Inactive-A Windows 7 Start Recovery Loop Virus and Other?

[Tyler Olsen]

Was unable to get computer to boot. Kept going to start recovery. Was able to correct with info from SevenForums but want check for possible viruses.

Logs are in two threads due to length:
Here are the logs:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:23-12-2015
Ran by Tyler (administrator) on TYLER-HP (23-12-2015 23:41:08)
Running from C:\Users\Tyler\Desktop
Loaded Profiles: Tyler (Available Profiles: Tyler)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool:

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Advanced Micro Devices) C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Roxio) C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-11] (Oracle Corporation)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [7021880 2015-12-23] (AVAST Software)
HKLM-x32\...\RunOnce: [20150107] => C:\Program Files\AVAST Software\Avast\setup\emupdate\409a18f2-bd6b-4d13-af39-a53ddee07141.exe [183232 2015-12-23] (AVAST Software)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2011-05-31] (EasyBits Software Corp.)
ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-11-04] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-11-04] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-11-04] (Google)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-12-23] (AVAST Software)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{6F6C1F7F-40F9-4570-825E-019054F4CF0C}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1678204619-2015826032-607794690-1001 -> {B4ECF1EC-7A0D-4E36-BD28-B1C2A481F8B6} URL = hxxp://www.bing.com/search?FORM=U038DF&PC=U038&dt=061713&q={searchTerms}&src=IE-SearchBox
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2013-11-15] (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-12-23] (AVAST Software)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2013-11-15] (Oracle Corporation)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-11-15] (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-07-11] (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-12-23] (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-03-01] (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-07-11] (Oracle Corporation)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-03-01] (Microsoft Corporation.)
Toolbar: HKU\S-1-5-21-1678204619-2015826032-607794690-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File

FireFox:
========
FF ProfilePath: C:\Users\Tyler\AppData\Roaming\Mozilla\Firefox\Profiles\45aro5td.default-1423777539203
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_20_0_0_235.dll [2015-12-08] ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2013-11-15] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2013-11-15] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_235.dll [2015-12-08] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll [No File]
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-02-21] ()
FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-07-11] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-07-11] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-05] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-05] (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2010-12-07] ()
FF Plugin HKU\S-1-5-21-1678204619-2015826032-607794690-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Tyler\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2013-11-09] (Unity Technologies ApS)
FF Plugin HKU\S-1-5-21-1678204619-2015826032-607794690-1001: thehappycloud.com/HappyCloudPlugin -> C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll [2013-11-17] (The Happy Cloud)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-12-23]

Chrome:
=======
CHR HomePage: Default -> hxxp://www.msn.com/?pc=U038&ocid=U038DHP&dt=061713
CHR StartupUrls: Default -> "hxxp://www.msn.com/?pc=U038&ocid=U038DHP&dt=061713"
CHR DefaultSearchURL: Default -> hxxps://www.bing.com/search?q={searchTerms}&PC=U316&FORM=CHROMN
CHR DefaultSearchKeyword: Default -> bing.com
CHR DefaultNewTabURL: Default -> hxxps://www.bing.com/chrome/newtab
CHR DefaultSuggestURL: Default -> hxxps://www.bing.com/osjson.aspx?query={searchTerms}&language={language}&PC=U316
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\ppGoogleNaClPluginChrome.dll => No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\pdf.dll => No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.240.7) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll => No File
CHR Plugin: (Java(TM) Platform SE 6 U24) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll => No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll => No File
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll => No File
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll => No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll => No File
CHR Profile: C:\Users\Tyler\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Avast Online Security) - C:\Users\Tyler\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-12-23]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Tyler\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-12-23]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-12-23]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [354304 2011-02-28] (Advanced Micro Devices, Inc.) [File not signed]
R2 AMD Reservation Manager; C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [194496 2010-06-17] (Advanced Micro Devices)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [226440 2015-12-23] (AVAST Software)
R2 ezSharedSvc; C:\Windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS) [File not signed]
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
S4 HPAuto; C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe [682040 2011-02-17] (Hewlett-Packard)
R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2375168 2011-03-07] (Realsil Microelectronics Inc.) [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [28656 2015-12-23] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [97648 2015-12-23] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-12-23] (AVAST Software)
S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65224 2015-12-23] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1055560 2015-12-23] (AVAST Software)
S1 aswSP; C:\Windows\system32\drivers\aswSP.sys [451040 2015-12-23] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [155304 2015-12-23] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [273784 2015-12-23] (AVAST Software)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-12-24 01:59 - 2015-12-24 02:00 - 00000000 ____D C:\Windows\system32\config\mybackup
2015-12-23 23:41 - 2015-12-23 23:43 - 00016064 _____ C:\Users\Tyler\Desktop\FRST.txt
2015-12-23 23:39 - 2015-12-23 23:41 - 00000000 ____D C:\FRST
2015-12-23 23:34 - 2015-12-23 23:34 - 00000000 ____D C:\Users\Tyler\AppData\Roaming\AVAST Software
2015-12-23 23:33 - 2015-12-23 23:33 - 00003924 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2015-12-23 23:33 - 2015-12-23 23:33 - 00001922 _____ C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-12-23 23:33 - 2015-12-23 23:33 - 00000000 ____D C:\Windows\System32\Tasks\AVAST Software
2015-12-23 23:33 - 2015-12-23 23:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-12-23 23:32 - 2015-12-23 23:32 - 00002255 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-12-23 23:32 - 2015-12-23 23:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-12-23 23:31 - 2015-12-23 23:33 - 00451040 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2015-12-23 23:31 - 2015-12-23 23:33 - 00097648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswmonflt.sys
2015-12-23 23:31 - 2015-12-23 23:31 - 02370560 _____ (Farbar) C:\Users\Tyler\Desktop\FRST64.exe
2015-12-23 23:31 - 2015-12-23 23:31 - 01055560 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2015-12-23 23:31 - 2015-12-23 23:31 - 00450504 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.1450931605098
2015-12-23 23:31 - 2015-12-23 23:31 - 00386096 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2015-12-23 23:31 - 2015-12-23 23:31 - 00273784 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
2015-12-23 23:31 - 2015-12-23 23:31 - 00155304 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2015-12-23 23:31 - 2015-12-23 23:31 - 00097648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswmonflt.sys.1450931605098
2015-12-23 23:31 - 2015-12-23 23:31 - 00093528 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2015-12-23 23:31 - 2015-12-23 23:31 - 00065224 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2015-12-23 23:31 - 2015-12-23 23:31 - 00043112 _____ (AVAST Software) C:\Windows\avastSS.scr
2015-12-23 23:31 - 2015-12-23 23:31 - 00028656 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2015-12-23 23:29 - 2015-12-23 23:29 - 00450504 _____ (AVAST Software) C:\Windows\system32\Drivers\orgntxal.sys
2015-12-23 23:29 - 2015-12-23 23:29 - 00000000 ____D C:\ProgramData\AVAST Software
2015-12-23 23:29 - 2015-12-23 23:29 - 00000000 ____D C:\Program Files\AVAST Software
2015-12-23 23:28 - 2015-12-23 23:29 - 161199376 _____ (AVAST Software) C:\Users\Tyler\Downloads\avast_free_antivirus_setup(1).exe
2015-12-23 23:25 - 2015-12-23 23:26 - 161199376 _____ (AVAST Software) C:\Users\Tyler\Downloads\avast_free_antivirus_setup.exe
2015-12-23 23:20 - 2015-12-23 23:20 - 00275208 _____ C:\Windows\Minidump\122315-39951-01.dmp
2015-12-23 20:56 - 2015-02-02 22:30 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-12-18 21:48 - 2015-12-18 21:48 - 00275208 _____ C:\Windows\Minidump\121815-37065-01.dmp
2015-12-08 16:20 - 2015-12-08 19:52 - 00000000 ____D C:\51adb6f5be27b08953c7
2015-12-06 18:09 - 2015-12-06 18:09 - 00275208 _____ C:\Windows\Minidump\120615-29889-01.dmp
2015-12-05 05:24 - 2015-11-20 14:40 - 00163328 _____ C:\Windows\ERDNT.E_E
2015-12-05 05:24 - 2015-11-20 14:40 - 00157696 _____ C:\Windows\ERUNT.exe
2015-12-05 05:24 - 2015-11-20 14:36 - 00004090 _____ C:\Windows\ERUNT.LOC
2015-12-05 05:24 - 2015-11-20 14:36 - 00003275 _____ C:\Windows\ERDNTWIN.LOC
2015-12-05 05:24 - 2015-11-20 14:36 - 00002815 _____ C:\Windows\ERDNTDOS.LOC
2015-12-03 15:09 - 2015-12-03 15:09 - 00275208 _____ C:\Windows\Minidump\120315-69280-01.dmp

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-12-24 01:54 - 2015-04-05 18:30 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-12-24 01:54 - 2015-04-05 18:30 - 00000000 ___SD C:\Windows\system32\GWX
2015-12-24 01:54 - 2014-12-10 03:25 - 00000000 ____D C:\Windows\system32\appraiser
2015-12-24 01:54 - 2014-05-06 19:03 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-12-24 01:54 - 2013-06-26 20:21 - 00000000 ____D C:\Program Files (x86)\Steam
2015-12-24 01:54 - 2013-05-29 18:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-12-24 01:54 - 2013-05-29 18:58 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-12-24 01:54 - 2013-05-29 18:58 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2015-12-24 01:54 - 2011-05-31 14:59 - 00000000 ____D C:\ProgramData\RoxioNow
2015-12-24 01:54 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\Dism
2015-12-24 01:54 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\system32\Dism
2015-12-24 01:54 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\servicing
2015-12-24 01:54 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-12-24 01:54 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\inf
2015-12-24 01:54 - 2009-07-13 22:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2015-12-24 01:52 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\registration
2015-12-23 23:39 - 2009-07-13 22:20 - 00000000 ____D C:\Windows
2015-12-23 23:33 - 2015-08-21 07:42 - 00000000 ____D C:\Program Files\Common Files\AV
2015-12-23 23:32 - 2013-05-19 12:41 - 00000000 ____D C:\Program Files (x86)\Google
2015-12-23 23:29 - 2009-07-13 23:45 - 00032064 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-12-23 23:29 - 2009-07-13 23:45 - 00032064 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-12-23 23:21 - 2013-05-19 12:41 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-12-23 23:21 - 2009-07-14 00:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-12-23 23:20 - 2013-06-17 14:14 - 559640583 _____ C:\Windows\MEMORY.DMP
2015-12-23 23:20 - 2013-06-17 14:14 - 00000000 ____D C:\Windows\Minidump
2015-12-23 23:20 - 2011-06-13 09:46 - 00000000 ____D C:\ProgramData\Norton
2015-12-23 23:05 - 2013-05-19 12:03 - 00000000 ____D C:\Users\Tyler
2015-12-20 02:21 - 2013-05-19 12:40 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-12-20 01:58 - 2013-05-19 12:41 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-12-20 00:23 - 2009-07-14 00:13 - 00782510 _____ C:\Windows\system32\PerfStringBackup.INI
2015-12-19 00:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\rescache
2015-12-08 18:21 - 2013-05-19 12:40 - 00796864 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-12-08 18:21 - 2013-05-19 12:40 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-12-08 18:21 - 2013-05-19 12:40 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-12-08 17:10 - 2015-02-25 17:41 - 00000000 ____D C:\Users\Tyler\AppData\Local\Steam
2015-12-05 11:53 - 2013-05-19 12:41 - 00003894 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-12-05 11:53 - 2013-05-19 12:41 - 00003642 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-12-03 01:10 - 2013-05-19 12:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2015-12-02 13:18 - 2010-11-20 22:27 - 00301728 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-11-28 07:04 - 2011-06-13 10:30 - 00000000 ___RD C:\Users\Public\Recorded TV
2015-11-27 03:57 - 2014-11-23 10:59 - 00000000 ____D C:\Users\Tyler\AppData\Local\Battle.net
2015-11-26 19:02 - 2013-06-26 19:14 - 00000000 ____D C:\Users\Tyler\Documents\StarCraft II
2015-11-26 19:02 - 2013-06-26 19:14 - 00000000 ____D C:\Program Files (x86)\StarCraft II
2015-11-26 15:43 - 2013-06-11 19:43 - 00000000 ____D C:\Users\Public\Downloads\Norton
2015-11-26 15:30 - 2014-11-23 10:59 - 00000000 ____D C:\Program Files (x86)\Battle.net

==================== Files in the root of some directories =======

2014-02-26 17:19 - 2014-02-26 17:19 - 4216840 _____ (Microsoft Corporation) C:\Program Files (x86)\Common Files\vcredist.exe
2014-05-13 16:53 - 2014-05-13 16:53 - 0000017 _____ () C:\Users\Tyler\AppData\Local\resmon.resmoncfg
2015-09-01 08:51 - 2015-09-01 08:51 - 0000000 _____ () C:\Users\Tyler\AppData\Local\{3FDC0C10-1031-4610-8702-F62F1EA865E3}
2015-08-23 11:07 - 2015-08-23 11:16 - 0001318 _____ () C:\ProgramData\hpzinstall.log
2014-05-05 16:44 - 2014-05-05 16:44 - 0000113 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
C:\Windows\svchost.exe
ATTENTION ====> Check for partition/boot infection.

Some files in TEMP:
====================
C:\Users\Tyler\AppData\Local\Temp\contentDATs.exe
C:\Users\Tyler\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpodovoa.dll
C:\Users\Tyler\AppData\Local\Temp\Extract.exe
C:\Users\Tyler\AppData\Local\Temp\HPHelpUpdater.exe
C:\Users\Tyler\AppData\Local\Temp\ICReinstall_Firefox_Setup_21.0.exe
C:\Users\Tyler\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\Tyler\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Tyler\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Tyler\AppData\Local\Temp\mssinstaller.exe
C:\Users\Tyler\AppData\Local\Temp\PCPTUpdate.exe
C:\Users\Tyler\AppData\Local\Temp\Resource.exe
C:\Users\Tyler\AppData\Local\Temp\SecurityScan_Release.exe
C:\Users\Tyler\AppData\Local\Temp\SP53394.exe
C:\Users\Tyler\AppData\Local\Temp\SP55040.exe
C:\Users\Tyler\AppData\Local\Temp\SP55151.exe
C:\Users\Tyler\AppData\Local\Temp\SP55152.exe
C:\Users\Tyler\AppData\Local\Temp\SP56878.exe
C:\Users\Tyler\AppData\Local\Temp\SP56929.exe
C:\Users\Tyler\AppData\Local\Temp\SP57538.exe
C:\Users\Tyler\AppData\Local\Temp\sp58915.exe
C:\Users\Tyler\AppData\Local\Temp\SP60593.exe
C:\Users\Tyler\AppData\Local\Temp\sp64126.exe
C:\Users\Tyler\AppData\Local\Temp\UninstallHPSA.exe
C:\Users\Tyler\AppData\Local\Temp\UninstallHPTCA.exe
C:\Users\Tyler\AppData\Local\Temp\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}_NIS_7707.exe


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

TDL4: custom:26000022 <===== ATTENTION


LastRegBack: 2015-12-16 21:58

==================== End of FRST.txt ============================

 

[Tyler Olsen]

Here is the other log:

Additional scan result of Farbar Recovery Scan Tool (x64) Version:23-12-2015
Ran by Tyler (2015-12-23 23:44:05)
Running from C:\Users\Tyler\Desktop
Windows 7 Home Premium Service Pack 1 (X64) (2013-05-19 17:03:23)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-1678204619-2015826032-607794690-500 - Administrator - Disabled)
Guest (S-1-5-21-1678204619-2015826032-607794690-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1678204619-2015826032-607794690-1003 - Limited - Enabled)
Tyler (S-1-5-21-1678204619-2015826032-607794690-1001 - Administrator - Enabled) => C:\Users\Tyler

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 20 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 20.0.0.228 - Adobe Systems Incorporated)
Adobe Flash Player 20 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 20.0.0.235 - Adobe Systems Incorporated)
Adobe Reader X MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.0.0 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.5 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.5.9.620 - Adobe Systems, Inc.)
Agatha Christie - Peril at End House (x32 Version: 2.2.0.95 - WildTangent) Hidden
Age of Empires II: HD Edition (HKLM-x32\...\Steam App 221380) (Version: - Hidden Path Entertainment, Ensemble Studios)
Apple Application Support (32-bit) (HKLM-x32\...\{7FE25256-B7C1-480D-B736-10A67A833AEA}) (Version: 3.2 - Apple Inc.)
Apple Application Support (HKLM-x32\...\{D9DAD0FF-495A-472B-9F10-BAE430A26682}) (Version: 3.0.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ATI Catalyst Install Manager (HKLM\...\{7FBA6627-88F8-0AE0-9326-FB8488DD26E0}) (Version: 3.0.812.0 - ATI Technologies, Inc.)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 11.1.2245 - AVAST Software)
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
BeamNG-Techdemo-0.3 (remove only) (HKU\S-1-5-21-1678204619-2015826032-607794690-1001\...\BeamNG-Techdemo-0.3) (Version: - )
Bejeweled 2 Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Bejeweled 3 (x32 Version: 2.2.0.95 - WildTangent) Hidden
Bing Bar (HKLM-x32\...\{1E03DB52-D5CB-4338-A338-E526DD4D4DB1}) (Version: 7.0.610.0 - Microsoft Corporation)
Blackhawk Striker 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
Blasterball 3 (x32 Version: 2.2.0.95 - WildTangent) Hidden
Blio (HKLM-x32\...\{9368DDD5-CE7F-4BD7-A83A-F00FABE338EC}) (Version: 2.2.6699 - K-NFB Reading Technology, Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Bounce Symphony (x32 Version: 2.2.0.95 - WildTangent) Hidden
Build-a-lot 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
Cake Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden
ccc-core-static (x32 Version: 2011.0228.1151.21177 - ATI) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Classic PDF Editor 12.0 (HKLM-x32\...\Classic PDF Editor_is1) (Version: - )
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.1.3922 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.95 - WildTangent) Hidden
Dora's World Adventure (x32 Version: 2.2.0.95 - WildTangent) Hidden
Dota 2 (HKLM-x32\...\Steam App 570) (Version: - Valve)
Dota 2 Test (HKLM-x32\...\Steam App 205790) (Version: - )
Energy Star Digital Logo (HKLM-x32\...\{BD1A34C9-4764-4F79-AE1F-112F8C89D3D4}) (Version: 1.0.1 - Hewlett-Packard)
ESU for Microsoft Windows 7 (HKLM-x32\...\{3877C901-7B90-4727-A639-B6ED2DD59D43}) (Version: 1.0.0 - Hewlett-Packard)
Evernote v. 4.2.2 (HKLM-x32\...\{F761359C-9CED-45AE-9A51-9D6605CD55C4}) (Version: 4.2.2.3979 - Evernote Corp.)
Farm Frenzy (x32 Version: 2.2.0.95 - WildTangent) Hidden
FATE - The Traitor Soul (x32 Version: 2.2.0.95 - WildTangent) Hidden
Garry's Mod (HKLM-x32\...\Steam App 4000) (Version: - Garry)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 47.0.2526.106 - Google Inc.)
Google Drive (HKLM-x32\...\{1C3D2F92-D25E-4D98-B810-3F3B0857BF26}) (Version: 1.26.0707.2863 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.29.1 - Google Inc.) Hidden
Happy Cloud Client (HKU\S-1-5-21-1678204619-2015826032-607794690-1001\...\HappyCloud) (Version: 4.54 - Happy Cloud, Inc.)
HP Connection Manager (HKLM-x32\...\{7A6B4340-7090-418F-8976-EE9650B35550}) (Version: 4.1.22.1 - Hewlett-Packard Company)
HP Documentation (HKLM-x32\...\{6C453C9C-38AE-494D-BF89-7AA0DE87F3E5}) (Version: 1.2.0.0 - Hewlett-Packard)
HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.2.4 - WildTangent)
HP MovieStore (HKLM-x32\...\{9008D736-35CA-40DB-A2BE-5F32D954E5AA}) (Version: 2.0 - Hewlett-Packard)
HP On Screen Display (HKLM-x32\...\{ED1BD69A-07E3-418C-91F1-D856582581BF}) (Version: 1.3.5 - Hewlett-Packard Company)
HP Power Manager (HKLM-x32\...\{E44578C7-4667-4124-8BC2-1161BCA54978}) (Version: 1.4.4 - Hewlett-Packard Company)
HP Quick Launch (HKLM-x32\...\{53B17A98-5BF0-40BC-AAFF-850A357975AC}) (Version: 2.7.2 - Hewlett-Packard Company)
HP Setup (HKLM-x32\...\{210A03F5-B2ED-4947-B27E-516F50CBB292}) (Version: 8.6.4530.3651 - Hewlett-Packard Company)
HP Setup Manager (HKLM-x32\...\{AE856388-AFAD-4753-81DF-D96B19D0A17C}) (Version: 1.1.13253.3682 - Hewlett-Packard Company)
HP Software Framework (HKLM-x32\...\{962CB079-85E6-405F-8704-1C62365AE46F}) (Version: 4.5.10.1 - Hewlett-Packard Company)
iCloud (HKLM\...\{81E20D41-C277-4526-934D-F2380AF91B78}) (Version: 3.1.0.40 - Apple Inc.)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6327.0 - IDT)
iTunes (HKLM\...\{1CF5754A-545B-4360-BFDE-2847BC728DFC}) (Version: 11.2.0.115 - Apple Inc.)
Java 7 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417045FF}) (Version: 7.0.450 - Oracle)
Java 7 Update 65 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.650 - Oracle)
Java(TM) 6 Update 24 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416024FF}) (Version: 6.0.240 - Oracle)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Magic Desktop (HKLM-x32\...\EasyBits Magic Desktop) (Version: 3.0 - EasyBits Software AS)
Magic: The Gathering – Tactics (HKLM-x32\...\Steam App 201190) (Version: - Sony Online Entertainment, LLC.)
Mah Jong Medley (x32 Version: 2.2.0.95 - WildTangent) Hidden
March of War (HKLM-x32\...\Steam App 234310) (Version: - ISOTX)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Mount&Blade (HKLM-x32\...\Mount&Blade) (Version: - )
Mount&Blade Warband (HKLM-x32\...\Mount&Blade Warband) (Version: - )
Mozilla Firefox 40.0.3 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 40.0.3 (x86 en-US)) (Version: 40.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 40.0.3 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Mystery P.I. - Stolen in San Francisco (x32 Version: 2.2.0.95 - WildTangent) Hidden
Namco All-Stars PAC-MAN (x32 Version: 2.2.0.95 - WildTangent) Hidden
OpenOffice 4.1.1 (HKLM-x32\...\{9395F41D-0F80-432E-9A59-B8E477E7E163}) (Version: 4.11.9775 - Apache Software Foundation)
Paint XP version 1.2 (HKLM-x32\...\{2367FAB6-055A-4923-835F-F57F7BBBA363}_is1) (Version: 1.2 - MSPAINTXP.COM)
Pearson IT Certification Practice Test (HKLM-x32\...\Pearson IT Certification Practice Test_is1) (Version: 1.0.0.21 - Pearson IT Certification)
Penguins! (x32 Version: 2.2.0.95 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95 - WildTangent) Hidden
PlayReady PC Runtime x86 (HKLM-x32\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)
Poker Superstars III (x32 Version: 2.2.0.95 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.95 - WildTangent) Hidden
Polar Golfer (x32 Version: 2.2.0.95 - WildTangent) Hidden
Portal 2 (HKLM-x32\...\Steam App 620) (Version: - Valve)
Portal 2 Publishing Tool (HKLM-x32\...\Steam App 644) (Version: - )
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Ralink RT5390 802.11b/g/n WiFi Adapter (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 3.2.13.0 - Ralink)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.46.610.2011 - Realtek)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7600.77 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 2.0.0 - Hewlett-Packard) Hidden
RoxioNow Player (HKLM-x32\...\{0EDEB615-1A60-425E-8306-0E10519C7B55}) (Version: 1.9.5.103 - RoxioNow)
Slingo Supreme (x32 Version: 2.2.0.95 - WildTangent) Hidden
StarCraft II (HKLM-x32\...\StarCraft II) (Version: - Blizzard Entertainment)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.2.7.0 - Synaptics Incorporated)
System Requirements Lab Detection (HKLM-x32\...\{E5F486A0-2AAB-4B32-82E1-36FFBFB06A27}) (Version: 2.0.0.0 - Husdawg, LLC)
Team Fortress 2 (HKLM-x32\...\Steam App 440) (Version: - Valve)
TERA (HKU\S-1-5-21-1678204619-2015826032-607794690-1001\...\teraenmasse) (Version: - )
The Witcher 2: Assassins of Kings Enhanced Edition (HKLM-x32\...\Steam App 20920) (Version: - CD Projekt RED)
The Witcher Enhanced Edition version 1.6 (HKLM-x32\...\The Witcher Enhanced Edition_is1) (Version: 1.6 - CD Projekt RED)
Toribash (HKLM-x32\...\Steam App 248570) (Version: - Nabi Studios)
Unity Web Player (HKU\S-1-5-21-1678204619-2015826032-607794690-1001\...\UnityWebPlayer) (Version: - Unity Technologies ApS)
Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
Vindictus (HKLM-x32\...\Steam App 212160) (Version: - Nexon)
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.95 - WildTangent) Hidden
Warframe (HKLM-x32\...\Steam App 230410) (Version: - Digital Extremes)
Wheel of Fortune 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
WildTangent Games App (HP Games) (x32 Version: 4.0.5.2 - WildTangent) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
WinRAR 4.20 (64-bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
WMV9/VC-1 Video Playback (Version: 1.00.0000 - ATI Technologies Inc.) Hidden
World of Guns: Gun Disassembly (HKLM-x32\...\Steam App 262410) (Version: - Noble Empire Corp.)
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1678204619-2015826032-607794690-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Tyler\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay => No File

==================== Restore Points =========================

20-12-2015 18:52:18 Windows Update
23-12-2015 19:36:10 Windows Update

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 21:34 - 2009-06-10 16:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts


==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {16C5582F-7601-494A-8B32-AE8E5D025976} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2015-12-23] (AVAST Software)
Task: {277E38F3-D563-4650-BFD7-2405B0415030} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2011-03-22] (CyberLink)
Task: {30E091AB-02F0-47E1-9EE6-45F981C49E19} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {428DCFD7-902E-4319-A25C-081CE620076A} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {42ACCD36-B458-478D-89FC-F5E3DF34ADFF} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HPSAObjUtilTask => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\UtilTask.exe
Task: {4EE574B7-3DF3-445F-B9E3-36C085ECD2A6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-10-15] (Hewlett-Packard)
Task: {4F1BC21B-E09F-4DAC-9EE0-95D31E612159} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {555F9802-DDDC-46F5-8D83-1909DB0B3FD7} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-10-15] (Hewlett-Packard)
Task: {833D74F3-C3A5-4195-8D51-2882BEC81961} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
Task: {97F8AAE5-DACA-4853-811A-A6A21985E15F} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {BB03E254-1D23-456A-820C-62A3DE5ADA36} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {C62A5195-EE4F-4E56-81B0-4BD047D9EBC9} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {CC904A7B-B7FF-45F8-B44F-212B10B9EDE6} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {D5835D46-47BA-4166-B757-23DFC04381C5} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-12-08] (Adobe Systems Incorporated)
Task: {E311FF06-9681-41F8-89F9-A43F11000555} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
Task: {E3E2A214-6E94-4968-8CB1-D1FCCF5B046D} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {FEF11329-E2C2-4990-88A5-1F63DEE50D57} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2015-12-23] (AVAST Software)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2011-02-28 14:01 - 2011-02-28 14:01 - 00079872 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Services.dll
2011-02-28 14:01 - 2011-02-28 14:01 - 00073728 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2014-04-23 15:05 - 2014-04-23 15:05 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2015-05-15 15:27 - 2015-05-15 15:27 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2015-12-23 23:31 - 2015-12-23 23:31 - 00103888 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2015-12-23 23:31 - 2015-12-23 23:31 - 00125512 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2015-12-23 23:31 - 2015-12-23 23:31 - 02813440 _____ () C:\Program Files\AVAST Software\Avast\defs\15120101\algo.dll
2015-12-23 23:31 - 2015-12-23 23:31 - 00469008 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2015-12-23 23:31 - 2015-12-23 23:31 - 00241896 _____ () C:\Program Files\AVAST Software\Avast\browser_pass.dll
2015-12-23 23:36 - 2015-12-23 23:36 - 02806272 _____ () C:\Program Files\AVAST Software\Avast\defs\15122302\algo.dll
2015-12-23 23:31 - 2015-12-23 23:31 - 40539648 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2015-12-23 23:32 - 2015-12-10 22:54 - 01583432 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\libglesv2.dll
2015-12-23 23:32 - 2015-12-10 22:54 - 00081224 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\libegl.dll
2015-12-23 23:32 - 2015-12-10 22:54 - 16573256 _____ () C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-1678204619-2015826032-607794690-1001\...\clonewarsadventures.com -> clonewarsadventures.com
IE trusted site: HKU\S-1-5-21-1678204619-2015826032-607794690-1001\...\freerealms.com -> freerealms.com
IE trusted site: HKU\S-1-5-21-1678204619-2015826032-607794690-1001\...\soe.com -> soe.com
IE trusted site: HKU\S-1-5-21-1678204619-2015826032-607794690-1001\...\sony.com -> sony.com

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1678204619-2015826032-607794690-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Tyler\AppData\Roaming\Mozilla\Firefox\Desktop Background.bmp
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: Easybits Recovery => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
MSCONFIG\startupreg: HP Quick Launch => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
MSCONFIG\startupreg: HPConnectionManager => C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe
MSCONFIG\startupreg: HPOSD => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: Logitech Download Assistant => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
MSCONFIG\startupreg: Magic Desktop for HP notification => "C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe"
MSCONFIG\startupreg: PDFVPrinter => C:\Program Files (x86)\Classic PDF Editor\PDFVPrinter.exe
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: StartCCC => "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
MSCONFIG\startupreg: Steam => "C:\Program Files (x86)\Steam\steam.exe" -silent
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: SynTPEnh => %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
MSCONFIG\startupreg: SysTrayApp => C:\Program Files\IDT\WDM\sttray64.exe

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{D80812DA-0736-46D3-8F6A-D036080F593A}] => (Allow) C:\Program Files (x86)\Roxio\RoxioNow Player\RNowShell.exe
FirewallRules: [{6F006E3A-F14A-4E44-9419-9D2AE4D2A323}] => (Allow) C:\Program Files (x86)\Roxio\RoxioNow Player\RNowShell.exe
FirewallRules: [{9D639BBC-A1F2-4292-87E4-729859EC0906}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\MediaSmart\RoxioNow\RNow.exe
FirewallRules: [{7E0BBBB3-EA91-47D7-B2F7-BD04A5E9D299}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\MediaSmart\RoxioNow\RNow.exe
FirewallRules: [{D0A5D0EE-B7E7-4E3B-8B87-335F571245E3}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{91525777-5653-4D2C-95B4-E15B13419CCE}] => (Allow) LPort=2869
FirewallRules: [{E15AEDE4-CEA9-40B2-82FF-74942785388F}] => (Allow) LPort=1900
FirewallRules: [{F597AA5A-C59E-4F6E-BDB3-42BD86EE4BE2}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{ABCBAF38-FB38-4D32-80DE-3B608FEAB3EE}] => (Allow) C:\Program Files (x86)\Windows Live\Mesh\MOE.exe
FirewallRules: [{B82BE985-578C-49BF-9CA5-2A7CDB884FF2}] => (Allow) C:\Windows\system32\ezSharedSvcHost.exe
FirewallRules: [{F62ECF7E-2BEB-42C0-AB5B-F2D209652F3B}] => (Allow) C:\Program Files (x86)\EasyBits For Kids\ezDesktop.exe
FirewallRules: [{7215093A-0AB7-41F7-B5B4-794AD2398F37}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1675\Agent.exe
FirewallRules: [{5FC40F34-313E-4413-980E-01D4A05E2D36}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1675\Agent.exe
FirewallRules: [{5B41CAF3-FE39-4375-AF72-A01FFE2D1E83}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1737\Agent.exe
FirewallRules: [{AB78F274-1494-443D-97E3-601D1781EB85}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1737\Agent.exe
FirewallRules: [{778ED716-D00C-4594-9CEC-6D29D18FECFC}] => (Allow) C:\Program Files (x86)\StarCraft II\StarCraft II.exe
FirewallRules: [{38EF5443-736C-42ED-BC97-2F536DDC2E9A}] => (Allow) C:\Program Files (x86)\StarCraft II\StarCraft II.exe
FirewallRules: [{E6951663-BEB3-4F43-A9CE-2D044345FBFF}] => (Allow) C:\Program Files (x86)\StarCraft II\StarCraft II Public Test.exe
FirewallRules: [{2BEC42CF-7A33-42CF-9C52-8642ACBB16C5}] => (Allow) C:\Program Files (x86)\StarCraft II\StarCraft II Public Test.exe
FirewallRules: [{BC86281A-8EFB-4EEE-A9B6-ACF4FE71C177}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{6151DFF3-373F-48E2-9412-43484D3D9DA5}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{5AC3F912-86CD-4566-BBA4-4C2DBE0C94FC}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.exe
FirewallRules: [{BFD8B518-D0C2-41FD-AFF6-82C789973675}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.x64.exe
FirewallRules: [{711A348D-C5E0-4EC5-80BF-B0BBCEFF769C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.exe
FirewallRules: [{04E0693D-EE5B-42FD-9E49-A0568DA47B4F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.x64.exe
FirewallRules: [{99ABC882-D92A-463E-A194-C4AC15E34360}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.exe
FirewallRules: [{A9F18873-0AE3-4828-A1DC-EAED03607BB6}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Warframe.x64.exe
FirewallRules: [{D9071DB6-9195-40E1-980B-5C8DB002543B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Tools\Launcher.exe
FirewallRules: [{360452A2-B797-437E-962D-915B0B28DEE1}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Vindictus\en-US\NMService.exe
FirewallRules: [{0E34808A-0FD8-4C66-8209-AB82B2C61C61}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Vindictus\en-US\NMService.exe
FirewallRules: [TCP Query User{C8C87125-7D41-43E3-B394-DF7E2D0D2FF6}C:\program files\java\jre6\bin\javaw.exe] => (Allow) C:\program files\java\jre6\bin\javaw.exe
FirewallRules: [UDP Query User{267D0F12-F9B1-4EC1-9018-BE940982FAD2}C:\program files\java\jre6\bin\javaw.exe] => (Allow) C:\program files\java\jre6\bin\javaw.exe
FirewallRules: [TCP Query User{94EDFF17-BF37-4BB6-9314-B356FC5C229C}C:\program files\java\jre6\bin\javaw.exe] => (Allow) C:\program files\java\jre6\bin\javaw.exe
FirewallRules: [UDP Query User{D2D73008-CF5F-4904-A3F5-0162DFC3B965}C:\program files\java\jre6\bin\javaw.exe] => (Allow) C:\program files\java\jre6\bin\javaw.exe
FirewallRules: [{75B2299F-27DA-4FAA-A7E1-2B5B3B8C0CA7}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2045\Agent.exe
FirewallRules: [{59399AD6-AEC4-4138-AF93-9ACAF679339B}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2045\Agent.exe
FirewallRules: [TCP Query User{E717D5A2-AD16-4E67-9DC4-29053F7877EE}C:\program files (x86)\starcraft ii\versions\base24944\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base24944\sc2.exe
FirewallRules: [UDP Query User{324902F3-3180-471F-B870-08018CE3E0AE}C:\program files (x86)\starcraft ii\versions\base24944\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base24944\sc2.exe
FirewallRules: [TCP Query User{F2F695DF-D86F-4D69-99D2-E364E155FC35}C:\program files (x86)\steam\steamapps\common\the witcher 2\bin\witcher2.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\the witcher 2\bin\witcher2.exe
FirewallRules: [UDP Query User{2D4B482F-051C-4687-80C8-C723CC166687}C:\program files (x86)\steam\steamapps\common\the witcher 2\bin\witcher2.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\the witcher 2\bin\witcher2.exe
FirewallRules: [{7F77E439-A455-4CB1-BAB8-1B06A1071EE9}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Team Fortress 2\hl2.exe
FirewallRules: [{F148CA37-7584-4C80-8392-D1274E7199FF}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Team Fortress 2\hl2.exe
FirewallRules: [{3C7691E2-FE94-4C78-9EA9-319636E78110}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Team Fortress 2\hl2.exe
FirewallRules: [{C8C43894-3BE1-4AE5-A8A1-BCE6AB9A9319}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Team Fortress 2\hl2.exe
FirewallRules: [TCP Query User{9FBF6AA6-E638-4F91-B50A-416AFA3B3758}C:\program files\java\jre7\bin\javaw.exe] => (Allow) C:\program files\java\jre7\bin\javaw.exe
FirewallRules: [UDP Query User{FBACCD05-3472-496E-B60C-2E4A321BDB8A}C:\program files\java\jre7\bin\javaw.exe] => (Allow) C:\program files\java\jre7\bin\javaw.exe
FirewallRules: [{793912B0-03EC-4CAC-8997-675FED34BB1A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\MarchOfWar\game.exe
FirewallRules: [{8F33FBF9-0994-42A5-BD14-68B05DCCB6C4}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\MarchOfWar\game.exe
FirewallRules: [{C02D92D9-8881-4299-916E-40F151CEC581}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Portal 2\portal2.exe
FirewallRules: [{B3885DE3-1154-47F8-9495-9ECD30880CAF}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Portal 2\portal2.exe
FirewallRules: [{11EBCBFF-2502-4D28-80FC-C141E4BE9625}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\the witcher 2\Launcher.exe
FirewallRules: [{732F84AB-04C6-4131-B1DC-6A81806E8B48}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\the witcher 2\Launcher.exe
FirewallRules: [{5925F068-2F82-4A8F-80D6-D3E2C74390F4}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Magic The Gathering Tactics\LaunchPad.exe
FirewallRules: [{3683F5F6-4D92-4054-8A77-9F88EC424DA0}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Magic The Gathering Tactics\LaunchPad.exe
FirewallRules: [{AC33FED8-CD1A-40E1-8A0B-7503094B8FAB}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Warframe\Tools\Launcher.exe
FirewallRules: [{101CCAEC-E83E-4683-885C-6D6DEEBA037D}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Warframe\Tools\Launcher.exe
FirewallRules: [{AA42513B-2544-4FE0-9815-81C1A2B0D07E}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2380\Agent.exe
FirewallRules: [{C5CAFD4C-D198-472A-84DD-24B82E465190}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2380\Agent.exe
FirewallRules: [TCP Query User{6443EDE2-0BA1-45D6-961B-587BF4B0F8E3}C:\program files (x86)\starcraft ii\versions\base26490\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base26490\sc2.exe
FirewallRules: [UDP Query User{1F88362F-EAB6-462B-9ECF-6E16242F20BA}C:\program files (x86)\starcraft ii\versions\base26490\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base26490\sc2.exe
FirewallRules: [{F654E831-D632-428E-A355-E8404C8CD35F}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\GarrysMod\hl2.exe
FirewallRules: [{1B5B4298-A2FC-4500-9C23-180722461FB1}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\GarrysMod\hl2.exe
FirewallRules: [{4CEEAC21-9868-41A4-82E4-5EAB7B179287}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{985AF26A-3B9A-4351-882A-4A264BA5E515}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{1553E3BB-A512-4F26-8363-1B0AD04DACC7}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{BEAF4772-2574-4322-9CD1-EAF86944022B}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{A6C29D58-8B01-4C0C-8355-A881F220873B}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\GarrysMod\hl2.exe
FirewallRules: [{48FC73FF-D728-4520-9F40-783EA487C2B3}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\GarrysMod\hl2.exe
FirewallRules: [{25F72D03-709C-490D-9AFC-5CDB3A11DFAE}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Warframe\Tools\RemoteCrashSender.exe
FirewallRules: [TCP Query User{B1533E63-09F3-45A5-8D5B-CA8B34061466}C:\program files (x86)\starcraft ii\versions\base28667\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base28667\sc2.exe
FirewallRules: [UDP Query User{E2585ED7-BB45-46A5-B4EE-5947ABEA1B34}C:\program files (x86)\starcraft ii\versions\base28667\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base28667\sc2.exe
FirewallRules: [{8C330267-1183-43A9-809B-73C080D2ABBD}] => (Allow) C:\ProgramData\HappyCloud\Cache\TERA\TERA-Launcher.exe
FirewallRules: [{01F057F5-028D-49E8-9464-8C177868FB7D}] => (Allow) C:\ProgramData\HappyCloud\Cache\TERA\TERA-Launcher.exe
FirewallRules: [{81466F15-EB8F-4FF7-8951-57E2E0F6EA84}] => (Allow) C:\ProgramData\HappyCloud\Cache\TERA\Client\TL.exe
FirewallRules: [{575807A6-C1C6-44C6-B1F9-18D0052202DA}] => (Allow) C:\ProgramData\HappyCloud\Cache\TERA\Client\TL.exe
FirewallRules: [{F35EE6F8-5275-41F4-AA61-7278DAFBF202}] => (Allow) C:\ProgramData\HappyCloud\Cache\TERA\Client\Binaries\TERA.exe
FirewallRules: [{E0318326-884D-4ED1-89EB-91E8921B860A}] => (Allow) C:\ProgramData\HappyCloud\Cache\TERA\Client\Binaries\TERA.exe
FirewallRules: [{6B832386-F6F8-4971-AEB7-65EC5F91A286}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2689\Agent.exe
FirewallRules: [{1D7F532C-4D46-41AB-B57F-8B6102979A84}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2689\Agent.exe
FirewallRules: [TCP Query User{E24C2341-CB0F-4708-85DF-4E266FA17681}C:\program files (x86)\goat simulator\binaries\win32\goatgame-win32-shipping.exe] => (Allow) C:\program files (x86)\goat simulator\binaries\win32\goatgame-win32-shipping.exe
FirewallRules: [UDP Query User{0485347E-945F-4E7B-9084-02F36FAF6F9E}C:\program files (x86)\goat simulator\binaries\win32\goatgame-win32-shipping.exe] => (Allow) C:\program files (x86)\goat simulator\binaries\win32\goatgame-win32-shipping.exe
FirewallRules: [{826180BE-2993-4B7F-8087-AA39361E5540}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2816\Agent.exe
FirewallRules: [{A8777B14-E09D-4A64-89FD-4D7A114173E8}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2816\Agent.exe
FirewallRules: [{88205CC1-11F6-43A4-8A7B-8AA771A07936}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exe
FirewallRules: [{D53E5191-1325-4D79-B347-66128F79A946}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\WOG\disasm.exe
FirewallRules: [{9B29F92C-A819-405D-8723-2526545BF7E9}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\WOG\disasm.exe
FirewallRules: [{E8560589-721B-4236-8B96-3A7397B9D9C2}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Toribash\toribash.exe
FirewallRules: [{B474ACF1-FB07-4825-890C-15819EF214EA}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Toribash\toribash.exe
FirewallRules: [TCP Query User{71083820-BEFB-4FF2-B085-31220B886993}C:\program files (x86)\goat simulator\binaries\win32\goatgame-win32-shipping.exe] => (Allow) C:\program files (x86)\goat simulator\binaries\win32\goatgame-win32-shipping.exe
FirewallRules: [UDP Query User{72B01AC7-AB53-4890-B6F8-899F9239A9C5}C:\program files (x86)\goat simulator\binaries\win32\goatgame-win32-shipping.exe] => (Allow) C:\program files (x86)\goat simulator\binaries\win32\goatgame-win32-shipping.exe
FirewallRules: [{A2D4D0AD-40EA-4359-A56E-F9DD36CDD7B3}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Vindictus\en-US\vslauncher.exe
FirewallRules: [{D282F4ED-D587-471D-96AB-FC68588D6D16}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Vindictus\en-US\vslauncher.exe
FirewallRules: [{7C0582EB-371A-4005-A85A-F688254FDFF2}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{7D74ED51-DA72-457D-AB23-D4D85CA28392}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [TCP Query User{A65B1A91-F047-4784-AD40-BEF6CF2986EF}C:\program files (x86)\steam\steamapps\common\dota 2 beta\dota_ugc\game\bin\win64\dota2.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\dota 2 beta\dota_ugc\game\bin\win64\dota2.exe
FirewallRules: [UDP Query User{1F839DA3-4364-4A24-B75D-E12D826F4AFC}C:\program files (x86)\steam\steamapps\common\dota 2 beta\dota_ugc\game\bin\win64\dota2.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\dota 2 beta\dota_ugc\game\bin\win64\dota2.exe
FirewallRules: [{11312D9D-4D6D-4949-AFB1-FC8715DAA792}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3526\Agent.exe
FirewallRules: [{83F91642-1009-4EE6-BB24-84F40580A171}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3526\Agent.exe
FirewallRules: [{D1E95D57-3A19-4D16-BBB3-4BB9CC270D5E}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe
FirewallRules: [{2FEA0C22-7F53-4E28-88EE-DA130BD837D7}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe
FirewallRules: [TCP Query User{B99BA24B-7D19-4776-B273-4AA1CCE5482B}C:\program files (x86)\starcraft ii\versions\base32283\sc2.exe] => (Block) C:\program files (x86)\starcraft ii\versions\base32283\sc2.exe
FirewallRules: [UDP Query User{2AE5FBDA-25DA-4C5F-BBDC-B1DF05965685}C:\program files (x86)\starcraft ii\versions\base32283\sc2.exe] => (Block) C:\program files (x86)\starcraft ii\versions\base32283\sc2.exe
FirewallRules: [{6D0F47A9-D9B3-4FFD-B2AA-5E27FFD39CE4}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Age2HD\Launcher.exe
FirewallRules: [{342B3F2C-3D68-4B43-A5DE-53CBDECC5875}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Age2HD\Launcher.exe
FirewallRules: [{8B5071C6-306A-4DA6-AB53-02285B9261E7}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3634\Agent.exe
FirewallRules: [{495D051A-55A2-47F6-B108-79ACF29FA59A}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3634\Agent.exe
FirewallRules: [{99AA36FB-6191-4C72-AFFB-18C9EF0794B1}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\dota.exe
FirewallRules: [{16AFF6FC-1C69-49CD-965F-4FEDECC24BA7}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\dota.exe
FirewallRules: [{2A86ED7C-5760-4504-AFF5-95E3D3B84DD0}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 test\dota.exe
FirewallRules: [{8B67A351-6106-4BEF-8EA6-D68CD570982A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 test\dota.exe
FirewallRules: [{04C4C1ED-B846-49E8-8169-DF8FBB80BC07}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\game\bin\win32\dota2.exe
FirewallRules: [{9E8B2321-DEEA-4970-9F42-0CF3E9FCAA8A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\game\bin\win32\dota2.exe
FirewallRules: [{7BCA0C5B-C3B2-4FB6-B5AB-95943121061A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\game\bin\win64\dota2cfg.exe
FirewallRules: [{0E162F0C-36B7-42E2-AE2A-A877F853FFFB}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\game\bin\win64\dota2cfg.exe
FirewallRules: [{EA7C878C-C396-463B-B4F8-ED7622171128}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{70D5C188-2BA8-406E-8732-D902F22FC7CD}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{4277E67F-E0FB-4A53-8AAC-119198EA6F11}] => (Allow) C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
FirewallRules: [TCP Query User{A2E6E42B-C77D-4898-83D2-6CCE1FAF9DE0}C:\program files (x86)\starcraft ii\versions\base38996\sc2_x64.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base38996\sc2_x64.exe
FirewallRules: [UDP Query User{B8762D76-7B83-443C-888E-6BB8F5FDCCD4}C:\program files (x86)\starcraft ii\versions\base38996\sc2_x64.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base38996\sc2_x64.exe
FirewallRules: [{8922FD7A-F6DE-42E1-9F72-5F22524DF9BB}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{D6F21661-9273-446E-AD32-14F6F9A9AD80}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{EC93D6D2-CE4F-40DA-8920-9E7507BD0346}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPDeviceDetection3.exe
FirewallRules: [{B179EAD4-872D-4910-90F5-BB06E449DF36}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Vindictus\en-US\nxsteam.exe
FirewallRules: [{03CC272E-1ABC-456D-A508-4476873A4266}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Vindictus\en-US\nxsteam.exe
FirewallRules: [{36B9B11E-3E26-43DD-9AD3-EC45979D2EEB}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (12/23/2015 11:40:45 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program FRST64.exe version 23.12.2015.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 360

Start Time: 01d13e050714eb2d

Termination Time: 4

Application Path: C:\Users\Tyler\Desktop\FRST64.exe

Report Id: 73196c16-a9f8-11e5-ac7a-78e3b550891e

Error: (12/23/2015 11:37:54 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4101) (User: )
Description: Failed auto update retrieval of third-party root certificate from: <http://ctldl.windowsupdate.com/msdo...039EEDB80BE7A03C6953893B20D2D9323A4C2AFD.crt> with error: The specified server cannot perform the requested operation.
.

Error: (12/23/2015 11:37:54 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4101) (User: )
Description: Failed auto update retrieval of third-party root certificate from: <http://ctldl.windowsupdate.com/msdo...039EEDB80BE7A03C6953893B20D2D9323A4C2AFD.crt> with error: This operation returned because the timeout period expired.
.

Error: (12/23/2015 11:33:23 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "Avast.VC110.DebugCRT,processorArchitecture="x86",publicKeyToken="2036b14a11e83e4a",type="win32",version="11.0.60610.1"1".
Dependent Assembly Avast.VC110.DebugCRT,processorArchitecture="x86",publicKeyToken="2036b14a11e83e4a",type="win32",version="11.0.60610.1" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (12/23/2015 11:22:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/23/2015 11:06:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/23/2015 07:29:37 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/23/2015 05:49:13 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/20/2015 08:28:20 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/20/2015 06:48:20 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (12/23/2015 11:33:26 PM) (Source: bowser) (EventID: 8003) (User: )
Description: The master browser has received a server announcement from the computer DSOLSEN-PC
that believes that it is the master browser for the domain on transport NetBT_Tcpip_{6F6C1F7F-40F9-4570-825E-019054F4CF0C}.
The master browser is stopping or an election is being forced.

Error: (12/23/2015 11:20:58 PM) (Source: BugCheck) (EventID: 1001) (User: )
Description: 0x0000001e (0xffffffffc0000005, 0xfffff80002eb04ef, 0x0000000000000000, 0x000000007efa0000)C:\Windows\MEMORY.DMP122315-39951-01

Error: (12/23/2015 11:20:54 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 11:18:58 PM on ‎12/‎23/‎2015 was unexpected.

Error: (12/23/2015 11:09:52 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x800f0816: Security Update for Windows 7 for x64-based Systems (KB3087039).

Error: (12/23/2015 11:09:52 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x800f0816: Security Update for Windows 7 for x64-based Systems (KB3100213).

Error: (12/23/2015 11:09:52 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x800f0816: Security Update for Windows 7 for x64-based Systems (KB3108371).

Error: (12/23/2015 11:09:52 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x800f0816: Security Update for Windows 7 for x64-based Systems (KB3101722).

Error: (12/23/2015 11:09:52 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x800f0816: Cumulative Security Update for Internet Explorer 11 for Windows 7 for x64-based Systems (KB3104002).

Error: (12/23/2015 11:09:52 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x800f0816: Update for Windows 7 for x64-based Systems (KB3092627).

Error: (12/23/2015 11:09:52 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80242016: Update for Windows 7 for x64-based Systems (KB3035583).


==================== Memory info ===========================

Processor: AMD Phenom(tm) II P650 Dual-Core Processor
Percentage of memory in use: 49%
Total physical RAM: 3834.9 MB
Available physical RAM: 1926.52 MB
Total Virtual: 7668.01 MB
Available Virtual: 5551.85 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:450.74 GB) (Free:155.66 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive d: (RECOVERY) (Fixed) (Total:14.72 GB) (Free:1.63 GB) NTFS ==>[system with boot components (obtained from drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 8DE81F56)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=450.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=14.7 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=103 MB) - (Type=0C)

==================== End of Addition.txt ============================

 

[Broni]

Welcome aboard

Please, observe following rules:

• Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
• If you're stuck, or you're not sure about certain step, always ask before doing anything else.
• Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
• Never run more than one scan at a time.
• Keep updating me regarding your computer behavior, good, or bad.
• The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
• If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
• I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

=========================================

Yes, you're infected with a rootkit.

Download attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST(FRST64) and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

 

[Tyler Olsen]

Thanks for the quick response, I ran the FRST tool with the fixlist.txt, here is the log

Fix result of Farbar Recovery Scan Tool (x64) Version:23-12-2015
Ran by Tyler (2015-12-24 13:33:58) Run:1
Running from C:\Users\Tyler\Desktop
Loaded Profiles: Tyler (Available Profiles: Tyler)
Boot Mode: Normal
==============================================

fixlist content:
*****************
HKLM-x32\...\Run: [] => [X]
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => No File
Toolbar: HKU\S-1-5-21-1678204619-2015826032-607794690-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll [No File]
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\ppGoogleNaClPluginChrome.dll => No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\pdf.dll => No File
CHR Plugin: (Java Deployment Toolkit 6.0.240.7) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll => No File
CHR Plugin: (Java(TM) Platform SE 6 U24) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll => No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll => No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll => No File
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll => No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll => No File
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]
2014-02-26 17:19 - 2014-02-26 17:19 - 4216840 _____ (Microsoft Corporation) C:\Program Files (x86)\Common Files\vcredist.exe
2014-05-13 16:53 - 2014-05-13 16:53 - 0000017 _____ () C:\Users\Tyler\AppData\Local\resmon.resmoncfg
2015-09-01 08:51 - 2015-09-01 08:51 - 0000000 _____ () C:\Users\Tyler\AppData\Local\{3FDC0C10-1031-4610-8702-F62F1EA865E3}
2015-08-23 11:07 - 2015-08-23 11:16 - 0001318 _____ () C:\ProgramData\hpzinstall.log
2014-05-05 16:44 - 2014-05-05 16:44 - 0000113 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
C:\Windows\svchost.exe
C:\Users\Tyler\AppData\Local\Temp\contentDATs.exe
C:\Users\Tyler\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpodovoa.dll
C:\Users\Tyler\AppData\Local\Temp\Extract.exe
C:\Users\Tyler\AppData\Local\Temp\HPHelpUpdater.exe
C:\Users\Tyler\AppData\Local\Temp\ICReinstall_Firefox_Setup_21.0.exe
C:\Users\Tyler\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\Tyler\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Tyler\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Tyler\AppData\Local\Temp\mssinstaller.exe
C:\Users\Tyler\AppData\Local\Temp\PCPTUpdate.exe
C:\Users\Tyler\AppData\Local\Temp\Resource.exe
C:\Users\Tyler\AppData\Local\Temp\SecurityScan_Release.exe
C:\Users\Tyler\AppData\Local\Temp\SP53394.exe
C:\Users\Tyler\AppData\Local\Temp\SP55040.exe
C:\Users\Tyler\AppData\Local\Temp\SP55151.exe
C:\Users\Tyler\AppData\Local\Temp\SP55152.exe
C:\Users\Tyler\AppData\Local\Temp\SP56878.exe
C:\Users\Tyler\AppData\Local\Temp\SP56929.exe
C:\Users\Tyler\AppData\Local\Temp\SP57538.exe
C:\Users\Tyler\AppData\Local\Temp\sp58915.exe
C:\Users\Tyler\AppData\Local\Temp\SP60593.exe
C:\Users\Tyler\AppData\Local\Temp\sp64126.exe
C:\Users\Tyler\AppData\Local\Temp\UninstallHPSA.exe
C:\Users\Tyler\AppData\Local\Temp\UninstallHPTCA.exe
C:\Users\Tyler\AppData\Local\Temp\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}_NIS_7707.exe
TDL4: custom:26000022 <===== ATTENTION
CustomCLSID: HKU\S-1-5-21-1678204619-2015826032-607794690-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Tyler\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay => No File
Task: {30E091AB-02F0-47E1-9EE6-45F981C49E19} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {428DCFD7-902E-4319-A25C-081CE620076A} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {97F8AAE5-DACA-4853-811A-A6A21985E15F} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {BB03E254-1D23-456A-820C-62A3DE5ADA36} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {C62A5195-EE4F-4E56-81B0-4BD047D9EBC9} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {CC904A7B-B7FF-45F8-B44F-212B10B9EDE6} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {E3E2A214-6E94-4968-8CB1-D1FCCF5B046D} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION

*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value removed successfully
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\DropboxExt1" => key removed successfully
HKCR\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => key not found.
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\DropboxExt2" => key removed successfully
HKCR\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => key not found.
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\DropboxExt3" => key removed successfully
HKCR\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => key not found.
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\DropboxExt4" => key removed successfully
HKCR\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => key not found.
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\GDriveSharedOverlay" => key removed successfully
HKCR\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => key not found.
HKU\S-1-5-21-1678204619-2015826032-607794690-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => value removed successfully
HKCR\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => key not found.
"HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer" => key removed successfully
C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\ppGoogleNaClPluginChrome.dll => not found.
C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.106\pdf.dll => not found.
C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll => not found.
C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll => not found.
C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll => not found.
C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll => not found.
C:\Windows\system32\Adobe\Director\np32dsw.dll => not found.
c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll => not found.
EagleX64 => service removed successfully
MBAMSwissArmy => service removed successfully
C:\Program Files (x86)\Common Files\vcredist.exe => moved successfully
C:\Users\Tyler\AppData\Local\resmon.resmoncfg => moved successfully
C:\Users\Tyler\AppData\Local\{3FDC0C10-1031-4610-8702-F62F1EA865E3} => moved successfully
C:\ProgramData\hpzinstall.log => moved successfully
C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc => moved successfully
C:\Windows\svchost.exe => moved successfully
C:\Users\Tyler\AppData\Local\Temp\contentDATs.exe => moved successfully
C:\Users\Tyler\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpodovoa.dll => moved successfully
C:\Users\Tyler\AppData\Local\Temp\Extract.exe => moved successfully
C:\Users\Tyler\AppData\Local\Temp\HPHelpUpdater.exe => moved successfully
C:\Users\Tyler\AppData\Local\Temp\ICReinstall_Firefox_Setup_21.0.exe => moved successfully
C:\Users\Tyler\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe => moved successfully
C:\Users\Tyler\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe => moved successfully
C:\Users\Tyler\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe => moved successfully
C:\Users\Tyler\AppData\Local\Temp\mssinstaller.exe => moved successfully
C:\Users\Tyler\AppData\Local\Temp\PCPTUpdate.exe => moved successfully
C:\Users\Tyler\AppData\Local\Temp\Resource.exe => moved successfully
C:\Users\Tyler\AppData\Local\Temp\SecurityScan_Release.exe => moved successfully
C:\Users\Tyler\AppData\Local\Temp\SP53394.exe => moved successfully
C:\Users\Tyler\AppData\Local\Temp\SP55040.exe => moved successfully
C:\Users\Tyler\AppData\Local\Temp\SP55151.exe => moved successfully
C:\Users\Tyler\AppData\Local\Temp\SP55152.exe => moved successfully
C:\Users\Tyler\AppData\Local\Temp\SP56878.exe => moved successfully
C:\Users\Tyler\AppData\Local\Temp\SP56929.exe => moved successfully
C:\Users\Tyler\AppData\Local\Temp\SP57538.exe => moved successfully
C:\Users\Tyler\AppData\Local\Temp\sp58915.exe => moved successfully
C:\Users\Tyler\AppData\Local\Temp\SP60593.exe => moved successfully
C:\Users\Tyler\AppData\Local\Temp\sp64126.exe => moved successfully
C:\Users\Tyler\AppData\Local\Temp\UninstallHPSA.exe => moved successfully
C:\Users\Tyler\AppData\Local\Temp\UninstallHPTCA.exe => moved successfully
C:\Users\Tyler\AppData\Local\Temp\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}_NIS_7707.exe => moved successfully

========================= bcdedit ========================


The operation completed successfully.

========= End of bcdedit =========


========================= bcdedit ========================


The operation completed successfully.

========= End of bcdedit =========

"HKU\S-1-5-21-1678204619-2015826032-607794690-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{30E091AB-02F0-47E1-9EE6-45F981C49E19}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{30E091AB-02F0-47E1-9EE6-45F981C49E19}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{428DCFD7-902E-4319-A25C-081CE620076A}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{428DCFD7-902E-4319-A25C-081CE620076A}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Time-5d" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{97F8AAE5-DACA-4853-811A-A6A21985E15F}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{97F8AAE5-DACA-4853-811A-A6A21985E15F}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{BB03E254-1D23-456A-820C-62A3DE5ADA36}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BB03E254-1D23-456A-820C-62A3DE5ADA36}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C62A5195-EE4F-4E56-81B0-4BD047D9EBC9}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C62A5195-EE4F-4E56-81B0-4BD047D9EBC9}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{CC904A7B-B7FF-45F8-B44F-212B10B9EDE6}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CC904A7B-B7FF-45F8-B44F-212B10B9EDE6}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Logon-5d" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E3E2A214-6E94-4968-8CB1-D1FCCF5B046D}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E3E2A214-6E94-4968-8CB1-D1FCCF5B046D}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d" => key removed successfully

==== End of Fixlog 13:34:07 ====

 

[Broni]

Good

Download RogueKiller from one of the following links and save it to your Desktop:

Link 1
Link 2

• Close all the running programs
• Windows Vista/7/8 users: right click on RogueKiller.exe, click Run as Administrator
• Otherwise just double-click on RogueKiller.exe
• Pre-scan will start. Let it finish.
• Click on SCAN button.
• Wait until the Status box shows Scan Finished
• Click on Delete.
• Wait until the Status box shows Deleting Finished.
• Click on Report and copy/paste the content of the Notepad into your next reply.
• RKreport.txt could also be found on your desktop.
• If more than one log is produced post all logs.
• If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again

Please download Malwarebytes Anti-Malware (MBAM) to your desktop.
NOTE. If you already have MBAM 2.0 installed scroll down.

• Double-click mbam-setup-2.0.0.1000.exe and follow the prompts to install the program.
  
• At the end, be sure a checkmark is placed next to the following:
  
• Launch Malwarebytes Anti-Malware
• A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
  
• Click Finish.
• On the Dashboard, click the 'Update Now >>' link
• After the update completes, click the 'Scan Now >>' button.
  
• Or, on the Dashboard, click the Scan Now >> button.
• If an update is available, click the Update Now button.
  
• A Threat Scan will begin.
• When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
• In most cases, a restart will be required.
• Wait for the prompt to restart the computer to appear, then click on Yes.

If you already have MBAM 2.0 installed:

• On the Dashboard, click the 'Update Now >>' link
• After the update completes, click the 'Scan Now >>' button.
  
• Or, on the Dashboard, click the Scan Now >> button.
• If an update is available, click the Update Now button.
  
• A Threat Scan will begin.
• When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
• In most cases, a restart will be required.
• Wait for the prompt to restart the computer to appear, then click on Yes.

How to get logs:
(Export log to save as txt)

• After the restart once you are back at your desktop, open MBAM once more.
• Click on the History tab > Application Logs.
• Double click on the Scan Log which shows the Date and time of the scan just performed.
• Click 'Export'.
• Click 'Text file (*.txt)'
• In the Save File dialog box which appears, click on Desktop.
• In the File name: box type a name for your scan log.
• A message box named 'File Saved' should appear stating "Your file has been successfully exported".
• Click Ok
• Attach that saved log to your next reply.

(Copy to clipboard for pasting into forum replies or tickets)

• After the restart once you are back at your desktop, open MBAM once more.
• Click on the History tab > Application Logs.
• Double click on the Scan Log which shows the Date and time of the scan just performed.
• Click 'Copy to Clipboard'
• Paste the contents of the clipboard into your reply.

Please download AdwCleaner by Xplode onto your desktop.

• Close all open programs and internet browsers.
• Double click on adwcleaner.exe to run the tool.
• Click on Scan button.
• When the scan has finished click on Clean button.
• Your computer will be rebooted automatically. A text file will open after the restart.
• Please post the contents of that logfile with your next reply.
• You can find the logfile at C:\AdwCleaner[S1].txt as well.

Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

 

[Tyler Olsen]

Hey, ran all of those and got the logs. Posting them in the same order done.

RogueKiller V11.0.4.0 [Dec 20 2015] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/software/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Tyler [Administrator]
Started from : C:\Users\Tyler\Desktop\RogueKiller.exe
Mode : Delete -- Date : 12/27/2015 16:40:04

¤¤¤ Processes : 2 ¤¤¤
[Proc.Injected] ccsvchst.exe(2148) -- C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccsvchst.exe[7] -> Killed [TermProc]
[Suspicious.Path] DismHost.exe(4112) -- C:\Windows\Temp\E566FE3E-24C9-43B8-99E5-8090184E6D32\DismHost.exe[x] -> Killed [TermThr]

¤¤¤ Registry : 0 ¤¤¤

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 4 ¤¤¤
[Hj.Name][File] C:\Windows\svchost.exe -> Deleted
[PUP][Folder] C:\ProgramData\{18165758-115C-4DC0-9EC2-FF89F725767F} -> Deleted
[PUP][File] C:\ProgramData\{18165758-115C-4DC0-9EC2-FF89F725767F}\0x0409.ini -> Deleted
[PUP][File] C:\ProgramData\{18165758-115C-4DC0-9EC2-FF89F725767F}\HP Support Assistant.msi -> Deleted
[PUP][Folder] C:\Program Files (x86)\B1 Free Archiver -> Deleted
[PUP][File] C:\Program Files (x86)\B1 Free Archiver\installer.exe -> Deleted
[PUP][Folder] C:\Program Files (x86)\Coupons -> Deleted
[PUP][File] C:\Program Files (x86)\Coupons\CouponsCom.url -> Deleted
[PUP][File] C:\Program Files (x86)\Coupons\Uninstall\IRIMG1.JPG -> Deleted
[PUP][File] C:\Program Files (x86)\Coupons\Uninstall\IRIMG2.JPG -> Deleted
[PUP][File] C:\Program Files (x86)\Coupons\Uninstall\IRIMG3.JPG -> Deleted
[PUP][File] C:\Program Files (x86)\Coupons\Uninstall\IRIMG4.JPG -> Deleted
[PUP][File] C:\Program Files (x86)\Coupons\Uninstall\IRIMG5.JPG -> Deleted
[PUP][File] C:\Program Files (x86)\Coupons\Uninstall\IRIMG6.JPG -> Deleted
[PUP][File] C:\Program Files (x86)\Coupons\Uninstall\IRIMG7.JPG -> Deleted
[PUP][File] C:\Program Files (x86)\Coupons\Uninstall\IRIMG8.JPG -> Deleted
[PUP][File] C:\Program Files (x86)\Coupons\Uninstall\uninstall.dat -> Deleted
[PUP][File] C:\Program Files (x86)\Coupons\Uninstall\uninstall.xml -> Deleted
[PUP][Folder] C:\Program Files (x86)\Coupons\Uninstall -> Deleted



Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 12/27/2015
Scan Time: 4:43 PM
Logfile: Anti Malware Log.txt
Administrator: Yes

Version: 2.2.0.1024
Malware Database: v2015.12.27.05
Rootkit Database: v2015.12.26.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Tyler

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 360974
Time Elapsed: 32 min, 43 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 3
PUP.Optional.InstallCore, C:\Users\Tyler\AppData\Local\Temp\ICReinstall_Firefox_Setup_21.0.exe, Quarantined, [33de29810586bb7b52da55dc39c8a858],
PUP.Optional.InstallCore, C:\Users\Tyler\Downloads\Firefox_Setup_21.0.exe, Quarantined, [dd34efbb08834beb81ab141dcc35916f],
Trojan.Agent, C:\Windows\svchost.exe, Quarantined, [729fb2f86b202a0c3a0af2f6c939a15f],

Physical Sectors: 0
(No malicious items detected)


(end)

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Not loaded [0xc000036b]) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
\\.\PHYSICALDRIVE0 Root.PiHar|VT.Unknown -> Not selected

+++++ PhysicalDrive0: Hitachi HTS545050B9A300 SATA Disk Device +++++
--- User ---
[MBR] ce18acc2843d4e4c7449aa8029cb6b63
[BSP] d9a5f1b1e6cf8c8e38496c1c6199aa83 : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 199 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 409600 | Size: 461561 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 945686528 | Size: 15075 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
3 - [XXXXXX] FAT32-LBA (0xc) [VISIBLE] Offset (sectors): 976560128 | Size: 103 MB
User = LL1 ... OK
User != LL2 ... KO!
--- LL2 ---
[MBR] 2aba9e201989756fa9bc8738e3f503e3
[BSP] cfc12681ea201b500b5fe92b022e2406 : Root.PiHar|VT.Unknown MBR Code [Malware!]
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 199 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 409600 | Size: 461561 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 945686528 | Size: 15075 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
3 - [XXXXXX] FAT32-LBA (0xc) [VISIBLE] Offset (sectors): 976560128 | Size: 103 MB

# AdwCleaner v5.026 - Logfile created 27/12/2015 at 17:41:13
# Updated 21/12/2015 by Xplode
# Database : 2015-12-23.1 [Server]
# Operating system : Windows 7 Home Premium Service Pack 1 (x64)
# Username : Tyler - TYLER-HP
# Running from : C:\Users\Tyler\Desktop\adwcleaner_5.026.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****


***** [ Files ] *****


***** [ DLLs ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****

[-] Key Deleted : HKCU\Software\b1.org
[-] Key Deleted : HKLM\SOFTWARE\b1.org
[-] Key Deleted : [x64] HKLM\SOFTWARE\b1.org
[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\softonic.com

***** [ Web browsers ] *****

[-] [C:\Users\Tyler\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : aol.com
[-] [C:\Users\Tyler\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : ask.com
[-] [C:\Users\Tyler\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Startup_URLs] Deleted : hxxp://search.babylon.com/home?affID=17425&tt=3812_1

*************************

:: "Tracing" keys removed
:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [1290 bytes] ##########



~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.1 (11.24.2015)
Operating System: Windows 7 Home Premium x64
Ran by Tyler (Administrator) on Sun 12/27/2015 at 17:46:35.67
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 1

Successfully deleted: C:\Windows\svchost.exe (File)



Registry: 1

Successfully deleted: HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} (Registry Key)




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sun 12/27/2015 at 18:00:45.43
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

[Broni]

Please download ComboFix from Here, Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

• Never rename Combofix unless instructed.
• Close any open browsers.
• Very Important! Temporarily disable your anti-virus and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
• Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
• Close any open browsers.
• WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
• Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
• If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  If the connection is not there use restore point you created prior to running Combofix.
• Double click on combofix.exe & follow the prompts.

• 
  NOTE1. If Combofix asks you to install Recovery Console, please allow it.
  NOTE 2. If Combofix asks you to update the program, always do so.

• When finished, it will produce a report for you.
• Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
Use AppRemover to uninstall it: https://www.techspot.com/downloads/5514-appremover.html
We can reinstall it when we're done with CF.
**Note 3: If you receive an error Illegal operation attempted on a registery key that has been marked for deletion, restart computer to fix the issue.
**Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try the following...

Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.
Download Rkill (courtesy of BleepingComputer.com) to your desktop.
There are 2 different versions. If one of them won't run then download and try to run the other one.
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

Restart computer in safe mode

• Double-click on the Rkill desktop icon to run the tool.
• If using Windows Vista, 7 or 8 right-click on it and choose Run As Administrator.
• A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
• If not, delete the file, then download and use the one provided in Link 2.
• Do not reboot until instructed.
• If the tool does not run from any of the links provided, please let me know.

When the scan is done Notepad will open with rKill.txt log.
NOTE. rKill.txt log will also be present on your desktop.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.

 

[Broni]

Still with me?

 

[Broni]

This topic is marked as abandoned and closed due to inactivity.

This member will NOT be eligible to receive any more help in malware removal forum.