Forums
New posts
Search forums
News
Security News
Technology News
Giveaways
Giveaways, Promotions and Contests
Discounts & Deals
Reviews
Users Reviews
Video Reviews
Support
Windows Malware Removal Help & Support
Mac Malware Removal Help & Support
Mobile Malware Removal Help & Support
Blog
Log in
Register
What's new
Search
Search titles only
By:
Search titles only
By:
Reply to thread
Menu
Install the app
Install
JavaScript is disabled. For a better experience, please enable JavaScript in your browser before proceeding.
You are using an out of date browser. It may not display this or other websites correctly.
You should upgrade or use an
alternative browser
.
Forums
Support
Windows Malware Removal Help & Support
Can't Remove GoSSave Extension From Google Chrome
Message
<blockquote data-quote="Rich K" data-source="post: 337991" data-attributes="member: 33441"><p>I did the Farbar scan. Here is the FRST.txt info followed by the Addition.txt info:</p><p></p><p>Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 19-01-2015</p><p>Ran by Rich (administrator) on RICH-WORK on 22-01-2015 15:39:32</p><p>Running from C:\Users\Rich\Downloads</p><p>Loaded Profiles: Rich (Available profiles: Rich)</p><p>Platform: Windows 8.1 (X64) OS Language: English (United States)</p><p>Internet Explorer Version 11 (Default browser: IE)</p><p>Boot Mode: Normal</p><p>Tutorial for Farbar Recovery Scan Tool: <a href="http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/" target="_blank">http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/</a></p><p></p><p>==================== Processes (Whitelisted) =================</p><p></p><p>(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)</p><p></p><p>(Intel Corporation) C:\Windows\System32\igfxCUIService.exe</p><p>(DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe</p><p>(DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkUserAgent.exe</p><p>(Microsoft Corporation) C:\Windows\System32\wlanext.exe</p><p>(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe</p><p>(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe</p><p>(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe</p><p>(Hewlett-Packard Company) C:\Program Files (x86)\HP\Common\HPSupportSolutionsFrameworkService.exe</p><p>(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe</p><p>(DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkUI.exe</p><p>(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe</p><p>(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe</p><p>(Nitro PDF Software) C:\Program Files\Common Files\Nitro PDF\Professional\7.0\NitroPDFDriverService2x64.exe</p><p>(Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE</p><p>(PasswordBox, Inc.) C:\Program Files (x86)\PasswordBox\pbbtnService.exe</p><p>(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe</p><p>(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe</p><p>(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe</p><p>(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe</p><p>(Microsoft Corporation) C:\Windows\System32\dasHost.exe</p><p>(Intel Corporation) C:\Windows\System32\igfxEM.exe</p><p>(Intel Corporation) C:\Windows\System32\igfxHK.exe</p><p>(Intel Corporation) C:\Windows\System32\igfxTray.exe</p><p>(Microsoft Corporation) C:\Windows\System32\dllhost.exe</p><p>(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe</p><p>(Synaptics) C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe</p><p>(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe</p><p>(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe</p><p>(Vimicro) C:\Program Files (x86)\USB Camera\VM331STI.EXE</p><p>(CyberLink) C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe</p><p>(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe</p><p>(CyberLink Corp.) C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe</p><p>(Lenovo) C:\Program Files (x86)\Lenovo\Lenovo MuteSync\MuteSync.exe</p><p>(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe</p><p>(CyberLink) C:\Program Files (x86)\Cyberlink\Power2Go9\CLMLSvc_P2G9.exe</p><p>(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe</p><p>(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe</p><p>(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe</p><p>(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe</p><p>(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE</p><p></p><p></p><p>==================== Registry (Whitelisted) ==================</p><p></p><p>(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)</p><p></p><p>HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12937872 2012-07-27] (Realtek Semiconductor)</p><p>HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1214608 2012-07-10] (Realtek Semiconductor)</p><p>HKLM\...\Run: [HotKeysCmds] => C:\windows\system32\hkcmd.exe</p><p>HKLM\...\Run: [Persistence] => C:\windows\system32\igfxpers.exe</p><p>HKLM\...\Run: [SynLenovoGestureMgr] => C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe [665400 2012-08-16] (Synaptics)</p><p>HKLM\...\Run: [OnekeyStudio] => C:\Program Files\Lenovo\Onekey Theater\OnekeyStudio.exe [4196432 2012-08-10] (Lenovo)</p><p>HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [17079376 2012-09-22] (Lenovo (Beijing) Limited)</p><p>HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [191568 2012-09-22] (Lenovo(beijing) Limited)</p><p>HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2916152 2012-08-16] (Synaptics Incorporated)</p><p>HKLM-x32\...\Run: [331BigDog] => C:\Program Files (x86)\USB Camera\VM331STI.EXE [548864 2012-05-01] (Vimicro)</p><p>HKLM-x32\...\Run: [Dolby Home Theater v4] => C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe [508656 2012-07-25] (Dolby Laboratories Inc.)</p><p>HKLM-x32\...\Run: [YouCam Mirage] => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [136488 2012-07-27] (CyberLink)</p><p>HKLM-x32\...\Run: [YouCam Tray] => C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [167024 2012-07-27] (CyberLink Corp.)</p><p>HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe [91432 2012-03-28] (CyberLink Corp.)</p><p>HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-07-12] (Intel Corporation)</p><p>HKLM-x32\...\Run: [MuteSync] => C:\Program Files (x86)\Lenovo\Lenovo MuteSync\MuteSync.exe [343040 2012-02-03] (Lenovo)</p><p>HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)</p><p>HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)</p><p>HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)</p><p>HKLM-x32\...\Run: [] => [X]</p><p>HKLM-x32\...\Run: [CLMLServer_For_P2G9] => C:\Program Files (x86)\Cyberlink\Power2Go9\CLMLSvc_P2G9.exe [110344 2014-08-11] (CyberLink)</p><p>HKU\S-1-5-21-1768883850-4105323506-3219541303-1001\...\Run: [HP Photosmart 5520 series (NET)] => C:\Program Files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)</p><p>HKU\S-1-5-21-1768883850-4105323506-3219541303-1001\...\Run: [Power2GoExpress9] => C:\Program Files (x86)\CyberLink\Power2Go9\Power2GoExpress9.exe [2397448 2014-08-11] (CyberLink Corp.)</p><p>Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk</p><p>ShortcutTarget: Bluetooth.lnk -> C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe (Broadcom Corporation.)</p><p>Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk</p><p>ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)</p><p>Startup: C:\Users\Rich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Photosmart 5520 series (Network).lnk</p><p>ShortcutTarget: Monitor Ink Alerts - HP Photosmart 5520 series (Network).lnk -> C:\Program Files\HP\HP Photosmart 5520 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)</p><p>Startup: C:\Users\Rich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk</p><p>ShortcutTarget: OneNote 2010 Screen Clipper and Launcher.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)</p><p>ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Rich\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)</p><p>ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Rich\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)</p><p>ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Rich\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)</p><p>ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Rich\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)</p><p>ShellIconOverlayIdentifiers: [SugarSyncBackedUp] -> {0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll No File</p><p>ShellIconOverlayIdentifiers: [SugarSyncPending] -> {62CCD8E3-9C21-41E1-B55E-1E26DFC68511} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll No File</p><p>ShellIconOverlayIdentifiers: [SugarSyncRoot] -> {A759AFF6-5851-457D-A540-F4ECED148351} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll No File</p><p>ShellIconOverlayIdentifiers: [SugarSyncShared] -> {1574C9EF-7D58-488F-B358-8B78C1538F51} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll No File</p><p>ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Rich\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)</p><p>ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Rich\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)</p><p>ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Rich\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)</p><p></p><p>==================== Internet (Whitelisted) ====================</p><p></p><p>(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)</p><p></p><p>HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION</p><p>HKU\S-1-5-21-1768883850-4105323506-3219541303-1001\Software\Microsoft\Internet Explorer\Main,Start Page = <a href="http://www.msn.com/?pc=MSE1" target="_blank">http://www.msn.com/?pc=MSE1</a></p><p>HKU\S-1-5-21-1768883850-4105323506-3219541303-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = <a href="http://lenovo13.msn.com" target="_blank">http://lenovo13.msn.com</a></p><p>HKU\S-1-5-21-1768883850-4105323506-3219541303-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = <a href="http://www.lenovo.com" target="_blank">http://www.lenovo.com</a></p><p>HKU\S-1-5-21-1768883850-4105323506-3219541303-1001\Software\Microsoft\Internet Explorer\Main,First Home Page = <a href="http://go.microsoft.com/fwlink/?LinkID=226786&Mkt=en-US&Src=WD8&Tid=000328B9&OHP=https%3A%2F%2Flogin.yahoo.com%2Fconfig%2Flogin%5Fverify2%3F%26.src%3Dym%26.intl%3Dus,http%3A%2F%2Fwww.lenovo.com&OSP=http%3A%2F%2Fwww.bing.com%2Fsearch%3Fq%3D%7BsearchTerms%7D%26src%3DIE%2DSearchBox%26FORM%3DIESR02" target="_blank">http://go.microsoft.com/fwlink/?LinkID=226786&Mkt=en-US&Src=WD8&Tid=000328B9&OHP=https://login.yahoo.com/config/login_verify2?&.src=ym&.intl=us,http://www.lenovo.com&OSP=http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02</a></p><p>SearchScopes: HKU\S-1-5-21-1768883850-4105323506-3219541303-1001 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = <a href="http://www.google.com/search?q={searchTerms}" target="_blank">http://www.google.com/search?q={searchTerms}</a></p><p>BHO: No Name -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> No File</p><p>BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)</p><p>BHO-x32: PasswordBox Helper -> {5DB69B97-934B-451D-94DB-32EF802A01CD} -> C:\Program Files (x86)\PasswordBox\Application\pbbtn.dll (PasswordBox, Inc.)</p><p>BHO-x32: No Name -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> No File</p><p>BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)</p><p>DPF: HKLM-x32 {4FF78044-96B4-4312-A5B7-FDA3CB328095}</p><p>Tcpip\Parameters: [DhcpNameServer] 192.168.0.1</p><p></p><p>FireFox:</p><p>========</p><p>FF ProfilePath: C:\Users\Rich\AppData\Roaming\Mozilla\Firefox\Profiles\t4tj16vu.default</p><p>FF DefaultSearchEngine: Google</p><p>FF SelectedSearchEngine: AVG Secure Search</p><p>FF Homepage: <a href="https://login.yahoo.com/?.src=ym&.intl=us&.lang=en-US&.done=https%3a//mail.yahoo.com" target="_blank">https://login.yahoo.com/?.src=ym&.intl=us&.lang=en-US&.done=https://mail.yahoo.com</a></p><p>FF Keyword.URL:</p><p>FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_257.dll ()</p><p>FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)</p><p>FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_257.dll ()</p><p>FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)</p><p>FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)</p><p>FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)</p><p>FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)</p><p>FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro PDF\Professional 7\npnitromozilla.dll ( )</p><p>FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)</p><p>FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)</p><p>FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)</p><p>FF HKLM-x32\...\Firefox\Extensions: [<a href="mailto:firefox@passwordbox.com">firefox@passwordbox.com</a>] - C:\Program Files (x86)\PasswordBox\Firefox</p><p>FF Extension: PasswordBox - C:\Program Files (x86)\PasswordBox\Firefox [2013-11-21]</p><p></p><p>Chrome:</p><p>=======</p><p>CHR HomePage: Default -> hxxp://mail.yahoo.com/</p><p>CHR StartupUrls: Default -> "<a href="https://login.yahoo.com/config/mail?.intl=us&.done=http%3A%2F%2Fus%2Dmg6.mail.yahoo.com%2Fneo%2Flaunch%3F.rand%3D2a7k6p35mplep#mail" target="_blank">https://login.yahoo.com/config/mail?.intl=us&.done=http://us-mg6.mail.yahoo.com/neo/launch?.rand=2a7k6p35mplep#mail</a>"</p><p>CHR Profile: C:\Users\Rich\AppData\Local\Google\Chrome\User Data\Default</p><p>CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Rich\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-28]</p><p>CHR Extension: (Google Wallet) - C:\Users\Rich\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]</p><p></p><p>==================== Services (Whitelisted) =================</p><p></p><p>(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)</p><p></p><p>S2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2252504 2013-09-04] (Broadcom Corporation.)</p><p>R2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [953720 2012-08-17] (Broadcom Corporation.)</p><p>R2 DisplayLinkService; C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe [10820400 2014-09-26] (DisplayLink Corp.)</p><p>R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1039360 2011-08-18] (Hewlett-Packard Co.) [File not signed]</p><p>R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89864 2014-12-11] (Hewlett-Packard Company)</p><p>R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe [2451456 2012-07-13] (Realsil Microelectronics Inc.) [File not signed]</p><p>R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [314696 2014-05-20] (Intel Corporation)</p><p>R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128896 2012-07-17] (Intel Corporation)</p><p>R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)</p><p>S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [272176 2012-07-18] ()</p><p>R2 Net Driver HPZ12; C:\Windows\System32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]</p><p>R2 NitroDriverReadSpool2; C:\Program Files\Common Files\Nitro PDF\Professional\7.0\NitroPDFDriverService2x64.exe [216072 2012-11-18] (Nitro PDF Software)</p><p>R2 PasswordBox; C:\Program Files (x86)\PasswordBox\pbbtnService.exe [67584 2014-05-14] (PasswordBox, Inc.) [File not signed]</p><p>R2 Pml Driver HPZ12; C:\Windows\System32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]</p><p>R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-21] (Microsoft Corporation)</p><p>R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-21] (Microsoft Corporation)</p><p>R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2699568 2012-07-18] (Intel® Corporation)</p><p></p><p>==================== Drivers (Whitelisted) ====================</p><p></p><p>(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)</p><p></p><p>R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170712 2013-09-04] (Broadcom Corporation.)</p><p>R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-09-24] (Microsoft Corporation)</p><p>R3 CLVirtualBus01; C:\Windows\System32\drivers\CLVirtualBus01.sys [103176 2014-03-12] (CyberLink)</p><p>R3 DisplayLinkUsbIo_x64; C:\Windows\system32\DRIVERS\DisplayLinkUsbIo_x64_7.7.57957.0.sys [46384 2014-10-30] ()</p><p>R3 dlcdcncm; C:\Windows\system32\DRIVERS\dlcdcncm62_x64.sys [82224 2014-09-26] (DisplayLink Corp.)</p><p>R3 dlusbaudio; C:\Windows\system32\DRIVERS\dlusbaudio_x64.sys [206640 2014-09-26] (DisplayLink Corp.)</p><p>R3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3344352 2013-07-08] (Intel Corporation)</p><p>R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-16] (Synaptics Incorporated)</p><p>R3 vm331avs; C:\Windows\System32\Drivers\vm331avs.sys [975104 2012-08-23] (Vimicro Corporation)</p><p>R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-21] (Microsoft Corporation)</p><p>S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)</p><p>S3 XHCIPort; C:\Windows\System32\drivers\XHCIPort.sys [188384 2012-08-09] (Windows (R) Win 7 DDK provider)</p><p>S3 dlcdcecm; \SystemRoot\system32\DRIVERS\dlcdcecm.sys [X]</p><p>S3 dlcdcncm6_x64; \SystemRoot\system32\DRIVERS\dlcdcncm6_x64.sys [X]</p><p></p><p>==================== NetSvcs (Whitelisted) ===================</p><p></p><p>(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)</p><p></p><p></p><p>==================== One Month Created Files and Folders ========</p><p></p><p>(If an entry is included in the fixlist, the file\folder will be moved.)</p><p></p><p>2015-01-22 15:39 - 2015-01-22 15:40 - 00018473 _____ () C:\Users\Rich\Downloads\FRST.txt</p><p>2015-01-22 15:38 - 2015-01-22 15:39 - 00000000 ____D () C:\FRST</p><p>2015-01-22 15:37 - 2015-01-22 15:38 - 02126848 _____ (Farbar) C:\Users\Rich\Downloads\FRST64.exe</p><p>2015-01-22 15:32 - 2015-01-22 15:32 - 00209404 _____ () C:\Users\Rich\Downloads\Spotify-spymusicgroupinc-2014-12 (1).zip</p><p>2015-01-22 14:57 - 2015-01-22 14:57 - 00209404 _____ () C:\Users\Rich\Downloads\Spotify-spymusicgroupinc-2014-12.zip</p><p>2015-01-22 13:53 - 2015-01-22 13:42 - 00024064 _____ () C:\WINDOWS\zoek-delete.exe</p><p>2015-01-22 13:42 - 2015-01-22 13:56 - 00011567 _____ () C:\zoek-results.log</p><p>2015-01-22 13:40 - 2015-01-22 13:52 - 00000000 ____D () C:\zoek_backup</p><p>2015-01-22 13:40 - 2015-01-22 13:40 - 01295360 _____ () C:\Users\Rich\Downloads\zoek.exe</p><p>2015-01-20 15:53 - 2015-01-20 15:53 - 00002381 _____ () C:\Users\Rich\Downloads\attachment</p><p>2015-01-20 15:53 - 2015-01-20 15:53 - 00000496 _____ () C:\Users\Rich\Downloads\VPOINRPTVXL.CSV</p><p>2015-01-19 15:27 - 2015-01-22 14:58 - 00000000 ____D () C:\Users\Rich\Documents\Fat Beats - Vinyl Project (with Lenny)</p><p>2015-01-19 10:54 - 2015-01-19 10:54 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox</p><p>2015-01-19 10:24 - 2015-01-19 10:24 - 06381120 _____ (Tim Kosse) C:\Users\Rich\Downloads\FileZilla_3.10.0.2_win32-setup.exe</p><p>2015-01-19 10:24 - 2015-01-19 10:24 - 06126536 _____ (Tim Kosse) C:\Users\Rich\Downloads\FileZilla_3.9.0.6_win32-setup.exe</p><p>2015-01-14 14:08 - 2014-12-11 21:04 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWbPrxy.exe</p><p>2015-01-14 14:08 - 2014-12-08 20:50 - 00225280 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll</p><p>2015-01-14 14:07 - 2014-12-19 01:26 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys</p><p>2015-01-14 14:07 - 2014-12-11 19:51 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys</p><p>2015-01-14 14:07 - 2014-12-08 14:42 - 00535640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll</p><p>2015-01-14 14:07 - 2014-12-08 14:42 - 00531616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll</p><p>2015-01-14 14:07 - 2014-12-08 14:42 - 00448792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll</p><p>2015-01-14 14:07 - 2014-12-08 14:42 - 00413248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll</p><p>2015-01-14 14:07 - 2014-12-08 14:42 - 00372408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll</p><p>2015-01-14 14:07 - 2014-12-08 14:42 - 00108944 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll</p><p>2015-01-14 14:07 - 2014-12-08 14:42 - 00038264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe</p><p>2015-01-14 14:07 - 2014-12-08 14:42 - 00033584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe</p><p>2015-01-14 14:07 - 2014-12-05 22:17 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll</p><p>2015-01-14 14:07 - 2014-12-05 20:41 - 00391680 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll</p><p>2015-01-14 14:07 - 2014-12-05 20:35 - 00229888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll</p><p>2015-01-14 14:07 - 2014-10-28 23:00 - 00465320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe</p><p>2015-01-14 14:07 - 2014-10-28 23:00 - 00139984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe</p><p>2015-01-14 14:07 - 2014-10-28 22:52 - 00500016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll</p><p>2015-01-14 14:07 - 2014-10-28 22:52 - 00482872 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll</p><p>2015-01-14 14:07 - 2014-10-28 22:52 - 00394120 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll</p><p>2015-01-14 14:07 - 2014-10-28 22:52 - 00272248 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe</p><p>2015-01-14 14:07 - 2014-10-28 22:12 - 00413136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe</p><p>2015-01-14 14:07 - 2014-10-28 22:12 - 00136296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe</p><p>2015-01-14 14:07 - 2014-10-28 22:07 - 00424544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll</p><p>2015-01-14 14:07 - 2014-10-28 22:07 - 00370424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll</p><p>2015-01-14 14:07 - 2014-10-28 22:07 - 00344536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll</p><p>2015-01-14 14:07 - 2014-10-28 21:44 - 00037888 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll</p><p>2015-01-14 14:07 - 2014-10-28 20:59 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll</p><p>2015-01-14 14:07 - 2014-10-28 20:24 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll</p><p>2015-01-14 14:07 - 2014-10-28 20:02 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll</p><p>2015-01-14 14:07 - 2014-10-28 20:01 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nlaapi.dll</p><p>2015-01-14 10:23 - 2015-01-14 10:23 - 04359168 _____ () C:\Users\Rich\Downloads\M2K_RoyaltyReport_2014-10-16_to_2015-01-13.xls</p><p>2015-01-14 09:29 - 2015-01-14 09:31 - 65671128 _____ () C:\Users\Rich\Downloads\PS5520_1315-1.exe</p><p>2015-01-13 09:33 - 2015-01-14 10:05 - 00002039 _____ () C:\Users\Public\Desktop\HP Print and Scan Doctor.lnk</p><p>2015-01-13 09:26 - 2015-01-13 09:26 - 00000000 ____D () C:\Users\Rich\AppData\Local\Hewlett-Packard</p><p>2015-01-13 09:25 - 2015-01-13 09:25 - 05197824 _____ () C:\Users\Rich\Downloads\HPSupportSolutionsFramework-en-11.51.0048.msi</p><p>2015-01-12 16:26 - 2015-01-12 16:26 - 00120526 _____ () C:\Users\Rich\Downloads\D_W_80034486_20150111.txt.gz</p><p>2015-01-12 16:20 - 2015-01-12 16:20 - 00146271 _____ () C:\Users\Rich\Downloads\D_W_80034486_20150104.txt.gz</p><p>2015-01-07 10:01 - 2015-01-19 15:07 - 00002214 _____ () C:\Users\Public\Desktop\Google Chrome.lnk</p><p>2015-01-07 10:01 - 2015-01-07 10:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome</p><p></p><p>==================== One Month Modified Files and Folders =======</p><p></p><p>(If an entry is included in the fixlist, the file\folder will be moved.)</p><p></p><p>2015-01-22 15:05 - 2012-11-28 14:37 - 00000914 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job</p><p>2015-01-22 15:00 - 2013-08-22 10:36 - 00000000 ____D () C:\WINDOWS\system32\sru</p><p>2015-01-22 14:13 - 2012-11-28 17:58 - 00000000 ____D () C:\Users\Rich\Documents\AAA (Miscellaneous Files)</p><p>2015-01-22 14:09 - 2014-10-29 13:43 - 01790259 _____ () C:\WINDOWS\WindowsUpdate.log</p><p>2015-01-22 14:02 - 2014-09-24 02:15 - 00863592 _____ () C:\WINDOWS\system32\PerfStringBackup.INI</p><p>2015-01-22 13:57 - 2012-11-28 14:37 - 00000910 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job</p><p>2015-01-22 13:56 - 2014-10-29 14:00 - 00000008 __RSH () C:\ProgramData\ntuser.pol</p><p>2015-01-22 13:56 - 2014-10-29 13:45 - 00000008 __RSH () C:\Users\Rich\ntuser.pol</p><p>2015-01-22 13:56 - 2014-10-29 13:19 - 00000000 ____D () C:\Users\Rich</p><p>2015-01-22 13:55 - 2013-08-22 09:46 - 00289358 _____ () C:\WINDOWS\setupact.log</p><p>2015-01-22 13:55 - 2013-08-22 09:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT</p><p>2015-01-22 13:54 - 2014-09-24 02:03 - 00027984 _____ () C:\WINDOWS\PFRO.log</p><p>2015-01-22 13:54 - 2013-08-22 08:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI</p><p>2015-01-22 13:54 - 2012-11-28 19:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service</p><p>2015-01-22 13:52 - 2014-09-11 14:25 - 00000000 ____D () C:\Users\Rich\AppData\Local\Comodo</p><p>2015-01-22 13:52 - 2014-09-11 14:25 - 00000000 ____D () C:\Users\Guest\AppData\Local\Google</p><p>2015-01-22 13:52 - 2014-09-11 14:25 - 00000000 ____D () C:\Users\Guest\AppData\Local\Comodo</p><p>2015-01-22 13:52 - 2014-09-11 14:25 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Google</p><p>2015-01-22 13:52 - 2014-09-11 14:25 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Comodo</p><p>2015-01-22 13:52 - 2012-11-28 14:36 - 00000000 ____D () C:\Users\Rich\AppData\Local\Google</p><p>2015-01-22 13:51 - 2013-08-22 10:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\GroupPolicy</p><p>2015-01-22 13:51 - 2012-07-26 03:12 - 00000000 ___HD () C:\WINDOWS\system32\GroupPolicy</p><p>2015-01-21 14:27 - 2012-11-30 14:05 - 00000000 ____D () C:\Users\Rich\AppData\Roaming\BitTorrent</p><p>2015-01-19 16:34 - 2012-11-28 14:19 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1768883850-4105323506-3219541303-1001</p><p>2015-01-19 15:34 - 2012-11-28 17:59 - 00000000 ____D () C:\Users\Rich\Documents\EOne Info</p><p>2015-01-19 15:30 - 2012-11-28 18:04 - 00000000 ____D () C:\Users\Rich\Documents\Royalty Share</p><p>2015-01-19 14:21 - 2013-08-22 09:44 - 00412760 _____ () C:\WINDOWS\system32\FNTCACHE.DAT</p><p>2015-01-19 14:16 - 2012-11-28 18:02 - 00000000 ____D () C:\Users\Rich\Documents\Personal File</p><p>2015-01-19 10:28 - 2012-11-28 17:58 - 00000000 ____D () C:\Users\Rich\Documents\Amazon Digital</p><p>2015-01-19 10:26 - 2012-12-12 16:39 - 00000000 ____D () C:\Users\Rich\AppData\Roaming\FileZilla</p><p>2015-01-19 09:38 - 2013-08-14 09:29 - 00000000 ____D () C:\WINDOWS\system32\MRT</p><p>2015-01-19 09:38 - 2012-07-26 02:59 - 00000000 ____D () C:\WINDOWS\CbsTemp</p><p>2015-01-19 09:37 - 2012-12-03 16:04 - 00000000 ____D () C:\Users\Rich\AppData\Roaming\HpUpdate</p><p>2015-01-19 09:30 - 2012-12-13 09:59 - 113365784 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe</p><p>2015-01-14 09:36 - 2012-11-28 18:18 - 00000000 ____D () C:\Users\Rich\AppData\Roaming\Nitro PDF</p><p>2015-01-13 09:27 - 2012-12-03 16:00 - 00000000 ____D () C:\Program Files (x86)\HP</p><p>2015-01-13 09:26 - 2013-07-15 14:06 - 00000000 ____D () C:\Program Files (x86)\Hewlett-Packard</p><p>2015-01-12 16:30 - 2012-11-28 17:59 - 00000000 ____D () C:\Users\Rich\Documents\Giusseppe D</p><p>2015-01-09 12:57 - 2012-11-28 17:59 - 00000000 ____D () C:\Users\Rich\Documents\Consolidated Independent (CI)</p><p>2015-01-08 09:07 - 2014-07-02 08:04 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys</p><p>2015-01-07 10:01 - 2012-11-28 14:37 - 00000000 ____D () C:\Program Files (x86)\Google</p><p>2015-01-07 10:00 - 2012-11-28 14:37 - 00003886 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA</p><p>2015-01-07 10:00 - 2012-11-28 14:37 - 00003650 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore</p><p>2015-01-05 19:08 - 2014-09-24 04:55 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe</p><p>2015-01-05 19:08 - 2014-09-24 04:55 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl</p><p>2015-01-05 10:06 - 2013-05-01 13:46 - 00000000 ____D () C:\Users\Rich\Documents\JSM</p><p>2015-01-05 09:19 - 2012-11-28 17:59 - 00000000 ____D () C:\Users\Rich\Documents\EOne Sales Reports (Walter)</p><p>2014-12-31 06:14 - 2012-11-29 09:51 - 00298120 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe</p><p>2014-12-24 11:53 - 2014-04-29 12:10 - 00000000 ____D () C:\Users\Rich\Documents\AMPED (AEC Distribution)</p><p>2014-12-23 16:12 - 2013-04-16 15:32 - 00000000 ____D () C:\Users\Rich\Documents\Brunswick Website Design 2014</p><p>2014-12-23 14:31 - 2012-11-29 14:04 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk</p><p>2014-12-23 10:52 - 2012-12-04 15:42 - 00000000 ____D () C:\ProgramData\1click dvd copy</p><p>2014-12-23 09:15 - 2014-11-18 13:26 - 00001362 _____ () C:\Users\Rich\Desktop\1CLICK DVD COPY 6.lnk</p><p>2014-12-23 09:15 - 2014-11-18 13:26 - 00000000 ____D () C:\Users\Public\Documents\LGSI</p><p>2014-12-23 09:15 - 2014-11-18 13:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\1Click DVD Copy 6</p><p></p><p>==================== Files in the root of some directories =======</p><p>2013-10-16 13:58 - 2013-10-23 09:10 - 0000006 _____ () C:\Users\Rich\AppData\Roaming\WBPU-TTL.DAT</p><p>2014-09-23 14:11 - 2014-09-23 14:11 - 0090784 _____ () C:\Users\Rich\AppData\Local\ars.cache</p><p>2014-09-23 14:12 - 2014-09-23 14:12 - 0153816 _____ () C:\Users\Rich\AppData\Local\census.cache</p><p>2014-09-23 13:57 - 2014-09-23 13:57 - 0000036 _____ () C:\Users\Rich\AppData\Local\housecall.guid.cache</p><p>2013-07-15 14:05 - 2013-07-15 14:05 - 0000057 _____ () C:\ProgramData\Ament.ini</p><p>2012-09-22 03:04 - 2012-09-22 03:04 - 0000000 ____H () C:\ProgramData\DP45977C.lfl</p><p>2012-12-03 15:59 - 2014-11-04 14:00 - 0001276 _____ () C:\ProgramData\hpzinstall.log</p><p></p><p>==================== Bamital & volsnap Check =================</p><p></p><p>(There is no automatic fix for files that do not pass verification.)</p><p></p><p>C:\Windows\System32\winlogon.exe => File is digitally signed</p><p>C:\Windows\System32\wininit.exe => File is digitally signed</p><p>C:\Windows\explorer.exe => File is digitally signed</p><p>C:\Windows\SysWOW64\explorer.exe => File is digitally signed</p><p>C:\Windows\System32\svchost.exe => File is digitally signed</p><p>C:\Windows\SysWOW64\svchost.exe => File is digitally signed</p><p>C:\Windows\System32\services.exe => File is digitally signed</p><p>C:\Windows\System32\User32.dll => File is digitally signed</p><p>C:\Windows\SysWOW64\User32.dll => File is digitally signed</p><p>C:\Windows\System32\userinit.exe => File is digitally signed</p><p>C:\Windows\SysWOW64\userinit.exe => File is digitally signed</p><p>C:\Windows\System32\rpcss.dll => File is digitally signed</p><p>C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed</p><p></p><p></p><p>LastRegBack: 2015-01-20 09:37</p><p></p><p>==================== End Of Log ============================</p><p></p><p></p><p>Additional scan result of Farbar Recovery Scan Tool (x64) Version: 19-01-2015</p><p>Ran by Rich at 2015-01-22 15:40:36</p><p>Running from C:\Users\Rich\Downloads</p><p>Boot Mode: Normal</p><p>==========================================================</p><p></p><p></p><p>==================== Security Center ========================</p><p></p><p>(If an entry is included in the fixlist, it will be removed.)</p><p></p><p>AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}</p><p>AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}</p><p></p><p>==================== Installed Programs ======================</p><p></p><p>(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)</p><p></p><p>1Click DVD Copy 6.0.1.0 (HKLM-x32\...\1Click DVD Copy 6_is1) (Version: - LG Software Innovations)</p><p>64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden</p><p>Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.257 - Adobe Systems Incorporated)</p><p>Adobe Reader XI (11.0.10) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)</p><p>Amazon Browser App (HKLM-x32\...\{0A7D6F3C-F2AB-48ED-BE23-99791BFF87D6}) (Version: 1.0.0.0 - Amazon)</p><p>Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)</p><p>Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)</p><p>Audacity 2.0.6 (HKLM-x32\...\Audacity_is1) (Version: 2.0.6 - Audacity Team)</p><p>BitTorrent (HKU\S-1-5-21-1768883850-4105323506-3219541303-1001\...\BitTorrent) (Version: 7.9.2.36804 - BitTorrent Inc.)</p><p>BufferChm (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden</p><p>C4700 (x32 Version: 140.0.851.000 - Hewlett-Packard) Hidden</p><p>CyberLink LabelPrint 2.5 (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.0.6603 - CyberLink Corp.)</p><p>CyberLink Power2Go 9 (HKLM-x32\...\InstallShield_{57D68FAE-CB5E-4fd6-AE3B-A0B43375AF18}) (Version: 9.0.1827.0 - CyberLink Corp.)</p><p>CyberLink WaveEditor 2 (HKLM-x32\...\InstallShield_{324F76CC-D8DD-4D87-B77D-D4AF5E1AA7B3}) (Version: 2.0.0.4203 - CyberLink Corp.)</p><p>Destinations (x32 Version: 140.0.253.000 - Hewlett-Packard) Hidden</p><p>DeviceDiscovery (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden</p><p>DisplayLink Core Software (HKLM\...\{16A951F0-1A5B-450F-B828-8E26CB8FB08F}) (Version: 7.7.57957.0 - DisplayLink Corp.)</p><p>DisplayLink Graphics (HKLM\...\{249173FD-D060-4D5A-9C14-040D5A25D6D4}) (Version: 7.7.57957.0 - DisplayLink Corp.)</p><p>Dolby Home Theater v4 (HKLM-x32\...\{B26438B4-BF51-49C3-9567-7F14A5E40CB9}) (Version: 7.2.8000.16 - Dolby Laboratories Inc)</p><p>Dropbox (HKU\S-1-5-21-1768883850-4105323506-3219541303-1001\...\Dropbox) (Version: 2.8.2 - Dropbox, Inc.)</p><p>DVD43 Plug-in v1.0.0.5 (HKLM-x32\...\DVD43 Plug-in_is1) (Version: - )</p><p>Energy Management (HKLM-x32\...\InstallShield_{D0956C11-0F60-43FE-99AD-524E833471BB}) (Version: 8.0.2.3 - Lenovo)</p><p>Energy Management (x32 Version: 8.0.2.3 - Lenovo) Hidden</p><p>FileZilla Client 3.9.0.3 (HKLM-x32\...\FileZilla Client) (Version: 3.9.0.3 - Tim Kosse)</p><p>foobar2000 v1.1.18 (HKLM-x32\...\foobar2000) (Version: 1.1.18 - Peter Pawlowski)</p><p>Free Audio Converter version 5.0.51.1022 (HKLM-x32\...\Free Audio Converter_is1) (Version: 5.0.51.1022 - DVDVideoSoft Ltd.)</p><p>FreeFixer (HKLM-x32\...\FreeFixer1.12) (Version: 1.12 - Kephyr)</p><p>Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.99 - Google Inc.)</p><p>Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden</p><p>GPBaseService2 (x32 Version: 140.0.297.000 - Hewlett-Packard) Hidden</p><p>HP Customer Participation Program 14.0 (HKLM\...\HPExtendedCapabilities) (Version: 14.0 - HP)</p><p>HP FWUpdateEDO2 (HKLM-x32\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)</p><p>HP Imaging Device Functions 14.0 (HKLM\...\HP Imaging Device Functions) (Version: 14.0 - HP)</p><p>HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.2024 - HP Photo Creations Powered by RocketLife)</p><p>HP Photosmart 5520 series Basic Device Software (HKLM\...\{68C0736C-3E47-43A6-B14D-236BEF198A5F}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)</p><p>HP Photosmart 5520 series Help (HKLM-x32\...\{7137E26A-10F7-4B1C-9980-0893579E92DA}) (Version: 27.0.0 - Hewlett Packard)</p><p>HP Photosmart 5520 series Product Improvement Study (HKLM\...\{DCC176F0-3CE3-4DA9-8FF9-3809C1B48C47}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)</p><p>HP Photosmart C4700 All-in-One Driver Software 14.0 Rel. 6 (HKLM\...\{28981D56-C55A-4972-998F-823590FD43A2}) (Version: 14.0 - HP)</p><p>HP Solution Center 14.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 14.0 - HP)</p><p>HP Support Solutions Framework (HKLM-x32\...\{E35601C0-BA8E-4F32-919A-C7EF4CA81F67}) (Version: 11.51.0048 - Hewlett-Packard Company)</p><p>HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)</p><p>HPDiagnosticAlert (x32 Version: 1.00.0000 - Microsoft) Hidden</p><p>HPPhotoGadget (x32 Version: 140.0.524.000 - Hewlett-Packard) Hidden</p><p>HPProductAssistant (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden</p><p>HPSSupply (x32 Version: 140.0.297.000 - Hewlett-Packard) Hidden</p><p>Intel AppUp(SM) center (HKLM-x32\...\Intel AppUp(SM) center 33057) (Version: 3.6.1.33057.10 - Intel)</p><p>Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)</p><p>Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3621 - Intel Corporation)</p><p>Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.0.1207 - Intel Corporation)</p><p>Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)</p><p>Intel(R) WiDi (HKLM\...\{EDBA2433-0910-4C72-8C5B-8FEDAE3EF18E}) (Version: 3.5.34.0 - Intel Corporation)</p><p>Intel® PROSet/Wireless WiFi Software (HKLM\...\{99FDAE3B-6905-45A6-8F73-595363AAD3D1}) (Version: 15.05.1000.1411 - Intel Corporation)</p><p>Intelligent Touchpad (HKLM-x32\...\{DD7D6D84-93AB-48CA-A759-94324E341CBA}) (Version: 2.00.0012.0723 - Lenovo)</p><p>Lenovo Bluetooth with Enhanced Data Rate Software (HKLM\...\{C6D9ED03-6FCF-4410-9CB7-45CA285F9E11}) (Version: 12.0.0.1900 - Broadcom Corporation)</p><p>Lenovo EasyCamera (HKLM-x32\...\{ADE16A9D-FBDC-4ecc-B6BD-9C31E51D0332}) (Version: 13.12.824.1 - Vimicro)</p><p>Lenovo MuteSync (HKLM-x32\...\{16D5D9E9-C8DE-4014-A09C-B9B5ABA0F7FA}) (Version: 1.0.10 - Lenovo)</p><p>Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 8.0.0.0710 - CyberLink Corp.)</p><p>Lenovo OneKey Recovery (Version: 8.0.0.0710 - CyberLink Corp.) Hidden</p><p>Lenovo Photos (HKLM-x32\...\Lenovo Photos) (Version: - CEWE COLOR AG u Co. OHG)</p><p>Lenovo PowerDVD10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.4310.52 - CyberLink Corp.)</p><p>Lenovo PowerDVD10 (x32 Version: 10.0.4310.52 - CyberLink Corp.) Hidden</p><p>Lenovo YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 4.1.3127 - CyberLink Corp.)</p><p>Lenovo YouCam (x32 Version: 4.1.3127 - CyberLink Corp.) Hidden</p><p>Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)</p><p>MarketResearch (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden</p><p>MediaMonkey 4.1 (HKLM-x32\...\MediaMonkey_is1) (Version: 4.1 - Ventis Media Inc.)</p><p>Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)</p><p>Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)</p><p>Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)</p><p>Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)</p><p>Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)</p><p>Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)</p><p>Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)</p><p>Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)</p><p>Mozilla Firefox 35.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 35.0 (x86 en-US)) (Version: 35.0 - Mozilla)</p><p>Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)</p><p>MP3Resizer 1.9.7 (HKLM-x32\...\MP3Resizer_is1) (Version: - Skyshape Software)</p><p>Network64 (Version: 140.0.306.000 - Hewlett-Packard) Hidden</p><p>Nitro Pro 7 (HKLM\...\{8665A8ED-8F56-45AB-91EF-E5A440649208}) (Version: 7.5.0.29 - Nitro PDF Software)</p><p>Onekey Theater (HKLM-x32\...\{91CC5BAE-A098-40D3-A43B-C0DC7CE263FE}) (Version: 3.0.0.9 - Lenovo)</p><p>PeaZip 4.8 (HKLM-x32\...\{5A2BC38A-406C-4A5B-BF45-6991F9A05325}_is1) (Version: - Giorgio Tani)</p><p>PeaZip 5.5.0 (WIN64) (HKLM\...\{5A2BC38A-406C-4A5B-BF45-6991F9A05325}_is1) (Version: - Giorgio Tani)</p><p>PS_AIO_06_C4700_SW_Min (x32 Version: 140.0.863.000 - Hewlett-Packard) Hidden</p><p>QuickTransfer (x32 Version: 140.0.98.000 - Hewlett-Packard) Hidden</p><p>Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.2.612.2012 - Realtek)</p><p>Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6695 - Realtek Semiconductor Corp.)</p><p>Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.39030 - Realtek Semiconductor Corp.)</p><p>Scan (x32 Version: 140.0.253.000 - Hewlett-Packard) Hidden</p><p>Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)</p><p>Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 14.0 - HP)</p><p>SolutionCenter (x32 Version: 140.0.299.000 - Hewlett-Packard) Hidden</p><p>Stamps.com (HKLM-x32\...\Stamps.com) (Version: - Stamps.com, Inc.)</p><p>Stamps.com (x32 Version: 9.6.1.2323 - Stamps.com, Inc.) Hidden</p><p>Status (x32 Version: 140.0.342.000 - Hewlett-Packard) Hidden</p><p>Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.10.5 - Synaptics Incorporated)</p><p>System Requirements Lab for Intel (HKLM-x32\...\{C7CA731B-BF9A-46D9-92CF-8A8737AE9240}) (Version: 4.5.13.0 - Husdawg, LLC)</p><p>TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.32494 - TeamViewer)</p><p>Toolbox (x32 Version: 140.0.596.000 - Hewlett-Packard) Hidden</p><p>TrayApp (x32 Version: 140.0.297.000 - Hewlett-Packard) Hidden</p><p>Trustworthy Toolbar (HKLM-x32\...\Trustworthy Toolbar) (Version: 6.13.3.505 - Trustworthy)</p><p>UserGuide (HKLM-x32\...\InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}) (Version: 1.0.0.9 - Lenovo)</p><p>UserGuide (x32 Version: 1.0.0.9 - Lenovo) Hidden</p><p>Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)</p><p>Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)</p><p>WebReg (x32 Version: 140.0.297.017 - Hewlett-Packard) Hidden</p><p>Windows Driver Package - Lenovo (ACPIVPC) System (06/15/2012 8.1.0.1) (HKLM\...\71BC3FD63F450BA0A957AAECBDB4A000C4F2BE42) (Version: 06/15/2012 8.1.0.1 - Lenovo)</p><p>Windows Driver Package - Lenovo (WUDFRd) LenovoVhid (06/19/2012 10.13.29.733) (HKLM\...\8A223E56FB1ED4F697B54E5BF96F1EB63B512684) (Version: 06/19/2012 10.13.29.733 - Lenovo)</p><p></p><p>==================== Custom CLSID (selected items): ==========================</p><p></p><p>(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)</p><p></p><p>CustomCLSID: HKU\S-1-5-21-1768883850-4105323506-3219541303-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Rich\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)</p><p>CustomCLSID: HKU\S-1-5-21-1768883850-4105323506-3219541303-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)</p><p>CustomCLSID: HKU\S-1-5-21-1768883850-4105323506-3219541303-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rich\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)</p><p>CustomCLSID: HKU\S-1-5-21-1768883850-4105323506-3219541303-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rich\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)</p><p>CustomCLSID: HKU\S-1-5-21-1768883850-4105323506-3219541303-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rich\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)</p><p>CustomCLSID: HKU\S-1-5-21-1768883850-4105323506-3219541303-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rich\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)</p><p></p><p>==================== Restore Points =========================</p><p></p><p>08-01-2015 11:21:40 Windows Update</p><p>12-01-2015 09:08:34 Windows Update</p><p>13-01-2015 09:25:27 Installed HP Support Solutions Framework</p><p>19-01-2015 09:27:48 Windows Update</p><p>22-01-2015 09:52:42 Windows Update</p><p></p><p>==================== Hosts content: ==========================</p><p></p><p>(If needed Hosts: directive could be included in the fixlist to reset Hosts.)</p><p></p><p>2013-08-22 08:25 - 2013-08-22 08:25 - 00000824 ____N C:\WINDOWS\system32\Drivers\etc\hosts</p><p></p><p>==================== Scheduled Tasks (whitelisted) =============</p><p></p><p>(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)</p><p></p><p>Task: {0CE5432C-1600-4080-B18C-F639FADEEE10} - \BackgroundContainer Startup Task No Task File <==== ATTENTION</p><p>Task: {194CD3B0-C82A-487D-9AB8-D4BED1407A3E} - System32\Tasks\HPCustParticipation HP Photosmart 5520 series => C:\Program Files\HP\HP Photosmart 5520 series\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)</p><p>Task: {4A5035DC-FE74-4A25-AE5D-2DC7BEB77825} - System32\Tasks\Microsoft\Windows\MobilePC\DisplayLink TMM Control</p><p>Task: {6117811A-A23D-46D7-BE46-65FE56484347} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-07] (Google Inc.)</p><p>Task: {66793CD2-3EA9-40C9-835F-FEEB0B220E90} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc</p><p>Task: {74CE45AD-896C-43BF-A7F2-1F5D268CAC39} - System32\Tasks\MirageAgent => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [2012-07-27] (CyberLink)</p><p>Task: {76A7CEE2-1359-4516-993B-1A789D5B6675} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-07] (Google Inc.)</p><p>Task: {7FE87057-4CCC-494B-AE7C-4801FD890A38} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-01-19] (Microsoft Corporation)</p><p>Task: {D6D398A9-4215-4193-9DA1-E973BDFDBACA} - System32\Tasks\Synaptics TouchPad Enhancements => \Program Files\Synaptics\SynTP\SynTPEnh.exe [2012-08-16] (Synaptics Incorporated)</p><p>Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe</p><p>Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe</p><p>Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe</p><p></p><p>==================== Loaded Modules (whitelisted) =============</p><p></p><p>2012-08-17 12:23 - 2012-08-17 12:23 - 00044408 _____ () C:\Program Files\Lenovo\Bluetooth Software\BtwLeAPI.dll</p><p>2014-05-14 11:45 - 2014-05-14 11:45 - 00090624 _____ () C:\Program Files (x86)\PasswordBox\libwebsocketswin32.dll</p><p>2014-11-04 15:32 - 2013-05-19 22:01 - 00627672 _____ () C:\Program Files (x86)\Cyberlink\Power2Go9\CLMediaLibrary.dll</p><p>2013-05-20 11:02 - 2013-05-20 11:02 - 00016856 _____ () C:\Program Files (x86)\CyberLink\Power2Go9\CLMLSvcPS.dll</p><p>2012-09-22 02:46 - 2012-06-25 12:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll</p><p></p><p>==================== Alternate Data Streams (whitelisted) =========</p><p></p><p>(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)</p><p></p><p></p><p>==================== Safe Mode (whitelisted) ===================</p><p></p><p>(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)</p><p></p><p></p><p>==================== EXE Association (whitelisted) =============</p><p></p><p>(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)</p><p></p><p></p><p>==================== MSCONFIG/TASK MANAGER disabled items =========</p><p></p><p>(Currently there is no automatic fix for this section.)</p><p></p><p>HKLM\...\StartupApproved\StartupFolder: => "Bluetooth.lnk"</p><p>HKLM\...\StartupApproved\StartupFolder: => "HP Digital Imaging Monitor.lnk"</p><p>HKLM\...\StartupApproved\Run: => "OnekeyStudio"</p><p>HKLM\...\StartupApproved\Run: => "RtHDVCpl"</p><p>HKLM\...\StartupApproved\Run32: => "Adobe ARM"</p><p>HKLM\...\StartupApproved\Run32: => "Dolby Home Theater v4"</p><p>HKLM\...\StartupApproved\Run32: => "RemoteControl10"</p><p>HKLM\...\StartupApproved\Run32: => "APSDaemon"</p><p>HKLM\...\StartupApproved\Run32: => "AVG_UI"</p><p>HKLM\...\StartupApproved\Run32: => "QuickTime Task"</p><p>HKU\S-1-5-21-1768883850-4105323506-3219541303-1001\...\StartupApproved\StartupFolder: => "OneNote 2010 Screen Clipper and Launcher.lnk"</p><p>HKU\S-1-5-21-1768883850-4105323506-3219541303-1001\...\StartupApproved\Run: => "HP Photosmart 5520 series (NET)"</p><p>HKU\S-1-5-21-1768883850-4105323506-3219541303-1001\...\StartupApproved\Run: => "CX"</p><p>HKU\S-1-5-21-1768883850-4105323506-3219541303-1001\...\StartupApproved\Run: => "Power2GoExpress9"</p><p></p><p>========================= Accounts: ==========================</p><p></p><p>Administrator (S-1-5-21-1768883850-4105323506-3219541303-500 - Administrator - Disabled)</p><p>Guest (S-1-5-21-1768883850-4105323506-3219541303-501 - Limited - Disabled)</p><p>HomeGroupUser$ (S-1-5-21-1768883850-4105323506-3219541303-1003 - Limited - Enabled)</p><p>Rich (S-1-5-21-1768883850-4105323506-3219541303-1001 - Administrator - Enabled) => C:\Users\Rich</p><p></p><p>==================== Faulty Device Manager Devices =============</p><p></p><p>Name: USB-IF xHCI USB Host Controller</p><p>Description: USB-IF xHCI USB Host Controller</p><p>Class Guid: {8a2edc79-c759-46f2-88af-9d4efe3b5eee}</p><p>Manufacturer: Intel Corporation</p><p>Service: XHCIPort</p><p>Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)</p><p>Resolution: Update the driver</p><p></p><p></p><p>==================== Event log errors: =========================</p><p></p><p>Application errors:</p><p>==================</p><p>Error: (01/22/2015 01:57:30 PM) (Source: SideBySide) (EventID: 33) (User: )</p><p>Description: Activation context generation failed for "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".</p><p>Dependent Assembly Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0" could not be found.</p><p>Please use sxstrace.exe for detailed diagnosis.</p><p></p><p>Error: (01/22/2015 01:51:13 PM) (Source: Application Error) (EventID: 1000) (User: )</p><p>Description: Faulting application name: plugin-container.exe, version: 35.0.0.5486, time stamp: 0x54af7153</p><p>Faulting module name: mozalloc.dll, version: 35.0.0.5486, time stamp: 0x54af69d4</p><p>Exception code: 0x80000003</p><p>Fault offset: 0x00001425</p><p>Faulting process id: 0xea8</p><p>Faulting application start time: 0xplugin-container.exe0</p><p>Faulting application path: plugin-container.exe1</p><p>Faulting module path: plugin-container.exe2</p><p>Report Id: plugin-container.exe3</p><p>Faulting package full name: plugin-container.exe4</p><p>Faulting package-relative application ID: plugin-container.exe5</p><p></p><p>Error: (01/22/2015 09:33:08 AM) (Source: SideBySide) (EventID: 33) (User: )</p><p>Description: Activation context generation failed for "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".</p><p>Dependent Assembly Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0" could not be found.</p><p>Please use sxstrace.exe for detailed diagnosis.</p><p></p><p>Error: (01/21/2015 09:14:55 AM) (Source: SideBySide) (EventID: 33) (User: )</p><p>Description: Activation context generation failed for "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".</p><p>Dependent Assembly Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0" could not be found.</p><p>Please use sxstrace.exe for detailed diagnosis.</p><p></p><p>Error: (01/20/2015 09:05:01 AM) (Source: SideBySide) (EventID: 33) (User: )</p><p>Description: Activation context generation failed for "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".</p><p>Dependent Assembly Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0" could not be found.</p><p>Please use sxstrace.exe for detailed diagnosis.</p><p></p><p>Error: (01/19/2015 03:17:23 PM) (Source: SideBySide) (EventID: 33) (User: )</p><p>Description: Activation context generation failed for "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".</p><p>Dependent Assembly Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0" could not be found.</p><p>Please use sxstrace.exe for detailed diagnosis.</p><p></p><p>Error: (01/19/2015 03:17:23 PM) (Source: SideBySide) (EventID: 33) (User: )</p><p>Description: Activation context generation failed for "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".</p><p>Dependent Assembly Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0" could not be found.</p><p>Please use sxstrace.exe for detailed diagnosis.</p><p></p><p>Error: (01/19/2015 03:16:59 PM) (Source: SideBySide) (EventID: 33) (User: )</p><p>Description: Activation context generation failed for "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".</p><p>Dependent Assembly Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0" could not be found.</p><p>Please use sxstrace.exe for detailed diagnosis.</p><p></p><p>Error: (01/19/2015 03:16:59 PM) (Source: SideBySide) (EventID: 33) (User: )</p><p>Description: Activation context generation failed for "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".</p><p>Dependent Assembly Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0" could not be found.</p><p>Please use sxstrace.exe for detailed diagnosis.</p><p></p><p>Error: (01/19/2015 03:16:48 PM) (Source: SideBySide) (EventID: 33) (User: )</p><p>Description: Activation context generation failed for "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".</p><p>Dependent Assembly Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0" could not be found.</p><p>Please use sxstrace.exe for detailed diagnosis.</p><p></p><p></p><p>System errors:</p><p>=============</p><p>Error: (01/22/2015 01:51:12 PM) (Source: Service Control Manager) (EventID: 7030) (User: )</p><p>Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.</p><p></p><p>Error: (01/22/2015 01:51:11 PM) (Source: Service Control Manager) (EventID: 7030) (User: )</p><p>Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.</p><p></p><p>Error: (01/22/2015 01:51:11 PM) (Source: Service Control Manager) (EventID: 7030) (User: )</p><p>Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.</p><p></p><p>Error: (01/22/2015 01:51:11 PM) (Source: Service Control Manager) (EventID: 7030) (User: )</p><p>Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.</p><p></p><p>Error: (01/22/2015 01:51:10 PM) (Source: Service Control Manager) (EventID: 7030) (User: )</p><p>Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.</p><p></p><p>Error: (01/22/2015 00:15:20 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)</p><p>Description: Installation Failure: Windows failed to install the following update with error 0x80070490: Hewlett-Packard - Imaging - Null Print - HP Photosmart 5520 series.</p><p></p><p>Error: (01/22/2015 09:54:34 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)</p><p>Description: Installation Failure: Windows failed to install the following update with error 0x80070490: Hewlett-Packard - Imaging - Null Print - HP Photosmart 5520 series.</p><p></p><p>Error: (01/21/2015 04:09:41 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)</p><p>Description: Installation Failure: Windows failed to install the following update with error 0x80070490: Hewlett-Packard - Imaging - Null Print - HP Photosmart 5520 series.</p><p></p><p>Error: (01/21/2015 03:42:23 PM) (Source: DCOM) (EventID: 10010) (User: Rich-Work)</p><p>Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}</p><p></p><p>Error: (01/21/2015 03:41:53 PM) (Source: DCOM) (EventID: 10010) (User: Rich-Work)</p><p>Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}</p><p></p><p></p><p>Microsoft Office Sessions:</p><p>=========================</p><p>Error: (01/22/2015 01:57:30 PM) (Source: SideBySide) (EventID: 33) (User: )</p><p>Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\WINDOWS\WinSxS\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.762_none_0c178a139ee2a7ed\MFC80U.DLL</p><p></p><p>Error: (01/22/2015 01:51:13 PM) (Source: Application Error) (EventID: 1000) (User: )</p><p>Description: plugin-container.exe35.0.0.548654af7153mozalloc.dll35.0.0.548654af69d48000000300001425ea801d036722cdd8de6C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dlla30f52ff-a267-11e4-bece-74e54320168a</p><p></p><p>Error: (01/22/2015 09:33:08 AM) (Source: SideBySide) (EventID: 33) (User: )</p><p>Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\WINDOWS\WinSxS\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.762_none_0c178a139ee2a7ed\MFC80U.DLL</p><p></p><p>Error: (01/21/2015 09:14:55 AM) (Source: SideBySide) (EventID: 33) (User: )</p><p>Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\WINDOWS\WinSxS\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.762_none_0c178a139ee2a7ed\MFC80U.DLL</p><p></p><p>Error: (01/20/2015 09:05:01 AM) (Source: SideBySide) (EventID: 33) (User: )</p><p>Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\WINDOWS\WinSxS\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.762_none_0c178a139ee2a7ed\MFC80U.DLL</p><p></p><p>Error: (01/19/2015 03:17:23 PM) (Source: SideBySide) (EventID: 33) (User: )</p><p>Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\WINDOWS\WinSxS\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.762_none_0c178a139ee2a7ed\MFC80.DLL</p><p></p><p>Error: (01/19/2015 03:17:23 PM) (Source: SideBySide) (EventID: 33) (User: )</p><p>Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\WINDOWS\WinSxS\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.762_none_0c178a139ee2a7ed\MFC80.DLL</p><p></p><p>Error: (01/19/2015 03:16:59 PM) (Source: SideBySide) (EventID: 33) (User: )</p><p>Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\WINDOWS\WinSxS\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.762_none_0c178a139ee2a7ed\MFC80.DLL</p><p></p><p>Error: (01/19/2015 03:16:59 PM) (Source: SideBySide) (EventID: 33) (User: )</p><p>Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\WINDOWS\WinSxS\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.762_none_0c178a139ee2a7ed\MFC80.DLL</p><p></p><p>Error: (01/19/2015 03:16:48 PM) (Source: SideBySide) (EventID: 33) (User: )</p><p>Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\WINDOWS\WinSxS\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.762_none_0c178a139ee2a7ed\MFC80.DLL</p><p></p><p></p><p>CodeIntegrity Errors:</p><p>===================================</p><p> Date: 2014-12-12 11:12:54.192</p><p> Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.</p><p></p><p></p><p>==================== Memory info ===========================</p><p></p><p>Processor: Intel(R) Core(TM) i5-3210M CPU @ 2.50GHz</p><p>Percentage of memory in use: 18%</p><p>Total physical RAM: 8052.91 MB</p><p>Available physical RAM: 6573.27 MB</p><p>Total Pagefile: 9524.91 MB</p><p>Available Pagefile: 8000.64 MB</p><p>Total Virtual: 131072 MB</p><p>Available Virtual: 131071.79 MB</p><p></p><p>==================== Drives ================================</p><p></p><p>Drive c: (Windows8_OS) (Fixed) (Total:650.86 GB) (Free:566.85 GB) NTFS ==>[System with boot components (obtained from reading drive)]</p><p>Drive d: (LENOVO) (Fixed) (Total:25 GB) (Free:22.43 GB) NTFS</p><p></p><p>==================== MBR & Partition Table ==================</p><p></p><p>========================================================</p><p>Disk: 0 (Size: 698.6 GB) (Disk ID: 2D36BE54)</p><p></p><p>Partition: GPT Partition Type.</p><p></p><p>==================== End Of Log ============================</p></blockquote><p></p>
[QUOTE="Rich K, post: 337991, member: 33441"] I did the Farbar scan. Here is the FRST.txt info followed by the Addition.txt info: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 19-01-2015 Ran by Rich (administrator) on RICH-WORK on 22-01-2015 15:39:32 Running from C:\Users\Rich\Downloads Loaded Profiles: Rich (Available profiles: Rich) Platform: Windows 8.1 (X64) OS Language: English (United States) Internet Explorer Version 11 (Default browser: IE) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: [URL]http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/[/URL] ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Intel Corporation) C:\Windows\System32\igfxCUIService.exe (DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe (DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkUserAgent.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe (Hewlett-Packard Company) C:\Program Files (x86)\HP\Common\HPSupportSolutionsFrameworkService.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (DisplayLink Corp.) C:\Program Files\DisplayLink Core Software\DisplayLinkUI.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (Nitro PDF Software) C:\Program Files\Common Files\Nitro PDF\Professional\7.0\NitroPDFDriverService2x64.exe (Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE (PasswordBox, Inc.) C:\Program Files (x86)\PasswordBox\pbbtnService.exe (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe (Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Intel Corporation) C:\Windows\System32\igfxEM.exe (Intel Corporation) C:\Windows\System32\igfxHK.exe (Intel Corporation) C:\Windows\System32\igfxTray.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Synaptics) C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe (Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe (Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe (Vimicro) C:\Program Files (x86)\USB Camera\VM331STI.EXE (CyberLink) C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (CyberLink Corp.) C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe (Lenovo) C:\Program Files (x86)\Lenovo\Lenovo MuteSync\MuteSync.exe (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (CyberLink) C:\Program Files (x86)\Cyberlink\Power2Go9\CLMLSvc_P2G9.exe (Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12937872 2012-07-27] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1214608 2012-07-10] (Realtek Semiconductor) HKLM\...\Run: [HotKeysCmds] => C:\windows\system32\hkcmd.exe HKLM\...\Run: [Persistence] => C:\windows\system32\igfxpers.exe HKLM\...\Run: [SynLenovoGestureMgr] => C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe [665400 2012-08-16] (Synaptics) HKLM\...\Run: [OnekeyStudio] => C:\Program Files\Lenovo\Onekey Theater\OnekeyStudio.exe [4196432 2012-08-10] (Lenovo) HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [17079376 2012-09-22] (Lenovo (Beijing) Limited) HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [191568 2012-09-22] (Lenovo(beijing) Limited) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2916152 2012-08-16] (Synaptics Incorporated) HKLM-x32\...\Run: [331BigDog] => C:\Program Files (x86)\USB Camera\VM331STI.EXE [548864 2012-05-01] (Vimicro) HKLM-x32\...\Run: [Dolby Home Theater v4] => C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe [508656 2012-07-25] (Dolby Laboratories Inc.) HKLM-x32\...\Run: [YouCam Mirage] => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [136488 2012-07-27] (CyberLink) HKLM-x32\...\Run: [YouCam Tray] => C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [167024 2012-07-27] (CyberLink Corp.) HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe [91432 2012-03-28] (CyberLink Corp.) HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-07-12] (Intel Corporation) HKLM-x32\...\Run: [MuteSync] => C:\Program Files (x86)\Lenovo\Lenovo MuteSync\MuteSync.exe [343040 2012-02-03] (Lenovo) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated) HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.) HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [CLMLServer_For_P2G9] => C:\Program Files (x86)\Cyberlink\Power2Go9\CLMLSvc_P2G9.exe [110344 2014-08-11] (CyberLink) HKU\S-1-5-21-1768883850-4105323506-3219541303-1001\...\Run: [HP Photosmart 5520 series (NET)] => C:\Program Files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.) HKU\S-1-5-21-1768883850-4105323506-3219541303-1001\...\Run: [Power2GoExpress9] => C:\Program Files (x86)\CyberLink\Power2Go9\Power2GoExpress9.exe [2397448 2014-08-11] (CyberLink Corp.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk ShortcutTarget: Bluetooth.lnk -> C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe (Broadcom Corporation.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.) Startup: C:\Users\Rich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Photosmart 5520 series (Network).lnk ShortcutTarget: Monitor Ink Alerts - HP Photosmart 5520 series (Network).lnk -> C:\Program Files\HP\HP Photosmart 5520 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.) Startup: C:\Users\Rich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk ShortcutTarget: OneNote 2010 Screen Clipper and Launcher.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation) ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Rich\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Rich\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Rich\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Rich\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: [SugarSyncBackedUp] -> {0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll No File ShellIconOverlayIdentifiers: [SugarSyncPending] -> {62CCD8E3-9C21-41E1-B55E-1E26DFC68511} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll No File ShellIconOverlayIdentifiers: [SugarSyncRoot] -> {A759AFF6-5851-457D-A540-F4ECED148351} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll No File ShellIconOverlayIdentifiers: [SugarSyncShared] -> {1574C9EF-7D58-488F-B358-8B78C1538F51} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll No File ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Rich\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Rich\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Rich\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\S-1-5-21-1768883850-4105323506-3219541303-1001\Software\Microsoft\Internet Explorer\Main,Start Page = [URL]http://www.msn.com/?pc=MSE1[/URL] HKU\S-1-5-21-1768883850-4105323506-3219541303-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [URL]http://lenovo13.msn.com[/URL] HKU\S-1-5-21-1768883850-4105323506-3219541303-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [URL]http://www.lenovo.com[/URL] HKU\S-1-5-21-1768883850-4105323506-3219541303-1001\Software\Microsoft\Internet Explorer\Main,First Home Page = [URL]http://go.microsoft.com/fwlink/?LinkID=226786&Mkt=en-US&Src=WD8&Tid=000328B9&OHP=https%3A%2F%2Flogin.yahoo.com%2Fconfig%2Flogin%5Fverify2%3F%26.src%3Dym%26.intl%3Dus,http%3A%2F%2Fwww.lenovo.com&OSP=http%3A%2F%2Fwww.bing.com%2Fsearch%3Fq%3D%7BsearchTerms%7D%26src%3DIE%2DSearchBox%26FORM%3DIESR02[/URL] SearchScopes: HKU\S-1-5-21-1768883850-4105323506-3219541303-1001 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = [URL]http://www.google.com/search?q={searchTerms}[/URL] BHO: No Name -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> No File BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: PasswordBox Helper -> {5DB69B97-934B-451D-94DB-32EF802A01CD} -> C:\Program Files (x86)\PasswordBox\Application\pbbtn.dll (PasswordBox, Inc.) BHO-x32: No Name -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> No File BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) DPF: HKLM-x32 {4FF78044-96B4-4312-A5B7-FDA3CB328095} Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 FireFox: ======== FF ProfilePath: C:\Users\Rich\AppData\Roaming\Mozilla\Firefox\Profiles\t4tj16vu.default FF DefaultSearchEngine: Google FF SelectedSearchEngine: AVG Secure Search FF Homepage: [URL]https://login.yahoo.com/?.src=ym&.intl=us&.lang=en-US&.done=https%3a//mail.yahoo.com[/URL] FF Keyword.URL: FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_257.dll () FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_257.dll () FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro PDF\Professional 7\npnitromozilla.dll ( ) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF HKLM-x32\...\Firefox\Extensions: [[email]firefox@passwordbox.com[/email]] - C:\Program Files (x86)\PasswordBox\Firefox FF Extension: PasswordBox - C:\Program Files (x86)\PasswordBox\Firefox [2013-11-21] Chrome: ======= CHR HomePage: Default -> hxxp://mail.yahoo.com/ CHR StartupUrls: Default -> "[URL]https://login.yahoo.com/config/mail?.intl=us&.done=http%3A%2F%2Fus%2Dmg6.mail.yahoo.com%2Fneo%2Flaunch%3F.rand%3D2a7k6p35mplep#mail[/URL]" CHR Profile: C:\Users\Rich\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Rich\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-28] CHR Extension: (Google Wallet) - C:\Users\Rich\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2252504 2013-09-04] (Broadcom Corporation.) R2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [953720 2012-08-17] (Broadcom Corporation.) R2 DisplayLinkService; C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe [10820400 2014-09-26] (DisplayLink Corp.) R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1039360 2011-08-18] (Hewlett-Packard Co.) [File not signed] R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89864 2014-12-11] (Hewlett-Packard Company) R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe [2451456 2012-07-13] (Realsil Microelectronics Inc.) [File not signed] R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [314696 2014-05-20] (Intel Corporation) R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128896 2012-07-17] (Intel Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation) S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [272176 2012-07-18] () R2 Net Driver HPZ12; C:\Windows\System32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed] R2 NitroDriverReadSpool2; C:\Program Files\Common Files\Nitro PDF\Professional\7.0\NitroPDFDriverService2x64.exe [216072 2012-11-18] (Nitro PDF Software) R2 PasswordBox; C:\Program Files (x86)\PasswordBox\pbbtnService.exe [67584 2014-05-14] (PasswordBox, Inc.) [File not signed] R2 Pml Driver HPZ12; C:\Windows\System32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed] R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-21] (Microsoft Corporation) R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-21] (Microsoft Corporation) R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2699568 2012-07-18] (Intel® Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170712 2013-09-04] (Broadcom Corporation.) R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-09-24] (Microsoft Corporation) R3 CLVirtualBus01; C:\Windows\System32\drivers\CLVirtualBus01.sys [103176 2014-03-12] (CyberLink) R3 DisplayLinkUsbIo_x64; C:\Windows\system32\DRIVERS\DisplayLinkUsbIo_x64_7.7.57957.0.sys [46384 2014-10-30] () R3 dlcdcncm; C:\Windows\system32\DRIVERS\dlcdcncm62_x64.sys [82224 2014-09-26] (DisplayLink Corp.) R3 dlusbaudio; C:\Windows\system32\DRIVERS\dlusbaudio_x64.sys [206640 2014-09-26] (DisplayLink Corp.) R3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3344352 2013-07-08] (Intel Corporation) R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-16] (Synaptics Incorporated) R3 vm331avs; C:\Windows\System32\Drivers\vm331avs.sys [975104 2012-08-23] (Vimicro Corporation) R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-21] (Microsoft Corporation) S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink) S3 XHCIPort; C:\Windows\System32\drivers\XHCIPort.sys [188384 2012-08-09] (Windows (R) Win 7 DDK provider) S3 dlcdcecm; \SystemRoot\system32\DRIVERS\dlcdcecm.sys [X] S3 dlcdcncm6_x64; \SystemRoot\system32\DRIVERS\dlcdcncm6_x64.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-22 15:39 - 2015-01-22 15:40 - 00018473 _____ () C:\Users\Rich\Downloads\FRST.txt 2015-01-22 15:38 - 2015-01-22 15:39 - 00000000 ____D () C:\FRST 2015-01-22 15:37 - 2015-01-22 15:38 - 02126848 _____ (Farbar) C:\Users\Rich\Downloads\FRST64.exe 2015-01-22 15:32 - 2015-01-22 15:32 - 00209404 _____ () C:\Users\Rich\Downloads\Spotify-spymusicgroupinc-2014-12 (1).zip 2015-01-22 14:57 - 2015-01-22 14:57 - 00209404 _____ () C:\Users\Rich\Downloads\Spotify-spymusicgroupinc-2014-12.zip 2015-01-22 13:53 - 2015-01-22 13:42 - 00024064 _____ () C:\WINDOWS\zoek-delete.exe 2015-01-22 13:42 - 2015-01-22 13:56 - 00011567 _____ () C:\zoek-results.log 2015-01-22 13:40 - 2015-01-22 13:52 - 00000000 ____D () C:\zoek_backup 2015-01-22 13:40 - 2015-01-22 13:40 - 01295360 _____ () C:\Users\Rich\Downloads\zoek.exe 2015-01-20 15:53 - 2015-01-20 15:53 - 00002381 _____ () C:\Users\Rich\Downloads\attachment 2015-01-20 15:53 - 2015-01-20 15:53 - 00000496 _____ () C:\Users\Rich\Downloads\VPOINRPTVXL.CSV 2015-01-19 15:27 - 2015-01-22 14:58 - 00000000 ____D () C:\Users\Rich\Documents\Fat Beats - Vinyl Project (with Lenny) 2015-01-19 10:54 - 2015-01-19 10:54 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2015-01-19 10:24 - 2015-01-19 10:24 - 06381120 _____ (Tim Kosse) C:\Users\Rich\Downloads\FileZilla_3.10.0.2_win32-setup.exe 2015-01-19 10:24 - 2015-01-19 10:24 - 06126536 _____ (Tim Kosse) C:\Users\Rich\Downloads\FileZilla_3.9.0.6_win32-setup.exe 2015-01-14 14:08 - 2014-12-11 21:04 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWbPrxy.exe 2015-01-14 14:08 - 2014-12-08 20:50 - 00225280 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll 2015-01-14 14:07 - 2014-12-19 01:26 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys 2015-01-14 14:07 - 2014-12-11 19:51 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys 2015-01-14 14:07 - 2014-12-08 14:42 - 00535640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll 2015-01-14 14:07 - 2014-12-08 14:42 - 00531616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll 2015-01-14 14:07 - 2014-12-08 14:42 - 00448792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll 2015-01-14 14:07 - 2014-12-08 14:42 - 00413248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll 2015-01-14 14:07 - 2014-12-08 14:42 - 00372408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll 2015-01-14 14:07 - 2014-12-08 14:42 - 00108944 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll 2015-01-14 14:07 - 2014-12-08 14:42 - 00038264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe 2015-01-14 14:07 - 2014-12-08 14:42 - 00033584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe 2015-01-14 14:07 - 2014-12-05 22:17 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll 2015-01-14 14:07 - 2014-12-05 20:41 - 00391680 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll 2015-01-14 14:07 - 2014-12-05 20:35 - 00229888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll 2015-01-14 14:07 - 2014-10-28 23:00 - 00465320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe 2015-01-14 14:07 - 2014-10-28 23:00 - 00139984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe 2015-01-14 14:07 - 2014-10-28 22:52 - 00500016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll 2015-01-14 14:07 - 2014-10-28 22:52 - 00482872 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll 2015-01-14 14:07 - 2014-10-28 22:52 - 00394120 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll 2015-01-14 14:07 - 2014-10-28 22:52 - 00272248 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe 2015-01-14 14:07 - 2014-10-28 22:12 - 00413136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe 2015-01-14 14:07 - 2014-10-28 22:12 - 00136296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe 2015-01-14 14:07 - 2014-10-28 22:07 - 00424544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll 2015-01-14 14:07 - 2014-10-28 22:07 - 00370424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll 2015-01-14 14:07 - 2014-10-28 22:07 - 00344536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll 2015-01-14 14:07 - 2014-10-28 21:44 - 00037888 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll 2015-01-14 14:07 - 2014-10-28 20:59 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll 2015-01-14 14:07 - 2014-10-28 20:24 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll 2015-01-14 14:07 - 2014-10-28 20:02 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll 2015-01-14 14:07 - 2014-10-28 20:01 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nlaapi.dll 2015-01-14 10:23 - 2015-01-14 10:23 - 04359168 _____ () C:\Users\Rich\Downloads\M2K_RoyaltyReport_2014-10-16_to_2015-01-13.xls 2015-01-14 09:29 - 2015-01-14 09:31 - 65671128 _____ () C:\Users\Rich\Downloads\PS5520_1315-1.exe 2015-01-13 09:33 - 2015-01-14 10:05 - 00002039 _____ () C:\Users\Public\Desktop\HP Print and Scan Doctor.lnk 2015-01-13 09:26 - 2015-01-13 09:26 - 00000000 ____D () C:\Users\Rich\AppData\Local\Hewlett-Packard 2015-01-13 09:25 - 2015-01-13 09:25 - 05197824 _____ () C:\Users\Rich\Downloads\HPSupportSolutionsFramework-en-11.51.0048.msi 2015-01-12 16:26 - 2015-01-12 16:26 - 00120526 _____ () C:\Users\Rich\Downloads\D_W_80034486_20150111.txt.gz 2015-01-12 16:20 - 2015-01-12 16:20 - 00146271 _____ () C:\Users\Rich\Downloads\D_W_80034486_20150104.txt.gz 2015-01-07 10:01 - 2015-01-19 15:07 - 00002214 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2015-01-07 10:01 - 2015-01-07 10:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-22 15:05 - 2012-11-28 14:37 - 00000914 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job 2015-01-22 15:00 - 2013-08-22 10:36 - 00000000 ____D () C:\WINDOWS\system32\sru 2015-01-22 14:13 - 2012-11-28 17:58 - 00000000 ____D () C:\Users\Rich\Documents\AAA (Miscellaneous Files) 2015-01-22 14:09 - 2014-10-29 13:43 - 01790259 _____ () C:\WINDOWS\WindowsUpdate.log 2015-01-22 14:02 - 2014-09-24 02:15 - 00863592 _____ () C:\WINDOWS\system32\PerfStringBackup.INI 2015-01-22 13:57 - 2012-11-28 14:37 - 00000910 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job 2015-01-22 13:56 - 2014-10-29 14:00 - 00000008 __RSH () C:\ProgramData\ntuser.pol 2015-01-22 13:56 - 2014-10-29 13:45 - 00000008 __RSH () C:\Users\Rich\ntuser.pol 2015-01-22 13:56 - 2014-10-29 13:19 - 00000000 ____D () C:\Users\Rich 2015-01-22 13:55 - 2013-08-22 09:46 - 00289358 _____ () C:\WINDOWS\setupact.log 2015-01-22 13:55 - 2013-08-22 09:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT 2015-01-22 13:54 - 2014-09-24 02:03 - 00027984 _____ () C:\WINDOWS\PFRO.log 2015-01-22 13:54 - 2013-08-22 08:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI 2015-01-22 13:54 - 2012-11-28 19:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2015-01-22 13:52 - 2014-09-11 14:25 - 00000000 ____D () C:\Users\Rich\AppData\Local\Comodo 2015-01-22 13:52 - 2014-09-11 14:25 - 00000000 ____D () C:\Users\Guest\AppData\Local\Google 2015-01-22 13:52 - 2014-09-11 14:25 - 00000000 ____D () C:\Users\Guest\AppData\Local\Comodo 2015-01-22 13:52 - 2014-09-11 14:25 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Google 2015-01-22 13:52 - 2014-09-11 14:25 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Comodo 2015-01-22 13:52 - 2012-11-28 14:36 - 00000000 ____D () C:\Users\Rich\AppData\Local\Google 2015-01-22 13:51 - 2013-08-22 10:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\GroupPolicy 2015-01-22 13:51 - 2012-07-26 03:12 - 00000000 ___HD () C:\WINDOWS\system32\GroupPolicy 2015-01-21 14:27 - 2012-11-30 14:05 - 00000000 ____D () C:\Users\Rich\AppData\Roaming\BitTorrent 2015-01-19 16:34 - 2012-11-28 14:19 - 00003600 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1768883850-4105323506-3219541303-1001 2015-01-19 15:34 - 2012-11-28 17:59 - 00000000 ____D () C:\Users\Rich\Documents\EOne Info 2015-01-19 15:30 - 2012-11-28 18:04 - 00000000 ____D () C:\Users\Rich\Documents\Royalty Share 2015-01-19 14:21 - 2013-08-22 09:44 - 00412760 _____ () C:\WINDOWS\system32\FNTCACHE.DAT 2015-01-19 14:16 - 2012-11-28 18:02 - 00000000 ____D () C:\Users\Rich\Documents\Personal File 2015-01-19 10:28 - 2012-11-28 17:58 - 00000000 ____D () C:\Users\Rich\Documents\Amazon Digital 2015-01-19 10:26 - 2012-12-12 16:39 - 00000000 ____D () C:\Users\Rich\AppData\Roaming\FileZilla 2015-01-19 09:38 - 2013-08-14 09:29 - 00000000 ____D () C:\WINDOWS\system32\MRT 2015-01-19 09:38 - 2012-07-26 02:59 - 00000000 ____D () C:\WINDOWS\CbsTemp 2015-01-19 09:37 - 2012-12-03 16:04 - 00000000 ____D () C:\Users\Rich\AppData\Roaming\HpUpdate 2015-01-19 09:30 - 2012-12-13 09:59 - 113365784 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2015-01-14 09:36 - 2012-11-28 18:18 - 00000000 ____D () C:\Users\Rich\AppData\Roaming\Nitro PDF 2015-01-13 09:27 - 2012-12-03 16:00 - 00000000 ____D () C:\Program Files (x86)\HP 2015-01-13 09:26 - 2013-07-15 14:06 - 00000000 ____D () C:\Program Files (x86)\Hewlett-Packard 2015-01-12 16:30 - 2012-11-28 17:59 - 00000000 ____D () C:\Users\Rich\Documents\Giusseppe D 2015-01-09 12:57 - 2012-11-28 17:59 - 00000000 ____D () C:\Users\Rich\Documents\Consolidated Independent (CI) 2015-01-08 09:07 - 2014-07-02 08:04 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2015-01-07 10:01 - 2012-11-28 14:37 - 00000000 ____D () C:\Program Files (x86)\Google 2015-01-07 10:00 - 2012-11-28 14:37 - 00003886 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA 2015-01-07 10:00 - 2012-11-28 14:37 - 00003650 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore 2015-01-05 19:08 - 2014-09-24 04:55 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2015-01-05 19:08 - 2014-09-24 04:55 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl 2015-01-05 10:06 - 2013-05-01 13:46 - 00000000 ____D () C:\Users\Rich\Documents\JSM 2015-01-05 09:19 - 2012-11-28 17:59 - 00000000 ____D () C:\Users\Rich\Documents\EOne Sales Reports (Walter) 2014-12-31 06:14 - 2012-11-29 09:51 - 00298120 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe 2014-12-24 11:53 - 2014-04-29 12:10 - 00000000 ____D () C:\Users\Rich\Documents\AMPED (AEC Distribution) 2014-12-23 16:12 - 2013-04-16 15:32 - 00000000 ____D () C:\Users\Rich\Documents\Brunswick Website Design 2014 2014-12-23 14:31 - 2012-11-29 14:04 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2014-12-23 10:52 - 2012-12-04 15:42 - 00000000 ____D () C:\ProgramData\1click dvd copy 2014-12-23 09:15 - 2014-11-18 13:26 - 00001362 _____ () C:\Users\Rich\Desktop\1CLICK DVD COPY 6.lnk 2014-12-23 09:15 - 2014-11-18 13:26 - 00000000 ____D () C:\Users\Public\Documents\LGSI 2014-12-23 09:15 - 2014-11-18 13:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\1Click DVD Copy 6 ==================== Files in the root of some directories ======= 2013-10-16 13:58 - 2013-10-23 09:10 - 0000006 _____ () C:\Users\Rich\AppData\Roaming\WBPU-TTL.DAT 2014-09-23 14:11 - 2014-09-23 14:11 - 0090784 _____ () C:\Users\Rich\AppData\Local\ars.cache 2014-09-23 14:12 - 2014-09-23 14:12 - 0153816 _____ () C:\Users\Rich\AppData\Local\census.cache 2014-09-23 13:57 - 2014-09-23 13:57 - 0000036 _____ () C:\Users\Rich\AppData\Local\housecall.guid.cache 2013-07-15 14:05 - 2013-07-15 14:05 - 0000057 _____ () C:\ProgramData\Ament.ini 2012-09-22 03:04 - 2012-09-22 03:04 - 0000000 ____H () C:\ProgramData\DP45977C.lfl 2012-12-03 15:59 - 2014-11-04 14:00 - 0001276 _____ () C:\ProgramData\hpzinstall.log ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-01-20 09:37 ==================== End Of Log ============================ Additional scan result of Farbar Recovery Scan Tool (x64) Version: 19-01-2015 Ran by Rich at 2015-01-22 15:40:36 Running from C:\Users\Rich\Downloads Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) 1Click DVD Copy 6.0.1.0 (HKLM-x32\...\1Click DVD Copy 6_is1) (Version: - LG Software Innovations) 64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.257 - Adobe Systems Incorporated) Adobe Reader XI (11.0.10) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated) Amazon Browser App (HKLM-x32\...\{0A7D6F3C-F2AB-48ED-BE23-99791BFF87D6}) (Version: 1.0.0.0 - Amazon) Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.) Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.) Audacity 2.0.6 (HKLM-x32\...\Audacity_is1) (Version: 2.0.6 - Audacity Team) BitTorrent (HKU\S-1-5-21-1768883850-4105323506-3219541303-1001\...\BitTorrent) (Version: 7.9.2.36804 - BitTorrent Inc.) BufferChm (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden C4700 (x32 Version: 140.0.851.000 - Hewlett-Packard) Hidden CyberLink LabelPrint 2.5 (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.0.6603 - CyberLink Corp.) CyberLink Power2Go 9 (HKLM-x32\...\InstallShield_{57D68FAE-CB5E-4fd6-AE3B-A0B43375AF18}) (Version: 9.0.1827.0 - CyberLink Corp.) CyberLink WaveEditor 2 (HKLM-x32\...\InstallShield_{324F76CC-D8DD-4D87-B77D-D4AF5E1AA7B3}) (Version: 2.0.0.4203 - CyberLink Corp.) Destinations (x32 Version: 140.0.253.000 - Hewlett-Packard) Hidden DeviceDiscovery (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden DisplayLink Core Software (HKLM\...\{16A951F0-1A5B-450F-B828-8E26CB8FB08F}) (Version: 7.7.57957.0 - DisplayLink Corp.) DisplayLink Graphics (HKLM\...\{249173FD-D060-4D5A-9C14-040D5A25D6D4}) (Version: 7.7.57957.0 - DisplayLink Corp.) Dolby Home Theater v4 (HKLM-x32\...\{B26438B4-BF51-49C3-9567-7F14A5E40CB9}) (Version: 7.2.8000.16 - Dolby Laboratories Inc) Dropbox (HKU\S-1-5-21-1768883850-4105323506-3219541303-1001\...\Dropbox) (Version: 2.8.2 - Dropbox, Inc.) DVD43 Plug-in v1.0.0.5 (HKLM-x32\...\DVD43 Plug-in_is1) (Version: - ) Energy Management (HKLM-x32\...\InstallShield_{D0956C11-0F60-43FE-99AD-524E833471BB}) (Version: 8.0.2.3 - Lenovo) Energy Management (x32 Version: 8.0.2.3 - Lenovo) Hidden FileZilla Client 3.9.0.3 (HKLM-x32\...\FileZilla Client) (Version: 3.9.0.3 - Tim Kosse) foobar2000 v1.1.18 (HKLM-x32\...\foobar2000) (Version: 1.1.18 - Peter Pawlowski) Free Audio Converter version 5.0.51.1022 (HKLM-x32\...\Free Audio Converter_is1) (Version: 5.0.51.1022 - DVDVideoSoft Ltd.) FreeFixer (HKLM-x32\...\FreeFixer1.12) (Version: 1.12 - Kephyr) Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.99 - Google Inc.) Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden GPBaseService2 (x32 Version: 140.0.297.000 - Hewlett-Packard) Hidden HP Customer Participation Program 14.0 (HKLM\...\HPExtendedCapabilities) (Version: 14.0 - HP) HP FWUpdateEDO2 (HKLM-x32\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard) HP Imaging Device Functions 14.0 (HKLM\...\HP Imaging Device Functions) (Version: 14.0 - HP) HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.2024 - HP Photo Creations Powered by RocketLife) HP Photosmart 5520 series Basic Device Software (HKLM\...\{68C0736C-3E47-43A6-B14D-236BEF198A5F}) (Version: 28.0.1315.0 - Hewlett-Packard Co.) HP Photosmart 5520 series Help (HKLM-x32\...\{7137E26A-10F7-4B1C-9980-0893579E92DA}) (Version: 27.0.0 - Hewlett Packard) HP Photosmart 5520 series Product Improvement Study (HKLM\...\{DCC176F0-3CE3-4DA9-8FF9-3809C1B48C47}) (Version: 28.0.1315.0 - Hewlett-Packard Co.) HP Photosmart C4700 All-in-One Driver Software 14.0 Rel. 6 (HKLM\...\{28981D56-C55A-4972-998F-823590FD43A2}) (Version: 14.0 - HP) HP Solution Center 14.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 14.0 - HP) HP Support Solutions Framework (HKLM-x32\...\{E35601C0-BA8E-4F32-919A-C7EF4CA81F67}) (Version: 11.51.0048 - Hewlett-Packard Company) HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard) HPDiagnosticAlert (x32 Version: 1.00.0000 - Microsoft) Hidden HPPhotoGadget (x32 Version: 140.0.524.000 - Hewlett-Packard) Hidden HPProductAssistant (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden HPSSupply (x32 Version: 140.0.297.000 - Hewlett-Packard) Hidden Intel AppUp(SM) center (HKLM-x32\...\Intel AppUp(SM) center 33057) (Version: 3.6.1.33057.10 - Intel) Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation) Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3621 - Intel Corporation) Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.0.1207 - Intel Corporation) Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation) Intel(R) WiDi (HKLM\...\{EDBA2433-0910-4C72-8C5B-8FEDAE3EF18E}) (Version: 3.5.34.0 - Intel Corporation) Intel® PROSet/Wireless WiFi Software (HKLM\...\{99FDAE3B-6905-45A6-8F73-595363AAD3D1}) (Version: 15.05.1000.1411 - Intel Corporation) Intelligent Touchpad (HKLM-x32\...\{DD7D6D84-93AB-48CA-A759-94324E341CBA}) (Version: 2.00.0012.0723 - Lenovo) Lenovo Bluetooth with Enhanced Data Rate Software (HKLM\...\{C6D9ED03-6FCF-4410-9CB7-45CA285F9E11}) (Version: 12.0.0.1900 - Broadcom Corporation) Lenovo EasyCamera (HKLM-x32\...\{ADE16A9D-FBDC-4ecc-B6BD-9C31E51D0332}) (Version: 13.12.824.1 - Vimicro) Lenovo MuteSync (HKLM-x32\...\{16D5D9E9-C8DE-4014-A09C-B9B5ABA0F7FA}) (Version: 1.0.10 - Lenovo) Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 8.0.0.0710 - CyberLink Corp.) Lenovo OneKey Recovery (Version: 8.0.0.0710 - CyberLink Corp.) Hidden Lenovo Photos (HKLM-x32\...\Lenovo Photos) (Version: - CEWE COLOR AG u Co. OHG) Lenovo PowerDVD10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.4310.52 - CyberLink Corp.) Lenovo PowerDVD10 (x32 Version: 10.0.4310.52 - CyberLink Corp.) Hidden Lenovo YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 4.1.3127 - CyberLink Corp.) Lenovo YouCam (x32 Version: 4.1.3127 - CyberLink Corp.) Hidden Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation) MarketResearch (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden MediaMonkey 4.1 (HKLM-x32\...\MediaMonkey_is1) (Version: 4.1 - Ventis Media Inc.) Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Mozilla Firefox 35.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 35.0 (x86 en-US)) (Version: 35.0 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla) MP3Resizer 1.9.7 (HKLM-x32\...\MP3Resizer_is1) (Version: - Skyshape Software) Network64 (Version: 140.0.306.000 - Hewlett-Packard) Hidden Nitro Pro 7 (HKLM\...\{8665A8ED-8F56-45AB-91EF-E5A440649208}) (Version: 7.5.0.29 - Nitro PDF Software) Onekey Theater (HKLM-x32\...\{91CC5BAE-A098-40D3-A43B-C0DC7CE263FE}) (Version: 3.0.0.9 - Lenovo) PeaZip 4.8 (HKLM-x32\...\{5A2BC38A-406C-4A5B-BF45-6991F9A05325}_is1) (Version: - Giorgio Tani) PeaZip 5.5.0 (WIN64) (HKLM\...\{5A2BC38A-406C-4A5B-BF45-6991F9A05325}_is1) (Version: - Giorgio Tani) PS_AIO_06_C4700_SW_Min (x32 Version: 140.0.863.000 - Hewlett-Packard) Hidden QuickTransfer (x32 Version: 140.0.98.000 - Hewlett-Packard) Hidden Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.2.612.2012 - Realtek) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6695 - Realtek Semiconductor Corp.) Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.39030 - Realtek Semiconductor Corp.) Scan (x32 Version: 140.0.253.000 - Hewlett-Packard) Hidden Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft) Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 14.0 - HP) SolutionCenter (x32 Version: 140.0.299.000 - Hewlett-Packard) Hidden Stamps.com (HKLM-x32\...\Stamps.com) (Version: - Stamps.com, Inc.) Stamps.com (x32 Version: 9.6.1.2323 - Stamps.com, Inc.) Hidden Status (x32 Version: 140.0.342.000 - Hewlett-Packard) Hidden Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.10.5 - Synaptics Incorporated) System Requirements Lab for Intel (HKLM-x32\...\{C7CA731B-BF9A-46D9-92CF-8A8737AE9240}) (Version: 4.5.13.0 - Husdawg, LLC) TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.32494 - TeamViewer) Toolbox (x32 Version: 140.0.596.000 - Hewlett-Packard) Hidden TrayApp (x32 Version: 140.0.297.000 - Hewlett-Packard) Hidden Trustworthy Toolbar (HKLM-x32\...\Trustworthy Toolbar) (Version: 6.13.3.505 - Trustworthy) UserGuide (HKLM-x32\...\InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}) (Version: 1.0.0.9 - Lenovo) UserGuide (x32 Version: 1.0.0.9 - Lenovo) Hidden Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies) Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.) WebReg (x32 Version: 140.0.297.017 - Hewlett-Packard) Hidden Windows Driver Package - Lenovo (ACPIVPC) System (06/15/2012 8.1.0.1) (HKLM\...\71BC3FD63F450BA0A957AAECBDB4A000C4F2BE42) (Version: 06/15/2012 8.1.0.1 - Lenovo) Windows Driver Package - Lenovo (WUDFRd) LenovoVhid (06/19/2012 10.13.29.733) (HKLM\...\8A223E56FB1ED4F697B54E5BF96F1EB63B512684) (Version: 06/19/2012 10.13.29.733 - Lenovo) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) CustomCLSID: HKU\S-1-5-21-1768883850-4105323506-3219541303-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Rich\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-1768883850-4105323506-3219541303-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation) CustomCLSID: HKU\S-1-5-21-1768883850-4105323506-3219541303-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rich\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-1768883850-4105323506-3219541303-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rich\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-1768883850-4105323506-3219541303-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rich\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.) CustomCLSID: HKU\S-1-5-21-1768883850-4105323506-3219541303-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rich\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.) ==================== Restore Points ========================= 08-01-2015 11:21:40 Windows Update 12-01-2015 09:08:34 Windows Update 13-01-2015 09:25:27 Installed HP Support Solutions Framework 19-01-2015 09:27:48 Windows Update 22-01-2015 09:52:42 Windows Update ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2013-08-22 08:25 - 2013-08-22 08:25 - 00000824 ____N C:\WINDOWS\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {0CE5432C-1600-4080-B18C-F639FADEEE10} - \BackgroundContainer Startup Task No Task File <==== ATTENTION Task: {194CD3B0-C82A-487D-9AB8-D4BED1407A3E} - System32\Tasks\HPCustParticipation HP Photosmart 5520 series => C:\Program Files\HP\HP Photosmart 5520 series\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.) Task: {4A5035DC-FE74-4A25-AE5D-2DC7BEB77825} - System32\Tasks\Microsoft\Windows\MobilePC\DisplayLink TMM Control Task: {6117811A-A23D-46D7-BE46-65FE56484347} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-07] (Google Inc.) Task: {66793CD2-3EA9-40C9-835F-FEEB0B220E90} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc Task: {74CE45AD-896C-43BF-A7F2-1F5D268CAC39} - System32\Tasks\MirageAgent => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [2012-07-27] (CyberLink) Task: {76A7CEE2-1359-4516-993B-1A789D5B6675} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-07] (Google Inc.) Task: {7FE87057-4CCC-494B-AE7C-4801FD890A38} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-01-19] (Microsoft Corporation) Task: {D6D398A9-4215-4193-9DA1-E973BDFDBACA} - System32\Tasks\Synaptics TouchPad Enhancements => \Program Files\Synaptics\SynTP\SynTPEnh.exe [2012-08-16] (Synaptics Incorporated) Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe ==================== Loaded Modules (whitelisted) ============= 2012-08-17 12:23 - 2012-08-17 12:23 - 00044408 _____ () C:\Program Files\Lenovo\Bluetooth Software\BtwLeAPI.dll 2014-05-14 11:45 - 2014-05-14 11:45 - 00090624 _____ () C:\Program Files (x86)\PasswordBox\libwebsocketswin32.dll 2014-11-04 15:32 - 2013-05-19 22:01 - 00627672 _____ () C:\Program Files (x86)\Cyberlink\Power2Go9\CLMediaLibrary.dll 2013-05-20 11:02 - 2013-05-20 11:02 - 00016856 _____ () C:\Program Files (x86)\CyberLink\Power2Go9\CLMLSvcPS.dll 2012-09-22 02:46 - 2012-06-25 12:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== EXE Association (whitelisted) ============= (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== MSCONFIG/TASK MANAGER disabled items ========= (Currently there is no automatic fix for this section.) HKLM\...\StartupApproved\StartupFolder: => "Bluetooth.lnk" HKLM\...\StartupApproved\StartupFolder: => "HP Digital Imaging Monitor.lnk" HKLM\...\StartupApproved\Run: => "OnekeyStudio" HKLM\...\StartupApproved\Run: => "RtHDVCpl" HKLM\...\StartupApproved\Run32: => "Adobe ARM" HKLM\...\StartupApproved\Run32: => "Dolby Home Theater v4" HKLM\...\StartupApproved\Run32: => "RemoteControl10" HKLM\...\StartupApproved\Run32: => "APSDaemon" HKLM\...\StartupApproved\Run32: => "AVG_UI" HKLM\...\StartupApproved\Run32: => "QuickTime Task" HKU\S-1-5-21-1768883850-4105323506-3219541303-1001\...\StartupApproved\StartupFolder: => "OneNote 2010 Screen Clipper and Launcher.lnk" HKU\S-1-5-21-1768883850-4105323506-3219541303-1001\...\StartupApproved\Run: => "HP Photosmart 5520 series (NET)" HKU\S-1-5-21-1768883850-4105323506-3219541303-1001\...\StartupApproved\Run: => "CX" HKU\S-1-5-21-1768883850-4105323506-3219541303-1001\...\StartupApproved\Run: => "Power2GoExpress9" ========================= Accounts: ========================== Administrator (S-1-5-21-1768883850-4105323506-3219541303-500 - Administrator - Disabled) Guest (S-1-5-21-1768883850-4105323506-3219541303-501 - Limited - Disabled) HomeGroupUser$ (S-1-5-21-1768883850-4105323506-3219541303-1003 - Limited - Enabled) Rich (S-1-5-21-1768883850-4105323506-3219541303-1001 - Administrator - Enabled) => C:\Users\Rich ==================== Faulty Device Manager Devices ============= Name: USB-IF xHCI USB Host Controller Description: USB-IF xHCI USB Host Controller Class Guid: {8a2edc79-c759-46f2-88af-9d4efe3b5eee} Manufacturer: Intel Corporation Service: XHCIPort Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31) Resolution: Update the driver ==================== Event log errors: ========================= Application errors: ================== Error: (01/22/2015 01:57:30 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: Activation context generation failed for "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1". Dependent Assembly Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0" could not be found. Please use sxstrace.exe for detailed diagnosis. Error: (01/22/2015 01:51:13 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: plugin-container.exe, version: 35.0.0.5486, time stamp: 0x54af7153 Faulting module name: mozalloc.dll, version: 35.0.0.5486, time stamp: 0x54af69d4 Exception code: 0x80000003 Fault offset: 0x00001425 Faulting process id: 0xea8 Faulting application start time: 0xplugin-container.exe0 Faulting application path: plugin-container.exe1 Faulting module path: plugin-container.exe2 Report Id: plugin-container.exe3 Faulting package full name: plugin-container.exe4 Faulting package-relative application ID: plugin-container.exe5 Error: (01/22/2015 09:33:08 AM) (Source: SideBySide) (EventID: 33) (User: ) Description: Activation context generation failed for "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1". Dependent Assembly Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0" could not be found. Please use sxstrace.exe for detailed diagnosis. Error: (01/21/2015 09:14:55 AM) (Source: SideBySide) (EventID: 33) (User: ) Description: Activation context generation failed for "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1". Dependent Assembly Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0" could not be found. Please use sxstrace.exe for detailed diagnosis. Error: (01/20/2015 09:05:01 AM) (Source: SideBySide) (EventID: 33) (User: ) Description: Activation context generation failed for "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1". Dependent Assembly Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0" could not be found. Please use sxstrace.exe for detailed diagnosis. Error: (01/19/2015 03:17:23 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: Activation context generation failed for "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1". Dependent Assembly Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0" could not be found. Please use sxstrace.exe for detailed diagnosis. Error: (01/19/2015 03:17:23 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: Activation context generation failed for "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1". Dependent Assembly Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0" could not be found. Please use sxstrace.exe for detailed diagnosis. Error: (01/19/2015 03:16:59 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: Activation context generation failed for "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1". Dependent Assembly Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0" could not be found. Please use sxstrace.exe for detailed diagnosis. Error: (01/19/2015 03:16:59 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: Activation context generation failed for "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1". Dependent Assembly Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0" could not be found. Please use sxstrace.exe for detailed diagnosis. Error: (01/19/2015 03:16:48 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: Activation context generation failed for "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1". Dependent Assembly Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0" could not be found. Please use sxstrace.exe for detailed diagnosis. System errors: ============= Error: (01/22/2015 01:51:12 PM) (Source: Service Control Manager) (EventID: 7030) (User: ) Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly. Error: (01/22/2015 01:51:11 PM) (Source: Service Control Manager) (EventID: 7030) (User: ) Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly. Error: (01/22/2015 01:51:11 PM) (Source: Service Control Manager) (EventID: 7030) (User: ) Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly. Error: (01/22/2015 01:51:11 PM) (Source: Service Control Manager) (EventID: 7030) (User: ) Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly. Error: (01/22/2015 01:51:10 PM) (Source: Service Control Manager) (EventID: 7030) (User: ) Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly. Error: (01/22/2015 00:15:20 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY) Description: Installation Failure: Windows failed to install the following update with error 0x80070490: Hewlett-Packard - Imaging - Null Print - HP Photosmart 5520 series. Error: (01/22/2015 09:54:34 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY) Description: Installation Failure: Windows failed to install the following update with error 0x80070490: Hewlett-Packard - Imaging - Null Print - HP Photosmart 5520 series. Error: (01/21/2015 04:09:41 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY) Description: Installation Failure: Windows failed to install the following update with error 0x80070490: Hewlett-Packard - Imaging - Null Print - HP Photosmart 5520 series. Error: (01/21/2015 03:42:23 PM) (Source: DCOM) (EventID: 10010) (User: Rich-Work) Description: {1B1F472E-3221-4826-97DB-2C2324D389AE} Error: (01/21/2015 03:41:53 PM) (Source: DCOM) (EventID: 10010) (User: Rich-Work) Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001} Microsoft Office Sessions: ========================= Error: (01/22/2015 01:57:30 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\WINDOWS\WinSxS\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.762_none_0c178a139ee2a7ed\MFC80U.DLL Error: (01/22/2015 01:51:13 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: plugin-container.exe35.0.0.548654af7153mozalloc.dll35.0.0.548654af69d48000000300001425ea801d036722cdd8de6C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dlla30f52ff-a267-11e4-bece-74e54320168a Error: (01/22/2015 09:33:08 AM) (Source: SideBySide) (EventID: 33) (User: ) Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\WINDOWS\WinSxS\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.762_none_0c178a139ee2a7ed\MFC80U.DLL Error: (01/21/2015 09:14:55 AM) (Source: SideBySide) (EventID: 33) (User: ) Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\WINDOWS\WinSxS\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.762_none_0c178a139ee2a7ed\MFC80U.DLL Error: (01/20/2015 09:05:01 AM) (Source: SideBySide) (EventID: 33) (User: ) Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\WINDOWS\WinSxS\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.762_none_0c178a139ee2a7ed\MFC80U.DLL Error: (01/19/2015 03:17:23 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\WINDOWS\WinSxS\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.762_none_0c178a139ee2a7ed\MFC80.DLL Error: (01/19/2015 03:17:23 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\WINDOWS\WinSxS\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.762_none_0c178a139ee2a7ed\MFC80.DLL Error: (01/19/2015 03:16:59 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\WINDOWS\WinSxS\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.762_none_0c178a139ee2a7ed\MFC80.DLL Error: (01/19/2015 03:16:59 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\WINDOWS\WinSxS\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.762_none_0c178a139ee2a7ed\MFC80.DLL Error: (01/19/2015 03:16:48 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\WINDOWS\WinSxS\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.762_none_0c178a139ee2a7ed\MFC80.DLL CodeIntegrity Errors: =================================== Date: 2014-12-12 11:12:54.192 Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. ==================== Memory info =========================== Processor: Intel(R) Core(TM) i5-3210M CPU @ 2.50GHz Percentage of memory in use: 18% Total physical RAM: 8052.91 MB Available physical RAM: 6573.27 MB Total Pagefile: 9524.91 MB Available Pagefile: 8000.64 MB Total Virtual: 131072 MB Available Virtual: 131071.79 MB ==================== Drives ================================ Drive c: (Windows8_OS) (Fixed) (Total:650.86 GB) (Free:566.85 GB) NTFS ==>[System with boot components (obtained from reading drive)] Drive d: (LENOVO) (Fixed) (Total:25 GB) (Free:22.43 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 698.6 GB) (Disk ID: 2D36BE54) Partition: GPT Partition Type. ==================== End Of Log ============================ [/QUOTE]
Insert quotes…
Verification
Post reply
Top