Computer is running very slow

sarahcarehomehealth · September 30, 2015

I have a personal computer and it is running very slow and getting a repeated message: "computer memory is full and you must close programs or they will crash". I will only have a few tabs open and for some reason the Memory will be at 93%. This is a fairly new ASUS with 4 gigs of Ram. The computer is constantly moving at very slow speeds and this only recently started doing this. I'm running Windows 7. Please help me figure out if there is any MALWARE on my computer that is causing this slowness.

Thank you!

kevinf80 · September 30, 2015

Hello and welcome to Malwarebytes.org

P2P/Piracy Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here. Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Next,

Change the download folder setting in the default Browser so all tools we may use are saved to the Desktop:

Google Chrome - Click the "Customize and control Google Chrome" button in the upper right-corner of the browser.

Choose Settings. at the bottom of the screen click the
"Show advanced settings..." link. Scroll down to find the Downloads section and click the Change... button. Select your desktop and click OK.

Mozilla Firefox - Click the "Open Menu" button in the upper right-corner of the browser.

Choose Options. In the downloads section, click the Browse button, click on the Desktop folder and the click the "Select Folder" button. Click OK to get out of the Options menu.

Internet Explorer - Click the Tools menu in the upper right-corner of the browser.

Select View downloads. Select the Options link in the lower left of the window. Click Browse and select the Desktop and then choose the Select Folder button. Click OK to get out of the download options screen and then click Close to get out of the View Downloads screen.
NOTE: IE8 Does not support changing download locations in this manner. You will need to download the tool(s) to the default folder, usually Downloads, then copy them to the desktop.

Next,

Follow the instructions in the following link to show hidden files:

http://www.bleepingcomputer.com/tutorials/how-to-see-hidden-files-in-windows/

Next,

Please open Malwarebytes Anti-Malware.

On the Settings tab > Detection and Protection sub tab, Detection Options, tick the box "Scan for rootkits".
Under Non-Malware Protection sub tab Change PUP and PUM entries to Treat detections as Malware
Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button.
A Threat Scan will begin.
With some infections, you may or may not see this message box.

'Could not load DDA driver'
Click 'Yes' to this message, to allow the driver to load after a restart.
Allow the computer to restart. Continue with the rest of these instructions.
When the scan is complete, click Apply Actions.
Wait for the prompt to restart the computer to appear, then click on Yes.
After the restart once you are back at your desktop, open MBAM once more.

To get the log from Malwarebytes do the following:

Click on the History tab > Application Logs.
Double click on the scan log which shows the Date and time of the scan just performed.
Click Export > From export you have three options:

Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
XML file (*.xml) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
Recommend you use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply…

If Malwarebytes is not installed follow these instructions first:

Download Malwarebytes Anti-Malware to your desktop.

Double-click mbam-setup and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to the following:
Launch Malwarebytes Anti-Malware
A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
Click Finish. Follow the instructions above....

Next,

Download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

If your security alerts to FRST either accept the alert or disable your security and allow FRST to run...

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

Next,

Please download RogueKiller and save it to your desktop from the following link: http://www.bleepingcomputer.com/download/roguekiller/

Quit all running programs.
For Windows XP, double-click to start.
For Vista,Windows 7/8/8.1/10, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
Read and accept the EULA (End User Licene Agreement)
Click Scan to scan the system.
When the scan completes select "Report",in the next window select "Export txt" the log will open as a text file post that log... Also save to your Desktop for reference. log will open.
Close the program > Don't Fix anything!

Let me see those logs in your reply....

Thank you,

Kevin...

sarahcarehomehealth · September 30, 2015

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 9/30/2015

Scan Time: 4:16 PM

Logfile:

Administrator: Yes

Version: 2.1.8.1057

Malware Database: v2015.09.30.07

Rootkit Database: v2015.09.22.01

License: Trial

Malware Protection: Enabled

Malicious Website Protection: Enabled

Self-protection: Disabled

OS: Windows 7 Service Pack 1

CPU: x64

File System: NTFS

User: Sarah Care

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 373809

Time Elapsed: 21 min, 24 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Enabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 0

(No malicious items detected)

Registry Values: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Folders: 0

(No malicious items detected)

Files: 0

(No malicious items detected)

Physical Sectors: 0

(No malicious items detected)

(end)

kevinf80 · September 30, 2015

Can you also post the other requested logs?

sarahcarehomehealth · October 1, 2015

Additional scan result of Farbar Recovery Scan Tool (x64) Version:30-09-2015

Ran by Sarah Care (2015-09-30 17:07:57)

Running from C:\Users\Sarah Care\Downloads

Windows 7 Home Premium Service Pack 1 (X64) (2013-12-27 17:31:23)

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-2023128739-2569144306-2742317746-500 - Administrator - Disabled)

Guest (S-1-5-21-2023128739-2569144306-2742317746-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-2023128739-2569144306-2742317746-1004 - Limited - Enabled)

Sarah Care (S-1-5-21-2023128739-2569144306-2742317746-1000 - Administrator - Enabled) => C:\Users\Sarah Care

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Norton 360 Premier (Disabled - Up to date) {53C7D717-52E2-B95E-FA61-6F32ECC805DB}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Norton 360 Premier (Disabled - Up to date) {E8A636F3-74D8-B6D0-C0D1-5440974F4F66}

FW: Norton 360 Premier (Enabled) {6BFC5632-188D-B806-D13E-C607121B42A0}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

64 Bit HP CIO Components Installer (Version: 1.2.0 - Hewlett-Packard) Hidden

64 Bit HP CIO Components Installer (Version: 2.2.6 - Hewlett-Packard) Hidden

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)

Adobe Reader XI (11.0.12) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.12 - Adobe Systems Incorporated)

Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{B678797F-DF38-4556-8A31-8B818E261868}) (Version: 8.0.0.23 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

Asmedia ASM104x USB 3.0 Host Controller Driver (HKLM-x32\...\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.10.0.0 - Asmedia Technology)

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

Citrix Online Launcher (HKLM-x32\...\{6740FE60-43C1-4D15-8C4A-001624134B14}) (Version: 1.0.312 - Citrix)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

DocuWare Desktop Apps Setup (HKLM-x32\...\{20BC019E-0B3D-44C4-8DF1-2B9F9E03F29E}) (Version: 6.7.3381.3381 - DocuWare)

DocuWare Desktop Framework (HKLM-x32\...\{7E9C4305-7D00-4917-8569-0C335198AB5D}) (Version: 6.7.3381.3381 - DocuWare)

DocuWare OCR Toolkit (HKLM-x32\...\{008FA86E-A785-4B9D-A7E2-34D482CA0972}) (Version: 6.7.3381.3381 - DocuWare)

DocuWare Smart Connect (HKLM-x32\...\{366E1F68-9A48-4872-8DAA-C37189D26B8C}) (Version: 6.7.3381.3381 - DocuWare)

DocuWare Update (HKLM-x32\...\{FA8DBBC8-6DF3-4651-B7D5-63477D3406DD}) (Version: 6.7.3381.3381 - DocuWare)

Dropbox (HKU\S-1-5-21-2023128739-2569144306-2742317746-1000\...\Dropbox) (Version: 3.8.8 - Dropbox, Inc.)

Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Google Apps Migration For Microsoft Outlook® 3.4.27.52 (HKLM-x32\...\{65960C6E-BFA2-4FE7-A1BC-8028F3072566}) (Version: 3.4.27.52 - Google, Inc.)

Google Apps Sync™ for Microsoft Outlook® 3.7.410.1100 (HKLM-x32\...\{799A7E2B-388F-4BDE-B55B-47AF42C6440A}) (Version: 3.7.410.1100 - Google, Inc.)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 45.0.2454.101 - Google Inc.)

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.28.15 - Google Inc.) Hidden

GoToMeeting 7.3.0.3499 (HKU\S-1-5-21-2023128739-2569144306-2742317746-1000\...\GoToMeeting) (Version: 7.3.0.3499 - CitrixOnline)

Intel® Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)

Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)

Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2372 - Intel Corporation)

Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.5.1001 - Intel Corporation)

iTunes (HKLM\...\{F46AA0F1-E284-4878-A462-5F11B9166C0E}) (Version: 11.4.0.18 - Apple Inc.)

JMicron Flash Media Controller Driver (HKLM-x32\...\{26604C7E-A313-4D12-867F-7C6E7820BE4C}) (Version: 1.0.59.2 - JMicron Technology Corp.)

join.me (HKU\S-1-5-21-2023128739-2569144306-2742317746-1000\...\JoinMe) (Version: 2.4.1.1133 - LogMeIn, Inc.)

Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Malwarebytes Anti-Malware version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)

Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)

Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)

Microsoft XNA Framework Redistributable 3.0 (HKLM-x32\...\{3898934B-05AE-41CD-96BE-70DA9BFBCE1F}) (Version: 3.0.11010.0 - Microsoft Corporation)

Mozilla Firefox 40.0.3 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 40.0.3 (x86 en-US)) (Version: 40.0.3 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 40.0.3.5716 - Mozilla)

Norton 360 Premier (HKLM-x32\...\N360) (Version: 22.5.4.24 - Symantec Corporation)

OOBERegBackup (HKLM-x32\...\OOBERegBackup_is1) (Version: - ASUSTeK Computer Inc.)

Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.40.126.2011 - Realtek)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6387 - Realtek Semiconductor Corp.)

Soneto-SarahCare (HKU\S-1-5-21-2023128739-2569144306-2742317746-1000\...\4f8f1da1743c3cfe) (Version: 1.35.202.0 - Stratis Business Systems)

Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)

Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-2023128739-2569144306-2742317746-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Sarah Care\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2023128739-2569144306-2742317746-1000_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Users\Sarah Care\AppData\Local\Citrix\GoToMeeting\2759\G2MOutlookAddin64.dll (Citrix Online, a division of Citrix Systems, Inc.)

CustomCLSID: HKU\S-1-5-21-2023128739-2569144306-2742317746-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Sarah Care\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2023128739-2569144306-2742317746-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Sarah Care\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2023128739-2569144306-2742317746-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Sarah Care\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2023128739-2569144306-2742317746-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Sarah Care\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2023128739-2569144306-2742317746-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Sarah Care\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2023128739-2569144306-2742317746-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Sarah Care\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2023128739-2569144306-2742317746-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Sarah Care\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2023128739-2569144306-2742317746-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Sarah Care\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2023128739-2569144306-2742317746-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Sarah Care\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2023128739-2569144306-2742317746-1000_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\Sarah Care\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)

==================== Restore Points =========================

03-09-2015 15:06:01 Windows Update

09-09-2015 03:01:11 Windows Update

16-09-2015 19:13:11 Scheduled Checkpoint

24-09-2015 10:34:44 Scheduled Checkpoint

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 22:34 - 2009-06-10 17:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0395392E-1CF4-48A1-98CB-EAF76B78938E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-27] (Google Inc.)

Task: {17212649-084C-42B7-A176-FDEE787CD2DF} - System32\Tasks\Norton 360\Norton Error Processor => C:\Program Files (x86)\Norton 360\Engine\22.5.4.24\SymErr.exe [2015-09-08] (Symantec Corporation)

Task: {35A572D7-05B6-4DD5-AFA4-AC1077E0F69C} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-2023128739-2569144306-2742317746-1000Core => C:\Users\Sarah Care\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-15] (Dropbox, Inc.)

Task: {5C1F3DFC-6771-4DD5-9012-EBB2FCB0BA21} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-2023128739-2569144306-2742317746-1000UA => C:\Users\Sarah Care\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-15] (Dropbox, Inc.)

Task: {73D19C39-AFFD-4611-B2C4-71947289A22A} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton 360\Engine\22.5.4.24\WSCStub.exe [2015-09-23] (Symantec Corporation)

Task: {765B12D3-3E2C-403E-BD94-98578615502F} - System32\Tasks\Norton 360\Norton Error Analyzer => C:\Program Files (x86)\Norton 360\Engine\22.5.4.24\SymErr.exe [2015-09-08] (Symantec Corporation)

Task: {7BB89A85-0DB5-48A4-93AB-1B8B3533083B} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {7F2C15EC-5307-447C-A05B-9BF677D7AD93} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-27] (Google Inc.)

Task: {83952981-9681-4138-87F4-212907A724CA} - System32\Tasks\G2MUpdateTask-S-1-5-21-2023128739-2569144306-2742317746-1000 => C:\Users\Sarah Care\AppData\Local\Citrix\GoToMeeting\3499\g2mupdate.exe [2015-09-19] (Citrix Online, a division of Citrix Systems, Inc.)

Task: {8F9B382A-50F5-410C-B020-2A4B192C616F} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)

Task: {A68FF331-C3F4-4894-8010-97975D1D9DBF} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => Rundll32.exe invagent.dll,RunUpdate -noappraiser

Task: {B9B3F55D-5B2F-4A9F-9FA7-2AA0E186B1B5} - System32\Tasks\G2MUploadTask-S-1-5-21-2023128739-2569144306-2742317746-1000 => C:\Users\Sarah Care\AppData\Local\Citrix\GoToMeeting\3499\g2mupload.exe [2015-09-19] (Citrix Online, a division of Citrix Systems, Inc.)

Task: {F76AB8E6-1441-41F3-959D-FCB2ABE61F69} - System32\Tasks\DocuWare Update => C:\Program Files (x86)\DocuWare\Update\DocuWare.Update.exe [2015-02-12] (DocuWare GmbH)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-2023128739-2569144306-2742317746-1000Core.job => C:\Users\Sarah Care\AppData\Local\Dropbox\Update\DropboxUpdate.exe

Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-2023128739-2569144306-2742317746-1000UA.job => C:\Users\Sarah Care\AppData\Local\Dropbox\Update\DropboxUpdate.exe

Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-2023128739-2569144306-2742317746-1000.job => C:\Users\Sarah Care\AppData\Local\Citrix\GoToMeeting\3499\g2mupdate.exe

Task: C:\Windows\Tasks\G2MUploadTask-S-1-5-21-2023128739-2569144306-2742317746-1000.job => C:\Users\Sarah Care\AppData\Local\Citrix\GoToMeeting\3499\g2mupload.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2011-05-11 03:38 - 2011-05-11 07:38 - 00034304 _____ () C:\Windows\System32\ssa3mlm.dll

2011-06-21 16:21 - 2010-10-21 13:52 - 00586880 _____ () C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe

2011-06-21 15:48 - 2011-04-15 06:16 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll

2015-09-30 16:46 - 2015-09-30 16:46 - 18801736 _____ () C:\Users\Sarah Care\Downloads\RogueKiller.exe

2014-07-31 12:16 - 2014-07-31 12:16 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

2014-07-31 12:16 - 2014-07-31 12:16 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

2015-09-30 13:33 - 2015-09-30 13:33 - 00071168 _____ () c:\Users\Sarah Care\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmprgax7w.dll

2015-03-04 17:45 - 2015-08-05 01:26 - 00012800 _____ () C:\Users\Sarah Care\AppData\Roaming\Dropbox\bin\QtQuick.2\qtquick2plugin.dll

2015-03-04 17:45 - 2015-08-05 01:26 - 00779776 _____ () C:\Users\Sarah Care\AppData\Roaming\Dropbox\bin\QtQuick\Controls\qtquickcontrolsplugin.dll

2015-07-30 15:56 - 2015-08-05 01:26 - 00056320 _____ () C:\Users\Sarah Care\AppData\Roaming\Dropbox\bin\QtQuick\Layouts\qquicklayoutsplugin.dll

2015-03-04 17:45 - 2015-08-05 01:26 - 00012288 _____ () C:\Users\Sarah Care\AppData\Roaming\Dropbox\bin\QtQuick\Window.2\windowplugin.dll

2015-09-25 15:32 - 2015-09-23 22:34 - 01501512 _____ () C:\Program Files (x86)\Google\Chrome\Application\45.0.2454.101\libglesv2.dll

2015-09-25 15:32 - 2015-09-23 22:34 - 00081224 _____ () C:\Program Files (x86)\Google\Chrome\Application\45.0.2454.101\libegl.dll

2014-10-17 03:33 - 2014-10-17 03:33 - 00169472 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\17c296575fad30d021e6370dc70cf800\IsdiInterop.ni.dll

2011-06-21 16:14 - 2011-02-18 12:16 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IsdiInterop.dll

2009-02-26 13:46 - 2009-02-26 13:46 - 00064344 _____ () C:\Program Files (x86)\Microsoft Office\Office12\ADDINS\ColleagueImport.dll

2011-06-22 11:46 - 2011-06-22 11:46 - 00434016 _____ () C:\Program Files (x86)\Microsoft Office\Office12\ADDINS\UmOutlookAddin.dll

2015-07-14 18:20 - 2015-07-14 18:20 - 00756376 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\Sarah Care\Desktop\HCSIS.lnk:com.dropbox.attributes

AlternateDataStreams: C:\Users\Sarah Care\Desktop\PaymentsBilling Reports.lnk:com.dropbox.attributes

AlternateDataStreams: C:\Users\Sarah Care\Desktop\PCA.lnk:com.dropbox.attributes

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2023128739-2569144306-2742317746-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Sarah Care\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

DNS Servers: 8.8.8.8 - 8.8.4.4

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{99590D0F-23D2-47BA-A072-EFED17F2EC6B}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

FirewallRules: [{B36245FA-69F7-4618-BE34-EC4524ECF59D}] => (Allow) LPort=2869

FirewallRules: [{5B49237A-ECD9-494D-AB32-70E3905F7B42}] => (Allow) LPort=1900

FirewallRules: [{95E5E980-8832-4814-BC47-15CD47CA38AD}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe

FirewallRules: [{35EF1136-E29D-46D5-AA59-93777FED71B2}] => (Allow) C:\Program Files (x86)\Windows Live\Mesh\MOE.exe

FirewallRules: [TCP Query User{EDAEC1FA-2E04-44A8-8FA5-F5E074BFAB6D}C:\users\sarah care\appdata\roaming\spotify\spotify.exe] => (Block) C:\users\sarah care\appdata\roaming\spotify\spotify.exe

FirewallRules: [uDP Query User{2DDAA2EE-4646-40AC-AF39-5BE5F6CBE192}C:\users\sarah care\appdata\roaming\spotify\spotify.exe] => (Block) C:\users\sarah care\appdata\roaming\spotify\spotify.exe

FirewallRules: [{41F748FF-A2C5-4227-A6B6-E961FB51CFF5}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{6FD34D1E-F4C8-453D-BEBC-74DFC93254D1}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{7C7706FD-9D04-4D31-BC4A-C4C41F8F1ABE}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{B1CE2BB7-5595-465C-875B-2C193DC7C07E}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{80B0ABB8-BE16-45A2-B7F7-B354C3CC8CE6}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exe

FirewallRules: [{7129D5F1-8AFB-45C4-9E00-9A6B1AA46332}] => (Allow) C:\Users\Sarah Care\AppData\Roaming\Dropbox\bin\Dropbox.exe

FirewallRules: [{2219D4A0-EC5E-4110-B8E2-6C02D19DCA77}] => (Allow) C:\Users\Sarah Care\AppData\Roaming\Dropbox\bin\Dropbox.exe

FirewallRules: [{0512054C-5C31-468E-8F10-1E8FDE2A89B7}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{65A42BC2-C7DF-4988-BA9C-1326F62B10AC}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{73705867-71E4-4C1F-BA04-4277AC698EE0}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Faulty Device Manager Devices =============

Name: Touchscreen

Description: Touchscreen

Class Guid:

Manufacturer:

Service:

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

==================== Event log errors: =========================

Application errors:

==================

Error: (09/30/2015 04:55:01 PM) (Source: Application Hang) (EventID: 1002) (User: )

Description: The program N360.exe version 13.0.2.6 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 1020

Start Time: 01d0fba6387b552e

Termination Time: 2588

Application Path: C:\Program Files (x86)\Norton 360\Engine\22.5.4.24\N360.exe

Report Id: 1f78dd6f-67b5-11e5-bbcc-1c75086ca20d

Error: (09/30/2015 01:34:11 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/30/2015 01:28:07 PM) (Source: Desktop Window Manager) (EventID: 9020) (User: )

Description: The Desktop Window Manager has encountered a fatal error (0x8007000e)

Error: (09/30/2015 01:02:49 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 68640

Error: (09/30/2015 01:02:49 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 68640

Error: (09/30/2015 01:02:49 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second

Error: (09/30/2015 01:02:48 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 67642

Error: (09/30/2015 01:02:48 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 67642

Error: (09/30/2015 01:02:48 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second

Error: (09/30/2015 01:02:47 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 66628

System errors:

=============

Error: (09/30/2015 04:47:07 PM) (Source: Application Popup) (EventID: 1060) (User: )

Description: \??\C:\Windows\System32\drivers\TrueSight.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

Error: (09/30/2015 01:34:09 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)

Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)

Error: (09/30/2015 03:34:03 AM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the IPBusEnum service.

Error: (09/29/2015 06:44:51 PM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the IPBusEnum service.

Error: (09/29/2015 08:27:25 AM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Wlansvc service.

Error: (09/29/2015 07:31:56 AM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.

Error: (09/28/2015 08:53:59 PM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the lmhosts service.

Error: (09/26/2015 04:10:55 AM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the lmhosts service.

Error: (09/25/2015 01:08:33 PM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the IPBusEnum service.

Error: (09/25/2015 01:05:18 AM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the IPBusEnum service.

CodeIntegrity:

===================================

Date: 2015-09-30 17:04:38.810