Help? Anti-Malware and Anti-Rootkit both keep freezing

supez2004 · August 8, 2014

Hi,

My computer has slowed down significantly over the course of the last 1-2 months, for reasons unknown. I thought it might be malware / viruses so I've tried running a few things. However, my Anti-Malware is freezing now (i.e. not completing within 6-8 hours), as is the Anti-Rootkit (this one has been running for 18 hours and is still stuck on the file c:\windows\syswow64\Wbem\WsmAuto.mof). I did get the Anti-Malware to run once using Chameleon, but would appreciate any additional insight.

Here is my FRST.txt and my Addition.txt pasted in below.

I would appreciate any help! Thank you!!

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-08-2014

Ran by USER (administrator) on USER on 08-08-2014 09:01:50

Running from C:\Users\USER\Downloads

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)

Internet Explorer Version 11

Boot Mode: Normal

The only official download link for FRST:

Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/

Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe

(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Ghost\Agent\VProSvc.exe

(Symantec) C:\Program Files (x86)\Norton Ghost\Shared\Drivers\SymSnapServicex64.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(CANON INC.) C:\Program Files\Canon\Canon MF Network Scan Utility\CNMFSUT6.EXE

(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe

(Google Inc.) C:\Users\USER\AppData\Local\Google\Chrome\Application\chrome.exe

(Malwarebytes Corporation) C:\Users\USER\Desktop\mbar\mbar.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

(Google Inc.) C:\Users\USER\AppData\Local\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\System32\msiexec.exe

(Box, Inc.) C:\Program Files\Box\Box Sync\BoxSync.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MFNetworkScanUtility] => C:\Program Files\Canon\Canon MF Network Scan Utility\CNMFSUT6.EXE [508312 2009-12-15] (CANON INC.)

HKLM\...\Run: [boxSync] => C:\Program Files\Box\Box Sync\BoxSync.exe [13242536 2014-04-14] (Box, Inc.)

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-08-07] (AVAST Software)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKLM\...\Policies\Explorer: [NoFolderOptions] 0

HKLM\...\Policies\Explorer: [NoControlPanel] 0

HKU\S-1-5-21-2910704583-641120756-2897071384-1000\...\Policies\Explorer: [NoFolderOptions] 0

HKU\S-1-5-21-2910704583-641120756-2897071384-1000\...\Policies\Explorer: [NoControlPanel] 0

HKU\S-1-5-21-2910704583-641120756-2897071384-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Policies\Explorer: [NoFolderOptions] 0

HKU\S-1-5-21-2910704583-641120756-2897071384-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Policies\Explorer: [NoControlPanel] 0

ShellIconOverlayIdentifiers: 0000BoxSyncFileLocked -> {b973655f-b823-3729-abea-e88cb316ddd4} => C:\Windows\system32\mscoree.dll (Microsoft Corporation)

ShellIconOverlayIdentifiers: 0000BoxSyncNotSynced -> {a316141f-fa66-334c-8d40-a8f4e6d21080} => C:\Windows\system32\mscoree.dll (Microsoft Corporation)

ShellIconOverlayIdentifiers: 0000BoxSyncProblem -> {a74ad9e8-37eb-31db-9026-8eda10d85860} => C:\Windows\system32\mscoree.dll (Microsoft Corporation)

ShellIconOverlayIdentifiers: 0000BoxSyncSynced -> {c3de22fc-b307-320f-ba41-27d95101bbf3} => C:\Windows\system32\mscoree.dll (Microsoft Corporation)

ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)

BootExecute: autocheck autochk * PCloudBroom64.exe \systemroot\system32\BroomData.bit

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daum.net/

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xF59F3A3536BCCB01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

URLSearchHook: HKCU - Default Value = {CFBFAE00-17A6-11D0-99CB-00C04FD64497}

URLSearchHook: HKCU - (No Name) - {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - No File

SearchScopes: HKCU - DefaultScope {04BAA40C-2A4F-4302-82FC-FEAA3CF92E72} URL = https://search.yahoo.com/search?fr=mcafee&type=A010US739&p={SearchTerms}

SearchScopes: HKCU - {04BAA40C-2A4F-4302-82FC-FEAA3CF92E72} URL = https://search.yahoo.com/search?fr=mcafee&type=A010US739&p={SearchTerms}

SearchScopes: HKCU - {3A40E547-20FD-44a2-94D0-1C98342D1507} URL = http://search.daum.net/search?nil_profile=ie&ref_code=ms&q={searchTerms}

SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.co.kr/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7AVSA_enUS472

SearchScopes: HKCU - {6ADB3AEA-737A-475C-82E4-B11DE523E94B} URL = http://search.yahoo.com/search?p={searchterms}&ei=UTF-8&fr=w3i&type=W3i_DS,136,0_0,Search,20120208,6901,0,8,0

SearchScopes: HKCU - {76E9350E-0392-9C19-F83A-99BC015260AF} URL = http://www.bing.com/search?q={searchTerms}&pc=Z039&form=ZGAIDF

SearchScopes: HKCU - {8876EF08-DEEB-487B-84C4-C677C98A2848} URL = http://websearch.ask.com/redirect?client=ie&tb=BCPA&o=16145&src=crm&q={searchTerms}&locale=en_US&apn_ptnrs=QK&apn_dtid=YYYYYYYYUS&apn_uid=B8DE41AE-04EF-48B5-9FF6-8143F866E6BF&apn_sauid=06FC8212-06BC-482A-A543-04DBAB347A57

BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

BHO: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: No Name -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> No File

BHO-x32: No Name -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> No File

BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO-x32: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: No Name -> {BDDB5A00-D1EB-49D5-B197-72A06DF78AA1} -> No File

BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File

Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)

Toolbar: HKLM-x32 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)

Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

DPF: HKLM-x32 {A08D2318-19E6-4332-A741-87FBBD3984CD} http://hpfweb.hpmedcenter.com/portal/mckesson/eig/viewer/mckapprun.cab

DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)

Handler: intu-help-qb5 - {867FCB77-9823-4cd6-8210-D85F968D466F} - No File

Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - No File

Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)

Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)

Handler-x32: intu-help-qb5 - {867FCB77-9823-4cd6-8210-D85F968D466F} - C:\Program Files (x86)\Intuit\QuickBooks 2012\HelpAsyncPluggableProtocol.dll (Intuit, Inc.)

Handler-x32: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)

Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.254

FireFox:

========

FF ProfilePath: C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\ggos53vd.default

FF DefaultSearchEngine: Secure Search

FF SearchEngineOrder.1: Secure Search

FF SelectedSearchEngine: Secure Search

FF Keyword.URL: https://search.yahoo.com/search?fr=mcafee&type=A110US739&p=

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()

FF Plugin-x32: @daum.net/DaumNPPLive -> C:\Users\USER\AppData\Local\Daum\DaumLiveAgent\npDaumNPPLive.dll (Daum Communications)

FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @mcafee.com/McAfeeMssPlugin -> C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll No File

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @daum.net/DaumNPPLive - C:\Users\USER\AppData\Local\Daum\DaumLiveAgent\npDaumNPPLive.dll (Daum Communications)

FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\USER\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\USER\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: daum.net/DaumNPPLive - C:\Users\USER\AppData\Local\Daum\DaumLiveAgent\npDaumNPPLive.dll (Daum Communications)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\McSiteAdvisor.xml

FF HKLM-x32\...\Firefox\Extensions: [fbdownloader@KMcore] -

FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2012-01-12]

FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor

FF Extension: McAfee SiteAdvisor - C:\Program Files (x86)\McAfee\SiteAdvisor [2012-07-16]

Chrome:

=======

CHR HomePage: hxxp://search.babylon.com/home?affID=113959&tt=4512_3

CHR StartupUrls: "hxxp://search.babylon.com/home?affID=113959&tt=4512_3", "hxxp://www.google.com"

CHR Plugin: (Remoting Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Users\USER\AppData\Local\Google\Chrome\Application\36.0.1985.125\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Users\USER\AppData\Local\Google\Chrome\Application\36.0.1985.125\pdf.dll ()

CHR Plugin: (Shockwave Flash) - C:\Users\USER\AppData\Local\Google\Chrome\Application\36.0.1985.125\gcswf32.dll No File

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File

CHR Plugin: (BrowserPlus (from Yahoo!) v2.9.8) - C:\Users\USER\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll No File

CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-30]

CHR Extension: (YouTube) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2011-12-21]

CHR Extension: (Google Search) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2011-12-21]

CHR Extension: (avast! Online Security) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-08-06]

CHR Extension: (Google Wallet) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]

CHR Extension: (Gmail) - C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2011-12-21]

CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-08-05]

CHR StartMenuInternet: Google Chrome - C:\Users\USER\AppData\Local\Google\Chrome\Application\chrome.exe

CHR HKCU\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-08-05] (AVAST Software)

S3 BoxSyncUpdateService; C:\Program Files\Box\Box Sync\SyncUpdaterService.exe [28768 2014-04-14] (Box, Inc.)

S3 DaumStationService; C:\Program Files (x86)\Daum\DaumStation\DaumStationService.exe [121200 2014-02-04] (Daum Communications Corp.)

S3 GenericMount Helper Service; C:\Program Files (x86)\Norton Ghost\Shared\Drivers\GenericMountHelper.exe [1571336 2009-09-21] (Symantec)

S2 KMService; C:\Windows\SysWOW64\srvany.exe [8192 2003-04-18] () [File not signed]

S3 LiveUpdate; C:\Program Files (x86)\Symantec\LiveUpdate\LuComServer_3_2.EXE [2999664 2007-09-12] (Symantec Corporation)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)

R2 McAfee SiteAdvisor Service; c:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe [156904 2014-07-28] (McAfee, Inc.)

R2 NitroReaderDriverReadSpool3; C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe [230416 2013-05-28] (Nitro PDF Software)

R2 Norton Ghost; C:\Program Files (x86)\Norton Ghost\Agent\VProSvc.exe [4584288 2009-10-01] (Symantec Corporation)

S3 QBFCService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe [61440 2011-08-19] (Intuit Inc.) [File not signed]

S3 Symantec SymSnap VSS Provider; C:\Windows\system32\dllhost.exe [9728 2009-07-13] (Microsoft Corporation)

S3 Symantec SymSnap VSS Provider; C:\Windows\SysWOW64\dllhost.exe [7168 2009-07-13] (Microsoft Corporation)

R3 SymSnapService; C:\Program Files (x86)\Norton Ghost\Shared\Drivers\SymSnapServicex64.exe [2963960 2009-09-21] (Symantec)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-08-05] ()

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-08-05] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-08-05] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-08-05] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-08-05] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-08-07] (AVAST Software)

R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-08-05] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-08-05] ()

R3 GenericMount; C:\Windows\System32\DRIVERS\GenericMount.sys [54320 2009-09-21] (Symantec Corporation)

S3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [92888 2014-08-06] (Malwarebytes Corporation)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-08-07] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)

R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()

S3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [47632 2013-04-29] (Panda Security, S.L.)

R0 symsnap; C:\Windows\System32\DRIVERS\symsnap.sys [170032 2009-09-21] (StorageCraft)

S3 VProEventMonitor; C:\Windows\System32\DRIVERS\vproeventmonitor.sys [20528 2009-09-21] (Symantec Corporation)

R3 vrvd5; C:\Windows\System32\DRIVERS\vrvd5.sys [13344 2012-05-16] (Rsupport Corporation)

U2 V2iMount;

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-08 09:01 - 2014-08-08 09:04 - 00021733 _____ () C:\Users\USER\Downloads\FRST.txt

2014-08-08 09:01 - 2014-08-08 09:02 - 00000000 ____D () C:\FRST

2014-08-08 09:00 - 2014-08-08 09:01 - 02094080 _____ (Farbar) C:\Users\USER\Downloads\FRST64.exe

2014-08-07 17:11 - 2014-08-07 17:11 - 00003304 ____N () C:\bootsqm.dat

2014-08-07 16:38 - 2014-08-07 16:38 - 00000000 ____D () C:\Users\USER\AppData\Roaming\PotPlayerMini

2014-08-07 11:58 - 2014-08-07 16:28 - 00000000 ____D () C:\Windows\pss

2014-08-07 09:55 - 2014-08-07 09:55 - 00000000 ____D () C:\Users\USER\AppData\Roaming\AVAST Software

2014-08-06 17:19 - 2014-08-06 17:19 - 00026112 _____ () C:\Users\USER\Downloads\_Thumbs (2).db

2014-08-06 13:22 - 2014-08-07 17:22 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2014-08-06 13:07 - 2014-08-07 17:18 - 00000000 ____D () C:\Users\USER\Desktop\mbar

2014-08-06 12:01 - 2014-08-06 12:03 - 14349744 _____ (Malwarebytes Corp.) C:\Users\USER\Downloads\mbar-1.07.0.1012.exe

2014-08-06 12:00 - 2014-08-06 12:00 - 00030312 _____ () C:\Windows\system32\Drivers\TrueSight.sys

2014-08-06 12:00 - 2014-08-06 12:00 - 00000000 ____D () C:\Windows\ERDNT

2014-08-06 12:00 - 2014-08-06 12:00 - 00000000 ____D () C:\ProgramData\RogueKiller

2014-08-06 11:59 - 2014-08-06 11:59 - 00000924 _____ () C:\Users\USER\Desktop\NTREGOPT.lnk

2014-08-06 11:59 - 2014-08-06 11:59 - 00000905 _____ () C:\Users\USER\Desktop\ERUNT.lnk

2014-08-06 11:59 - 2014-08-06 11:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT

2014-08-06 11:59 - 2014-08-06 11:59 - 00000000 ____D () C:\Program Files (x86)\ERUNT

2014-08-06 11:58 - 2014-08-06 11:59 - 05379160 _____ () C:\Users\USER\Desktop\RogueKillerX64.exe

2014-08-06 11:58 - 2014-08-06 11:59 - 00791393 _____ (Lars Hederer ) C:\Users\USER\Desktop\erunt-setup.exe

2014-08-06 11:54 - 2014-08-07 10:13 - 00002362 _____ () C:\Users\USER\Desktop\Rkill.txt

2014-08-06 11:51 - 2014-08-06 11:51 - 01942776 _____ (Bleeping Computer, LLC) C:\Users\USER\Desktop\rkill.exe

2014-08-06 11:48 - 2014-08-06 11:48 - 00321848 _____ (Malwarebytes Corporation) C:\Users\USER\Desktop\mbam-clean-2.1.1.1001.exe

2014-08-06 09:56 - 2014-08-07 17:17 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-08-06 09:54 - 2014-08-06 17:50 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-08-06 09:54 - 2014-08-06 09:54 - 00001102 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-08-06 09:54 - 2014-08-06 09:54 - 00000112 ___RH () C:\Users\USER\Downloads\Stinger.opt

2014-08-06 09:54 - 2014-08-06 09:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-08-06 09:54 - 2014-08-06 09:54 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-08-06 09:54 - 2014-08-06 09:54 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-08-06 09:54 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-08-06 09:54 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-08-06 09:38 - 2014-08-06 09:44 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\USER\Downloads\mbam-setup-2.0.2.1012.exe

2014-08-06 09:10 - 2014-08-06 09:20 - 00001000 _____ () C:\Users\USER\Downloads\Stinger_06082014_091026.html

2014-08-06 09:10 - 2014-08-06 09:10 - 00000000 ____D () C:\Quarantine

2014-08-06 09:08 - 2014-08-06 09:54 - 00000000 ____D () C:\Program Files (x86)\stinger

2014-08-06 09:08 - 2014-08-06 09:10 - 04639735 _____ (Malwarebytes Corporation ) C:\Users\USER\Downloads\Unconfirmed 477860.crdownload

2014-08-06 09:01 - 2014-08-06 09:03 - 10972008 _____ (McAfee Inc) C:\Users\USER\Downloads\stinger32.exe

2014-08-05 10:43 - 2014-08-05 10:42 - 00092008 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys

2014-08-05 10:43 - 2014-08-05 10:42 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys

2014-08-05 10:42 - 2014-08-05 10:42 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2014-08-05 10:17 - 2014-08-07 09:57 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update

2014-08-05 10:17 - 2014-08-05 10:42 - 00224896 _____ () C:\Windows\system32\Drivers\aswVmm.sys

2014-08-05 10:17 - 2014-08-05 10:42 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys

2014-08-05 10:17 - 2014-08-05 10:42 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys

2014-08-04 09:03 - 2014-08-04 09:03 - 00031938 _____ () C:\Users\USER\Downloads\taxdetails.CSV

2014-07-31 10:45 - 2014-07-31 10:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-07-31 10:45 - 2014-07-11 03:02 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-07-31 10:45 - 2014-07-11 02:56 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-07-31 10:45 - 2014-07-11 02:56 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-07-31 10:45 - 2014-07-11 02:55 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-07-31 10:44 - 2014-07-31 10:45 - 00004162 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log

2014-07-29 03:01 - 2014-07-29 03:04 - 00000000 ____D () C:\8b8cdebc7901521a84d1a625

2014-07-09 00:15 - 2014-06-29 19:09 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-07-09 00:15 - 2014-06-29 19:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-07-09 00:15 - 2014-06-17 19:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe

2014-07-09 00:15 - 2014-06-17 18:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe

2014-07-09 00:15 - 2014-06-17 18:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-07-09 00:15 - 2014-06-06 03:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll

2014-07-09 00:15 - 2014-06-06 02:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

2014-07-09 00:14 - 2014-05-30 01:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2014-07-09 00:14 - 2014-05-30 01:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2014-07-09 00:14 - 2014-05-30 01:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2014-07-09 00:14 - 2014-05-30 01:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll

2014-07-09 00:14 - 2014-05-30 01:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2014-07-09 00:14 - 2014-05-30 01:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2014-07-09 00:14 - 2014-05-30 01:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2014-07-09 00:14 - 2014-05-30 00:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2014-07-09 00:14 - 2014-05-30 00:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2014-07-09 00:14 - 2014-05-30 00:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2014-07-09 00:14 - 2014-05-30 00:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2014-07-09 00:14 - 2014-05-30 00:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2014-07-09 00:14 - 2014-05-30 00:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2014-07-09 00:14 - 2014-05-30 00:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2014-07-09 00:14 - 2014-05-29 23:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys

2014-07-09 00:13 - 2014-06-20 13:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-07-09 00:13 - 2014-06-20 12:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-07-09 00:13 - 2014-06-18 18:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-07-09 00:13 - 2014-06-18 18:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-07-09 00:13 - 2014-06-18 18:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-07-09 00:13 - 2014-06-18 17:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-07-09 00:13 - 2014-06-18 17:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-07-09 00:13 - 2014-06-18 17:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-07-09 00:13 - 2014-06-18 17:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-07-09 00:13 - 2014-06-18 17:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-07-09 00:13 - 2014-06-18 17:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-07-09 00:13 - 2014-06-18 17:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-07-09 00:13 - 2014-06-18 17:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-07-09 00:13 - 2014-06-18 17:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-07-09 00:13 - 2014-06-18 17:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-07-09 00:13 - 2014-06-18 17:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-07-09 00:13 - 2014-06-18 17:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-07-09 00:13 - 2014-06-18 17:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-07-09 00:13 - 2014-06-18 17:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-07-09 00:13 - 2014-06-18 16:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-07-09 00:13 - 2014-06-18 16:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-07-09 00:13 - 2014-06-18 16:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-07-09 00:13 - 2014-06-18 16:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-07-09 00:13 - 2014-06-18 16:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-07-09 00:13 - 2014-06-18 16:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-07-09 00:13 - 2014-06-18 16:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-07-09 00:13 - 2014-06-18 16:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-07-09 00:13 - 2014-06-18 16:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-07-09 00:13 - 2014-06-18 16:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-07-09 00:13 - 2014-06-18 16:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-07-09 00:13 - 2014-06-18 16:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-07-09 00:13 - 2014-06-18 16:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-07-09 00:13 - 2014-06-18 16:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-07-09 00:13 - 2014-06-18 16:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-07-09 00:13 - 2014-06-18 16:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-07-09 00:13 - 2014-06-18 16:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-07-09 00:13 - 2014-06-18 16:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-07-09 00:13 - 2014-06-18 16:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-07-09 00:13 - 2014-06-18 16:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-07-09 00:13 - 2014-06-18 16:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-07-09 00:13 - 2014-06-18 16:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-07-09 00:13 - 2014-06-18 16:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-07-09 00:13 - 2014-06-18 15:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-07-09 00:13 - 2014-06-18 15:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-07-09 00:13 - 2014-06-18 15:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-07-09 00:13 - 2014-06-18 15:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-07-09 00:13 - 2014-06-18 15:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-07-09 00:13 - 2014-06-18 15:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-07-09 00:13 - 2014-06-18 15:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-07-09 00:13 - 2014-06-18 15:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-07-09 00:13 - 2014-06-18 15:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-07-09 00:13 - 2014-06-18 15:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-07-09 00:13 - 2014-06-18 15:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-07-09 00:13 - 2014-06-18 15:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-07-09 00:13 - 2014-06-18 15:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-07-09 00:13 - 2014-06-18 15:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-07-09 00:13 - 2014-06-05 07:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2014-07-09 00:13 - 2014-06-05 07:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2014-07-09 00:13 - 2014-06-05 07:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-08 09:04 - 2014-08-08 09:01 - 00021733 _____ () C:\Users\USER\Downloads\FRST.txt

2014-08-08 09:02 - 2014-08-08 09:01 - 00000000 ____D () C:\FRST

2014-08-08 09:01 - 2014-08-08 09:00 - 02094080 _____ (Farbar) C:\Users\USER\Downloads\FRST64.exe

2014-08-08 09:01 - 2012-04-24 17:33 - 00000000 ____D () C:\Users\USER\AppData\Local\Box Sync

2014-08-08 08:54 - 2012-04-03 17:41 - 00000462 _____ () C:\Windows\Tasks\SpeedyPC Update Version3.job

2014-08-08 08:54 - 2011-01-25 18:44 - 00000904 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2910704583-641120756-2897071384-1000UA.job

2014-08-08 08:38 - 2012-03-29 10:52 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-08-08 08:31 - 2011-11-17 18:12 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-08-08 03:00 - 2011-01-24 18:37 - 01784657 _____ () C:\Windows\WindowsUpdate.log

2014-08-07 19:32 - 2011-11-17 18:12 - 00000890 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-08-07 17:46 - 2009-07-13 21:45 - 00018816 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-08-07 17:46 - 2009-07-13 21:45 - 00018816 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-08-07 17:22 - 2014-08-06 13:22 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2014-08-07 17:18 - 2014-08-06 13:07 - 00000000 ____D () C:\Users\USER\Desktop\mbar

2014-08-07 17:17 - 2014-08-06 09:56 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-08-07 17:13 - 2012-07-20 08:41 - 00000514 _____ () C:\Windows\Tasks\SpeedyPC Update Version3 Startup Task.job

2014-08-07 17:11 - 2014-08-07 17:11 - 00003304 ____N () C:\bootsqm.dat

2014-08-07 17:11 - 2012-01-12 14:51 - 00000000 ____D () C:\Program Files\Google

2014-08-07 17:11 - 2011-11-17 18:12 - 00000000 ____D () C:\Program Files (x86)\Google

2014-08-07 17:11 - 2011-03-08 12:22 - 00419862 _____ () C:\Windows\PFRO.log

2014-08-07 17:11 - 2009-07-13 22:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-08-07 17:11 - 2009-07-13 21:51 - 00042692 _____ () C:\Windows\setupact.log

2014-08-07 16:39 - 2011-01-25 18:44 - 00000000 ____D () C:\Users\USER\AppData\Local\Google

2014-08-07 16:38 - 2014-08-07 16:38 - 00000000 ____D () C:\Users\USER\AppData\Roaming\PotPlayerMini

2014-08-07 16:37 - 2011-01-24 19:42 - 00000000 ____D () C:\Program Files (x86)\GRETECH

2014-08-07 16:28 - 2014-08-07 11:58 - 00000000 ____D () C:\Windows\pss

2014-08-07 15:55 - 2011-01-25 18:44 - 00000852 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2910704583-641120756-2897071384-1000Core.job

2014-08-07 10:15 - 2012-01-12 14:50 - 00427360 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys

2014-08-07 10:13 - 2014-08-06 11:54 - 00002362 _____ () C:\Users\USER\Desktop\Rkill.txt

2014-08-07 09:57 - 2014-08-05 10:17 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update

2014-08-07 09:55 - 2014-08-07 09:55 - 00000000 ____D () C:\Users\USER\AppData\Roaming\AVAST Software

2014-08-07 07:18 - 2011-06-23 10:25 - 00000000 ____D () C:\Users\USER\Documents\Outlook Files

2014-08-06 17:50 - 2014-08-06 09:54 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-08-06 17:19 - 2014-08-06 17:19 - 00026112 _____ () C:\Users\USER\Downloads\_Thumbs (2).db

2014-08-06 12:03 - 2014-08-06 12:01 - 14349744 _____ (Malwarebytes Corp.) C:\Users\USER\Downloads\mbar-1.07.0.1012.exe

2014-08-06 12:00 - 2014-08-06 12:00 - 00030312 _____ () C:\Windows\system32\Drivers\TrueSight.sys

2014-08-06 12:00 - 2014-08-06 12:00 - 00000000 ____D () C:\Windows\ERDNT

2014-08-06 12:00 - 2014-08-06 12:00 - 00000000 ____D () C:\ProgramData\RogueKiller

2014-08-06 11:59 - 2014-08-06 11:59 - 00000924 _____ () C:\Users\USER\Desktop\NTREGOPT.lnk

2014-08-06 11:59 - 2014-08-06 11:59 - 00000905 _____ () C:\Users\USER\Desktop\ERUNT.lnk

2014-08-06 11:59 - 2014-08-06 11:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT

2014-08-06 11:59 - 2014-08-06 11:59 - 00000000 ____D () C:\Program Files (x86)\ERUNT

2014-08-06 11:59 - 2014-08-06 11:58 - 05379160 _____ () C:\Users\USER\Desktop\RogueKillerX64.exe

2014-08-06 11:59 - 2014-08-06 11:58 - 00791393 _____ (Lars Hederer ) C:\Users\USER\Desktop\erunt-setup.exe

2014-08-06 11:51 - 2014-08-06 11:51 - 01942776 _____ (Bleeping Computer, LLC) C:\Users\USER\Desktop\rkill.exe

2014-08-06 11:48 - 2014-08-06 11:48 - 00321848 _____ (Malwarebytes Corporation) C:\Users\USER\Desktop\mbam-clean-2.1.1.1001.exe

2014-08-06 09:54 - 2014-08-06 09:54 - 00001102 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-08-06 09:54 - 2014-08-06 09:54 - 00000112 ___RH () C:\Users\USER\Downloads\Stinger.opt

2014-08-06 09:54 - 2014-08-06 09:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-08-06 09:54 - 2014-08-06 09:54 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-08-06 09:54 - 2014-08-06 09:54 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-08-06 09:54 - 2014-08-06 09:08 - 00000000 ____D () C:\Program Files (x86)\stinger

2014-08-06 09:44 - 2014-08-06 09:38 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\USER\Downloads\mbam-setup-2.0.2.1012.exe

2014-08-06 09:20 - 2014-08-06 09:10 - 00001000 _____ () C:\Users\USER\Downloads\Stinger_06082014_091026.html

2014-08-06 09:10 - 2014-08-06 09:10 - 00000000 ____D () C:\Quarantine

2014-08-06 09:10 - 2014-08-06 09:08 - 04639735 _____ (Malwarebytes Corporation ) C:\Users\USER\Downloads\Unconfirmed 477860.crdownload

2014-08-06 09:03 - 2014-08-06 09:01 - 10972008 _____ (McAfee Inc) C:\Users\USER\Downloads\stinger32.exe

2014-08-05 10:44 - 2012-01-12 14:50 - 00001966 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk

2014-08-05 10:42 - 2014-08-05 10:43 - 00092008 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys

2014-08-05 10:42 - 2014-08-05 10:43 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys

2014-08-05 10:42 - 2014-08-05 10:42 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2014-08-05 10:42 - 2014-08-05 10:17 - 00224896 _____ () C:\Windows\system32\Drivers\aswVmm.sys

2014-08-05 10:42 - 2014-08-05 10:17 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys

2014-08-05 10:42 - 2014-08-05 10:17 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys

2014-08-05 10:42 - 2012-01-12 14:50 - 01041168 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys

2014-08-05 10:42 - 2012-01-12 14:50 - 00307344 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe

2014-08-05 10:42 - 2012-01-12 14:50 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys

2014-08-05 10:20 - 2012-01-12 14:49 - 00000000 ____D () C:\ProgramData\AVAST Software

2014-08-05 10:17 - 2012-01-12 14:50 - 00000000 _____ () C:\Windows\SysWOW64\config.nt

2014-08-05 09:07 - 2012-07-16 11:21 - 00000000 ____D () C:\Program Files (x86)\McAfee

2014-08-04 09:03 - 2014-08-04 09:03 - 00031938 _____ () C:\Users\USER\Downloads\taxdetails.CSV

2014-08-01 08:42 - 2014-05-09 12:31 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-08-01 08:42 - 2012-05-16 11:56 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-07-31 10:45 - 2014-07-31 10:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-07-31 10:45 - 2014-07-31 10:44 - 00004162 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log

2014-07-31 10:45 - 2013-12-03 14:49 - 00000000 ____D () C:\ProgramData\Oracle

2014-07-31 10:45 - 2013-07-08 16:24 - 00000000 ____D () C:\Program Files (x86)\Java

2014-07-29 10:48 - 2013-03-14 03:01 - 00000000 ____D () C:\Program Files\Microsoft Silverlight

2014-07-29 10:48 - 2013-03-14 03:01 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight

2014-07-29 03:04 - 2014-07-29 03:01 - 00000000 ____D () C:\8b8cdebc7901521a84d1a625

2014-07-29 03:03 - 2013-03-14 03:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight

2014-07-28 12:00 - 2011-01-25 18:46 - 00002321 _____ () C:\Users\USER\Desktop\Google Chrome.lnk

2014-07-11 03:02 - 2014-07-31 10:45 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-07-11 02:56 - 2014-07-31 10:45 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-07-11 02:56 - 2014-07-31 10:45 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-07-11 02:55 - 2014-07-31 10:45 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-07-09 04:12 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\rescache

2014-07-09 03:35 - 2009-07-13 21:45 - 00425992 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-07-09 03:32 - 2014-05-06 03:00 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-07-09 03:32 - 2009-07-14 00:45 - 00000000 ____D () C:\Program Files\Windows Journal

2014-07-09 03:32 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism

2014-07-09 03:32 - 2009-07-13 20:20 - 00000000 ____D () C:\Windows\system32\Dism

2014-07-09 03:14 - 2013-08-15 03:01 - 00000000 ____D () C:\Windows\system32\MRT

2014-07-09 03:06 - 2011-01-24 19:00 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-07-09 03:05 - 2011-01-24 19:37 - 00000000 ____D () C:\ProgramData\Microsoft Help

Some content of TEMP:

====================

C:\Users\USER\AppData\Local\Temp\0k23hupe.dll

C:\Users\USER\AppData\Local\Temp\APNSetup.exe

C:\Users\USER\AppData\Local\Temp\bpuninstall.exe

C:\Users\USER\AppData\Local\Temp\DaumStationInstall.exe

C:\Users\USER\AppData\Local\Temp\DaumV3Mater.exe

C:\Users\USER\AppData\Local\Temp\DLiveUpdate.exe

C:\Users\USER\AppData\Local\Temp\install_flashplayer13x32au_ltr5x64d_awc_aih.exe

C:\Users\USER\AppData\Local\Temp\install_flashplayer14x32axau_ltr5x64d_awc_aih.exe

C:\Users\USER\AppData\Local\Temp\jre-7u60-windows-i586-iftw.exe

C:\Users\USER\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe

C:\Users\USER\AppData\Local\Temp\log4net.dll

C:\Users\USER\AppData\Local\Temp\nitro_reader3_64.exe

C:\Users\USER\AppData\Local\Temp\PCloudCleanerUpdater.exe

C:\Users\USER\AppData\Local\Temp\SCC.dll

C:\Users\USER\AppData\Local\Temp\setup.exe

C:\Users\USER\AppData\Local\Temp\som_fs.exe

C:\Users\USER\AppData\Local\Temp\som_mp4_encoder.exe

C:\Users\USER\AppData\Local\Temp\SymCCIS.dll

C:\Users\USER\AppData\Local\Temp\SyncRestarter.exe

C:\Users\USER\AppData\Local\Temp\sync_upgrader.exe

C:\Users\USER\AppData\Local\Temp\Update.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-08-07 00:47

==================== End Of Log ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 08-08-2014

Ran by USER at 2014-08-08 09:31:10

Running from C:\Users\USER\Downloads

Boot Mode: Normal

==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

AC3Filter (remove only) (HKLM-x32\...\AC3Filter) (Version: - )

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.5.1.17730 - Adobe Systems Inc.)

Adobe AIR (x32 Version: 2.5.1.17730 - Adobe Systems Inc.) Hidden

Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)

Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)

Adobe Reader X (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AA0000000001}) (Version: 10.0.0 - Adobe Systems Incorporated)

ALTools Update (HKLM-x32\...\ALUpdate_is1) (Version: v11.4.28.1 - ESTsoft Corp.)

ALZip 8.51 (HKLM-x32\...\ALZip_is1) (Version: v8.51 - ESTsoft Corp.)

avast! Free Antivirus (HKLM-x32\...\avast) (Version: 9.0.2021 - AVAST Software)

AVS Image Converter 1.3.2.141 (HKLM-x32\...\AVS Image Converter_is1) (Version: - Online Media Technologies Ltd.)

AVS Update Manager 1.0 (HKLM-x32\...\AVS Update Manager_is1) (Version: - Online Media Technologies Ltd.)

AVS4YOU Software Navigator 1.4 (HKLM-x32\...\AVS4YOU Software Navigator_is1) (Version: - Online Media Technologies Ltd.)

Box Sync (HKLM\...\{04A4BB98-FA52-493B-AE6D-B8F5C94FF74C}) (Version: 4.0.4758.0 - Box, Inc.)

Canon MF Toolbox 4.9.1.1.mf13 (HKLM-x32\...\{6767DFEE-8909-453A-B553-C7693912B2EB}) (Version: 4.9.1.1.mf13 - CANON INC.)

Canon MF4700 Series (HKLM\...\{47A8DB42-4E21-4d55-9931-D4F44CC3F03B}) (Version: 4.1.0.0 - CANON INC.)

Daum 라이브 에이전트 (HKLM-x32\...\DaumLiveAgent) (Version: - Daum Communications Corp.)

Daum 팟플레이어 (HKLM-x32\...\PotPlayer) (Version: - Daum Communications Corp.)

Definition Update for Microsoft Office 2010 (KB982726) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{043645C8-48EC-458F-B9BD-9C8F15CEF6F7}) (Version: - Microsoft)

ERUNT 1.1j (HKLM-x32\...\ERUNT_is1) (Version: - Lars Hederer)

Google Chrome (HKCU\...\Google Chrome) (Version: 36.0.1985.125 - Google Inc.)

Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)

Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden

GoToMeeting 5.1.0.880 (HKCU\...\GoToMeeting) (Version: 5.1.0.880 - CitrixOnline)

Haansoft Hangul 2007 (HKLM-x32\...\{B2423C36-006E-4270-AEBC-CFC4CAF2C310}) (Version: 7.0.0.121 - Haansoft)

Java 7 Update 65 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.650 - Oracle)

Java Auto Updater (x32 Version: 2.1.65.20 - Oracle, Inc.) Hidden

LiveUpdate 3.2 (Symantec Corporation) (HKLM-x32\...\LiveUpdate) (Version: 3.2.0.68 - Symantec Corporation)

Malwarebytes Anti-Malware version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)

McAfee SiteAdvisor (HKLM-x32\...\{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}) (Version: 3.7.125 - McAfee, Inc.)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft Office Access MUI (English) 2010 (Version: 14.0.4734.1000 - Microsoft Corporation) Hidden

Microsoft Office Access Setup Metadata MUI (English) 2010 (Version: 14.0.4734.1000 - Microsoft Corporation) Hidden

Microsoft Office Excel MUI (English) 2010 (Version: 14.0.4734.1000 - Microsoft Corporation) Hidden

Microsoft Office Groove MUI (English) 2010 (Version: 14.0.4734.1000 - Microsoft Corporation) Hidden

Microsoft Office InfoPath MUI (English) 2010 (Version: 14.0.4734.1000 - Microsoft Corporation) Hidden

Microsoft Office Office 32-bit Components 2010 (Version: 14.0.4734.1000 - Microsoft Corporation) Hidden

Microsoft Office OneNote MUI (English) 2010 (Version: 14.0.4734.1000 - Microsoft Corporation) Hidden

Microsoft Office Outlook MUI (English) 2010 (Version: 14.0.4734.1000 - Microsoft Corporation) Hidden

Microsoft Office PowerPoint MUI (English) 2010 (Version: 14.0.4734.1000 - Microsoft Corporation) Hidden

Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.4734.1000 - Microsoft Corporation)

Microsoft Office Professional Plus 2010 (Version: 14.0.4734.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (English) 2010 (Version: 14.0.4734.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (French) 2010 (Version: 14.0.4734.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (Spanish) 2010 (Version: 14.0.4734.1000 - Microsoft Corporation) Hidden

Microsoft Office Proofing (English) 2010 (Version: 14.0.4734.1000 - Microsoft Corporation) Hidden

Microsoft Office Publisher MUI (English) 2010 (Version: 14.0.4734.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared 32-bit MUI (English) 2010 (Version: 14.0.4734.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared MUI (English) 2010 (Version: 14.0.4734.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared Setup Metadata MUI (English) 2010 (Version: 14.0.4734.1000 - Microsoft Corporation) Hidden

Microsoft Office Word MUI (English) 2010 (Version: 14.0.4734.1000 - Microsoft Corporation) Hidden

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Mozilla Firefox 31.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 31.0 (x86 en-US)) (Version: 31.0 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

MSXML 4.0 SP2 Parser and SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)

Nitro Reader 3 (HKLM\...\{369FD683-593C-42DE-A463-09F3FACB6C1B}) (Version: 3.5.4.10 - Nitro)

Norton Ghost (HKLM-x32\...\{B0255743-165B-4BD5-8DA8-37DFB9930015}) (Version: 15.0.0.35659 - Symantec Corporation)

Panda Cloud Cleaner (HKLM-x32\...\{92B2B132-C7F0-43DC-921A-4493C04F78A4}_is1) (Version: 1.0.102 - Panda Security)

QuickBooks (x32 Version: 22.0.4001.2206 - Intuit Inc.) Hidden

QuickBooks Premier: Professional Services Edition 2012 (HKLM-x32\...\{25ACE540-BFB7-46E1-BC50-2C5E0AFFF783}) (Version: 22.0.4001.2206 - Intuit Inc.)

Roxio Creator Audio (x32 Version: 3.7.0 - Roxio) Hidden

Roxio Creator Copy (x32 Version: 3.7.0 - Roxio) Hidden

Roxio Creator Data (x32 Version: 3.7.0 - Roxio) Hidden

Roxio Creator DE (HKLM-x32\...\{09760D42-E223-42AD-8C3E-55B47D0DDAC3}) (Version: 10.1 - Roxio)

Roxio Creator DE (x32 Version: 3.7.0 - Roxio) Hidden

Roxio Creator Tools (x32 Version: 3.7.0 - Roxio) Hidden

Update for Microsoft Office 2010 (KB2494150) (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{428CB7A0-1068-4CE1-8835-39C7ECD297ED}) (Version: - Microsoft)

Update for Microsoft Office 2010 (KB2760631) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{B6AD7E27-012A-4B63-82BA-AF62893E5435}) (Version: - Microsoft)

Update for Microsoft Office 2010 (KB2825640) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{43F59F4D-7179-497E-BE99-BC6F7D1DDCBA}) (Version: - Microsoft)

Update for Microsoft Office 2010 (KB2825640) 64-Bit Edition (HKLM\...\{90140000-0044-0409-1000-0000000FF1CE}_Office14.PROPLUS_{43F59F4D-7179-497E-BE99-BC6F7D1DDCBA}) (Version: - Microsoft)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2910704583-641120756-2897071384-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\USER\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File

CustomCLSID: HKU\S-1-5-21-2910704583-641120756-2897071384-1000_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Program Files (x86)\Citrix\GoToMeeting\880\G2MOutlookAddin64.dll (Citrix Online, a division of Citrix Systems, Inc.)

CustomCLSID: HKU\S-1-5-21-2910704583-641120756-2897071384-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\USER\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-2910704583-641120756-2897071384-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\USER\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-2910704583-641120756-2897071384-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\USER\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File

==================== Restore Points =========================

15-07-2014 21:47:19 Windows Backup

28-07-2014 17:32:44 Windows Backup

29-07-2014 10:00:13 Windows Update

31-07-2014 17:43:26 Installed Java 7 Update 65

04-08-2014 15:46:42 Windows Backup

05-08-2014 17:20:49 avast! antivirus system restore point

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 19:34 - 2009-06-10 14:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0776DD6C-0E22-4BF1-81A8-273FBD8145D2} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup

Task: {2BEB27D1-404E-4032-B748-F3CC8565E6A4} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2910704583-641120756-2897071384-1000Core => C:\Users\USER\AppData\Local\Google\Update\GoogleUpdate.exe [2011-01-25] (Google Inc.)

Task: {3474A9F4-9184-46FD-82CD-D9F726A5BD17} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-11-17] (Google Inc.)

Task: {432B30BF-B1D6-4758-B748-69849CDF4CE4} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2910704583-641120756-2897071384-1000UA => C:\Users\USER\AppData\Local\Google\Update\GoogleUpdate.exe [2011-01-25] (Google Inc.)

Task: {58ADC3DF-1ED2-4D06-9EA5-B7CC0ED67805} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-08-05] (AVAST Software)

Task: {7C7554B6-DE22-45C6-AAD3-94E3DFE6099F} - System32\Tasks\SpeedyPC Update Version3 Startup Task => C:\Program Files (x86)\Common Files\SpeedyPC Software\UUS3\SpeedyPC_Update3.exe [2013-06-10] (SpeedyPC Software) <==== ATTENTION

Task: {C5260D40-CDAD-4480-9102-3E56F9539F3D} - System32\Tasks\SpeedyPC Update Version3 => C:\Program Files (x86)\Common Files\SpeedyPC Software\UUS3\SpeedyPC_Update3.exe [2013-06-10] (SpeedyPC Software) <==== ATTENTION

Task: {CE533C57-34F7-4480-840E-DA847E911721} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-11-17] (Google Inc.)

Task: {FF7BF90F-0E63-4F69-B860-66069B4F43D5} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-08] (Adobe Systems Incorporated)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2910704583-641120756-2897071384-1000Core.job => C:\Users\USER\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2910704583-641120756-2897071384-1000UA.job => C:\Users\USER\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\SpeedyPC Update Version3 Startup Task.job => C:\Program Files (x86)\Common Files\SpeedyPC Software\UUS3\SpeedyPC_Update3.exe <==== ATTENTION

Task: C:\Windows\Tasks\SpeedyPC Update Version3.job => C:\Program Files (x86)\Common Files\SpeedyPC Software\UUS3\SpeedyPC_Update3.exe <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2006-12-04 02:26 - 2006-12-04 02:26 - 00022016 _____ () C:\Windows\System32\sugo3l6.dll

2010-01-09 21:17 - 2010-01-09 21:17 - 04254560 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF

2010-01-21 02:40 - 2010-01-21 02:40 - 08794464 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll

2010-01-09 21:17 - 2010-01-09 21:17 - 04254560 _____ () C:\Program Files\Common Files\Microsoft Shared\office14\Cultures\office.odf

2014-08-08 09:01 - 2014-08-08 09:01 - 00003584 _____ () C:\Users\USER\AppData\Local\Temp\_MEI42602\clr.pyd

2014-08-05 10:42 - 2014-08-05 10:42 - 00301152 _____ () C:\Program Files\AVAST Software\Avast\aswProperty.dll

2014-08-07 13:59 - 2014-08-07 13:59 - 02795008 _____ () C:\Program Files\AVAST Software\Avast\defs\14080701\algo.dll

2014-08-08 05:17 - 2014-08-08 05:17 - 02795008 _____ () C:\Program Files\AVAST Software\Avast\defs\14080800\algo.dll

2010-01-09 21:18 - 2010-01-09 21:18 - 04254560 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF

2010-01-21 02:34 - 2010-01-21 02:34 - 08793952 _____ () C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll

2014-08-05 10:42 - 2014-08-05 10:42 - 19329904 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

2014-07-28 12:00 - 2014-07-15 02:24 - 00718664 _____ () C:\Users\USER\AppData\Local\Google\Chrome\Application\36.0.1985.125\libglesv2.dll

2014-07-28 12:00 - 2014-07-15 02:24 - 00126280 _____ () C:\Users\USER\AppData\Local\Google\Chrome\Application\36.0.1985.125\libegl.dll

2014-07-28 12:00 - 2014-07-15 02:24 - 08537928 _____ () C:\Users\USER\AppData\Local\Google\Chrome\Application\36.0.1985.125\pdf.dll

2014-07-28 12:00 - 2014-07-15 02:24 - 00353096 _____ () C:\Users\USER\AppData\Local\Google\Chrome\Application\36.0.1985.125\ppGoogleNaClPluginChrome.dll

2014-07-28 12:00 - 2014-07-15 02:24 - 01732936 _____ () C:\Users\USER\AppData\Local\Google\Chrome\Application\36.0.1985.125\ffmpegsumo.dll

2014-07-28 12:00 - 2014-07-15 02:24 - 14664008 _____ () C:\Users\USER\AppData\Local\Google\Chrome\Application\36.0.1985.125\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\USER\Downloads\noname (1).eml:OECustomProperty

AlternateDataStreams: C:\Users\USER\Downloads\noname (2).eml:OECustomProperty

AlternateDataStreams: C:\Users\USER\Downloads\noname.eml:OECustomProperty

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Intuit Data Protect.lnk => C:\Windows\pss\Intuit Data Protect.lnk.CommonStartup

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk => C:\Windows\pss\QuickBooks Update Agent.lnk.CommonStartup

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickBooks_Standard_21.lnk => C:\Windows\pss\QuickBooks_Standard_21.lnk.CommonStartup

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"

MSCONFIG\startupreg: BCSSync => "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices

MSCONFIG\startupreg: Daum Streaming Service => "C:\Users\USER\AppData\Local\Daum\DaumLiveAgent\DaumSAM.exe"

MSCONFIG\startupreg: DaumCleaner => "C:\Program Files\Daum\Cleaner\DaumCleaner.exe" /T

MSCONFIG\startupreg: DaumStation => C:\Program Files (x86)\Daum\DaumStation\DaumStation.exe

MSCONFIG\startupreg: Google Update => "C:\Users\USER\AppData\Local\Google\Update\GoogleUpdate.exe" /c

MSCONFIG\startupreg: HncUpdate => C:\Program Files (x86)\Common Files\Hnc\HncUtils\HncUpdate.exe /A

MSCONFIG\startupreg: Norton Ghost 15.0 => "C:\Program Files (x86)\Norton Ghost\Agent\VProTray.exe"

MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

MSCONFIG\startupreg: swg => "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:

==================

Error: (08/07/2014 05:16:24 PM) (Source: SharpShell) (EventID: 0) (User: )

Description: SyncedIconOverlay: Cannot create the overlay icon path.

Error: (08/07/2014 05:16:24 PM) (Source: SharpShell) (EventID: 0) (User: )

Description: System.IO.IOException: The process cannot access the file 'C:\Users\USER\AppData\Local\Temp\SyncedIconOverlay.ico' because it is being used by another process.

at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)

at System.IO.File.InternalDelete(String path, Boolean checkHost)

at SharpShell.SharpIconOverlayHandler.SharpIconOverlayHandler.GetIconFilePath()

Error: (08/07/2014 05:16:24 PM) (Source: SharpShell) (EventID: 0) (User: )

Description: SyncedIconOverlay: An exception occured when trying to create the overlay icon.

Error: (08/07/2014 05:16:24 PM) (Source: SharpShell) (EventID: 0) (User: )

Description: ProblemIconOverlay: Cannot create the overlay icon path.

Error: (08/07/2014 05:16:24 PM) (Source: SharpShell) (EventID: 0) (User: )

Description: System.IO.IOException: The process cannot access the file 'C:\Users\USER\AppData\Local\Temp\ProblemIconOverlay.ico' because it is being used by another process.

at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)

at System.IO.File.InternalDelete(String path, Boolean checkHost)

at SharpShell.SharpIconOverlayHandler.SharpIconOverlayHandler.GetIconFilePath()

Error: (08/07/2014 05:16:24 PM) (Source: SharpShell) (EventID: 0) (User: )

Description: ProblemIconOverlay: An exception occured when trying to create the overlay icon.

Error: (08/07/2014 05:16:24 PM) (Source: SharpShell) (EventID: 0) (User: )

Description: NotSyncedIconOverlay: Cannot create the overlay icon path.

Error: (08/07/2014 05:16:24 PM) (Source: SharpShell) (EventID: 0) (User: )

Description: System.IO.IOException: The process cannot access the file 'C:\Users\USER\AppData\Local\Temp\NotSyncedIconOverlay.ico' because it is being used by another process.

at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)

at System.IO.File.InternalDelete(String path, Boolean checkHost)

at SharpShell.SharpIconOverlayHandler.SharpIconOverlayHandler.GetIconFilePath()

Error: (08/07/2014 05:16:24 PM) (Source: SharpShell) (EventID: 0) (User: )

Description: NotSyncedIconOverlay: An exception occured when trying to create the overlay icon.

Error: (08/07/2014 05:16:24 PM) (Source: SharpShell) (EventID: 0) (User: )

Description: LockedIconOverlay: Cannot create the overlay icon path.

System errors:

=============

Error: (08/07/2014 05:19:30 PM) (Source: Service Control Manager) (EventID: 7022) (User: )

Description: The Windows Update service hung on starting.

Error: (08/07/2014 05:17:25 PM) (Source: DCOM) (EventID: 10010) (User: )

Description: {7D1933CB-86F6-4A98-8628-01BE94C9A575}

Error: (08/07/2014 04:25:56 PM) (Source: DCOM) (EventID: 10010) (User: )

Description: {7D1933CB-86F6-4A98-8628-01BE94C9A575}

Error: (08/07/2014 04:23:58 PM) (Source: DCOM) (EventID: 10010) (User: )

Description: {4991D34B-80A1-4291-83B6-3328366B9097}

Error: (08/06/2014 00:00:56 PM) (Source: volsnap) (EventID: 16) (User: )

Description: The shadow copies of volume E: were aborted because volume E:, which contains shadow copy storage for this shadow copy, was force dismounted.

Error: (08/06/2014 11:54:18 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The KMService service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

Error: (08/06/2014 09:11:19 AM) (Source: DCOM) (EventID: 10010) (User: )

Description: {7D1933CB-86F6-4A98-8628-01BE94C9A575}

Error: (08/06/2014 09:10:29 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The Norton Ghost service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.

Error: (08/05/2014 02:08:33 PM) (Source: Application Popup) (EventID: 1060) (User: )

Description: \SystemRoot\System32\DRIVERS\PSKMAD.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

Error: (08/05/2014 09:14:53 AM) (Source: Application Popup) (EventID: 1060) (User: )

Description: \SystemRoot\System32\DRIVERS\PSKMAD.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

Microsoft Office Sessions:

=========================