black screen with cursor afer malwarebytes restart

tasnan49 · October 29, 2014

been reading posts here, note the answers are individually given so thought I had best start a new post.

Windows 7 desktop. Malwarebytes Pro quarantined some files, I agreed to actions. files deleted and told needed to restart. Clicked on agreement. Came back on, windows start logo then black screen with moving cursor.

Have tried the following:

System repair - after it said was successful rebooted to black screen
Tried safe mode - runs files then black sceen
Ditto safe mode with networking
Windows installation disk repair - by which time I realised monitor not the problem, must be virus
I have downloaded frst and have frst.txt log and have attached itFRST.txt

Please can someone help me - I do admin for volunteer group and need to be able to use pc

thanks in advance!

LiquidTension · October 29, 2014

Hello tasnan49, welcome to Malwarebytes' Malware Removal forum!

My username is LiquidTension, but you can call me Adam. I will be assisting you with your malware-related problems.
If you would allow me to call you by your first name I would prefer that. xsmile.png.pagespeed.ic.CwSpBGGvqN.png

General P2P/Piracy Notice:

If you are using Peer to Peer (P2P) filesharing software such as uTorrent, BitTorrent or similar you must either fully uninstall or completely disable the programme(s) from running whilst receiving assistance at this forum.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
If you have illegal/cracked/keygen or similar software on the computer, please remove/uninstall the software now and read the policy on Piracy. Failure to do so will also result in your topic being closed.

======================================================

Please read through the points below to ensure this process moves as quickly and efficiently as possible.

Please read through my instructions thoroughly, and ensure you carry out each step in the order specified.
Please do not post logs using the CODE, QUOTE or ATTACHMENT format. Logs should be posted directly in plain text. If you receive an error whilst posting, please break the log in half and use multiple posts.
Please do not run any tools or take any steps other than those I provide for you. Independent efforts may make matters worse, and will affect my ability in ascertaining the current situation and providing the best set of instructions for you.
Please backup important file before proceeding with my instructions. Malware removal can be unpredictable.
If you come across any issues whilst following my instructions, please stop and inform me of the issue in as much detail as possible. Please do not hesitate to ask before proceeding.
Topics are locked if no response is made after 4 days. Please inform me if you will require additional time to complete my instructions.
Ensure you are following this topic. Click at the top of the page.

======================================================

Enter the Recovery Environment as you did before, and run FRST.

Farbar Recovery Scan Tool (FRST) Search

Type the following text into the Search: textbox:
```
rpcss.dll
```
Click on the Search File(s) button.
Upon completion, a log (Search.txt) will be saved to your USB drive.
Copy the contents of the log and paste in your next reply.

tasnan49 · October 29, 2014

Hi Adam, I'm Judy and am in Tasmania Australia. Thanks for helping. Have run FRST per instructions and search.txt is below:

Farbar Recovery Scan Tool (x86) Version: 27-10-2014 01

Ran by SYSTEM at 2014-10-29 22:13:44

Running from E:\

Boot Mode: Recovery

================== Search: "rpcss.dll" ===================

C:\Windows\winsxs\x86_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7601.17514_none_6bd245e79c221747\rpcss.dll

[2012-04-21 19:07][2010-11-20 04:21] 0376832 ____A (Microsoft Corporation) 7660F01D3B38ACA1747E397D21D790AF

C:\Windows\winsxs\x86_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7600.16385_none_69a1321f9f3393ad\rpcss.dll

[2009-07-13 15:45][2009-07-13 17:16] 0376320 ____A (Microsoft Corporation) B82CD39E336973359D7C9BF911E8E84F

C:\Windows\erdnt\cache\rpcss.dll

[2014-01-22 04:15][2010-11-20 04:21] 0376832 ____A (Microsoft Corporation) 7660F01D3B38ACA1747E397D21D790AF

X:\Windows\winsxs\x86_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7600.16385_none_69a1321f9f3393ad\rpcss.dll

[2009-07-13 15:45][2009-07-13 17:16] 0376320 ____A (Microsoft Corporation) B82CD39E336973359D7C9BF911E8E84F

X:\Windows\System32\rpcss.dll

[2009-07-13 15:45][2009-07-13 17:16] 0376320 ____A (Microsoft Corporation) B82CD39E336973359D7C9BF911E8E84F

X:\Windows\winsxs\x86_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7600.16385_none_69a1321f9f3393ad\rpcss.dll

[2009-07-13 15:45][2009-07-13 17:16] 0376320 ____A (Microsoft Corporation) B82CD39E336973359D7C9BF911E8E84F

X:\Windows\System32\rpcss.dll

[2009-07-13 15:45][2009-07-13 17:16] 0376320 ____A (Microsoft Corporation) B82CD39E336973359D7C9BF911E8E84F

=== End Of Search ===

LiquidTension · October 29, 2014

Please do the following, Judy.

FRST Recovery Environment Script

Using your clean PC, press the Windows Key + r on your keyboard at the same time. Type Notepad and click OK.

Copy the entire contents of the codebox below and paste into the Notepad document.

startHKLM\...\RunOnce: [*Restore] => C:\Windows\system32\rstrui.exe [262656 2010-11-20] (Microsoft Corporation)HKU\removevirus\...\Run: [mskhet] => "C:\Windows\System32\rundll32.exe" "C:\Users\JUDY\AppData\Roaming\mskhet.dll",set_tRNS <===== ATTENTIONC:\Users\JUDY\AppData\Roaming\mskhet.dllC:\Users\JUDY\AppData\Local\Temp\ytaiesmt.exeReplace: C:\Windows\erdnt\cache\rpcss.dll C:\Windows\System32\rpcss.dllend

Click File, Save As and type fixlist.txt as the File Name.
Save the file to your USB drive.

NOTICE: This script is intended for use on this particular machine. Do not use this script on any other machine; doing so may cause damage to your Operating System.

Enter the Recovery Environment just as you did before.
Run FRST just as you did before.
Click the Fix button once.
A log (Fixlog.txt) will be created on your USB drive.
Boot into Windows.
Copy the contents of Fixlog.txt and paste in your next reply.

tasnan49 · October 30, 2014

did what you said, booted into Windows, took a long time to load, even after login, now I'm in, says Malwarebytes realtime protection is disabled clicking Fix Now does not work, not game to scan now or reboot as that is what happened before

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 27-10-2014 01

Ran by SYSTEM at 2014-10-30 00:11:38 Run:1

Running from e:\

Boot Mode: Recovery

==============================================

Content of fixlist:

*****************

start

HKLM\...\RunOnce: [*Restore] => C:\Windows\system32\rstrui.exe [262656 2010-11-20] (Microsoft Corporation)

HKU\removevirus\...\Run: [mskhet] => "C:\Windows\System32\rundll32.exe" "C:\Users\JUDY\AppData\Roaming\mskhet.dll",set_tRNS <===== ATTENTION

C:\Users\JUDY\AppData\Roaming\mskhet.dll

C:\Users\JUDY\AppData\Local\Temp\ytaiesmt.exe

Replace: C:\Windows\erdnt\cache\rpcss.dll C:\Windows\System32\rpcss.dll

end

*****************

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\\HKLM\...\RunOnce: [*Restore] => C:\Windows\system32\rstrui.exe [262656 2010-11-20] (Microsoft Corporation) => Value not found.

HKU\removevirus\Software\Microsoft\Windows\CurrentVersion\Run\\mskhet => value deleted successfully.

"C:\Users\JUDY\AppData\Roaming\mskhet.dll" => File/Directory not found.

C:\Users\JUDY\AppData\Local\Temp\ytaiesmt.exe => Moved successfully.

Could not find C:\Windows\System32\rpcss.dll

C:\Windows\erdnt\cache\rpcss.dll copied successfully to C:\Windows\System32\rpcss.dll

==== End of Fixlog ====

LiquidTension · October 30, 2014

Good progress, Judy.

Please proceed with the following.

STEP 1
Farbar Recovery Scan Tool (FRST) Scan

Please download Farbar Recovery Scan Tool (x32) and save the file to your Desktop.
Right-Click FRST.exe and select Run as administrator to run the programme.
Click Yes to the disclaimer.
Ensure the Addition.txt box is checked.
Click the Scan button and let the programme run.
Upon completion, click OK, then OK on the Addition.txt pop up screen.
Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply.

STEP 2
YARWD1t.png.pagespeed.ce.nvhmVeYDe3.png TDSSKiller Scan

Please download TDSSKiller and save the file to your Desktop.
Right-Click TDSSKiller.exe and select Run as administrator to run the programme.
Click Change parameters. Place a checkmark next to Detect TDLFS file system and Verify file digital signatures.
Click Start Scan. Do not use the computer during the scan.
If objects are found, change the action to skip.
Click Continue and close the window.
A log will be created and saved to the root directory (usually C:\). Attach the file in your next reply.

======================================================

STEP 3
Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

FRST.txt
Addition.txt
TDSSKiller log (attached)

tasnan49 · October 30, 2014

ok here we are

LastRegBack: 2014-10-26 00:12

==================== End Of Log ============================

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 30-10-2014

Ran by JUDY at 2014-10-30 01:34:41

Running from C:\Users\JUDY\Desktop

Boot Mode: Normal

==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: System Shield (Enabled - Up to date) {3030810C-E2AC-B12D-8BB1-B1B8C0193798}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: System Shield (Enabled - Up to date) {8B5160E8-C496-BEA3-B101-8ACABB9E7D25}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (HKLM\...\7-Zip) (Version: - )

Acrobat.com (HKLM\...\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.2.443 - Adobe Systems Incorporated)

Acrobat.com (Version: 0.0.0 - Adobe Systems Incorporated) Hidden

Adobe Acrobat 9.5.5 - CPSID_83708 (HKLM\...\{AC76BA86-1033-F400-7760-000000000004}_955) (Version: - Adobe Systems Incorporated)

Adobe AIR (HKLM\...\Adobe AIR) (Version: 3.8.0.1430 - Adobe Systems Incorporated)

Adobe Creative Suite 4 Master Collection (HKLM\...\Adobe_7e74552a59eaf9fafd13f90894ac9bd) (Version: 4.0 - Adobe Systems Incorporated)

Adobe Flash Player 14 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 14.0.0.125 - Adobe Systems Incorporated)

Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)

Adobe Media Player (HKLM\...\com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.1 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.09) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)

Amazon Kindle (HKLM\...\Amazon Kindle) (Version: - Amazon)

Apple Application Support (HKLM\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{941B4CE7-3F5D-443E-A8B7-56A420D2EAFD}) (Version: 7.1.2.6 - Apple Inc.)

Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

AUSkey software 1.4.4 (HKLM\...\{24D37B30-83B4-46A7-A691-30F2FCEAE58E}) (Version: 1.4.4 - ABR)

AviSynth 2.5 (HKLM\...\AviSynth) (Version: - )

AVSDK5 (Version: 5.4.11 - CYREN Inc.) Hidden

Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)

CameraHelperMsi (Version: 13.31.1038.0 - Logitech) Hidden

Cashbook Complete (HKLM\...\Cashbook Complete) (Version: - )

CCScore (Version: 7.00.0000.0001 - EASTMAN KODAK Company) Hidden

Connect (Version: 1.0.0.1 - Adobe Systems Incorporated) Hidden

D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden

DHTML Editing Component (HKLM\...\{2EA870FA-585F-4187-903D-CB9FFD21E2E0}) (Version: 6.02.0001 - Microsoft Corporation)

Dropbox (HKCU\...\Dropbox) (Version: 2.11.29 - Dropbox, Inc.)

EasyRotator Wizard (HKLM\...\com.dwuser.erwizard.EasyRotatorWizard) (Version: 1.0.124 - Magnetic Marketing Corp)

EasyRotator Wizard (Version: 1.0.124 - Magnetic Marketing Corp) Hidden

eM Client (HKLM\...\{8A33684C-A2EF-4A49-A4A9-BD6EF80EC12A}) (Version: 6.0.21040.0 - eM Client Inc.)

erLT (Version: 1.20.138.34 - Logitech, Inc.) Hidden

ESSBrwr (Version: 7.00.0000.0003 - EASTMAN KODAK Company) Hidden

ESSCDBK (Version: 7.00.0000.0002 - EASTMAN KODAK Company) Hidden

ESScore (Version: 7.00.0000.0008 - EASTMAN KODAK Company) Hidden

ESSgui (Version: 7.00.0000.0002 - EASTMAN KODAK Company) Hidden

ESSini (Version: 7.00.0000.0003 - EASTMAN KODAK Company) Hidden

ESSPCD (Version: 7.00.0000.0002 - EASTMAN KODAK Company) Hidden

ESSPDock (Version: 6.03.0001.0004 - EASTMAN KODAK Company) Hidden

ESSSONIC (Version: 6.4.0000.0001 - EASTMAN KODAK Company) Hidden

ESSTOOLS (Version: 5.00.0000.0004 - EASTMAN KODAK Company) Hidden

essvatgt (Version: 7.00.0000.0002 - EASTMAN KODAK Company) Hidden

e-tax 2013 (HKLM\...\{FFF14233-FE39-4671-A38E-76FD8F24A879}) (Version: 0.7.491 - Australian Taxation Office)

e-tax 2014 (HKLM\...\{42D5C0B2-A309-4F84-9BD7-5DDDFE6C09E1}) (Version: 2.10.788 - Australian Taxation Office)

Fences 2 (HKLM\...\Fences 22.01) (Version: 2.01 - Stardock Corporation)

fflink (Version: 6.02.1001.0001 - EASTMAN KODAK Company) Hidden

FileZilla Client 3.9.0.5 (HKLM\...\FileZilla Client) (Version: 3.9.0.5 - Tim Kosse)

Fotosizer 2.08 (HKLM\...\Fotosizer) (Version: 2.08.0.545 - Fotosizer.com)

GanttProject (HKLM\...\GanttProject) (Version: - )

GIMP 2.6.12-2 (HKLM\...\WinGimp-2.0_is1) (Version: 2.6.12 - The GIMP Team)

Google Chrome (HKCU\...\Google Chrome) (Version: 38.0.2125.111 - Google Inc.)

Google Drive (HKLM\...\{56D4499E-AC3E-4B8D-91C9-C700C148C44B}) (Version: 1.13.5782.599 - Google, Inc.)

Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)

Google Update Helper (Version: 1.3.22.3 - Google Inc.) Hidden

HP FWUpdateEDO2 (HKLM\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)

HP Officejet Pro 8600 Basic Device Software (HKLM\...\{8EAB4100-B343-41AE-A880-418746998209}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)

HP Officejet Pro 8600 Help (HKLM\...\{46235FF7-2CBE-4A84-BEDA-87348D1F7850}) (Version: 28.0.0 - Hewlett Packard)

HP Officejet Pro 8600 Product Improvement Study (HKLM\...\{79ACC31A-87EA-472A-853E-5AC6A97CE569}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)

HP Update (HKLM\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)

I.R.I.S. OCR (HKLM\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)

iCloud (HKLM\...\{00A61104-74B5-4056-AD00-4397EF4FB141}) (Version: 3.1.0.40 - Apple Inc.)

ImgBurn (HKLM\...\ImgBurn) (Version: 2.5.7.0 - LIGHTNING UK!)

Internode Monthly Usage Meter 8.2a (HKLM\...\Internode Monthly Usage Meter_is1) (Version: - )

iolo technologies' System Mechanic Professional (HKLM\...\{BBD3F66B-1180-4785-B679-3F91572CD3B4}_is1) (Version: 14.0.1 - iolo technologies, LLC)

iTunes (HKLM\...\{86D04316-F49A-4AF2-B3F1-A1E943886CE7}) (Version: 11.3.1.2 - Apple Inc.)

Java 7 Update 60 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F03217060FF}) (Version: 7.0.600 - Oracle)

JavaFX 2.1.1 (HKLM\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)

kgcbase (Version: 5.03.0000.0004 - EASTMAN KODAK Company) Hidden

Kobo (HKLM\...\Kobo) (Version: 3.0.4 - Kobo Inc.)

Kodak EasyShare software (HKLM\...\{D32470A1-B10C-4059-BA53-CF0486F68EBC}) (Version: - Eastman Kodak Company)

Korean Fonts Support For Adobe Reader X (HKLM\...\{AC76BA86-7AD7-5670-0000-A00000000003}) (Version: 10.0.0 - Adobe Systems Incorporated)

kuler (Version: 2.0 - Adobe Systems Incorporated) Hidden

Logitech Unifying Software 2.10 (HKLM\...\Logitech Unifying) (Version: 2.10.37 - Logitech)

Logitech Vid HD (HKLM\...\Logitech Vid) (Version: 7.2 (7240) - Logitech Inc..)

Logitech Webcam Software (HKLM\...\{D40EB009-0499-459c-A8AF-C9C110766215}) (Version: 2.0 - Logitech Inc.)

Lyrics Plugin for Windows Media Player (HKLM\...\{43002AE2-4093-49E0-A03D-990EE184C568}) (Version: 0.4 - Lyrics Plugin)

Malwarebytes Anti-Malware version 2.0.3.1025 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)

MariusSoft Bulk Image Resizer (HKLM\...\{DE563E12-A92C-4547-A3E4-D93D744164D7}) (Version: 1.0.0 - MariusSoft LLC)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)

Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office Ultimate 2007 (HKLM\...\ULTIMATER) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Mozilla Firefox 32.0.3 (x86 en-GB) (HKLM\...\Mozilla Firefox 32.0.3 (x86 en-GB)) (Version: 32.0.3 - Mozilla)

Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)

MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden

MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

netbrdg (Version: 7.00.0000.0003 - EASTMAN KODAK Company) Hidden

OfotoXMI (Version: 7.00.0000.0002 - EASTMAN KODAK Company) Hidden

Opera 12.17 (HKLM\...\Opera 12.17.1863) (Version: 12.17.1863 - Opera Software ASA)

OverDrive Media Console (HKLM\...\{D647F06F-2908-487E-9CDA-DE52148CBF49}) (Version: 3.2.10 - OverDrive, Inc.)

PASSAGE 3 (English version) (HKLM\...\P3E) (Version: - )

Password Generator (remove only) (HKCU\...\Password Generator) (Version: - WinCatalog.com)

PDF Settings CS4 (Version: 9.0 - Adobe Systems Incorporated) Hidden

Photoshop Camera Raw (Version: 5.0 - Adobe Systems Incorporated) Hidden

Pixel Bender Toolkit (Version: 1.0 - Adobe Systems Incorporated) Hidden

Project Viewer 2010 SP1 (HKLM\...\{E0993C3B-5CCB-4160-A9CE-86604DAC20BE}) (Version: 17.3.0 - Viewer Central)

PSPad editor (HKLM\...\PSPad editor_is1) (Version: - Jan Fiala)

QuickTime (HKLM\...\{7BE15435-2D3E-4B58-867F-9C75BED0208C}) (Version: 7.71.80.42 - Apple Inc.)

Safari (HKLM\...\{C779648B-410E-4BBA-B75B-5815BCEFE71D}) (Version: 5.34.57.2 - Apple Inc.)

SFR (Version: 7.00.0000.0004 - Eastman Kodak Company) Hidden

SHASTA (Version: 6.04.0000.0001 - EASTMAN KODAK Company) Hidden

skin0001 (Version: 7.00.0000.0002 - EASTMAN KODAK Company) Hidden

SKINXSDK (Version: 7.00.0000.0001 - EASTMAN KODAK Company) Hidden

Snap.Do (HKLM\...\{F33C8209-E8E0-49C8-8D7E-363CD346C801}) (Version: 11.117.1.19710 - ReSoft Ltd.) <==== ATTENTION

staticcr (Version: 7.00.0000.0002 - EASTMAN KODAK Company) Hidden

Suite Shared Configuration CS4 (Version: 1.0 - Adobe Systems Incorporated) Hidden

System Mechanic 14 Professional (Version: 14.0.1 - ) Hidden

TeamViewer 9 (HKLM\...\TeamViewer 9) (Version: 9.0.29947 - TeamViewer)

tooltips (Version: 7.00.0000.0002 - EASTMAN KODAK Company) Hidden

Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)

Update Manager for SweetPacks 1.1 (HKLM\...\{EA8FA6BE-29BE-4AF2-9352-841F83215EB0}) (Version: 1.1.0008 - SweetIM Technologies Ltd.) <==== ATTENTION

Videora iPod Converter 6 (HKLM\...\Videora iPod Converter) (Version: 6 - Red Kawa)

VPRINTOL (Version: 7.00.0000.0001 - EASTMAN KODAK Company) Hidden

WD SmartWare (HKLM\...\{A6813E19-244A-476E-8AE5-A1176739EEE5}) (Version: 1.6.0.25 - Western Digital)

Web Assistant 2.0.0.445 (HKLM\...\{336D0C35-8A85-403a-B9D2-65C292C39087}_is1) (Version: - IB) <==== ATTENTION

Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)

Windows Media Player Firefox Plugin (HKLM\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)

WIRELESS (Version: 7.00.0000.0002 - EASTMAN KODAK Company) Hidden

WOW Slider (HKLM\...\WOW Slider_is1) (Version: - )

XAMPP 1.7.7 (HKLM\...\xampp) (Version: - )

Yahoo! Software Update (HKLM\...\Yahoo! Software Update) (Version: - )

Yahoo!7 Messenger (HKLM\...\Yahoo!7 Messenger) (Version: - Yahoo! Inc.)

YouTube Downloader App 3.00 (HKLM\...\YouTube Downloader App) (Version: 3.00 - Regensoft)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\JUDY\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> C:\Users\JUDY\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\InprocServer32 -> C:\Windows\system32\comctl32.ocx (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{0713E8A8-850A-101B-AFC0-4210102A8DA7}\InprocServer32 -> C:\Windows\system32\comctl32.ocx (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\InprocServer32 -> C:\Windows\system32\comctl32.ocx (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{0713E8D8-850A-101B-AFC0-4210102A8DA7}\InprocServer32 -> C:\Windows\system32\comctl32.ocx (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\JUDY\AppData\Local\Google\Update\1.3.25.5\psuser.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{20C62CA0-15DA-101B-B9A8-444553540000}\InprocServer32 -> C:\Windows\system32\msmapi32.ocx (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{20C62CAB-15DA-101B-B9A8-444553540000}\InprocServer32 -> C:\Windows\system32\msmapi32.ocx (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> C:\Users\JUDY\AppData\Local\Google\Update\1.3.25.5\GoogleUpdateOnDemand.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> C:\Users\JUDY\AppData\Local\Google\Update\1.3.25.5\GoogleUpdateOnDemand.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\InprocServer32 -> C:\Windows\system32\comctl32.ocx (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{373FF7F4-EB8B-11CD-8820-08002B2F4F5A}\InprocServer32 -> C:\Windows\system32\comctl32.ocx (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{42AEDC87-2188-41FD-B9A3-0C966FEABEC1}\InprocServer32 -> C:\Windows\system32\shell32.dll (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{49BBAA3C-C574-419E-8378-783C362E9C15}\InprocServer32 -> C:\Program Files\HP\Common\FWUpdateEDO2.dll (Hewlett-Packard Co.)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> C:\Users\JUDY\AppData\Local\Google\Update\1.3.25.5\GoogleUpdateOnDemand.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\InprocServer32 -> C:\Windows\system32\comctl32.ocx (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\InprocServer32 -> C:\Windows\system32\comctl32.ocx (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{58DA8D93-9D6A-101B-AFC0-4210102A8DA7}\InprocServer32 -> C:\Windows\system32\comctl32.ocx (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{58DA8D96-9D6A-101B-AFC0-4210102A8DA7}\InprocServer32 -> C:\Windows\system32\comctl32.ocx (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{5ACBB955-5C57-11CF-8993-00AA00688B10}\InprocServer32 -> C:\Windows\system32\comctl32.ocx (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{5ACBB956-5C57-11CF-8993-00AA00688B10}\InprocServer32 -> C:\Windows\system32\comctl32.ocx (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{5ACBB957-5C57-11CF-8993-00AA00688B10}\InprocServer32 -> C:\Windows\system32\comctl32.ocx (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{5ACBB958-5C57-11CF-8993-00AA00688B10}\InprocServer32 -> C:\Windows\system32\comctl32.ocx (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}\localserver32 -> C:\Users\JUDY\AppData\Local\Google\Chrome\Application\38.0.2125.111\delegate_execute.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{6027C2D4-FB28-11CD-8820-08002B2F4F5A}\InprocServer32 -> C:\Windows\system32\comctl32.ocx (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\InprocServer32 -> C:\Windows\system32\comctl32.ocx (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{612A8628-0FB3-11CE-8747-524153480004}\InprocServer32 -> C:\Windows\system32\comctl32.ocx (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{62823C20-41A3-11CE-9E8B-0020AF039CA3}\InprocServer32 -> C:\Windows\system32\comctl32.ocx (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\InprocServer32 -> C:\Windows\system32\comctl32.ocx (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{6B7E6393-850A-101B-AFC0-4210102A8DA7}\InprocServer32 -> C:\Windows\system32\comctl32.ocx (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{6B7E63A3-850A-101B-AFC0-4210102A8DA7}\InprocServer32 -> C:\Windows\system32\comctl32.ocx (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{6FBA474B-43AC-11CE-9A0E-00AA0062BB4C}\InprocServer32 -> C:\Windows\system32\sysinfo.ocx (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{7DA06D40-54A0-11CF-A521-0080C77A7786}\InprocServer32 -> C:\Windows\system32\tabctl32.ocx (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{9ED94440-E5E8-101B-B9B5-444553540000}\InprocServer32 -> C:\Windows\system32\comctl32.ocx (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{9ED94444-E5E8-101B-B9B5-444553540000}\InprocServer32 -> C:\Windows\system32\comctl32.ocx (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{B66834C6-2E60-11CE-8748-524153480004}\InprocServer32 -> C:\Windows\system32\comctl32.ocx (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{BB1AE0D0-634E-11CF-8996-00AA00688B10}\InprocServer32 -> C:\Windows\system32\msmapi32.ocx (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{BB1AE0D1-634E-11CF-8996-00AA00688B10}\InprocServer32 -> C:\Windows\system32\msmapi32.ocx (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{BDC217C5-ED16-11CD-956C-0000C04E4C0A}\InprocServer32 -> C:\Windows\system32\tabctl32.ocx (Microsoft Corporation)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> C:\Users\JUDY\AppData\Local\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> C:\Users\JUDY\AppData\Local\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> C:\Users\JUDY\AppData\Local\Google\Update\1.3.25.5\GoogleUpdateOnDemand.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\JUDY\AppData\Local\Google\Update\1.3.25.5\psuser.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JUDY\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JUDY\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JUDY\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JUDY\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JUDY\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JUDY\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JUDY\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-3679276584-3606042885-2229931398-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\JUDY\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

==================== Restore Points =========================

21-10-2014 09:36:54 Windows Update

24-10-2014 18:27:59 Windows Update

25-10-2014 13:00:33 Windows Backup

28-10-2014 19:29:04 Windows Update

29-10-2014 13:20:15 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 21:23 - 2014-01-22 23:08 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1 localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {155723BA-60E2-4354-93AF-84EAC8D3C2D8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs

Task: {21F2886D-9563-41E3-B8C5-95BDB221CDC5} - System32\Tasks\SDMsgUpdate (Local) => C:\Program Files\SmartDraw CI\Messages\SDNotify.exe [2012-08-14] ()

Task: {3674A452-9074-4D18-87C3-FC55398DB483} - System32\Tasks\HP AR Program Upload - 9bcc7fd55bd04f98b9848c21cb4fee10f8d5d3240f3c44208ada20b20a7f0d85 => C:\Program Files\HP\HP Officejet Pro 8600\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)

Task: {386DF063-9C35-431D-8683-E9DAE84E9651} - System32\Tasks\SDMsgUpdate (TE) => C:\Program Files\SmartDraw CI\Messages\SDNotify.exe [2012-08-14] ()

Task: {391BB1EF-867C-4839-9B8C-396910A5E44D} - System32\Tasks\HP AR Program Upload - 6f2b85e691014a32b2dbda37ff2ee6c4a392746e39ef41818d4e9e816a03fa2d => C:\Program Files\HP\HP Officejet Pro 8600\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)

Task: {4340CFFD-14FB-4CE8-B7EC-49515E9964EF} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-26] (Adobe Systems Incorporated)

Task: {46BCAA68-631E-4472-88AA-CD63784E78D4} - \BrowserSafeguard Update Task No Task File <==== ATTENTION

Task: {4BB46668-3F6B-409D-8DB3-94333546E251} - System32\Tasks\Microsoft\Windows\Wired\GatherWiredInfo => C:\Windows\system32\gatherWiredInfo.vbs

Task: {4D72741E-769C-45DB-8604-CB8EBDADAA29} - System32\Tasks\Microsoft\Windows\MobilePC\TMM

Task: {745039D9-7BF1-41E3-97D2-5B60E330E2DB} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe

Task: {75E37D6C-CBC4-493F-B1B7-483D95D6B643} - System32\Tasks\HP AR Program Upload - 6a1b909d73cf47668c635d1b70c737f0df200fce71c9499d8fe5fa4d11bad297 => C:\Program Files\HP\HP Officejet Pro 8600\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)

Task: {7C2A209A-4AFB-4724-B6CD-66C82A14B26D} - System32\Tasks\HPCustParticipation HP Officejet Pro 8600 => C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)

Task: {9A8E8E42-C684-45C0-9DCD-FF01AAC4010E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-04-27] (Google Inc.)

Task: {AAA198E8-4C59-41D6-A68D-0D6BCBB3FEB5} - System32\Tasks\iolo Process Governor => C:\Program Files\iolo\System Mechanic Professional\iologovernor.exe [2014-08-13] (iolo technologies, LLC)

Task: {BF0BDD64-C447-4609-A36B-1B1CA457F183} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3679276584-3606042885-2229931398-1000UA => C:\Users\JUDY\AppData\Local\Google\Update\GoogleUpdate.exe [2012-04-20] (Google Inc.)

Task: {CD262629-5463-42A9-8239-3C2F3552F4DB} - System32\Tasks\HP AR Program Upload - af41b27368bd45959bdc19a601e84794810127de4b2249b3be3a20b59b9b1845 => C:\Program Files\HP\HP Officejet Pro 8600\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)

Task: {D0604AD8-A356-494A-B4B5-97352F740746} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-04-27] (Google Inc.)

Task: {D099DA58-58F1-493F-ACC4-4A3D663E8A8B} - \Windows Update Check - 0x127402C5 No Task File <==== ATTENTION

Task: {D947123D-86E4-49CF-8F49-F98144E956F7} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup

Task: {F0AA8786-B93A-4845-B679-48E9B7228712} - System32\Tasks\eM Client Database Backup => C:\Program Files\eM Client\DbBackup.exe [2014-10-16] ()

Task: {F1A343BC-AB6D-4640-A1C3-BBB4ACE7B2E9} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe

Task: {F56D68F0-0162-4134-B52C-68906D1D09B3} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe

Task: {FC9F2ABD-785C-4736-B580-7F629C05BDAE} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3679276584-3606042885-2229931398-1000Core => C:\Users\JUDY\AppData\Local\Google\Update\GoogleUpdate.exe [2012-04-20] (Google Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3679276584-3606042885-2229931398-1000Core.job => C:\Users\JUDY\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3679276584-3606042885-2229931398-1000UA.job => C:\Users\JUDY\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\SDMsgUpdate (Local).job => C:\PROGRA~1\SMARTD~1\Messages\SDNotify.exe

Task: C:\Windows\Tasks\SDMsgUpdate (TE).job => C:\PROGRA~1\SMARTD~1\Messages\SDNotify.exe

==================== Loaded Modules (whitelisted) =============

2014-02-12 21:58 - 2014-02-12 21:58 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll

2014-02-12 21:58 - 2014-02-12 21:58 - 01044808 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll

2014-09-07 03:44 - 2014-09-07 03:44 - 00035328 _____ () C:\Program Files\FileZilla FTP Client\fzshellext.dll

2014-05-25 03:41 - 2014-05-25 03:41 - 00091648 _____ () C:\Program Files\FileZilla FTP Client\libgcc_s_sjlj-1.dll

2014-05-25 03:41 - 2014-05-25 03:41 - 00892416 _____ () C:\Program Files\FileZilla FTP Client\libstdc++-6.dll

2012-04-21 15:00 - 2009-11-16 21:31 - 00069632 _____ () C:\Program Files\PSPad editor\PSPadShell.dll

2014-10-16 12:03 - 2014-10-16 12:03 - 00021504 _____ () C:\Program Files\eM Client\MailClient.Mapi.dll

2014-10-16 12:03 - 2014-10-16 12:03 - 00145408 _____ () C:\Program Files\eM Client\MailClient.Mail.dll

2012-04-26 12:45 - 2001-07-26 16:17 - 00692224 _____ () C:\Program Files\Internode\libeay32.dll

2012-04-26 12:45 - 2001-07-26 16:18 - 00151552 _____ () C:\Program Files\Internode\ssleay32.dll

2013-12-03 00:29 - 2012-05-25 04:25 - 00921600 _____ () C:\Program Files\Yahoo!\Messenger\yui.dll

2013-12-03 00:28 - 2012-05-25 04:25 - 00078336 _____ () C:\Program Files\Yahoo!\Messenger\pcre.dll

2014-10-30 00:29 - 2014-10-22 15:04 - 01042760 _____ () C:\Users\JUDY\AppData\Local\Google\Chrome\Application\38.0.2125.111\libglesv2.dll

2014-10-30 00:29 - 2014-10-22 15:04 - 00211272 _____ () C:\Users\JUDY\AppData\Local\Google\Chrome\Application\38.0.2125.111\libegl.dll

2014-10-30 00:29 - 2014-10-22 15:04 - 08910664 _____ () C:\Users\JUDY\AppData\Local\Google\Chrome\Application\38.0.2125.111\pdf.dll

2014-10-30 00:29 - 2014-10-22 15:04 - 01681224 _____ () C:\Users\JUDY\AppData\Local\Google\Chrome\Application\38.0.2125.111\ffmpegsumo.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AMP => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AMPSE => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BITS => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EventSystem => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ioloSystemService => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SCT_SKMScan => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vseamps => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vsedsps => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vseqrts => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AMP => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AMPSE => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\BITS => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\EventSystem => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ioloSystemService => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SCT_SKMScan => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vseamps => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vsedsps => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vseqrts => ""="Service"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: vseamps => 2

MSCONFIG\Services: vsedsps => 2

MSCONFIG\startupreg: APSDaemon => "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"

MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"

========================= Accounts: ==========================

Administrator (S-1-5-21-3679276584-3606042885-2229931398-500 - Administrator - Disabled)

Graham (S-1-5-21-3679276584-3606042885-2229931398-1007 - Administrator - Enabled) => C:\Users\Graham

Guest (S-1-5-21-3679276584-3606042885-2229931398-501 - Limited - Enabled)

HomeGroupUser$ (S-1-5-21-3679276584-3606042885-2229931398-1005 - Limited - Enabled)

JUDY (S-1-5-21-3679276584-3606042885-2229931398-1000 - Administrator - Enabled) => C:\Users\JUDY

Public (S-1-5-21-3679276584-3606042885-2229931398-1006 - Limited - Enabled)

removevirus (S-1-5-21-3679276584-3606042885-2229931398-1003 - Administrator - Enabled) => C:\Users\removevirus

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:

==================

Error: (10/30/2014 00:15:11 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/29/2014 00:24:18 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: Activation context generation failed for "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".

Dependent Assembly Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0" could not be found.

Please use sxstrace.exe for detailed diagnosis.

Error: (10/29/2014 00:22:20 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: Activation context generation failed for "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".

Dependent Assembly Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0" could not be found.

Please use sxstrace.exe for detailed diagnosis.

Error: (10/28/2014 07:05:01 PM) (Source: MsiInstaller) (EventID: 11723) (User: JUDY-PC)

Description: Product: Snap.Do -- Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run. Contact your support personnel or package vendor. Action InstallationFailed, entry: InstallationFailed, library: C:\Windows\Installer\MSI57F5.tmp

Error: (10/28/2014 07:05:00 PM) (Source: MsiInstaller) (EventID: 11723) (User: JUDY-PC)

Description: Product: Snap.Do -- Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run. Contact your support personnel or package vendor. Action InstallationComplete, entry: InstallationComplete, library: C:\Windows\Installer\MSI53EF.tmp

Error: (10/28/2014 02:53:16 PM) (Source: SignInAssistant) (EventID: 0) (User: )

Description: StartService failed with hr = 0x80070422

Error: (10/28/2014 02:53:16 PM) (Source: SignInAssistant) (EventID: 0) (User: )

Description: StartService failed with hr = 0x80070422

Error: (10/26/2014 02:58:48 PM) (Source: Chrome) (EventID: 1) (User: JUDY-PC)

Description: Chrome has encountered a fatal error.

ver=38.0.2125.104;lang=;guid=37CEA14469C349329A55BE0554D0AFA8;is_machine=0;oop=1;upload=1;minidump=C:\Users\JUDY\AppData\Local\Google\CrashReports\082d3734-7d83-457e-9dca-cb00ce7db10a.dmp

Error: (10/26/2014 00:40:41 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: Activation context generation failed for "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".

Dependent Assembly Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0" could not be found.

Please use sxstrace.exe for detailed diagnosis.

Error: (10/26/2014 00:37:34 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: Activation context generation failed for "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".

Dependent Assembly Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0" could not be found.

Please use sxstrace.exe for detailed diagnosis.

System errors:

=============

Error: (10/30/2014 01:34:44 AM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The WD Backup service depends on the WD Rules service which failed to start because of the following error:

%%1058

Error: (10/30/2014 01:34:27 AM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The WD Backup service depends on the WD Rules service which failed to start because of the following error:

%%1058

Error: (10/30/2014 01:33:46 AM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The WD Backup service depends on the WD Rules service which failed to start because of the following error:

%%1058

Error: (10/30/2014 01:30:33 AM) (Source: NetBT) (EventID: 4319) (User: )

Description: A duplicate name has been detected on the TCP network. The IP address of

the computer that sent the message is in the data. Use nbtstat -n in a

command window to see which name is in the Conflict state.

Error: (10/30/2014 01:10:00 AM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The WD Backup service depends on the WD Rules service which failed to start because of the following error:

%%1058

Error: (10/30/2014 01:03:35 AM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The WD Backup service depends on the WD Rules service which failed to start because of the following error:

%%1058

Error: (10/30/2014 01:02:21 AM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The WD Backup service depends on the WD Rules service which failed to start because of the following error:

%%1058

Error: (10/30/2014 01:00:40 AM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The WD Backup service depends on the WD Rules service which failed to start because of the following error:

%%1058

Error: (10/30/2014 00:59:57 AM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The WD Backup service depends on the WD Rules service which failed to start because of the following error:

%%1058

Error: (10/30/2014 00:59:54 AM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The WD Backup service depends on the WD Rules service which failed to start because of the following error:

%%1058

Microsoft Office Sessions:

=========================

Error: (02/20/2013 10:50:45 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 58 seconds with 0 seconds of active time. This session ended with a crash.

Error: (02/20/2013 10:32:24 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 884 seconds with 480 seconds of active time. This session ended with a crash.

Error: (09/20/2012 11:39:05 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 2836 seconds with 1380 seconds of active time. This session ended with a crash.

CodeIntegrity Errors:

===================================

Date: 2013-04-11 12:50:08.371

Description: Code Integrity is unable to verify the image integrity of the file \Device\CdRom0\HitmanPro.exe because the set of per-page image hashes could not be found on the system.

Date: 2012-04-20 19:08:27.523

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.

Date: 2012-04-20 19:08:27.507

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.

Date: 2012-04-20 19:08:27.507

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.

Date: 2012-04-20 19:08:27.492

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.

Date: 2012-04-20 19:08:27.492

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.

Date: 2012-04-20 19:04:49.404

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.

Date: 2012-04-20 19:04:49.404

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.

Date: 2012-04-20 19:04:49.388

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.

Date: 2012-04-20 19:04:49.388

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.

==================== Memory info ===========================

Processor: Intel® Core2 Duo CPU E7200 @ 2.53GHz

Percentage of memory in use: 61%

Total physical RAM: 3326.18 MB

Available physical RAM: 1295.14 MB

Total Pagefile: 6650.64 MB

Available Pagefile: 3997.95 MB

Total Virtual: 2047.88 MB

Available Virtual: 1897.73 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:149.01 GB) (Free:63.15 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (MBR Code: Windows XP) (Size: 149 GB) (Disk ID: 166E37A8)

Partition 1: (Active) - (Size=149 GB) - (Type=07 NTFS)

==================== End Of Log ============================

TDSSKiller.3.0.0.41_30.10.2014_01.50.23_log.txt

tasnan49 · October 30, 2014

an update -was able to get Malwarebytes to enable real time protection, all of a sudden the Fix Now button worked. Just not sure if I'm safe to allow pc to reboot

LiquidTension · October 30, 2014

Please rerun FRST. Ensure you place a checkmark next to Addition.txt. Click Scan.

This time, please post FRST.txt and Addition.txt.

Thank you.

tasnan49 · October 31, 2014

thanks Adam. by mistake I attempted to boot to safe mode and run FRST but of course that didn't work and was not what you meant. So computer booted back on, very slow again so that I thought I was back to a black screen again, but eventually it opened though without Windows Explorer working. I have now done what you asked, right clicked FRST and ran as administrator, checked Addition.txt and here are the logs. Many thanks for your help, it is very appreciated.

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 30-10-2014 01

Ran by JUDY (administrator) on JUDY-PC on 31-10-2014 04:09:37

Running from C:\Users\JUDY\Dropbox\Desktop

Loaded Profile: JUDY (Available profiles: JUDY & removevirus & Graham)

Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: English (United States)

Internet Explorer Version 11

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: "https://www.google.com.au/webhp?"

CHR Profile: C:\Users\JUDY\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Drive) - C:\Users\JUDY\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-06-04]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\JUDY\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-04]

CHR Extension: (Web Developer) - C:\Users\JUDY\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfbameneiokkgbdmiekhjnmfkcnldhhm [2012-04-20]

CHR Extension: (ColorZilla) - C:\Users\JUDY\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhlhnicpbhignbdhedgjhgdocnmhomnp [2012-11-17]

CHR Extension: (YouTube) - C:\Users\JUDY\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-04-20]

CHR Extension: (Firebug Lite for Google Chrome™) - C:\Users\JUDY\AppData\Local\Google\Chrome\User Data\Default\Extensions\bmagokdooijbeehmkpknfglimnifench [2012-04-20]

CHR Extension: (QR Code Generator) - C:\Users\JUDY\AppData\Local\Google\Chrome\User Data\Default\Extensions\cicimfkkbejhggfjaabggafffgdnjgjp [2012-08-29]

CHR Extension: (Google Search) - C:\Users\JUDY\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-04-20]

CHR Extension: (20-20 3D Viewer for Virtual Studio) - C:\Users\JUDY\AppData\Local\Google\Chrome\User Data\Default\Extensions\cpbhljkhbideandpbhpinhedfgdhkpdc [2014-01-11]

CHR Extension: (Lorem Ipsum Generator) - C:\Users\JUDY\AppData\Local\Google\Chrome\User Data\Default\Extensions\dmpfoncmmihgkooacnplecaopcefceam [2012-08-29]

CHR Extension: (Google Earth The Instant Way) - C:\Users\JUDY\AppData\Local\Google\Chrome\User Data\Default\Extensions\dpifhlbldgbpgcgpcmiakanpghoddbme [2012-05-12]

CHR Extension: (The QR Code Generator) - C:\Users\JUDY\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcmhlmapohffdglflokbgknlknnmogbb [2012-08-29]

CHR Extension: (Hola Better Internet) - C:\Users\JUDY\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio [2014-09-01]

CHR Extension: (Pin It Button) - C:\Users\JUDY\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpdjojdkbbmdfjfahjcgigfpmkopogic [2014-10-24]

CHR Extension: (New Tab Redirect) - C:\Users\JUDY\AppData\Local\Google\Chrome\User Data\Default\Extensions\icpgjfneehieebagbmdbhnlpiopdcmna [2014-08-14]

CHR Extension: (ManageWP) - C:\Users\JUDY\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfehlfmidmihiohmobbfnbpgkckijbjj [2012-08-06]

CHR Extension: (HTML5 Web Development IDE) - C:\Users\JUDY\AppData\Local\Google\Chrome\User Data\Default\Extensions\kheidghjolippfddjfloeinafjkcgcic [2012-11-17]

CHR Extension: (Google Maps) - C:\Users\JUDY\AppData\Local\Google\Chrome\User Data\Default\Extensions\lneaknkopdijkpnocmklfnjbeapigfbh [2012-05-12]

CHR Extension: (Google Wallet) - C:\Users\JUDY\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-31]

CHR Extension: (SEO for Chrome) - C:\Users\JUDY\AppData\Local\Google\Chrome\User Data\Default\Extensions\oangcciaeihlfmhppegpdceadpfaoclj [2012-04-20]

CHR Extension: (Gmail) - C:\Users\JUDY\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-04-20]

CHR HKCU\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\JUDY\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [2013-06-04]

CHR StartMenuInternet: Google Chrome - C:\Users\JUDY\AppData\Local\Google\Chrome\Application\chrome.exe

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S4 Adobe Version Cue CS4; C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [284016 2008-08-15] (Adobe Systems Incorporated)

R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)

S4 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2012-01-18] (Logitech Inc.)

S4 vToolbarUpdater11.2.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe [935008 2012-07-10] ()

S2 WDBackup; C:\Program Files\Western Digital\WD SmartWare\WDBackupEngine.exe [1150368 2012-04-24] (Western Digital )

S4 WDDriveService; C:\Program Files\Western Digital\WD Drive Manager\WDDriveService.exe [247704 2012-04-11] (Western Digital)

S4 Web Assistant Updater; C:\Program Files\Web Assistant\ExtensionUpdaterService.exe [185856 2012-05-24] () [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 appliand; C:\Windows\System32\DRIVERS\appliand.sys [28256 2011-06-26] (Applian Technologies Inc.)

S3 appliandMP; C:\Windows\System32\DRIVERS\appliand.sys [28256 2011-06-26] (Applian Technologies Inc.)

R3 CompFilter; C:\Windows\System32\DRIVERS\lvbusflt.sys [22176 2012-01-18] (Logitech Inc.)

R1 ElRawDisk; C:\Windows\system32\drivers\ElRawDsk.sys [26248 2013-12-03] (EldoS Corporation)

R2 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [75480 2014-10-01] (Malwarebytes Corporation)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-10-01] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [114904 2014-10-31] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-10-01] (Malwarebytes Corporation)

R1 RawDisk3; C:\Windows\system32\drivers\rawdsk3.sys [28256 2014-08-13] (EldoS Corporation)

R1 SCT_SKMScan; C:\Windows\System32\DRIVERS\sct_skmscan.sys [33096 2012-10-12] (Sophos Limited)

S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [13464 2014-01-15] ()

S0 bdgw; System32\drivers\gjavkl.sys [X]

S3 catchme; \??\C:\Users\JUDY\AppData\Local\Temp\catchme.sys [X]

S1 FileDisk; No ImagePath

S0 kdcmo; System32\drivers\ejrh.sys [X]

S3 massfilter_hs; \??\C:\Windows\system32\drivers\massfilter_hs.sys [X]

S0 tqqe; System32\drivers\hpue.sys [X]

S3 zghsdiag; system32\DRIVERS\zghsdiag.sys [X]

S3 zghsmdm; system32\DRIVERS\zghsmdm.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-30 19:11 - 2010-11-20 23:21 - 00376832 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll

2014-10-30 11:11 - 2014-10-31 04:09 - 00000000 ____D () C:\FRST

2014-10-30 01:46 - 2014-10-30 01:46 - 00000097 _____ () C:\Users\JUDY\Desktop\FRST.txt

2014-10-30 00:55 - 2014-10-30 00:56 - 04184008 _____ (Kaspersky Lab ZAO) C:\Users\JUDY\Desktop\tdsskiller.exe

2014-10-30 00:54 - 2014-10-30 01:46 - 00044517 _____ () C:\Users\JUDY\Desktop\Addition.txt

2014-10-30 00:49 - 2014-10-30 00:49 - 01105408 _____ (Farbar) C:\Users\JUDY\Desktop\FRST.exe

2014-10-29 19:19 - 2014-10-29 19:24 - 00000000 ____D () C:\.Trash-999

2014-10-28 19:02 - 2014-10-28 19:02 - 00000000 ____D () C:\Users\JUDY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Free Mahjong Games

2014-10-28 19:01 - 2014-10-28 19:01 - 00225504 _____ () C:\Users\JUDY\Downloads\FreeMahjongGamesSetup-N8mdJBEcO.exe

2014-10-28 14:53 - 2014-10-28 14:53 - 00000000 ____D () C:\Users\JUDY\AppData\Local\{A323528A-2121-4BB8-B742-20C0B4681180}

2014-10-27 13:05 - 2014-10-27 13:05 - 00056376 _____ () C:\Users\JUDY\.recently-used.xbel

2014-10-26 15:24 - 2014-10-26 15:26 - 25491968 _____ () C:\Users\JUDY\Desktop\Steamfest 2014 - Exhibits & Stall Holders (Mick Smith's conflicted copy 2014-03-05).xls

2014-10-21 15:17 - 2014-10-21 15:17 - 00000000 ____D () C:\Users\JUDY\Documents\Red Kawa

2014-10-21 15:17 - 2014-10-21 15:17 - 00000000 ____D () C:\Users\JUDY\AppData\Roaming\Red Kawa

2014-10-21 13:33 - 2014-10-21 13:33 - 00000000 ____D () C:\Users\JUDY\AppData\Roaming\Regensoft

2014-10-21 13:28 - 2014-10-21 13:28 - 00000000 ____D () C:\Users\JUDY\Documents\Regensoft

2014-10-21 13:28 - 2014-10-21 13:28 - 00000000 ____D () C:\Users\JUDY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AviSynth 2.5

2014-10-21 13:28 - 2014-10-21 13:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Regensoft

2014-10-21 13:28 - 2014-10-21 13:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviSynth 2.5

2014-10-21 13:28 - 2014-10-21 13:28 - 00000000 ____D () C:\Program Files\Regensoft

2014-10-21 13:28 - 2014-10-21 13:28 - 00000000 ____D () C:\Program Files\AviSynth 2.5

2014-10-21 13:27 - 2014-10-21 13:27 - 00002156 _____ () C:\Users\Public\Desktop\Videora iPod Converter.lnk

2014-10-21 13:27 - 2014-10-21 13:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Red Kawa

2014-10-21 13:27 - 2014-10-21 13:27 - 00000000 ____D () C:\Program Files\Red Kawa

2014-10-16 07:50 - 2014-10-16 07:50 - 01054912 _____ (Adobe) C:\Users\JUDY\Desktop\install_flashplayer15x32au_ltr5x32d_awc_aih.exe

2014-10-15 18:27 - 2014-06-27 12:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll

2014-10-15 17:51 - 2014-09-18 12:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll

2014-10-15 17:51 - 2014-06-25 12:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2014-10-15 17:51 - 2014-06-24 13:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll

2014-10-15 17:50 - 2014-09-25 12:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll

2014-10-15 17:50 - 2014-09-05 12:52 - 05703168 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll

2014-10-15 17:50 - 2014-08-01 22:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll

2014-10-15 17:50 - 2014-07-09 12:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL

2014-10-15 17:50 - 2014-07-09 12:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL

2014-10-15 17:50 - 2014-07-09 12:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL

2014-10-15 17:50 - 2014-07-09 12:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL

2014-10-15 17:50 - 2014-07-09 12:29 - 00005632 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL

2014-10-15 17:50 - 2014-07-09 09:30 - 00419992 _____ () C:\Windows\system32\locale.nls

2014-10-15 17:49 - 2014-09-10 08:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2014-10-15 17:35 - 2014-09-29 11:41 - 02379264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-10-15 17:32 - 2014-09-04 16:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll

2014-10-15 17:31 - 2014-07-17 12:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll

2014-10-15 17:31 - 2014-07-17 12:39 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll

2014-10-15 17:31 - 2014-07-17 12:39 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe

2014-10-15 17:31 - 2014-07-17 12:39 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll

2014-10-15 17:31 - 2014-07-17 12:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2014-10-15 17:31 - 2014-07-17 12:03 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys

2014-10-15 17:30 - 2014-07-17 12:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2014-10-15 17:30 - 2014-07-17 12:02 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys

2014-10-15 17:29 - 2014-10-07 13:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-10-15 17:29 - 2014-09-26 09:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-10-15 17:29 - 2014-09-26 09:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-10-15 17:29 - 2014-09-26 09:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-10-15 17:29 - 2014-09-26 09:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-10-15 17:29 - 2014-09-26 09:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-10-15 17:29 - 2014-09-19 12:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-10-15 17:29 - 2014-09-19 12:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-10-15 17:29 - 2014-09-19 12:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-10-15 17:29 - 2014-09-19 12:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-10-15 17:29 - 2014-09-19 12:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-10-15 17:29 - 2014-09-19 12:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-10-15 17:29 - 2014-09-19 12:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-10-15 17:29 - 2014-09-19 11:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-10-15 17:29 - 2014-09-19 11:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-10-15 17:29 - 2014-09-19 11:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-10-15 17:29 - 2014-09-19 11:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-10-15 17:29 - 2014-09-19 11:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-10-15 17:29 - 2014-09-19 11:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-10-15 17:29 - 2014-09-19 11:50 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-10-15 17:29 - 2014-09-19 11:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-10-15 17:29 - 2014-09-19 11:44 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-10-15 17:29 - 2014-09-19 11:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-10-15 17:29 - 2014-09-19 11:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-10-15 17:29 - 2014-09-19 11:20 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-10-15 17:29 - 2014-09-19 11:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-10-15 17:29 - 2014-09-19 11:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-10-15 17:29 - 2014-09-19 10:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-10-15 17:29 - 2014-09-19 10:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-10-15 17:29 - 2014-09-19 10:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-10-15 17:29 - 2014-06-19 09:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll

2014-10-15 17:29 - 2014-06-19 09:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll

2014-10-15 17:29 - 2014-06-19 09:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll

2014-10-15 17:28 - 2014-09-13 12:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll

2014-10-15 17:28 - 2014-08-29 12:44 - 02744320 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll

2014-10-15 17:27 - 2014-07-07 12:40 - 11411456 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll

2014-10-15 17:27 - 2014-07-07 12:40 - 03208704 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll

2014-10-15 17:27 - 2014-07-07 12:40 - 01329664 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll

2014-10-15 17:27 - 2014-07-07 12:40 - 00988160 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll

2014-10-15 17:27 - 2014-07-07 12:40 - 00744960 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll

2014-10-15 17:27 - 2014-07-07 12:40 - 00617984 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll

2014-10-15 17:27 - 2014-07-07 12:40 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll

2014-10-15 17:27 - 2014-07-07 12:40 - 00442880 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll

2014-10-15 17:27 - 2014-07-07 12:40 - 00406016 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll

2014-10-15 17:27 - 2014-07-07 12:40 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll

2014-10-15 17:27 - 2014-07-07 12:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll

2014-10-15 17:27 - 2014-07-07 12:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll

2014-10-15 17:27 - 2014-07-07 12:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll

2014-10-15 17:27 - 2014-07-07 12:39 - 03970488 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe

2014-10-15 17:27 - 2014-07-07 12:39 - 03914680 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2014-10-15 17:27 - 2014-07-07 12:28 - 00593920 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys

2014-10-15 17:27 - 2014-06-28 11:21 - 00521384 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe

2014-10-15 17:27 - 2014-06-28 11:21 - 00455752 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe

2014-10-15 17:27 - 2014-06-28 11:21 - 00409272 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll

2014-10-15 17:26 - 2014-08-19 13:41 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll

2014-10-15 17:26 - 2014-08-19 13:41 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll

2014-10-15 17:26 - 2014-08-19 13:41 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll

2014-10-15 17:26 - 2014-08-19 13:40 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe

2014-10-15 17:26 - 2014-08-19 13:40 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe

2014-10-15 17:26 - 2014-08-19 12:48 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys

2014-10-15 17:26 - 2014-07-07 12:40 - 01174528 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll

2014-10-15 17:26 - 2014-07-07 12:40 - 01005056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll

2014-10-15 17:26 - 2014-07-07 12:40 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll

2014-10-15 17:26 - 2014-07-07 12:40 - 00473600 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll

2014-10-15 17:26 - 2014-07-07 12:40 - 00374784 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll

2014-10-15 17:26 - 2014-07-07 12:40 - 00354816 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll

2014-10-15 17:26 - 2014-07-07 12:40 - 00265216 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll

2014-10-15 17:26 - 2014-07-07 12:40 - 00157184 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll

2014-10-15 17:26 - 2014-07-07 12:40 - 00103424 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll

2014-10-15 17:26 - 2014-07-07 12:40 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll

2014-10-15 17:26 - 2014-07-07 12:40 - 00008192 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll

2014-10-15 17:26 - 2014-07-07 12:40 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx

2014-10-15 17:26 - 2014-07-07 12:40 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll

2014-10-15 17:26 - 2014-07-07 12:39 - 12625408 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL

2014-10-15 17:26 - 2014-07-07 12:39 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe

2014-10-15 17:26 - 2014-07-07 12:39 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe

2014-10-15 17:26 - 2014-07-07 12:39 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe

2014-10-15 17:26 - 2014-07-07 12:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll

2014-10-14 18:30 - 2014-10-14 18:30 - 00474271 _____ () C:\Users\JUDY\Desktop\Dimensions.xlsx

2014-10-13 13:25 - 2014-10-30 00:15 - 00000408 _____ () C:\Windows\system32\iolo.ini

2014-10-13 13:10 - 2014-10-13 13:11 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

2014-10-10 09:02 - 2014-10-10 09:02 - 00007435 _____ () C:\Users\JUDY\Desktop\2014-June.txt.gz

2014-10-09 20:33 - 2014-10-09 20:33 - 00000000 ____D () C:\Users\JUDY\Desktop\2014+TasTourismAwards+Finalist+Logos

2014-10-09 13:35 - 2014-10-09 13:35 - 00000064 _____ () C:\Users\JUDY\Desktop\Steamfest call tracker.laccdb

2014-10-07 14:44 - 2014-10-07 14:44 - 00000000 ____D () C:\Users\JUDY\NZBDriveCache

2014-10-07 14:37 - 2014-10-07 14:37 - 00000000 ____D () C:\Users\JUDY\AppData\Local\ByteFountain

2014-10-07 14:35 - 2014-10-07 15:00 - 00000000 ____D () C:\Program Files\NZBDrive

2014-10-07 14:35 - 2014-01-08 23:34 - 00051712 _____ () C:\Windows\system32\dokanx.dll

2014-10-07 14:27 - 2014-10-07 14:28 - 05194104 _____ (ByteFountain ) C:\Users\JUDY\Desktop\nzbdrive-setup-1.1.1-win.exe

2014-10-06 16:42 - 2014-10-06 16:43 - 00000000 ____D () C:\Users\JUDY\Desktop\TOSHIBA

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-31 04:04 - 2012-06-11 00:49 - 00000000 ____D () C:\Users\JUDY\AppData\Roaming\eM Client

2014-10-31 03:30 - 2014-07-07 23:07 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-10-31 03:28 - 2012-04-20 22:25 - 00000904 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3679276584-3606042885-2229931398-1000UA.job

2014-10-31 03:00 - 2012-04-20 20:36 - 01623055 _____ () C:\Windows\WindowsUpdate.log

2014-10-31 01:39 - 2012-12-20 11:11 - 00000000 ____D () C:\Users\JUDY\Documents\eM Client

2014-10-30 21:07 - 2012-04-20 20:29 - 00010080 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-10-30 21:07 - 2012-04-20 20:29 - 00010080 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-10-30 21:04 - 2012-04-20 20:43 - 00786474 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-10-30 21:01 - 2013-12-08 22:31 - 00000478 _____ () C:\Windows\Tasks\SDMsgUpdate (Local).job

2014-10-30 21:01 - 2013-12-08 22:31 - 00000470 _____ () C:\Windows\Tasks\SDMsgUpdate (TE).job

2014-10-30 21:00 - 2014-09-27 22:25 - 00046738 _____ () C:\Windows\setupact.log

2014-10-30 21:00 - 2014-09-16 13:42 - 00000374 _____ () C:\Windows\system32\Drivers\etc\hosts.ics

2014-10-30 21:00 - 2009-07-14 15:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-10-30 20:59 - 2012-04-20 20:33 - 02521000 _____ () C:\Windows\PFRO.log

2014-10-30 12:34 - 2009-07-14 13:37 - 00000000 ____D () C:\Windows\system32\LogFiles

2014-10-30 12:16 - 2013-07-04 01:39 - 00000000 ____D () C:\Program Files\etax2013

2014-10-30 11:15 - 2012-05-09 17:30 - 00000000 ___RD () C:\Users\JUDY\Dropbox

2014-10-30 09:11 - 2012-04-21 14:19 - 00000000 ____D () C:\Users\JUDY\Documents\WEB DESIGN TOOLS

2014-10-30 07:52 - 2014-07-10 11:11 - 00000000 ____D () C:\Users\Graham

2014-10-30 07:52 - 2013-03-26 21:57 - 00000000 ____D () C:\Users\removevirus

2014-10-30 07:52 - 2012-04-21 15:00 - 00000000 ____D () C:\Program Files\PSPad editor

2014-10-30 07:52 - 2009-07-14 13:37 - 00000000 ____D () C:\Windows\system32\wfp

2014-10-30 07:52 - 2009-07-14 13:37 - 00000000 ____D () C:\Windows\registration

2014-10-30 07:21 - 2013-10-24 09:54 - 00000000 ____D () C:\Users\JUDY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

2014-10-30 07:21 - 2012-05-09 16:35 - 00000000 ____D () C:\Users\JUDY\AppData\Roaming\Dropbox

2014-10-30 05:28 - 2012-04-20 22:25 - 00000852 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3679276584-3606042885-2229931398-1000Core.job

2014-10-30 03:24 - 2012-05-20 01:17 - 00000000 ____D () C:\Users\JUDY\AppData\Local\Western_Digital

2014-10-30 00:15 - 2012-04-20 23:18 - 00000392 _____ () C:\Windows\system32\iolo.ini.txt

2014-10-30 00:14 - 2012-04-20 20:30 - 00000000 ____D () C:\Users\JUDY

2014-10-29 09:32 - 2012-04-21 14:45 - 00000000 ____D () C:\Users\JUDY\AppData\Roaming\FileZilla

2014-10-27 18:39 - 2012-04-21 15:44 - 00000000 ____D () C:\Windows\system32\config\SM Registry Backup

2014-10-27 13:06 - 2014-09-17 18:04 - 00000000 ____D () C:\Users\JUDY\.gimp-2.6

2014-10-26 22:21 - 2012-04-22 19:52 - 00000000 ____D () C:\Users\JUDY\AppData\Roaming\gtk-2.0

2014-10-24 17:19 - 2012-04-21 13:45 - 00000000 ____D () C:\Users\JUDY\Documents\Cashbook Data

2014-10-24 17:19 - 2012-04-21 13:44 - 00000000 ____D () C:\ProgramData\Cashbook Complete

2014-10-23 11:57 - 2014-07-13 19:34 - 00000000 ____D () C:\Users\JUDY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\e-tax 2014

2014-10-23 11:57 - 2014-07-13 19:34 - 00000000 ____D () C:\Program Files\etax2014

2014-10-23 09:03 - 2013-07-08 18:15 - 00016896 ___SH () C:\Users\JUDY\Thumbs.db

2014-10-21 16:07 - 2009-07-14 13:37 - 00000000 ____D () C:\Windows\PLA

2014-10-17 10:04 - 2009-07-14 13:37 - 00000000 ____D () C:\Windows\Microsoft.NET

2014-10-17 09:56 - 2012-06-11 00:48 - 00000924 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eM Client.lnk

2014-10-17 09:56 - 2012-06-11 00:48 - 00000000 ____D () C:\Program Files\eM Client

2014-10-15 20:20 - 2009-07-14 15:46 - 00001515 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk

2014-10-15 20:08 - 2009-07-14 13:37 - 00000000 ____D () C:\Windows\rescache

2014-10-15 19:26 - 2014-07-07 22:55 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware

2014-10-15 19:26 - 2009-07-14 15:33 - 02355440 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-10-15 18:32 - 2012-04-21 21:43 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-10-15 18:23 - 2013-08-15 04:06 - 00000000 ____D () C:\Windows\system32\MRT

2014-10-15 18:08 - 2012-04-22 10:17 - 100290944 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-10-15 14:22 - 2012-09-03 12:47 - 00000000 ____D () C:\Users\JUDY\Documents\My Kindle Content

2014-10-14 08:54 - 2014-07-07 22:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-10-13 13:10 - 2012-04-20 22:22 - 00000000 ____D () C:\Program Files\Common Files\Adobe

2014-10-13 13:10 - 2012-04-20 22:22 - 00000000 ____D () C:\Program Files\Adobe

2014-10-13 09:22 - 2014-09-29 10:51 - 01802240 _____ () C:\Users\JUDY\Documents\RWCSHS.accdb

2014-10-10 18:43 - 2013-02-23 13:54 - 00000000 ___SD () C:\Users\JUDY\Documents\My Data Sources

2014-10-02 15:53 - 2012-04-20 21:13 - 00231568 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2014-10-01 11:11 - 2014-07-07 22:55 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-10-01 11:11 - 2014-07-07 22:55 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-10-01 11:11 - 2014-01-21 09:21 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

Some content of TEMP:

====================

C:\Users\JUDY\AppData\Local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp0rktla.dll

C:\Users\JUDY\AppData\Local\temp\FreeMahjong.exe

C:\Users\JUDY\AppData\Local\temp\setup.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-10-26 00:12

==================== End Of Log ============================

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 30-10-2014 01

Ran by JUDY at 2014-10-31 04:10:36