Jump to content

Can't install malwarebytes due to virus: Corrupt file error message


etexe

Recommended Posts

Hey all,

 

I could really use some help with installation of Malwarebytes. I have been attempting to install the program in safe mode from a flash drive, but every time I do, I get an error message saying "Setup was unable to create the directory C:/users/appdate/local/temp/is-FS1CO.tmp: followed by "Error 1392: The file or directory is corrupted and unreadable"... 

I have utilized the MBAM clean tool for a clean uninstall, but this hasn't gotten me anywhere.. I have gotten further than this error message once, only to get about halfway through the install and receive a similar error message. 

I have tried alternatives such as "Windows all in one" and various other scanning instruments, but am unable to run any of them on my PC due to error messages of similar nature.

 

The virus also seems to be creating the same error messages when I try to run just about any other program on my PC, as well as viewing pictures.. Google Chrome won't even open.

 

I have Spybot Search and Destroy, but upon completion of a scan, it restarts and freezes in the same spot before I can resolve any threats.

 

I was able to run my Norton antivirus once (won't open usually), and saw it detect something called info stealer.snifula.b, but it didn't flag it. I also saw one called win32.fraudload.edt, so it is obvious my computer is infected.

I am running windows 8.1 on an HP.

 

I've been battling this issue for a few days thus far, and could really use some help. 

PLEASE AND THANK YOU

Link to post
Share on other sites

It appears as though the entire C: drive is corrupted... I can run programs when moving them to the D drive...

I can only assume this is the work of whatever viruses are on my computer, as the problems began as small glitches and crashes and escalated to this point..

I can't run anything that needs to access the C: drive though.

Link to post
Share on other sites

I haven't tried that recently. I was finally able to run Malwarebytes, which removed 6 threats the first time, and even more the second time. I then ran my Norton Antivirus and removed two more threats. However, I am still getting an error message when trying to access (open, copy, delete, run programs) from the C drive.

Could a virus (or multiple) be responsible for this corrupt message? I'm hoping the drive isn't actually corrupt, although I don't know why it would be, if that were the case.

I will post my FRST re​​ports after work today.

 

 

Link to post
Share on other sites

Here are the logs from FRST: 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:10-01-2015 01

Ran by Zack (administrator) on BOSSPLAYA (11-01-2016 18:26:41)
Running from F:\
Loaded Profiles: Zack (Available Profiles: UpdatusUser & Zack)
Platform: Windows 8.1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Safe Mode (with Networking)
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
 
==================== Registry (Whitelisted) ===========================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [sysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1664000 2012-08-14] (IDT, Inc.)
HKLM\...\Run: [synTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2874168 2012-09-14] (Synaptics Incorporated)
HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491632 2012-09-10] (CyberLink Corp.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)
HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [581024 2012-09-07] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HP CoolSense] => C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe [1342008 2012-09-14] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-05-26] (Apple Inc.)
HKLM-x32\...\Run: [M-Audio Panel Launcher] => C:\Program Files (x86)\M-Audio\M-Track\MAPanel.exe [1190096 2013-04-24] (M-Audio)
HKLM-x32\...\Run: [sDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-1957512214-3067395479-2839608453-1002\...\Run: [steam] => C:\Program Files (x86)\Steam\Steam.exe [2892992 2015-06-04] (Valve Corporation)
HKU\S-1-5-21-1957512214-3067395479-2839608453-1002\...\Run: [bitTorrent] => C:\Users\Zack\AppData\Roaming\BitTorrent\BitTorrent.exe [1873952 2015-12-06] (BitTorrent Inc.)
HKU\S-1-5-21-1957512214-3067395479-2839608453-1002\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [6501656 2014-10-29] (Piriform Ltd)
HKU\S-1-5-21-1957512214-3067395479-2839608453-1002\...\Run: [Copy] => C:\Users\Zack\AppData\Roaming\Copy\CopyAgent.exe [15410832 2015-04-07] (Barracuda Networks, Inc.)
HKU\S-1-5-21-1957512214-3067395479-2839608453-1002\...\Run: [spybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
HKU\S-1-5-21-1957512214-3067395479-2839608453-1002\...\Run: [bubble Dock] => "C:\Users\Zack\AppData\Roaming\Nosibay\Bubble Dock\LBubble Dock.exe" /winstartup
HKU\S-1-5-21-1957512214-3067395479-2839608453-1002\...\MountPoints2: {a0d6b8b7-73a4-11e5-802f-a0b3cc52253a} - "G:\WD SmartWare.exe" autoplay=true
HKU\S-1-5-18\...\Run: [Copy] => C:\Users\Zack\AppData\Roaming\Copy\CopyAgent.exe [15410832 2015-04-07] (Barracuda Networks, Inc.)
ShellIconOverlayIdentifiers: [  OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton Internet Security\Engine64\22.5.5.15\buShell.dll [2015-11-05] (Symantec Corporation)
ShellIconOverlayIdentifiers: [  OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton Internet Security\Engine64\22.5.5.15\buShell.dll [2015-11-05] (Symantec Corporation)
ShellIconOverlayIdentifiers: [  OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton Internet Security\Engine64\22.5.5.15\buShell.dll [2015-11-05] (Symantec Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-01-14] ()
ShellIconOverlayIdentifiers: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-01-14] ()
ShellIconOverlayIdentifiers: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-01-14] ()
ShellIconOverlayIdentifiers: [1aCopyShExtError] -> {83BEA36E-7680-4598-A4DF-994426F6E78D} => C:\Users\Zack\AppData\Roaming\Copy\overlay\CopyShExt.dll [2015-03-06] (Barracuda Networks, Inc.)
ShellIconOverlayIdentifiers: [2aCopyShExtSynced] -> {845B7388-6F85-4F32-9FD5-F02DC7882B89} => C:\Users\Zack\AppData\Roaming\Copy\overlay\CopyShExt.dll [2015-03-06] (Barracuda Networks, Inc.)
ShellIconOverlayIdentifiers: [3aCopyShExtSyncing] -> {F6378A7A-F753-449B-AE1B-997A96132E61} => C:\Users\Zack\AppData\Roaming\Copy\overlay\CopyShExt.dll [2015-03-06] (Barracuda Networks, Inc.)
ShellIconOverlayIdentifiers: [4aCopyShExtSyncingProg1] -> {3A511828-777D-46F8-82F4-5B530C1B3D9E} => C:\Users\Zack\AppData\Roaming\Copy\overlay\CopyShExt.dll [2015-03-06] (Barracuda Networks, Inc.)
ShellIconOverlayIdentifiers: [5aCopyShExtSyncingProg2] -> {C8C88204-5B14-40EC-BA72-8AEBC762047E} => C:\Users\Zack\AppData\Roaming\Copy\overlay\CopyShExt.dll [2015-03-06] (Barracuda Networks, Inc.)
ShellIconOverlayIdentifiers: [6aCopyShExtSyncingProg3] -> {ACFF45C3-3EEB-4351-86C2-6696BA264239} => C:\Users\Zack\AppData\Roaming\Copy\overlay\CopyShExt.dll [2015-03-06] (Barracuda Networks, Inc.)
ShellIconOverlayIdentifiers: [7aCopyShExtSyncingProg4] -> {29AF997F-488B-46F0-AE78-7146F1B89CC3} => C:\Users\Zack\AppData\Roaming\Copy\overlay\CopyShExt.dll [2015-03-06] (Barracuda Networks, Inc.)
ShellIconOverlayIdentifiers: [8aCopyShExtSyncingProg5] -> {03F9AD29-1C78-4B66-8890-B177B5430C53} => C:\Users\Zack\AppData\Roaming\Copy\overlay\CopyShExt.dll [2015-03-06] (Barracuda Networks, Inc.)
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
BootExecute: autocheck autochk * sdnclean64.exe
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Tcpip\Parameters: [DhcpNameServer] 75.75.76.76 75.75.75.75
Tcpip\..\Interfaces\{F255D4F5-805E-4D33-8CD1-6C50082B7CB1}: [DhcpNameServer] 75.75.76.76 75.75.75.75
Tcpip\..\Interfaces\{F811CCDA-5468-4282-A4DA-759DAB7CAA3B}: [DhcpNameServer] 75.75.76.76 75.75.75.75
 
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.msn.com/HPNOT13/1
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPNOT13/1
HKU\S-1-5-21-1957512214-3067395479-2839608453-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.youtube.com/
SearchScopes: HKLM -> {C7F82C5A-78D0-467E-AE51-BBC60F64B27F} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKLM-x32 -> {C7F82C5A-78D0-467E-AE51-BBC60F64B27F} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1957512214-3067395479-2839608453-1002 -> {6CBE31E5-EE1E-433E-BCB5-D8F8E904CA72} URL = hxxp://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=586383&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1957512214-3067395479-2839608453-1002 -> {C7F82C5A-78D0-467E-AE51-BBC60F64B27F} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-1957512214-3067395479-2839608453-1002 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2014-12-02] (Microsoft Corporation)
BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine64\22.5.5.15\coIEPlg.dll [2015-11-05] (Symantec Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-01-14] ()
BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine\22.5.5.15\coIEPlg.dll [2015-11-05] (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\IPS\IPSBHO.DLL => No File
BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-07-25] (Oracle Corporation)
BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-07-25] (Oracle Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2012-07-09] (Hewlett-Packard)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\22.5.5.15\coIEPlg.dll [2015-11-05] (Symantec Corporation)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\22.5.5.15\coIEPlg.dll [2015-11-05] (Symantec Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2014-10-24] (Microsoft Corporation)
 
FireFox:
========
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1166636.dll [2012-08-08] (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-02-21] ()
FF Plugin-x32: @authentec.com/ffwloplugin -> C:\Program Files (x86)\HP SimplePass\npffwloplugin.dll [2012-08-10] ( HP)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-07-25] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-07-25] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-10-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-01] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-01] (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2012-05-11] ()
FF HKLM\...\Firefox\Extensions: [{C1A2A613-35F1-4FCF-B27F-2840527B6556}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_22.5.0.124\coFFAddon
FF Extension: Norton Identity Safe - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_22.5.0.124\coFFAddon [2015-12-15]
FF HKLM-x32\...\Firefox\Extensions: [{C1A2A613-35F1-4FCF-B27F-2840527B6556}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_22.5.0.124\coFFAddon
 
Chrome: 
=======
CHR Profile: C:\Users\Zack\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Zack\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-01-07]
CHR Extension: (Google Docs) - C:\Users\Zack\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-01-07]
CHR Extension: (Google Drive) - C:\Users\Zack\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-01-07]
CHR Extension: (YouTube) - C:\Users\Zack\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-01-07]
CHR Extension: (Google Search) - C:\Users\Zack\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-01-07]
CHR Extension: (Website Logon) - C:\Users\Zack\AppData\Local\Google\Chrome\User Data\Default\Extensions\fegekclkdhbnfdcmomlpegkkndgnmfmo [2016-01-07]
CHR Extension: (Google Sheets) - C:\Users\Zack\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-01-07]
CHR Extension: (Google Docs Offline) - C:\Users\Zack\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-01-07]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Zack\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-01-07]
CHR Extension: (Gmail) - C:\Users\Zack\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-01-07]
CHR HKLM\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Internet Security\Engine\22.5.5.15\Exts\Chrome.crx [2015-11-30]
CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Internet Security\Engine\22.5.5.15\Exts\Chrome.crx [2015-11-30]
CHR HKLM-x32\...\Chrome\Extension: [fegekclkdhbnfdcmomlpegkkndgnmfmo] - C:\Program Files (x86)\HP SimplePass\tschrome.crx [2012-07-12]
CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx
 
==================== Services (Whitelisted) ========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
ATTENTION: => Could not perform signature verification. Cryptographic Service is not running.
 
S2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2802360 2015-11-24] (Microsoft Corporation)
S2 FPLService; C:\Program Files (x86)\HP SimplePass\TrueSuiteService.exe [1641320 2012-08-10] (HP)
S2 HPConnectedRemote; C:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteService.exe [35744 2012-10-12] (Hewlett-Packard)
S2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [314696 2014-05-20] (Intel Corporation)
S2 Intel® ME Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [128896 2012-07-17] (Intel Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)
S2 MBAMService; D:\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
S2 MTrackAudioDevMon; C:\Program Files (x86)\M-Audio\M-Track\AudioDevMon.exe [546816 2013-04-24] (M-Audio)
S2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\22.5.5.15\NIS.exe [282016 2015-11-20] (Symantec Corporation)
S2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
S3 TrueService; C:\Program Files\Common Files\AuthenTec\TrueService.exe [401256 2012-07-16] (AuthenTec, Inc.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)
S2 winoptfilterservice; C:\Program Files (x86)\winoptfilter\WinOptSrv.exe [141440 2015-10-08] (Digital Light Co.)
S2 winoptfilterservice2; C:\Program Files (x86)\winoptfilter\WinOptSrv_.exe [141440 2015-10-08] (Digital Light Co.)
 
===================== Drivers (Whitelisted) ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
S1 BHDrvx64; C:\Program Files (x86)\Norton Internet Security\NortonData\22.5.0.124\Definitions\BASHDefs\20160104.001\BHDrvx64.sys [1665608 2016-01-04] (Symantec Corporation)
S1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1605050.00F\ccSetx64.sys [173808 2015-07-10] (Symantec Corporation)
S1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
R0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [498512 2015-11-17] (Symantec Corporation)
S3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [157520 2015-11-17] (Symantec Corporation)
S3 ffusb2audio; C:\Windows\system32\DRIVERS\ffusb2audio.sys [127280 2013-09-25] (Focusrite Audio Engineering Limited.)
S3 gfiark; C:\Windows\System32\drivers\gfiark.sys [41032 2013-05-23] (ThreatTrack Security)
S3 gfiutil; C:\Windows\System32\drivers\gfiutil.sys [31264 2013-09-04] (ThreatTrack Security)
S1 IDSVia64; C:\Program Files (x86)\Norton Internet Security\NortonData\22.5.0.124\Definitions\IPSDefs\20160106.001\IDSvia64.sys [767224 2016-01-05] (Symantec Corporation)
S3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
R0 MBAMSwissArmy; C:\Windows\System32\drivers\MBAMSwissArmy.sys [192216 2016-01-10] (Malwarebytes)
S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-10-05] (Malwarebytes Corporation)
S3 mm2avs; C:\Windows\System32\Drivers\mm2avs.sys [358520 2012-06-06] (Native Instruments GmbH)
S3 mm2usb_svc; C:\Windows\System32\Drivers\mm2usb.sys [45688 2012-06-06] (Native Instruments GmbH)
S3 MTRACK; C:\Windows\system32\DRIVERS\MAudioMTrack.sys [471040 2013-04-24] (M-Audio)
S3 NAVENG; C:\Program Files (x86)\Norton Internet Security\NortonData\22.5.0.124\Definitions\VirusDefs\20160107.004\ENG64.SYS [138488 2015-10-27] (Symantec Corporation)
S3 NAVEX15; C:\Program Files (x86)\Norton Internet Security\NortonData\22.5.0.124\Definitions\VirusDefs\20160107.004\EX64.SYS [2148080 2015-10-27] (Symantec Corporation)
S3 pbfilter; C:\Program Files\PeerBlock\pbfilter.sys [22600 2014-01-14] ()
S3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [273040 2012-08-08] (Realtek Semiconductor Corp.)
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [41272 2012-09-14] (Synaptics Incorporated)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-09-14] (Synaptics Incorporated)
S1 SRTSP; C:\Windows\System32\Drivers\NISx64\1605050.00F\SRTSP64.SYS [928496 2015-11-11] (Symantec Corporation)
S1 SRTSPX; C:\Windows\system32\drivers\NISx64\1605050.00F\SRTSPX64.SYS [50936 2015-07-10] (Symantec Corporation)
R0 SymEFASI; C:\Windows\System32\drivers\NISx64\1605050.00F\SYMEFASI64.SYS [1621232 2015-11-11] (Symantec Corporation)
S0 SymELAM; C:\Windows\System32\drivers\NISx64\1605050.00F\SymELAM.sys [24192 2015-07-10] (Symantec Corporation)
S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [111344 2015-07-21] (Symantec Corporation)
S1 SymIRON; C:\Windows\system32\drivers\NISx64\1605050.00F\Ironx64.SYS [297720 2015-07-10] (Symantec Corporation)
S1 SymNetS; C:\Windows\System32\Drivers\NISx64\1605050.00F\SYMNETS.SYS [577768 2015-11-11] (Symantec Corporation)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)
R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2012-08-31] (Hewlett-Packard Development Company, L.P.)
S1 SASDIFSV; \??\C:\Users\Zack\AppData\Local\Temp\SAS_SelfExtract\SASDIFSV64.SYS [X]
S1 SASKUTIL; \??\C:\Users\Zack\AppData\Local\Temp\SAS_SelfExtract\SASKUTIL64.SYS [X]
S1 SMR501; \SystemRoot\System32\drivers\SMR501.SYS [X]
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2016-01-11 18:26 - 2016-01-11 18:26 - 00000000 ____D C:\FRST
2016-01-10 23:28 - 2016-01-10 23:28 - 00000882 _____ C:\Pictures - Shortcut.lnk
2016-01-10 22:23 - 2016-01-10 22:23 - 00004040 _____ C:\ProgramData\SMRResults501.dat
2016-01-10 22:16 - 2016-01-11 18:26 - 01953418 _____ C:\WINDOWS\ntbtlog.txt
2016-01-10 21:42 - 2016-01-10 23:17 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2016-01-10 21:42 - 2016-01-10 21:42 - 00000645 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-01-10 21:42 - 2016-01-10 21:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-01-10 18:47 - 2016-01-10 18:47 - 00000274 ____H C:\WINDOWS\Tasks\User_Feed_Synchronization-{5C3BE7DA-81AD-4C57-B4AB-3B09DAA7A9BF}.job
2016-01-10 15:43 - 2016-01-10 21:41 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware
2016-01-10 15:43 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2016-01-10 15:43 - 2015-10-05 09:50 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2016-01-10 15:43 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2016-01-10 15:17 - 2016-01-10 15:17 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-01-09 16:48 - 2016-01-09 16:48 - 00000020 ___SH C:\Users\Zack\ntuser.ini
2016-01-08 21:43 - 2016-01-08 21:44 - 00000000 ____D C:\Users\Zack\Downloads\Rob Papen Plugin Collection 22.04.2014 VST32 VST64 Win - R2R [oddsox]
2016-01-08 18:54 - 2016-01-08 18:54 - 00013103 _____ C:\Users\Zack\Downloads\[kat.cr]rob.papen.plugins.latest.win.12.2015.r2r.oddsox.torrent
2016-01-08 18:35 - 2016-01-08 18:35 - 00720373 _____ C:\WINDOWS\unins000.exe
2016-01-08 18:13 - 2016-01-08 18:13 - 00000000 ____D C:\Users\Zack\AppData\Local\Apple
2016-01-07 23:11 - 2016-01-07 23:11 - 00001509 _____ C:\Users\Zack\Desktop\Ableton Live 9 Suite - Shortcut.lnk
2016-01-07 23:09 - 2016-01-10 18:47 - 00000000 ____D C:\Users\Zack\AppData\Local\CrashDumps
2016-01-07 23:05 - 2016-01-07 23:05 - 00000905 _____ C:\Users\Zack\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ableton Live 9.5 Suite.lnk
2016-01-07 23:05 - 2016-01-07 23:05 - 00000000 ____D C:\ProgramData\Ableton
2016-01-07 22:43 - 2016-01-07 23:03 - 00000000 ____D C:\Users\Zack\Downloads\Ableton live Suite v9.5 WiN x86 x64-d33p57a7u5
2016-01-07 22:43 - 2016-01-07 22:43 - 00019023 _____ C:\Users\Zack\Downloads\[kat.cr]ableton.live.suite.v9.5.win.x86.x64.d33p57a7u5 (3).torrent
2016-01-07 22:42 - 2016-01-07 22:42 - 00019023 _____ C:\Users\Zack\Downloads\[kat.cr]ableton.live.suite.v9.5.win.x86.x64.d33p57a7u5 (2).torrent
2016-01-07 22:32 - 2016-01-07 22:32 - 00000901 _____ C:\Users\Zack\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ableton Live 9 Suite.lnk
2016-01-07 21:27 - 2016-01-07 21:27 - 00002279 _____ C:\Users\Zack\Desktop\Google Chrome.lnk
2016-01-07 20:58 - 2016-01-07 22:36 - 00000000 ____D C:\Users\Zack\Desktop\ableton_live_suite_9.5_64
2016-01-07 20:40 - 2016-01-10 21:53 - 00000000 ____D C:\Users\Zack\AppData\LocalLow\BitTorrent
2016-01-06 23:11 - 2016-01-06 23:26 - 1981452851 _____ C:\Users\Zack\Documents\LoopmastersMixtape_r32903_v9.0.alp
2016-01-02 14:48 - 2016-01-02 20:48 - 00000000 ____D C:\Users\Zack\VST PRESETS
2015-12-16 18:10 - 2015-12-16 20:00 - 00000000 ____D C:\Users\Zack\Documents\Writing Samples DMM
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2016-01-11 18:26 - 2013-08-22 08:36 - 00000000 ____D C:\Windows
2016-01-11 17:42 - 2015-03-06 10:48 - 00000000 ____D C:\Users\Zack\AppData\Roaming\Copy
2016-01-11 17:39 - 2013-08-22 09:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-01-11 17:35 - 2015-04-10 12:42 - 00000922 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2016-01-11 17:35 - 2014-10-21 23:09 - 00000000 __RDO C:\Users\Zack\OneDrive
2016-01-11 17:34 - 2013-08-15 17:25 - 00000000 ____D C:\Users\Zack\AppData\LocalLow\AuthenTec
2016-01-11 17:33 - 2014-10-21 21:09 - 00000000 ____D C:\Users\Zack
2016-01-10 23:34 - 2013-08-22 10:36 - 00000000 ____D C:\WINDOWS\vpnplugins
2016-01-10 23:15 - 2015-10-15 16:20 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2016-01-10 22:43 - 2015-10-15 16:20 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2016-01-10 22:31 - 2013-08-22 08:36 - 00000000 ____D C:\WINDOWS\Inf
2016-01-10 22:30 - 2013-08-15 17:35 - 00003598 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1957512214-3067395479-2839608453-1002
2016-01-10 22:28 - 2015-04-23 15:31 - 00000000 ____D C:\Users\Zack\AppData\Local\NPE
2016-01-10 22:27 - 2013-08-15 23:01 - 00000000 ____D C:\Program Files (x86)\Steam
2016-01-10 21:53 - 2013-08-26 03:15 - 00000000 ____D C:\Users\Zack\AppData\Roaming\BitTorrent
2016-01-10 21:39 - 2015-10-17 00:01 - 00000000 ____D C:\Users\Zack\AppData\Roaming\Ableton
2016-01-10 17:49 - 2013-08-22 08:25 - 00262144 ___SH C:\WINDOWS\system32\config\ELAM
2016-01-10 13:03 - 2014-09-24 02:15 - 00339546 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-01-10 12:58 - 2015-02-18 13:07 - 00000000 ____D C:\WINDOWS\pss
2016-01-10 10:29 - 2013-08-22 10:36 - 00000000 ___HD C:\Program Files\WindowsApps
2016-01-10 10:29 - 2013-08-22 10:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-01-10 10:20 - 2014-11-13 22:56 - 00000000 __SHD C:\Users\Zack\AppData\LocalLow\EmieUserList
2016-01-10 10:20 - 2014-11-13 22:56 - 00000000 __SHD C:\Users\Zack\AppData\LocalLow\EmieSiteList
2016-01-09 18:12 - 2015-04-10 12:42 - 00000926 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2016-01-08 18:55 - 2014-12-28 03:14 - 00000000 ____D C:\Program Files\PeerBlock
2016-01-08 18:35 - 2014-07-14 20:09 - 00014507 _____ C:\WINDOWS\unins000.dat
2016-01-08 18:35 - 2013-08-26 04:53 - 00000000 ____D C:\Program Files (x86)\VstPlugins
2016-01-08 18:28 - 2013-08-15 17:27 - 00003926 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{5C3BE7DA-81AD-4C57-B4AB-3B09DAA7A9BF}
2016-01-08 07:39 - 2014-01-31 20:38 - 00000000 ____D C:\Users\Zack\Documents\SOUNDZZZZ
2016-01-07 23:09 - 2015-12-07 19:18 - 00000000 ____D C:\WINDOWS\System32\Tasks\Remediation
2016-01-07 23:07 - 2015-01-06 20:50 - 00000000 ____D C:\ProgramData\Package Cache
2016-01-07 18:01 - 2015-10-17 00:01 - 00000000 ____D C:\Users\Zack\Documents\Ableton
2016-01-06 22:54 - 2013-12-26 18:20 - 00000000 ____D C:\Program Files\Native Instruments
2016-01-06 22:07 - 2015-03-06 10:49 - 00000000 ___RD C:\Users\Zack\Copy
2016-01-05 19:26 - 2013-08-22 08:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2015-12-31 16:52 - 2012-07-26 02:59 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-12-27 23:02 - 2015-03-02 15:09 - 00000000 ____D C:\WINDOWS\Minidump
2015-12-26 03:48 - 2014-09-24 04:55 - 00826872 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-12-26 03:48 - 2014-09-24 04:55 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-12-19 17:31 - 2015-04-20 14:39 - 00000000 ___SD C:\WINDOWS\SysWOW64\GWX
2015-12-19 17:31 - 2015-04-20 14:39 - 00000000 ___SD C:\WINDOWS\system32\GWX
2015-12-16 20:14 - 2013-08-15 17:24 - 00000000 ____D C:\Users\Zack\AppData\Local\Packages
2015-12-16 20:13 - 2014-01-29 18:09 - 00000000 ____D C:\Users\Zack\Documents\POEMS AND SUCH
2015-12-15 17:38 - 2013-08-26 01:50 - 00000000 ____D C:\Program Files\Microsoft Office 15
2015-12-13 18:04 - 2013-08-22 09:44 - 00381968 _____ C:\WINDOWS\system32\FNTCACHE.DAT
 
==================== Files in the root of some directories =======
 
2013-08-15 17:26 - 2013-08-15 17:26 - 0000141 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.64.bc
2016-01-10 22:23 - 2016-01-10 22:23 - 0004040 _____ () C:\ProgramData\SMRResults501.dat
 
Files to move or delete:
====================
C:\ProgramData\SMRResults501.dat
 
 
==================== Bamital & volsnap =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\WINDOWS\system32\winlogon.exe
[2015-12-08 16:53] - [2015-10-05 13:25] - 0572928 ____A (Microsoft Corporation) 3F8645885823692D93765817759BE21C
 
C:\WINDOWS\system32\wininit.exe
[2015-12-08 16:53] - [2015-10-05 13:28] - 0146432 ____A (Microsoft Corporation) EC302D06155F8E3C383750993FCB6B27
 
C:\WINDOWS\explorer.exe
[2015-03-10 18:07] - [2015-01-27 18:47] - 2501368 ____A (Microsoft Corporation) C10A66189DC8C090E7C84873EDCEBC88
 
C:\WINDOWS\SysWOW64\explorer.exe
[2015-03-10 18:07] - [2015-01-27 18:41] - 2207488 ____A (Microsoft Corporation) 91E24273FCA076EA9E65DAFA98901225
 
C:\WINDOWS\system32\svchost.exe
[2015-03-19 14:08] - [2014-10-28 23:11] - 0038792 ____A (Microsoft Corporation) E3A2AD05E24105B35E986CF9CB38EC47
 
C:\WINDOWS\SysWOW64\svchost.exe
[2015-03-19 14:08] - [2014-10-28 22:17] - 0033088 ____A (Microsoft Corporation) D0ABC231C0B3E88C6B612B28ABBF734D
 
C:\WINDOWS\system32\services.exe
[2015-05-14 00:15] - [2015-04-08 17:55] - 0410128 ____A (Microsoft Corporation) E0C7813A97CA7947FF5C18A8F3B61A45
 
C:\WINDOWS\system32\User32.dll
[2015-12-08 16:53] - [2015-11-08 19:41] - 1540728 ____A (Microsoft Corporation) 33094E2182C451BCFCFD60F734B1C4EF
 
C:\WINDOWS\SysWOW64\User32.dll
[2015-12-08 16:53] - [2015-11-08 15:48] - 1376256 ____A (Microsoft Corporation) 72DF14DA8F1CC15F7BE4176DE0404D9E
 
C:\WINDOWS\system32\userinit.exe
[2015-03-19 14:08] - [2014-10-28 20:28] - 0026112 ____A (Microsoft Corporation) 5C131534A3EA4A461A793FB507A8004F
 
C:\WINDOWS\SysWOW64\userinit.exe
[2015-03-19 14:08] - [2014-10-28 20:05] - 0022528 ____A (Microsoft Corporation) D10643FC0095434C819316CA6CD748C0
 
C:\WINDOWS\system32\rpcss.dll
[2015-03-19 14:10] - [2014-10-28 20:19] - 0817664 ____A (Microsoft Corporation) A6F17C299A03BAFEFB9257C462A19E00
 
C:\WINDOWS\system32\dnsapi.dll
[2015-03-19 14:10] - [2014-10-28 20:30] - 0657920 ____A (Microsoft Corporation) A5675939CF0F99B20B5A3CFCC3C1B46A
 
C:\WINDOWS\SysWOW64\dnsapi.dll
[2015-03-19 14:10] - [2014-10-28 20:06] - 0498688 ____A (Microsoft Corporation) BD9C7A068C46053F8747CEA73B5930AB
 
C:\WINDOWS\system32\Drivers\volsnap.sys => MD5 is legit
 
 
LastRegBack: 2015-01-25 22:53
 
==================== End of FRST.txt ============================

​Additional scan result of Farbar Recovery Scan Tool (x64) Version:10-01-2015 01

Ran by Zack (2016-01-11 18:27:32)
Running from F:\
Windows 8.1 (X64) (2014-10-22 04:05:09)
Boot Mode: Safe Mode (with Networking)
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-1957512214-3067395479-2839608453-500 - Administrator - Disabled)
Guest (S-1-5-21-1957512214-3067395479-2839608453-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1957512214-3067395479-2839608453-1004 - Limited - Enabled)
UpdatusUser (S-1-5-21-1957512214-3067395479-2839608453-1001 - Limited - Enabled) => C:\Users\UpdatusUser
Zack (S-1-5-21-1957512214-3067395479-2839608453-1002 - Administrator - Enabled) => C:\Users\Zack
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: Norton Internet Security (Enabled - Out of date) {53C7D717-52E2-B95E-FA61-6F32ECC805DB}
AV: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: Norton Internet Security (Enabled - Out of date) {E8A636F3-74D8-B6D0-C0D1-5440974F4F66}
FW: Norton Internet Security (Enabled) {6BFC5632-188D-B806-D13E-C607121B42A0}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
4 Elements II (x32 Version: 2.2.0.98 - WildTangent) Hidden
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Ableton Live 9 Intro (HKLM\...\{703D1131-DCA5-4B27-B7A4-40B734D5D7D4}) (Version: 9.0.0.0 - Ableton)
Ableton Live 9 Suite (HKLM\...\{7597F2DC-003A-476E-9281-774AB112B7BE}) (Version: 9.0.0.0 - Ableton)
Adobe Shockwave Player 11.6 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.6.6.636 - Adobe Systems, Inc.)
Apple Application Support (HKLM-x32\...\{D9DAD0FF-495A-472B-9F10-BAE430A26682}) (Version: 3.0.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ASIO4ALL (HKLM-x32\...\ASIO4ALL) (Version: 2.10 - Michael Tippach)
AuthenTec TrueAPI 64-bit (Version: 1.6.0.86 - AuthenTec, Inc.) Hidden
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
BitTorrent (HKU\S-1-5-21-1957512214-3067395479-2839608453-1002\...\BitTorrent) (Version: 7.9.5.41373 - BitTorrent Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Build-a-lot 4 - Power Source (x32 Version: 2.2.0.98 - WildTangent) Hidden
Camel Audio Alchemy64 (HKLM-x32\...\Camel Audio Alchemy64) (Version: 1.25.0 - Camel Audio)
CCleaner (HKLM\...\CCleaner) (Version: 4.19 - Piriform)
Copy (HKLM\...\{6C680D3E-8940-4FEA-BA3A-E57825C691AF}) (Version: 1.48.456.0 - Barracuda Networks, Inc.)
Counter-Strike: Source (HKLM-x32\...\Steam App 240) (Version:  - Valve)
Cradle Of Egypt Collector's Edition (x32 Version: 2.2.0.98 - WildTangent) Hidden
Cradle of Rome 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.2.5712 - CyberLink Corp.)
CyberLink Media Suite 10 (HKLM-x32\...\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.2.2114 - CyberLink Corp.)
CyberLink PhotoDirector (HKLM-x32\...\InstallShield_{4862344A-A39C-4897-ACD4-A1BED5163C5A}) (Version: 2.0.2.3317 - CyberLink Corp.)
CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.2.2110 - CyberLink Corp.)
CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.2.2126 - CyberLink Corp.)
CyberLink PowerDVD (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.7.4528 - CyberLink Corp.)
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.5.5811 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Energy Star (HKLM-x32\...\{FC0ADA4D-8FA5-4452-8AFF-F0A0BAC97EF7}) (Version: 1.0.9 - Hewlett-Packard Company)
Farm Frenzy (x32 Version: 2.2.0.98 - WildTangent) Hidden
FATE: The Cursed King (x32 Version: 2.2.0.97 - WildTangent) Hidden
Final Drive Fury (x32 Version: 2.2.0.95 - WildTangent) Hidden
Focusrite USB 2.0 Audio Driver 2.5.1 (HKLM\...\Focusrite USB 2.0 Audio Driver_is1) (Version: 2.5.1 - Focusrite Audio Engineering Limited.)
Fracture version 1.0 (HKLM-x32\...\{0BF82F4F-37CC-4A00-A20E-B24AA8D90160}_is1) (Version: 1.0 - Glitchmachines)
Gardenscapes: Mansion Makeover (x32 Version: 3.0.2.32 - WildTangent) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 47.0.2526.106 - Google Inc.)
Google Update Helper (x32 Version: 1.3.29.1 - Google Inc.) Hidden
Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.95 - WildTangent) Hidden
Hewlett-Packard ACLM.NET v1.2.1.1 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
House of 1000 Doors: Family Secrets (x32 Version: 2.2.0.98 - WildTangent) Hidden
Hoyle Card Games (x32 Version: 2.2.0.95 - WildTangent) Hidden
HP 3D DriveGuard (HKLM\...\{6821D775-9303-46DD-977A-2D97CA18B054}) (Version: 4.2.8.1 - Hewlett-Packard Company)
HP Connected Music (Meridian - installer) (HKLM-x32\...\StartHPConnectedMusic) (Version: v1.0 - Meridian Audio Ltd)
HP Connected Remote (HKLM-x32\...\{F243A34B-AB7F-4065-B770-B85B767C247C}) (Version: 1.0.1218 - Hewlett-Packard)
HP CoolSense (HKLM-x32\...\{8704FEEF-A6A8-4E7E-B124-BD6122C66E2C}) (Version: 2.10.42 - Hewlett-Packard Company)
HP Documentation (HKLM-x32\...\{53D3E126-699A-4D92-AA66-6560D573553E}) (Version: 1.2.0.0 - Hewlett-Packard)
HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.3.0 - WildTangent)
HP MyRoom (HKLM-x32\...\{9C35EDE5-4B0F-45E7-A438-314BA889948E}) (Version: 9.0.0.0 - Hewlett-Packard Company)
HP Quick Launch (HKLM-x32\...\{E5823036-6F09-4D0A-B05C-E2BAA129288A}) (Version: 3.0.6 - Hewlett-Packard Company)
HP Registration Service (HKLM\...\{C2E428EB-116E-41C0-9E84-B22DE9CCA42F}) (Version: 1.1.6232.4245 - Hewlett-Packard)
HP SimplePass (HKLM-x32\...\{34C821CA-6B55-44A0-8A9B-2EF471D6019E}) (Version: 6.0.100.244 - Hewlett-Packard)
HP Support Assistant (HKLM-x32\...\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}) (Version: 7.0.39.15 - Hewlett-Packard Company)
HP Utility Center (HKLM-x32\...\{0C57987A-A03A-4B95-A309-D23F78F406CA}) (Version: 1.0.8 - Hewlett-Packard)
HP Wireless Button Driver (HKLM-x32\...\{941DE69D-6CEE-4171-8F1F-3D7E352AA498}) (Version: 1.0.6.1 - Hewlett-Packard Company)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6423.0 - IDT)
Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3621 - Intel Corporation)
Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.9.1002 - Intel Corporation)
Intel® SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
iTunes (HKLM\...\{5A68A656-979F-4168-8795-E2E368AA4DC2}) (Version: 11.2.2.3 - Apple Inc.)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.670 - Oracle)
JBridge (HKLM-x32\...\JBridge) (Version:  - JBridge)
Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden
Left 4 Dead 2 (HKLM-x32\...\Steam App 550) (Version:  - Valve)
Luxor Evolved (x32 Version: 2.2.0.98 - WildTangent) Hidden
Mahjongg Dimensions Deluxe: Tiles in Time (x32 Version: 2.2.0.98 - WildTangent) Hidden
Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
M-Audio M-Track Driver 1.0.6 (x64) (HKLM\...\{7E76C229-D68D-480E-BB99-DAF73BE3C67B}) (Version: 1.0.6 - M-Audio)
Max 6.1.10 (x64) (HKLM\...\{C8F67FDD-EE0B-4F60-9FAD-1B49C4E2EB63}) (Version: 136.1.10 - Cycling '74)
Microsoft Office Home and Student 2013 - en-us (HKLM\...\HomeStudentRetail - en-us) (Version: 15.0.4779.1002 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1957512214-3067395479-2839608453-1002\...\OneDriveSetup.exe) (Version: 17.3.6281.1202 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Mortimer Beckett and the Crimson Thief Premium Edition (x32 Version: 2.2.0.98 - WildTangent) Hidden
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mystery P.I. - Curious Case of Counterfeit Cove (x32 Version: 2.2.0.98 - WildTangent) Hidden
Native Instruments Abbey Road 60s Drummer (HKLM-x32\...\Native Instruments Abbey Road 60s Drummer) (Version:  - Native Instruments)
Native Instruments Absynth 5 (HKLM-x32\...\Native Instruments Absynth 5) (Version:  - Native Instruments)
Native Instruments Battery 4 (HKLM-x32\...\Native Instruments Battery 4) (Version: 4.0.0.1981 - Native Instruments)
Native Instruments Battery 4 Factory Library (HKLM-x32\...\Native Instruments Battery 4 Factory Library) (Version: 1.0.0.002 - Native Instruments)
Native Instruments Berlin Concert Grand (HKLM-x32\...\Native Instruments Berlin Concert Grand) (Version:  - Native Instruments)
Native Instruments Controller Editor (HKLM-x32\...\Native Instruments Controller Editor) (Version: 1.6.1.1657 - Native Instruments)
Native Instruments FM8 (HKLM-x32\...\Native Instruments FM8) (Version:  - Native Instruments)
Native Instruments Guitar Rig 5 (HKLM-x32\...\Native Instruments Guitar Rig 5) (Version:  - Native Instruments)
Native Instruments Guitar Rig Mobile I/O (HKLM-x32\...\Native Instruments Guitar Rig Mobile I/O) (Version:  - Native Instruments)
Native Instruments Guitar Rig Pro Library for Maschine (HKLM-x32\...\Native Instruments Guitar Rig Pro Library for Maschine) (Version:  - Native Instruments)
Native Instruments Guitar Rig Session I/O (HKLM-x32\...\Native Instruments Guitar Rig Session I/O) (Version:  - Native Instruments)
Native Instruments Komplete 9 (HKLM-x32\...\Native Instruments Komplete 9) (Version:  - Native Instruments)
Native Instruments Komplete Selection (HKLM-x32\...\Native Instruments Komplete Selection) (Version:  - Native Instruments)
Native Instruments Kontakt 5 (HKLM-x32\...\Native Instruments Kontakt 5) (Version: 5.3.1.37 - Native Instruments)
Native Instruments Kontakt Factory Library (HKLM-x32\...\Native Instruments Kontakt Factory Library) (Version:  - Native Instruments)
Native Instruments Maschine 2 (HKLM-x32\...\Native Instruments Maschine 2) (Version: 2.0.6.1083 - Native Instruments)
Native Instruments Maschine 2 Factory Library (HKLM-x32\...\Native Instruments Maschine 2 Factory Library) (Version: 1.0.0.12 - Native Instruments)
Native Instruments Maschine Controller Driver (HKLM-x32\...\Native Instruments Maschine Controller Driver) (Version:  - Native Instruments)
Native Instruments Maschine Controller MK2 Driver (HKLM-x32\...\Native Instruments Maschine Controller MK2 Driver) (Version:  - Native Instruments)
Native Instruments Maschine Mikro Driver (HKLM-x32\...\Native Instruments Maschine Mikro Driver) (Version:  - Native Instruments)
Native Instruments Maschine Mikro MK2 Driver (HKLM-x32\...\Native Instruments Maschine Mikro MK2 Driver) (Version:  - Native Instruments)
Native Instruments Maschine Studio Driver (HKLM-x32\...\Native Instruments Maschine Studio Driver) (Version:  - Native Instruments)
Native Instruments Massive (HKLM-x32\...\Native Instruments Massive) (Version: 1.4.0.292 - Native Instruments)
Native Instruments Monark (HKLM-x32\...\Native Instruments Monark) (Version:  - Native Instruments)
Native Instruments New York Concert Grand (HKLM-x32\...\Native Instruments New York Concert Grand) (Version:  - Native Instruments)
Native Instruments Rammfire (HKLM-x32\...\Native Instruments Rammfire) (Version:  - Native Instruments)
Native Instruments Rammfire for Maschine (HKLM-x32\...\Native Instruments Rammfire for Maschine) (Version:  - Native Instruments)
Native Instruments Reaktor 5 (HKLM-x32\...\Native Instruments Reaktor 5) (Version: 5.9.2.1074 - Native Instruments)
Native Instruments Reaktor Prism (HKLM-x32\...\Native Instruments Reaktor Prism) (Version: 1.4.0.10 - Native Instruments)
Native Instruments Reaktor Spark R2 (HKLM-x32\...\Native Instruments Reaktor Spark R2) (Version:  - Native Instruments)
Native Instruments Reflektor (HKLM-x32\...\Native Instruments Reflektor) (Version:  - Native Instruments)
Native Instruments Reflektor for Maschine (HKLM-x32\...\Native Instruments Reflektor for Maschine) (Version:  - Native Instruments)
Native Instruments Retro Machines Mk2 (HKLM-x32\...\Native Instruments Retro Machines Mk2) (Version:  - Native Instruments)
Native Instruments Rig Kontrol 3 (HKLM-x32\...\Native Instruments Rig Kontrol 3) (Version:  - Native Instruments)
Native Instruments Scarbee Mark I (HKLM-x32\...\Native Instruments Scarbee Mark I) (Version: 1.3.0.7 - Native Instruments)
Native Instruments Scarbee MM-Bass (HKLM-x32\...\Native Instruments Scarbee MM-Bass) (Version:  - Native Instruments)
Native Instruments Scarbee Vintage Keys (HKLM-x32\...\Native Instruments Scarbee Vintage Keys) (Version:  - Native Instruments)
Native Instruments Service Center (HKLM-x32\...\Native Instruments Service Center) (Version: 2.5.2.1549 - Native Instruments)
Native Instruments Session Strings (HKLM-x32\...\Native Instruments Session Strings) (Version:  - Native Instruments)
Native Instruments Solid Bus Comp FX (HKLM-x32\...\Native Instruments Solid Bus Comp FX) (Version: 1.0.0.276 - Native Instruments)
Native Instruments Solid Dynamics FX (HKLM-x32\...\Native Instruments Solid Dynamics FX) (Version: 1.0.0.276 - Native Instruments)
Native Instruments Solid EQ FX (HKLM-x32\...\Native Instruments Solid EQ FX) (Version: 1.0.0.276 - Native Instruments)
Native Instruments Studio Drummer (HKLM-x32\...\Native Instruments Studio Drummer) (Version:  - Native Instruments)
Native Instruments The Finger R2 (HKLM-x32\...\Native Instruments The Finger R2) (Version:  - Native Instruments)
Native Instruments The Giant (HKLM-x32\...\Native Instruments The Giant) (Version:  - Native Instruments)
Native Instruments Traktors 12 (HKLM-x32\...\Native Instruments Traktors 12) (Version:  - Native Instruments)
Native Instruments Traktors 12 for Maschine (HKLM-x32\...\Native Instruments Traktors 12 for Maschine) (Version:  - Native Instruments)
Native Instruments Transient Master FX (HKLM-x32\...\Native Instruments Transient Master FX) (Version:  - Native Instruments)
Native Instruments Upright Piano (HKLM-x32\...\Native Instruments Upright Piano) (Version:  - Native Instruments)
Native Instruments Vienna Concert Grand (HKLM-x32\...\Native Instruments Vienna Concert Grand) (Version:  - Native Instruments)
Native Instruments Vintage Organs (HKLM-x32\...\Native Instruments Vintage Organs) (Version:  - Native Instruments)
Native Instruments West Africa (HKLM-x32\...\Native Instruments West Africa) (Version:  - Native Instruments)
Network Secured DNS (HKLM-x32\...\DnsIo) (Version: 1.52.0.0 - Network Secured DNS)
Norton Internet Security (HKLM-x32\...\NIS) (Version: 22.5.5.15 - Symantec Corporation)
Novation Launch Control XL Editor version 1.0 (HKLM-x32\...\{CAAF2F99-674E-457a-854A-94051D5F5B18}_is1) (Version: 1.0 - Focusrite Audio Engineering Ltd.)
NVIDIA Graphics Driver 331.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 331.65 - NVIDIA Corporation)
NVIDIA Update 1.10.8 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.10.8 - NVIDIA Corporation)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4693.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4693.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4693.1002 - Microsoft Corporation) Hidden
PeerBlock 1.2 (r693) (HKLM\...\{015C5B35-B678-451C-9AEE-821E8D69621C}_is1) (Version: 1.2.0.693 - PeerBlock, LLC)
Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden
Penguins! (x32 Version: 2.2.0.98 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Polar Golfer (x32 Version: 2.2.0.98 - WildTangent) Hidden
Ralink RT5390R 802.11bgn Wi-Fi Adapter (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 5.0.5.0 - Ralink)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.2.612.2012 - Realtek)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.2.8400.29034 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Roads of Rome 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Royal Envoy 2 Collector's Edition (x32 Version: 3.0.2.32 - WildTangent) Hidden
Scarlett Plug-in Suite 1.7 (HKLM-x32\...\{D7F912D4-C237-4079-966A-5044A5025CBF}}_is1) (Version: 1.7 - Focusrite)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.15.0 - Synaptics Incorporated)
Tales of Lagoona (x32 Version: 2.2.0.110 - WildTangent) Hidden
Team Fortress 2 (HKLM-x32\...\Steam App 440) (Version:  - Valve)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Validity WBF DDK (HKLM\...\{1F91C200-8F0F-4009-A75E-DB6CE151BD4E}) (Version: 4.4.234.0 - Validity Sensors, Inc.)
WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.3.0 - WildTangent)
WildTangent Games App (x32 Version: 4.0.9.7 - WildTangent) Hidden
Window Optimizer (HKU\S-1-5-21-1957512214-3067395479-2839608453-1002\...\Window Optimizer) (Version: 1.27 - Digital Light Co.)
Windows Driver Package - Focusrite USB 2.0 Audio Driver (09/25/2013 2.5.128.1) (HKLM\...\CF1FC201D237269A9CD51A3A6B14ADBF67175C32) (Version: 09/25/2013 2.5.128.1 - Focusrite)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Youda Jewel Shop (x32 Version: 3.0.2.32 - WildTangent) Hidden
Zuma's Revenge (x32 Version: 2.2.0.98 - WildTangent) Hidden
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
CustomCLSID: HKU\S-1-5-21-1957512214-3067395479-2839608453-1002_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {02027014-6DA5-43E5-A0C1-0C825A9416F0} - System32\Tasks\{28C5B692-F3F3-46E3-9DE5-0C71F9A07952} => pcalua.exe -a C:\Users\Zack\AppData\Roaming\SSN\uninstall.exe
Task: {0D8A6DBC-72AB-4A32-938D-DFCB6ADAD0BF} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\22.5.5.15\SymErr.exe [2015-11-05] (Symantec Corporation)
Task: {19CE6A74-71D1-448F-8CEE-765DF60D6EF0} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2012-09-05] (Hewlett-Packard Company)
Task: {1A5C64FF-B11F-439C-AF0B-D0E4131789FF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-04-10] (Google Inc.)
Task: {2F2806BD-82EC-41A8-9642-E77BEAB77C5F} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-10-13] (Microsoft Corporation)
Task: {3BF80125-DC19-4D2C-A18F-C05CCF5B6F82} - System32\Tasks\CLMLSvc_P2G8 => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [2012-06-07] (CyberLink)
Task: {4D5EA519-0B46-4C97-BE92-234FAE565B29} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {60D8FD05-B24A-47A3-B256-5423C887EC94} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-10-29] (Piriform Ltd)
Task: {61B63C27-A5EE-4FD6-9AA5-591901C06F47} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {6FBFC01B-5F89-450D-B6A3-E9C4349E64A1} - System32\Tasks\{215602C0-0825-46B9-AABD-32562D4E49E2} => pcalua.exe -a "C:\Program Files (x86)\jogotempo\uninst.exe"
Task: {8770F09D-95EB-40C2-9AFD-965E9645DEDB} - System32\Tasks\Synaptics TouchPad Enhancements => Program Files\Synaptics\SynTP\SynTPEnh.exe
Task: {8966AFC4-9868-4C7B-8E79-54553E270F68} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
Task: {8CB92F5B-37E5-40FE-8296-7977C10B3017} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2012-10-12] (CyberLink)
Task: {93347EE8-C1BE-4B8E-99E0-9FC7CFEACE30} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\22.5.5.15\SymErr.exe [2015-11-05] (Symantec Corporation)
Task: {9D950182-6CA6-44B8-BC9B-539AED12241A} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
Task: {AB9E7401-B1BC-44FB-93E3-59011876A335} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-1957512214-3067395479-2839608453-1002 => C:\Users\Zack\AppData\Local\Microsoft\OneDrive\OneDrive.exe [2015-12-11] (Microsoft Corporation)
Task: {AF322C87-2D69-44F0-A16A-EAB217531E22} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-04-10] (Google Inc.)
Task: {BA48FCCD-F364-42BF-B684-E7B4DCC4D3D1} - System32\Tasks\Microsoft\Windows\UPnP\UPnPHostConfig => config upnphost start= auto
Task: {F162DBE3-BBD5-4276-A1C4-D17F4E5170FA} - System32\Tasks\Remediation\AntimalwareMigrationTask => C:\Program Files\Common Files\AV\Norton Internet Security\Upgrade.exe [2015-11-23] (Symantec Corporation)
Task: {F39E1382-908F-463B-977A-FE520C556C14} - System32\Tasks\K9-PCP => C:\Program Files (x86)\K9-PCFixer\k9schedule.exe
Task: {F4EF0E12-325B-4C3F-A6A2-022C1B0FDE1A} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\22.5.5.15\WSCStub.exe [2015-11-23] (Symantec Corporation)
Task: {F545CE86-9657-49A4-A65C-F6CD8344B0D6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
Task: {F8DB6AD2-7F64-431F-91DC-E46D8C4C39CA} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-12-10] (Microsoft Corporation)
Task: {FE0164F0-24F0-4344-ACD3-B747FA48A6C9} - \RegClean Pro -> No File <==== ATTENTION
Task: {FFD24C81-3212-4EE7-854D-0E8EDFF903A2} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-10-13] (Microsoft Corporation)
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
Task: C:\WINDOWS\Tasks\User_Feed_Synchronization-{5C3BE7DA-81AD-4C57-B4AB-3B09DAA7A9BF}.job => C:\WINDOWS\system32\msfeedssync.exe
 
==================== Shortcuts =============================
 
(The entries could be listed to be restored or removed.)
 
==================== Loaded Modules (Whitelisted) ==============
 
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMSwissArmy => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMSwissArmy => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MSIServer => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SMR501 => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="2"
 
==================== EXE Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
 
==================== Hosts content: ===============================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2013-08-22 08:25 - 2013-08-22 08:25 - 00000824 ____N C:\WINDOWS\system32\Drivers\etc\hosts
 
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-1957512214-3067395479-2839608453-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Zack\AppData\Roaming\Microsoft\Windows Photo Viewer\Windows Photo Viewer Wallpaper.jpg
DNS Servers: Media is not connected to internet.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-1957512214-3067395479-2839608453-1002\...\StartupApproved\Run: => "BitTorrent"
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{56DC4E7B-F25F-4F5E-BE8B-B3A71C708244}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exe
FirewallRules: [uDP Query User{DE365860-C1C3-4860-A903-1F04000BAF75}C:\program files (x86)\steam\steam.exe] => (Allow) C:\program files (x86)\steam\steam.exe
FirewallRules: [TCP Query User{CA3F5FDF-06B1-446D-83FC-0C6F5C9BD786}C:\program files (x86)\steam\steam.exe] => (Allow) C:\program files (x86)\steam\steam.exe
FirewallRules: [{CA639CAD-8562-4FF5-9A39-058AE7AE057A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Team Fortress 2\hl2.exe
FirewallRules: [{2AE0CDA7-E14B-4BB5-9A25-629074D35E4B}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Team Fortress 2\hl2.exe
FirewallRules: [{C036F94B-B68E-4483-8659-83DC04DDFDF9}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Left 4 Dead 2\left4dead2.exe
FirewallRules: [{A2276020-1DF5-45DC-B328-90EDD53ED849}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Left 4 Dead 2\left4dead2.exe
FirewallRules: [{7AF8F440-E6DF-4567-9E8B-3A170C238097}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Team Fortress 2\hl2.exe
FirewallRules: [{3962D227-0AC8-4A30-BB20-5B8416AC4C82}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Team Fortress 2\hl2.exe
FirewallRules: [{D7279A2B-9367-41BF-A24A-309260B5EFA2}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Counter-Strike Source\hl2.exe
FirewallRules: [{4EE60DC0-3A6C-48CF-ABA4-ECA8A8BA3F52}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Counter-Strike Source\hl2.exe
FirewallRules: [{91AA5670-733D-4133-84F0-36438D0D0213}] => (Allow) C:\Users\Zack\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{06E40A9B-AF4D-4ABD-94E5-A98234AC2CB2}] => (Allow) C:\Users\Zack\AppData\Roaming\BitTorrent\BitTorrent.exe
FirewallRules: [{C24F59E3-1003-45AF-B75E-32A98AE40B91}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{260EA907-2B92-4CA6-A9BB-192156C07A73}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{D2203DA3-5D06-4081-A41A-22FCF9D794B4}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDirector10\PDR10.EXE
FirewallRules: [{C3D3B01D-73E9-4643-9492-50264DF24616}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD10.EXE
FirewallRules: [{0C05005A-39D0-451C-86D5-74C64FC1BFF4}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{CCCE09EC-1841-4223-8384-9CDB41FE2412}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{B834139A-D9ED-43EB-8108-1999E291A7F6}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{54079D45-924E-4BDF-A322-9D5013AEBA59}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{D5113F7A-BACB-4BB1-987F-3A33CE7B6AD4}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{02D31468-DF2C-49AF-A4A5-B036E16E80EF}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{313267C1-8BA5-40AE-9504-7A19BF9D4B22}] => (Allow) C:\Program Files (x86)\HPConnectedMusic\HPConnectedMusic.exe
FirewallRules: [{AEC7259B-6E41-4B31-BC82-7401B043CE36}] => (Allow) C:\Program Files (x86)\HPConnectedMusic\HPConnectedMusic.exe
FirewallRules: [{CACCB147-4CA8-4B00-B260-530F1D05B6EA}] => (Allow) C:\Users\Zack\AppData\Roaming\Copy\CopyAgent.exe
FirewallRules: [TCP Query User{73E44585-B71E-4232-BD5E-360587D9F0A2}C:\users\zack\appdata\roaming\copy\copyagent.exe] => (Block) C:\users\zack\appdata\roaming\copy\copyagent.exe
FirewallRules: [uDP Query User{F3F69AC4-7B42-4D24-9564-AE3B26CE76E1}C:\users\zack\appdata\roaming\copy\copyagent.exe] => (Block) C:\users\zack\appdata\roaming\copy\copyagent.exe
FirewallRules: [{3B475B41-908C-46B8-B4A8-B0358A364F98}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{1A5A0921-34F3-4EAE-9701-0B57BE3AEEC0}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{9508DD06-B328-4AC8-A6A7-9DCE0366AB91}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{E04058D9-BEF8-44D5-8F78-E8E6879F673F}] => (Allow) LPort=2869
FirewallRules: [{38B0B790-20D2-4C7B-B406-E1DC32B01B36}] => (Allow) LPort=1900
FirewallRules: [{A6CE4005-153F-4667-ADBB-D0583B7FB2FA}] => (Allow) C:\WINDOWS\system32\rundll32.exe
FirewallRules: [{43616F05-BC30-43D9-A337-4DE6BEAA4497}] => (Allow) C:\Users\Zack\AppData\Roaming\SSN\ssn.exe
FirewallRules: [{AFABBCBC-BF6B-4AFB-95CD-5365A753E4A3}] => (Allow) C:\Users\Zack\AppData\Roaming\SSN\updssn.exe
FirewallRules: [{4370C624-5141-4D00-870A-205727ECD920}] => (Allow) 㩃停潲牧浡䘠汩獥⠠㡸⤶睜湩灯晴汩整屲楷潮瑰楦瑬牥攮數
FirewallRules: [{4BFEAF16-99F7-4331-BDF0-6EA5F246B7E6}] => (Allow) 㩃停潲牧浡䘠汩獥⠠㡸⤶睜湩灯晴汩整屲敲瑳楷潮瑰楦瑬牥攮數
FirewallRules: [{9636989E-E72E-4F2A-AF03-7F2066E17FAD}] => (Allow) 㩃停潲牧浡䘠汩獥⠠㡸⤶睜湩灯晴汩整屲楷潮瑰楦瑬牥⹟硥e
FirewallRules: [{C10BA3AA-2D4F-458D-B2FE-746E5DAA10D7}] => (Allow) 㩃停潲牧浡䘠汩獥⠠㡸⤶睜湩灯晴汩整屲敲瑳楷潮瑰楦瑬牥⹟硥e
FirewallRules: [{D54D2523-AD65-442B-8525-53AF11726BF5}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{B4375C8C-2CE1-45E5-8B4E-C9F82779D2F5}] => (Allow) LPort=53000
FirewallRules: [{77F86AE5-60BC-49B8-B906-1DD8A30FF657}] => (Allow) LPort=52000
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service
StandardProfile\AuthorizedApplications: [C:\Windows\SysWOW64\rundll32.exe] => *:Enabled:rundll32
 
==================== Restore Points =========================
 
07-01-2016 18:03:48 Removed Ableton Live 9 Suite
 
==================== Faulty Device Manager Devices =============
 
Name: ISO Mounter
Description: ISO Mounter
Class Guid: {4d36e97b-e325-11ce-bfc1-08002be10318}
Manufacturer: Native Instruments GmbH
Service: NIWinCDEmu
Problem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19)
Resolution: A registry problem was detected.
 This can occur when more than one service is defined for a device, if there is a failure opening the service subkey, or if the driver name cannot be obtained from the service subkey. Try these options:
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver.
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (01/11/2016 05:38:04 PM) (Source: Customer Experience Improvement Program) (EventID: 1006) (User: )
Description: 80070570
 
Error: (01/11/2016 05:37:33 PM) (Source: ESENT) (EventID: 536) (User: )
Description: taskhost (5612) An attempt to create temporary database C:\ProgramData\Microsoft\RAC\StateData\tmp.edb failed with error -1121.
 
Error: (01/11/2016 05:37:03 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: IAStorDataMgrSvc.exe, version: 11.5.9.1002, time stamp: 0x5065e128
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x0467538d
Faulting process id: 0x32c
Faulting application start time: 0xIAStorDataMgrSvc.exe0
Faulting application path: IAStorDataMgrSvc.exe1
Faulting module path: IAStorDataMgrSvc.exe2
Report Id: IAStorDataMgrSvc.exe3
Faulting package full name: IAStorDataMgrSvc.exe4
Faulting package-relative application ID: IAStorDataMgrSvc.exe5
 
Error: (01/11/2016 05:37:02 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: IAStorDataMgrSvc.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.NullReferenceException
Stack:
   at IAStorUtil.SystemDataModelListener.ProcessSystemDataModelChanges()
   at IAStorUtil.SystemDataModelListener.LoadSavedSystemState()
   at IAStorDataMgr.EventRelay.<Start>b__0(System.Object)
   at System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object)
   at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   at System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
   at System.Threading.ThreadPoolWorkQueue.Dispatch()
   at System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()
 
Error: (01/11/2016 05:35:42 PM) (Source: Windows Search Service) (EventID: 3030) (User: )
Description: The gatherer service cannot be initialized.
 
Details:
The Temp folder is on a drive that is full or is inaccessible. Free up space on the drive or verify that you have write permission on the Temp folder.  (HRESULT : 0x80070660) (0x80070660)
 
Error: (01/10/2016 11:39:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: IAStorDataMgrSvc.exe, version: 11.5.9.1002, time stamp: 0x5065e128
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x0428538d
Faulting process id: 0xeb8
Faulting application start time: 0xIAStorDataMgrSvc.exe0
Faulting application path: IAStorDataMgrSvc.exe1
Faulting module path: IAStorDataMgrSvc.exe2
Report Id: IAStorDataMgrSvc.exe3
Faulting package full name: IAStorDataMgrSvc.exe4
Faulting package-relative application ID: IAStorDataMgrSvc.exe5
 
Error: (01/10/2016 11:38:59 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: IAStorDataMgrSvc.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.NullReferenceException
Stack:
   at IAStorUtil.SystemDataModelListener.ProcessSystemDataModelChanges()
   at IAStorUtil.SystemDataModelListener.LoadSavedSystemState()
   at IAStorDataMgr.EventRelay.<Start>b__0(System.Object)
   at System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object)
   at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   at System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
   at System.Threading.ThreadPoolWorkQueue.Dispatch()
   at System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()
 
Error: (01/10/2016 11:38:50 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: Failed to schedule Software Protection service for re-start at 2115-12-18T04:38:50Z. Error Code: 0x80070570.
 
Error: (01/10/2016 11:38:20 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: Failed to schedule Software Protection service for re-start at 2115-12-18T04:38:20Z. Error Code: 0x80070570.
 
Error: (01/10/2016 11:37:42 PM) (Source: Windows Search Service) (EventID: 3030) (User: )
Description: The gatherer service cannot be initialized.
 
Details:
The Temp folder is on a drive that is full or is inaccessible. Free up space on the drive or verify that you have write permission on the Temp folder.  (HRESULT : 0x80070660) (0x80070660)
 
 
System errors:
=============
Error: (01/11/2016 06:27:33 PM) (Source: DCOM) (EventID: 10005) (User: BOSSPLAYA)
Description: 1084WSearchUnavailable{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}
 
Error: (01/11/2016 06:27:33 PM) (Source: DCOM) (EventID: 10005) (User: BOSSPLAYA)
Description: 1084WSearchUnavailable{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}
 
Error: (01/11/2016 06:27:33 PM) (Source: DCOM) (EventID: 10005) (User: BOSSPLAYA)
Description: 1084ShellHWDetectionUnavailable{DD522ACC-F821-461A-A407-50B198B896DC}
 
Error: (01/11/2016 06:26:42 PM) (Source: DCOM) (EventID: 10005) (User: BOSSPLAYA)
Description: 1084WSearchUnavailable{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}
 
Error: (01/11/2016 06:26:42 PM) (Source: DCOM) (EventID: 10005) (User: BOSSPLAYA)
Description: 1084WSearchUnavailable{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}
 
Error: (01/11/2016 06:26:38 PM) (Source: DCOM) (EventID: 10005) (User: BOSSPLAYA)
Description: 1084ShellHWDetectionUnavailable{DD522ACC-F821-461A-A407-50B198B896DC}
 
Error: (01/11/2016 06:26:31 PM) (Source: DCOM) (EventID: 10005) (User: BOSSPLAYA)
Description: 1084WSearchUnavailable{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}
 
Error: (01/11/2016 06:26:31 PM) (Source: DCOM) (EventID: 10005) (User: BOSSPLAYA)
Description: 1084WSearchUnavailable{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}
 
Error: (01/11/2016 06:26:31 PM) (Source: DCOM) (EventID: 10005) (User: BOSSPLAYA)
Description: 1084WSearchUnavailable{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}
 
Error: (01/11/2016 06:26:31 PM) (Source: DCOM) (EventID: 10005) (User: BOSSPLAYA)
Description: 1084WSearchUnavailable{B52D54BB-4818-4EB9-AA80-F9EACD371DF8}
 
 
==================== Memory info =========================== 
 
Processor: Intel® Core i7-3630QM CPU @ 2.40GHz
Percentage of memory in use: 6%
Total physical RAM: 12177.27 MB
Available physical RAM: 11327.78 MB
Total Virtual: 24465.27 MB
Available Virtual: 23698.73 MB
 
==================== Drives ================================
 
Drive c: () (Fixed) (Total:665.49 GB) (Free:395.88 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive d: (RECOVERY) (Fixed) (Total:31.93 GB) (Free:3.55 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive f: (YEAH HOE) (Removable) (Total:7.22 GB) (Free:7.11 GB) FAT32
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (Size: 698.6 GB) (Disk ID: A50E1C7D)
 
Partition: GPT.
 
========================================================
Disk: 1 (Size: 7.2 GB) (Disk ID: 00000000)
 
Partition: GPT.
 
==================== End of Addition.txt ============================
Link to post
Share on other sites

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 1/10/2016
Scan Time: 9:42 PM
Logfile:
Administrator: Yes

Version: 2.2.0.1024
Malware Database: v2015.09.22.05
Rootkit Database: v2015.09.18.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 8.1
CPU: x64
File System: NTFS
User: Zack

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 494559
Time Elapsed: 11 min, 41 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 6
PUP.Optional.WebWatcher, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{FCE1662E-06F1-413D-80CB-33D456D1CFCB}, Quarantined, [678648ea375441f557f327c7c53dfc04],
PUP.Optional.WebWatcher, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FCE1662E-06F1-413D-80CB-33D456D1CFCB}, Quarantined, [678648ea375441f557f327c7c53dfc04],
PUP.Optional.AmiUpdater, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\amiupdaterExd, Quarantined, [e9043002fc8f83b326cd9fe732d2b947],
PUP.Optional.AmiUpdater, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\amiupdaterExi, Quarantined, [bf2e0230eba01f17f6fdb1d5c2424ab6],
PUP.Optional.Udapoker, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\UdvdPork, Quarantined, [b439c36f98f36fc77de307bd29db6799],
PUP.Optional.WindowsManagementService, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WINDOWSMANAGEMENTSERVICE, Quarantined, [54993ff3abe0ac8a9644f2d6bc48dd23],

Registry Values: 1
PUP.Optional.WindowsManagementService, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WINDOWSMANAGEMENTSERVICE|ImagePath, "C:\Users\Zack\AppData\Local\Temp\20151017\ct.exe" /svc, Quarantined, [54993ff3abe0ac8a9644f2d6bc48dd23]

Registry Data: 0
(No malicious items detected)

Folders: 3
Rogue.Multiple, C:\ProgramData\1445042128, Quarantined, [a34a161c4942cd692b45ba34b64c9b65],
PUP.Optional.Nosibay, C:\Users\Zack\AppData\Roaming\Nosibay, Quarantined, [4da0df53e5a660d60b98be637b8858a8],
PUP.Optional.Nosibay, C:\Users\Zack\AppData\Roaming\Nosibay\Bubble Dock, Quarantined, [4da0df53e5a660d60b98be637b8858a8],

Files: 9
PUP.Optional.Nosibay, C:\Users\Zack\AppData\Roaming\Nosibay\Bubble Dock\LBubble Dock.exe, Quarantined, [c5282909a5e69b9bb8b24467a3626997],
PUP.Optional.BubbleDock, C:\Users\Zack\AppData\Local\Temp\LBubble Dock.txt, Quarantined, [777645ed6328ed495268cac2eb19d828],
Rogue.Multiple, C:\ProgramData\1445042128\s9.zip, Quarantined, [a34a161c4942cd692b45ba34b64c9b65],
PUP.Optional.Nosibay, C:\Users\Zack\AppData\Roaming\Nosibay\Bubble Dock\CommonSrv.dll, Quarantined, [4da0df53e5a660d60b98be637b8858a8],
PUP.Optional.Nosibay, C:\Users\Zack\AppData\Roaming\Nosibay\Bubble Dock\gdiplus.dll, Quarantined, [4da0df53e5a660d60b98be637b8858a8],
PUP.Optional.Nosibay, C:\Users\Zack\AppData\Roaming\Nosibay\Bubble Dock\MFC71.dll, Quarantined, [4da0df53e5a660d60b98be637b8858a8],
PUP.Optional.Nosibay, C:\Users\Zack\AppData\Roaming\Nosibay\Bubble Dock\msvcp71.dll, Quarantined, [4da0df53e5a660d60b98be637b8858a8],
PUP.Optional.Nosibay, C:\Users\Zack\AppData\Roaming\Nosibay\Bubble Dock\msvcr71.dll, Quarantined, [4da0df53e5a660d60b98be637b8858a8],
PUP.Optional.Nosibay, C:\Users\Zack\AppData\Roaming\Nosibay\Bubble Dock\WindowsHook.dll, Quarantined, [4da0df53e5a660d60b98be637b8858a8],

Physical Sectors: 0
(No malicious items detected)

(end)

Link to post
Share on other sites

sorry... couldn't find the attach button...

 

The situation has not resolved itself. I am able to access the internet now... but any update I attempt to install for ANY antivirus/antimalware program will not work due to the same corrupt directory message...

 

There are viruses in my FRST scan logs, aren't there? 

Link to post
Share on other sites

Do not paste the logs in your posts, attachments make my work easier. There is a More reply options button, that gives you Upload Files option below which you can use to attach your reports. Always attach reports from all tools.
 
 
 
FRST.gif Scan with Farbar Recovery Scan Tool
 
Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

  • Right-click on FRST.gif icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Make sure that Addition option is checked.
  • Press Scan button and wait.
  • The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please upload them into your next reply.

Link to post
Share on other sites

  • 3 weeks later...

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.