-B4DD-B48BF3C27D4D}] => (Allow) C:\Program Files (x86)\Dragon Age\DAOriginsLauncher.exe
FirewallRules: [{CFAF3591-CFEB-4EB1-A3E4-F15787293CBF}] => (Allow) C:\Program Files (x86)\Dragon Age\DAOriginsLauncher.exe
FirewallRules: [{DD3A8F26-D9B0-401D-B55F-9703B1D44D8C}] => (Allow) C:\Program Files (x86)\Dragon Age\bin_ship\daupdatersvc.service.exe
FirewallRules: [{C2BF2C02-59B4-4DCC-BBC5-473ED3F04865}] => (Allow) C:\Program Files (x86)\Dragon Age\bin_ship\daupdatersvc.service.exe
FirewallRules: [{E7A7A500-336B-4E35-AAB2-F52595BBCD2D}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{E46EDB05-03ED-42B1-AB2B-41E6D89DDD53}] => (Allow) LPort=2869
FirewallRules: [{4A452023-FDC6-42E0-B2F3-44BFE510D26C}] => (Allow) LPort=1900
FirewallRules: [{162C60CB-2295-48E4-ACE3-E86AABCD8734}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{CECE4ABA-5EA2-49DD-982A-6FC8E3D4645A}] => (Allow) C:\Program Files (x86)\Dragon Age 2\bin_ship\DragonAge2.exe
FirewallRules: [{C5AF0433-BF16-4A7A-AABF-8E78CAAF38C3}] => (Allow) C:\Program Files (x86)\Dragon Age 2\bin_ship\DragonAge2.exe
FirewallRules: [{856C2638-E4ED-403A-92A9-7CCACF9E796D}] => (Allow) C:\Program Files (x86)\Dragon Age 2\DragonAge2Launcher.exe
FirewallRules: [{206CA681-1784-4B95-920E-40216144F594}] => (Allow) C:\Program Files (x86)\Dragon Age 2\DragonAge2Launcher.exe
FirewallRules: [{A6C6964C-37D9-4467-941E-68CF107AC506}] => (Allow) C:\Program Files (x86)\Mass Effect\Binaries\MassEffect.exe
FirewallRules: [{9E273AEA-00DB-43FF-9AD1-0E5EF17AD162}] => (Allow) C:\Program Files (x86)\Mass Effect\Binaries\MassEffect.exe
FirewallRules: [{9C0164B1-3B4C-40B6-B766-CF2A30BB445D}] => (Allow) C:\Program Files (x86)\Mass Effect\MassEffectLauncher.exe
FirewallRules: [{D2D05632-ACD7-4C8B-9F2B-6F782CD4A427}] => (Allow) C:\Program Files (x86)\Mass Effect\MassEffectLauncher.exe
FirewallRules: [{D3771278-7A18-4335-A124-0D7F5E2709F3}] => (Allow) C:\Program Files (x86)\HollywoodMogul3\hm3.exe
FirewallRules: [{C16B3628-BE80-4EF0-B6D6-4F8D11D134B4}] => (Allow) C:\Program Files (x86)\HollywoodMogul3\hm3.exe
FirewallRules: [TCP Query User{B6E9B88E-025D-41D2-A0B9-B0EED37B6162}E:\mirc\mirc.exe] => (Block) E:\mirc\mirc.exe
FirewallRules: [UDP Query User{E194A098-1579-427E-BDD5-3A7344A7DA6E}E:\mirc\mirc.exe] => (Block) E:\mirc\mirc.exe
FirewallRules: [TCP Query User{46B00044-EDCC-4FC3-AFEC-E0885C62C489}C:\program files (x86)\dragon age\bin_ship\daorigins.exe] => (Allow) C:\program files (x86)\dragon age\bin_ship\daorigins.exe
FirewallRules: [UDP Query User{7773A525-B395-421A-A52B-4D40BC68ECE1}C:\program files (x86)\dragon age\bin_ship\daorigins.exe] => (Allow) C:\program files (x86)\dragon age\bin_ship\daorigins.exe
FirewallRules: [{3289AE5C-F33B-43A7-8A15-2DD879B2AE92}] => (Allow) C:\Program Files (x86)\Dragon Age\bin_ship\daupdatersvc.service.exe
FirewallRules: [{FBBC38E7-F9E7-4875-BFC5-61C419581EC9}] => (Allow) C:\Program Files (x86)\Dragon Age\bin_ship\daupdatersvc.service.exe
FirewallRules: [TCP Query User{F2E73E31-CBB5-4A14-8F55-C458857FA388}C:\program files (x86)\electronic arts\bioware\star wars - the old republic\betatest\retailclient\swtor.exe] => (Allow) C:\program files (x86)\electronic arts\bioware\star wars - the old republic\betatest\retailclient\swtor.exe
FirewallRules: [UDP Query User{D3B8D9B7-1243-4B09-9E27-57D2F1D133D3}C:\program files (x86)\electronic arts\bioware\star wars - the old republic\betatest\retailclient\swtor.exe] => (Allow) C:\program files (x86)\electronic arts\bioware\star wars - the old republic\betatest\retailclient\swtor.exe
FirewallRules: [{D076527B-D452-4A75-BFC6-2AAC193BA4D7}] => (Allow) C:\Program Files (x86)\Dragon Age\tools\GffEditor.exe
FirewallRules: [{18E3C544-B0C0-4B0D-A5E7-B2896CB2DE39}] => (Allow) C:\Program Files (x86)\Dragon Age\tools\GffEditor.exe
FirewallRules: [{AFB2E0EB-586F-4904-ACBA-2A03ABC7FC97}] => (Allow) C:\Program Files (x86)\Dragon Age\tools\ErfEditor.exe
FirewallRules: [{5CAD97B4-EF06-4ECD-A5C3-E1E33AFB16AD}] => (Allow) C:\Program Files (x86)\Dragon Age\tools\ErfEditor.exe
FirewallRules: [{A549842B-E3BE-49F7-9C20-D42CE5F11D17}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\swtor\retailclient\swtor.exe
FirewallRules: [{7EC0C227-C3E8-4850-839E-604A76C3E484}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\swtor\retailclient\swtor.exe
FirewallRules: [{5EF7B69D-00D7-4D72-A32E-1B9028F5CCAB}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\swtor\retailclient\swtor.exe
FirewallRules: [{059F74F8-11C3-4A4C-AFA1-8DDB4F3898C2}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\swtor\retailclient\swtor.exe
FirewallRules: [{4AAB739C-D1AA-4232-A0C4-69D97308F10D}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\launcher.exe
FirewallRules: [{BD606EF6-3D56-4964-A4D0-BEB04559ABB2}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\launcher.exe
FirewallRules: [{57ABAF1D-A37C-4768-B222-A49145DAECD2}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\launcher.exe
FirewallRules: [{41E05A38-588C-4B5F-AD7F-DB6E9AF08A63}] => (Allow) C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\launcher.exe
FirewallRules: [{6D449565-6D4D-4E43-94B6-76F0A01E8E11}] => (Allow) C:\Program Files (x86)\AVG\AVG2012\avgmfapx.exe
FirewallRules: [{54AE5C96-2607-4228-952C-D711E2D878FA}] => (Allow) C:\Program Files (x86)\AVG\AVG2012\avgmfapx.exe
FirewallRules: [{BBF3E2B6-DD86-449F-990D-E83619BE26FC}] => (Allow) C:\Program Files (x86)\AVG\AVG2012\avgdiagex.exe
FirewallRules: [{A93DC9EC-072C-4851-8EC4-C9EB949A9045}] => (Allow) C:\Program Files (x86)\AVG\AVG2012\avgdiagex.exe
FirewallRules: [TCP Query User{43B412D7-0C15-4841-9AA2-1A3A2985EA28}C:\program files (x86)\beamdog\beamdog.launcher.exe] => (Allow) C:\program files (x86)\beamdog\beamdog.launcher.exe
FirewallRules: [UDP Query User{5F67EA85-EAE2-48AA-8DD8-66046EE75A2E}C:\program files (x86)\beamdog\beamdog.launcher.exe] => (Allow) C:\program files (x86)\beamdog\beamdog.launcher.exe
FirewallRules: [{28B7FD70-10A0-43FD-8A6F-D0424477FDCE}] => (Allow) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe
FirewallRules: [{DFA9437C-3D2E-4D08-A84B-8899F2B207A5}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{5D5774FF-23D0-415D-BBC3-35C0E61683D0}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{61C9749D-D319-4FFF-B82A-E3896A0AE65E}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{C3B3D321-450C-4B99-AC24-007F79C41A5E}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{E2B95A3F-C8B3-4645-9926-3D3E7A9E6126}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exe
FirewallRules: [TCP Query User{96686D9B-08B2-409D-A187-28F8B153D492}C:\program files (x86)\gazillion entertainment\marvel heroes\unrealengine3\binaries\win32\marvelgame.exe] => (Allow) C:\program files (x86)\gazillion entertainment\marvel heroes\unrealengine3\binaries\win32\marvelgame.exe
FirewallRules: [UDP Query User{C8485275-E38D-4491-8339-A5B288F38E8A}C:\program files (x86)\gazillion entertainment\marvel heroes\unrealengine3\binaries\win32\marvelgame.exe] => (Allow) C:\program files (x86)\gazillion entertainment\marvel heroes\unrealengine3\binaries\win32\marvelgame.exe
FirewallRules: [{D052AC2C-67D7-4C93-A5CF-B98574F74F0D}] => (Allow) C:\Users\Trevor\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [TCP Query User{9405C89B-7F75-422A-ABE1-940BA8C53387}C:\program files (x86)\baldur's gate enhanced edition\bgee.exe] => (Allow) C:\program files (x86)\baldur's gate enhanced edition\bgee.exe
FirewallRules: [UDP Query User{F7D3F7CC-85F5-474F-84C5-7CFA091305A5}C:\program files (x86)\baldur's gate enhanced edition\bgee.exe] => (Allow) C:\program files (x86)\baldur's gate enhanced edition\bgee.exe
FirewallRules: [{C106BE3A-424F-425D-BFF0-49C2483B58A5}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\the witcher 2\Launcher.exe
FirewallRules: [{E2710BF6-281F-4BC3-B6BF-2E06DDE095CD}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\the witcher 2\Launcher.exe
FirewallRules: [{EC53805F-3FA0-4EC6-B964-A1A26A294CB6}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\King's Bounty - The Legend\kb.exe
FirewallRules: [{034C447B-7C2E-4D81-9735-6A2C52D828C4}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\King's Bounty - The Legend\kb.exe
FirewallRules: [{8BE600F2-C830-47DF-A55B-0F73562C323D}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\King's Bounty - The Legend\save_fixer.exe
FirewallRules: [{619E0E99-A669-4DBF-B806-FB8B87DD7408}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\King's Bounty - The Legend\save_fixer.exe
FirewallRules: [{3E10FD49-4C98-4F14-928A-6CC4DA85A111}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Alan Wake\AlanWake.exe
FirewallRules: [{8C3B158F-BB43-468F-A0AA-AD2DBCC96F63}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Alan Wake\AlanWake.exe
FirewallRules: [{40F4F3B2-DE64-4E23-9A1B-13106B6A3A4A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Leisure Suit Larry in the Land of the Lounge Lizards Reloaded\LarryReloaded.exe
FirewallRules: [{425DA194-D9E0-47BC-AB7C-41292CE1EF3C}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Leisure Suit Larry in the Land of the Lounge Lizards Reloaded\LarryReloaded.exe
FirewallRules: [{14D66D33-821F-4589-9BA0-30F98CC8F76F}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sid Meier's Civilization V\Launcher.exe
FirewallRules: [{629E0F46-511C-400E-91C9-7CAFF9557B35}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sid Meier's Civilization V\Launcher.exe
FirewallRules: [{31D79DC5-12BD-41ED-A365-9D7A797D5EDC}] => (Allow) G:\Games\Steam\SteamApps\common\the witcher 2\Launcher.exe
FirewallRules: [{F9E8EEA1-F747-497D-80D0-D8BBE54C2A2D}] => (Allow) G:\Games\Steam\SteamApps\common\the witcher 2\Launcher.exe
FirewallRules: [{6B1C3EF4-A088-448D-A988-CEA658646DA6}] => (Allow) G:\Games\Steam\SteamApps\common\King's Bounty - The Legend\kb.exe
FirewallRules: [{CE9DA1D2-663E-4813-85E8-8DE42A56DA18}] => (Allow) G:\Games\Steam\SteamApps\common\King's Bounty - The Legend\kb.exe
FirewallRules: [{F4201ECE-1EAE-4BF9-9855-E7AA832F3C1B}] => (Allow) G:\Games\Steam\SteamApps\common\King's Bounty - The Legend\save_fixer.exe
FirewallRules: [{4EF83B04-204B-45C6-9E4B-12D1798F3DAC}] => (Allow) G:\Games\Steam\SteamApps\common\King's Bounty - The Legend\save_fixer.exe
FirewallRules: [{0D5C693C-9554-48EE-887D-4CC63EA392D2}] => (Allow) C:\Program Files (x86)\Opera\opera.exe
FirewallRules: [{C1A1E9AB-0D1A-409D-8306-0EA7D7066851}] => (Allow) C:\Program Files (x86)\Opera\opera.exe
FirewallRules: [{9C948C7D-AD45-4E51-8535-B4C65D58A59F}] => (Allow) G:\Games\Steam\SteamApps\common\Sid Meier's Civilization V\Launcher.exe
FirewallRules: [{E59F09A1-ABD9-4E36-94FB-253004B17192}] => (Allow) G:\Games\Steam\SteamApps\common\Sid Meier's Civilization V\Launcher.exe
FirewallRules: [{98AB2345-92B0-43F8-B603-9281606C79CF}] => (Allow) G:\Games\Steam\SteamApps\common\Leisure Suit Larry in the Land of the Lounge Lizards Reloaded\LarryReloaded.exe
FirewallRules: [{A99CB411-1E05-4DD9-B81F-28CC53DF6ECB}] => (Allow) G:\Games\Steam\SteamApps\common\Leisure Suit Larry in the Land of the Lounge Lizards Reloaded\LarryReloaded.exe
FirewallRules: [{71ACEC3E-092F-479F-A43B-369A934DE9DC}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{531CE928-4C25-4DA8-8EE0-33B79B38CD4F}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{FED1631B-B1A4-4416-8ADE-0B2C381ECD52}] => (Allow) G:\Games\Steam\SteamApps\common\Alan Wake\AlanWake.exe
FirewallRules: [{1B9E05C4-AC4E-47FB-A065-34286E2F141B}] => (Allow) G:\Games\Steam\SteamApps\common\Alan Wake\AlanWake.exe
FirewallRules: [{9F73AEA6-B44A-42AC-BF3F-D1F1BD5E7ABA}] => (Allow) G:\Games\Steam\SteamApps\common\Shadowrun Returns\Shadowrun.exe
FirewallRules: [{9DC35499-A9CF-4987-88D7-BDFEC22A8352}] => (Allow) G:\Games\Steam\SteamApps\common\Shadowrun Returns\Shadowrun.exe
FirewallRules: [{1661C7B4-5773-41DF-9759-794A2227207C}] => (Allow) G:\Games\Steam\SteamApps\common\Jade Empire\JadeEmpireLauncher.exe
FirewallRules: [{5790486F-7C6C-461E-A769-898E54DFC60A}] => (Allow) G:\Games\Steam\SteamApps\common\Jade Empire\JadeEmpireLauncher.exe
FirewallRules: [{11A8EF7F-4EFD-4311-B60D-838BA1DEC835}] => (Allow) G:\Games\Steam\SteamApps\common\Jade Empire\JadeEmpireConfig.exe
FirewallRules: [{B45C42C9-E9F8-4E8F-99BC-C075A925849F}] => (Allow) G:\Games\Steam\SteamApps\common\Jade Empire\JadeEmpireConfig.exe
FirewallRules: [{A6DA5A5C-1E3E-4771-A6AA-9027BBE6EAA1}] => (Allow) G:\Games\Steam\SteamApps\common\Marvel Heroes\UnrealEngine3\Binaries\Win32\MarvelGame.exe
FirewallRules: [{3A2AD0DD-D7E5-4B9B-ACE0-6C2C2EDB62F2}] => (Allow) G:\Games\Steam\SteamApps\common\Marvel Heroes\UnrealEngine3\Binaries\Win32\MarvelGame.exe
FirewallRules: [{8B5E39AC-5CC9-4755-B395-B7C3D060A757}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{349ACFBC-1AA4-4BC6-B6E0-CC2F9E664222}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{83539628-ABC3-43BF-B041-81FCEC48CAF2}] => (Allow) G:\Games\Steam\SteamApps\common\Shadowrun Returns\Shadowrun.exe
FirewallRules: [{1CBC217E-CE73-41BF-859E-580C6F78BF9E}] => (Allow) G:\Games\Steam\SteamApps\common\Shadowrun Returns\Shadowrun.exe
FirewallRules: [{33A373F9-EA67-4F7B-8920-2266B38A9534}] => (Allow) G:\Games\Steam\SteamApps\common\XCom-Enemy-Unknown\Binaries\Win32\XComGame.exe
FirewallRules: [{4F43790C-AA69-4DDD-BC48-C1E60F63CC7C}] => (Allow) G:\Games\Steam\SteamApps\common\XCom-Enemy-Unknown\Binaries\Win32\XComGame.exe
FirewallRules: [{203452A1-AA4F-4799-8590-C3B80761F319}] => (Allow) G:\Games\Steam\SteamApps\common\Marvel Heroes\UnrealEngine3\Binaries\Win32\MarvelGame.exe
FirewallRules: [{04409A3B-25AC-4BFD-8BF1-79637CB431DA}] => (Allow) G:\Games\Steam\SteamApps\common\Marvel Heroes\UnrealEngine3\Binaries\Win32\MarvelGame.exe
FirewallRules: [{3B55A883-7D8D-4201-94D4-4C84D2E76CCB}] => (Allow) G:\Games\Steam\Steam.exe
FirewallRules: [{CEFC81B0-F487-45DD-B88B-15B3589B7E0E}] => (Allow) G:\Games\Steam\Steam.exe
FirewallRules: [{F2E8480F-04A9-4DF3-89C9-BEDC09D91903}] => (Allow) G:\Games\Steam\SteamApps\common\Scribblenauts Unmasked\Scribble.exe
FirewallRules: [{639A7000-6246-4B35-95C8-1248C59B1633}] => (Allow) G:\Games\Steam\SteamApps\common\Scribblenauts Unmasked\Scribble.exe
FirewallRules: [TCP Query User{132EA6BC-127F-48FA-BA40-D69CC8DA2A5D}E:\mirc\mirc.exe] => (Allow) E:\mirc\mirc.exe
FirewallRules: [UDP Query User{E6A6505B-1D8D-4C57-ACF0-707A1FD7ED1D}E:\mirc\mirc.exe] => (Allow) E:\mirc\mirc.exe
FirewallRules: [{B8A77CE8-D718-43C6-95EB-03542B5028AD}] => (Allow) G:\Games\Steam\SteamApps\common\Broken Sword Shadow of the Templars\bs1dc.exe
FirewallRules: [{9360200F-7E71-4CBD-9348-B0A903A6FEBE}] => (Allow) G:\Games\Steam\SteamApps\common\Broken Sword Shadow of the Templars\bs1dc.exe
FirewallRules: [{667892C8-F737-42D6-BF1A-8B2C3FE253BE}] => (Allow) G:\Games\Steam\SteamApps\common\Marvel Heroes\UnrealEngine3\Binaries\Win32\MarvelHeroes2015.exe
FirewallRules: [{B1F11A71-516C-4882-B183-5A591F77A7F9}] => (Allow) G:\Games\Steam\SteamApps\common\Marvel Heroes\UnrealEngine3\Binaries\Win32\MarvelHeroes2015.exe
FirewallRules: [{AE402559-A1F5-4F03-8B3D-F20D3D5178C9}] => (Allow) G:\Games\Steam\SteamApps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{13ACA6E0-1FDC-4E87-B93A-F1801579BB40}] => (Allow) G:\Games\Steam\SteamApps\common\Skyrim\SkyrimLauncher.exe
FirewallRules: [{10B864E8-1D66-4DC8-8B31-83DCE70EA922}] => (Allow) G:\Games\Steam\SteamApps\common\The Sims Medieval\Game\Bin\TSM.exe
FirewallRules: [{8E783514-4B93-4ECC-B301-1275A1313559}] => (Allow) G:\Games\Steam\SteamApps\common\The Sims Medieval\Game\Bin\TSM.exe
FirewallRules: [{1FF1E100-2999-4752-AE3E-F28C9275ABAD}] => (Allow) G:\HappyCloud\Cache\TERA\TERA-Launcher.exe
FirewallRules: [{94296674-5398-4600-82D2-CEF77F8246A0}] => (Allow) G:\HappyCloud\Cache\TERA\TERA-Launcher.exe
FirewallRules: [{172DDB0A-D650-48BA-BA96-CD6A7D494704}] => (Allow) G:\HappyCloud\Cache\TERA\Client\TL.exe
FirewallRules: [{98B82CE1-F4FC-4609-B025-E3966409AB0A}] => (Allow) G:\HappyCloud\Cache\TERA\Client\TL.exe
FirewallRules: [{37AC57F4-1B91-4337-878D-A529A8DCD04B}] => (Allow) G:\HappyCloud\Cache\TERA\Client\Binaries\TERA.exe
FirewallRules: [{9B3A1AB5-DD64-4FC8-ACD2-F9DFE2577585}] => (Allow) G:\HappyCloud\Cache\TERA\Client\Binaries\TERA.exe
FirewallRules: [{1BB7A158-EE3A-465A-8604-B3A77E68681E}] => (Allow) C:\Program Files (x86)\Origin Games\The Sims 4 Create A Sim Demo\Game\Bin\TS4CAS.exe
FirewallRules: [{8487F072-3734-4419-A427-BFF80A10CEBE}] => (Allow) C:\Program Files (x86)\Origin Games\The Sims 4 Create A Sim Demo\Game\Bin\TS4CAS.exe
FirewallRules: [{D36DF2F2-A285-421C-823E-A6D6D2771AD4}] => (Allow) C:\Program Files (x86)\Origin Games\Dragon Age Inquisition\DragonAgeInquisition.exe
FirewallRules: [{3B16A197-6AC1-460B-8EDE-8119A178204A}] => (Allow) C:\Program Files (x86)\Origin Games\Dragon Age Inquisition\DragonAgeInquisition.exe
FirewallRules: [{85D98E0E-EF07-48FB-BF0B-760F1E535BD2}] => (Allow) C:\Program Files (x86)\Origin Games\SimCity 2000 SE\Game\Game\DOSBox\DOSBox.exe
FirewallRules: [{32E02BEF-5906-47BB-A053-D9FAE70E74FC}] => (Allow) C:\Program Files (x86)\Origin Games\SimCity 2000 SE\Game\Game\DOSBox\DOSBox.exe
FirewallRules: [{C1F9BCE2-AFB6-4E92-AC11-B045E1FFC21D}] => (Allow) G:\Games\Steam\bin\steamwebhelper.exe
FirewallRules: [{974D940D-1B4E-4A94-8EF3-9FEDA27F59D3}] => (Allow) G:\Games\Steam\bin\steamwebhelper.exe
FirewallRules: [{F123521E-8EFA-4AA5-B701-5570E6E6CC23}] => (Allow) C:\Program Files (x86)\Origin Games\Syndicate (1993)\data\Game\DOSBox\LAUNCHER.exe
FirewallRules: [{5A747DE5-480B-4C13-835B-CC235AB94733}] => (Allow) C:\Program Files (x86)\Origin Games\Syndicate (1993)\data\Game\DOSBox\LAUNCHER.exe
FirewallRules: [{28BC8A27-D873-4677-B2A8-54686CA8F04C}] => (Allow) G:\Games\Steam\SteamApps\common\Pillars of Eternity\PillarsOfEternity.exe
FirewallRules: [{B3D78AF3-B654-4FE2-9ACE-0B8F736F1BBD}] => (Allow) G:\Games\Steam\SteamApps\common\Pillars of Eternity\PillarsOfEternity.exe
FirewallRules: [{635063E9-1511-4B41-A905-73BF9A55E686}] => (Allow) C:\Users\Trevor\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{6D180673-7293-4F04-A1F3-F031C1F24F7C}] => (Allow) C:\Users\Trevor\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{DD529B8E-8E05-4D6B-A4E7-91D600A128B8}] => (Allow) C:\Program Files (x86)\Origin Games\Ultima 8\Game\Game\DOSBox\DOSBox.exe
FirewallRules: [{1C279089-2CED-4C0D-B9E4-9E1A2A084B97}] => (Allow) C:\Program Files (x86)\Origin Games\Ultima 8\Game\Game\DOSBox\DOSBox.exe
FirewallRules: [{63D3C89F-43B3-4FBF-B514-7734C46D1A66}] => (Allow) G:\Games\Steam\SteamApps\common\Heroine's Quest\Heroine's Quest.exe
FirewallRules: [{4329B9D4-097D-44D7-BC2B-EA4332E91B75}] => (Allow) G:\Games\Steam\SteamApps\common\Heroine's Quest\Heroine's Quest.exe
FirewallRules: [{1A540182-9C84-4EA3-B3A2-9DEC757DB1EA}] => (Allow) G:\Games\Steam\SteamApps\common\Homeworld\HWLauncher\Launcher.exe
FirewallRules: [{19A48817-E496-475E-9065-F9F622CA3CC8}] => (Allow) G:\Games\Steam\SteamApps\common\Homeworld\HWLauncher\Launcher.exe
FirewallRules: [{26556BD2-D263-4381-91D4-0B0249119CF7}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{90E217B9-E20F-44E1-B27B-C6474C8E5084}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{A27DB6CE-993C-4A82-BEA4-89311FB83685}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
FirewallRules: [{D6E98FCA-51E4-4B20-9434-FCC2E9976BA5}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{4A15CA04-E4AB-4F20-AE44-CA12AC6EF693}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{7414D9D1-8177-429D-B14F-73AD1075846D}] => (Allow) G:\Games\Steam\SteamApps\common\InvisibleInc\invisibleinc.exe
FirewallRules: [{6C9C172C-B168-4132-B844-3691E735CE15}] => (Allow) G:\Games\Steam\SteamApps\common\InvisibleInc\invisibleinc.exe
FirewallRules: [{C39A045D-E7FF-4992-BA87-2C7E6E93FD39}] => (Allow) G:\Games\Steam\SteamApps\common\Torchlight\Torchlight.exe
FirewallRules: [{4C06089C-D8D1-4BC7-B09C-C0BADC4C8637}] => (Allow) G:\Games\Steam\SteamApps\common\Torchlight\Torchlight.exe
FirewallRules: [{0D36F229-8CF8-4FE7-AACD-23F8A4F14ADA}] => (Allow) G:\Games\Steam\SteamApps\common\GoatSimulator\Binaries\Win32\GoatGame-Win32-Shipping.exe
FirewallRules: [{B2ADD6CE-F748-49CE-A11F-74A704051B83}] => (Allow) G:\Games\Steam\SteamApps\common\GoatSimulator\Binaries\Win32\GoatGame-Win32-Shipping.exe
FirewallRules: [{7C5A6983-1D70-4342-ADC3-42B8E60DB383}] => (Allow) G:\Games\Steam\SteamApps\common\FTL Faster Than Light\FTLGame.exe
FirewallRules: [{6F54FC18-4D27-4F3C-B681-2C6295CC16E5}] => (Allow) G:\Games\Steam\SteamApps\common\FTL Faster Than Light\FTLGame.exe
FirewallRules: [{760D789E-2D16-4266-B262-F01D4D74490F}] => (Allow) G:\Games\Steam\SteamApps\common\Game of Thrones\Thrones.exe
FirewallRules: [{31AC1597-7280-4716-A647-046640E71EE2}] => (Allow) G:\Games\Steam\SteamApps\common\Game of Thrones\Thrones.exe
FirewallRules: [{4AD43CD8-1F40-47DD-B536-B3974AC3B263}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{09460CFA-F49D-4307-AEC6-8DC564399AA5}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{9D1CE529-65DB-4A36-BA92-832E2F91545E}] => (Allow) C:\Program Files (x86)\Origin Games\Dragon Age Inquisition\DragonAgeInquisition.exe
FirewallRules: [{04E131A8-7BDF-48AF-916C-A756CD33ED40}] => (Allow) C:\Program Files (x86)\Origin Games\Dragon Age Inquisition\DragonAgeInquisition.exe
FirewallRules: [{C55E5D6E-68A6-4857-A37B-B483DF749543}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{4F94DF74-AB38-476A-B326-74A006E679BC}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{3F67D6B8-0BE4-408F-BCE5-9D0B57CB9F15}] => (Allow) G:\Games\Steam\SteamApps\common\Doodle God\DoodleGod.exe
FirewallRules: [{3FCB040E-F0F6-4543-9BBA-59DC97A280CF}] => (Allow) G:\Games\Steam\SteamApps\common\Doodle God\DoodleGod.exe
FirewallRules: [{7F322E2E-B22E-42E6-889A-ECF24105F962}] => (Allow) G:\Games\Steam\SteamApps\common\Marvel Heroes\UnrealEngine3\Binaries\Win64\MarvelHeroes2016.exe
FirewallRules: [{950B9A8D-00FF-4C4E-91BA-BA5C30310872}] => (Allow) G:\Games\Steam\SteamApps\common\Marvel Heroes\UnrealEngine3\Binaries\Win64\MarvelHeroes2016.exe
FirewallRules: [{57DC029F-2363-4ECA-9EE7-378E433E21D6}] => (Allow) G:\Games\Steam\SteamApps\common\NEKOPARA Vol. 1\nekopara_vol1.exe
FirewallRules: [{A2AC7C7E-5AEF-4958-8BA7-A1CF57D41CE2}] => (Allow) G:\Games\Steam\SteamApps\common\NEKOPARA Vol. 1\nekopara_vol1.exe
FirewallRules: [{3EFCD0AE-BEFE-4B14-8501-623A8B26DA61}] => (Allow) G:\Games\Steam\SteamApps\common\The Purring Quest\ThePurringQuest.exe
FirewallRules: [{A9D9C1EF-3195-4FE4-BCB6-767CFE5BE9C3}] => (Allow) G:\Games\Steam\SteamApps\common\The Purring Quest\ThePurringQuest.exe
FirewallRules: [{68EA30E7-B7ED-446C-8DB1-CA10C7894D76}] => (Allow) G:\Games\Steam\SteamApps\common\Portal\hl2.exe
FirewallRules: [{F545645E-625D-450F-A9E0-B11E9F9ED847}] => (Allow) G:\Games\Steam\SteamApps\common\Portal\hl2.exe
FirewallRules: [{B58EAD14-D6F2-4C55-93D3-4FDB941AE726}] => (Allow) C:\Program Files (x86)\HollywoodMovieStudio\hms.exe
FirewallRules: [{3075E8A7-6C6B-405F-8708-8AE6FD618538}] => (Allow) C:\Program Files (x86)\HollywoodMovieStudio\hms.exe
FirewallRules: [{FDF32A29-75E6-4F1D-AE12-3E08512465A1}] => (Allow) G:\Games\Steam\SteamApps\common\Showtime\Showtime.exe
FirewallRules: [{8E13C82A-04F4-476D-BBB0-59120ABE9AD6}] => (Allow) G:\Games\Steam\SteamApps\common\Showtime\Showtime.exe
FirewallRules: [{8BAA48ED-33BD-4206-8141-A27E0A92141C}] => (Allow) G:\Games\Steam\SteamApps\common\Showtime\Editor.exe
FirewallRules: [{3446AF10-DB7B-41DA-8993-81ED082F5013}] => (Allow) G:\Games\Steam\SteamApps\common\Showtime\Editor.exe
FirewallRules: [{9F2A3A33-D625-4611-A90B-1B6582F1372B}] => (Allow) C:\Users\Trevor\AppData\Local\Google\Chrome\Application\chrome.exe
FirewallRules: [{677F5E4F-C81D-4376-A197-DF036956D5A1}] => (Allow) C:\Program Files (x86)\IObit\Driver Booster\DriverBooster.exe
FirewallRules: [{9A4B88AF-79AC-4637-8F7B-24D144416B03}] => (Allow) C:\Program Files (x86)\IObit\Driver Booster\DriverBooster.exe
FirewallRules: [{08249C4B-17D9-4740-9F66-5D8B8565E9EE}] => (Allow) C:\Program Files (x86)\IObit\Driver Booster\DBDownloader.exe
FirewallRules: [{2D03AD66-225C-47CE-B36E-4A1926B3E78E}] => (Allow) C:\Program Files (x86)\IObit\Driver Booster\DBDownloader.exe
FirewallRules: [{C647AD74-4D79-484D-8A99-0BCAB0DD0893}] => (Allow) C:\Program Files (x86)\IObit\Driver Booster\AutoUpdate.exe
FirewallRules: [{3B7854BE-1BCC-460E-A395-D797E3977C1B}] => (Allow) C:\Program Files (x86)\IObit\Driver Booster\AutoUpdate.exe
FirewallRules: [{F9ECF901-4187-486D-9652-804634124260}] => (Allow) C:\Program Files (x86)\AVG\Av\avgdiagex.exe
FirewallRules: [{EF03F6C9-287B-4126-A0DC-0F37C91B42D4}] => (Allow) C:\Program Files (x86)\AVG\Av\avgdiagex.exe
FirewallRules: [{F32133D2-6DE9-408A-A01C-5ADBD0D060FE}] => (Allow) C:\Program Files (x86)\AVG\Av\avgemca.exe
FirewallRules: [{188C799B-7CFD-45E0-BDE0-85AFA85D7422}] => (Allow) C:\Program Files (x86)\AVG\Av\avgemca.exe
FirewallRules: [{46AE619D-B4A3-4141-9FF9-5D2607FF63D1}] => (Allow) C:\Users\Trevor\Desktop\bin\BlackDesert32.exe
FirewallRules: [{B89F944D-9C15-4F0E-8682-EA98E32A8C7B}] => (Allow) C:\Users\Trevor\Desktop\bin64\BlackDesert64.exe
FirewallRules: [{48948C0D-54F7-4D74-90BB-F713C7698E89}] => (Allow) C:\Users\Trevor\Desktop\BlackDesert_Launcher.exe
FirewallRules: [{363991CA-7D27-4555-9AAC-B45C48E86E12}] => (Allow) C:\Users\Trevor\Desktop\BlackDesert_Downloader.exe
 
==================== Restore Points =========================

12-10-2016 12:57:03 Windows Update
12-10-2016 19:37:22 Revo Uninstaller Pro's restore point - Emsisoft Anti-Malware
12-10-2016 19:38:38 Windows Update
15-10-2016 11:57:21 JRT Pre-Junkware Removal
16-10-2016 15:11:29 Installed HeatherTrial.

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (10/16/2016 06:05:19 PM) (Source: XTUservice) (EventID: 0) (User: )
Description: ------------------------------------------------------------------------------

2016-10-16, 18:05:19.6549425 : Error : Failed to start the Intel Extreme Tuning Utility Service.

Error: (10/16/2016 06:03:15 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: NvStreamNetworkService.exe, version: 7.1.2084.9592, time stamp: 0x57605ac0
Faulting module name: MessageBus.dll, version: 0.0.0.0, time stamp: 0x5760534f
Exception code: 0xc0000005
Fault offset: 0x0000000000010f73
Faulting process id: 0x146c
Faulting application start time: 0x01d227f90d8b8454
Faulting application path: C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
Faulting module path: C:\Program Files\NVIDIA Corporation\NvStreamSrv\MessageBus.dll
Report Id: 5629c2d7-93ec-11e6-8722-0025648bf141

Error: (10/16/2016 06:01:25 PM) (Source: XTUservice) (EventID: 0) (User: )
Description: ------------------------------------------------------------------------------

2016-10-16, 18:01:25.0327241 : Error : Unhandled exception detected while executing virtual device command response.: IdOfEvent: 7 | IdOfItem: IOH_VOLTAGE | Status: ErrorResponse | Return Value: Intel.PerfTune.DeviceData.SmbusByteItemData`1[System.Single]

Error: (10/16/2016 06:01:25 PM) (Source: XTUservice) (EventID: 0) (User: )
Description: ------------------------------------------------------------------------------

2016-10-16, 18:01:25.0327241 : Error : Unhandled exception detected while executing virtual device command response.: IdOfEvent: 11 | IdOfItem: MEMORY_VOLTAGE | Status: ErrorResponse | Return Value: Intel.PerfTune.DeviceData.SmbusByteItemData`1[System.Single]

Error: (10/16/2016 06:01:25 PM) (Source: XTUservice) (EventID: 0) (User: )
Description: ------------------------------------------------------------------------------

2016-10-16, 18:01:25.0327241 : Error : Unhandled exception detected while executing virtual device command response.: IdOfEvent: 4 | IdOfItem: RESERVED_ITEM_VOLTAGE_START | Status: ErrorResponse | Return Value: Intel.PerfTune.DeviceData.SmbusByteItemData`1[System.Single]

Error: (10/16/2016 06:01:25 PM) (Source: XTUservice) (EventID: 0) (User: )
Description: ------------------------------------------------------------------------------

2016-10-16, 18:01:25.0327241 : Error : Unhandled exception detected while executing virtual device command response.: IdOfEvent: 9 | IdOfItem: QPI_VOLTAGE | Status: ErrorResponse | Return Value: Intel.PerfTune.DeviceData.SmbusByteItemData`1[System.Single]

Error: (10/16/2016 06:01:23 PM) (Source: XTUservice) (EventID: 0) (User: )
Description: ------------------------------------------------------------------------------

2016-10-16, 18:01:23.4259213 : Error : Unhandled exception detected while executing virtual device command response.: IdOfEvent: 1 | IdOfItem: HOST_CLOCK_FREQUENCY | Status: ErrorSending, ErrorResponse | Return Value: NULL

Error: (10/16/2016 03:11:36 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

Details:
AddLegacyDriverFiles: Unable to back up image of binary epp.

System Error:
The system cannot find the file specified.
.

Error: (10/15/2016 11:57:29 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

Details:
AddLegacyDriverFiles: Unable to back up image of binary epp.

System Error:
The system cannot find the file specified.
.

Error: (10/12/2016 07:37:15 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied.
.
This is often caused by incorrect security settings in either the writer or requestor process.


Operation:
Gathering Writer Data

Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {fb053c05-0ba8-4aaf-83c0-b7a49ff2879e}


System errors:
=============
Error: (10/16/2016 11:20:27 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: The name "TREVOR-PC :0" could not be registered on the interface with IP address 192.168.2.10.
The computer with the IP address 192.168.2.12 did not allow the name to be claimed by
this computer.

Error: (10/16/2016 06:39:14 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: The name "TREVOR-PC :0" could not be registered on the interface with IP address 192.168.2.10.
The computer with the IP address 192.168.2.12 did not allow the name to be claimed by
this computer.

Error: (10/16/2016 06:37:46 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: The name "TREVOR-PC :0" could not be registered on the interface with IP address 192.168.2.10.
The computer with the IP address 192.168.2.12 did not allow the name to be claimed by
this computer.

Error: (10/16/2016 06:33:48 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: The name "TREVOR-PC :0" could not be registered on the interface with IP address 192.168.2.10.
The computer with the IP address 192.168.2.12 did not allow the name to be claimed by
this computer.

Error: (10/16/2016 06:32:57 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: The name "TREVOR-PC :0" could not be registered on the interface with IP address 192.168.2.10.
The computer with the IP address 192.168.2.12 did not allow the name to be claimed by
this computer.

Error: (10/16/2016 06:30:45 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: The name "TREVOR-PC :0" could not be registered on the interface with IP address 192.168.2.10.
The computer with the IP address 192.168.2.12 did not allow the name to be claimed by
this computer.

Error: (10/16/2016 06:02:33 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The Intel(R) Extreme Tuning Utility service hung on starting.

Error: (10/16/2016 06:00:44 PM) (Source: NetBT) (EventID: 4321) (User: )
Description: The name "TREVOR-PC :20" could not be registered on the interface with IP address 192.168.2.10.
The computer with the IP address 192.168.2.12 did not allow the name to be claimed by
this computer.

Error: (10/16/2016 06:00:44 PM) (Source: Server) (EventID: 2505) (User: )
Description: The server could not bind to the transport \Device\NetBT_Tcpip_{79904027-AA3E-4099-9322-97F672ACDDDC} because another computer on the network has the same name. The server could not start.

Error: (10/16/2016 05:59:38 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The mrtRate service failed to start due to the following error:
This driver has been blocked from loading


CodeIntegrity:
===================================
Date: 2016-10-11 12:40:49.574
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2016-10-11 12:40:49.473
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-10-08 11:06:17.130
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.

Date: 2014-10-08 11:01:02.788
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.

Date: 2014-10-08 08:44:05.417
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.

Date: 2014-10-07 22:37:27.766
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.

Date: 2014-10-07 22:18:46.621
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.

Date: 2014-10-07 21:54:49.403
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.

Date: 2014-10-07 20:50:56.278
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.

Date: 2014-10-07 19:43:35.002
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i7 CPU 920 @ 2.67GHz
Percentage of memory in use: 31%
Total physical RAM: 12278.93 MB
Available physical RAM: 8358.02 MB
Total Virtual: 24556.04 MB
Available Virtual: 20481.85 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:587.91 GB) (Free:205.98 GB) NTFS
Drive e: () (Fixed) (Total:229.67 GB) (Free:155.37 GB) NTFS
Drive f: (My Book) (Fixed) (Total:931.28 GB) (Free:920.87 GB) FAT32
Drive g: (1 TB Hard Drive) (Fixed) (Total:931.51 GB) (Free:703.3 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 596.2 GB) (Disk ID: 5BB6E660)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Active) - (Size=8.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=587.9 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 232.8 GB) (Disk ID: 41AB2316)
Partition 1: (Not Active) - (Size=55 MB) - (Type=DE)
Partition 2: (Active) - (Size=229.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=3.1 GB) - (Type=DB)

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: C671211A)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

========================================================
Disk: 3 (Size: 931.5 GB) (Disk ID: E8900690)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=0C)

==================== End of Addition.txt ============================
 
Download attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST(FRST64) and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.
 

Attachments

  • fixlist.txt
    9.8 KB · Views: 1
Here's the Fixlog.txt:

Fix result of Farbar Recovery Scan Tool (x64) Version: 13-10-2016
Ran by Trevor (18-10-2016 11:47:57) Run:1
Running from C:\Users\Trevor\Desktop
Loaded Profiles: Trevor (Available Profiles: Trevor)
Boot Mode: Normal
==============================================

fixlist content:
*****************
HKLM-x32\...\Run: [] => [X]
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-1645592776-1552282287-2170224798-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
SearchScopes: HKLM-x32 -> DefaultScope value is missing
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll => No File
BHO-x32: No Name -> {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -> No File
FF Extension: (No Name) - C:\Users\Trevor\AppData\Roaming\Mozilla\Firefox\Profiles\onsugnew.default\extensions\gmailnoads@mywebber.com.xpi [not found]
FF Extension: (No Name) - C:\Users\Trevor\AppData\Roaming\Mozilla\Firefox\Profiles\onsugnew.default\extensions\tinyurl.addon@fast-chat.co.uk.xpi [not found]
FF Extension: (No Name) - C:\Users\Trevor\AppData\Roaming\Mozilla\Firefox\Profiles\onsugnew.default\extensions\viewastext@john.tyree.xpi [not found]
FF Extension: (No Name) - C:\Users\Trevor\AppData\Roaming\Mozilla\Firefox\Profiles\onsugnew.default\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3} [not found]
FF Extension: (No Name) - C:\Users\Trevor\AppData\Roaming\Mozilla\Firefox\Profiles\onsugnew.default\extensions\amznUWL2@amazon.com.xpi [not found]
FF Extension: (No Name) - C:\Users\Trevor\AppData\Roaming\Mozilla\Firefox\Profiles\onsugnew.default\extensions\status4evar@caligonstudios.com.xpi [not found]
FF Extension: (No Name) - C:\Users\Trevor\AppData\Roaming\Mozilla\Firefox\Profiles\onsugnew.default\extensions\foxyproxy@eric.h.jung [not found]
FF Extension: (No Name) - C:\Users\Trevor\AppData\Roaming\Mozilla\Firefox\Profiles\onsugnew.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [not found]
FF Extension: (No Name) - C:\Users\Trevor\AppData\Roaming\Mozilla\Firefox\Profiles\onsugnew.default\extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F} [not found]
FF Extension: (No Name) - C:\Users\Trevor\AppData\Roaming\Mozilla\Firefox\Profiles\onsugnew.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [not found]
FF Extension: (No Name) - C:\Program Files (x86)\Common Files\McAfee\SystemCore [not found]
FF Extension: (No Name) - C:\Users\Trevor\AppData\Roaming\Mozilla\Firefox\Profiles\onsugnew.default\extensions\{d62bb6fa-7192-47fd-b640-ad8855c444f3}.xpi [not found]
FF Extension: (No Name) - C:\Users\Trevor\AppData\Roaming\Mozilla\Firefox\Profiles\onsugnew.default\extensions\youtube-cinemode@gmail.com.xpi [not found]
FF Extension: (No Name) - C:\Users\Trevor\AppData\Roaming\Mozilla\Firefox\Profiles\onsugnew.default\extensions\firefoxaddon@youtubeenhancer.com [not found]
FF Extension: (No Name) - C:\Users\Trevor\AppData\Roaming\Mozilla\Firefox\Profiles\onsugnew.default\extensions\support@lastpass.com [not found]
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor => not found
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_22_0_0_192.dll [No File]
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_22_0_0_192.dll [No File]
FF Plugin-x32: @mcafee.com/SAFFPlugin -> C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll [No File]
FF Plugin HKU\S-1-5-21-1645592776-1552282287-2170224798-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Trevor\AppData\Local\Google\Update\1.3.30.3\npGoogleUpdate3.dll [No File]
FF Plugin HKU\S-1-5-21-1645592776-1552282287-2170224798-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Trevor\AppData\Local\Google\Update\1.3.30.3\npGoogleUpdate3.dll [No File]
S2 HOSTS Anti-PUPs; C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware.exe -update [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 cpuz130; \??\C:\Users\Trevor\AppData\Local\Temp\cpuz130\cpuz_x64.sys [X]
S3 cpuz135; \??\C:\Windows\TEMP\cpuz135\cpuz135_x64.sys [X]
R4 IOMap; \??\C:\Windows\system32\drivers\IOMap64.sys [X]
S3 MREMP50; \??\C:\PROGRA~2\COMMON~1\Motive\MREMP50.SYS [X]
S3 MREMP50a64; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS [X]
S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [X]
S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [X]
S3 MRESP50; \??\C:\PROGRA~2\COMMON~1\Motive\MRESP50.SYS [X]
S3 MRESP50a64; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS [X]
2013-06-27 03:32 - 2013-10-02 15:33 - 0003726 _____ () C:\Program Files (x86)\Mozilla Firefoxavg-secure-search.xml
2013-05-30 21:57 - 2013-05-30 22:08 - 0004744 _____ () C:\Users\Trevor\AppData\Roaming\RegistrationLog.log
2013-05-30 21:57 - 2013-05-30 22:08 - 0002983 _____ () C:\Users\Trevor\AppData\Roaming\ReplayMusicLog.log
2014-06-15 14:50 - 2014-06-15 14:50 - 0001675 _____ () C:\Users\Trevor\AppData\Roaming\SAS7_000.DAT
2014-07-22 12:10 - 2014-07-22 12:10 - 0193994 _____ () C:\Users\Trevor\AppData\Local\ars.cache
2014-07-22 12:10 - 2014-07-22 12:10 - 0309823 _____ () C:\Users\Trevor\AppData\Local\census.cache
2012-02-21 04:22 - 2012-02-24 05:51 - 0005632 _____ () C:\Users\Trevor\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-09-10 17:45 - 2012-09-10 17:45 - 0027520 _____ () C:\Users\Trevor\AppData\Local\dt.dat
2014-07-22 11:54 - 2014-07-22 11:54 - 0000036 _____ () C:\Users\Trevor\AppData\Local\housecall.guid.cache
2010-02-13 16:08 - 2016-10-09 23:39 - 0000000 _____ () C:\Users\Trevor\AppData\Local\prvlcl.dat
2011-04-01 01:43 - 2015-12-19 07:04 - 0007598 _____ () C:\Users\Trevor\AppData\Local\Resmon.ResmonCfg
2014-07-22 12:01 - 2014-07-22 12:01 - 0000010 _____ () C:\Users\Trevor\AppData\Local\sponge.last.runtime.cache
CustomCLSID: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\Trevor\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000_Classes\CLSID\{1423F872-3F7F-4E57-B621-8B1A9D49B448}\InprocServer32 -> C:\Users\Trevor\AppData\Local\Google\Update\1.3.27.5\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Trevor\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000_Classes\CLSID\{590C4387-5EBD-4D46-8A84-CD0BA2EF2856}\InprocServer32 -> C:\Users\Trevor\AppData\Local\Google\Update\1.3.30.3\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000_Classes\CLSID\{5C8C2A98-6133-4EBA-BBCC-34D9EA01FC2E}\InprocServer32 -> C:\Users\Trevor\AppData\Local\Google\Update\1.3.28.1\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000_Classes\CLSID\{78550997-5DEF-4A8A-BAF9-D5774E87AC98}\InprocServer32 -> C:\Users\Trevor\AppData\Local\Google\Update\1.3.28.13\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000_Classes\CLSID\{793EE463-1304-471C-ADF1-68C2FFB01247}\InprocServer32 -> C:\Users\Trevor\AppData\Local\Google\Update\1.3.29.5\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Trevor\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\Trevor\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000_Classes\CLSID\{CC182BE1-84CE-4A57-B85C-FD4BBDF78CB2}\InprocServer32 -> C:\Users\Trevor\AppData\Local\Google\Update\1.3.29.1\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\Trevor\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000_Classes\CLSID\{D1EDC4F5-7F4D-4B12-906A-614ECF66DDAF}\InprocServer32 -> C:\Users\Trevor\AppData\Local\Google\Update\1.3.28.15\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Trevor\AppData\Local\Google\Update\1.3.30.3\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-1645592776-1552282287-2170224798-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Trevor\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll => No File
Task: {2F57269B-1E09-4E2D-AB1E-B0FDAC7D279C} - \Microsoft\Windows\WindowsBackup\ConfigNotification -> No File <==== ATTENTION
Task: {90EFBBC7-D531-4B4F-A061-8AF917C5B3C9} - \IHUninstallTrackingTASK -> No File <==== ATTENTION
Task: {AB67A2DA-B34F-409C-98A6-EE1B71CA7A11} - \Microsoft\Windows\Windows Activation Technologies\ValidationTaskDeadline -> No File <==== ATTENTION
Task: {AC4E5ACF-89F7-4220-BA21-81EE183975E2} - \Microsoft\Windows\Application Experience\AitAgent -> No File <==== ATTENTION
Task: {CEE64558-E1A7-4D9D-80A7-2001912BE5B5} - \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector -> No File <==== ATTENTION
Task: {E0266165-9478-4F56-A3FC-F1450F174B54} - \Microsoft\Windows\Windows Activation Technologies\ValidationTask -> No File <==== ATTENTION
Task: {E25AFC50-B92B-41C9-8128-77DDAABED012} - System32\Tasks\IHSelfDeleteTASK => /C DEL C:\Users\Trevor\AppData\Local\Temp\IHUB389.tmp.exe <==== ATTENTION
C:\Users\Trevor\AppData\Local\Temp\IHUB389.tmp.exe
Task: {FA2BC0A6-8D4B-458A-85C8-2B8C72487513} - \Microsoft\Windows\MemoryDiagnostic\DecompressionFailureDetector -> No File <==== ATTENTION
AlternateDataStreams: C:\ProgramData\Temp:0FF263E8 [123]
AlternateDataStreams: C:\ProgramData\Temp:5C321E34 [125]

*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value removed successfully
C:\Windows\system32\GroupPolicy\Machine => moved successfully
C:\Windows\system32\GroupPolicy\GPT.ini => moved successfully
C:\Windows\SysWOW64\GroupPolicy\GPT.ini => moved successfully
"HKLM\SOFTWARE\Policies\Google" => key removed successfully
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully
"HKU\S-1-5-21-1645592776-1552282287-2170224798-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}" => key removed successfully
"HKCR\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}" => key removed successfully
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}" => key removed successfully
HKCR\Wow6432Node\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} => key not found.
C:\Users\Trevor\AppData\Roaming\Mozilla\Firefox\Profiles\onsugnew.default\extensions\gmailnoads@mywebber.com.xpi => path removed successfully
C:\Users\Trevor\AppData\Roaming\Mozilla\Firefox\Profiles\onsugnew.default\extensions\tinyurl.addon@fast-chat.co.uk.xpi => path removed successfully
C:\Users\Trevor\AppData\Roaming\Mozilla\Firefox\Profiles\onsugnew.default\extensions\viewastext@john.tyree.xpi => path removed successfully
C:\Users\Trevor\AppData\Roaming\Mozilla\Firefox\Profiles\onsugnew.default\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3} => path removed successfully
C:\Users\Trevor\AppData\Roaming\Mozilla\Firefox\Profiles\onsugnew.default\extensions\amznUWL2@amazon.com.xpi => path removed successfully
C:\Users\Trevor\AppData\Roaming\Mozilla\Firefox\Profiles\onsugnew.default\extensions\status4evar@caligonstudios.com.xpi => path removed successfully
C:\Users\Trevor\AppData\Roaming\Mozilla\Firefox\Profiles\onsugnew.default\extensions\foxyproxy@eric.h.jung => path removed successfully
C:\Users\Trevor\AppData\Roaming\Mozilla\Firefox\Profiles\onsugnew.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} => path removed successfully
C:\Users\Trevor\AppData\Roaming\Mozilla\Firefox\Profiles\onsugnew.default\extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F} => path removed successfully
C:\Users\Trevor\AppData\Roaming\Mozilla\Firefox\Profiles\onsugnew.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi => path removed successfully
C:\Program Files (x86)\Common Files\McAfee\SystemCore => path removed successfully
C:\Users\Trevor\AppData\Roaming\Mozilla\Firefox\Profiles\onsugnew.default\extensions\{d62bb6fa-7192-47fd-b640-ad8855c444f3}.xpi => path removed successfully
C:\Users\Trevor\AppData\Roaming\Mozilla\Firefox\Profiles\onsugnew.default\extensions\youtube-cinemode@gmail.com.xpi => path removed successfully
C:\Users\Trevor\AppData\Roaming\Mozilla\Firefox\Profiles\onsugnew.default\extensions\firefoxaddon@youtubeenhancer.com => path removed successfully
C:\Users\Trevor\AppData\Roaming\Mozilla\Firefox\Profiles\onsugnew.default\extensions\support@lastpass.com => path removed successfully
HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92} => value removed successfully
"HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer" => key removed successfully
"HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer" => key removed successfully
"HKLM\Software\Wow6432Node\MozillaPlugins\@mcafee.com/SAFFPlugin" => key removed successfully
"HKU\S-1-5-21-1645592776-1552282287-2170224798-1000\Software\MozillaPlugins\@tools.google.com/Google Update;version=3" => key removed successfully
C:\Users\Trevor\AppData\Local\Google\Update\1.3.30.3\npGoogleUpdate3.dll => not found.
"HKU\S-1-5-21-1645592776-1552282287-2170224798-1000\Software\MozillaPlugins\@tools.google.com/Google Update;version=9" => key removed successfully
C:\Users\Trevor\AppData\Local\Google\Update\1.3.30.3\npGoogleUpdate3.dll => not found.
HOSTS Anti-PUPs => service removed successfully
catchme => service removed successfully
cpuz130 => service removed successfully
cpuz135 => service removed successfully
IOMap => Unable to stop service.
IOMap => service could not remove
MREMP50 => service removed successfully
MREMP50a64 => service removed successfully
MREMPR5 => service removed successfully
MRENDIS5 => service removed successfully
MRESP50 => service removed successfully
MRESP50a64 => service removed successfully
C:\Program Files (x86)\Mozilla Firefoxavg-secure-search.xml => moved successfully
C:\Users\Trevor\AppData\Roaming\RegistrationLog.log => moved successfully
C:\Users\Trevor\AppData\Roaming\ReplayMusicLog.log => moved successfully
C:\Users\Trevor\AppData\Roaming\SAS7_000.DAT => moved successfully
C:\Users\Trevor\AppData\Local\ars.cache => moved successfully
C:\Users\Trevor\AppData\Local\census.cache => moved successfully
C:\Users\Trevor\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini => moved successfully
C:\Users\Trevor\AppData\Local\dt.dat => moved successfully
C:\Users\Trevor\AppData\Local\housecall.guid.cache => moved successfully
C:\Users\Trevor\AppData\Local\prvlcl.dat => moved successfully
C:\Users\Trevor\AppData\Local\Resmon.ResmonCfg => moved successfully
C:\Users\Trevor\AppData\Local\sponge.last.runtime.cache => moved successfully
"HKU\S-1-5-21-1645592776-1552282287-2170224798-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}" => key removed successfully
"HKU\S-1-5-21-1645592776-1552282287-2170224798-1000_Classes\CLSID\{1423F872-3F7F-4E57-B621-8B1A9D49B448}" => key removed successfully
"HKU\S-1-5-21-1645592776-1552282287-2170224798-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}" => key removed successfully
"HKU\S-1-5-21-1645592776-1552282287-2170224798-1000_Classes\CLSID\{590C4387-5EBD-4D46-8A84-CD0BA2EF2856}" => key removed successfully
"HKU\S-1-5-21-1645592776-1552282287-2170224798-1000_Classes\CLSID\{5C8C2A98-6133-4EBA-BBCC-34D9EA01FC2E}" => key removed successfully
"HKU\S-1-5-21-1645592776-1552282287-2170224798-1000_Classes\CLSID\{78550997-5DEF-4A8A-BAF9-D5774E87AC98}" => key removed successfully
"HKU\S-1-5-21-1645592776-1552282287-2170224798-1000_Classes\CLSID\{793EE463-1304-471C-ADF1-68C2FFB01247}" => key removed successfully
"HKU\S-1-5-21-1645592776-1552282287-2170224798-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}" => key removed successfully
"HKU\S-1-5-21-1645592776-1552282287-2170224798-1000_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}" => key removed successfully
"HKU\S-1-5-21-1645592776-1552282287-2170224798-1000_Classes\CLSID\{CC182BE1-84CE-4A57-B85C-FD4BBDF78CB2}" => key removed successfully
"HKU\S-1-5-21-1645592776-1552282287-2170224798-1000_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}" => key removed successfully
"HKU\S-1-5-21-1645592776-1552282287-2170224798-1000_Classes\CLSID\{D1EDC4F5-7F4D-4B12-906A-614ECF66DDAF}" => key removed successfully
"HKU\S-1-5-21-1645592776-1552282287-2170224798-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}" => key removed successfully
"HKU\S-1-5-21-1645592776-1552282287-2170224798-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2F57269B-1E09-4E2D-AB1E-B0FDAC7D279C}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2F57269B-1E09-4E2D-AB1E-B0FDAC7D279C}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\WindowsBackup\ConfigNotification" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{90EFBBC7-D531-4B4F-A061-8AF917C5B3C9}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{90EFBBC7-D531-4B4F-A061-8AF917C5B3C9}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\IHUninstallTrackingTASK" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{AB67A2DA-B34F-409C-98A6-EE1B71CA7A11}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AB67A2DA-B34F-409C-98A6-EE1B71CA7A11}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Windows Activation Technologies\ValidationTaskDeadline" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{AC4E5ACF-89F7-4220-BA21-81EE183975E2}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AC4E5ACF-89F7-4220-BA21-81EE183975E2}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Application Experience\AitAgent" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CEE64558-E1A7-4D9D-80A7-2001912BE5B5}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CEE64558-E1A7-4D9D-80A7-2001912BE5B5}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\MemoryDiagnostic\CorruptionDetector" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E0266165-9478-4F56-A3FC-F1450F174B54}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E0266165-9478-4F56-A3FC-F1450F174B54}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Windows Activation Technologies\ValidationTask" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E25AFC50-B92B-41C9-8128-77DDAABED012}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E25AFC50-B92B-41C9-8128-77DDAABED012}" => key removed successfully
C:\Windows\System32\Tasks\IHSelfDeleteTASK => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\IHSelfDeleteTASK" => key removed successfully
"C:\Users\Trevor\AppData\Local\Temp\IHUB389.tmp.exe" => not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{FA2BC0A6-8D4B-458A-85C8-2B8C72487513}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FA2BC0A6-8D4B-458A-85C8-2B8C72487513}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\MemoryDiagnostic\DecompressionFailureDetector" => key removed successfully
C:\ProgramData\Temp => ":0FF263E8" ADS removed successfully.
C:\ProgramData\Temp => ":5C321E34" ADS removed successfully.


The system needed a reboot.

==== End of Fixlog 11:49:46 ====
 
Last scans...

redtarget.gif
Download Security Check from here or here and save it to your Desktop.
  • Double-click SecurityCheck.exe
  • Follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
NOTE 2. SecurityCheck may produce some false warning(s), so leave the results reading to me.
NOTE 3. If you receive UNSUPPORTED OPERATING SYSTEM! ABORTED! message restart computer and Security Check should run


redtarget.gif
Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
Make sure the following options are checked:
  • Internet Services
  • Windows Firewall
  • System Restore
  • Security Center
  • Windows Update
  • Windows Defender
  • Other Services

Press "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.
Please copy and paste the log to your reply.


redtarget.gif
Download Temp File Cleaner (TFC)
Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe
  • Double click on TFC.exe to run the program.
  • Click on Start button to begin cleaning process.
  • TFC will close all running programs, and it may ask you to restart computer.


redtarget.gif
Download Sophos Free Virus Removal Tool and save it to your desktop.
  • Double click the icon and select Run
  • Click Next
  • Select I accept the terms in this license agreement, then click Next twice
  • Click Install
  • Click Finish to launch the program
  • Once the virus database has been updated click Start Scanning
  • If any threats are found click Details, then View log file... (bottom left hand corner)
  • Copy and paste the results in your reply
  • Close the Notepad document, close the Threat Details screen, then click Start cleanup
  • Click Exit to close the program
 
This is the Security Check log. I'll try to get the other stuff uploaded as soon as I can. Hopefully in a little while if my internet connection continues to hold. At any rate:

Results of screen317's Security Check version 1.014 --- 12/23/15
Windows 7 Service Pack 1 x64 (UAC is disabled!)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Microsoft Security Essentials
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
WinPatrol
MVPS Hosts File
SpywareBlaster 5.5
Spybot - Search & Destroy
SUPERAntiSpyware Professional
Java 8 Update 65
Java version 32-bit out of Date!
Adobe Flash Player 22.0.0.192
Adobe Reader XI
Mozilla Firefox (47.0.1)
Google Chrome (51.0.2704.103)
Google Chrome (51.0.2704.84)
Google Chrome (SetupMetrics.pma..)
````````Process Check: objlist.exe by Laurent````````
Microsoft Security Essentials MSMpEng.exe
Microsoft Security Essentials msseces.exe
WinPatrol winpatrol.exe
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbam.exe
Malwarebytes Anti-Ransomware MB3Service.exe
Malwarebytes Anti-Malware mbamscheduler.exe
Malwarebytes Anti-Ransomware mbarw.exe
Alienware Command Center ThermalController.exe
Ruiware WinPatrol WinPatrol.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 0%
````````````````````End of Log``````````````````````
 
Here's the Farbar Service Scan:

Results of screen317's Security Check version 1.014 --- 12/23/15
Windows 7 Service Pack 1 x64 (UAC is disabled!)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Microsoft Security Essentials
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
WinPatrol
MVPS Hosts File
SpywareBlaster 5.5
Spybot - Search & Destroy
SUPERAntiSpyware Professional
Java 8 Update 65
Java version 32-bit out of Date!
Adobe Flash Player 22.0.0.192
Adobe Reader XI
Mozilla Firefox (47.0.1)
Google Chrome (51.0.2704.103)
Google Chrome (51.0.2704.84)
Google Chrome (SetupMetrics.pma..)
````````Process Check: objlist.exe by Laurent````````
Microsoft Security Essentials MSMpEng.exe
Microsoft Security Essentials msseces.exe
WinPatrol winpatrol.exe
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbam.exe
Malwarebytes Anti-Ransomware MB3Service.exe
Malwarebytes Anti-Malware mbamscheduler.exe
Malwarebytes Anti-Ransomware mbarw.exe
Alienware Command Center ThermalController.exe
Ruiware WinPatrol WinPatrol.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 0%
````````````````````End of Log``````````````````````
 
Sophos Virus Remover Log:

2016-10-19 04:28:10.061 Sophos Virus Removal Tool version 2.5.6
2016-10-19 04:28:10.061 Copyright (c) 2009-2016 Sophos Limited. All rights reserved.

2016-10-19 04:28:10.061 This tool will scan your computer for viruses and other threats. If it finds any, it will give you the option to remove them.

2016-10-19 04:28:10.061 Windows version 6.1 SP 1.0 Service Pack 1 build 7601 SM=0x300 PT=0x1 WOW64
2016-10-19 04:28:10.061 Checking for updates...
2016-10-19 04:28:10.348 Update progress: proxy server not available
2016-10-19 04:28:18.926 Option all = no
2016-10-19 04:28:18.926 Option recurse = yes
2016-10-19 04:28:18.926 Option archive = no
2016-10-19 04:28:18.926 Option service = yes
2016-10-19 04:28:18.926 Option confirm = yes
2016-10-19 04:28:18.926 Option sxl = yes
2016-10-19 04:28:18.927 Option max-data-age = 35
2016-10-19 04:28:18.927 Option vdl-logging = yes
2016-10-19 04:28:18.946 Customer ID: 094260ca9b3af99f9d4a3909fc47a743
2016-10-19 04:28:18.946 Machine ID: a5f822f8839e40db9dbae55d6adeaad8
2016-10-19 04:28:18.947 Component SVRTcli.exe version 2.5.6
2016-10-19 04:28:18.947 Component control.dll version 2.5.6
2016-10-19 04:28:18.948 Component SVRTservice.exe version 2.5.6
2016-10-19 04:28:18.948 Component engine\osdp.dll version 1.44.1.2252
2016-10-19 04:28:18.948 Component engine\veex.dll version 3.65.2.2252
2016-10-19 04:28:18.948 Component engine\savi.dll version 9.0.1.2252
2016-10-19 04:28:18.949 Component rkdisk.dll version 1.5.30.0
2016-10-19 04:28:18.949 Version info: Product version 2.5.6
2016-10-19 04:28:18.949 Version info: Detection engine 3.65.2
2016-10-19 04:28:18.949 Version info: Detection data 5.31
2016-10-19 04:28:18.949 Version info: Build date 06/09/2016
2016-10-19 04:28:18.949 Version info: Data files added 363
2016-10-19 04:28:18.949 Version info: Last successful update (not yet updated)
2016-10-19 04:28:51.406 Downloading updates...
2016-10-19 04:28:51.407 Update progress: [I96736] sdds.svrt_10: adding primary package C1A903B2-E63E-483b-982D-04BB9C457C60 RECOMMENDED baseVersion=1
2016-10-19 04:28:51.407 Update progress: [I95020] sdds.svrt_10: looking for packages included from product C1A903B2-E63E-483b-982D-04BB9C457C60 RECOMMENDED path=
2016-10-19 04:28:51.407 Update progress: [I22529] sdds.svrt_10: looking for supplements included from product C1A903B2-E63E-483b-982D-04BB9C457C60 RECOMMENDED path=
2016-10-19 04:28:51.407 Update progress: [I49502] sdds.savi0910.xml: found supplement SAVIW32 LATEST path= baseVersion= [included from product C1A903B2-E63E-483b-982D-04BB9C457C60 RECOMMENDED path=]
2016-10-19 04:28:51.407 Update progress: [I95020] sdds.savi0910.xml: looking for packages included from product SAVIW32 LATEST path=
2016-10-19 04:28:51.407 Update progress: [I22529] sdds.savi0910.xml: looking for supplements included from product SAVIW32 LATEST path=
2016-10-19 04:28:51.407 Update progress: [I49502] sdds.data0910.xml: found supplement IDE532 LATEST path= baseVersion= [included from product SAVIW32 LATEST path=]
2016-10-19 04:28:51.407 Update progress: [I95020] sdds.data0910.xml: looking for packages included from product IDE532 LATEST path=
2016-10-19 04:28:51.407 Update progress: [I22529] sdds.data0910.xml: looking for supplements included from product IDE532 LATEST path=
2016-10-19 04:28:51.407 Update progress: [I49502] sdds.data0910.xml: found supplement IDE533 LATEST path= baseVersion= [included from product IDE532 LATEST path=]
2016-10-19 04:28:51.407 Update progress: [I95020] sdds.data0910.xml: looking for packages included from product IDE533 LATEST path=
2016-10-19 04:28:51.407 Update progress: [I22529] sdds.data0910.xml: looking for supplements included from product IDE533 LATEST path=
2016-10-19 04:28:51.407 Update progress: [I49502] sdds.data0910.xml: found supplement IDE534 LATEST path= baseVersion= [included from product IDE533 LATEST path=]
2016-10-19 04:28:51.407 Update progress: [I95020] sdds.data0910.xml: looking for packages included from product IDE534 LATEST path=
2016-10-19 04:28:51.407 Update progress: [I22529] sdds.data0910.xml: looking for supplements included from product IDE534 LATEST path=
2016-10-19 04:28:51.407 Update progress: [I19463] Syncing product C1A903B2-E63E-483b-982D-04BB9C457C60 RECOMMENDED path=
2016-10-19 04:28:51.821 Update progress: [I19463] Syncing product SAVIW32 LATEST path=
2016-10-19 04:28:51.821 Update progress: [I19463] Product download size 151406551 bytes
2016-10-19 04:28:55.811 Update progress: [I19463] Syncing product IDE532 LATEST path=
2016-10-19 04:28:55.811 Update progress: [I19463] Product download size 1832805 bytes
2016-10-19 04:28:57.034 Update progress: [I19463] Syncing product IDE533 LATEST path=
2016-10-19 04:28:57.034 Update progress: [I19463] Product download size 2192549 bytes
2016-10-19 04:28:57.656 Update progress: [I19463] Syncing product IDE534 LATEST path=
2016-10-19 04:28:57.656 Update progress: [I19463] Product download size 1034884 bytes
2016-10-19 04:28:59.085 Installing updates...
2016-10-19 04:28:59.686 Error level 1
2016-10-19 04:30:28.360 Update successful
2016-10-19 04:30:36.713 Option all = no
2016-10-19 04:30:36.713 Option recurse = yes
2016-10-19 04:30:36.713 Option archive = no
2016-10-19 04:30:36.713 Option service = yes
2016-10-19 04:30:36.713 Option confirm = yes
2016-10-19 04:30:36.713 Option sxl = yes
2016-10-19 04:30:36.715 Option max-data-age = 35
2016-10-19 04:30:36.715 Option vdl-logging = yes
2016-10-19 04:30:36.749 Customer ID: 094260ca9b3af99f9d4a3909fc47a743
2016-10-19 04:30:36.749 Machine ID: a5f822f8839e40db9dbae55d6adeaad8
2016-10-19 04:30:36.750 Component SVRTcli.exe version 2.5.6
2016-10-19 04:30:36.751 Component control.dll version 2.5.6
2016-10-19 04:30:36.751 Component SVRTservice.exe version 2.5.6
2016-10-19 04:30:36.751 Component engine\osdp.dll version 1.44.1.2252
2016-10-19 04:30:36.751 Component engine\veex.dll version 3.65.2.2252
2016-10-19 04:30:36.751 Component engine\savi.dll version 9.0.1.2252
2016-10-19 04:30:36.752 Component rkdisk.dll version 1.5.30.0
2016-10-19 04:30:36.752 Version info: Product version 2.5.6
2016-10-19 04:30:36.752 Version info: Detection engine 3.65.2
2016-10-19 04:30:36.753 Version info: Detection data 5.31
2016-10-19 04:30:36.753 Version info: Build date 06/09/2016
2016-10-19 04:30:36.753 Version info: Data files added 364
2016-10-19 04:30:36.753 Version info: Last successful update 19/10/2016 12:30:28 AM

2016-10-19 07:44:11.373 Could not open C:\hiberfil.sys
2016-10-19 07:44:11.476 Could not open C:\pagefile.sys
2016-10-19 08:25:29.128 Could not open C:\System Volume Information\{3808876b-c176-4e48-b7ae-04046e6cc752}
2016-10-19 08:25:29.134 Could not open C:\System Volume Information\{940a4c9f-90d2-11e6-b371-0025648bf141}{3808876b-c176-4e48-b7ae-04046e6cc752}
2016-10-19 08:25:29.134 Could not open C:\System Volume Information\{940a4ec7-90d2-11e6-b371-0025648bf141}{3808876b-c176-4e48-b7ae-04046e6cc752}
2016-10-19 08:25:29.134 Could not open C:\System Volume Information\{a7cb131f-93eb-11e6-8722-0025648bf141}{3808876b-c176-4e48-b7ae-04046e6cc752}
2016-10-19 08:25:29.134 Could not open C:\System Volume Information\{e7f738a7-954a-11e6-af05-0025648bf141}{3808876b-c176-4e48-b7ae-04046e6cc752}
2016-10-19 09:04:20.926 Could not open C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb
2016-10-19 09:04:20.927 Could not open C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb
2016-10-19 09:04:27.880 Could not open C:\Windows\System32\config\RegBack\DEFAULT
2016-10-19 09:04:27.881 Could not open C:\Windows\System32\config\RegBack\SAM
2016-10-19 09:04:27.883 Could not open C:\Windows\System32\config\RegBack\SECURITY
2016-10-19 09:04:27.884 Could not open C:\Windows\System32\config\RegBack\SOFTWARE
2016-10-19 09:04:27.885 Could not open C:\Windows\System32\config\RegBack\SYSTEM
2016-10-19 09:13:57.550 Could not open C:\Windows\SysWOW64\mmf.sys
2016-10-19 09:35:08.912 Could not open LOGICAL:0003:00000000
2016-10-19 09:35:08.914 Could not open D:\
2016-10-19 10:35:19.589 >>> Virus 'Mal/FakeAV-CH' found in file G:\Games\Steam\SteamApps\common\Marvel Heroes\UnrealEngine3\Binaries\Win32\GazillionWebHelper\MarvelHeroes_WebHelper.exe
2016-10-19 10:35:19.589 >>> Virus 'Mal/FakeAV-CH' found in file HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell
2016-10-19 10:35:19.589 >>> Virus 'Mal/FakeAV-CH' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
2016-10-19 10:35:19.590 >>> Virus 'Mal/FakeAV-CH' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
2016-10-19 10:35:19.590 >>> Virus 'Mal/FakeAV-CH' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin
2016-10-19 10:35:19.590 >>> Virus 'Mal/FakeAV-CH' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin
2016-10-19 10:35:19.590 >>> Virus 'Mal/FakeAV-CH' found in file HKU\S-1-5-21-1645592776-1552282287-2170224798-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPostRedirect
2016-10-19 10:35:19.590 >>> Virus 'Mal/FakeAV-CH' found in file HKU\S-1-5-21-1645592776-1552282287-2170224798-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPostRedirect
2016-10-19 10:35:19.590 >>> Virus 'Mal/FakeAV-CH' found in file HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnPostRedirect
2016-10-19 10:35:19.590 >>> Virus 'Mal/FakeAV-CH' found in file HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell
2016-10-19 10:39:58.505 Could not check G:\My Documents\Time.doc (corrupt)
2016-10-19 10:51:24.367 The following items will be cleaned up:
2016-10-19 10:51:24.367 Mal/FakeAV-CH
 
After running Sophos, Malware Bytes suddenly reported the following (after previously having not detected or letting these things go):

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 10/19/2016
Scan Time: 3:16 AM
Logfile: Malware Bytes Sophos Detection.txt
Administrator: Yes

Version: 2.2.1.1043
Malware Database: v2016.10.19.03
Rootkit Database: v2016.09.26.02
License: Premium
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Enabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Trevor

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 373205
Time Elapsed: 21 min, 9 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 33
PUP.Optional.AdvanceSystemCare, HKLM\SOFTWARE\CLASSES\CLSID\{2803063F-4B8D-4dc6-8874-D1802487FE2D}, No Action By User, [f11ecfcc6634a69000d436df93726e92],
PUP.Optional.AdvanceSystemCare, HKLM\SOFTWARE\CLASSES\TYPELIB\{60AD0991-ECD4-49dc-B170-8B7E7C60F51B}, No Action By User, [f11ecfcc6634a69000d436df93726e92],
PUP.Optional.AdvanceSystemCare, HKLM\SOFTWARE\CLASSES\INTERFACE\{BA935377-E17C-4475-B1BF-DE3110613A99}, No Action By User, [f11ecfcc6634a69000d436df93726e92],
PUP.Optional.AdvanceSystemCare, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{BA935377-E17C-4475-B1BF-DE3110613A99}, No Action By User, [f11ecfcc6634a69000d436df93726e92],
PUP.Optional.AdvanceSystemCare, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{BA935377-E17C-4475-B1BF-DE3110613A99}, No Action By User, [f11ecfcc6634a69000d436df93726e92],
PUP.Optional.AdvanceSystemCare, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{60AD0991-ECD4-49dc-B170-8B7E7C60F51B}, No Action By User, [f11ecfcc6634a69000d436df93726e92],
PUP.Optional.AdvanceSystemCare, HKLM\SOFTWARE\CLASSES\WOW6432NODE\TYPELIB\{60AD0991-ECD4-49dc-B170-8B7E7C60F51B}, No Action By User, [f11ecfcc6634a69000d436df93726e92],
PUP.Optional.AdvanceSystemCare, HKLM\SOFTWARE\CLASSES\ASCExtMenu.CExtMenu.1, No Action By User, [f11ecfcc6634a69000d436df93726e92],
PUP.Optional.AdvanceSystemCare, HKLM\SOFTWARE\CLASSES\ASCExtMenu.CExtMenu, No Action By User, [f11ecfcc6634a69000d436df93726e92],
PUP.Optional.AdvanceSystemCare, HKLM\SOFTWARE\WOW6432NODE\CLASSES\ASCExtMenu.CExtMenu, No Action By User, [f11ecfcc6634a69000d436df93726e92],
PUP.Optional.AdvanceSystemCare, HKLM\SOFTWARE\CLASSES\WOW6432NODE\ASCExtMenu.CExtMenu, No Action By User, [f11ecfcc6634a69000d436df93726e92],
PUP.Optional.AdvanceSystemCare, HKLM\SOFTWARE\WOW6432NODE\CLASSES\ASCExtMenu.CExtMenu.1, No Action By User, [f11ecfcc6634a69000d436df93726e92],
PUP.Optional.AdvanceSystemCare, HKLM\SOFTWARE\CLASSES\WOW6432NODE\ASCExtMenu.CExtMenu.1, No Action By User, [f11ecfcc6634a69000d436df93726e92],
PUP.Optional.AdvanceSystemCare, HKLM\SOFTWARE\CLASSES\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLEX\CONTEXTMENUHANDLERS\Advanced SystemCare, No Action By User, [34dba5f68317b086f1e4d93c6f96d22e],
PUP.Optional.AdvanceSystemCare, HKLM\SOFTWARE\CLASSES\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}, No Action By User, [34dba5f68317b086f1e4d93c6f96d22e],
PUP.Optional.AdvanceSystemCare, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}, No Action By User, [34dba5f68317b086f1e4d93c6f96d22e],
PUP.Optional.AdvanceSystemCare, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}, No Action By User, [34dba5f68317b086f1e4d93c6f96d22e],
PUP.Optional.AdvanceSystemCare, HKU\S-1-5-21-1645592776-1552282287-2170224798-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}, No Action By User, [34dba5f68317b086f1e4d93c6f96d22e],
PUP.Optional.AdvanceSystemCare, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{645FF040-5081-101B-9F08-00AA002F954E}, No Action By User, [34dba5f68317b086f1e4d93c6f96d22e],
PUP.Optional.AdvanceSystemCare, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{645FF040-5081-101B-9F08-00AA002F954E}, No Action By User, [34dba5f68317b086f1e4d93c6f96d22e],
PUP.Optional.Venis, HKLM\SOFTWARE\CLASSES\DIRECTORY\SHELLEX\CONTEXTMENUHANDLERS\Advanced SystemCare, No Action By User, [28e74b50b4e60d298551db3a7a8b9e62],
PUP.Optional.AdvanceSystemCare, HKLM\SOFTWARE\CLASSES\DRIVE\SHELLEX\CONTEXTMENUHANDLERS\Advanced SystemCare, No Action By User, [9e71ebb0bae0b6807f58b95c669fb050],
PUP.Optional.AdvanceSystemCare, HKLM\SOFTWARE\CLASSES\LNKFILE\SHELLEX\CONTEXTMENUHANDLERS\Advanced SystemCare, No Action By User, [d936f9a25c3ed95deaee997cfc09f10f],
PUP.Optional.Venis, HKLM\SOFTWARE\CLASSES\WOW6432NODE\DIRECTORY\SHELLEX\CONTEXTMENUHANDLERS\Advanced SystemCare, No Action By User, [ac63acef47537eb8c5118c89cb3a738d],
PUP.Optional.AdvanceSystemCare, HKLM\SOFTWARE\CLASSES\WOW6432NODE\DRIVE\SHELLEX\CONTEXTMENUHANDLERS\Advanced SystemCare, No Action By User, [9b749506a6f4bf7731a6e13412f3f30d],
PUP.Optional.AdvanceSystemCare, HKLM\SOFTWARE\CLASSES\WOW6432NODE\LNKFILE\SHELLEX\CONTEXTMENUHANDLERS\Advanced SystemCare, No Action By User, [67a82e6defab32043b9d6ea713f21ce4],
PUP.Optional.Venis, HKLM\SOFTWARE\WOW6432NODE\CLASSES\DIRECTORY\SHELLEX\CONTEXTMENUHANDLERS\Advanced SystemCare, No Action By User, [26e93d5e4555f04614c27d9808fd4bb5],
PUP.Optional.AdvanceSystemCare, HKLM\SOFTWARE\WOW6432NODE\CLASSES\DRIVE\SHELLEX\CONTEXTMENUHANDLERS\Advanced SystemCare, No Action By User, [8a8505960496c373f9de43d24cb922de],
PUP.Optional.AdvanceSystemCare, HKLM\SOFTWARE\WOW6432NODE\CLASSES\LNKFILE\SHELLEX\CONTEXTMENUHANDLERS\Advanced SystemCare, No Action By User, [78975f3cdcbe9b9b6672c550ac593cc4],
PUP.Optional.AdvanceSystemCare, HKLM\SOFTWARE\WOW6432NODE\IOBIT\Advanced SystemCare, No Action By User, [8e81d0cb396191a5fae18e878e779e62],
PUP.Optional.AdvanceSystemCare, HKLM\SOFTWARE\WOW6432NODE\IOBIT\ASC, No Action By User, [0f00c7d4a8f2f145edefd93c48bd01ff],
PUP.Optional.DriverBooster, HKLM\SOFTWARE\WOW6432NODE\IOBIT\Driver Booster, No Action By User, [17f8fba0f5a5d2648954be57e025f20e],
PUP.Optional.DriverBooster, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Driver Booster_is1, No Action By User, [58b76e2de9b11323746e70a5976ee21e],

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 3
PUP.Optional.DriverBooster, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver Booster 3, No Action By User, [e02f9dfe455503332e97de3724e1f60a],
PUP.Optional.AdvanceSystemCare, C:\Program Files (x86)\Common Files\IObit\Advanced SystemCare, No Action By User, [29e6bbe0801a9e981ba260b5ff0611ef],
PUP.Optional.AdvanceSystemCare, C:\Users\Trevor\AppData\Roaming\IObit\Advanced SystemCare, No Action By User, [52bde8b35a40e254249dc1547491e020],

Files: 4
PUP.Optional.DriverBooster, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver Booster 3\Driver Booster 3.lnk, No Action By User, [e02f9dfe455503332e97de3724e1f60a],
PUP.Optional.DriverBooster, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver Booster 3\Uninstall Driver Booster 3.lnk, No Action By User, [e02f9dfe455503332e97de3724e1f60a],
PUP.Optional.DriverBooster, C:\Users\Public\Desktop\Driver Booster 3.lnk, No Action By User, [8986dac1d6c4f541a0288095e223fc04],
PUP.Optional.AdvanceSystemCare, C:\Users\Trevor\AppData\Roaming\IObit\Advanced SystemCare\Main.ini, No Action By User, [52bde8b35a40e254249dc1547491e020],

Physical Sectors: 0
(No malicious items detected)


(end)
 
These are not malicious.
Just some leftovers form rather not recommended programs like Advanced SystemCare.
You can clean them all.

You posted Security Check log twice.
I still need FSS log.
 
Sorry about that. I'm not sure how that happened. Here's the log:

Farbar Service Scanner Version: 27-01-2016
Ran by Trevor (administrator) on 19-10-2016 at 00:17:45
Running from "C:\Users\Trevor\Desktop"
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Policy:
========================


Action Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcore.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****
 
Your computer is clean

1. This step will remove all cleaning tools we used, it'll reset restore points (so you won't get reinfected by accidentally using some older restore point) and it'll make some other minor adjustments...
This is a very crucial step so make sure you don't skip it.
Download
51a5ce45263de-delfix.png
DelFix by Xplode to your desktop. Delfix will delete all the used tools and logfiles.

Double-click Delfix.exe to start the tool.
Make sure the following items are checked:
  • Activate UAC (optional; some users prefer to keep it off)
  • Remove disinfection tools
  • Create registry backup
  • Purge System Restore
  • Reset system settings
Now click "Run" and wait patiently.
Once finished a logfile will be created. You don't have to attach it to your next reply.

2. Make sure Windows Updates are current.

3. If any trojans, rootkits or bootkits were listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

4. Check if your browser plugins are up to date.
Firefox - https://www.mozilla.org/en-US/plugincheck/
other browsers: https://browsercheck.qualys.com/ (click on "Scan without installing plugin" and then on "Scan now")

5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

7. Run Temporary File Cleaner (TFC), AdwCleaner and Junkware Removal Tool (JRT) weekly (you need to redownload these tools since they were removed by DelFix).

8. Download and install Secunia Personal Software Inspector (PSI): https://www.techspot.com/downloads/4898-secunia-personal-software-inspector-psi.html. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

10. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

11. Read:
How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html
Simple and easy ways to keep your computer safe and secure on the Internet: http://www.bleepingcomputer.com/tutorials/keep-your-computer-safe-online/
About those Toolbars and Add-ons - Potentially Unwanted Programs (PUPs) which change your browser settings: http://www.bleepingcomputer.com/for...curity-questions-best-practices/#entry3187642

12. Please, let me know, how your computer is doing.
 
As a student, I don't have a lot of money you give to you for your services but I'd like to donate at least something. I hope you don't find my contribution insulting and accept it with the gratitude with which it is intended. That being said, I do have a laptop that I want to make sure that nothing is wrong with and will post any suspicious activity that I happen to find on it on here, as well (I'm sure something must be wrong with it, all thing considered). If you're interested in taking up the challenge again, I offer it up for your excellent detailed analysis and trouble-shooting.
 
Thank you for your donation :)
Please create new topic for another computer.
Good luck and stay safe :)
 
Should I be worried that a Microsoft Security Essentials scan just reported and cleaned the Win32/Stallmonitz on two separate occasions (on the 28th and 30th) after the last post in this thread? It reported that it quarantined and cleaned the problem and that no further action was required. Is this some "false positive" (for lack of a better term) that's being reported by MSE or is it something I should still be worried about? I've run another Farbar scan but will only start another topic and post the scan results if you think it necessary.
 
Thanks. This is the file and location detected by Microsoft Security Essentials:

Items:
containerfile:G:\Logo Design Studio\Logo.Design.Studio.Pro.Vector.Edition.v1.5.Incl.Serial\Logo.Design.Studio.Pro.Vector.Edition.v1.5.Incl.Serial.rar
containerfile:G:\Logo Design\Logo.Design.Studio.Pro.Vector.Edition.v1.5.Incl.Serial\Logo.Design.Studio.Pro.Vector.Edition.v1.5.Incl.Serial.rar
file:G:\Logo Design Studio\Logo.Design.Studio.Pro.Vector.Edition.v1.5.Incl.Serial\Logo.Design.Studio.Pro.Vector.Edition.v1.5.Incl.Serial.rar->Autoplay\Docs\setup-LDSV.exe->(UPX)
file:G:\Logo Design Studio\Logo.Design.Studio.Pro.Vector.Edition.v1.5.Incl.Serial\Logo.Design.Studio.Pro.Vector.Edition.v1.5.Incl.Serial.rar->Autoplay\Docs\setup_1.exe->(UPX)
file:G:\Logo Design\Logo.Design.Studio.Pro.Vector.Edition.v1.5.Incl.Serial\Logo.Design.Studio.Pro.Vector.Edition.v1.5.Incl.Serial.rar->Autoplay\Docs\setup-LDSV.exe->(UPX)
file:G:\Logo Design\Logo.Design.Studio.Pro.Vector.Edition.v1.5.Incl.Serial\Logo.Design.Studio.Pro.Vector.Edition.v1.5.Incl.Serial.rar->Autoplay\Docs\setup_1.exe->(UPX)

What's particularly maddening about the whole thing is that I downloaded the software from Summitsoft's own site which, I assumed, would be safe -- or, at least, I thought Summitsoft was the official site of the Logo Design Studio Pro software before you kindly directed me towards using the Web of Trust (WOT) plugin which, of course, I really appreciate and wish I had known about prior to all this trouble starting.

At any rate, once again, thank you for all your time and trouble, into checking in on this once more. I'm not sure if this qualifies as part of the whole "Please, let me know, how your computer is doing" follow up that you made mention of in your final e-mail to me, as my computer hasn't really been acting strangely, but I thought it better to be safe than sorry.

Thanks again.
 
Back