SFC Corrupted and it cannot fix itself.

BetaLeaf · Mar 11, 2015

Hey guys. I have a friend who is having trouble with viruses and the such. I tried using teamviewer to remove the viruses once with herdprotect and afterwards I got disconnected from teamviewer during the cleaning/removal phase.

My friend did a system restore to get it back online, thus also restoring the viruses. He is currently infected with the following. https://www.dropbox.com/s/m7gxzjzeb4c6x8w/herd.txt?raw=1

Here is his Current CBS.log. https://www.dropbox.com/s/vejz3s6v3fmrq1f/CBS3.log?raw=1

An explanation and tutorial, while not necessary, would be awesome. I am always looking to be self-reliant and honing my skills.

Thanks again for the help :)

BetaLeaf · Mar 12, 2015

I posted in the wrong section, can an admin move this topic to Windows update please.

Corrine · Mar 12, 2015

As requested, moved to the Windows Update forum!

Go The Power · Mar 13, 2015

Corrine, is there anything of concern in the malware log? Richard has requested that SFCFix does not get ran on a infected system.

BetaLeaf · Mar 14, 2015

How goes things?

Go The Power · Mar 15, 2015

Just to make sure the computer is malware free first can you please follow the steps Here and post the required log back into this thread.

Once you have been cleared I will have a look at the CBS log.

Corrine · Mar 15, 2015

BetaLeaf, please be sure to copy/paste the requested logs. Do not attach or post to DropBox.

Thank you.

BetaLeaf · Mar 15, 2015

### Start FRST.TXT ###

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by Owner (administrator) on DELL-SLIMLINE on 15-03-2015 13:03:52
Running from C:\Users\Owner\Desktop
Loaded Profiles: Owner (Available profiles: Owner)
Platform: Windows 8.1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
() C:\Users\Owner\AppData\Local\driverpsisrndrBckp\driverpsisrndrBckp.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Dell Inc.) C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe
() C:\Windows\taskmgr.exe
(Yahoo! Inc.) C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
(Atheros) C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe
(McAfee, Inc.) C:\Program Files\mcafee\msc\McAPExe.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\AMCore\mcshield.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Dell Inc.) C:\Program Files\Dell\DellDataVault\DellDataVaultWiz.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\CSP\1.3.336.0\McCSPServiceHost.exe
(SoftThinks SAS) C:\Program Files (x86)\Dell Backup and Recovery\SftService.exe
(Dell Inc.) C:\Program Files\Dell\DellDataVault\DellDataVault.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\Platform\McUICnt.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\csisyncclient.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(AOL Inc.) C:\Program Files (x86)\Common Files\AOL\1392089244\ee\aolsoftware.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell Backup and Recovery\Toaster.exe
() C:\Program Files (x86)\Dell Backup and Recovery\Components\Shell\DBRCrawler.exe
(AOL Inc.) C:\Program Files (x86)\Common Files\AOL\acs\AOLacsd.exe
(TeamViewer GmbH) C:\Users\Owner\AppData\Local\Temp\TeamViewer\TeamViewer.exe
(TeamViewer GmbH) C:\Users\Owner\AppData\Local\Temp\TeamViewer\tv_w32.exe
(TeamViewer GmbH) C:\Users\Owner\AppData\Local\Temp\TeamViewer\tv_x64.exe
(AOL Inc.) C:\Program Files (x86)\AOL Desktop 9.7a\waol.exe
(AOL Inc.) C:\Program Files (x86)\AOL Desktop 9.7a\shellmon.exe
(TeamViewer GmbH) C:\Users\Owner\AppData\Local\Temp\TeamViewer\TeamViewer_Desktop.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\McChHost.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\saUI.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [133440 2012-07-19] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [285240 2012-09-01] (Intel Corporation)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [102928 2012-10-23] (CyberLink Corp.)
HKLM-x32\...\Run: [mcui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [533872 2015-01-13] (McAfee, Inc.)
HKLM-x32\...\Run: [mcpltui_exe] => C:\Program Files\Common Files\mcafee\Platform\McUICnt.exe [643064 2014-09-17] (McAfee, Inc.)
HKLM-x32\...\Run: [HostManager] => C:\Program Files (x86)\Common Files\AOL\1392089244\ee\AOLSoftware.exe [41800 2010-03-08] (AOL Inc.)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
HKU\S-1-5-21-3980855148-3933710502-1200373542-1001\...\Run: [MobileAppSync] => "C:\Program Files (x86)\Mobile App Sync\D2MClient.exe"
HKU\S-1-5-21-3980855148-3933710502-1200373542-1001\...\Run: [AOL Fast Start] => C:\Program Files (x86)\AOL Desktop 9.7a\AOL.EXE [72296 2014-08-19] (AOL Inc.)
HKU\S-1-5-21-3980855148-3933710502-1200373542-1001\...\RunOnce: [FlashPlayerUpdate] => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_16_0_0_305_Plugin.exe [960688 2015-02-04] (Adobe Systems Incorporated)
HKU\S-1-5-21-3980855148-3933710502-1200373542-1001\...\Policies\Explorer: [NoFolderOptions] 0
HKU\S-1-5-21-3980855148-3933710502-1200373542-1001\...\Policies\Explorer: [NoControlPanel] 0
AppInit_DLLs: C:\PROGRA~3\PERFOR~1\PERFOR~2.DLL => C:\PROGRA~3\PERFOR~1\PERFOR~2.DLL File Not Found
IFEO\bitguard.exe: [Debugger] tasklist.exe
IFEO\bprotect.exe: [Debugger] tasklist.exe
IFEO\bpsvc.exe: [Debugger] tasklist.exe
IFEO\browserdefender.exe: [Debugger] tasklist.exe
IFEO\browserprotect.exe: [Debugger] tasklist.exe
IFEO\dprotectsvc.exe: [Debugger] tasklist.exe
IFEO\jumpflip: [Debugger] tasklist.exe
IFEO\protectedsearch.exe: [Debugger] tasklist.exe
IFEO\searchinstaller.exe: [Debugger] tasklist.exe
IFEO\searchprotection.exe: [Debugger] tasklist.exe
IFEO\searchprotector.exe: [Debugger] tasklist.exe
IFEO\searchsettings.exe: [Debugger] tasklist.exe
IFEO\searchsettings64.exe: [Debugger] tasklist.exe
IFEO\snapdo.exe: [Debugger] tasklist.exe
IFEO\stinst32.exe: [Debugger] tasklist.exe
IFEO\stinst64.exe: [Debugger] tasklist.exe
IFEO\umbrella.exe: [Debugger] tasklist.exe
IFEO\utiljumpflip.exe: [Debugger] tasklist.exe
IFEO\volaro: [Debugger] tasklist.exe
IFEO\vonteera: [Debugger] tasklist.exe
IFEO\websteroids.exe: [Debugger] tasklist.exe
IFEO\websteroidsservice.exe: [Debugger] tasklist.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKU\S-1-5-21-3980855148-3933710502-1200373542-1001\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3980855148-3933710502-1200373542-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = http://www.default-search.net/search?sid=492&aid=100&itype=n&ver=12283&tm=338&src=ds&p={searchTerms}
SearchScopes: HKLM -> {CC865B26-C31D-4D23-B17B-96548EEF03F6} URL =
SearchScopes: HKLM-x32 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL =
SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = http://www.default-search.net/search?sid=492&aid=100&itype=n&ver=12283&tm=338&src=ds&p={searchTerms}
SearchScopes: HKLM-x32 -> {b0441a0e-a49a-4e16-afc1-74ecced1921f} URL = http://search.tb.ask.com/search/GGmain.jhtml?p2=^UX^xdm038^S09263^us&si=fmc_bing_directions-broad&ptb=17A1236A-3D3B-47A8-9EE8-EF5915BFEC74&ind=2014040411&n=780bd15b&psa=&st=sb&searchfor={searchTerms}
SearchScopes: HKU\S-1-5-21-3980855148-3933710502-1200373542-1001 -> DefaultScope {D9B067FE-29A8-45DB-80C0-75122BE6D83D} URL = https://search.yahoo.com/search?fr=mcafee&type=B011US0D19700101&p={searchTerms}
SearchScopes: HKU\S-1-5-21-3980855148-3933710502-1200373542-1001 -> {14732A5B-0177-4EDE-9FCC-68B2E1885A09} URL =
SearchScopes: HKU\S-1-5-21-3980855148-3933710502-1200373542-1001 -> {800329EE-529E-44BC-A3DC-DA0A87E35059} URL = http://groovorio.com/results.php?f=4&q={searchTerms}&a=grv_installertech_14_22&cd=2XzuyEtN2Y1L1Qzu0BzzyByCtA0FyByDtCtAyE0A0FyE0FtCtN0D0Tzu0StCtDyDtCtN1L2XzutAtFyCtFtCtFtDtN1L1Czu1N1C2X1V1L1G1B2Z1T1I1I1P1C2Z1P1R1M1VtCyE1VtBtBtN1L1G1B1V1N2Y1L1Qzu2StBtD0DtC0A0FzzyBtG0FyD0A0BtG0EyE0CtCtGzy0EzztBtGyE0FtDtCyE0EtC0CtBzzyBtA2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0A0Czy0FtByD0F0EtGtDtC0AtCtGyE0Ezz0EtGzz0FyC0BtGtB0CtD0B0D0AyB0C0EtD0D0B2Q&cr=1725787544&ir=
SearchScopes: HKU\S-1-5-21-3980855148-3933710502-1200373542-1001 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = http://www.default-search.net/search?sid=492&aid=100&itype=n&ver=12283&tm=338&src=ds&p={searchTerms}
SearchScopes: HKU\S-1-5-21-3980855148-3933710502-1200373542-1001 -> {b0441a0e-a49a-4e16-afc1-74ecced1921f} URL = http://search.tb.ask.com/search/GGmain.jhtml?p2=^UX^xdm038^S09263^us&si=fmc_bing_directions-broad&ptb=17A1236A-3D3B-47A8-9EE8-EF5915BFEC74&ind=2014040411&n=780bd15b&psa=&st=sb&searchfor={searchTerms}
SearchScopes: HKU\S-1-5-21-3980855148-3933710502-1200373542-1001 -> {D9B067FE-29A8-45DB-80C0-75122BE6D83D} URL = https://search.yahoo.com/search?fr=mcafee&type=B011US0D19700101&p={searchTerms}
SearchScopes: HKU\S-1-5-21-3980855148-3933710502-1200373542-1001 -> {DD48EC5A-2E4E-43E8-83FF-44D74A879A42} URL = https://search.yahoo.com/search?p={searchTerms}&ei=UTF-8&fr=w3i&type=W3i_DS,136,0_0,Search,20150104,20028,0,31,0
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2014-12-02] (Microsoft Corporation)
BHO: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll [2015-01-28] (McAfee, Inc.)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-01-14] (Microsoft Corporation)
BHO-x32: &Yahoo! Toolbar Helper -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll [2014-03-18] (Yahoo! Inc.)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll [2014-04-09] (McAfee, Inc.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-20] (Oracle Corporation)
BHO-x32: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll [2015-01-28] (McAfee, Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-20] (Oracle Corporation)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll [2015-01-28] (McAfee, Inc.)
Toolbar: HKLM-x32 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll [2015-01-28] (McAfee, Inc.)
Toolbar: HKLM-x32 - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll [2014-03-18] (Yahoo! Inc.)
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll [2015-01-28] (McAfee, Inc.)
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll [2015-01-28] (McAfee, Inc.)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2014-08-22] (Microsoft Corporation)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll [2015-01-28] (McAfee, Inc.)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll [2015-01-28] (McAfee, Inc.)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\msc\McSnIePl64.dll [2015-01-13] (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\msc\McSnIePl.dll [2015-01-13] (McAfee, Inc.)
Winsock: Catalog9 01 C:\WINDOWS\SysWOW64\PCProtect.dll [293984] (Objectify Media Inc)
Winsock: Catalog9 02 C:\WINDOWS\SysWOW64\PCProtect.dll [293984] (Objectify Media Inc)
Winsock: Catalog9 03 C:\WINDOWS\SysWOW64\PCProtect.dll [293984] (Objectify Media Inc)
Winsock: Catalog9 04 C:\WINDOWS\SysWOW64\PCProtect.dll [293984] (Objectify Media Inc)
Winsock: Catalog9 15 C:\WINDOWS\SysWOW64\PCProtect.dll [293984] (Objectify Media Inc)
Winsock: Catalog9-x64 01 C:\WINDOWS\system32\PCProtect64.dll [330624] (Objectify Media Inc)
Winsock: Catalog9-x64 02 C:\WINDOWS\system32\PCProtect64.dll [330624] (Objectify Media Inc)
Winsock: Catalog9-x64 03 C:\WINDOWS\system32\PCProtect64.dll [330624] (Objectify Media Inc)
Winsock: Catalog9-x64 04 C:\WINDOWS\system32\PCProtect64.dll [330624] (Objectify Media Inc)
Winsock: Catalog9-x64 15 C:\WINDOWS\system32\PCProtect64.dll [330624] (Objectify Media Inc)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 71.10.216.1 71.10.216.2
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\2ftkxy1m.default
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-04] ()
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL [2015-01-13] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-04] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-20] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-20] (Oracle Corporation)
FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL [2015-01-13] ()
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-01-26] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-09-12] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.)
FF Plugin-x32: @viewpoint.com/VMP -> C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll [2004-02-20] ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\2ftkxy1m.default\user.js [2015-02-24]
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor
FF Extension: McAfee SiteAdvisor - C:\Program Files (x86)\McAfee\SiteAdvisor [2014-08-31]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2013-03-19]
FF HKU\S-1-5-21-3980855148-3933710502-1200373542-1001\...\FIREFOX\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]

Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxp://search.conduit.com/?gd=&ctid=CT3321972&octid=EB_ORIGINAL_CTID&ISID=M28910FBD-10EF-44EC-8A0A-BED5F6E0719B&SearchSource=55&CUI=&UM=5&UP=SPC725CDDC-708F-47BF-8976-ABF31BB8E91B&SSPV=", "hxxp://www.default-search.net?sid=492&aid=100&itype=n&ver=12283&tm=338&src=hmp", "hxxp://search.easylifeapp.com/", "hxxp://groovorio.com/?f=7&a=grv_installertech_14_22&cd=2XzuyEtN2Y1L1Qzu0BzzyByCtA0FyByDtCtAyE0A0FyE0FtCtN0D0Tzu0StCtDyDtCtN1L2XzutAtFyCtFtCtFtDtN1L1Czu1N1C2X1V1L1G1B2Z1T1I1I1P1C2Z1P1R1M1VtCyE1VtBtBtN1L1G1B1V1N2Y1L1Qzu2StBtD0DtC0A0FzzyBtG0FyD0A0BtG0EyE0CtCtGzy0EzztBtGyE0FtDtCyE0EtC0CtBzzyBtA2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0A0Czy0FtByD0F0EtGtDtC0AtCtGyE0Ezz0EtGzz0FyC0BtGtB0CtD0B0D0AyB0C0EtD0D0B2Q&cr=1725787544&ir="
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google

ageClassification}{google:searchVersion}{google:sessionToken}{google

refetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Widevine Content Decryption Module) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.6.703\_platform_specific\win_x86\widevinecdmadapter.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.89\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.89\internal-nacl-plugin No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.89\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll No File
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
CHR Plugin: (Java Deployment Toolkit 8.0.250.18) - C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 8 U25) - C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll No File
CHR Plugin: (MetaStream 3 Plugin) - C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()
CHR Plugin: (Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2013) - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (McAfee SecurityCenter) - c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL ()
CHR Profile: C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-09-21]
CHR Extension: (Google Docs) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-09-21]
CHR Extension: (Google Drive) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-21]
CHR Extension: (YouTube) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-09-21]
CHR Extension: (Google Search) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-09-21]
CHR Extension: (Google Sheets) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-09-21]
CHR Extension: (SiteAdvisor) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2014-09-21]
CHR Extension: (Bookmark Manager) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-02-08]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-05]
CHR Extension: (Google Wallet) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-09-21]
CHR Extension: (Gmail) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-09-21]
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2015-03-06]
CHR HKLM-x32\...\Chrome\Extension: [bopakagnckmlgajfccecajhnimjiiedh] - http://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [eefhnbpnnaaokmclnihgajdnlgljajjg] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2015-03-06]
CHR HKLM-x32\...\Chrome\Extension: [ggebenakhmhfdkmkemdmllecchcldgec] - https://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 0158351426288875mcinstcleanup; C:\WINDOWS\TEMP\015835~1.EXE [851136 2014-08-08] (McAfee, Inc.)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2449592 2014-11-12] (Microsoft Corporation)
R2 DellDataVault; C:\Program Files\Dell\DellDataVault\DellDataVault.exe [2557136 2015-02-26] (Dell Inc.)
R2 DellDataVaultWiz; C:\Program Files\Dell\DellDataVault\DellDataVaultWiz.exe [201936 2015-02-26] (Dell Inc.)
S2 DellDigitalDelivery; c:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe [173056 2012-06-19] (Dell Products, LP.) [File not signed]
R2 driverpsisrndrBckp.exe; C:\Users\Owner\AppData\Local\driverpsisrndrBckp\driverpsisrndrBckp.exe [229888 2015-02-28] () [File not signed]
R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-07-19] (Intel Corporation)
R2 McAfee SiteAdvisor Service; C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe [155368 2015-02-19] (McAfee, Inc.)
R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [562200 2015-01-13] (McAfee, Inc.)
S3 McAWFwk; C:\Program Files\mcafee\msc\McAWFwk.exe [332080 2012-01-26] (McAfee, Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
R2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\1.3.336.0\McCSPServiceHost.exe [422632 2014-11-21] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [601864 2015-01-07] (McAfee, Inc.)
S4 McOobeSv; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)
R2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [1050952 2014-11-06] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [221832 2014-10-01] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [189920 2014-10-01] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [254512 2012-04-24] ()
R2 SftService; C:\Program Files (x86)\Dell Backup and Recovery\sftservice.exe [1915480 2013-05-23] (SoftThinks SAS)
R2 SupportAssistAgent; C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe [19288 2015-03-04] (Dell Inc.)
R2 Task Manager Pro; C:\WINDOWS\taskmgr.exe [48128 2015-02-26] () [File not signed]
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-03] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-03] (Microsoft Corporation)
R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe [77824 2012-06-19] (Atheros) [File not signed]
S2 67d7717165bbdc4.exe; C:\Users\Owner\AppData\Local\7b8a788adc4859d7a43a8e66a84959ca\67d7717165bbdc4.exe [X]
S2 controllocalsplTask.exe; C:\Users\Owner\AppData\Local\controllocalsplTask\controllocalsplTask.exe [X]
S2 dfc86759; "C:\WINDOWS\system32\rundll32.exe" "c:\progra~3\perfor~1\PerformancerSvc.dll",service
S2 IconMotionRoot.exe; C:\Users\Owner\AppData\Local\IconMotionRoot\IconMotionRoot.exe [X]
S2 scriptsyncuiProvider.exe; C:\Users\Owner\AppData\Local\scriptsyncuiProvider\scriptsyncuiProvider.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [72136 2014-10-01] (McAfee, Inc.)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
R3 DDDriver; C:\Windows\system32\drivers\DDDriver64Dcsa.sys [23760 2015-01-30] (Dell Computer Corporation)
R3 DellProf; C:\Windows\system32\drivers\DellProf.sys [23312 2015-01-30] (Dell Computer Corporation)
S3 DellRbtn; C:\Windows\System32\drivers\DellRbtn.sys [10752 2013-01-24] (OSR Open Systems Resources, Inc.)
R3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
R3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [197704 2013-09-23] (McAfee, Inc.)
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [181584 2014-10-01] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [313680 2014-10-01] (McAfee, Inc.)
S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [70608 2014-10-01] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [526360 2014-10-01] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [786304 2014-10-01] (McAfee, Inc.)
R3 mfencbdc; C:\Windows\system32\DRIVERS\mfencbdc.sys [447440 2014-09-19] (McAfee, Inc.)
S3 mfencrk; C:\Windows\system32\DRIVERS\mfencrk.sys [96600 2014-09-19] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [348560 2014-10-01] (McAfee, Inc.)
R1 netfilter64; C:\Windows\System32\drivers\netfilter64.sys [41168 2014-11-19] (NetFilterSDK.com)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-03] (Microsoft Corporation)
S3 IntcAzAudAddService; \SystemRoot\system32\drivers\RTKVHD64.sys [X]
S3 RegFltrX64; \??\C:\Users\Owner\AppData\Local\IconMotionRoot\RegFltrX64.sys [X]
S1 wStLibG64; system32\drivers\wStLibG64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-15 13:03 - 2015-03-15 13:04 - 00030572 _____ () C:\Users\Owner\Desktop\FRST.txt
2015-03-15 13:03 - 2015-03-15 13:03 - 02095616 _____ (Farbar) C:\Users\Owner\Desktop\FRST64.exe
2015-03-15 13:03 - 2015-03-15 13:03 - 00000000 ____D () C:\FRST
2015-03-15 12:32 - 2015-03-15 12:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2015-03-11 17:55 - 2015-03-11 17:55 - 05318272 _____ (TeamViewer) C:\Users\Owner\Downloads\TeamViewerQS_en (2).exe
2015-03-10 21:28 - 2013-09-23 13:49 - 00197704 _____ (McAfee, Inc.) C:\WINDOWS\system32\Drivers\HipShieldK.sys
2015-03-10 18:14 - 2015-02-03 18:58 - 00264000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdFilter.sys
2015-03-10 18:14 - 2015-02-03 18:58 - 00114496 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdNisDrv.sys
2015-03-10 18:14 - 2015-02-03 18:58 - 00044024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdBoot.sys
2015-03-10 18:14 - 2015-02-02 18:53 - 00014848 _____ (Microsoft Corporation) C:\WINDOWS\system32\winshfhc.dll
2015-03-10 18:14 - 2015-02-02 18:53 - 00012800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winshfhc.dll
2015-03-10 18:14 - 2015-01-26 22:44 - 00933888 _____ (Microsoft Corporation) C:\WINDOWS\system32\calc.exe
2015-03-10 18:14 - 2015-01-23 20:51 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\calc.exe
2015-03-10 18:13 - 2015-03-05 21:53 - 00430080 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2015-03-10 18:13 - 2015-03-05 21:33 - 00358912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2015-03-10 18:13 - 2015-02-25 18:26 - 04178944 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2015-03-10 18:13 - 2015-02-06 18:09 - 00396419 _____ () C:\WINDOWS\system32\ApnDatabase.xml
2015-03-10 18:13 - 2015-01-23 02:17 - 00723072 _____ (Microsoft Corporation) C:\WINDOWS\system32\SHCore.dll
2015-03-10 18:13 - 2015-01-23 00:02 - 00560392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SHCore.dll
2015-03-10 18:12 - 2015-02-19 22:03 - 00358912 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2015-03-10 18:12 - 2015-02-19 21:58 - 00044032 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2015-03-10 18:12 - 2015-02-19 21:20 - 00301056 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2015-03-10 18:12 - 2015-02-19 21:15 - 00035840 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2015-03-10 18:12 - 2015-01-30 18:42 - 03097600 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
2015-03-10 18:12 - 2015-01-30 18:29 - 02484224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2015-03-10 18:12 - 2015-01-28 20:58 - 00347136 _____ (Microsoft Corporation) C:\WINDOWS\system32\photowiz.dll
2015-03-10 18:12 - 2015-01-28 20:29 - 00290816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\photowiz.dll
2015-03-10 18:12 - 2014-10-28 21:49 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\system32\lpk.dll
2015-03-10 18:12 - 2014-10-28 21:44 - 00096256 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontsub.dll
2015-03-10 18:12 - 2014-10-28 21:44 - 00014848 _____ (Microsoft Corporation) C:\WINDOWS\system32\dciman32.dll
2015-03-10 18:12 - 2014-10-28 21:04 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\lpk.dll
2015-03-10 18:12 - 2014-10-28 21:00 - 00077824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontsub.dll
2015-03-10 18:12 - 2014-10-28 21:00 - 00011776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dciman32.dll
2015-03-10 18:11 - 2015-02-05 15:24 - 01113920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys
2015-03-10 18:11 - 2015-01-29 22:01 - 00097792 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidbth.sys
2015-03-10 18:11 - 2015-01-28 20:04 - 01091072 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
2015-03-10 18:11 - 2015-01-28 20:04 - 00864256 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32spl.dll
2015-03-10 18:11 - 2014-10-28 21:43 - 00062976 _____ (Microsoft Corporation) C:\WINDOWS\system32\printui.exe
2015-03-10 18:11 - 2014-10-28 21:34 - 00309760 _____ (Microsoft Corporation) C:\WINDOWS\system32\compstui.dll
2015-03-10 18:11 - 2014-10-28 21:04 - 00066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\findnetprinters.dll
2015-03-10 18:11 - 2014-10-28 20:58 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\printui.exe
2015-03-10 18:11 - 2014-10-28 20:52 - 00289280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\compstui.dll
2015-03-10 18:11 - 2014-10-28 20:51 - 00477184 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiobj.dll
2015-03-10 18:11 - 2014-10-28 20:45 - 00221184 _____ (Microsoft Corporation) C:\WINDOWS\system32\prnntfy.dll
2015-03-10 18:11 - 2014-10-28 20:28 - 00055808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\findnetprinters.dll
2015-03-10 18:11 - 2014-10-28 20:20 - 00367104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiobj.dll
2015-03-10 18:11 - 2014-10-28 20:15 - 00199168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\prnntfy.dll
2015-03-10 18:11 - 2014-10-28 19:55 - 00192512 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiapi.dll
2015-03-10 18:11 - 2014-10-28 19:44 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiapi.dll
2015-03-10 18:11 - 2014-10-28 19:41 - 00269312 _____ (Microsoft Corporation) C:\WINDOWS\system32\DafPrintProvider.dll
2015-03-10 18:11 - 2014-10-28 19:35 - 00203776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DafPrintProvider.dll
2015-03-10 18:10 - 2015-02-05 20:28 - 02257408 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2015-03-10 18:10 - 2015-02-05 20:08 - 01943040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2015-03-10 18:10 - 2015-02-02 19:03 - 03551744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll
2015-03-10 18:10 - 2015-02-02 19:02 - 04298240 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll
2015-03-10 18:10 - 2015-01-29 21:03 - 01488896 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfc42u.dll
2015-03-10 18:10 - 2015-01-29 21:03 - 01464832 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfc42.dll
2015-03-10 18:10 - 2015-01-29 20:44 - 01230336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfc42u.dll
2015-03-10 18:10 - 2015-01-29 20:42 - 01204224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfc42.dll
2015-03-10 18:10 - 2015-01-29 20:29 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\atlthunk.dll
2015-03-10 18:10 - 2015-01-28 20:11 - 00274944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2015-03-10 18:10 - 2015-01-28 20:00 - 00210944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2015-03-10 18:10 - 2015-01-28 19:55 - 00971776 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll
2015-03-10 18:10 - 2015-01-28 19:50 - 00811008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll
2015-03-10 18:10 - 2015-01-27 21:24 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorageContextHandler.dll
2015-03-10 18:10 - 2015-01-27 20:47 - 00060928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StorageContextHandler.dll
2015-03-10 18:10 - 2014-10-28 21:34 - 00084992 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSCollect.exe
2015-03-10 18:10 - 2014-10-28 21:34 - 00079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSReset.exe
2015-03-10 18:10 - 2014-10-28 20:28 - 00048128 _____ (Microsoft Corporation) C:\WINDOWS\system32\atlthunk.dll
2015-03-10 18:10 - 2014-10-28 20:13 - 00315392 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll
2015-03-10 18:10 - 2014-10-28 19:55 - 00223744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll
2015-03-10 18:09 - 2015-01-30 18:20 - 00203264 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll
2015-03-10 18:09 - 2015-01-28 19:59 - 02773504 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2015-03-10 18:09 - 2015-01-28 19:49 - 02459136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2015-03-10 18:09 - 2015-01-28 10:41 - 07472960 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2015-03-10 18:09 - 2015-01-28 10:41 - 01733440 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2015-03-10 18:09 - 2015-01-28 10:41 - 01498360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2015-03-10 18:08 - 2015-01-29 21:02 - 00102912 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappgnui.dll
2015-03-10 18:08 - 2015-01-29 20:40 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappgnui.dll
2015-03-10 18:08 - 2015-01-29 20:37 - 00331776 _____ (Microsoft Corporation) C:\WINDOWS\system32\eapp3hst.dll
2015-03-10 18:08 - 2015-01-29 20:24 - 00339456 _____ (Microsoft Corporation) C:\WINDOWS\system32\eapphost.dll
2015-03-10 18:08 - 2015-01-29 20:24 - 00250880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eapp3hst.dll
2015-03-10 18:08 - 2015-01-29 20:16 - 00266752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eapphost.dll
2015-03-10 18:08 - 2015-01-29 20:08 - 00346112 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappcfg.dll
2015-03-10 18:08 - 2015-01-29 20:06 - 00278016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappcfg.dll
2015-03-10 18:08 - 2015-01-26 23:22 - 00131584 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2015-03-10 18:08 - 2015-01-26 21:11 - 03547648 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2015-03-10 18:08 - 2014-10-28 22:56 - 00027456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdpvideominiport.sys
2015-03-10 18:08 - 2014-10-28 21:37 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\system32\rfxvmt.dll
2015-03-10 18:08 - 2014-10-28 20:19 - 00070656 _____ (Microsoft Corporation) C:\WINDOWS\system32\eappprxy.dll
2015-03-10 18:08 - 2014-10-28 19:59 - 00056320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\eappprxy.dll
2015-03-10 18:07 - 2015-02-20 20:16 - 25021440 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-03-10 18:07 - 2015-02-20 19:41 - 12827648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-03-10 18:07 - 2015-02-20 19:27 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2015-03-10 18:07 - 2015-02-20 19:27 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2015-03-10 18:07 - 2015-02-20 19:25 - 19720192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-03-10 18:07 - 2015-02-20 18:58 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2015-03-10 18:07 - 2015-02-20 18:32 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2015-03-10 18:07 - 2015-02-19 21:49 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-03-10 18:07 - 2015-02-19 21:48 - 02886144 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-03-10 18:07 - 2015-02-19 21:47 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2015-03-10 18:07 - 2015-02-19 21:35 - 00816128 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-03-10 18:07 - 2015-02-19 21:34 - 00814080 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2015-03-10 18:07 - 2015-02-19 21:32 - 06035456 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-03-10 18:07 - 2015-02-19 21:09 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-03-10 18:07 - 2015-02-19 21:07 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2015-03-10 18:07 - 2015-02-19 21:06 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2015-03-10 18:07 - 2015-02-19 21:05 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2015-03-10 18:07 - 2015-02-19 21:03 - 02278400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-03-10 18:07 - 2015-02-19 20:59 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-03-10 18:07 - 2015-02-19 20:56 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-03-10 18:07 - 2015-02-19 20:52 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2015-03-10 18:07 - 2015-02-19 20:49 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-03-10 18:07 - 2015-02-19 20:49 - 00374272 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2015-03-10 18:07 - 2015-02-19 20:46 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2015-03-10 18:07 - 2015-02-19 20:43 - 14398976 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-03-10 18:07 - 2015-02-19 20:30 - 04300288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-03-10 18:07 - 2015-02-19 20:30 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-03-10 18:07 - 2015-02-19 20:29 - 02865152 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2015-03-10 18:07 - 2015-02-19 20:28 - 02358784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-03-10 18:07 - 2015-02-19 20:26 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2015-03-10 18:07 - 2015-02-19 20:24 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2015-03-10 18:07 - 2015-02-19 20:24 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-03-10 18:07 - 2015-02-19 20:16 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-03-10 18:07 - 2015-02-19 20:03 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-03-10 18:07 - 2015-02-19 20:01 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-03-10 18:07 - 2015-02-19 19:57 - 01311232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-03-10 18:07 - 2015-02-19 19:55 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-03-10 18:07 - 2015-01-29 13:45 - 01763352 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2015-03-10 18:07 - 2015-01-29 13:34 - 01488040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2015-03-10 18:06 - 2015-02-12 12:40 - 22291584 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2015-03-10 18:06 - 2015-02-12 12:34 - 19731824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2015-03-10 18:06 - 2015-02-07 18:57 - 01090048 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2015-03-10 18:06 - 2015-02-07 18:49 - 00791040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
2015-03-10 18:06 - 2014-12-11 00:36 - 00046456 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockScreenContentServer.exe
2015-03-10 18:05 - 2015-01-27 20:31 - 00402432 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPhoto.dll
2015-03-10 18:05 - 2015-01-27 20:11 - 00357376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPhoto.dll
2015-03-10 18:05 - 2015-01-27 18:47 - 02501368 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2015-03-10 18:05 - 2015-01-27 18:41 - 02207488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2015-03-10 18:05 - 2015-01-21 00:54 - 01384712 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2015-03-10 18:05 - 2015-01-21 00:15 - 01123848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2015-03-06 22:30 - 2015-03-06 22:30 - 00000000 _____ () C:\Recovery.txt
2015-03-05 23:59 - 2015-03-13 17:21 - 00000000 __HDC () C:\ProgramData\{6AACA38B-2810-4B47-BDEC-D7A1F38B1531}
2015-03-05 21:52 - 2015-03-07 17:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\herdProtect
2015-03-05 21:52 - 2015-03-07 16:54 - 00000000 ____D () C:\Program Files\Reason
2015-03-05 21:52 - 2015-03-05 21:52 - 02873112 _____ (Reason Company Software Inc.) C:\Users\Owner\Downloads\herdProtectScan_Setup.exe
2015-03-05 21:52 - 2015-03-05 21:52 - 00001135 _____ () C:\Users\Public\Desktop\herdProtect.lnk
2015-03-05 21:16 - 2015-03-11 18:07 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-03-05 21:15 - 2015-03-07 17:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-03-05 21:15 - 2015-03-07 17:07 - 00000000 ____D () C:\Users\Owner\Desktop\Windows
2015-03-05 21:15 - 2015-03-07 17:07 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-03-05 21:15 - 2015-03-07 16:54 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-03-05 21:15 - 2015-03-05 21:15 - 00001120 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-03-05 21:15 - 2014-11-21 07:14 - 00093400 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-03-05 21:15 - 2014-11-21 07:14 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-03-05 21:15 - 2014-11-21 07:14 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-03-05 21:14 - 2015-03-05 21:14 - 04909382 _____ () C:\Users\Owner\Downloads\mbam-chameleon-3.1.7.0.zip
2015-03-05 21:12 - 2015-03-05 21:12 - 05318272 _____ (TeamViewer) C:\Users\Owner\Downloads\TeamViewerQS_en (1).exe
2015-03-05 19:17 - 2015-03-15 12:49 - 05318272 _____ (TeamViewer) C:\Users\Owner\Downloads\TeamViewerQS_en.exe
2015-03-05 19:17 - 2015-03-05 19:17 - 00000000 ____D () C:\Users\Owner\AppData\Roaming\TeamViewer
2015-03-04 06:24 - 2015-02-26 06:25 - 00048128 _____ () C:\WINDOWS\taskmgr.exe
2015-03-02 05:16 - 2015-03-04 06:25 - 00000689 _____ () C:\WINDOWS\taskmgr.InstallLog
2015-03-01 12:06 - 2014-12-13 16:28 - 00513488 _____ () C:\WINDOWS\SysWOW64\locale.nls
2015-03-01 12:06 - 2014-12-13 16:28 - 00513488 _____ () C:\WINDOWS\system32\locale.nls
2015-03-01 12:06 - 2014-10-28 20:27 - 01200128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll
2015-03-01 12:06 - 2014-10-28 20:27 - 00323072 _____ (Microsoft Corporation) C:\WINDOWS\system32\GlobCollationHost.dll
2015-03-01 12:06 - 2014-10-28 20:04 - 00868352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll
2015-03-01 12:06 - 2014-10-28 20:04 - 00200704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GlobCollationHost.dll
2015-02-28 21:06 - 2015-03-07 17:09 - 00000000 ____D () C:\Users\Owner\AppData\Local\driverpsisrndrBckp
2015-02-28 21:06 - 2015-03-07 17:07 - 00000000 ____D () C:\Users\Owner\AppData\Local\Helper
2015-02-28 21:06 - 2015-03-04 06:24 - 00000696 _____ () C:\WINDOWS\InstallUtil.InstallLog
2015-02-28 21:06 - 2015-02-28 21:06 - 00000343 _____ () C:\WINDOWS\wauctla.InstallLog
2015-02-26 20:42 - 2015-03-06 06:46 - 00000000 ____D () C:\Users\Owner\AppData\Local\pathrecycleBckp
2015-02-26 20:42 - 2015-02-26 20:42 - 00000000 ____D () C:\Users\Owner\AppData\Local\HelperApp
2015-02-23 18:54 - 2015-02-23 18:54 - 00000000 ____D () C:\Users\Owner\AppData\Local\Macromedia
2015-02-23 18:43 - 2015-02-23 18:44 - 00000000 ____D () C:\Users\Owner\AppData\Local\Mozilla
2015-02-23 18:42 - 2015-02-23 18:42 - 40014832 _____ () C:\Users\Owner\Downloads\Firefox Setup 35.0.1.exe
2015-02-23 18:42 - 2015-02-23 18:42 - 00000000 ____D () C:\ProgramData\Mozilla
2015-02-20 20:22 - 2014-04-15 18:35 - 00028352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aspnet_counters.dll
2015-02-20 20:22 - 2014-04-15 18:34 - 00029888 _____ (Microsoft Corporation) C:\WINDOWS\system32\aspnet_counters.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-15 13:00 - 2013-08-22 10:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-03-15 12:57 - 2014-01-26 18:58 - 00004992 _____ () C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for DELL-SLIMLINE-Owner Dell-Slimline
2015-03-15 12:56 - 2013-08-13 21:48 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3980855148-3933710502-1200373542-1001
2015-03-15 12:51 - 2013-12-03 21:48 - 01387878 _____ () C:\WINDOWS\WindowsUpdate.log
2015-03-15 12:50 - 2014-03-26 18:11 - 00164352 ___SH () C:\Users\Owner\Downloads\Thumbs.db
2015-03-15 12:36 - 2013-08-22 08:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2015-03-15 12:35 - 2013-03-19 20:23 - 00000000 ____D () C:\Program Files (x86)\Dell Backup and Recovery
2015-03-15 12:30 - 2014-11-16 09:09 - 00000920 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-15 12:30 - 2013-12-03 22:09 - 00000000 ___DO () C:\Users\Owner\SkyDrive
2015-03-15 12:28 - 2014-06-08 06:33 - 00000830 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-03-14 04:34 - 2013-08-22 10:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-03-14 04:26 - 2013-12-07 14:02 - 00003946 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{157290A3-82D1-4DFC-9F48-72B24D5EC2DC}
2015-03-13 22:12 - 2014-11-16 09:09 - 00000924 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-13 22:07 - 2013-08-22 10:36 - 00000000 ____D () C:\WINDOWS\rescache
2015-03-13 19:14 - 2013-08-14 05:09 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-03-13 19:10 - 2013-08-14 05:09 - 122905848 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-03-13 18:36 - 2013-12-03 21:38 - 00000000 ____D () C:\Users\Owner
2015-03-13 18:18 - 2013-09-29 23:04 - 00865408 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-03-13 18:12 - 2014-03-26 19:23 - 00007352 _____ () C:\WINDOWS\setupact.log
2015-03-13 18:12 - 2013-08-22 09:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-03-13 17:21 - 2015-02-11 18:55 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Dell SupportAssistAgent AutoUpdate
2015-03-13 17:20 - 2015-02-11 18:55 - 00000000 ____D () C:\ProgramData\SupportAssistAgent
2015-03-12 04:32 - 2013-03-19 20:21 - 00000000 ____D () C:\Program Files\Common Files\mcafee
2015-03-11 17:29 - 2012-07-26 02:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-03-11 04:25 - 2013-08-22 09:44 - 00493392 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2015-03-11 04:24 - 2014-03-26 18:52 - 01354086 _____ () C:\WINDOWS\PFRO.log
2015-03-10 22:14 - 2013-08-22 08:25 - 01048576 ___SH () C:\WINDOWS\system32\config\BBI
2015-03-10 22:12 - 2013-08-22 10:36 - 00000000 ___RD () C:\WINDOWS\ToastData
2015-03-10 22:12 - 2013-08-22 10:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-03-10 22:12 - 2013-08-22 10:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-03-10 22:12 - 2013-08-22 10:36 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2015-03-10 22:12 - 2013-08-22 10:36 - 00000000 ____D () C:\WINDOWS\WinStore
2015-03-10 22:12 - 2013-08-22 10:36 - 00000000 ____D () C:\Program Files\Windows Defender
2015-03-10 22:12 - 2013-08-22 10:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2015-03-10 21:27 - 2012-07-26 03:12 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP
2015-03-07 17:09 - 2015-01-20 18:00 - 00000000 ____D () C:\ProgramData\ZjxWyUOEK
2015-03-07 17:09 - 2015-01-16 22:52 - 00000000 ____D () C:\WINDOWS\SysWOW64\iconocrapi
2015-03-07 17:09 - 2014-07-06 09:13 - 00000000 ____D () C:\Program Files (x86)\7B0A8368-1A6F-48A5-B236-8BD61816B3F9
2015-03-07 17:09 - 2013-03-19 20:22 - 00000000 ____D () C:\WINDOWS\eBayDesktopShortcut
2015-03-07 17:07 - 2015-01-21 19:03 - 00000000 ____D () C:\ProgramData\Browser
2015-03-07 17:07 - 2015-01-20 17:59 - 00000000 ____D () C:\ProgramData\Yahoo! Companion
2015-03-07 17:07 - 2014-11-16 09:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-03-07 17:07 - 2014-06-08 06:33 - 00000000 ____D () C:\ProgramData\McAfee Security Scan
2015-03-07 17:07 - 2014-05-06 05:18 - 00000000 ____D () C:\Program Files (x86)\Amazon Browser Bar
2015-03-07 17:07 - 2013-08-22 10:36 - 00000000 ___HD () C:\WINDOWS\system32\GroupPolicy
2015-03-07 17:07 - 2013-08-22 10:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\WinMetadata
2015-03-07 17:07 - 2013-08-22 10:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\GroupPolicy
2015-03-07 17:07 - 2013-03-19 20:21 - 00000000 ____D () C:\Program Files (x86)\mcafee.com
2015-03-07 17:07 - 2012-05-08 06:37 - 00000000 ____D () C:\DELL
2015-03-07 16:58 - 2013-08-22 10:36 - 00000000 ____D () C:\WINDOWS\registration
2015-03-07 16:58 - 2013-08-22 08:36 - 00000000 ____D () C:\WINDOWS\system32\Sysprep
2015-03-07 16:56 - 2013-08-18 09:53 - 00000000 ____D () C:\Users\Owner\AppData\Local\Google
2015-03-07 16:56 - 2013-03-19 20:21 - 00000000 ____D () C:\ProgramData\McAfee
2015-03-07 16:52 - 2015-01-20 17:59 - 00000000 ____D () C:\Program Files (x86)\Yahoo!
2015-03-07 16:52 - 2014-01-26 18:52 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2015-03-07 16:52 - 2013-03-19 20:21 - 00000000 ____D () C:\Program Files (x86)\McAfee
2015-03-06 20:40 - 2013-08-22 10:36 - 00000000 ____D () C:\WINDOWS\system32\NDF
2015-03-05 21:48 - 2014-04-27 07:10 - 00000000 ____D () C:\Users\Owner\AppData\Roaming\systweak
2015-03-05 21:48 - 2013-03-19 20:23 - 00000000 ____D () C:\Temp
2015-03-04 16:24 - 2014-10-17 05:24 - 00792032 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-03-04 16:24 - 2014-10-17 05:24 - 00178144 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-03-02 05:14 - 2013-08-22 08:25 - 01048576 ___SH () C:\WINDOWS\system32\config\BBI(48)
2015-03-02 05:14 - 2013-08-22 08:25 - 01048576 ___SH () C:\WINDOWS\system32\config\BBI(43)
2015-02-28 21:06 - 2014-05-05 17:36 - 00000258 __RSH () C:\ProgramData\ntuser.pol
2015-02-28 21:00 - 2015-01-20 17:59 - 00000000 ____D () C:\ProgramData\Yahoo!
2015-02-23 19:02 - 2014-05-05 18:02 - 00001144 _____ () C:\Users\Owner\Desktop\Live PC Help.lnk
2015-02-23 19:02 - 2014-04-27 07:10 - 00000000 ____D () C:\ProgramData\Systweak

==================== Files in the root of some directories =======

2014-12-02 21:11 - 2014-11-26 16:47 - 1694595 _____ ( ) C:\Program Files (x86)\UpdInstaller.exe
2014-05-05 17:37 - 2014-05-05 18:24 - 0000316 _____ () C:\Users\Owner\AppData\Roaming\aps.uninstall.scan.results
2015-01-21 05:59 - 2015-01-21 05:59 - 0000112 _____ () C:\ProgramData\XTkgSf5yP.dat
2013-03-19 20:20 - 2013-03-19 20:21 - 0000119 _____ () C:\ProgramData\{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}.log
2013-03-19 20:18 - 2013-03-19 20:18 - 0000106 _____ () C:\ProgramData\{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}.log
2013-03-19 20:18 - 2013-03-19 20:19 - 0000111 _____ () C:\ProgramData\{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}.log
2013-03-19 20:17 - 2013-03-19 20:17 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
2013-03-19 20:19 - 2013-03-19 20:20 - 0000108 _____ () C:\ProgramData\{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}.log

Files to move or delete:
====================
C:\ProgramData\XTkgSf5yP.dat

Some content of TEMP:
====================
C:\Users\Owner\AppData\Local\Temp\AcsInstall.dll
C:\Users\Owner\AppData\Local\Temp\jre-8u31-windows-au.exe
C:\Users\Owner\AppData\Local\Temp\nsk4524.tmp.exe
C:\Users\Owner\AppData\Local\Temp\OfficeSetup.exe
C:\Users\Owner\AppData\Local\Temp\SendMsg.dll
C:\Users\Owner\AppData\Local\Temp\SfpcHelper_installFinish.exe
C:\Users\Owner\AppData\Local\Temp\SfpcHelper_installStart.exe
C:\Users\Owner\AppData\Local\Temp\SHFOLDER.DLL
C:\Users\Owner\AppData\Local\Temp\SpOrder.dll
C:\Users\Owner\AppData\Local\Temp\SymCCIS.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite10231.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite11220.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite12611.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite12781.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite12980.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite13138.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite13209.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite14071.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite14288.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite14325.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite15981.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite16047.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite16302.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite16377.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite16429.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite16691.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite17880.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite18641.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite19302.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite20050.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite21308.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite21891.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite21940.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite22928.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite22996.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite23107.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite23417.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite24158.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite24314.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite26695.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite27269.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite27720.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite28531.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite28709.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite29655.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite31202.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite33238.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite33362.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite34368.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite34498.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite35059.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite35322.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite35958.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite36161.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite36909.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite37291.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite37470.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite37506.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite37886.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite38934.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite39127.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite39426.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite40692.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite40726.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite41033.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite41095.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite42162.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite42280.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite42378.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite42760.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite43756.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite44443.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite44813.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite45176.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite45749.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite46265.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite46605.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite46640.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite46824.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite47175.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite47287.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite48034.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite48370.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite48913.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite49203.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite49579.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite49643.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite50023.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite50246.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite50745.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite51969.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite52389.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite52405.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite53390.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite53735.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite54248.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite54929.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite55250.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite55392.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite55520.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite55827.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite56933.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite57147.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite57724.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite58790.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite59611.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite60171.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite61037.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite61211.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite61442.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite61800.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite62481.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite62951.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite63746.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite63974.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite64603.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite65180.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite65940.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite66465.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite66578.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite67192.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite67937.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite68532.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite68543.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite69203.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite69235.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite69297.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite70634.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite71103.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite72010.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite72279.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite73270.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite73829.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite74550.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite74919.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite75388.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite76180.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite77394.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite78307.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite78310.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite78379.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite79086.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite79405.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite79507.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite79886.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite80326.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite80544.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite81631.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite81938.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite81959.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite82431.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite82957.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite83687.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite84570.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite84832.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite84993.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite85332.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite85369.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite85593.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite85830.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite86216.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite86515.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite87308.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite87426.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite87547.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite87735.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite88116.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite88985.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite89210.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite89596.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite89815.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite90560.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite91263.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite91460.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite91545.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite91753.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite92013.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite92418.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite92422.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite92912.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite93147.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite93899.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite94234.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite95372.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite95669.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite95726.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite96920.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite97458.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite97772.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite97815.dll
C:\Users\Owner\AppData\Local\Temp\System.Data.SQLite98156.dll
C:\Users\Owner\AppData\Local\Temp\vcredist_x64.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-03-13 21:33

==================== End Of Log ============================

### End FRST.TXT ###

### Start Additions.txt ###

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015
Ran by Owner at 2015-03-15 13:05:15
Running from C:\Users\Owner\Desktop
Boot Mode: Normal
==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: McAfee Anti-Virus and Anti-Spyware (Enabled - Up to date) {DA9F8ED0-D0DE-39CC-F55A-51AB4CC1B556}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: McAfee Anti-Virus and Anti-Spyware (Enabled - Up to date) {61FE6F34-F6E4-3642-CFEA-6AD93746FFEB}
FW: McAfee Firewall (Enabled) {E2A40FF5-9AB1-3894-DE05-F89EB212F22D}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
AOL Uninstaller (Choose which Products to Remove) (HKLM-x32\...\AOL Uninstaller) (Version: - AOL Inc.)
Coupon Printer for Windows (HKLM-x32\...\Coupon Printer for Windows5.0.0.3) (Version: 5.0.0.3 - Coupons.com Incorporated)
CyberLink Media Suite Essentials (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dell Backup and Recovery - Support Software (HKLM-x32\...\{A9668246-FB70-4103-A1E3-66C9BC2EFB49}) (Version: 1.5.0.0 - Dell Inc.)
Dell Backup and Recovery (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 1.5.0.0 - Dell Inc.)
Dell Data Vault (Version: 4.2.2.0 - Dell Inc.) Hidden
Dell Digital Delivery (HKLM-x32\...\{D9ED3EFC-AB00-4CE0-ADED-80EE6B1158A7}) (Version: 2.2.2000.0 - Dell Products, LP)
Dell SupportAssist (HKLM\...\PC-Doctor for Windows) (Version: 1.0.6584.52 - Dell)
Dell SupportAssistAgent (HKLM-x32\...\{287348C8-8B47-4C36-AF28-441A3B7D8722}) (Version: 1.0.2.57295 - Dell)
Dell Wireless Driver Installation (HKLM-x32\...\{451517F1-7E41-400B-AA36-FB7E2563526D}) (Version: 10.0 - Dell)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 41.0.2272.89 - Google Inc.)
Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
herdProtect Anti-Malware Scanner (HKLM-x32\...\herdProtectScan) (Version: 1.0 - Reason Company Software Inc.)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1008 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1281 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3316 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.6.0.1030 - Intel Corporation)
Java 7 Update 65 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217065FF}) (Version: 7.0.650 - Oracle)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
McAfee LiveSafe – Internet Security (HKLM-x32\...\MSC) (Version: 13.6.1529 - McAfee, Inc.)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
McAfee SiteAdvisor (HKLM-x32\...\{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}) (Version: 3.7.194 - McAfee, Inc.)
Microsoft Office 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 15.0.4693.1002 - Microsoft Corporation)
Microsoft SkyDrive (HKU\S-1-5-21-3980855148-3933710502-1200373542-1001\...\SkyDriveSetup.exe) (Version: 17.0.2015.0811 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4693.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4693.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4693.1002 - Microsoft Corporation) Hidden
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Viewpoint Media Player (HKLM-x32\...\ViewpointMediaPlayer) (Version: - )
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)
Yahoo! Toolbar (HKLM-x32\...\Yahoo! Companion) (Version: - Yahoo! Inc.)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3980855148-3933710502-1200373542-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Owner\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points =========================

05-03-2015 22:45:01 herdProtect before 138 removals
06-03-2015 06:27:01 Restore Operation
10-03-2015 20:00:38 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 08:25 - 2014-05-05 18:16 - 00008953 ____A C:\WINDOWS\system32\Drivers\etc\hosts
216.239.32.20 google.com Google
216.239.32.20 google.com Google
216.239.32.20 google.com Google
216.239.32.20 google.com Google
216.239.32.20 google.com Google
216.239.32.20 google.com Google
216.239.32.20 google.com Google
216.239.32.20 google.com Google
216.239.32.20 google.com Google
216.239.32.20 google.com Google
216.239.32.20 google.com Google
216.239.32.20 google.com Google
216.239.32.20 google.com Google
216.239.32.20 google.com Google
216.239.32.20 google.com Google
216.239.32.20 google.com Google
216.239.32.20 google.com Google
216.239.32.20 google.com Google
216.239.32.20 google.com Google
216.239.32.20 google.com Google
216.239.32.20 google.com Google
216.239.32.20 google.com Google
216.239.32.20 google.com Google
216.239.32.20 google.com Google
216.239.32.20 google.com Google
216.239.32.20 google.com Google
216.239.32.20 google.com Google
216.239.32.20 google.com Google
216.239.32.20 google.com Google

There are 162 more lines.

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {068DB2AD-867E-4803-A2BF-2A28B593C6EF} - System32\Tasks\Dell SupportAssistAgent AutoUpdate => C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssist.exe [2015-03-04] (Dell Inc.)
Task: {15F9F6B4-8012-47F5-80D3-E634EDA26E7F} - System32\Tasks\{8C676202-8115-48F8-8ACF-6BC399A65D7C} => pcalua.exe -a C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_13_0_0_214_Plugin.exe -c -maintain plugin
Task: {17F33AE1-84B9-4B2E-9EB5-710923E79B24} - System32\Tasks\LaunchApp => C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe <==== ATTENTION
Task: {2596B29D-2912-41D1-9903-1F38DA14C9FC} - System32\Tasks\GenericSettingsHandler\Windows-Credentials\RetrySyncTask_for_S-1-5-21-3980855148-3933710502-1200373542-1001
Task: {45713B6D-40ED-43DC-8E1C-DE064A9CCB72} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {54340A37-472C-40EA-A478-A823EF44C843} - \BrowserSafeguard Update Task No Task File <==== ATTENTION
Task: {56F4867C-DB88-4F09-8850-4B52FC1A004A} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-01-13] (Microsoft Corporation)
Task: {62C93226-B2A2-426F-9B28-7723F64BB04B} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe
Task: {698AEE9F-B3F4-497D-B130-70DD7804AEA4} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-03-13] (Microsoft Corporation)
Task: {6B591404-1252-4244-9B4F-7C84047C835A} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\Dell\SupportAssist\sessionchecker.exe [2015-02-03] (PC-Doctor, Inc.)
Task: {6E7A5205-7283-4EB6-A60B-16CECAEC4DE9} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {80C9C589-4380-4FE6-8AA6-261E56724F33} - System32\Tasks\CLVDLauncher => C:\Program Files (x86)\CyberLink\Power2Go8\CLVDLauncher.exe [2012-12-03] (CyberLink Corp.)
Task: {8C34E9A4-C80F-4A24-ADEE-2C7DD5A8766C} - System32\Tasks\Microsoft Office 15 Sync Maintenance for DELL-SLIMLINE-Owner Dell-Slimline => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2015-01-06] (Microsoft Corporation)
Task: {96AB834F-5935-43F3-9FBC-08C4A31F033A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-11-16] (Google Inc.)
Task: {A7FA2242-1867-4DA7-923E-929F5334584E} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\Dell\SupportAssist\uaclauncher.exe [2015-02-03] (PC-Doctor, Inc.)
Task: {AC5FCF34-97FF-42DD-900D-DD70B056AD4C} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-04] (Adobe Systems Incorporated)
Task: {E023D50D-B25E-446D-AAE9-2E56D25C44FC} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-11-04] (Microsoft Corporation)
Task: {E6EA81F5-0272-4538-A157-FA57130509C7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-11-16] (Google Inc.)
Task: {EB4739B6-87AF-41B4-A327-AAA1C502B9B3} - System32\Tasks\CLMLSvc_P2G8 => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [2012-12-03] (CyberLink)
Task: {F772C4AE-B65B-4264-9886-689497B3BBE6} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {FA632B00-E22E-45A1-BD2F-03C64975085A} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2014-03-24 19:35 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2015-02-28 21:06 - 2015-02-28 21:06 - 00229888 _____ () C:\Users\Owner\AppData\Local\driverpsisrndrBckp\driverpsisrndrBckp.exe
2013-03-19 20:19 - 2012-04-24 21:43 - 00254512 _____ () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
2015-03-04 06:24 - 2015-02-26 06:25 - 00048128 _____ () C:\WINDOWS\taskmgr.exe
2015-02-28 21:23 - 2014-12-23 14:53 - 08898728 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2013-10-04 00:42 - 2013-10-04 00:42 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-08-22 02:19 - 2013-08-22 01:54 - 00174592 _____ () C:\WINDOWS\system32\WinMetadata\Windows.UI.winmd
2013-07-06 11:09 - 2013-04-19 17:51 - 00023328 _____ () C:\Program Files (x86)\Dell Backup and Recovery\Components\Shell\DBRCrawler.exe
2013-07-06 11:09 - 2013-04-19 17:52 - 00049440 _____ () C:\Program Files (x86)\Dell Backup and Recovery\Components\Shell\STCommonShellIntegration.dll
2015-02-28 21:06 - 2014-07-08 09:22 - 00095232 _____ () C:\Users\Owner\AppData\Local\driverpsisrndrBckp\qjson0.dll
2015-02-21 17:53 - 2015-02-21 17:53 - 00016384 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PSIClient\c89a3da49bf7bd161745f4228277ea00\PSIClient.ni.dll
2013-03-19 20:14 - 2012-07-18 14:55 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2014-11-19 18:25 - 2014-11-19 18:25 - 00316576 _____ () C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\AppVIsvStream32.dll
2013-03-19 20:18 - 2012-06-07 22:34 - 00627216 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2012-06-08 13:34 - 2012-06-08 13:34 - 00016400 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2013-07-06 11:09 - 2013-05-02 18:01 - 01813792 _____ () C:\Program Files (x86)\Dell Backup and Recovery\OLCoreWrapper.dll
2014-08-19 13:34 - 2014-08-19 13:34 - 00048640 _____ () C:\Program Files (x86)\AOL Desktop 9.7a\zlib.dll
2014-08-19 13:34 - 2014-08-19 13:34 - 21151232 _____ () C:\Program Files (x86)\AOL Desktop 9.7a\libcef.dll
2014-08-19 13:34 - 2014-08-19 13:34 - 00648704 _____ () C:\Program Files (x86)\AOL Desktop 9.7a\libglesv2.dll
2014-08-19 13:34 - 2014-08-19 13:34 - 00122880 _____ () C:\Program Files (x86)\AOL Desktop 9.7a\libegl.dll
2015-03-12 17:21 - 2015-03-07 01:12 - 01174856 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.89\libglesv2.dll
2015-03-12 17:21 - 2015-03-07 01:12 - 00080200 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.89\libegl.dll
2015-03-12 17:21 - 2015-03-07 01:13 - 09279304 _____ () C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.89\pdf.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:373E1720
AlternateDataStreams: C:\Users\Owner\SkyDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Driver"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3980855148-3933710502-1200373542-1001\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 71.10.216.1 - 71.10.216.2

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run32: => "MapsGalaxy_39 Browser Plugin Loader 64"

==================== Accounts: =============================

Administrator (S-1-5-21-3980855148-3933710502-1200373542-500 - Administrator - Disabled)
Guest (S-1-5-21-3980855148-3933710502-1200373542-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3980855148-3933710502-1200373542-1003 - Limited - Enabled)
Owner (S-1-5-21-3980855148-3933710502-1200373542-1001 - Administrator - Enabled) => C:\Users\Owner

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (03/15/2015 00:47:10 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program waol.exe version 9.7.3.1 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 1960

Start Time: 01d05f47e1736501

Termination Time: 15

Application Path: C:\Program Files (x86)\AOL Desktop 9.7a\waol.exe

Report Id: 4c5cfe3a-cb3b-11e4-bec0-a41f724f2cb0

Faulting package full name:

Faulting package-relative application ID:

Error: (03/13/2015 05:31:06 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DELL-SLIMLINE)
Description: Activation of app Microsoft.MicrosoftMahjong_8wekyb3d8bbwe!MicrosoftMahjong failed with error: -2144927142 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (03/12/2015 05:35:36 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DELL-SLIMLINE)
Description: Activation of app Microsoft.MicrosoftMahjong_8wekyb3d8bbwe!MicrosoftMahjong failed with error: -2144927142 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (03/11/2015 06:33:49 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: herdProtectScan.exe, version: 1.0.3.9, time stamp: 0x549300f9
Faulting module name: LSASRV.dll, version: 6.3.9600.17415, time stamp: 0x54504358
Exception code: 0xc0000005
Fault offset: 0x000000000005036a
Faulting process id: 0x8a8
Faulting application start time: 0xherdProtectScan.exe0
Faulting application path: herdProtectScan.exe1
Faulting module path: herdProtectScan.exe2
Report Id: herdProtectScan.exe3
Faulting package full name: herdProtectScan.exe4
Faulting package-relative application ID: herdProtectScan.exe5

Error: (03/11/2015 05:45:03 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DELL-SLIMLINE)
Description: Activation of app Microsoft.MicrosoftMahjong_8wekyb3d8bbwe!MicrosoftMahjong failed with error: -2144927142 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (03/11/2015 04:27:17 AM) (Source: Microsoft-Windows-WMI) (EventID: 24) (User: NT AUTHORITY)
Description: Event provider ProtectionManagement attempted to register query "select * from MSFT_MpEvent" whose target class "MSFT_MpEvent" in //./root/microsoft/protectionManagement namespace does not exist. The query will be ignored.

Error: (03/11/2015 04:27:17 AM) (Source: Microsoft-Windows-WMI) (EventID: 24) (User: NT AUTHORITY)
Description: Event provider attempted to register query "select * from MSFT_MpEvent" whose target class "MSFT_MpEvent" in //./root/microsoft/protectionManagement namespace does not exist. The query will be ignored.

Error: (03/10/2015 05:55:19 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: delegate_execute.exe, version: 41.0.2272.76, time stamp: 0x54f1041c
Faulting module name: delegate_execute.exe, version: 41.0.2272.76, time stamp: 0x54f1041c
Exception code: 0xc0000005
Fault offset: 0x0002b9f0
Faulting process id: 0xe80
Faulting application start time: 0xdelegate_execute.exe0
Faulting application path: delegate_execute.exe1
Faulting module path: delegate_execute.exe2
Report Id: delegate_execute.exe3
Faulting package full name: delegate_execute.exe4
Faulting package-relative application ID: delegate_execute.exe5

Error: (03/08/2015 11:51:21 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: delegate_execute.exe, version: 41.0.2272.76, time stamp: 0x54f1041c
Faulting module name: delegate_execute.exe, version: 41.0.2272.76, time stamp: 0x54f1041c
Exception code: 0xc0000005
Fault offset: 0x0002c095
Faulting process id: 0xbf0
Faulting application start time: 0xdelegate_execute.exe0
Faulting application path: delegate_execute.exe1
Faulting module path: delegate_execute.exe2
Report Id: delegate_execute.exe3
Faulting package full name: delegate_execute.exe4
Faulting package-relative application ID: delegate_execute.exe5

Error: (03/08/2015 10:48:32 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: McChHost.exe, version: 3.7.2.117, time stamp: 0x54c94577
Faulting module name: ntdll.dll, version: 6.3.9600.17630, time stamp: 0x54b0d74f
Exception code: 0xc0000005
Fault offset: 0x0001e193
Faulting process id: 0x19ec
Faulting application start time: 0xMcChHost.exe0
Faulting application path: McChHost.exe1
Faulting module path: McChHost.exe2
Report Id: McChHost.exe3
Faulting package full name: McChHost.exe4
Faulting package-relative application ID: McChHost.exe5

System errors:
=============
Error: (03/15/2015 00:31:00 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SftService service.

Error: (03/14/2015 04:24:18 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SftService service.

Error: (03/13/2015 07:16:36 PM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )
Description: 4

Error: (03/13/2015 06:36:55 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SftService service.

Error: (03/13/2015 06:15:59 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Dell Digital Delivery Service service terminated unexpectedly. It has done this 1 time(s).

Error: (03/13/2015 06:13:50 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The driverpsisrndrBckp.exe service hung on starting.

Error: (03/13/2015 06:12:56 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The scriptsyncuiProvider.exe service failed to start due to the following error:
%%2

Error: (03/13/2015 06:12:56 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The IconMotionRoot.exe service failed to start due to the following error:
%%2

Error: (03/13/2015 06:12:56 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Performancer service to connect.

Error: (03/13/2015 06:12:26 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The controllocalsplTask.exe service failed to start due to the following error:
%%2

Microsoft Office Sessions:
=========================
Error: (03/15/2015 00:47:10 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: waol.exe9.7.3.1196001d05f47e173650115C:\Program Files (x86)\AOL Desktop 9.7a\waol.exe4c5cfe3a-cb3b-11e4-bec0-a41f724f2cb0

Error: (03/13/2015 05:31:06 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DELL-SLIMLINE)
Description: Microsoft.MicrosoftMahjong_8wekyb3d8bbwe!MicrosoftMahjong-2144927142

Error: (03/12/2015 05:35:36 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DELL-SLIMLINE)
Description: Microsoft.MicrosoftMahjong_8wekyb3d8bbwe!MicrosoftMahjong-2144927142

Error: (03/11/2015 06:33:49 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: herdProtectScan.exe1.0.3.9549300f9LSASRV.dll6.3.9600.1741554504358c0000005000000000005036a8a801d05c53a28f6947C:\Program Files\Reason\herdProtect\Scanner\herdProtectScan.exeC:\WINDOWS\SYSTEM32\LSASRV.dll1129724d-c847-11e4-bebf-a41f724f2cb0

Error: (03/11/2015 05:45:03 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DELL-SLIMLINE)
Description: Microsoft.MicrosoftMahjong_8wekyb3d8bbwe!MicrosoftMahjong-2144927142

Error: (03/11/2015 04:27:17 AM) (Source: Microsoft-Windows-WMI) (EventID: 24) (User: NT AUTHORITY)
Description: ProtectionManagementselect * from MSFT_MpEventMSFT_MpEvent//./root/microsoft/protectionManagement

Error: (03/11/2015 04:27:17 AM) (Source: Microsoft-Windows-WMI) (EventID: 24) (User: NT AUTHORITY)
Description: select * from MSFT_MpEventMSFT_MpEvent//./root/microsoft/protectionManagement

Error: (03/10/2015 05:55:19 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: delegate_execute.exe41.0.2272.7654f1041cdelegate_execute.exe41.0.2272.7654f1041cc00000050002b9f0e8001d05b854714017fC:\Program Files (x86)\Google\Chrome\Application\41.0.2272.76\delegate_execute.exeC:\Program Files (x86)\Google\Chrome\Application\41.0.2272.76\delegate_execute.exe8617e4c0-c778-11e4-bebe-a41f724f2cb0

Error: (03/08/2015 11:51:21 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: delegate_execute.exe41.0.2272.7654f1041cdelegate_execute.exe41.0.2272.7654f1041cc00000050002c095bf001d059c019ab4d02C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.76\delegate_execute.exeC:\Program Files (x86)\Google\Chrome\Application\41.0.2272.76\delegate_execute.exe589e7fb0-c5b3-11e4-bebe-a41f724f2cb0

Error: (03/08/2015 10:48:32 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: McChHost.exe3.7.2.11754c94577ntdll.dll6.3.9600.1763054b0d74fc00000050001e19319ec01d059a2a926f640C:\Program Files (x86)\McAfee\SiteAdvisor\McChHost.exeC:\WINDOWS\SYSTEM32\ntdll.dll923ddc49-c5aa-11e4-bebe-a41f724f2cb0

CodeIntegrity Errors:
===================================
Date: 2015-02-12 04:32:33.446
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files (x86)\Web Protect\pcwtc64f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-12-09 19:13:41.807
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files (x86)\Web Protect\pcwtc64f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-11-14 17:23:43.733
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files (x86)\Web Protect\pcwtc64f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-10-17 05:43:28.184
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files (x86)\Web Protect\pcwtc64f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-09-14 07:29:06.676
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files (x86)\Web Protect\pcwtc64f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-08-15 05:34:34.176
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files (x86)\Web Protect\pcwtc64f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-07-22 06:29:48.427
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files (x86)\Web Protect\pcwtc64f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-07-11 21:20:58.610
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files (x86)\Web Protect\pcwtc64f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-07-11 20:16:28.310
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume5\Program Files (x86)\Web Protect\pcwtc64f.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

==================== Memory info ===========================

Processor: Intel(R) Pentium(R) CPU G2020 @ 2.90GHz
Percentage of memory in use: 50%
Total physical RAM: 3970.08 MB
Available physical RAM: 1969.35 MB
Total Pagefile: 7938.08 MB
Available Pagefile: 5122.83 MB
Total Virtual: 131072 MB
Available Virtual: 131071.76 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:425.84 GB) (Free:367.55 GB) NTFS
Drive e: (RCT2_TTP) (CDROM) (Total:0.59 GB) (Free:0 GB) CDFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 531CB751)

Partition: GPT Partition Type.

==================== End Of Log ============================

### End Additions.txt ###

Corrine · Mar 15, 2015

Hi, BetaLeaf. It appears I should have read your post instead of following your PM request and moved the thread to the Windows Update forum. There is quite a mess to deal with. Hopefully, I've found the worst of it.

1. Please start by uninstalling the outdated, vulnerable version of Java: Java 7 Update 65.

2. Please do the following to run FRST:

Note: If the tool warns you about the version you're using being an outdated version please download and run the updated version.

NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system

Open Notepad (Start =>All Programs => Accessories => Notepad).
Copy/Paste the entire contents of the code box below into Notepad. The information in the code box is very long so be sure to copy from "start" to "end".

Code:

start
CreateRestorePoint:
CloseProcesses:
Hosts:
() C:\Users\Owner\AppData\Local\driverpsisrndrBckp\driverpsisrndrBckp.exe
AppInit_DLLs: C:\PROGRA~3\PERFOR~1\PERFOR~2.DLL => C:\PROGRA~3\PERFOR~1\PERFOR~2.DLL File Not Found
IFEO\bitguard.exe: [Debugger] tasklist.exe
IFEO\bprotect.exe: [Debugger] tasklist.exe
IFEO\bpsvc.exe: [Debugger] tasklist.exe
IFEO\browserdefender.exe: [Debugger] tasklist.exe
IFEO\browserprotect.exe: [Debugger] tasklist.exe
IFEO\dprotectsvc.exe: [Debugger] tasklist.exe
IFEO\jumpflip: [Debugger] tasklist.exe
IFEO\protectedsearch.exe: [Debugger] tasklist.exe
IFEO\searchinstaller.exe: [Debugger] tasklist.exe
IFEO\searchprotection.exe: [Debugger] tasklist.exe
IFEO\searchprotector.exe: [Debugger] tasklist.exe
IFEO\searchsettings.exe: [Debugger] tasklist.exe
IFEO\searchsettings64.exe: [Debugger] tasklist.exe
IFEO\snapdo.exe: [Debugger] tasklist.exe
IFEO\stinst32.exe: [Debugger] tasklist.exe
IFEO\stinst64.exe: [Debugger] tasklist.exe
IFEO\umbrella.exe: [Debugger] tasklist.exe
IFEO\utiljumpflip.exe: [Debugger] tasklist.exe
IFEO\volaro: [Debugger] tasklist.exe
IFEO\vonteera: [Debugger] tasklist.exe
IFEO\websteroids.exe: [Debugger] tasklist.exe
IFEO\websteroidsservice.exe: [Debugger] tasklist.exe
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKU\S-1-5-21-3980855148-3933710502-1200373542-1001\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = http://www.default-search.net/search?sid=492&aid=100&itype=n&ver=12283&tm=338&src=ds&p={searchTerms}
SearchScopes: HKLM -> {CC865B26-C31D-4D23-B17B-96548EEF03F6} URL =
SearchScopes: HKLM-x32 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL =
SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = http://www.default-search.net/search?sid=492&aid=100&itype=n&ver=12283&tm=338&src=ds&p={searchTerms}
SearchScopes: HKLM-x32 -> {b0441a0e-a49a-4e16-afc1-74ecced1921f} URL = http://search.tb.ask.com/search/GGmain.jhtml?p2=^UX^xdm038^S09263^us&si=fmc_bing_directions-broad&ptb=17A1236A-3D3B-47A8-9EE8-EF5915BFEC74&ind=2014040411&n=780bd15b&psa=&st=sb&searchfor={searchTerms}
SearchScopes: HKU\S-1-5-21-3980855148-3933710502-1200373542-1001 -> DefaultScope {D9B067FE-29A8-45DB-80C0-75122BE6D83D} URL = https://search.yahoo.com/search?fr=mcafee&type=B011US0D19700101&p={searchTerms}
SearchScopes: HKU\S-1-5-21-3980855148-3933710502-1200373542-1001 -> {14732A5B-0177-4EDE-9FCC-68B2E1885A09} URL =
SearchScopes: HKU\S-1-5-21-3980855148-3933710502-1200373542-1001 -> {800329EE-529E-44BC-A3DC-DA0A87E35059} URL = http://groovorio.com/results.php?f=4&q={searchTerms}&a=grv_installertech_14_22&cd=2XzuyEtN2Y1L1Qzu0BzzyByCtA0FyByDtCtAyE0A0FyE0FtCtN0D0Tzu0StCtDyDtCtN1L2XzutAtFyCtFtCtFtDtN1L1Czu1N1C2X1V1L1G1B2Z1T1I1I1P1C2Z1P1R1M1VtCyE1VtBtBtN1L1G1B1V1N2Y1L1Qzu2StBtD0DtC0A0FzzyBtG0FyD0A0BtG0EyE0CtCtGzy0EzztBtGyE0FtDtCyE0EtC0CtBzzyBtA2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0A0Czy0FtByD0F0EtGtDtC0AtCtGyE0Ezz0EtGzz0FyC0BtGtB0CtD0B0D0AyB0C0EtD0D0B2Q&cr=1725787544&ir=
SearchScopes: HKU\S-1-5-21-3980855148-3933710502-1200373542-1001 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = http://www.default-search.net/search?sid=492&aid=100&itype=n&ver=12283&tm=338&src=ds&p={searchTerms}
SearchScopes: HKU\S-1-5-21-3980855148-3933710502-1200373542-1001 -> {b0441a0e-a49a-4e16-afc1-74ecced1921f} URL = http://search.tb.ask.com/search/GGmain.jhtml?p2=^UX^xdm038^S09263^us&si=fmc_bing_directions-broad&ptb=17A1236A-3D3B-47A8-9EE8-EF5915BFEC74&ind=2014040411&n=780bd15b&psa=&st=sb&searchfor={searchTerms}
SearchScopes: HKU\S-1-5-21-3980855148-3933710502-1200373542-1001 -> {D9B067FE-29A8-45DB-80C0-75122BE6D83D} URL = https://search.yahoo.com/search?fr=mcafee&type=B011US0D19700101&p={searchTerms}
SearchScopes: HKU\S-1-5-21-3980855148-3933710502-1200373542-1001 -> {DD48EC5A-2E4E-43E8-83FF-44D74A879A42} URL = https://search.yahoo.com/search?p={searchTerms}&ei=UTF-8&fr=w3i&type=W3i_DS,136,0_0,Search,20150104,20028,0,31,0
Winsock: Catalog9 01 C:\WINDOWS\SysWOW64\PCProtect.dll [293984] (Objectify Media Inc)
Winsock: Catalog9 02 C:\WINDOWS\SysWOW64\PCProtect.dll [293984] (Objectify Media Inc)
Winsock: Catalog9 03 C:\WINDOWS\SysWOW64\PCProtect.dll [293984] (Objectify Media Inc)
Winsock: Catalog9 04 C:\WINDOWS\SysWOW64\PCProtect.dll [293984] (Objectify Media Inc)
Winsock: Catalog9 15 C:\WINDOWS\SysWOW64\PCProtect.dll [293984] (Objectify Media Inc)
Winsock: Catalog9-x64 01 C:\WINDOWS\system32\PCProtect64.dll [330624] (Objectify Media Inc)
Winsock: Catalog9-x64 02 C:\WINDOWS\system32\PCProtect64.dll [330624] (Objectify Media Inc)
Winsock: Catalog9-x64 03 C:\WINDOWS\system32\PCProtect64.dll [330624] (Objectify Media Inc)
Winsock: Catalog9-x64 04 C:\WINDOWS\system32\PCProtect64.dll [330624] (Objectify Media Inc)
Winsock: Catalog9-x64 15 C:\WINDOWS\system32\PCProtect64.dll [330624] (Objectify Media Inc)
CMD: netsh winsock reset
FF user.js: detected! => C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\2ftkxy1m.default\user.js [2015-02-24]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]
CHR StartupUrls: Default -> "hxxp://search.conduit.com/?gd=&ctid=CT3321972&octid=EB_ORIGINAL_CTID&ISID=M28910FBD-10EF-44EC-8A0A-BED5F6E0719B&SearchSource=55&CUI=&UM=5&UP=SPC725CDDC-708F-47BF-8976-ABF31BB8E91B&SSPV=", "hxxp://www.default-search.net?sid=492&aid=100&itype=n&ver=12283&tm=338&src=hmp", "hxxp://search.easylifeapp.com/", "hxxp://groovorio.com/?f=7&a=grv_installertech_14_22&cd=2XzuyEtN2Y1L1Qzu0BzzyByCtA0FyByDtCtAyE0A0FyE0FtCtN0D0Tzu0StCtDyDtCtN1L2XzutAtFyCtFtCtFtDtN1L1Czu1N1C2X1V1L1G1B2Z1T1I1I1P1C2Z1P1R1M1VtCyE1VtBtBtN1L1G1B1V1N2Y1L1Qzu2StBtD0DtC0A0FzzyBtG0FyD0A0BtG0EyE0CtCtGzy0EzztBtGyE0FtDtCyE0EtC0CtBzzyBtA2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0A0Czy0FtByD0F0EtGtDtC0AtCtGyE0Ezz0EtGzz0FyC0BtGtB0CtD0B0D0AyB0C0EtD0D0B2Q&cr=1725787544&ir="
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{googleageClassification}{google:searchVersion}{google:sessionToken}{googlerefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Widevine Content Decryption Module) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.6.703\_platform_specific\win_x86\widevinecdmadapter.dll No File
CHR HKLM-x32\...\Chrome\Extension: [bopakagnckmlgajfccecajhnimjiiedh] - http://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [eefhnbpnnaaokmclnihgajdnlgljajjg] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2015-03-06]
CHR HKLM-x32\...\Chrome\Extension: [ggebenakhmhfdkmkemdmllecchcldgec] - https://clients2.google.com/service/update2/crx
R2 driverpsisrndrBckp.exe; C:\Users\Owner\AppData\Local\driverpsisrndrBckp\driverpsisrndrBckp.exe [229888 2015-02-28] () [File not signed]
S2 67d7717165bbdc4.exe; C:\Users\Owner\AppData\Local\7b8a788adc4859d7a43a8e66a84959ca\67d7717165bbdc4.exe [X]
S2 controllocalsplTask.exe; C:\Users\Owner\AppData\Local\controllocalsplTask\controllocalsplTask.exe [X]
S2 IconMotionRoot.exe; C:\Users\Owner\AppData\Local\IconMotionRoot\IconMotionRoot.exe [X]
S2 scriptsyncuiProvider.exe; C:\Users\Owner\AppData\Local\scriptsyncuiProvider\scriptsyncuiProvider.exe [X]
S3 IntcAzAudAddService; \SystemRoot\system32\drivers\RTKVHD64.sys [X]
S3 RegFltrX64; \??\C:\Users\Owner\AppData\Local\IconMotionRoot\RegFltrX64.sys [X]
S1 wStLibG64; system32\drivers\wStLibG64.sys [X]
2015-02-26 20:42 - 2015-03-06 06:46 - 00000000 ____D () C:\Users\Owner\AppData\Local\pathrecycleBckp
2015-03-07 17:09 - 2015-01-20 18:00 - 00000000 ____D () C:\ProgramData\ZjxWyUOEK
2015-03-07 17:09 - 2015-01-16 22:52 - 00000000 ____D () C:\WINDOWS\SysWOW64\iconocrapi
C:\ProgramData\XTkgSf5yP.dat
Task: {17F33AE1-84B9-4B2E-9EB5-710923E79B24} - System32\Tasks\LaunchApp => C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe <==== ATTENTION
Task: {45713B6D-40ED-43DC-8E1C-DE064A9CCB72} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {6E7A5205-7283-4EB6-A60B-16CECAEC4DE9} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {54340A37-472C-40EA-A478-A823EF44C843} - \BrowserSafeguard Update Task No Task File <==== ATTENTION
Task: {F772C4AE-B65B-4264-9886-689497B3BBE6} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
EmptyTemp:
end

Click Format and ensure Wordwrap is unchecked.
Important: Save the code to the same folder/directory that FRST.exe is located in, naming it as fixlist.txt
Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens ....
- Press the Fix button once and wait.
- FRST will process fixlist.txt
- When finished, it will produce a log fixlog.txt in the same folder/directory as FRST64.exe
- Please post the log in your next reply.

3. Please download Adware Cleaner by Xplode. Please save it to your desktop!

Close all open programs and internet browsers.
Double-click AdwCleaner.exe to run the tool.
Note: Windows Vista, Windows 7/8 users right-click and select Run As Administrator.
Click the Scan button.
AdwCleaner will begin. Be patient as the scan may take some time to complete.
After the scan has finished, click the Logfile button. A logfile (AdwCleaner[R0].txt) will open in Notepad for review.
Copy and paste the contents of that logfile in your next reply.
A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

BetaLeaf · Mar 15, 2015

1. Java 7 Uninstalled
2. Fixlog.txt Below
3. AdwCleaner[R0].txt Below

### Start Fixlog.txt ###

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-03-2015Ran by Owner at 2015-03-15 18:42:29 Run:1
Running from C:\Users\Owner\Desktop\frst
Loaded Profiles: Owner (Available profiles: Owner)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start
CreateRestorePoint:
CloseProcesses:
Hosts:
() C:\Users\Owner\AppData\Local\driverpsisrndrBckp\driverpsisrndrBckp.exe
AppInit_DLLs: C:\PROGRA~3\PERFOR~1\PERFOR~2.DLL => C:\PROGRA~3\PERFOR~1\PERFOR~2.DLL File Not Found
IFEO\bitguard.exe: [Debugger] tasklist.exe
IFEO\bprotect.exe: [Debugger] tasklist.exe
IFEO\bpsvc.exe: [Debugger] tasklist.exe
IFEO\browserdefender.exe: [Debugger] tasklist.exe
IFEO\browserprotect.exe: [Debugger] tasklist.exe
IFEO\dprotectsvc.exe: [Debugger] tasklist.exe
IFEO\jumpflip: [Debugger] tasklist.exe
IFEO\protectedsearch.exe: [Debugger] tasklist.exe
IFEO\searchinstaller.exe: [Debugger] tasklist.exe
IFEO\searchprotection.exe: [Debugger] tasklist.exe
IFEO\searchprotector.exe: [Debugger] tasklist.exe
IFEO\searchsettings.exe: [Debugger] tasklist.exe
IFEO\searchsettings64.exe: [Debugger] tasklist.exe
IFEO\snapdo.exe: [Debugger] tasklist.exe
IFEO\stinst32.exe: [Debugger] tasklist.exe
IFEO\stinst64.exe: [Debugger] tasklist.exe
IFEO\umbrella.exe: [Debugger] tasklist.exe
IFEO\utiljumpflip.exe: [Debugger] tasklist.exe
IFEO\volaro: [Debugger] tasklist.exe
IFEO\vonteera: [Debugger] tasklist.exe
IFEO\websteroids.exe: [Debugger] tasklist.exe
IFEO\websteroidsservice.exe: [Debugger] tasklist.exe
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKU\S-1-5-21-3980855148-3933710502-1200373542-1001\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = http://www.default-search.net/search?sid=492&aid=100&itype=n&ver=12283&tm=338&src=ds&p={searchTerms}
SearchScopes: HKLM -> {CC865B26-C31D-4D23-B17B-96548EEF03F6} URL =
SearchScopes: HKLM-x32 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL =
SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = http://www.default-search.net/search?sid=492&aid=100&itype=n&ver=12283&tm=338&src=ds&p={searchTerms}
SearchScopes: HKLM-x32 -> {b0441a0e-a49a-4e16-afc1-74ecced1921f} URL = http://search.tb.ask.com/search/GGmain.jhtml?p2=^UX^xdm038^S09263^us&si=fmc_bing_directions-broad&ptb=17A1236A-3D3B-47A8-9EE8-EF5915BFEC74&ind=2014040411&n=780bd15b&psa=&st=sb&searchfor={searchTerms}
SearchScopes: HKU\S-1-5-21-3980855148-3933710502-1200373542-1001 -> DefaultScope {D9B067FE-29A8-45DB-80C0-75122BE6D83D} URL = https://search.yahoo.com/search?fr=mcafee&type=B011US0D19700101&p={searchTerms}
SearchScopes: HKU\S-1-5-21-3980855148-3933710502-1200373542-1001 -> {14732A5B-0177-4EDE-9FCC-68B2E1885A09} URL =
SearchScopes: HKU\S-1-5-21-3980855148-3933710502-1200373542-1001 -> {800329EE-529E-44BC-A3DC-DA0A87E35059} URL = http://groovorio.com/results.php?f=4&q={searchTerms}&a=grv_installertech_14_22&cd=2XzuyEtN2Y1L1Qzu0BzzyByCtA0FyByDtCtAyE0A0FyE0FtCtN0D0Tzu0StCtDyDtCtN1L2XzutAtFyCtFtCtFtDtN1L1Czu1N1C2X1V1L1G1B2Z1T1I1I1P1C2Z1P1R1M1VtCyE1VtBtBtN1L1G1B1V1N2Y1L1Qzu2StBtD0DtC0A0FzzyBtG0FyD0A0BtG0EyE0CtCtGzy0EzztBtGyE0FtDtCyE0EtC0CtBzzyBtA2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0A0Czy0FtByD0F0EtGtDtC0AtCtGyE0Ezz0EtGzz0FyC0BtGtB0CtD0B0D0AyB0C0EtD0D0B2Q&cr=1725787544&ir=
SearchScopes: HKU\S-1-5-21-3980855148-3933710502-1200373542-1001 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = http://www.default-search.net/search?sid=492&aid=100&itype=n&ver=12283&tm=338&src=ds&p={searchTerms}
SearchScopes: HKU\S-1-5-21-3980855148-3933710502-1200373542-1001 -> {b0441a0e-a49a-4e16-afc1-74ecced1921f} URL = http://search.tb.ask.com/search/GGmain.jhtml?p2=^UX^xdm038^S09263^us&si=fmc_bing_directions-broad&ptb=17A1236A-3D3B-47A8-9EE8-EF5915BFEC74&ind=2014040411&n=780bd15b&psa=&st=sb&searchfor={searchTerms}
SearchScopes: HKU\S-1-5-21-3980855148-3933710502-1200373542-1001 -> {D9B067FE-29A8-45DB-80C0-75122BE6D83D} URL = https://search.yahoo.com/search?fr=mcafee&type=B011US0D19700101&p={searchTerms}
SearchScopes: HKU\S-1-5-21-3980855148-3933710502-1200373542-1001 -> {DD48EC5A-2E4E-43E8-83FF-44D74A879A42} URL = https://search.yahoo.com/search?p={searchTerms}&ei=UTF-8&fr=w3i&type=W3i_DS,136,0_0,Search,20150104,20028,0,31,0
Winsock: Catalog9 01 C:\WINDOWS\SysWOW64\PCProtect.dll [293984] (Objectify Media Inc)
Winsock: Catalog9 02 C:\WINDOWS\SysWOW64\PCProtect.dll [293984] (Objectify Media Inc)
Winsock: Catalog9 03 C:\WINDOWS\SysWOW64\PCProtect.dll [293984] (Objectify Media Inc)
Winsock: Catalog9 04 C:\WINDOWS\SysWOW64\PCProtect.dll [293984] (Objectify Media Inc)
Winsock: Catalog9 15 C:\WINDOWS\SysWOW64\PCProtect.dll [293984] (Objectify Media Inc)
Winsock: Catalog9-x64 01 C:\WINDOWS\system32\PCProtect64.dll [330624] (Objectify Media Inc)
Winsock: Catalog9-x64 02 C:\WINDOWS\system32\PCProtect64.dll [330624] (Objectify Media Inc)
Winsock: Catalog9-x64 03 C:\WINDOWS\system32\PCProtect64.dll [330624] (Objectify Media Inc)
Winsock: Catalog9-x64 04 C:\WINDOWS\system32\PCProtect64.dll [330624] (Objectify Media Inc)
Winsock: Catalog9-x64 15 C:\WINDOWS\system32\PCProtect64.dll [330624] (Objectify Media Inc)
CMD: netsh winsock reset
FF user.js: detected! => C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\2ftkxy1m.default\user.js [2015-02-24]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]
CHR StartupUrls: Default -> "hxxp://search.conduit.com/?gd=&ctid=CT3321972&octid=EB_ORIGINAL_CTID&ISID=M28910FBD-10EF-44EC-8A0A-BED5F6E0719B&SearchSource=55&CUI=&UM=5&UP=SPC725CDDC-708F-47BF-8976-ABF31BB8E91B&SSPV=", "hxxp://www.default-search.net?sid=492&aid=100&itype=n&ver=12283&tm=338&src=hmp", "hxxp://search.easylifeapp.com/", "hxxp://groovorio.com/?f=7&a=grv_installertech_14_22&cd=2XzuyEtN2Y1L1Qzu0BzzyByCtA0FyByDtCtAyE0A0FyE0FtCtN0D0Tzu0StCtDyDtCtN1L2XzutAtFyCtFtCtFtDtN1L1Czu1N1C2X1V1L1G1B2Z1T1I1I1P1C2Z1P1R1M1VtCyE1VtBtBtN1L1G1B1V1N2Y1L1Qzu2StBtD0DtC0A0FzzyBtG0FyD0A0BtG0EyE0CtCtGzy0EzztBtGyE0FtDtCyE0EtC0CtBzzyBtA2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0A0Czy0FtByD0F0EtGtDtC0AtCtGyE0Ezz0EtGzz0FyC0BtGtB0CtD0B0D0AyB0C0EtD0D0B2Q&cr=1725787544&ir="
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{googleageClassification}{google:searchVersion}{google:sessionToken}{googlerefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Widevine Content Decryption Module) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.6.703\_platform_specific\win_x86\widevinecdmadapter.dll No File
CHR HKLM-x32\...\Chrome\Extension: [bopakagnckmlgajfccecajhnimjiiedh] - http://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [eefhnbpnnaaokmclnihgajdnlgljajjg] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2015-03-06]
CHR HKLM-x32\...\Chrome\Extension: [ggebenakhmhfdkmkemdmllecchcldgec] - https://clients2.google.com/service/update2/crx
R2 driverpsisrndrBckp.exe; C:\Users\Owner\AppData\Local\driverpsisrndrBckp\driverpsisrndrBckp.exe [229888 2015-02-28] () [File not signed]
S2 67d7717165bbdc4.exe; C:\Users\Owner\AppData\Local\7b8a788adc4859d7a43a8e66a84959ca\67d7717165bbdc4.exe [X]
S2 controllocalsplTask.exe; C:\Users\Owner\AppData\Local\controllocalsplTask\controllocalsplTask.exe [X]
S2 IconMotionRoot.exe; C:\Users\Owner\AppData\Local\IconMotionRoot\IconMotionRoot.exe [X]
S2 scriptsyncuiProvider.exe; C:\Users\Owner\AppData\Local\scriptsyncuiProvider\scriptsyncuiProvider.exe [X]
S3 IntcAzAudAddService; \SystemRoot\system32\drivers\RTKVHD64.sys [X]
S3 RegFltrX64; \??\C:\Users\Owner\AppData\Local\IconMotionRoot\RegFltrX64.sys [X]
S1 wStLibG64; system32\drivers\wStLibG64.sys [X]
2015-02-26 20:42 - 2015-03-06 06:46 - 00000000 ____D () C:\Users\Owner\AppData\Local\pathrecycleBckp
2015-03-07 17:09 - 2015-01-20 18:00 - 00000000 ____D () C:\ProgramData\ZjxWyUOEK
2015-03-07 17:09 - 2015-01-16 22:52 - 00000000 ____D () C:\WINDOWS\SysWOW64\iconocrapi
C:\ProgramData\XTkgSf5yP.dat
Task: {17F33AE1-84B9-4B2E-9EB5-710923E79B24} - System32\Tasks\LaunchApp => C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe <==== ATTENTION
Task: {45713B6D-40ED-43DC-8E1C-DE064A9CCB72} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {6E7A5205-7283-4EB6-A60B-16CECAEC4DE9} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {54340A37-472C-40EA-A478-A823EF44C843} - \BrowserSafeguard Update Task No Task File <==== ATTENTION
Task: {F772C4AE-B65B-4264-9886-689497B3BBE6} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
EmptyTemp:
end
*****************

Restore point was successfully created.
Processes closed successfully.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
C:\Users\Owner\AppData\Local\driverpsisrndrBckp\driverpsisrndrBckp.exe => No running process found
"C:\PROGRA~3\PERFOR~1\PERFOR~2.DLL" => Value Data removed successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\bitguard.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\bprotect.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\bpsvc.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\browserdefender.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\browserprotect.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\dprotectsvc.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\jumpflip" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\protectedsearch.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\searchinstaller.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\searchprotection.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\searchprotector.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\searchsettings.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\searchsettings64.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\snapdo.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\stinst32.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\stinst64.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\umbrella.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\utiljumpflip.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\volaro" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\vonteera" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\websteroids.exe" => Key deleted successfully.
"HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\websteroidsservice.exe" => Key deleted successfully.
C:\WINDOWS\system32\GroupPolicy\Machine => Moved successfully.
C:\WINDOWS\system32\GroupPolicy\GPT.ini => Moved successfully.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
"HKU\S-1-5-21-3980855148-3933710502-1200373542-1001\SOFTWARE\Policies\Google" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2492}" => Key deleted successfully.
HKCR\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} => Key not found.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{CC865B26-C31D-4D23-B17B-96548EEF03F6}" => Key deleted successfully.
HKCR\CLSID\{CC865B26-C31D-4D23-B17B-96548EEF03F6} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2492}" => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} => Key not found.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{b0441a0e-a49a-4e16-afc1-74ecced1921f}" => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{b0441a0e-a49a-4e16-afc1-74ecced1921f} => Key not found.
HKU\S-1-5-21-3980855148-3933710502-1200373542-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
"HKU\S-1-5-21-3980855148-3933710502-1200373542-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{14732A5B-0177-4EDE-9FCC-68B2E1885A09}" => Key deleted successfully.
HKCR\CLSID\{14732A5B-0177-4EDE-9FCC-68B2E1885A09} => Key not found.
"HKU\S-1-5-21-3980855148-3933710502-1200373542-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{800329EE-529E-44BC-A3DC-DA0A87E35059}" => Key deleted successfully.
HKCR\CLSID\{800329EE-529E-44BC-A3DC-DA0A87E35059} => Key not found.
"HKU\S-1-5-21-3980855148-3933710502-1200373542-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2492}" => Key deleted successfully.
HKCR\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} => Key not found.
"HKU\S-1-5-21-3980855148-3933710502-1200373542-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{b0441a0e-a49a-4e16-afc1-74ecced1921f}" => Key deleted successfully.
HKCR\CLSID\{b0441a0e-a49a-4e16-afc1-74ecced1921f} => Key not found.
HKU\S-1-5-21-3980855148-3933710502-1200373542-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D9B067FE-29A8-45DB-80C0-75122BE6D83D} => Key not found.
HKCR\CLSID\{D9B067FE-29A8-45DB-80C0-75122BE6D83D} => Key not found.
"HKU\S-1-5-21-3980855148-3933710502-1200373542-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DD48EC5A-2E4E-43E8-83FF-44D74A879A42}" => Key deleted successfully.
HKCR\CLSID\{DD48EC5A-2E4E-43E8-83FF-44D74A879A42} => Key not found.
Winsock: Catalog entry 000000000001 => Deleted successfully.
Winsock: Catalog entry 000000000002 => Deleted successfully.
Winsock: Catalog entry 000000000003 => Deleted successfully.
Winsock: Catalog entry 000000000004 => Deleted successfully.
Winsock: Catalog entry 000000000015 => Deleted successfully.
Winsock: Catalog entry 000000000001 => Deleted successfully.
Winsock: Catalog entry 000000000002 => Deleted successfully.
Winsock: Catalog entry 000000000003 => Deleted successfully.
Winsock: Catalog entry 000000000004 => Deleted successfully.
Winsock: Catalog entry 000000000015 => Deleted successfully.

========= netsh winsock reset =========

Initialization Function InitHelperDll in NSHHTTP.DLL failed to start with error code 10107

Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.

========= End of CMD: =========

C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\2ftkxy1m.default\user.js => Moved successfully.
C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} not found.
Chrome StartupUrls deleted successfully.
Chrome DefaultSuggestURL deleted successfully.
C:\Users\Owner\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.6.703\_platform_specific\win_x86\widevinecdmadapter.dll not found.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\bopakagnckmlgajfccecajhnimjiiedh" => Key deleted successfully.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\eefhnbpnnaaokmclnihgajdnlgljajjg" => Key deleted successfully.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\fheoggkfdfchfphceeifdbepaooicaho" => Key deleted successfully.
Could not move "C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx" => Scheduled to move on reboot.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ggebenakhmhfdkmkemdmllecchcldgec" => Key deleted successfully.
driverpsisrndrBckp.exe => Service deleted successfully.
67d7717165bbdc4.exe => Service deleted successfully.
controllocalsplTask.exe => Service deleted successfully.
IconMotionRoot.exe => Service deleted successfully.
scriptsyncuiProvider.exe => Service deleted successfully.
IntcAzAudAddService => Service deleted successfully.
RegFltrX64 => Service deleted successfully.
wStLibG64 => Service deleted successfully.
C:\Users\Owner\AppData\Local\pathrecycleBckp => Moved successfully.
C:\ProgramData\ZjxWyUOEK => Moved successfully.
C:\WINDOWS\SysWOW64\iconocrapi => Moved successfully.
C:\ProgramData\XTkgSf5yP.dat => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{17F33AE1-84B9-4B2E-9EB5-710923E79B24}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{17F33AE1-84B9-4B2E-9EB5-710923E79B24}" => Key deleted successfully.
C:\Windows\System32\Tasks\LaunchApp => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\LaunchApp" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{45713B6D-40ED-43DC-8E1C-DE064A9CCB72}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{45713B6D-40ED-43DC-8E1C-DE064A9CCB72}" => Key deleted successfully.
C:\Windows\System32\Tasks\APSnotifierPP2 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\APSnotifierPP2" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{6E7A5205-7283-4EB6-A60B-16CECAEC4DE9}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6E7A5205-7283-4EB6-A60B-16CECAEC4DE9}" => Key deleted successfully.
C:\Windows\System32\Tasks\APSnotifierPP3 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\APSnotifierPP3" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{54340A37-472C-40EA-A478-A823EF44C843}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{54340A37-472C-40EA-A478-A823EF44C843}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\BrowserSafeguard Update Task" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F772C4AE-B65B-4264-9886-689497B3BBE6}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F772C4AE-B65B-4264-9886-689497B3BBE6}" => Key deleted successfully.
C:\Windows\System32\Tasks\APSnotifierPP1 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\APSnotifierPP1" => Key deleted successfully.
C:\WINDOWS\Tasks\APSnotifierPP1.job => Moved successfully.
C:\WINDOWS\Tasks\APSnotifierPP2.job => Moved successfully.
C:\WINDOWS\Tasks\APSnotifierPP3.job => Moved successfully.
EmptyTemp: => Removed 1.4 GB temporary data.

=> Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2015-03-15 18:55:04)<=

"C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx" => File could not move.

==== End of Fixlog 18:55:04 ====

### End Fixlog.txt ###

### Start AdwCleaner[R0].txt ###

# AdwCleaner v4.112 - Logfile created 15/03/2015 at 19:09:49
# Updated 09/03/2015 by Xplode
# Database : 2015-03-15.1 [Server]
# Operating system : Windows 8.1 (x64)
# Username : Owner - DELL-SLIMLINE
# Running from : C:\Users\Owner\Desktop\frst\adwcleaner_4.112.exe
# Option : Scan

***** [ Services ] *****

Service Found : dfc86759
Service Found : netfilter64
Service Found : YahooAUService

***** [ Files / Folders ] *****

File Found : C:\END
File Found : C:\Program Files (x86)\UpdInstaller.exe
File Found : C:\Users\Owner\AppData\Roaming\aps.uninstall.scan.results
File Found : C:\Users\Owner\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\speed browser.lnk
File Found : C:\Users\Owner\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\speed browser.lnk
File Found : C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\user.js
File Found : C:\Users\Owner\Desktop\Live PC Help.lnk
File Found : C:\Users\Owner\Desktop\Sync Folder.lnk
File Found : C:\WINDOWS\System32\drivers\netfilter64.sys
File Found : C:\WINDOWS\System32\roboot64.exe
Folder Found : C:\Program Files (x86)\Amazon Browser Bar
Folder Found : C:\Program Files (x86)\Bench
Folder Found : C:\Program Files (x86)\Coupons
Folder Found : C:\Program Files (x86)\Coupons
Folder Found : C:\Program Files (x86)\ddEeAlpeaku
Folder Found : C:\Program Files (x86)\ddEeAlpeaku
Folder Found : C:\Program Files (x86)\File Type Helper
Folder Found : C:\Program Files (x86)\predm
Folder Found : C:\Program Files (x86)\Systweak Support Dock
Folder Found : C:\Program Files (x86)\Viewpoint
Folder Found : C:\Program Files (x86)\Web Protect
Folder Found : C:\Program Files (x86)\weBsaover
Folder Found : C:\Program Files (x86)\weBsaover
Folder Found : C:\ProgramData\107a9f4fe3929d71
Folder Found : C:\ProgramData\Browser
Folder Found : C:\ProgramData\ddEeAlpeaku
Folder Found : C:\ProgramData\ddEeAlpeaku
Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Coupons
Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Coupons
Folder Found : C:\ProgramData\Performancer
Folder Found : C:\ProgramData\Systweak
Folder Found : C:\ProgramData\Viewpoint
Folder Found : C:\ProgramData\weBsaover
Folder Found : C:\ProgramData\weBsaover
Folder Found : C:\ProgramData\Yahoo! Companion
Folder Found : C:\Users\Owner\AppData\Local\CheckCode
Folder Found : C:\Users\Owner\AppData\Local\emaze
Folder Found : C:\Users\Owner\AppData\Local\HelperApp
Folder Found : C:\Users\Owner\AppData\Local\iac
Folder Found : C:\Users\Owner\AppData\Local\PackageAware
Folder Found : C:\Users\Owner\AppData\LocalLow\iac
Folder Found : C:\Users\Owner\AppData\Roaming\ASP
Folder Found : C:\Users\Owner\AppData\Roaming\Systweak
Folder Found : C:\Users\Owner\Documents\Optimizer Pro
Folder Found : C:\WINDOWS\SysWOW64\SearchProtect

***** [ Scheduled tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Data Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *origin.com;*ea.com;*akamaihd.net;<local>
Key Found : HKCU\Software\AnyProtect
Key Found : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Found : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Key Found : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Key Found : HKCU\Software\distromatic
Key Found : HKCU\Software\InstalledThirdPartyPrograms
Key Found : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\superfish.com
Key Found : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\us.yhs4.search.yahoo.com
Key Found : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\Superfish - Visual Search and Image Recognition
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0FA6F402-EDE5-18F8-867B-1BA7BB4052FD}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{ED6B732B-CE34-5F10-AA46-B2E57E5709E0}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0FA6F402-EDE5-18F8-867B-1BA7BB4052FD}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{ED6B732B-CE34-5F10-AA46-B2E57E5709E0}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Found : HKCU\Software\systweak
Key Found : HKCU\Software\visualbee
Key Found : HKCU\Software\WebProtect
Key Found : [x64] HKCU\Software\AnyProtect
Key Found : [x64] HKCU\Software\distromatic
Key Found : [x64] HKCU\Software\InstalledThirdPartyPrograms
Key Found : [x64] HKCU\Software\systweak
Key Found : [x64] HKCU\Software\visualbee
Key Found : [x64] HKCU\Software\WebProtect
Key Found : HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Found : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Found : HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Key Found : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Key Found : HKLM\SOFTWARE\{77D46E27-0E41-4478-87A6-AABE6FBCF252}
Key Found : HKLM\SOFTWARE\{F2E9660B-98AF-42c0-8258-9CDDF07BF95D}
Key Found : HKLM\SOFTWARE\BrowserSafeGuard
Key Found : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl
Key Found : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl.1
Key Found : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary
Key Found : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary.1
Key Found : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{03F998B2-0E00-11D3-A498-00104B6EB52E}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{058F0E48-61CA-4964-9FBA-1978A1BB060D}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{058F0E48-61CA-4964-9FBA-1978A1BB060D}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{0FA6F402-EDE5-18F8-867B-1BA7BB4052FD}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{18F33C35-8EF2-40D7-8BA4-932B0121B472}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{18F33C35-8EF2-40D7-8BA4-932B0121B472}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{A85A5E6A-DE2C-4F4E-99DC-F469DF5A0EEC}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{ED6B732B-CE34-5F10-AA46-B2E57E5709E0}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Found : HKLM\SOFTWARE\Classes\dEalpeAkk.dEalpeAkk
Key Found : HKLM\SOFTWARE\Classes\dEalpeAkk.dEalpeAkk.1.6
Key Found : HKLM\SOFTWARE\Classes\Interface\{0FCE4F01-64EC-42F1-83E1-1E08D38605D2}
Key Found : HKLM\SOFTWARE\Classes\Interface\{1A2A195A-A0F9-4006-AF02-3F05EEFDE792}
Key Found : HKLM\SOFTWARE\Classes\Interface\{2D9DB233-DC4B-4677-946C-5FA5ABCF506B}
Key Found : HKLM\SOFTWARE\Classes\Interface\{3AE76A17-C344-4A83-81CE-65EFEE41E42D}
Key Found : HKLM\SOFTWARE\Classes\Interface\{4C0A69B0-CE97-42B7-86FC-08280C99C74D}
Key Found : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Key Found : HKLM\SOFTWARE\Classes\Interface\{4E9EB4D5-C929-4005-AC62-1856B1DA5A24}
Key Found : HKLM\SOFTWARE\Classes\Interface\{8FAF962C-3EDE-405E-B1D0-62B8235C6044}
Key Found : HKLM\SOFTWARE\Classes\Interface\{C1F5E799-B218-4C32-B189-3C389BA140BB}
Key Found : HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
Key Found : HKLM\SOFTWARE\Classes\Interface\{F60C9408-3110-4C98-A139-ABE1EE1111DD}
Key Found : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Key Found : HKLM\SOFTWARE\Classes\weobisAverr.weobisAverr
Key Found : HKLM\SOFTWARE\Classes\weobisAverr.weobisAverr.6.2
Key Found : HKLM\SOFTWARE\MetaStream
Key Found : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{03F998B2-0E00-11D3-A498-00104B6EB52E}
Key Found : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{0FA6F402-EDE5-18F8-867B-1BA7BB4052FD}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F0B76E1-4E46-427B-B55B-B90593468AC6}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{ED6B732B-CE34-5F10-AA46-B2E57E5709E0}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C60D3D4E-3B20-5AB3-7F2C-9C946AD4080F}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Coupon Printer for Windows5.0.0.3
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ViewpointMediaPlayer
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! Companion
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! Toolbar
Key Found : HKLM\SOFTWARE\MozillaPlugins\@viewpoint.com/VMP
Key Found : HKLM\SOFTWARE\Pirrit
Key Found : HKLM\SOFTWARE\RST
Key Found : HKLM\SOFTWARE\SI-App
Key Found : HKLM\SOFTWARE\SpeedBrowser
Key Found : HKLM\SOFTWARE\systweak
Key Found : HKLM\SOFTWARE\Tutorials
Key Found : HKLM\SOFTWARE\Upt
Key Found : HKLM\SOFTWARE\VBMZ
Key Found : HKLM\SOFTWARE\Viewpoint
Key Found : HKLM\SOFTWARE\visualbee
Key Found : HKLM\SOFTWARE\WebProtect
Key Found : HKLM\SOFTWARE\WinUpd
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{0FA6F402-EDE5-18F8-867B-1BA7BB4052FD}
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{A85A5E6A-DE2C-4F4E-99DC-F469DF5A0EEC}
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{ED6B732B-CE34-5F10-AA46-B2E57E5709E0}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{0FCE4F01-64EC-42F1-83E1-1E08D38605D2}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{1A2A195A-A0F9-4006-AF02-3F05EEFDE792}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{2D9DB233-DC4B-4677-946C-5FA5ABCF506B}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{3AE76A17-C344-4A83-81CE-65EFEE41E42D}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{4C0A69B0-CE97-42B7-86FC-08280C99C74D}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{4E9EB4D5-C929-4005-AC62-1856B1DA5A24}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{8FAF962C-3EDE-405E-B1D0-62B8235C6044}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{C1F5E799-B218-4C32-B189-3C389BA140BB}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{F60C9408-3110-4C98-A139-ABE1EE1111DD}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Key Found : [x64] HKLM\SOFTWARE\InstalledThirdPartyPrograms
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
Key Found : [x64] HKLM\SOFTWARE\Pirrit
Key Found : [x64] HKLM\SOFTWARE\RST
Key Found : [x64] HKLM\SOFTWARE\SI-App
Key Found : [x64] HKLM\SOFTWARE\System Optimizer Pro
Key Found : [x64] HKLM\SOFTWARE\Upt
Key Found : [x64] HKLM\SOFTWARE\WinUpd
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17416

-\\ Mozilla Firefox v

-\\ Google Chrome v41.0.2272.89

[C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [Search Provider] : hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3321972&octid=EB_ORIGINAL_CTID&ISID=M28910FBD-10EF-44EC-8A0A-BED5F6E0719B&SearchSource=58&CUI=&UM=5&UP=SPC725CDDC-708F-47BF-8976-ABF31BB8E91B&q={searchTerms}&SSPV=
[C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}
[C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}
[C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [Search Provider] : hxxp://www.default-search.net/search?sid=492&aid=100&itype=n&ver=12283&tm=338&src=ds&p={searchTerms}
[C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [Search Provider] : hxxp://search.snapdo.com/?q={searchTerms}&category=Web&publisher=snapdoadknowledge&country=us&feedid=infospace&st=nt&dpid=cr&lan=en&start=1
[C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [Search Provider] : hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRaHp8Pk5fza5XP2LqNOcSHMtbl0vt3xjxqLjH3FfFGrtpLTUpBCyo3nl5u-McZ9jvdJgkc6luCHgNudD-8Ol2Cp3-1hk8M6eZxZM8zbCAYLdq5q7Mk4hstTf2o8yaFp4kF8iA3iwmi_8k984XkdbaM-HizchhNvppzLzEx-uSgoQElcXGjmGwDNSwkuzDm9o&q={searchTerms}
[C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [Search Provider] : hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=cmi_14_19_ch&cd=2XzuyEtN2Y1L1Qzu0BzzyByCtA0FyByDtCtAyE0A0FyE0FtCtN0D0Tzu0SzzyDyCtN1L2XzutBtFtBtDtFyCtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyB0BtC0DyD0Fzz0BtG0D0AyByDtGyD0AyB0DtGtB0BtA0FtGyE0A0DtAtC0AyDtCyC0Czz0B2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDtAyE0BtAzztCtCtGyE0B0DzytGyCzztD0DtGtA0ByEtAtGtAyDtAtC0CyBtDyByDtC0Azy2Q&cr=1594317445&ir=
[C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [Search Provider] : hxxp://groovorio.com/results.php?f=4&q={searchTerms}&a=grv_installertech_14_22&cd=2XzuyEtN2Y1L1Qzu0BzzyByCtA0FyByDtCtAyE0A0FyE0FtCtN0D0Tzu0StCtDyDtCtN1L2XzutAtFyCtFtCtFtDtN1L1Czu1N1C2X1V1L1G1B2Z1T1I1I1P1C2Z1P1R1M1VtCyE1VtBtBtN1L1G1B1V1N2Y1L1Qzu2StBtD0DtC0A0FzzyBtG0FyD0A0BtG0EyE0CtCtGzy0EzztBtGyE0FtDtCyE0EtC0CtBzzyBtA2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0A0Czy0FtByD0F0EtGtDtC0AtCtGyE0Ezz0EtGzz0FyC0BtGtB0CtD0B0D0AyB0C0EtD0D0B2Q&cr=1725787544&ir=
*************************

AdwCleaner[R0].txt - [15170 bytes] - [15/03/2015 19:09:49]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [15230 bytes] ##########

### End AdwCleaner[R0].txt ###

Corrine · Mar 16, 2015

Still a lot to clean up. Please do the following:

1. Double-click AdwCleaner.exe to run the tool again.

Click the Scan button.
AdwCleaner will begin to scan your computer like it did before.
Note: Windows Vista, Windows 7/8 users right-click and select Run As Administrator.
After the scan has finished,
This time click on the Clean button.
Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
Copy and paste the contents of that logfile in your next reply.
A copy of that logfile will also be saved in the C:\AdwCleaner folder.

2. Please download Junkware Removal Tool to your desktop.

Disable your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

3. Please follow the instructions below to run an on-line scan from ESET.

Note: It is easiest if you use Internet explorer for this scan. (If you use an alternate browser, it will be necessary to download the ESET Smart Installer)
- Hold down Control and click on this link to open ESET OnlineScan in a new window so you can refer to these instructions.
- Click the green ESET Online Scanner box.
- For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  - Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop.
  - Double click on the Eset Smart Installer icon on your desktop.
- Check "YES, I accept the Terms of Use."
- Click the Start button.
- Accept any security warnings from your browser.
- Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
- Click Advanced settings and select the following:
  - Scan potentially unwanted applications
  - Scan for potentially unsafe applications
  - Enable Anti-Stealth technology
- ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
- When the scan completes, click List Threats
- Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
- Click the Back button.
- Click the Finish button.

BetaLeaf · Mar 16, 2015

### Start AdwCleaner[S0].txt ###

# AdwCleaner v4.112 - Logfile created 16/03/2015 at 18:37:49
# Updated 09/03/2015 by Xplode
# Database : 2015-03-15.1 [Server]
# Operating system : Windows 8.1 (x64)
# Username : Owner - DELL-SLIMLINE
# Running from : C:\Users\Owner\Desktop\frst\adwcleaner_4.112.exe
# Option : Cleaning

***** [ Services ] *****

[#] Service Deleted : dfc86759
Service Deleted : netfilter64
Service Deleted : YahooAUService

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\Browser
Folder Deleted : C:\ProgramData\Performancer
Folder Deleted : C:\ProgramData\Systweak
Folder Deleted : C:\ProgramData\Viewpoint
Folder Deleted : C:\ProgramData\Yahoo! Companion
Folder Deleted : C:\ProgramData\ddEeAlpeaku
Folder Deleted : C:\ProgramData\weBsaover
Folder Deleted : C:\ProgramData\107a9f4fe3929d71
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Coupons
Folder Deleted : C:\Program Files (x86)\Amazon Browser Bar
Folder Deleted : C:\Program Files (x86)\Bench
Folder Deleted : C:\Program Files (x86)\File Type Helper
Folder Deleted : C:\Program Files (x86)\predm
Folder Deleted : C:\Program Files (x86)\Systweak Support Dock
Folder Deleted : C:\Program Files (x86)\Viewpoint
Folder Deleted : C:\Program Files (x86)\Web Protect
Folder Deleted : C:\Program Files (x86)\Coupons
Folder Deleted : C:\Program Files (x86)\ddEeAlpeaku
Folder Deleted : C:\Program Files (x86)\weBsaover
Folder Deleted : C:\WINDOWS\SysWOW64\SearchProtect
Folder Deleted : C:\Users\Owner\AppData\Local\emaze
Folder Deleted : C:\Users\Owner\AppData\Local\iac
Folder Deleted : C:\Users\Owner\AppData\Local\PackageAware
Folder Deleted : C:\Users\Owner\AppData\Local\CheckCode
Folder Deleted : C:\Users\Owner\AppData\Local\HelperApp
Folder Deleted : C:\Users\Owner\AppData\LocalLow\iac
Folder Deleted : C:\Users\Owner\AppData\Roaming\ASP
Folder Deleted : C:\Users\Owner\AppData\Roaming\Systweak
Folder Deleted : C:\Users\Owner\Documents\Optimizer Pro
File Deleted : C:\END
File Deleted : C:\Program Files (x86)\UpdInstaller.exe
File Deleted : C:\WINDOWS\System32\drivers\netfilter64.sys
File Deleted : C:\WINDOWS\System32\roboot64.exe
File Deleted : C:\Users\Owner\AppData\Roaming\aps.uninstall.scan.results
File Deleted : C:\Users\Owner\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\speed browser.lnk
File Deleted : C:\Users\Owner\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\speed browser.lnk
File Deleted : C:\Users\Owner\Desktop\Sync Folder.lnk
File Deleted : C:\Users\Owner\Desktop\Live PC Help.lnk
File Deleted : C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\user.js

***** [ Scheduled tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\superfish.com
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\Superfish - Visual Search and Image Recognition
Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl
Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl.1
Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary
Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary.1
Key Deleted : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{03F998B2-0E00-11D3-A498-00104B6EB52E}
Key Deleted : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@viewpoint.com/VMP
Key Deleted : HKLM\SOFTWARE\Classes\weobisAverr.weobisAverr
Key Deleted : HKLM\SOFTWARE\Classes\weobisAverr.weobisAverr.6.2
Key Deleted : HKLM\SOFTWARE\Classes\dEalpeAkk.dEalpeAkk
Key Deleted : HKLM\SOFTWARE\Classes\dEalpeAkk.dEalpeAkk.1.6
Key Deleted : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{03F998B2-0E00-11D3-A498-00104B6EB52E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{058F0E48-61CA-4964-9FBA-1978A1BB060D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{18F33C35-8EF2-40D7-8BA4-932B0121B472}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{0FA6F402-EDE5-18F8-867B-1BA7BB4052FD}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A85A5E6A-DE2C-4F4E-99DC-F469DF5A0EEC}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{ED6B732B-CE34-5F10-AA46-B2E57E5709E0}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0FCE4F01-64EC-42F1-83E1-1E08D38605D2}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1A2A195A-A0F9-4006-AF02-3F05EEFDE792}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2D9DB233-DC4B-4677-946C-5FA5ABCF506B}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3AE76A17-C344-4A83-81CE-65EFEE41E42D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4C0A69B0-CE97-42B7-86FC-08280C99C74D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E9EB4D5-C929-4005-AC62-1856B1DA5A24}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8FAF962C-3EDE-405E-B1D0-62B8235C6044}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C1F5E799-B218-4C32-B189-3C389BA140BB}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F60C9408-3110-4C98-A139-ABE1EE1111DD}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0FA6F402-EDE5-18F8-867B-1BA7BB4052FD}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{ED6B732B-CE34-5F10-AA46-B2E57E5709E0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0FA6F402-EDE5-18F8-867B-1BA7BB4052FD}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{ED6B732B-CE34-5F10-AA46-B2E57E5709E0}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F0B76E1-4E46-427B-B55B-B90593468AC6}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{0FA6F402-EDE5-18F8-867B-1BA7BB4052FD}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{ED6B732B-CE34-5F10-AA46-B2E57E5709E0}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{0FA6F402-EDE5-18F8-867B-1BA7BB4052FD}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{A85A5E6A-DE2C-4F4E-99DC-F469DF5A0EEC}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{ED6B732B-CE34-5F10-AA46-B2E57E5709E0}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{0FCE4F01-64EC-42F1-83E1-1E08D38605D2}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{1A2A195A-A0F9-4006-AF02-3F05EEFDE792}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{2D9DB233-DC4B-4677-946C-5FA5ABCF506B}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{3AE76A17-C344-4A83-81CE-65EFEE41E42D}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4C0A69B0-CE97-42B7-86FC-08280C99C74D}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4E9EB4D5-C929-4005-AC62-1856B1DA5A24}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{8FAF962C-3EDE-405E-B1D0-62B8235C6044}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{C1F5E799-B218-4C32-B189-3C389BA140BB}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{F60C9408-3110-4C98-A139-ABE1EE1111DD}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Key Deleted : HKCU\Software\AnyProtect
Key Deleted : HKCU\Software\distromatic
Key Deleted : HKCU\Software\InstalledThirdPartyPrograms
Key Deleted : HKCU\Software\systweak
Key Deleted : HKCU\Software\visualbee
Key Deleted : HKCU\Software\WebProtect
Key Deleted : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Deleted : HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Deleted : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Deleted : HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Key Deleted : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Key Deleted : HKLM\SOFTWARE\{77D46E27-0E41-4478-87A6-AABE6FBCF252}
Key Deleted : HKLM\SOFTWARE\BrowserSafeGuard
Key Deleted : HKLM\SOFTWARE\MetaStream
Key Deleted : HKLM\SOFTWARE\Pirrit
Key Deleted : HKLM\SOFTWARE\systweak
Key Deleted : HKLM\SOFTWARE\Tutorials
Key Deleted : HKLM\SOFTWARE\Upt
Key Deleted : HKLM\SOFTWARE\VBMZ
Key Deleted : HKLM\SOFTWARE\Viewpoint
Key Deleted : HKLM\SOFTWARE\visualbee
Key Deleted : HKLM\SOFTWARE\WebProtect
Key Deleted : HKLM\SOFTWARE\WinUpd
Key Deleted : HKLM\SOFTWARE\SI-App
Key Deleted : HKLM\SOFTWARE\RST
Key Deleted : HKLM\SOFTWARE\SpeedBrowser
Key Deleted : HKLM\SOFTWARE\{F2E9660B-98AF-42c0-8258-9CDDF07BF95D}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C60D3D4E-3B20-5AB3-7F2C-9C946AD4080F}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ViewpointMediaPlayer
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! Toolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! Companion
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Coupon Printer for Windows5.0.0.3
Key Deleted : [x64] HKLM\SOFTWARE\InstalledThirdPartyPrograms
Key Deleted : [x64] HKLM\SOFTWARE\Pirrit
Key Deleted : [x64] HKLM\SOFTWARE\Upt
Key Deleted : [x64] HKLM\SOFTWARE\WinUpd
Key Deleted : [x64] HKLM\SOFTWARE\SI-App
Key Deleted : [x64] HKLM\SOFTWARE\RST
Key Deleted : [x64] HKLM\SOFTWARE\System Optimizer Pro
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\us.yhs4.search.yahoo.com
Data Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *origin.com;*ea.com;*akamaihd.net;<local>

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17416

-\\ Mozilla Firefox v

-\\ Google Chrome v41.0.2272.89

[C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3321972&octid=EB_ORIGINAL_CTID&ISID=M28910FBD-10EF-44EC-8A0A-BED5F6E0719B&SearchSource=58&CUI=&UM=5&UP=SPC725CDDC-708F-47BF-8976-ABF31BB8E91B&q={searchTerms}&SSPV=
[C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}
[C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}
[C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://www.default-search.net/search?sid=492&aid=100&itype=n&ver=12283&tm=338&src=ds&p={searchTerms}
[C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://search.snapdo.com/?q={searchTerms}&category=Web&publisher=snapdoadknowledge&country=us&feedid=infospace&st=nt&dpid=cr&lan=en&start=1
[C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRaHp8Pk5fza5XP2LqNOcSHMtbl0vt3xjxqLjH3FfFGrtpLTUpBCyo3nl5u-McZ9jvdJgkc6luCHgNudD-8Ol2Cp3-1hk8M6eZxZM8zbCAYLdq5q7Mk4hstTf2o8yaFp4kF8iA3iwmi_8k984XkdbaM-HizchhNvppzLzEx-uSgoQElcXGjmGwDNSwkuzDm9o&q={searchTerms}
[C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=cmi_14_19_ch&cd=2XzuyEtN2Y1L1Qzu0BzzyByCtA0FyByDtCtAyE0A0FyE0FtCtN0D0Tzu0SzzyDyCtN1L2XzutBtFtBtDtFyCtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyB0BtC0DyD0Fzz0BtG0D0AyByDtGyD0AyB0DtGtB0BtA0FtGyE0A0DtAtC0AyDtCyC0Czz0B2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDtAyE0BtAzztCtCtGyE0B0DzytGyCzztD0DtGtA0ByEtAtGtAyDtAtC0CyBtDyByDtC0Azy2Q&cr=1594317445&ir=
[C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://groovorio.com/results.php?f=4&q={searchTerms}&a=grv_installertech_14_22&cd=2XzuyEtN2Y1L1Qzu0BzzyByCtA0FyByDtCtAyE0A0FyE0FtCtN0D0Tzu0StCtDyDtCtN1L2XzutAtFyCtFtCtFtDtN1L1Czu1N1C2X1V1L1G1B2Z1T1I1I1P1C2Z1P1R1M1VtCyE1VtBtBtN1L1G1B1V1N2Y1L1Qzu2StBtD0DtC0A0FzzyBtG0FyD0A0BtG0EyE0CtCtGzy0EzztBtGyE0FtDtCyE0EtC0CtBzzyBtA2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0A0Czy0FtByD0F0EtGtDtC0AtCtGyE0Ezz0EtGzz0FyC0BtGtB0CtD0B0D0AyB0C0EtD0D0B2Q&cr=1725787544&ir=

*************************

AdwCleaner[R0].txt - [15434 bytes] - [15/03/2015 19:09:49]
AdwCleaner[R1].txt - [15494 bytes] - [16/03/2015 18:36:02]
AdwCleaner[S0].txt - [14752 bytes] - [16/03/2015 18:37:49]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [14812 bytes] ##########

### End AdwCleaner[S0].txt ###

### Start JRT.txt ###

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.4 (03.16.2015:1)
OS: Windows 8.1 x64
Ran by Owner on Mon 03/16/2015 at 18:46:51.20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\MapsGalaxy_39.ToolbarProtector
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\MapsGalaxy_39.ToolbarProtector.1

~~~ Files

Successfully deleted: [File] "C:\WINDOWS\couponprinter.ocx"

~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\pcdr"
Successfully deleted: [Folder] "C:\Users\Owner\AppData\Roaming\pcdr"

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Mon 03/16/2015 at 18:49:37.52
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

### End JRT.txt ###

### Start ESET Export.txt ###

C:\Windows\SysWOW64\PCProtect.dll Win32/AdWare.Loadshop.A application
C:\Program Files (x86)\7B0A8368-1A6F-48A5-B236-8BD61816B3F9\nfapi.dll a variant of Win64/NetFilter.A potentially unsafe application deleted - quarantined
C:\Program Files (x86)\Dell Backup and Recovery\Components\DBRUpdate\hstart.exe a variant of Win32/HiddenStart.A potentially unsafe application deleted - quarantined
C:\Program Files (x86)\Dell Backup and Recovery\Components\DBRUpdate\Backup\DBRUpdate\hstart.exe.bak a variant of Win32/HiddenStart.A potentially unsafe application deleted - quarantined
C:\Users\Owner\Desktop\Geek Squad Data Backup\Documents and Settings\Char\Local Settings\Temp\cheCA7A.tmp a variant of Win32/Toolbar.Conduit.AH potentially unwanted application deleted - quarantined
C:\Users\Owner\Desktop\Geek Squad Data Backup\Documents and Settings\Char\Local Settings\Temp\iMesh_setup.exe a variant of Win32/Toolbar.SearchSuite.Z potentially unwanted application deleted - quarantined
C:\Users\Owner\Desktop\Geek Squad Data Backup\Documents and Settings\Char\Local Settings\Temp\YontooLayers.crx multiple threats deleted - quarantined
C:\Users\Owner\Desktop\Geek Squad Data Backup\Documents and Settings\Char\Local Settings\Temp\34AFBB6F-BAB0-7891-B883-7EFEAF0A41AE\Latest\BabylonObjectInstaller.msi a variant of Win32/Toolbar.Babylon.Q potentially unwanted application deleted - quarantined
C:\Users\Owner\Desktop\Geek Squad Data Backup\Documents and Settings\Char\Local Settings\Temp\DIQM\FlashPlayer_151\exes.zip Win32/DomaIQ.E potentially unwanted application deleted - quarantined
C:\Users\Owner\Desktop\Geek Squad Data Backup\Documents and Settings\Char\Local Settings\Temp\{2FE45C87-F7E7-8450-66BB-BFC5F4077E71}\Addons\babylon.exe a variant of Win32/Toolbar.Babylon.A potentially unwanted application deleted - quarantined
C:\Users\Owner\Desktop\Geek Squad Data Backup\Documents and Settings\Char\Local Settings\Temp\{2FE45C87-F7E7-8450-66BB-BFC5F4077E71}\Addons\OptimizerPro.exe a variant of Win32/Adware.SpeedingUpMyPC.A application cleaned by deleting - quarantined
C:\Users\Owner\Desktop\Geek Squad Data Backup\Documents and Settings\Char\Local Settings\Temporary Internet Files\Content.IE5\ITIOHFR8\pack[1].7z Win32/bProtector.F potentially unwanted application deleted - quarantined
C:\Users\Owner\Desktop\Geek Squad Data Backup\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AM9N4IX3\update[1] a variant of Win32/Toolbar.Perion.A potentially unwanted application deleted - quarantined
C:\Users\Owner\Desktop\Geek Squad Data Backup\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\TI7OVDNG\updater-startnow-200-2.5-d[1].exe a variant of Win32/Toolbar.Zugo potentially unwanted application deleted - quarantined
C:\Users\Owner\Desktop\My Documents\Downloads\FlashPlayer_V.118299382c.exe Win32/DomaIQ.E potentially unwanted application deleted - quarantined
C:\Users\Owner\Desktop\My Documents\Downloads\flv_runner_b2_t2_Wrapper.exe a variant of Win32/Toolbar.Conduit.AJ potentially unwanted application deleted - quarantined
C:\Users\Owner\Desktop\My Documents\Downloads\flv_runner_b2_t3_Wrapper.exe a variant of Win32/Toolbar.Conduit.AJ potentially unwanted application deleted - quarantined
C:\Users\Owner\Desktop\My Documents\Downloads\iLividSetup.exe Win32/Toolbar.SearchSuite potentially unwanted application deleted - quarantined
C:\Users\Owner\Desktop\My Documents\Downloads\Shockwave_Installer_Slim.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application deleted - quarantined
C:\Users\Owner\Downloads\adobeflashplayer15betastandalone-setup.exe a variant of Win32/DownloadAdmin.H potentially unwanted application deleted - quarantined
C:\Users\Owner\Downloads\Chrome_Setup.exe a variant of Win32/InstallCore.UE potentially unwanted application deleted - quarantined
C:\Users\Owner\Downloads\IDM2-Win-EN.exe a variant of Win32/InstallCore.UF potentially unwanted application deleted - quarantined
C:\Users\Owner\Downloads\SoftwareUpdater (1).exe Win32/Conduit.SearchProtect.W potentially unwanted application deleted - quarantined
C:\Users\Owner\Downloads\uplayermediaplayer-setup (1).exe Win32/DownloadAdmin.G potentially unwanted application deleted - quarantined
C:\Windows\Installer\MSI7A6F.tmp-\Smartbar.Resources.HistoryAndStatsWrapper.dll a variant of MSIL/Toolbar.Linkury.I potentially unwanted application deleted - quarantined
C:\Windows\Installer\MSI7A6F.tmp-\sppsm.dll a variant of MSIL/Toolbar.Linkury.G potentially unwanted application deleted - quarantined
C:\Windows\Installer\MSI7A6F.tmp-\spusm.dll a variant of MSIL/Toolbar.Linkury.G potentially unwanted application deleted - quarantined
C:\Windows\System32\PCProtect.dll Win32/AdWare.Loadshop.A application cleaned by deleting - quarantined

### End ESET Export.txt ###

BetaLeaf · Mar 16, 2015

Thank you guys for all the help thus far. I will donate once the problem is resolved. I await your next reply.

Corrine · Mar 17, 2015

Hi, BetaLeaf. Before I provide instructions for cleaning up the tools we used, please provide a status update on your friend's computer. Is it running smoothly now? Any redirects, pop-ups? Are you able to install Windows Updates?

BetaLeaf · Mar 17, 2015

I have already cleaned up any logs and cleaning programs I loaded on there. My friend isn't having any problems anymore.

I hope my donations helps keep these awesome forums running.

Confirmation number: 2CL25282SC673025D

Corrine · Mar 17, 2015

That was very thoughtful of you, BetaLeaf. You'll receive an email confirmation from John after everything gets processed (and when he is caught up

).

BetaLeaf · Mar 17, 2015

Np its the least I can do. I sorta have this policy. I try my best to be self reliant but when I need to ask help I do pay for it with either hard labor or money.

Corrine · Mar 17, 2015

That is a very honorable policy to have. :rose:

Go The Power · Mar 17, 2015

Thank you for the donation, every bit helps to keep this forum up and running :)

Alex

BetaLeaf · Mar 17, 2015

No problem. Have a good day.

SFC Corrupted and it cannot fix itself.

Contributor

Contributor

Administrator, Microsoft MVP, Security Analyst

Senior Administrator, Windows Update Expert, Contributor

Contributor

Senior Administrator, Windows Update Expert, Contributor

Administrator, Microsoft MVP, Security Analyst

Contributor

Administrator, Microsoft MVP, Security Analyst

Contributor

Administrator, Microsoft MVP, Security Analyst

Contributor

Contributor

Administrator, Microsoft MVP, Security Analyst

Contributor

Administrator, Microsoft MVP, Security Analyst

Contributor

Administrator, Microsoft MVP, Security Analyst

Senior Administrator, Windows Update Expert, Contributor

Contributor

Administrator,
Microsoft MVP,
Security Analyst

Administrator,
Microsoft MVP,
Security Analyst

Administrator,
Microsoft MVP,
Security Analyst

Administrator,
Microsoft MVP,
Security Analyst

Administrator,
Microsoft MVP,
Security Analyst

Administrator,
Microsoft MVP,
Security Analyst

Administrator,
Microsoft MVP,
Security Analyst