Unable to download, possible trojan

space6011 · January 22, 2015

I think a computer at my work has been infected for awhile. At one point in the past Norton has found trojans; at this point I don't think either Norton or Malwarebytes can detect anything like that. The computer is unable to download anything off the internet, claiming that a virus scan failed. I tried to download something after disabling Norton so I don't think it's a firewall.

This is the most recent Malwarebytes scan log that I have.

LOG1-21-15.xml

Naathim · January 22, 2015

Hello and welcome!

I'm Radek and I'll try to help you with your issue.

Before we start please note the following:

Analysis and research take some time, also sometimes real life gets in the way, please be patient.
Limit your internet access to posting here, some infections just wait to steal typed-in passwords.
Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
Paste the logs in your posts, attachments make my work harder and more complicated.
Stay with me to the end, the absence of symtoms doesn't mean that your machine is fully operational.
Note that we may live in totally different time zones, what may cause some delays between answers.

I can't foresee everything, so if anything unexpected happens, please stop and inform me!

There are no silly questions. Never be afraid to ask if in doubt!

Rules and policies

We won't support any piracy.

That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!

The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!

Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.

Scan with Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your Desktop.

There will be two versions to download: 32-bit and 64-bit. Please download the one that is designed for your system. If you don't know which one should it be, download both of them and try each other out. Only one will run - this is the right one. Please leave it and delete the other.

Right-click on icon and select Run as Administrator to start the tool.
> XP users click run after receipt of Windows Security Warning - Open File.
> 8 users will be prompted about Windows SmartScreen protection - click More information and Run.
When the tool opens click Yes to disclaimer.
Make sure that Addition option is checked.
Press Scan button and wait.
The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content in your next reply.

space6011 · January 22, 2015

FRST.txt

C:\$Recycle.Bin\S-1-5-18\$8b0c8dbb1b2ac8ed528db6ffb1032caf

Files to move or delete:

====================

C:\Users\kkaiser\jagex_cl_runescape_LIVE.dat

C:\Users\kkaiser\random.dat

Some content of TEMP:

====================

C:\Users\bonnie\AppData\Local\Temp\FFB2.exe

C:\Users\brian\AppData\Local\Temp\FFB2.exe

C:\Users\Default\AppData\Local\Temp\FFB2.exe

C:\Users\Default User\AppData\Local\Temp\FFB2.exe

C:\Users\don\AppData\Local\Temp\FFB2.exe

C:\Users\donnie\AppData\Local\Temp\FFB2.exe

C:\Users\guyjr\AppData\Local\Temp\FFB2.exe

C:\Users\heather\AppData\Local\Temp\FFB2.exe

C:\Users\jpaitsel\AppData\Local\Temp\FFB2.exe

C:\Users\kkaiser\AppData\Local\Temp\FFB2.exe

C:\Users\kkaiser\AppData\Local\Temp\MSIZAP.EXE

C:\Users\lmcnamee\AppData\Local\Temp\airA049.exe

C:\Users\lmcnamee\AppData\Local\Temp\airDBA4.exe

C:\Users\lmcnamee\AppData\Local\Temp\FFB2.exe

C:\Users\lmcnamee\AppData\Local\Temp\spiceworks_redist.exe

C:\Users\Nancy.COVMACH\AppData\Local\Temp\FFB2.exe

C:\Users\QBDataServiceUser22\AppData\Local\Temp\FFB2.exe

C:\Users\root\AppData\Local\Temp\FFB2.exe

C:\Users\root\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe

C:\Users\root\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe

C:\Users\root\AppData\Local\Temp\spiceworks_redist.exe

C:\Users\staff\AppData\Local\Temp\FFB2.exe

C:\Users\temp\AppData\Local\Temp\FFB2.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

ATTENTION: ====> ZeroAccess. Use DeleteJunctionsIndirectory: C:\Program Files\Windows Defender

LastRegBack: 2015-01-14 00:59

==================== End Of Log ============================

Addition.txt

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 19-01-2015

Ran by heather at 2015-01-22 09:36:53

Running from F:\

Boot Mode: Normal

==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Symantec Endpoint Protection (Enabled - Up to date) {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Symantec Endpoint Protection (Enabled - Up to date) {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

32 Bit HP CIO Components Installer (Version: 8.1.1 - Hewlett-Packard) Hidden

Aatrix Forms for Sage Timberline Office (HKLM\...\{21461F67-7C02-407E-9DF2-EF1752F55142}) (Version: 1.00.0000 - Sage)

Adobe Acrobat X Pro - English, Français, Deutsch (HKLM\...\{AC76BA86-1033-F400-7760-000000000005}) (Version: 10.1.2 - Adobe Systems)

Adobe AIR (HKLM\...\Adobe AIR) (Version: 2.0.3.13070 - Adobe Systems Inc.)

Adobe Flash Player 16 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 16.0.0.257 - Adobe Systems Incorporated)

Adobe Flash Player 16 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 16.0.0.257 - Adobe Systems Incorporated)

Adobe Reader 9.3.4 (HKLM\...\{AC76BA86-7AD7-1033-7B44-A93000000001}) (Version: 9.3.4 - Adobe Systems Incorporated)

Adobe Shockwave Player 11.5 (HKLM\...\Adobe Shockwave Player) (Version: 11.5.8.612 - Adobe Systems, Inc.)

Anti-phishing Domain Advisor (HKLM\...\Anti-phishing Domain Advisor) (Version: 1.1.0.1 - Visicom Media Inc. (Powered by Panda Security))

Brother MFL-Pro Suite (HKLM\...\{9211CCBB-BEFE-4A0C-9199-D7A535DBFE5F}) (Version: 1.00.000 - )

Cisco WebEx Meetings (HKLM\...\ActiveTouchMeetingClient) (Version: - Cisco WebEx LLC)

D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden

Dell Driver Download Manager (HKU\S-1-5-21-2480199604-2480216931-428779891-1002\...\f031ef6ac137efc5) (Version: 2.1.0.0 - Dell Inc.)

Dell Driver Download Manager (HKU\S-1-5-21-3918117171-1918430931-2789110331-1134\...\f031ef6ac137efc5) (Version: 2.1.0.0 - Dell Inc.)

Google Chrome (HKLM\...\Google Chrome) (Version: 39.0.2171.99 - Google Inc.)

Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden

HP LaserJet Professional P1100-P1560-P1600 Series (HKLM\...\HP LaserJet Professional P1100-P1560-P1600 Series) (Version: - )

hppLaserJetService (Version: 001.001.0.0 - Hewlett-Packard) Hidden

hppP1100P1560P1600SeriesLaserJetService (Version: 001.001.0.0 - Hewlett-Packard) Hidden

hppusgP1100P1560P1600Series (Version: 1.0.0.1 - Hewlett-Packard) Hidden

Java 6 Update 31 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216031FF}) (Version: 6.0.310 - Oracle)

Kyocera Product Library (HKLM\...\Kyocera Product Library) (Version: 2.0.0713 - Kyocera Mita Corporation)

Kyocera Scanner File Utility (HKLM\...\{61C79AE1-5403-4687-AC68-28BFA5EF3895}) (Version: 3.16.9 - KyoceraMita)

LiveUpdate 3.3 (Symantec Corporation) (HKLM\...\LiveUpdate) (Version: 3.3.0.96 - Symantec Corporation)

LogMeIn (HKLM\...\{F93EE340-3735-4032-8B74-0A3E489017A0}) (Version: 4.1.4670 - LogMeIn, Inc.)

Lorex Auto Port Forwarding (HKLM\...\Lorex Auto Port Forwarding) (Version: 1.2.0 - Lorex Technology Powered By PcWinTech.com)

Lorex Client 10 (HKLM\...\Lorex Client) (Version: 10 - )

Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)

MarketResearch (Version: 130.0.374.000 - Hewlett-Packard) Hidden

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft Office 2007 Primary Interop Assemblies (HKLM\...\{50120000-1105-0000-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)

Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office Outlook Connector (HKLM\...\{95140000-007A-0409-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)

Microsoft Office Professional Plus 2007 (HKLM\...\PROPLUS) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Mozilla Firefox 17.0.1 (x86 en-US) (HKLM\...\Mozilla Firefox 17.0.1 (x86 en-US)) (Version: 17.0.1 - Mozilla)

Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 17.0.1 - Mozilla)

MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

MSXML 4.0 SP2 Parser and SDK (HKLM\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)

MSXML 4.0 SP3 Parser (HKLM\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)

MSXML 4.0 SP3 Parser (KB2721691) (HKLM\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)

MSXML 4.0 SP3 Parser (KB2758694) (HKLM\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)

MSXML 4.0 SP3 Parser (KB973685) (HKLM\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)

Nortel Digital Mobility Controller 1.00 (HKLM\...\Nortel Digital Mobility Controller_is1) (Version: - Nortel)

Office Connector (Remove Only) (HKLM\...\Office Connector) (Version: - )

OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0 - Microsoft Corporation) Hidden

Outlook on the Desktop 2.0.2 (HKLM\...\{6D9785D9-FF53-4C06-9C2A-E4173D41A2FD}_is1) (Version: - Michael Scrivo)

PaperPort (HKLM\...\{71C97545-E547-4A8B-B0C8-61FF853270AC}) (Version: 9.02.0827 - ScanSoft, Inc.)

PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.2.0 - Frank Heindörfer, Philip Chinery)

Pervasive PSQL v10 SP3 Workgroup (32-bit) (HKLM\...\Pervasive PSQL v10 SP3 Workgroup (32-bit)) (Version: 10.30.013 - Pervasive Software)

Pervasive PSQL v10 SP3 Workgroup (32-bit) (Version: 10.30.013 - Pervasive Software) Hidden

PowerDVD DX (HKLM\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 8.3.6107 - CyberLink Corp.)

QuickBooks (Version: 22.0.4015.2206 - Intuit Inc.) Hidden

QuickBooks Premier: Contractor Edition 2012 (HKLM\...\{2556333D-27B8-4CCE-9DC3-A6CC382F3409}) (Version: 22.0.4015.2206 - Intuit Inc.)

Realtek 8136 8168 8169 Ethernet Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0005 - Realtek)

Roxio Creator DE 10.3 (HKLM\...\{09760D42-E223-42AD-8C3E-55B47D0DDAC3}) (Version: 10.3 - Roxio)

Sage Installation Manager CLIENT programs (HKLM\...\{71715DF4-3167-489A-B843-9EEFC71D97E8}) (Version: 2.0.0.0 - Sage)

Sage Installation Manager SERVER programs (HKLM\...\{D1E91805-6812-47AD-AB94-47F87AE50B60}) (Version: 2.0.0.0 - Sage)

Sage Timberline Office Accounting Client (HKLM\...\{C378651D-4F97-450E-9D33-8AF8C02FC287}) (Version: 9.7.0 - Sage)

Sage Timberline Office Payroll Tax Reports (Version: 6.14.16 - Sage Software) Hidden

SupportSoft Assisted Service (HKLM\...\{5A3F6A80-7913-475E-8B96-477A952CFA43}) (Version: 15 - SupportSoft)

Symantec Endpoint Protection (HKLM\...\{7B3B4CE5-300C-4DFC-8CD1-D9C0E07015D1}) (Version: 11.0.6000.550 - Symantec Corporation)

TurboMeeting (HKU\S-1-5-21-3918117171-1918430931-2789110331-1134\...\TurboMeeting) (Version: 3.0.305 - RHUB Communications, Inc.)

Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)

Visual Studio 2005 Tools for Office Second Edition Runtime (HKLM\...\Microsoft Visual Studio 2005 Tools for Office Runtime) (Version: - Microsoft Corporation)

Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)

Yahoo! Detect (HKLM\...\YTdetect) (Version: - )

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{05EC5C13-D255-4592-9CCB-98615172F0D6}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{0ADF9C35-0D5E-4B75-88DD-B64868907E17}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{123FAF7F-3FB1-4B8F-AD18-0047401D436A}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{1B3210AF-E236-46D4-83EF-6421F2FF543C}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBDTVIEW.OCx No File

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{1E78DD72-771E-42BF-8B4B-363CEB18E07B}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBDTVIEW.OCx No File

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{22664BE2-0806-4BA4-8643-DE40C9149176}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\BbfDepCalc.ocx No File

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{2A9EBDB5-0600-4E8C-B910-4001BEB2DD8C}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\BbfDepCalc.ocx No File

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{349D777D-F7A2-4AAE-967F-A54F05A7FF3B}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBFinder.dll No File

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{37A2FC00-1795-4679-94A3-A153F1A8BB54}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{37A2FC02-1795-4679-94A3-A153F1A8BB54}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{38F58721-5F93-11D5-9F94-0008C7AA5BD9}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\COMObjectFactory.dll No File

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{38F58742-5F93-11D5-9F94-0008C7AA5BD9}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\ViewSrcColumns.dll No File

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{38F58743-5F93-11D5-9F94-0008C7AA5BD9}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\ViewSrcColumns.dll No File

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{38F58744-5F93-11D5-9F94-0008C7AA5BD9}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\ViewSrcColumns.dll No File

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{4716D3CE-55DB-4D2A-818C-87D912895890}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{4844F3F7-2161-4AC4-B219-B3B4311782AA}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{4A56F19E-9F50-4F43-93C8-050E44AA83A9}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{4CA41277-032D-4a20-B225-371EBA96ABF2}\localserver32 -> C:\Program Files\Intuit\QuickBooks 2012\QBW32.EXE (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{4E5E74B5-8EB5-4859-A335-837EED412620}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{5249684A-D7A2-4DBE-94F4-B90923A7BC64}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\BbfDepCalc.ocx No File

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{5428A9ED-6CD8-11D6-9C8A-0001023DCAA2}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{547C8F00-5567-4AE3-8BB0-CC3CE2AB9070}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{57D590F1-91EB-44CE-8088-AE4AE19D30A1}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{596801D8-2C9D-4627-9C67-195CB81B655A}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{5B7331FA-8910-4748-A8A4-60B445041F28}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{5ED8AC89-B2DE-476D-8EEA-E170B2FCB058}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{70478C56-E77F-4134-B3E3-3B18EE036D71}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBDTRatios.dll No File

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{7694F1CD-A55B-4B7C-8820-A90892EB4E9E}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{7DBF8260-30AD-4D1B-876A-8032B87B809F}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{828E5386-74CF-4019-B356-C857CD028A7D}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{82CC31B3-53B4-4161-A4E9-6B4F1290A6C8}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{8572570D-12D9-4F2C-8BB8-EB8848178B94}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{8E590317-1329-11D1-B70B-00805F29CD16}\localserver32 -> C:\Program Files\Intuit\QuickBooks 2012\QBW32.EXE (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{8FEDE364-AB37-4551-80C9-6D468E222AB2}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{9D9B61F2-9E2B-492A-81B3-AA5A1CCFBC3A}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{9D9B61F3-9E2B-492A-81B3-AA5A1CCFBC3A}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{9D9B61F4-9E2B-492A-81B3-AA5A1CCFBC3A}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{9D9B61F5-9E2B-492A-81B3-AA5A1CCFBC3A}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{9D9B61F6-9E2B-492A-81B3-AA5A1CCFBC3A}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{9D9B61F7-9E2B-492A-81B3-AA5A1CCFBC3A}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{A58C4EAB-2DB8-445E-9CAE-2AE197A5C708}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\BbfDepCalc.ocx No File

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{A63E42D0-9C63-47B5-ABF2-0C839EC20778}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{A63E42D2-9C63-47B5-ABF2-0C839EC20778}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{AF5E0A13-CEAB-47CE-991D-77E82CD1BF3F}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{B10BFAC3-EFF1-40D9-ADA0-BEBE037C24CA}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{B66F2BF1-91EB-44CE-8088-AE4AE19D30A1}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{BCD594EA-15C3-4FD8-B92B-114BB9694537}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBCtrIPMDS2.dll No File

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{CE18240D-F3F8-43AE-9EA0-A0DC85A95375}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBDTRatios.dll No File

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{D14FD6B3-6A9F-4537-9460-07B836707127}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{D4A12AAF-E15E-470B-A6B6-63032186F91F}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{D9B9C060-0954-11D3-9E07-00104BD2BE34}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\ViewSource.dll (Intuit, Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{D9BC6F81-A54B-11D4-A516-0050DA68678D}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\cominifile.dll (Intuit, Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{D9BC6F84-A54B-11D4-A516-0050DA68678D}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\cominifile.dll (Intuit, Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{D9BC6F87-A54B-11D4-A516-0050DA68678D}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\cominifile.dll (Intuit, Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{D9BC6FA1-A54B-11D4-A516-0050DA68678D}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\GraphSeriesCol.dll (Intuit, Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{D9BC6FA6-A54B-11D4-A516-0050DA68678D}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\GraphSeriesCol.dll (Intuit, Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{D9BC6FB2-A54B-11D4-A516-0050DA68678D}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\StorageClasses.dll (Intuit, Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{D9BC6FC1-A54B-11D4-A516-0050DA68678D}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\ViewSrcColumns.dll No File

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{DCB2B478-EFF6-48F6-B718-13E98876854E}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{DFD0AF10-B86C-4AF3-B609-1348D513E565}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{E1A173E1-D957-4C3E-A098-43756A3DB454}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{E1A173E3-D957-4C3E-A098-43756A3DB454}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{E6E4DF8B-17CE-43ED-B2C7-2CE10457552D}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\BbfDepCalc.ocx No File

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{E7D2D0F6-B754-438D-B5C9-BF848D311A0F}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBDTRatios.dll No File

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{EADA914E-5B08-4E85-8440-5A087504DF87}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{EAEF733D-5B08-4E85-8440-5A087504DF87}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{F2C593CC-74B2-4F71-8556-DD4D426D0409}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{F9EF917A-E55E-4242-B205-E778395AC313}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\BbfDepCalc.ocx No File

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{FAC93D42-FFC2-11d1-9DEB-0008C7A08EBA}\localserver32 -> C:\Program Files\Intuit\QuickBooks 2012\QBW32.EXE (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{FB17915F-06D1-4214-A902-CC5EE05186E9}\InprocServer32 -> C:\Program Files\Common Files\Intuit\QuickBooks\QBObjProxy.dll (Intuit Inc.)

CustomCLSID: HKU\S-1-5-21-3918117171-1918430931-2789110331-1134_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 -> C:\$Recycle.Bin ()

==================== Restore Points =========================

22-01-2015 08:13:51 Pre Virus Scan

22-01-2015 08:49:10 Windows Backup

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 21:04 - 2012-04-06 06:33 - 00001805 ___RA C:\Windows\system32\Drivers\etc\hosts

127.0.0.1 3dns.adobe.com 3dns-1.adobe.com 3dns-2.adobe.com 3dns-3.adobe.com 3dns-4.adobe.com activate.adobe.com activate-sea.adobe.com activate-sjc0.adobe.com activate.wip.adobe.com

127.0.0.1 activate.wip1.adobe.com activate.wip2.adobe.com activate.wip3.adobe.com activate.wip4.adobe.com adobe-dns.adobe.com adobe-dns-1.adobe.com adobe-dns-2.adobe.com adobe-dns-3.adobe.com adobe-dns-4.adobe.com

127.0.0.1 adobeereg.com practivate.adobe practivate.adobe.com practivate.adobe.newoa practivate.adobe.ntp practivate.adobe.ipp ereg.adobe.com ereg.wip.adobe.com ereg.wip1.adobe.com

127.0.0.1 ereg.wip2.adobe.com ereg.wip3.adobe.com ereg.wip4.adobe.com hl2rcv.adobe.com wip.adobe.com wip1.adobe.com wip2.adobe.com wip3.adobe.com wip4.adobe.com

127.0.0.1 www.adobeereg.com wwis-dubc1-vip60.adobe.com www.wip.adobe.com www.wip1.adobe.com

127.0.0.1 www.wip2.adobe.com www.wip3.adobe.com www.wip4.adobe.com wwis-dubc1-vip60.adobe.com crl.verisign.net CRL.VERISIGN.NET ood.opsource.net

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {3D887A08-BD96-4C91-A856-42DE6B7D8AEF} - System32\Tasks\{1A40B363-A1BE-4F22-8112-4B9834778DE4} => pcalua.exe -a C:\Windows\system32\pcwrun.exe -c "C:\Program Files\Intuit\QuickBooks 2009\QBW32PremierContractor.exe"

Task: {58F62408-BE3B-4E03-AD85-9537485A2A48} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-14] (Adobe Systems Incorporated)

Task: {72FEB3C5-E90C-45C7-BFE8-1F7CDB036819} - System32\Tasks\{4EBFF532-6BE6-49B5-8665-708B96729CD0} => pcalua.exe -a "C:\Users\kkaiser\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4WUJNQ2X\QuickBooksPro2011.exe" -d C:\Users\kkaiser\Desktop

Task: {8139D077-C14B-485A-9F1E-89A8D2C98F9B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-23] (Google Inc.)

Task: {98636363-5226-48FA-B833-221672BFDC9F} - System32\Tasks\{29838F4C-EBCD-43AB-AA50-AE359D05D18E} => pcalua.exe -a "C:\Users\kkaiser\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7K1Q8P4Q\Setup_QuickBooksPremier2012.exe" -d C:\Users\kkaiser\Desktop

Task: {A4B9E0AB-06A7-47F0-84AA-25DE588ABCE8} - System32\Tasks\{C9A857A8-803D-475F-A7A7-40A1B40A2930} => pcalua.exe -a D:\setup.exe -d D:\

Task: {BD1622EC-A155-41E1-B1FC-918028FCF303} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-23] (Google Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-09-24 09:38 - 2012-08-31 14:01 - 00151552 _____ () C:\Windows\System32\HP1100LM.DLL

2012-08-27 14:40 - 2001-10-28 15:42 - 00116224 _____ () C:\Windows\System32\pdfcmnnt.dll

2014-09-24 09:38 - 2012-08-31 14:01 - 00069632 _____ () C:\Windows\system32\spool\PRTPROCS\W32X86\HP1100PP.DLL

2012-12-24 05:53 - 2012-12-24 05:53 - 00081920 _____ () C:\Windows\system32\mvusbews.DLL

2010-04-14 03:01 - 2010-04-14 03:01 - 00015144 _____ () C:\Program Files\Sage\SIM\Client\Sage.Sim.Client.WindowsService.exe

2010-04-14 03:01 - 2010-04-14 03:01 - 00065320 _____ () C:\Program Files\Sage\SIM\Client\Sage.Sim.Client.Core.dll

2010-04-14 03:00 - 2010-04-14 03:00 - 00068904 _____ () C:\Program Files\Sage\SIM\Client\Sage.Sim.Shared.dll

2010-04-14 03:00 - 2010-04-14 03:00 - 00021800 _____ () C:\Program Files\Sage\SIM\Client\Sage.Sim.Shared.ManagedProductPluginManager.dll

2010-04-14 03:00 - 2010-04-14 03:00 - 00015656 _____ () C:\Program Files\Sage\SIM\Client\Sage.Sim.DesktopNotification.Service.dll

2010-04-14 03:00 - 2010-04-14 03:00 - 00014632 _____ () C:\Program Files\Sage\SIM\Client\Sage.Sim.Shared.ManagedProducts.dll

2010-04-14 03:00 - 2010-04-14 03:00 - 00016168 _____ () C:\Program Files\Sage\SIM\Client\Sage.Sim.Client.ServerCallbackService.dll

2010-04-14 03:00 - 2010-04-14 03:00 - 00015656 _____ () C:\Program Files\Sage\SIM\Client\Sage.Sim.Shared.ManagedProductPluginWrapper.dll

2010-04-14 03:00 - 2010-04-14 03:00 - 00011560 _____ () C:\Program Files\Sage\SIM\Client\Sage.Sim.ClientShared.dll

2010-04-14 03:01 - 2010-04-14 03:01 - 00015656 _____ () C:\Program Files\Sage\SIM\Server\Sage.Sim.Server.WindowsService.exe

2010-04-14 03:01 - 2010-04-14 03:01 - 00129832 _____ () C:\Program Files\Sage\SIM\Server\Sage.Sim.Server.Core.dll

2010-04-14 03:00 - 2010-04-14 03:00 - 00068904 _____ () C:\Program Files\Sage\SIM\Server\Sage.Sim.Shared.dll

2010-04-14 03:00 - 2010-04-14 03:00 - 00012584 _____ () C:\Program Files\Sage\SIM\Server\Sage.Sim.Server.ClientDownloadService.dll

2010-04-14 03:00 - 2010-04-14 03:00 - 00011560 _____ () C:\Program Files\Sage\SIM\Server\Sage.Sim.ClientShared.dll

2010-04-14 03:00 - 2010-04-14 03:00 - 00016168 _____ () C:\Program Files\Sage\SIM\Server\Sage.Sim.Server.ClientManagerService.dll

2010-04-14 03:00 - 2010-04-14 03:00 - 00018216 _____ () C:\Program Files\Sage\SIM\Server\Sage.Sim.Server.ManagementConsoleService.dll

2010-04-14 03:00 - 2010-04-14 03:00 - 00013096 _____ () C:\Program Files\Sage\SIM\Server\Sage.Sim.ManagementConsoleShared.dll

2010-04-14 03:00 - 2010-04-14 03:00 - 00020776 _____ () C:\Program Files\Sage\SIM\Server\Sage.Sim.Shared.ManagedServerProductPluginManager.dll

2010-04-14 03:00 - 2010-04-14 03:00 - 00012584 _____ () C:\Program Files\Sage\SIM\Server\Sage.Sim.Shared.ManagedServerProducts.dll

2010-04-14 03:01 - 2010-04-14 03:01 - 00038696 _____ () C:\Program Files\Sage\SIM\Client\SimNotify.exe

2010-04-14 03:01 - 2010-04-14 03:01 - 00033064 _____ () C:\Program Files\Sage\SIM\Client\Sage.Sim.DesktopNotification.ClientLibrary.dll

2013-11-08 08:48 - 2013-11-08 08:48 - 00269128 _____ () C:\Program Files\Intuit\QuickBooks 2012\boost_regex-vc90-mt-p-1_33.dll

2013-11-08 08:48 - 2013-11-08 08:48 - 00021320 _____ () C:\Program Files\Intuit\QuickBooks 2012\QBCompressor.dll

2012-12-06 13:10 - 2012-12-06 13:10 - 00059904 _____ () C:\Program Files\Intuit\QuickBooks 2012\zlib1.dll

2013-11-08 08:48 - 2013-11-08 08:48 - 00380744 _____ () C:\Program Files\Intuit\QuickBooks 2012\BackupLib.dll

2013-11-08 08:48 - 2013-11-08 08:48 - 00138568 _____ () C:\Program Files\Intuit\QuickBooks 2012\QBMAPILibrary.dll

2013-11-08 08:48 - 2013-11-08 08:48 - 00176968 _____ () C:\Program Files\Intuit\QuickBooks 2012\boost_serialization-vc90-mt-p-1_33.dll

2013-11-08 08:48 - 2013-11-08 08:48 - 00042824 _____ () C:\Program Files\Intuit\QuickBooks 2012\mbpopup.dll

2010-09-22 01:25 - 2000-11-09 10:17 - 00190464 _____ () C:\Program Files\Kyocera\FileUtility\HgTiff2Pdf.dll

2015-01-14 02:45 - 2015-01-08 19:35 - 01077064 _____ () C:\Program Files\Google\Chrome\Application\39.0.2171.99\libglesv2.dll

2015-01-14 02:45 - 2015-01-08 19:35 - 00211272 _____ () C:\Program Files\Google\Chrome\Application\39.0.2171.99\libegl.dll

2015-01-14 02:45 - 2015-01-08 19:35 - 09009480 _____ () C:\Program Files\Google\Chrome\Application\39.0.2171.99\pdf.dll

2015-01-14 02:45 - 2015-01-08 19:35 - 01677128 _____ () C:\Program Files\Google\Chrome\Application\39.0.2171.99\ffmpegsumo.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antvirus => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\atashost => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ccEvtMgr => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ccSetMgr => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SmcService => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Symantec Antivirus => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Symantec Antvirus => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\TurboMeeting => ""="Service"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

========================= Accounts: ==========================

administrator (S-1-5-21-2480199604-2480216931-428779891-500 - Administrator - Enabled) => C:\Users\localroot

Guest (S-1-5-21-2480199604-2480216931-428779891-501 - Limited - Disabled)

QBDataServiceUser22 (S-1-5-21-2480199604-2480216931-428779891-1002 - Limited - Enabled) => C:\Users\QBDataServiceUser22

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:

==================

Error: (01/22/2015 08:47:51 AM) (Source: QuickBooks) (EventID: 4) (User: )

Description: An unexpected error has occured in "QuickBooks":

Returning NULL QBWinInstance Handle

Error: (01/22/2015 08:47:51 AM) (Source: QuickBooks) (EventID: 4) (User: )

Description: An unexpected error has occured in "QuickBooks":

Returning NULL QBWinInstance Handle

Error: (01/22/2015 08:47:51 AM) (Source: QuickBooks) (EventID: 4) (User: )

Description: An unexpected error has occured in "QuickBooks":

Returning NULL QBWinInstance Handle

Error: (01/22/2015 07:52:50 AM) (Source: QuickBooks) (EventID: 4) (User: )

Description: An unexpected error has occured in "QuickBooks: Premier Contractor Edition 2012":

Got unexpected error 5 in call to NetShareGetInfo for path \\covmach-srvr1\Accounting\QB CURRENT LIVE\Covington Machine and Welding12GOOD ONE, Inc 10 23 14.QBW

Error: (01/22/2015 07:52:48 AM) (Source: QuickBooks) (EventID: 4) (User: )

Description: An unexpected error has occured in "QuickBooks: Premier Contractor Edition 2012":

Got unexpected error 5 in call to NetShareGetInfo for path \\covmach-srvr1\Accounting\QB CURRENT LIVE\Covington Machine and Welding12GOOD ONE, Inc 10 23 14.QBW

Error: (01/22/2015 07:38:00 AM) (Source: QuickBooks) (EventID: 4) (User: )

Description: An unexpected error has occured in "QuickBooks: Premier Contractor Edition 2012":

Got unexpected error 5 in call to NetShareGetInfo for path \\covmach-srvr1\Accounting\QB CURRENT LIVE\Covington Machine and Welding12GOOD ONE, Inc 10 23 14.QBW

Error: (01/22/2015 07:32:20 AM) (Source: QuickBooks) (EventID: 4) (User: )

Description: An unexpected error has occured in "QuickBooks":

Returning NULL QBWinInstance Handle

Error: (01/22/2015 07:32:20 AM) (Source: QuickBooks) (EventID: 4) (User: )

Description: An unexpected error has occured in "QuickBooks":

Returning NULL QBWinInstance Handle

Error: (01/22/2015 07:32:20 AM) (Source: QuickBooks) (EventID: 4) (User: )

Description: An unexpected error has occured in "QuickBooks":

Returning NULL QBWinInstance Handle

Error: (01/21/2015 08:20:08 AM) (Source: QuickBooks) (EventID: 4) (User: )

Description: An unexpected error has occured in "QuickBooks: Premier Contractor Edition 2012":

Got unexpected error 5 in call to NetShareGetInfo for path \\covmach-srvr1\Accounting\QB CURRENT LIVE\Covington Machine and Welding12GOOD ONE, Inc 10 23 14.QBW

System errors:

=============

Error: (01/22/2015 09:34:05 AM) (Source: Disk) (EventID: 11) (User: )

Description: The driver detected a controller error on \Device\Harddisk1\DR2.

Error: (01/22/2015 09:34:05 AM) (Source: Disk) (EventID: 11) (User: )

Description: The driver detected a controller error on \Device\Harddisk1\DR2.

Error: (01/22/2015 09:34:04 AM) (Source: Disk) (EventID: 11) (User: )

Description: The driver detected a controller error on \Device\Harddisk1\DR2.

Error: (01/22/2015 09:34:04 AM) (Source: Disk) (EventID: 11) (User: )

Description: The driver detected a controller error on \Device\Harddisk1\DR2.

Error: (01/22/2015 08:45:29 AM) (Source: VDS Basic Provider) (EventID: 1) (User: )

Description: Unexpected failure. Error code: D@01010004

Error: (01/22/2015 08:45:28 AM) (Source: VDS Basic Provider) (EventID: 1) (User: )

Description: Unexpected failure. Error code: D@01010004

Error: (01/22/2015 08:42:11 AM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: A timeout was reached (30000 milliseconds) while waiting for the LogMeIn service to connect.

Error: (01/22/2015 08:41:03 AM) (Source: Service Control Manager) (EventID: 7003) (User: )

Description: The IPsec Policy Agent service depends the following service: BFE. This service might not be installed.

Error: (01/22/2015 08:41:01 AM) (Source: Service Control Manager) (EventID: 7003) (User: )

Description: The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed.

Error: (01/22/2015 08:40:57 AM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: The Computer Browser service terminated with the following error:

%%1060

Microsoft Office Sessions:

=========================

Error: (10/10/2011 11:53:39 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6562.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 17859 seconds with 3000 seconds of active time. This session ended with a crash.

Error: (11/10/2010 03:56:43 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 18959 seconds with 600 seconds of active time. This session ended with a crash.

Error: (10/21/2010 07:11:46 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6539.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 1813 seconds with 480 seconds of active time. This session ended with a crash.

CodeIntegrity Errors:

===================================

Date: 2011-08-31 15:02:12.312

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

Date: 2011-08-31 14:31:24.918

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

Date: 2011-08-31 14:24:49.266

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

Date: 2011-08-31 14:13:38.426

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

Date: 2011-08-11 14:30:59.554

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

Date: 2011-06-21 19:40:33.445

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

Date: 2011-06-21 19:25:50.540

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

Date: 2011-06-21 19:13:26.313

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

Date: 2011-06-21 18:55:26.405

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

Date: 2011-06-20 21:57:07.929

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

==================== Memory info ===========================

Processor: Intel® Core2 Duo CPU E8400 @ 3.00GHz

Percentage of memory in use: 42%

Total physical RAM: 3070.99 MB

Available physical RAM: 1767.41 MB

Total Pagefile: 7674.28 MB

Available Pagefile: 6107.06 MB

Total Virtual: 2047.88 MB

Available Virtual: 1912.48 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:148.91 GB) (Free:82.91 GB) NTFS

Drive f: () (Removable) (Total:7.26 GB) (Free:6.83 GB) FAT32

Drive g: (DATA) (Network) (Total:365.7 GB) (Free:227.09 GB) NTFS

Drive p: (DATA) (Network) (Total:365.7 GB) (Free:227.09 GB) NTFS

Drive q: (DATA) (Network) (Total:365.7 GB) (Free:227.09 GB) NTFS

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149 GB) (Disk ID: A42D04A3)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=148.9 GB) - (Type=07 NTFS)

========================================================

Disk: 1 (MBR Code: Windows XP) (Size: 7.3 GB) (Disk ID: C3072E18)

Partition 1: (Active) - (Size=7.3 GB) - (Type=0C)

==================== End Of Log ============================

Naathim · January 22, 2015

Hello. You are using pirated version of the Adobe products. I am sorry, but you have been warned about that in my first post. I have to close this topic due to the evidence of pirated software.

space6011 · January 22, 2015

I was unaware of this. Looks like I have something else to look into now.

Naathim · January 22, 2015

If you'd remove all Adobe software, I'd be able to continue with my assistance.

space6011 · January 22, 2015

Ok, I uninstalled the adobe software.

Naathim · January 22, 2015

Let's check.

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool.

Right-click on icon and select Run as Administrator to start the tool.
> XP users click run after receipt of Windows Security Warning - Open File.
> 8 users will be prompted about Windows SmartScreen protection - click More information and Run.
Make sure that Addition option is checked.
Press Scan button and wait.
The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content in your next reply.

Scan with CKScanner

Download CKScanner by askey127 and save it to your desktop.

Right-click on icon and select Run as Administrator to start the tool.
click Search For Files.
When finished, click Save List To File.
Remember to run this tool once only, if not asked to run it again.

Please include the content of CKFiles.txt in your next reply.

space6011 · January 22, 2015

FRST.txt

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 19-01-2015

Ran by heather (administrator) on COVMACH-PC3 on 22-01-2015 11:10:55

Running from F:\

Loaded Profiles: QBDataServiceUser22 & heather (Available profiles: QBDataServiceUser22 & administrator & brian & nancy & don & bonnie & donnie & guyjr & heather & Temp & root)

Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Symantec Corporation) C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe

(Symantec Corporation) C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

(Cisco WebEx LLC) C:\Windows\System32\atashost.exe

(HP) C:\Windows\System32\HPSIsvc.exe

(LogMeIn, Inc.) C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe

(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\VS7DEBUG\mdm.exe

(Intuit) C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe

(Intuit Inc.) C:\Program Files\Common Files\Intuit\DataProtect\QBIDPService.exe

() C:\Program Files\Sage\SIM\Client\Sage.Sim.Client.WindowsService.exe

() C:\Program Files\Sage\SIM\Server\Sage.Sim.Server.WindowsService.exe

(Symantec Corporation) C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe

(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE

(Symantec Corporation) C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe

(CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe

(Symantec Corporation) C:\Program Files\Common Files\Symantec Shared\ccApp.exe

() C:\Program Files\Sage\SIM\Client\SimNotify.exe

(ScanSoft, Inc.) C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe

(LogMeIn, Inc.) C:\Program Files\LogMeIn\x86\LogMeInSystray.exe

(LogMeIn, Inc.) C:\Program Files\LogMeIn\x86\LogMeIn.exe

(Intuit Inc.) C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe

(Intuit Inc.) C:\Program Files\Intuit\QuickBooks 2012\QBW32.EXE

(KYOCERA MITA Corporation) C:\Program Files\Kyocera\FileUtility\NsCatCom.exe

(Pervasive Software Inc.) C:\Program Files\Pervasive Software\PSQL\bin\w3dbsmgr.exe

(Intuit, Inc.) C:\Program Files\Intuit\QuickBooks 2012\QBDBMgrN.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Intuit Inc.) C:\Program Files\Common Files\Intuit\QuickBooks\axlbridge.exe

(Intel Corporation) C:\Windows\System32\igfxsrvc.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [PDVDDXSrv] => C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe [140520 2010-01-07] (CyberLink Corp.)

HKLM\...\Run: [ccApp] => C:\Program Files\Common Files\Symantec Shared\ccApp.exe [115560 2010-01-25] (Symantec Corporation)

HKLM\...\Run: [simNotify.exe] => C:\Program Files\Sage\SIM\Client\SimNotify.exe [38696 2010-04-14] ()

HKLM\...\Run: [sunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254696 2012-01-18] (Sun Microsystems, Inc.)

HKLM\...\Run: [sSBkgdUpdate] => C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [155648 2003-10-14] (Scansoft, Inc.)

HKLM\...\Run: [PaperPort PTD] => C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe [57393 2005-03-17] (ScanSoft, Inc.)

HKLM\...\Run: [indexSearch] => C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe [40960 2005-03-17] (ScanSoft, Inc.)

HKLM\...\Run: [HPUsageTrackingLEDM] => C:\Program Files\HP\HP UT LEDM\bin\hppusg.exe [30264 2009-08-04] (Hewlett-Packard Company)

HKLM\...\Run: [LogMeIn GUI] => C:\Program Files\LogMeIn\x86\LogMeInSystray.exe [63048 2014-10-31] (LogMeIn, Inc.)

HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] fastprox.dll ATTENTION! ====> ZeroAccess?

HKU\S-1-5-19\...\Run: [sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun

HKU\S-1-5-20\...\Run: [sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun

HKU\S-1-5-21-2480199604-2480216931-428779891-1002\...\MountPoints2: {de1ecb98-b206-11df-8e9c-806e6f6e6963} - D:\setup.exe

HKU\S-1-5-21-3918117171-1918430931-2789110331-1134\...\MountPoints2: {72d8539a-2e81-11e4-9508-002564d38afb} - E:\VerizonWirelessUpgradeAssistantSetup.exe -a

HKU\S-1-5-21-3918117171-1918430931-2789110331-1134\...\MountPoints2: {a177789a-b023-11e3-a863-002564d38afb} - E:\MotorolaDeviceManagerSetup.exe -a

HKU\S-1-5-21-3918117171-1918430931-2789110331-1134\...\MountPoints2: {d651e919-4342-11e4-87fa-002564d38afb} - E:\SISetup.exe

HKU\S-1-5-21-3918117171-1918430931-2789110331-1134\...409d6c4515e9\InprocServer32: [Default-shell32] C:\$Recycle.Bin\S-1-5-21-3918117171-1918430931-2789110331-1134\$8b0c8dbb1b2ac8ed528db6ffb1032caf\n. ATTENTION! ====> ZeroAccess?

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Intuit Data Protect.lnk

ShortcutTarget: Intuit Data Protect.lnk -> C:\Program Files\Common Files\Intuit\DataProtect\IntuitDataProtect.exe (Intuit Inc.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk

ShortcutTarget: QuickBooks Update Agent.lnk -> C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit Inc.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks_Standard_21.lnk

ShortcutTarget: QuickBooks_Standard_21.lnk -> C:\Program Files\Intuit\QuickBooks 2012\QBW32.EXE (Intuit Inc.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Scanner File Utility.lnk

ShortcutTarget: Scanner File Utility.lnk -> C:\Program Files\Kyocera\FileUtility\NsCatCom.exe (KYOCERA MITA Corporation)

Addition.txt

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 19-01-2015

Ran by heather at 2015-01-22 11:11:20