All of my microsoft office icons changed

jbobo348 · February 12, 2016

I've ran avast and malwarebytes on my computer and they both found stuff. But all of my microsoft office documents icons are still messed up. I can open them but they look like the picture that I've attached. Under my C: Drive I have a bunch of weird folders that have names like 2fb70cb04af271d2e88aed21f2521910 and there is about 30 folders like that. Inside the one that I just gave you it has $shtdwn$.req, MRT, mrt.exe._p, and mrtstub. Please help!

kevinf80 · February 12, 2016

Hello and welcome to Malwarebytes,

Please be aware the following P2P/Piracy Warning is a standard opening reply made here at Malwarebytes, we make no accusations but do make you aware of Forum Protocol....

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Anyone other than the original starter of this thread please DO NOT follow the instructions and advice posted as replies here, my help and advice is NOT related to your system and will probably cause more harm than good...

Please open Malwarebytes Anti-Malware.

On the Settings tab > Detection and Protection sub tab, Detection Options, tick the box "Scan for rootkits". <---- Very Important
Under Non-Malware Protection sub tab Change PUP and PUM entries to Treat detections as Malware
Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button.
A Threat Scan will begin.
With some infections, you may or may not see this message box.

'Could not load DDA driver'
Click 'Yes' to this message, to allow the driver to load after a restart.
Allow the computer to restart. Continue with the rest of these instructions.
When the scan is complete, click Apply Actions.
Wait for the prompt to restart the computer to appear, then click on Yes.
After the restart once you are back at your desktop, open MBAM once more.

To get the log from Malwarebytes do the following:

Click on the History tab > Application Logs.
Double click on the scan log which shows the Date and time of the scan just performed.
Click Export > From export you have three options:

Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
XML file (*.xml) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
Please use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply…

If Malwarebytes is not installed follow these instructions first:

Download Malwarebytes Anti-Malware to your desktop.

Double-click mbam-setup and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to the following:
Launch Malwarebytes Anti-Malware
A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
Click Finish. Follow the instructions above....

Next,

Download AdwCleaner by Xplode onto your Desktop.

Double click on Adwcleaner.exe to run the tool.
Click on the Scan in the Actions box
Please wait fot the scan to finish..
When "Waiting for action.Please uncheck elements you want to keep" shows in top line..
Click on the Cleaning box.
Next click OK on the "Closing Programs" pop up box.
Click OK on the Information box & again OK to allow the necessary reboot
After restart the AdwCleaner(C*)-Notepad log will appear, please copy/paste it in your next reply. Where * is the number relative to list of scans completed...

Next,

Download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Double-click to run it. When the tool opens click Yes to disclaimer.
(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.)
Make sure Addition.txt is checkmarked under "Optional scans"
Press Scan button to run the tool....
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The tool will also make a log named (Addition.txt) Please attach those logs to your reply.

Let me see those logs in your next reply...

Thank you,

Kevin...

jbobo348 · February 12, 2016

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 2/12/2016

Scan Time: 8:09 AM

Logfile:

Administrator: Yes

Version: 2.2.0.1024

Malware Database: v2016.02.12.02

Rootkit Database: v2016.02.08.01

License: Trial

Malware Protection: Enabled

Malicious Website Protection: Enabled

Self-protection: Disabled

OS: Windows 7 Service Pack 1

CPU: x86

File System: NTFS

User: Lena

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 337986

Time Elapsed: 52 min, 55 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Enabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 0

(No malicious items detected)

Registry Values: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Folders: 0

(No malicious items detected)

Files: 0

(No malicious items detected)

Physical Sectors: 0

(No malicious items detected)

(end)

jbobo348 · February 12, 2016

# AdwCleaner v5.033 - Logfile created 12/02/2016 at 09:29:06

# Updated 07/02/2016 by Xplode

# Database : 2016-02-07.2 [server]

# Operating system : Windows 7 Professional Service Pack 1 (x86)

# Username : Lena - LENA-PC

# Running from : C:\Users\Lena\Desktop\Downloads\AdwCleaner.exe

# Option : Cleaning

# Support : http://toolslib.net/forum

***** [ Services ] *****

[-] Service Deleted : YahooAUService

***** [ Folders ] *****

[-] Folder Deleted : C:\Program Files\Yahoo!\Companion

[-] Folder Deleted : C:\Program Files\Common Files\AVG Secure Search

[-] Folder Deleted : C:\ProgramData\AVG Secure Search

[-] Folder Deleted : C:\ProgramData\AVG Security Toolbar

[-] Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Coupons

[-] Folder Deleted : C:\Users\Lena\AppData\LocalLow\Conduit

[-] Folder Deleted : C:\Users\Lena\AppData\LocalLow\wiseconvert

[-] Folder Deleted : C:\Users\Lena\AppData\LocalLow\Yahoo!\Companion

[-] Folder Deleted : C:\Users\Lena\AppData\LocalLow\YahooCouponAddOn

***** [ Files ] *****

***** [ DLLs ] *****

***** [ Shortcuts ] *****

***** [ Scheduled tasks ] *****

***** [ Registry ] *****

[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\BrowserConnection.dll

[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\DNSBHO.dll

[-] Key Deleted : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe

[-] Key Deleted : HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\avgsh

[-] Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin

[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{AC662AF2-4601-4A68-84DF-A3FE83F1A5F9}

[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D97A8234-F2A2-4AD4-91D5-FECDB2C553AF}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{058F0E48-61CA-4964-9FBA-1978A1BB060D}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{18F33C35-8EF2-40D7-8BA4-932B0121B472}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CA3A5461-96B5-46DD-9341-5350D3C94615}

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}

[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}

[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}

[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}

[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}

[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}

[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}

[-] Key Deleted : HKCU\Software\Yahoo\Companion

[-] Key Deleted : HKCU\Software\Yahoo\YFriendsBar

[-] Key Deleted : HKCU\Software\AppDataLow\Toolbar

[-] Key Deleted : HKCU\Software\AppDataLow\Software\Conduit

[-] Key Deleted : HKCU\Software\AppDataLow\Software\Yahoo\Companion

[-] Key Deleted : HKLM\SOFTWARE\SearchquMediabarTb

[-] Key Deleted : HKLM\SOFTWARE\Yahoo\Companion

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1AE46C09-2AB8-4EE5-88FB-08CD0FF7F2DF}

[-] Key Deleted : HKU\.DEFAULT\Software\Yahoo\Companion

[-] Key Deleted : HKU\.DEFAULT\Software\Yahoo\YFriendsBar

[-] Key Deleted : HKU\.DEFAULT\Software\AppDataLow\Software\Yahoo\Companion

[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\90C64EA18BA25EE488BF80DCF07F2FFD

[-] Key Deleted : HKLM\SOFTWARE\Classes\Installer\Features\90C64EA18BA25EE488BF80DCF07F2FFD

[-] Key Deleted : HKLM\SOFTWARE\Classes\Installer\Products\90C64EA18BA25EE488BF80DCF07F2FFD

[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}

[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\ask.com

[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\mysearch.avg.com

***** [ Web browsers ] *****

*************************

:: "Tracing" keys removed

:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [5317 bytes] ##########

jbobo348 · February 12, 2016

Additional scan result of Farbar Recovery Scan Tool (x86) Version:07-02-2016

Ran by Lena (2016-02-12 09:46:54)

Running from C:\Users\Lena\Desktop\Downloads

Microsoft Windows 7 Professional Service Pack 1 (X86) (2010-05-12 20:49:10)

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-4116772418-655162160-1753580222-500 - Administrator - Disabled)

Guest (S-1-5-21-4116772418-655162160-1753580222-501 - Limited - Disabled)

Lena (S-1-5-21-4116772418-655162160-1753580222-1000 - Administrator - Enabled) => C:\Users\Lena

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}

AV: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {4D41356F-32AD-7C42-C820-63775EE4F413}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {F620D48B-1497-73CC-F290-58052563BEAE}

AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe AIR (HKLM\...\Adobe AIR) (Version: 2.0.2.12610 - Adobe Systems Inc.)

Adobe Flash Player 11 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 11.8.800.94 - Adobe Systems Incorporated)

Adobe Flash Player 11 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 11.8.800.94 - Adobe Systems Incorporated)

Adobe Reader 9.5.5 (HKLM\...\{AC76BA86-7AD7-1033-7B44-A95000000001}) (Version: 9.5.5 - Adobe Systems Incorporated)

Apple Application Support (32-bit) (HKLM\...\{7FE25256-B7C1-480D-B736-10A67A833AEA}) (Version: 3.2 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{538227C6-C74B-4A74-99E1-2C0B4F9DA5E1}) (Version: 8.2.1.3 - Apple Inc.)

Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

Avast Free Antivirus (HKLM\...\Avast) (Version: 11.1.2253 - AVAST Software)

AVG 2015 (HKLM\...\AVG) (Version: 2015.0.6189 - AVG Technologies)

AVG 2015 (Version: 15.0.4522 - AVG Technologies) Hidden

AVG 2015 (Version: 15.0.6189 - AVG Technologies) Hidden

Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)

Citrix Receiver (HKLM\...\CitrixOnlinePluginPackWeb) (Version: 14.1.0.0 - Citrix Systems, Inc.)

Coupon Printer for Windows (HKLM\...\Coupon Printer for Windows5.0.0.0) (Version: 5.0.0.0 - Coupons.com Incorporated)

DivX Web Player (HKLM\...\{B7050CBDB2504B34BC2A9CA0A692CC29}) (Version: 1.5.0 - DivX,Inc.)

EA Download Manager (HKLM\...\EA Download Manager) (Version: 6.0.4.124 - Electronic Arts, Inc.)

EA Download Manager UI (HKLM\...\com.ea.Vault.919CACB699904AC5D41B606703500DD39747C02D.1) (Version: 6.0.4.124 - Electronic Arts)

EA Download Manager UI (Version: 6.0.4 - Electronic Arts) Hidden

Fitbit Connect (HKLM\...\{F76678F2-2FF6-40D7-9B16-A39B0A820ED2}) (Version: 1.0.3.5512 - Fitbit Inc.)

Garmin Communicator Plugin (HKLM\...\{8ED02445-D491-414C-A56D-2ED6BBB7239A}) (Version: 3.0.1 - Garmin Ltd or its subsidiaries)

Garmin USB Drivers (HKLM\...\{65F9E1F3-A2C1-4AA9-9F33-A3AEB0255F0E}) (Version: 2.3.0.0 - Garmin Ltd or its subsidiaries)

Google Chrome (HKU\S-1-5-21-4116772418-655162160-1753580222-1000\...\Google Chrome) (Version: 48.0.2564.109 - Google Inc.)

Google Toolbar for Internet Explorer (HKLM\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.7210.1528 - Google Inc.)

Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden

Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden

Google Update Helper (Version: 1.3.29.5 - Google Inc.) Hidden

GoToMeeting 5.5.0.1133 (HKU\S-1-5-21-4116772418-655162160-1753580222-1000\...\GoToMeeting) (Version: 5.5.0.1133 - CitrixOnline)

HP Deskjet 1050 J410 series Basic Device Software (HKLM\...\{ECB35FFA-B010-45C5-9AB5-665AC7E27EE2}) (Version: 22.0.334.0 - Hewlett-Packard Co.)

HP Deskjet 1050 J410 series Help (HKLM\...\{5C90D8CF-F12A-41C6-9007-3B651A1F0D78}) (Version: 140.0.66.66 - Hewlett Packard)

HP Deskjet 1050 J410 series Product Improvement Study (HKLM\...\{6BE73D27-5ADC-4AD9-B619-8F5188AFCF9F}) (Version: 22.0.334.0 - Hewlett-Packard Co.)

HP Photo Creations (HKLM\...\HP Photo Creations) (Version: 1.0.0.3341 - HP Photo Creations Powered by RocketLife)

HP Update (HKLM\...\{787D1A33-A97B-4245-87C0-7174609A540C}) (Version: 5.002.005.003 - Hewlett-Packard)

iCloud (HKLM\...\{9A07AB4F-6B53-43E9-B7FC-7892E8C26BE3}) (Version: 4.1.1.53 - Apple Inc.)

iTunes (HKLM\...\{025E78AC-BD91-4E9E-B165-3C09D4084BA4}) (Version: 12.2.2.25 - Apple Inc.)

Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)

Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)

Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.50903 - Microsoft Corporation)

MobileMe Control Panel (HKLM\...\{5A9AA2C0-972F-4239-AA41-E409434194D5}) (Version: 3.1.8.0 - Apple Inc.)

Online Plug-in (Version: 14.1.0.0 - Citrix Systems, Inc.) Hidden

QuickTime 7 (HKLM\...\{627FFC10-CE0A-497F-BA2B-208CAC638010}) (Version: 7.77.80.95 - Apple Inc.)

Safari (HKLM\...\{C779648B-410E-4BBA-B75B-5815BCEFE71D}) (Version: 5.34.57.2 - Apple Inc.)

Self-service Plug-in (Version: 4.1.0.41738 - Citrix Systems, Inc.) Hidden

Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)

Skype Click to Call (HKLM\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 5.6.8442 - Skype Technologies S.A.)

Skype™ 7.0 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)

The Sims™ 2 Double Deluxe (HKLM\...\{C22E50B4-B9D0-4a07-B1F3-12362514FEA7}) (Version: - Electronic Arts)

VC80CRTRedist - 8.0.50727.762 (Version: 1.0.0 - DivX, Inc) Hidden

Visual Studio 2012 x86 Redistributables (HKLM\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)

VoiceOver Kit (HKLM\...\{6B4AD1A9-E73A-4184-9D6B-072F8A3C5EBA}) (Version: 1.42.128.0 - Apple Inc.)

Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0) (HKLM\...\49CF605F02C7954F4E139D18828DE298CD59217C) (Version: 06/03/2009 2.3.0.0 - Garmin)

Windows Live ID Sign-in Assistant (HKLM\...\{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}) (Version: 6.500.3165.0 - Microsoft Corporation)

Yahoo! Software Update (HKLM\...\Yahoo! Software Update) (Version: - )

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> C:\Users\Lena\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{035FBE31-3755-450A-A775-5E6BBD43D344}\InprocServer32 -> C:\Users\Lena\AppData\Local\Google\Update\1.3.21.135\psuser.dll => No File

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll => No File

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{095A2EEC-F7FE-42E8-96FB-C20E53081908}\InprocServer32 -> C:\Users\Lena\AppData\Local\Google\Update\1.3.21.99\psuser.dll => No File

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{0E55CBE1-B06A-49B6-AD8D-9EFAA0160C6F}\InprocServer32 -> C:\Users\Lena\AppData\Local\Google\Update\1.3.21.57\psuser.dll => No File

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\Lena\AppData\Local\Google\Update\1.3.25.5\psuser.dll => No File

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{1423F872-3F7F-4E57-B621-8B1A9D49B448}\InprocServer32 -> C:\Users\Lena\AppData\Local\Google\Update\1.3.27.5\psuser.dll => No File

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{218D2740-5A50-42A8-AB9F-62FF1B168782}\InprocServer32 -> C:\Users\Lena\AppData\Local\Google\Update\1.3.21.69\psuser.dll => No File

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> C:\Users\Lena\AppData\Local\Google\Update\1.3.29.5\GoogleUpdateOnDemand.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{29A96789-9595-4947-BEDB-0FCC776F7DB8}\InprocServer32 -> C:\Users\Lena\AppData\Local\Google\Update\1.2.183.39\goopdate.dll => No File

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> C:\Users\Lena\AppData\Local\Google\Update\1.3.29.5\GoogleUpdateOnDemand.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{320F0FDB-BE0A-4648-9D18-4A2C3448C007}\InprocServer32 -> C:\Users\Lena\AppData\Local\Google\Update\1.3.21.79\psuser.dll => No File

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Lena\AppData\Local\Google\Update\1.3.23.9\psuser.dll => No File

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll => No File

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> C:\Users\Lena\AppData\Local\Google\Update\1.3.29.5\GoogleUpdateOnDemand.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}\localserver32 -> C:\Users\Lena\AppData\Local\Google\Chrome\Application\48.0.2564.109\delegate_execute.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{5C8C2A98-6133-4EBA-BBCC-34D9EA01FC2E}\InprocServer32 -> C:\Users\Lena\AppData\Local\Google\Update\1.3.28.1\psuser.dll => No File

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{62A0D750-DED9-448C-B693-406B34BB0892}\InprocServer32 -> C:\Users\Lena\AppData\Local\Google\Update\1.3.21.145\psuser.dll => No File

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{634059C0-D264-4B2C-AE80-F73E48D33E5B}\InprocServer32 -> C:\Users\Lena\AppData\Local\Google\Update\1.3.21.123\psuser.dll => No File

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{6D7374DE-63AA-473C-8C02-60D9CDCD84C5}\InprocServer32 -> C:\Users\Lena\AppData\Local\Google\Update\1.3.21.153\psuser.dll => No File

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{78550997-5DEF-4A8A-BAF9-D5774E87AC98}\InprocServer32 -> C:\Users\Lena\AppData\Local\Google\Update\1.3.28.13\psuser.dll => No File

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{793EE463-1304-471C-ADF1-68C2FFB01247}\InprocServer32 -> C:\Users\Lena\AppData\Local\Google\Update\1.3.29.5\psuser.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Program Files\Citrix\GoToMeeting\1133\G2MOutlookAddin.dll (Citrix Online, a division of Citrix Systems, Inc.)

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Lena\AppData\Local\Google\Update\1.3.24.15\psuser.dll => No File

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{91EFB276-CEFE-48EC-BB3A-57795A7B4008}\InprocServer32 -> C:\Users\Lena\AppData\Local\Google\Update\1.3.21.149\psuser.dll => No File

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{A45426FB-E444-42B2-AA56-419F8FBEEC61}\InprocServer32 -> C:\Users\Lena\AppData\Local\Google\Update\1.3.22.3\psuser.dll => No File

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{A54D478D-4F70-4F72-9A74-17C9986E35AB}\InprocServer32 -> C:\Users\Lena\AppData\Local\Google\Update\1.3.21.165\psuser.dll => No File

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> C:\Users\Lena\AppData\Local\Google\Update\1.3.29.5\npGoogleUpdate3.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\Lena\AppData\Local\Google\Update\1.3.26.9\psuser.dll => No File

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> C:\Users\Lena\AppData\Local\Google\Update\1.3.29.5\npGoogleUpdate3.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{C5A2122B-A05B-4FD8-AE49-91990AE10998}\InprocServer32 -> C:\Users\Lena\AppData\Local\Google\Update\1.3.21.115\psuser.dll => No File

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{CC182BE1-84CE-4A57-B85C-FD4BBDF78CB2}\InprocServer32 -> C:\Users\Lena\AppData\Local\Google\Update\1.3.29.1\psuser.dll => No File

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\Lena\AppData\Local\Google\Update\1.3.25.11\psuser.dll => No File

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll => No File

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{D1EDC4F5-7F4D-4B12-906A-614ECF66DDAF}\InprocServer32 -> C:\Users\Lena\AppData\Local\Google\Update\1.3.28.15\psuser.dll => No File

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{DB25D157-76D4-41C1-97B5-359E4A4CECEB}\InprocServer32 -> C:\Users\Lena\AppData\Local\Google\Update\1.3.21.65\psuser.dll => No File

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> C:\Users\Lena\AppData\Local\Google\Update\1.3.29.5\GoogleUpdateOnDemand.exe (Google Inc.)

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Lena\AppData\Local\Google\Update\1.3.29.5\psuser.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{EB06378B-ABB6-4B3C-9B40-D488DD8A6E93}\InprocServer32 -> C:\Users\Lena\AppData\Local\Google\Update\1.3.22.5\psuser.dll => No File

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{FB994D36-B312-46CE-A40B-CF63980641F9}\InprocServer32 -> C:\Users\Lena\AppData\Local\Google\Update\1.3.21.111\psuser.dll => No File

CustomCLSID: HKU\S-1-5-21-4116772418-655162160-1753580222-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Lena\AppData\Local\Google\Update\1.3.24.7\psuser.dll => No File

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {02F6C99D-B22A-4606-865C-EE94C1FE40CB} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)

Task: {0E3C0F78-0722-4E40-9AC8-0C462F1D631E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)

Task: {11407B25-2166-4023-9730-3A4A3998BD4D} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2016-02-08] (AVAST Software)

Task: {20F40C46-F336-47D2-8195-8B0AF7929C21} - System32\Tasks\{7C23255D-7CA3-4BAD-8E98-A7F21788A2D8} => Chrome.exe

Task: {2788CCCF-AAE1-4616-A0F6-4E8789A598A1} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2016-02-08] (AVAST Software)

Task: {3650B140-5163-41AB-BAE6-0E5862E1549F} - System32\Tasks\{052C07D6-8C92-4345-A445-5DD5A94CFC5C} => C:\Program Files\iTunes\iTunes.exe [2015-08-13] (Apple Inc.)

Task: {3B3C326D-7574-423E-80E5-87261232107C} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime => C:\Windows\system32\GWX\GWXUXWorker.exe [2015-12-05] (Microsoft Corporation)

Task: {3FDE49BC-2A1A-45F2-9EE2-0FCCC7FE7104} - System32\Tasks\{FDFAB59F-A8D3-4691-84FD-515401945059} => Iexplore.exe hxxp://www.skype.com/go/downloading?source=lightinstaller&ver=4.2.0.169.404&LastError=12002

Task: {435B97A3-A6F7-48AB-B767-8355E68D02CE} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4116772418-655162160-1753580222-1000Core => C:\Users\Lena\AppData\Local\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)

Task: {4E811D86-3B1D-43C2-A42D-F966E87E36A3} - System32\Tasks\{C48279B2-756F-4D7F-97D0-DCBED8E06F75} => C:\Program Files\AVG\AVG2015\avgui.exe [2016-02-04] (AVG Technologies CZ, s.r.o.)

Task: {53F24067-2C0A-4477-B156-6A1A6D01FCD9} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4116772418-655162160-1753580222-1000UA => C:\Users\Lena\AppData\Local\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)

Task: {55380E5A-8003-4C1C-81DA-CAE7890C7DA6} - System32\Tasks\{55D8708A-F9F8-4C2E-8CBD-7896A4841EAC} => Chrome.exe

Task: {62A3E549-4E75-499E-B878-4B0CAC9D25A4} - System32\Tasks\{AACF855E-BB48-47A9-979D-0424A9FEC0E8} => Chrome.exe

Task: {6547248E-3ECD-442A-9BC1-A62146E524E0} - System32\Tasks\{E2925CD5-9C96-49F9-9020-41E90D156961} => Chrome.exe

Task: {6924B4A1-36B8-4F70-923E-52A79A79646A} - System32\Tasks\{8CCC030A-9CD5-484E-B407-88C3D54491F2} => C:\Program Files\iTunes\iTunes.exe [2015-08-13] (Apple Inc.)

Task: {70BEA12D-4EB9-416A-927C-EC97F0770285} - System32\Tasks\{5E021C3D-0435-4AD5-9E61-6C942CF17F6B} => Chrome.exe

Task: {7AFD50A8-F687-45B6-95BB-334B5FF1AFF0} - \DTReg -> No File <==== ATTENTION

Task: {80F594EA-95C4-4F54-9A33-A1B05E61E25A} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime => C:\Windows\system32\GWX\GWXUXWorker.exe [2015-12-05] (Microsoft Corporation)

Task: {B2912FD8-321A-485C-9B6E-B2C935466178} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {B51ABEAC-4CBC-4491-8ED2-66700A48E93D} - System32\Tasks\{9ABC865F-A514-4A6D-9187-D6F9577E66CD} => C:\Program Files\Skype\Phone\Skype.exe [2014-12-11] (Skype Technologies S.A.)

Task: {C68E9A1C-593B-4141-AFBC-1478404E241D} - System32\Tasks\HPCustParticipation HP Deskjet 1050 J410 series => C:\Program Files\HP\HP Deskjet 1050 J410 series\Bin\HPCustPartic.exe [2010-06-14] (Hewlett-Packard Co.)

Task: {D55625E1-E29E-42C4-8184-066B0A26849E} - System32\Tasks\{B3868327-72DD-470F-96E9-EF52A50380C4} => Chrome.exe

Task: {EF185EE2-8C13-4793-9216-34D667FBB113} - System32\Tasks\{06A1C31E-94A7-448B-9437-920864AF3CF4} => Chrome.exe

Task: {FADDA327-A25C-4D0B-A980-64EB7977BD19} - \DTChk -> No File <==== ATTENTION

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4116772418-655162160-1753580222-1000Core.job => C:\Users\Lena\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4116772418-655162160-1753580222-1000UA.job => C:\Users\Lena\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2016-02-08 16:47 - 2016-02-08 16:47 - 00113496 _____ () C:\Program Files\AVAST Software\Avast\log.dll

2016-02-08 16:47 - 2016-02-08 16:47 - 00133768 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll

2016-02-12 07:45 - 2016-02-12 07:45 - 02820096 _____ () C:\Program Files\AVAST Software\Avast\defs\16021200\algo.dll

2016-02-08 16:47 - 2016-02-08 16:47 - 00480760 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll

2014-02-12 19:58 - 2014-02-12 19:58 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll

2015-10-13 05:46 - 2015-05-15 15:27 - 01044776 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll

2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF

2010-10-20 14:45 - 2010-10-20 14:45 - 08801120 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll

2016-02-08 16:47 - 2016-02-08 16:47 - 40539648 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

2016-02-10 13:24 - 2016-02-09 05:58 - 01632584 _____ () C:\Users\Lena\AppData\Local\Google\Chrome\Application\48.0.2564.109\libglesv2.dll

2016-02-10 13:24 - 2016-02-09 05:58 - 00087880 _____ () C:\Users\Lena\AppData\Local\Google\Chrome\Application\48.0.2564.109\libegl.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\Lena\Documents\2014 tax information.tiff:3or4kl4x13tuuug3Byamue2s4b

AlternateDataStreams: C:\Users\Lena\Documents\2014 tax information.tiff:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ScreenConnect Client (4bb16ff2-b589-41d5-a684-3335b5e6443b) => ""="Service"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 20:04 - 2009-06-10 15:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-4116772418-655162160-1753580222-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Lena\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

DNS Servers: 192.168.104.1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [sPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe

FirewallRules: [sPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe

FirewallRules: [{0376279A-A2C3-46FA-997B-E97656EEF3F7}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe

FirewallRules: [TCP Query User{543F4F21-9166-4898-BBA2-3D828C44A848}C:\program files\electronic arts\eadm\core.exe] => (Allow) C:\program files\electronic arts\eadm\core.exe

FirewallRules: [uDP Query User{2689D0E9-A0A0-4B5A-8828-825DB13E5476}C:\program files\electronic arts\eadm\core.exe] => (Allow) C:\program files\electronic arts\eadm\core.exe

FirewallRules: [{FC921B4C-735E-4B94-AAB5-9BD9B6F4BA98}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{4F3D5F29-E86E-4740-A4C1-2D422F826ECC}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{A49047FA-5EA6-4123-BDEF-82E20E06D4ED}] => (Allow) C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\dtUser.exe

FirewallRules: [{FB1FF30D-668D-4415-976F-FD97B5D14482}] => (Allow) C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar\dtUser.exe

FirewallRules: [{C3EC4B44-48DF-4601-B96B-4D9F513CDEFE}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe

FirewallRules: [{24FE6280-4F3F-4CF4-86C0-A4EF76B15932}] => (Allow) C:\Program Files\HP\HP Deskjet 1050 J410 series\Bin\USBSetup.exe

FirewallRules: [{1FA4D3A6-7CD8-4A73-BCFE-765CAC2AE938}] => (Allow) C:\Program Files\HP\HP Deskjet 1050 J410 series\Bin\USBSetup.exe

FirewallRules: [{F20B5A04-F4B9-4CE7-B08F-CCDC7546809D}] => (Allow) C:\Program Files\AVG\AVG2015\avgmfapx.exe

FirewallRules: [{0115E73E-A39F-426F-9FEC-E425A78BEE6D}] => (Allow) C:\Program Files\AVG\AVG2015\avgmfapx.exe

FirewallRules: [{E29CC89C-BA16-421D-B77A-DB6B3B1F303E}] => (Allow) C:\Program Files\AVG\AVG2015\avgnsx.exe

FirewallRules: [{4ED05BA0-08EA-4572-8093-57432E5D6F49}] => (Allow) C:\Program Files\AVG\AVG2015\avgnsx.exe

FirewallRules: [{EF3395CF-DE6A-44A3-9E5B-1349D70DDEC4}] => (Allow) C:\Program Files\AVG\AVG2015\avgdiagex.exe

FirewallRules: [{A80A3B59-C697-47B9-92DA-FBFC91BA86E8}] => (Allow) C:\Program Files\AVG\AVG2015\avgdiagex.exe

FirewallRules: [{1287DA8B-0153-4800-91B8-40FF1F1B5FE6}] => (Allow) C:\Program Files\AVG\AVG2015\avgemcx.exe

FirewallRules: [{016052BE-956D-4C7F-B60F-F0A0E778B5D0}] => (Allow) C:\Program Files\AVG\AVG2015\avgemcx.exe

FirewallRules: [{1A98304D-4C0E-4CFD-8C84-6C99F3EB912D}] => (Allow) C:\Program Files\iTunes\iTunes.exe

FirewallRules: [TCP Query User{25323CB7-5E67-4D97-8892-3C80C11548A5}C:\users\lena\appdata\local\google\chrome\application\chrome.exe] => (Block) C:\users\lena\appdata\local\google\chrome\application\chrome.exe

FirewallRules: [uDP Query User{3ECF34BF-45EB-4A5F-AFF7-35E6B19C6A88}C:\users\lena\appdata\local\google\chrome\application\chrome.exe] => (Block) C:\users\lena\appdata\local\google\chrome\application\chrome.exe

FirewallRules: [TCP Query User{332E62E0-270B-4547-AFE4-7AB4202E4EB6}C:\users\lena\appdata\local\google\chrome\application\chrome.exe] => (Allow) C:\users\lena\appdata\local\google\chrome\application\chrome.exe

FirewallRules: [uDP Query User{657EC60F-C343-404C-AE1A-E8549BA319FA}C:\users\lena\appdata\local\google\chrome\application\chrome.exe] => (Allow) C:\users\lena\appdata\local\google\chrome\application\chrome.exe

FirewallRules: [{CDA0B3D3-1E70-4EB7-9E18-5A651C3CDA37}] => (Allow) C:\Program Files\AVG\AVG2015\avgnsx.exe

FirewallRules: [{98F963FF-46EF-43CA-845D-9588C58727C8}] => (Allow) C:\Program Files\AVG\AVG2015\avgnsx.exe

FirewallRules: [{5A8295EF-1EC7-4E9C-9EDA-107BDE0BA650}] => (Allow) C:\Program Files\AVG\AVG2015\avgdiagex.exe

FirewallRules: [{C1DE0C22-4935-4144-B454-740B9DEE112E}] => (Allow) C:\Program Files\AVG\AVG2015\avgdiagex.exe

FirewallRules: [{984BE290-A585-4AC6-ACE0-41BC1A01EBFC}] => (Allow) C:\Program Files\AVG\AVG2015\avgemcx.exe

FirewallRules: [{D85B290F-E6BD-4403-94BB-55DD92DC12D5}] => (Allow) C:\Program Files\AVG\AVG2015\avgemcx.exe

==================== Restore Points =========================

26-01-2016 15:27:43 Scheduled Checkpoint

27-01-2016 16:56:10 Windows Update

28-01-2016 09:11:32 Windows Update

04-02-2016 12:07:17 Scheduled Checkpoint

11-02-2016 14:12:27 Scheduled Checkpoint

12-02-2016 03:02:47 Windows Update

==================== Faulty Device Manager Devices =============

Name: Lexmark X422

Description: Lexmark X422

Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}

Manufacturer: Lexmark

Service: usbscan

Problem: : This device cannot start. (Code10)

Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.

On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Bluetooth Peripheral Device

Description: Bluetooth Peripheral Device

Class Guid:

Manufacturer:

Service:

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

==================== Event log errors: =========================

Application errors:

==================

Error: (02/12/2016 03:56:02 AM) (Source: .NET Runtime Optimization Service) (EventID: 1101) (User: )

Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - Failed to compile: System.Web.DynamicData, Version=3.5.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil . Error code = 0x80070020

Error: (02/12/2016 03:51:52 AM) (Source: .NET Runtime Optimization Service) (EventID: 1101) (User: )

Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - Failed to compile: ehshell, Version=6.1.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil . Error code = 0x80070020

Error: (02/12/2016 03:06:29 AM) (Source: Application Hang) (EventID: 1002) (User: )

Description: The program OTL.exe version 3.2.69.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 1c48

Start Time: 01d1657136cf4d29

Termination Time: 156

Application Path: C:\Users\Lena\Desktop\Downloads\OTL.exe

Report Id:

Error: (02/11/2016 09:15:27 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 58410862

Error: (02/11/2016 09:15:27 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 58410862

Error: (02/11/2016 09:15:26 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second

Error: (02/08/2016 04:59:49 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 31652

Error: (02/08/2016 04:59:49 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 31652

Error: (02/08/2016 04:59:49 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second

Error: (02/08/2016 04:59:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 15678

System errors:

=============

Error: (02/12/2016 09:34:21 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)

Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)

Error: (02/12/2016 09:32:50 AM) (Source: atikmdag) (EventID: 10261) (User: )

Description: Display is not active

Error: (02/12/2016 09:32:50 AM) (Source: atikmdag) (EventID: 19468) (User: )

Description: CPLIB :: General - Invalid Parameter

Error: (02/12/2016 09:31:01 AM) (Source: Service Control Manager) (EventID: 7032) (User: )

Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Modules Installer service, but this action failed with the following error:

%%1056

Error: (02/12/2016 09:29:34 AM) (Source: Service Control Manager) (EventID: 7032) (User: )

Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Search service, but this action failed with the following error:

%%1056

Error: (02/12/2016 09:29:05 AM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The iPod Service service terminated unexpectedly. It has done this 1 time(s).

Error: (02/12/2016 09:29:05 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The Windows Live ID Sign-in Assistant service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.

Error: (02/12/2016 09:29:04 AM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The BBUpdate service terminated unexpectedly. It has done this 1 time(s).

Error: (02/12/2016 09:29:04 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.

Error: (02/12/2016 09:29:04 AM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The Yahoo! Updater service terminated unexpectedly. It has done this 1 time(s).

==================== Memory info ===========================

Processor: Intel® Core i5 CPU M 430 @ 2.27GHz

Percentage of memory in use: 62%

Total physical RAM: 3061.87 MB

Available physical RAM: 1138.46 MB

Total Virtual: 6122.06 MB

Available Virtual: 3691.89 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:463.74 GB) (Free:317.08 GB) NTFS ==>[drive with boot components (obtained from BCD)]

Drive d: (HP_TOOLS) (Fixed) (Total:2 GB) (Free:1.99 GB) FAT32

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 95AA95AA)

Partition 1: (Active) - (Size=463.7 GB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=2 GB) - (Type=0C)

==================== End of Addition.txt ============================

kevinf80 · February 12, 2016

You have not posted the primary log from FRST "FRST.txt" I need to see that log... Logs are saved here: C:\FRST\Logs

Also you have two Anti-Virus programs installed and active, that is counterproductive. You will have to remove one asap....

Avast removal tool available here: https://www.avast.com/uninstall-utility

AVG removal tool available here: http://www.avg.com/us-en/utilities

Is your choice which one to remove...

jbobo348 · February 12, 2016