Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Malware Removal [Solved]

Started by Renita123 , May 04 2015 02:48 PM

This topic is locked

#1
Renita123

Posted 04 May 2015 - 02:48 PM

Member

Member
14 posts

My Malwarebytes Anti-Malware has been detecting malware. Can you help me remove it?

Renita123

Attached Files

aswMBR.txt 2.28KB 250 downloads
Addition.txt 83.4KB 267 downloads
FRST.txt 70.88KB 383 downloads

#2
Naathim

Posted 05 May 2015 - 02:33 AM

GeekU Minion

Expert
4,568 posts

Minion%20Welcome.jpg

My name's Naathim and I'm a GeekU Minion! Now that we are mates and will be working together to clean your machine out of any junkware, feel free to call me Naat

Before we start please note the following:

Analysis and research take some time, also sometimes real life gets in the way, please be patient.

Limit your internet access to posting here, some infections just wait to steal typed-in passwords.

Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.

Paste the logs in your posts, attachments make my work harder and more complicated.

Stay with me to the end, the absence of symtoms doesn't mean that your machine is fully operational.

Note that we may live in totally different time zones, what may cause some delays between answers.

I can't foresee everything, so if anything unexpected happens, please stop and inform me!

There are no silly questions. Never be afraid to ask if in doubt!

Let's start and enjoy the fight!

Can you please post me a report from Malwarebytes Anti-Malware ehat exactly it is detecting?

remove%20outdated.jpg

Uninstall some programs

We need to uninstall some programs.

Press the + R on your keyboard at the same time. Type appwiz.cpl and click OK.
Search there for each entry mentioned below, right-click the entry and click Uninstall one at a time

The list of programs to uninstall:

Ask Toolbar Updater
Image Editor Packages
Mipony Download Manager Packages

Pay special attention when uninstalling, some of the programs may have checkboxes that will either install others instead or ask you to leave them installed!
After completing uninstalls, please manually reboot your machine!

Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

Right-click on icon and select Run as Administrator to start the tool.
Wait patiently until the main console will appear, it may take a minute or two.

In the main box please paste in the following script:

createsrpoint;
C:\Program Files (x86)\YTDownloader;fs
C:\Program Files (x86)\WSE_Astromenda;fs
[-HKLM\SOFTWARE\Policies\Google];r
[-HKLM\SOFTWARE\Policies\Google];r64
{5FC7FB4A-AD3A-42B7-BB3C-7CF7756D5A5E};c
{7627B296-EE11-46DE-93E6-75D29EE90499};c
{C04B7D22-5AEC-4561-8F49-27F6269208F6};c
autoclean;
emptyclsid;
C:\Users\Renita\AppData\Roaming\Mozilla\Firefox\Profiles\wr0wpv71.default\user.js;f
C:\Program Files (x86)\GUT6DA1.tmp;f
C:\Program Files (x86)\GUTEC13.tmp;f
C:\Program Files (x86)\GUTFF26.tmp;f
firefoxlook;
chromelook;
filesrcm;

Make sure that Scan All Users option is checked.
Push Run Script and wait patiently. The scan may take a couple of minutes.
When the scan completes, a zoek-results logfile should open in notepad.
If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Please include its content in your next reply.
Don't forget to re-enable your switched-off protection software!

#3
Renita123

Posted 05 May 2015 - 12:06 PM

Member

Topic Starter
Member
14 posts

My name's Naathim and I'm a GeekU Minion! Now that we are mates and will be working together to clean your machine out of any junkware, feel free to call me Naat

Before we start please note the following:

Analysis and research take some time, also sometimes real life gets in the way, please be patient.
Limit your internet access to posting here, some infections just wait to steal typed-in passwords.
Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
Paste the logs in your posts, attachments make my work harder and more complicated.
Stay with me to the end, the absence of symtoms doesn't mean that your machine is fully operational.
Note that we may live in totally different time zones, what may cause some delays between answers.

I can't foresee everything, so if anything unexpected happens, please stop and inform me!
There are no silly questions. Never be afraid to ask if in doubt!

Let's start and enjoy the fight!

Can you please post me a report from Malwarebytes Anti-Malware ehat exactly it is detecting?

Uninstall some programs

We need to uninstall some programs.
Press the + R on your keyboard at the same time. Type appwiz.cpl and click OK.

Search there for each entry mentioned below, right-click the entry and click Uninstall one at a time

The list of programs to uninstall:
Ask Toolbar Updater

Image Editor Packages

Mipony Download Manager Packages

Pay special attention when uninstalling, some of the programs may have checkboxes that will either install others instead or ask you to leave them installed!
After completing uninstalls, please manually reboot your machine!

Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.
Right-click on icon and select Run as Administrator to start the tool.

Wait patiently until the main console will appear, it may take a minute or two.
In the main box please paste in the following script:
createsrpoint;
C:\Program Files (x86)\YTDownloader;fs
C:\Program Files (x86)\WSE_Astromenda;fs
[-HKLM\SOFTWARE\Policies\Google];r
[-HKLM\SOFTWARE\Policies\Google];r64
{5FC7FB4A-AD3A-42B7-BB3C-7CF7756D5A5E};c
{7627B296-EE11-46DE-93E6-75D29EE90499};c
{C04B7D22-5AEC-4561-8F49-27F6269208F6};c
autoclean;
emptyclsid;
C:\Users\Renita\AppData\Roaming\Mozilla\Firefox\Profiles\wr0wpv71.default\user.js;f
C:\Program Files (x86)\GUT6DA1.tmp;f
C:\Program Files (x86)\GUTEC13.tmp;f
C:\Program Files (x86)\GUTFF26.tmp;f
firefoxlook;
chromelook;
filesrcm;
Make sure that Scan All Users option is checked.

Push Run Script and wait patiently. The scan may take a couple of minutes.

When the scan completes, a zoek-results logfile should open in notepad.

If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)
Please include its content in your next reply.
Don't forget to re-enable your switched-off protection software!

Malwarebytes Report

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 5/5/2015

Scan Time: 11:26:40 AM

Logfile: Malwarebytes report.txt

Administrator: Yes

Version: 2.01.6.1022

Malware Database: v2015.05.05.03

Rootkit Database: v2015.04.21.01

License: Premium

Malware Protection: Enabled

Malicious Website Protection: Enabled

Self-protection: Disabled

OS: Windows 7 Service Pack 1

CPU: x64

File System: NTFS

User: Renita

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 421058

Time Elapsed: 26 min, 38 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Enabled

Heuristics: Enabled

PUP: Warn

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 5

PUP.Optional.Astromenda.C, HKLM\SOFTWARE\CLASSES\APPID\{9CB2CD61-FFA0-406C-9D2D-8FDE6F4A4D8A}\INSTL\DATA, , [b94e7719a2e81224c5d2f9d3ae552ad6],

PUP.Optional.Astromenda.C, HKLM\SOFTWARE\CLASSES\WOW6432NODE\APPID\{9CB2CD61-FFA0-406C-9D2D-8FDE6F4A4D8A}\INSTL\DATA, , [9e69a7e9e6a41125d7c0ae1ef80b10f0],

PUP.Optional.Astromenda.C, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{9CB2CD61-FFA0-406C-9D2D-8FDE6F4A4D8A}\INSTL\DATA, , [49be3a560f7b54e2badd19b3d42f748c],

PUP.Optional.ConduitTB.Gen, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\DACHBOKEKLMHLIKPKLNKMMEALJDFANOH, , [45c24749a8e2c3734680755724df2dd3],

PUP.Optional.ConduitTB.Gen, HKU\S-1-5-21-3026445660-3059579512-81386765-1000\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\DACHBOKEKLMHLIKPKLNKMMEALJDFANOH, , [0afd553b0288c4729f284983f80beb15],

Registry Values: 6

PUP.Optional.Astromenda.C, HKLM\SOFTWARE\CLASSES\APPID\{9CB2CD61-FFA0-406C-9D2D-8FDE6F4A4D8A}\INSTL\DATA|tlbrSrchUrl, http://astromenda.co...27372383&ir=&q=, , [b94e7719a2e81224c5d2f9d3ae552ad6]

PUP.Optional.Astromenda.C, HKLM\SOFTWARE\CLASSES\WOW6432NODE\APPID\{9CB2CD61-FFA0-406C-9D2D-8FDE6F4A4D8A}\INSTL\DATA|tlbrSrchUrl, http://astromenda.co...27372383&ir=&q=, , [9e69a7e9e6a41125d7c0ae1ef80b10f0]

PUP.Optional.Astromenda.C, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{9CB2CD61-FFA0-406C-9D2D-8FDE6F4A4D8A}\INSTL\DATA|tlbrSrchUrl, http://astromenda.co...27372383&ir=&q=, , [49be3a560f7b54e2badd19b3d42f748c]

PUP.Optional.ConduitTB.Gen, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\dachbokeklmhlikpklnkmmealjdfanoh|path, C:\Users\Renita\AppData\Local\CRE\dachbokeklmhlikpklnkmmealjdfanoh.crx, , [45c24749a8e2c3734680755724df2dd3]

PUP.Optional.Astromenda.C, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY|AppPath, C:\Program Files (x86)\WSE_Astromenda\\, , [6b9c4d4332583afcecb53597b15251af]

PUP.Optional.ConduitTB.Gen, HKU\S-1-5-21-3026445660-3059579512-81386765-1000\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\dachbokeklmhlikpklnkmmealjdfanoh|path, C:\Users\Renita\AppData\Local\CRE\dachbokeklmhlikpklnkmmealjdfanoh.crx, , [0afd553b0288c4729f284983f80beb15]

Registry Data: 0

(No malicious items detected)

Folders: 133

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\APISupport, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\js, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\js\lib, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\js\options, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\js\tabs, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\js\tabs\back, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\js\toolbarAPI, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\mam, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\mam\scripts, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\mam\scripts\contentScripts, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\nativeMessaging, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\plugins, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\Search, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\Search\html, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\Search\NewTabPages, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\tb, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\tb\al, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\tb\al\aboutBox, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\tb\al\ac, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\tb\al\ac\css, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\tb\al\ac\img, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\tb\al\ac\res, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\tb\al\api, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\tb\al\msd, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\tb\al\sp, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\tb\al\sp\js, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\tb\al\ui, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\tb\al\ui\dlg, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\tb\al\ui\gf, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\tb\al\wa, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\tb\core, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\tb\lib, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\tb\lib\jquery.alerts, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\tb\sl, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\_locales, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\_locales\en, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\CRE, , [24e3810f5f2b92a4d3f27c5022e17a86],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3291325, , [4fb8553b95f5c373de02ccfec2412ed2],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3291325\1_0_0_10, , [4fb8553b95f5c373de02ccfec2412ed2],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3291325\1_0_0_2, , [4fb8553b95f5c373de02ccfec2412ed2],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3291325\1_0_0_4, , [4fb8553b95f5c373de02ccfec2412ed2],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3291325\1_0_0_6, , [4fb8553b95f5c373de02ccfec2412ed2],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3291325\1_0_0_7, , [4fb8553b95f5c373de02ccfec2412ed2],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3291325\1_0_0_9, , [4fb8553b95f5c373de02ccfec2412ed2],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3291325\1_0_1_6, , [4fb8553b95f5c373de02ccfec2412ed2],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3291325\1_0_2_0, , [4fb8553b95f5c373de02ccfec2412ed2],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3300236, , [f116fb953654c5717070e1e951b2e21e],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3300236\1_0_0_10, , [f116fb953654c5717070e1e951b2e21e],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3300236\1_0_0_2, , [f116fb953654c5717070e1e951b2e21e],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3300236\1_0_0_4, , [f116fb953654c5717070e1e951b2e21e],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3300236\1_0_0_6, , [f116fb953654c5717070e1e951b2e21e],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3300236\1_0_0_7, , [f116fb953654c5717070e1e951b2e21e],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3300236\1_0_0_9, , [f116fb953654c5717070e1e951b2e21e],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3300236\1_0_1_6, , [f116fb953654c5717070e1e951b2e21e],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3300236\1_0_2_0, , [f116fb953654c5717070e1e951b2e21e],

Files: 621

PUP.Optional.Goobzo, C:\Users\Renita\AppData\Local\Temp\tu17p84.exe, , [fc0bb3dd0c7eaf875eb25bf3bc4a04fc],

PUP.Optional.Mypcbackup, C:\Users\Renita\AppData\Local\Temp\Install_26465\jd.exe, , [27e0167ad2b8b97da56263ebd1356898],

PUP.Optional.Proinstall, C:\Users\Renita\Downloads\abcexcel-30612726.exe, , [b453a5eb1d6d8da9e1bb8ebca95951af],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\CT3300236.txt, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\634968087898924591.png, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\AbstractionLayerBack.js, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\blank.png, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\icon.png, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\initdata.json, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\manifest.json, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\shouldShowTB.txt, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\APISupport\APISupport.dll, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\js\framework.js, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\js\bcview.js, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\js\chromeBackstage.html, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\js\communicator.back.js, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\js\compatibility.end.js, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\js\compatibility.service.js, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\js\compatibility.start.js, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\js\contentScript.js, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\js\iframeHost.html, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\js\JSONStringify.js, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\js\logger.js, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\js\match.js, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\js\nativeMsgCom.js, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\js\navigationHandler.js, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\js\pluginLoader.js, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\js\pricegongMigration.js, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\js\updatesManager.js, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\js\verlyEarly.js, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\js\lib\jquery-1.5.min.js, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\js\options\Options.html, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\mam\background.html, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\mam\settings.json, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\mam\scripts\background.js, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\mam\scripts\iframeHost.html, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\mam\scripts\iframeHost.js, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\plugins\ChromeApiPlugin.dll, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\tb\backstage.html, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\tb\version.txt, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\tb\core\corelibs.js, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\tb\lib\al.viewPerformanceLog.js, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\tb\lib\background.js, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\tb\lib\script2injectEmbedded.js, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\tb\lib\script2injectPopup.js, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\tb\sl\serviceLayer.js, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\dachbokeklmhlikpklnkmmealjdfanoh\10.31.4.510_0\_locales\en\messages.json, , [fd0a9cf46f1b3bfb2f9325a75ea505fb],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\CRE\dachbokeklmhlikpklnkmmealjdfanoh.crx, , [24e3810f5f2b92a4d3f27c5022e17a86],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3291325\nmHostManifest.json, , [4fb8553b95f5c373de02ccfec2412ed2],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3291325\1_0_0_10\nmHostConfig.json, , [4fb8553b95f5c373de02ccfec2412ed2],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3291325\1_0_0_10\nmHostManifest.json, , [4fb8553b95f5c373de02ccfec2412ed2],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3291325\1_0_0_10\TBMessagingHost.exe, , [4fb8553b95f5c373de02ccfec2412ed2],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3291325\1_0_0_2\nmHostConfig.json, , [4fb8553b95f5c373de02ccfec2412ed2],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3291325\1_0_0_2\nmHostManifest.json, , [4fb8553b95f5c373de02ccfec2412ed2],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3291325\1_0_0_2\TBMessagingHost.exe, , [4fb8553b95f5c373de02ccfec2412ed2],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3291325\1_0_0_4\nmHostConfig.json, , [4fb8553b95f5c373de02ccfec2412ed2],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3291325\1_0_0_4\nmHostManifest.json, , [4fb8553b95f5c373de02ccfec2412ed2],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3291325\1_0_0_4\TBMessagingHost.exe, , [4fb8553b95f5c373de02ccfec2412ed2],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3291325\1_0_0_6\nmHostConfig.json, , [4fb8553b95f5c373de02ccfec2412ed2],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3291325\1_0_0_6\nmHostManifest.json, , [4fb8553b95f5c373de02ccfec2412ed2],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3291325\1_0_0_6\TBMessagingHost.exe, , [4fb8553b95f5c373de02ccfec2412ed2],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3291325\1_0_0_7\nmHostConfig.json, , [4fb8553b95f5c373de02ccfec2412ed2],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3291325\1_0_0_7\nmHostManifest.json, , [4fb8553b95f5c373de02ccfec2412ed2],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3291325\1_0_0_7\TBMessagingHost.exe, , [4fb8553b95f5c373de02ccfec2412ed2],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3291325\1_0_0_9\nmHostConfig.json, , [4fb8553b95f5c373de02ccfec2412ed2],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3291325\1_0_0_9\nmHostManifest.json, , [4fb8553b95f5c373de02ccfec2412ed2],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3291325\1_0_0_9\TBMessagingHost.exe, , [4fb8553b95f5c373de02ccfec2412ed2],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3291325\1_0_1_6\nmHostConfig.json, , [4fb8553b95f5c373de02ccfec2412ed2],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3291325\1_0_1_6\nmHostManifest.json, , [4fb8553b95f5c373de02ccfec2412ed2],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3291325\1_0_2_0\nmHostConfig.json, , [4fb8553b95f5c373de02ccfec2412ed2],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3291325\1_0_2_0\nmHostManifest.json, , [4fb8553b95f5c373de02ccfec2412ed2],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3300236\nmHostManifest.json, , [f116fb953654c5717070e1e951b2e21e],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3300236\1_0_0_10\nmHostConfig.json, , [f116fb953654c5717070e1e951b2e21e],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3300236\1_0_0_10\nmHostManifest.json, , [f116fb953654c5717070e1e951b2e21e],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3300236\1_0_0_10\TBMessagingHost.exe, , [f116fb953654c5717070e1e951b2e21e],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3300236\1_0_0_2\nmHostConfig.json, , [f116fb953654c5717070e1e951b2e21e],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3300236\1_0_0_2\nmHostManifest.json, , [f116fb953654c5717070e1e951b2e21e],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3300236\1_0_0_2\TBMessagingHost.exe, , [f116fb953654c5717070e1e951b2e21e],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3300236\1_0_0_4\nmHostConfig.json, , [f116fb953654c5717070e1e951b2e21e],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3300236\1_0_0_4\nmHostManifest.json, , [f116fb953654c5717070e1e951b2e21e],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3300236\1_0_0_4\TBMessagingHost.exe, , [f116fb953654c5717070e1e951b2e21e],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3300236\1_0_0_6\nmHostConfig.json, , [f116fb953654c5717070e1e951b2e21e],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3300236\1_0_0_6\nmHostManifest.json, , [f116fb953654c5717070e1e951b2e21e],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3300236\1_0_0_6\TBMessagingHost.exe, , [f116fb953654c5717070e1e951b2e21e],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3300236\1_0_0_7\nmHostConfig.json, , [f116fb953654c5717070e1e951b2e21e],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3300236\1_0_0_7\nmHostManifest.json, , [f116fb953654c5717070e1e951b2e21e],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3300236\1_0_0_7\TBMessagingHost.exe, , [f116fb953654c5717070e1e951b2e21e],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3300236\1_0_0_9\nmHostConfig.json, , [f116fb953654c5717070e1e951b2e21e],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3300236\1_0_0_9\nmHostManifest.json, , [f116fb953654c5717070e1e951b2e21e],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3300236\1_0_0_9\TBMessagingHost.exe, , [f116fb953654c5717070e1e951b2e21e],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3300236\1_0_1_6\nmHostConfig.json, , [f116fb953654c5717070e1e951b2e21e],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3300236\1_0_1_6\nmHostManifest.json, , [f116fb953654c5717070e1e951b2e21e],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3300236\1_0_2_0\nmHostConfig.json, , [f116fb953654c5717070e1e951b2e21e],

PUP.Optional.ConduitTB.Gen, C:\Users\Renita\AppData\Local\NativeMessaging\CT3300236\1_0_2_0\nmHostManifest.json, , [f116fb953654c5717070e1e951b2e21e],

Physical Sectors: 0

(No malicious items detected)

#4
Renita123

Posted 05 May 2015 - 04:18 PM

Member

Topic Starter
Member
14 posts

Naat,

When I try to uninstall "Ask Toolbar Updater" I get a message "You do not have sufficient access to uninstall Ask Toolbar Updater. Please contact your system administrator." I am the owner of the computer. The other two uninstalled. Should I continue with the rest of your instruction or do I need to get Ask Toolbar Updater uninstalled first?

Renita

#5
Naathim

Posted 06 May 2015 - 01:40 AM

GeekU Minion

Expert
4,568 posts

Please continue with the script, I will take care about the Ask later using some sledgehammers

#6
Renita123

Posted 06 May 2015 - 09:33 AM

Member

Topic Starter
Member
14 posts

Hi

Please continue with the script, I will take care about the Ask later using some sledgehammers

Zoek.exe v5.0.0.0 Updated 04-May-2015

Tool run by Renita on Wed 05/06/2015 at 9:13:36.38.

Microsoft Windows 7 Professional 6.1.7601 Service Pack 1 x64

Running in: Normal Mode Internet Access Detected

Launched: C:\Users\Renita\Downloads\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

5/6/2015 9:18:38 AM Zoek.exe System Restore Point Created Successfully.

==== Empty Folders Check ======================

C:\PROGRA~2\blekkotb_soc deleted successfully

C:\PROGRA~2\Malwarebytes' Anti-Malware deleted successfully

C:\PROGRA~2\PCFixSpeed deleted successfully

C:\PROGRA~2\SearchProtect deleted successfully

C:\Program Files\Common Files\Autodesk Shared deleted successfully

C:\Users\Renita\AppData\Roaming\2EA13A16 deleted successfully

C:\Users\Renita\AppData\Roaming\DigitalSites deleted successfully

C:\Users\Renita\AppData\Roaming\Download Manager deleted successfully

C:\Users\Renita\AppData\Roaming\DSite deleted successfully

C:\Users\Renita\AppData\Roaming\Malwarebytes deleted successfully

C:\Users\Renita\AppData\Roaming\TightVNC deleted successfully

C:\Users\Renita\AppData\Roaming\UltraVNC deleted successfully

C:\Users\Renita\AppData\Roaming\Wondershare Video Converter Ultimate deleted successfully

C:\Users\Renita\AppData\Local\CrossLoop deleted successfully

C:\Users\Renita\AppData\Local\NativeMessaging deleted successfully

C:\Users\Renita\AppData\Local\TB deleted successfully

#7
Naathim

Posted 07 May 2015 - 01:03 AM

GeekU Minion

Expert
4,568 posts

Hi,

this doesn't look like a complete logfile. Can you please check the content of the C:\zoek-results.log file?

#8
Renita123

Posted 07 May 2015 - 09:01 AM

Member

Topic Starter
Member
14 posts

Hi,

this doesn't look like a complete logfile. Can you please check the content of the C:\zoek-results.log file?

That is all that is in the logfile. I will re-run it and see if I get a different result. When I execute the zoek program I get a cmd.exe-No Disk error that says "There is no disk in the drive. Please insert a disk into drive \Device\Harddisk6\DR6". When I click Try Again it opens. I insert the script into zoek and run script. I get the same message but when I click Try Again it goes through the process for me.

Edited by Renita123, 07 May 2015 - 09:06 AM.

#9
Renita123

Posted 07 May 2015 - 09:37 AM

Member

Topic Starter
Member
14 posts

Hi,

this doesn't look like a complete logfile. Can you please check the content of the C:\zoek-results.log file?

That is all that is in the logfile. I will re-run it and see if I get a different result. When I execute the zoek program I get a cmd.exe-No Disk error that says "There is no disk in the drive. Please insert a disk into drive \Device\Harddisk6\DR6". When I click Try Again it opens. I insert the script into zoek and run script. I get the same message but when I click Try Again it goes through the process for me.

Naat,

This one has a lot more in it. Does it look more like what you expected?

Zoek.exe v5.0.0.0 Updated 04-May-2015

Tool run by Renita on Thu 05/07/2015 at 9:01:02.06.

Microsoft Windows 7 Professional 6.1.7601 Service Pack 1 x64

Running in: Normal Mode Internet Access Detected

Launched: C:\Users\Renita\Downloads\zoek.exe [Scan all users] [Script inserted]

==== Older Logs ======================

C:\zoek-results2015-05-06-152244.log 1468 bytes

==== System Restore Info ======================

5/7/2015 9:01:41 AM Zoek.exe System Restore Point Created Successfully.

==== Empty Folders Check ======================

\2G8Iresources

\557765.Uninstall

\786AE384-C609-4B0E-A787-407F84390DA5

\7FF17FF2-519A-4757-AA6A-5D0AA9713C51

\825216D8-F1F9-408D-A569-697C594731E6

\83FBF260-9010-48CD-AACC-BDCE9BB8165A

\97475025.Uninstall

\97520998.Uninstall

\A454C782-3BE8-45AB-BDF6-77BEE770D9D7

\Acrobat Distiller 8

\acrord32_sbx

\Adobe

\AECF0002-7209-4F6C-8486-BC6BE67F7CFF

\AppleMediaCache

\Audible Device Images

\Autotag

\CitrixLogs

\comtypes_cache

\F428.tmp

\Google Toolbar

\History

\hsperfdata_Renita

\icc_051186061212

\Install_162

\Install_24343

\Install_26465

\is366025459

\ish1044557340

\iTunes CD burn

\iTunes CD burn 1

\Low

\MessengerCache

\msdtadmin

\msohtmlclip

\msohtmlclip1

\MSS

\Picasa3

\RapidSolution

\scoped_dir1688_2413

\scoped_dir2308_15878

\scoped_dir2480_7711

\scoped_dir2752_5467

\scoped_dir3332_412

\scoped_dir3344_13557

\scoped_dir3364_18820

\scoped_dir3388_2985

\scoped_dir3496_32520

\scoped_dir3508_12930

\scoped_dir3580_8931

\scoped_dir3624_4254

\scoped_dir3708_28617

\scoped_dir3772_21910

\scoped_dir3772_21983

\scoped_dir3772_27713

\scoped_dir3772_3114

\scoped_dir3772_5319

\scoped_dir3772_5485

\scoped_dir3772_7374

\scoped_dir3772_8174

\scoped_dir3800_14065

\scoped_dir3936_7299

\scoped_dir3956_31197

\scoped_dir4232_13417

\scoped_dir4296_18450

\scoped_dir4380_354

\scoped_dir4528_19200

\scoped_dir4588_27693

\scoped_dir4604_29691

\scoped_dir4652_2075

\scoped_dir4652_29832

\scoped_dir4676_12286

\scoped_dir4744_31744

\scoped_dir4752_32447

\scoped_dir4760_18726

\scoped_dir4808_17600

\scoped_dir4856_29137

\scoped_dir4860_16180

\scoped_dir4976_322

\scoped_dir4988_20146

\scoped_dir5024_25318

\scoped_dir5060_22814

\scoped_dir5512_4903

\scoped_dir5624_26839

\scoped_dir6136_26212

\scoped_dir6648_28732

\scoped_dir7360_30382

\scoped_dir_3524_250

\scoped_dir_3524_2502

\scoped_dir_3524_3818

\scoped_dir_5820_147

\Skype

\Symform

\tmpflztye

\tmpfy5ja1

\tmpr6zcmo

\Utility

\VBE

\wlmail-433777574

\WMPBurn

\WPDNSE

\_av4_

\_avast4_

\_MEI11642

\_MEI12002

\_MEI19362

\_MEI23522

\_MEI36602

\_MEI48562

\{08035C12-C081-4813-8A6D-0DF8D1951361}

\{1134ADD8-E64C-4D2F-BBA7-140786612575}

\{157EEC68-C9DD-41FE-8A4C-D11A090EF299}

\{16AA8FB8-4A98-4757-B7A5-0FF22C0A6E33}_0

\{16AA8FB8-4A98-4757-B7A5-0FF22C0A6E33}_1

\{16AA8FB8-4A98-4757-B7A5-0FF22C0A6E33}_2

\{436E3108-9859-4A4F-B647-72ED12B93A5C}

\{51EB4ED2-741B-471C-97F9-721D82ADD240}

\{63b42778-62d5-43ab-b5f9-861dbf2eb88e}

\{68A57B5B-390C-4B90-B493-55D66B993F3A}

\{71EF76B3-99F7-4E34-96DE-110F477C0DDF}

\{95A1F810-CDA1-4F6C-A3F7-D83A0A410639}

\{9F262E23-60D1-415F-98FB-045683B937A5}

\{B3981714-132D-4557-AB73-690C5EBE201A}

\{BC435FE5-4375-47A1-B8CE-1A4713CEFCBE}

\{BF61A71C-889D-4167-86ED-1517EA86EF82}

\{E7D8AB64-A2E4-42EE-8085-4CFF84E8ADB2}

\{F3C409CB-554E-46FA-980B-8D796C715DE8}

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-3026445660-3059579512-81386765-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{32004B8A-44A9-43E7-84E9-808838809519} deleted successfully

HKEY_USERS\S-1-5-21-3026445660-3059579512-81386765-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{289AF171-A56A-498D-AF49-679A65BFF4D4} deleted successfully

HKEY_USERS\S-1-5-21-3026445660-3059579512-81386765-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{300DDBE7-C154-426A-93EC-8DD86FB73C9} deleted successfully

HKEY_USERS\S-1-5-21-3026445660-3059579512-81386765-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{47FD4BB4-EC9E-4574-8440-92364762C6EC} deleted successfully

HKEY_USERS\S-1-5-21-3026445660-3059579512-81386765-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{517CF092-55E4-4897-889D-4F9A5E6EC0D1} deleted successfully

HKEY_USERS\S-1-5-21-3026445660-3059579512-81386765-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{53534E64-D910-437D-80FB-4BECA124E592} deleted successfully

HKEY_USERS\S-1-5-21-3026445660-3059579512-81386765-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5A9C562A-ADEF-41F6-963-705EFDB580D1} deleted successfully

HKEY_USERS\S-1-5-21-3026445660-3059579512-81386765-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5D59E5C2-6A0-44B2-9AC5-D150E82BE8DB} deleted successfully

HKEY_USERS\S-1-5-21-3026445660-3059579512-81386765-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5F462875-8BF0-4B7D-A688-225BBA4E6F} deleted successfully

HKEY_USERS\S-1-5-21-3026445660-3059579512-81386765-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{712133B5-B888-4336-8893-528417AB286A} deleted successfully

HKEY_USERS\S-1-5-21-3026445660-3059579512-81386765-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{71A9E2BE-8F18-475B-846-286B926CAF90} deleted successfully

HKEY_USERS\S-1-5-21-3026445660-3059579512-81386765-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{770C3C43-1903-4F74-A649-356637845F8} deleted successfully

HKEY_USERS\S-1-5-21-3026445660-3059579512-81386765-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{87E751A8-3BA8-44E0-87BD-C43EEE399A29} deleted successfully

HKEY_USERS\S-1-5-21-3026445660-3059579512-81386765-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8B9B4922-512-4A5E-A0BA-626EBAC53D5B} deleted successfully

HKEY_USERS\S-1-5-21-3026445660-3059579512-81386765-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{91B9F0E1-EAE4-46CE-8C8-F0CCB42CED4C} deleted successfully

HKEY_USERS\S-1-5-21-3026445660-3059579512-81386765-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5F4F8BD-FC6E-450B-A3A9-A5976E952DBB} deleted successfully

HKEY_USERS\S-1-5-21-3026445660-3059579512-81386765-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C86614CB-631-4BD8-8E4D-A39E2EC68382} deleted successfully

HKEY_USERS\S-1-5-21-3026445660-3059579512-81386765-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D03A7C14-5F22-42D3-A0AD-B18FAB4B583C} deleted successfully

HKEY_USERS\S-1-5-21-3026445660-3059579512-81386765-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EB34C15E-3F1-457A-9DFD-6F9450434872} deleted successfully

HKEY_USERS\S-1-5-21-3026445660-3059579512-81386765-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF007AE-C894-4ED1-AD77-38907A741B18} deleted successfully

HKEY_USERS\S-1-5-21-3026445660-3059579512-81386765-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F50DB36A-9AE3-4E54-BB6E-E3E33256B7C0} deleted successfully

==== Deleting CLSID Registry Values ======================

HKEY_USERS\S-1-5-21-3026445660-3059579512-81386765-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully

==== Deleting Services ======================

==== Registry Fix Code ======================

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google]

==== Registry Fix Code x64 ======================

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google]

==== Deleting Files \ Folders ======================

C:\Program Files (x86)\YTDownloader not found

C:\Program Files (x86)\WSE_Astromenda not found

C:\Users\Renita\AppData\LocalLow\Conduit deleted

C:\PROGRA~2\GUT6DA1.tmp deleted

C:\PROGRA~2\GUTEC13.tmp deleted

C:\PROGRA~2\GUTFF26.tmp deleted

C:\PROGRA~2\GUM6DA0.tmp deleted

C:\PROGRA~2\GUMEC12.tmp deleted

C:\PROGRA~2\GUMFF25.tmp deleted

C:\PROGRA~2\FoxTabVideoConverter deleted

C:\PROGRA~2\VideoConverter deleted

C:\PROGRA~2\vGrabber-software deleted

C:\PROGRA~2\Wondershare deleted

C:\PROGRA~2\globalUpdate deleted

C:\found.000 deleted

C:\Users\Renita\AppData\Roaming\WB.CFG deleted

C:\Users\Renita\AppData\Roaming\Mipony deleted

C:\Users\Renita\AppData\Roaming\stocksTicker.ini deleted

C:\Users\Renita\AppData\Roaming\wizards.ini deleted

C:\Users\Renita\AppData\Roaming\FileDiagTool.log deleted

C:\Users\Renita\AppData\Roaming\pcouffin.log deleted

C:\Users\Renita\AppData\Roaming\GetRightToGo deleted

C:\Users\Renita\AppData\Local\WhiteListing deleted

C:\Users\Renita\AppData\Local\globalUpdate deleted

C:\Users\Renita\AppData\Local\Wondershare deleted

C:\Users\Renita\AppData\Local\cache deleted

C:\Users\Renita\AppData\Local\CrashRpt deleted

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QB Connection Diagnostic Tool deleted

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare deleted

C:\Users\Renita\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Video Downloader deleted

C:\windows\SysNative\Tasks\DSite deleted

C:\Users\Renita\AppData\LocalLow\TB deleted

C:\Users\Renita\AppData\LocalLow\blekkotb_019 deleted

C:\Windows\wininit.ini deleted

C:\windows\SysNative\Tasks\LaunchSignup deleted

C:\windows\SysNative\tasks\YTDownloader deleted

C:\Windows\tasks\DSite.job deleted

C:\Windows\SysNative\config\systemprofile\Searches deleted

C:\windows\SysNative\GroupPolicy\Machine deleted

C:\windows\SysNative\GroupPolicy\User deleted

C:\windows\SysNative\GroupPolicy\GPT.INI deleted

C:\Windows\Syswow64\GroupPolicy\gpt.ini deleted

C:\Windows\SysWow64\searchplugins deleted

C:\Windows\SysWow64\Extensions deleted

C:\Users\Renita\Documents\Add-in Express deleted

C:\Users\Renita\Desktop\Sync Folder.lnk deleted

C:\Users\Renita\g2ax_customer_downloadhelper_win32_x86.exe deleted

C:\Users\Renita\gosetup.exe deleted

"C:\Users\Renita\AppData\Roaming\Mozilla\Firefox\Profiles\wr0wpv71.default\user.js" deleted

"C:\PROGRA~2\COMMON~1\Wondershare\Wondershare Helper Compact\CBSCreateVC.dll" deleted

"C:\PROGRA~2\COMMON~1\Wondershare\Wondershare Helper Compact\CBSProducstInfo.dll" deleted

"C:\PROGRA~2\COMMON~1\Wondershare\Wondershare Helper Compact\DAQExp.dll" deleted

"C:\PROGRA~2\COMMON~1\Wondershare\Wondershare Helper Compact\WSHelper.exe" deleted

"C:\PROGRA~2\COMMON~1\Wondershare" deleted

"C:\PROGRA~2\COMMON~1\Wondershare\Wondershare Helper Compact" deleted

==== Files Recently Created / Modified ======================

====== C:\Windows ====

====== C:\Users\Renita\AppData\Local\Temp ====

2015-05-06 15:43:33 C9889FA47FA63E6257B7A966C40BE286 43008 ----a-w- C:\Users\Renita\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmppzrwx8.dll

2015-05-05 21:56:13 8C7FB9078A63B7E5E899E7A2DBB0DB53 1114624 ----a-w- C:\Users\Renita\AppData\Local\Temp\557765.Uninstall\uninstaller.exe

2015-05-05 18:06:38 8C7FB9078A63B7E5E899E7A2DBB0DB53 1114624 ----a-w- C:\Users\Renita\AppData\Local\Temp\97520998.Uninstall\uninstaller.exe

2015-05-05 18:05:52 8C7FB9078A63B7E5E899E7A2DBB0DB53 1114624 ----a-w- C:\Users\Renita\AppData\Local\Temp\97475025.Uninstall\uninstaller.exe

2015-05-04 20:33:15 088022E7418526C11831394502A6E5BD 86016 ----a-w- C:\Users\Renita\AppData\Local\Temp\_av4_\aswScan.dll

2015-05-04 20:33:14 99F500385CB4DFF826F0A9058BEE2C98 131072 ----a-w- C:\Users\Renita\AppData\Local\Temp\_av4_\aswCmnB.dll

2015-05-04 20:33:14 6B198F82D25A06E2E402385038E6785B 1228800 ----a-w- C:\Users\Renita\AppData\Local\Temp\_av4_\aswEngin.dll

2015-05-04 20:33:14 13EEB998A123530809BFBC16A6BE580E 192512 ----a-w- C:\Users\Renita\AppData\Local\Temp\_av4_\aswCmnS.dll

2015-05-04 20:33:14 01033EDA5F63E4BA48C25099CE9D6BDD 81920 ----a-w- C:\Users\Renita\AppData\Local\Temp\_av4_\aswCmnOS.dll

2015-05-01 00:46:21 55D0E67A7C9BFD15E24C7F67A32FA6E5 25700056 ----a-w- C:\Users\Renita\AppData\Local\Temp\tmpfy5ja1\googledrivesync.exe

2015-04-28 01:46:03 CE70C1CFE3CC380CFC7C765045DD96E4 26232152 ----a-w- C:\Users\Renita\AppData\Local\Temp\tmpflztye\googledrivesync.exe

====== Java Cache =====

====== C:\Windows\SysWOW64 =====

2015-04-24 22:05:36 E981C27FA6C2F45C135DB4AF78D6FE1F 92672 ----a-w- C:\Windows\SysWOW64\wudriver.dll

2015-04-24 22:05:36 C7E498E41D92CF8C2EAED9995781A7F7 29696 ----a-w- C:\Windows\SysWOW64\wups.dll

2015-04-24 22:05:36 9D68CE45935C439D5082ECB56902124D 566784 ----a-w- C:\Windows\SysWOW64\wuapi.dll

2015-04-24 22:05:36 751C4859FD46A1461B3FB57252F541D8 33792 ----a-w- C:\Windows\SysWOW64\wuapp.exe

2015-04-24 22:05:36 031C03C9639CE0D294695968C68A5775 173056 ----a-w- C:\Windows\SysWOW64\wuwebv.dll

2015-04-24 22:05:09 2B381229CCACA02AFF9D27B09073E523 311808 ----a-w- C:\Windows\SysWOW64\gdi32.dll

2015-04-24 22:05:05 DA5B856A037872BE089CA6967C7050C5 1237504 ----a-w- C:\Windows\SysWOW64\msxml3.dll

2015-04-24 22:05:03 78492CF3C3697FB5AF4EAABB2BAF8595 2048 ----a-w- C:\Windows\SysWOW64\msxml3r.dll

2015-04-24 22:04:47 32B9FEE479FF55234ED6BCF1D7976189 1309696 ----a-w- C:\Windows\SysWOW64\ntdll.dll

2015-04-24 22:04:46 A6A644BFAE31F111F35F8C3C7BA2A8A0 3976632 ----a-w- C:\Windows\SysWOW64\ntkrnlpa.exe

2015-04-24 22:04:46 11896E75E1A118ABFAD126BEB650A189 3920824 ----a-w- C:\Windows\SysWOW64\ntoskrnl.exe

2015-04-24 22:04:45 99DE8BADC0E85C9AB4A8301A3723FFEA 1114112 ----a-w- C:\Windows\SysWOW64\kernel32.dll

2015-04-24 22:04:44 BC09159AFF6639DB2CB28058731199F0 248832 ----a-w- C:\Windows\SysWOW64\schannel.dll

2015-04-24 22:04:43 DB7CFA08957C94F6CFAA0DBB8BE4B906 550912 ----a-w- C:\Windows\SysWOW64\kerberos.dll

2015-04-24 22:04:43 56977F27A96383E2A6C8BACEFC17E9CA 259584 ----a-w- C:\Windows\SysWOW64\msv1_0.dll

2015-04-24 22:04:42 2DE438AE95C59FB33B3E4E34827C1100 221184 ----a-w- C:\Windows\SysWOW64\ncrypt.dll

2015-04-24 22:04:41 E6A73ED322D8D0E85589894157F81940 25600 ----a-w- C:\Windows\SysWOW64\setup16.exe

2015-04-24 22:04:41 A057B61F8A553F6DA38563597FA3676B 65536 ----a-w- C:\Windows\SysWOW64\TSpkg.dll

2015-04-24 22:04:41 655C88135254C78E6FB66B6C2F6AC5DA 172032 ----a-w- C:\Windows\SysWOW64\wdigest.dll

2015-04-24 22:04:40 A169307F0105183092F2AEDA9A8BD15D 43008 ----a-w- C:\Windows\SysWOW64\srclient.dll

2015-04-24 22:04:40 6F8CEB8115737D2E049804B191AE41A9 50176 ----a-w- C:\Windows\SysWOW64\auditpol.exe

2015-04-24 22:04:39 6A9FFEF19C4F8F2E9082A50BB07ECDF1 22016 ----a-w- C:\Windows\SysWOW64\secur32.dll

2015-04-24 22:04:39 47A1F23EE40C2389FCD53E9D5CEA3430 17408 ----a-w- C:\Windows\SysWOW64\credssp.dll

2015-04-24 22:04:39 06C69684C3730E1A31DF06D4DD4042BC 14336 ----a-w- C:\Windows\SysWOW64\ntvdm64.dll

2015-04-24 22:04:38 C2A7AEA0A0FF0E7284632902FF9BD73A 96768 ----a-w- C:\Windows\SysWOW64\sspicli.dll

2015-04-24 22:04:38 52C84F726B8B84634F2E666C49076CDE 274944 ----a-w- C:\Windows\SysWOW64\KernelBase.dll

2015-04-24 22:04:38 0FF9EEFF3EFC725FD90AD2CDA5A96776 5120 ----a-w- C:\Windows\SysWOW64\wow32.dll

2015-04-24 22:04:35 FC898E44379D877DE92D869E713528CD 7680 ----a-w- C:\Windows\SysWOW64\instnm.exe

2015-04-24 22:04:34 C557EB6CD735B4EE5076EA289B02CEAC 6656 ----a-w- C:\Windows\SysWOW64\apisetschema.dll

2015-04-24 22:04:34 53C485BC8BBD41877F58AEB89412F5D7 2048 ----a-w- C:\Windows\SysWOW64\user.exe

2015-04-24 22:04:34 2E0F849B7BF17969E45881FA4EB9B487 686080 ----a-w- C:\Windows\SysWOW64\adtschema.dll

2015-04-24 22:04:33 C0693456929F40833B9CC36C9CF7E3A8 146432 ----a-w- C:\Windows\SysWOW64\msaudite.dll

2015-04-24 22:04:33 4B21D227B191A6305087BDD6BB19220F 60416 ----a-w- C:\Windows\SysWOW64\msobjs.dll

2015-04-24 22:02:52 BA897AB3BC3DBC25829946EBA487496C 30720 ----a-w- C:\Windows\SysWOW64\iernonce.dll

2015-04-24 22:02:52 8CD57250F538CFFA0D5DCA9773AEDCAB 47616 ----a-w- C:\Windows\SysWOW64\ieetwproxystub.dll

2015-04-24 22:02:51 2CBD6D22499EB13A2666F62EF33D00E2 16303 ----a-w- C:\Windows\SysWOW64\ieuinit.inf

2015-04-24 22:02:50 DC155C2C14DC69EA400020CF92895873 64000 ----a-w- C:\Windows\SysWOW64\MshtmlDac.dll

2015-04-24 22:02:50 D730BA653F9F95EC044F6636E6E45905 76288 ----a-w- C:\Windows\SysWOW64\mshtmled.dll

2015-04-24 22:02:49 89CACDF654626F1948BF6C19A6D610BE 342704 ----a-w- C:\Windows\SysWOW64\iedkcs32.dll

2015-04-24 22:02:49 8127C2EE2E287BB3AB7843F9923B62BD 1311232 ----a-w- C:\Windows\SysWOW64\urlmon.dll

2015-04-24 22:02:48 EC442CB6F2D08F4FAA6BA68A23B82383 689152 ----a-w- C:\Windows\SysWOW64\msfeeds.dll

2015-04-24 22:02:48 CD91FE4F2718A88FC1C9C9C2E73EABB2 285696 ----a-w- C:\Windows\SysWOW64\dxtrans.dll

2015-04-24 22:02:48 92CF8BC1B198C01CDC55A1A91E510700 60416 ----a-w- C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2015-04-24 22:02:48 2F42037DD6F2831332653EB7F35D7E9A 19695616 ----a-w- C:\Windows\SysWOW64\mshtml.dll

2015-04-24 22:02:47 CA4F96D21BEF43DE9407210CFF76FCEA 2724864 ----a-w- C:\Windows\SysWOW64\mshtml.tlb

2015-04-24 22:02:47 8E30C9B4E16C23211F1DD02B517E4FA8 62464 ----a-w- C:\Windows\SysWOW64\iesetup.dll

2015-04-24 22:02:47 01C2BB4C13E6E0AF50867BCE8EE8A03E 710144 ----a-w- C:\Windows\SysWOW64\ieapfltr.dll

2015-04-24 22:02:46 B7BFB7C2970DF5E779FF729C037BD8E4 115712 ----a-w- C:\Windows\SysWOW64\ieUnatt.exe

2015-04-24 22:02:46 A305BEDA0CD8304102BFBBA0EB2A48CA 620032 ----a-w- C:\Windows\SysWOW64\jscript9diag.dll

2015-04-24 22:02:46 8A083313C1F7F50098D1D4F2FC092BD1 2052608 ----a-w- C:\Windows\SysWOW64\inetcpl.cpl

2015-04-24 22:02:46 77104FDBBD821F2D73338D9370675EF3 2278400 ----a-w- C:\Windows\SysWOW64\iertutil.dll

2015-04-24 22:02:46 1DFA1B4968C4E9E23CD6E68AF9CC063F 47104 ----a-w- C:\Windows\SysWOW64\jsproxy.dll

2015-04-24 22:02:45 AE8A9FCDC135F681EFE9135929CF4A7B 12825600 ----a-w- C:\Windows\SysWOW64\ieframe.dll

2015-04-24 22:02:45 94D64C343FE6341430A4C61BC490FEBF 478208 ----a-w- C:\Windows\SysWOW64\ieui.dll

2015-04-24 22:02:45 2B5DD86A4B6E92E5A79C479C0652E727 418304 ----a-w- C:\Windows\SysWOW64\dxtmsft.dll

2015-04-24 22:02:43 BDE9AA78B575CDA7C946A725926021F7 1155072 ----a-w- C:\Windows\SysWOW64\mshtmlmedia.dll

2015-04-24 22:02:43 43A5A38E45F0D4FA02A0CCD51244AA17 4305408 ----a-w- C:\Windows\SysWOW64\jscript9.dll

2015-04-24 22:02:42 C46904F2E9E121A91DDDABB48D7648C3 1888256 ----a-w- C:\Windows\SysWOW64\wininet.dll

2015-04-24 22:02:42 7776F3DA2B1AEDC2DA226F726B1E9A01 503296 ----a-w- C:\Windows\SysWOW64\vbscript.dll

2015-04-24 22:02:41 B55293D48979DADE6049944C252A3BDB 340992 ----a-w- C:\Windows\SysWOW64\html.iec

2015-04-24 22:02:41 2396395B6F563158BEC2E0526D7F6CD2 168960 ----a-w- C:\Windows\SysWOW64\msrating.dll

2015-04-24 22:02:21 D824C1C235349B67E652A5CA70D1AA49 58880 ----a-w- C:\Windows\SysWOW64\clfsw32.dll

====== C:\Windows\SysWOW64\drivers =====

====== C:\Windows\Sysnative =====

2015-04-24 22:05:36 C5D90D20035928387FE27E4485EE463F 36864 ----a-w- C:\Windows\Sysnative\wuapp.exe

2015-04-24 22:05:36 AECC03D0A794619E15FF1CB92D65EF9E 191488 ----a-w- C:\Windows\Sysnative\wuwebv.dll

2015-04-24 22:05:36 AEA602B4036CF95522818E911654F52E 135168 ----a-w- C:\Windows\Sysnative\wuauclt.exe

2015-04-24 22:05:36 95A9A336CFF6AC51B33BBFDBEA6D848B 60416 ----a-w- C:\Windows\Sysnative\WinSetupUI.dll

2015-04-24 22:05:36 6C21C983C1F83900DBEDE51DCA247B72 696320 ----a-w- C:\Windows\Sysnative\wuapi.dll

2015-04-24 22:05:36 6BAC8DCC6C58755A1B9E6D3B04C28FC5 12288 ----a-w- C:\Windows\Sysnative\wu.upgrade.ps.dll

2015-04-24 22:05:36 2ADEA6F221BBF0992FDF9A3E25BA9F59 98304 ----a-w- C:\Windows\Sysnative\wudriver.dll

2015-04-24 22:05:36 2A77BD58F0A8D3743D4299434390922E 35328 ----a-w- C:\Windows\Sysnative\wups.dll

2015-04-24 22:05:36 21DF773EF8EFEF531E7E0BF477E03047 3298816 ----a-w- C:\Windows\Sysnative\wucltux.dll

2015-04-24 22:05:36 21CA4277E6918B019525ECCD748EF401 37376 ----a-w- C:\Windows\Sysnative\wups2.dll

2015-04-24 22:05:36 0814A74C853F50B354F08F83DDA9F7FB 2553856 ----a-w- C:\Windows\Sysnative\wuaueng.dll

2015-04-24 22:05:15 E72C92A252EC4B230287BC6E06F24296 957952 ----a-w- C:\Windows\Sysnative\appraiser.dll

2015-04-24 22:05:15 5D0A492C42A43DCF73284F2865519712 30720 ----a-w- C:\Windows\Sysnative\acmigration.dll

2015-04-24 22:05:14 826A7F422014E4762C700B4254F5C588 1111552 ----a-w- C:\Windows\Sysnative\aeinv.dll

2015-04-24 22:05:14 05ED759DD0821294F05A41F6A8F1E18F 726528 ----a-w- C:\Windows\Sysnative\generaltel.dll

2015-04-24 22:05:13 3FCD3FE7F58935A85ACC33019129358E 419840 ----a-w- C:\Windows\Sysnative\devinv.dll

2015-04-24 22:05:13 0E0723E6D064ACD3D603BEF93EE0B950 769536 ----a-w- C:\Windows\Sysnative\invagent.dll

2015-04-24 22:05:12 3F0FFBA1765470F979D57F88248070CA 227328 ----a-w- C:\Windows\Sysnative\aepdu.dll

2015-04-24 22:05:12 205EE22E14A9848FB2266FF035BE0C9C 192000 ----a-w- C:\Windows\Sysnative\aepic.dll

2015-04-24 22:05:09 72098048AB8AE2CAFA4ECE35D5051D62 404480 ----a-w- C:\Windows\Sysnative\gdi32.dll

2015-04-24 22:05:05 0B85F3551337FE233477DA31545DC45C 1882624 ----a-w- C:\Windows\Sysnative\msxml3.dll

2015-04-24 22:05:02 2AA1704C1475AD9D18560AD07BDA66DF 2048 ----a-w- C:\Windows\Sysnative\msxml3r.dll

2015-04-24 22:04:50 DCB7D8034C773ADB660FA8F1139AC0A0 5557696 ----a-w- C:\Windows\Sysnative\ntoskrnl.exe

2015-04-24 22:04:47 E75074EFBE3C24FBC95C7C1985E08FDE 1163264 ----a-w- C:\Windows\Sysnative\kernel32.dll

2015-04-24 22:04:47 B47C4E8E9AF9044F9D59443196D54608 424448 ----a-w- C:\Windows\Sysnative\KernelBase.dll

2015-04-24 22:04:47 96C2380819EBAC0BF592A7E8977E9E8A 1727904 ----a-w- C:\Windows\Sysnative\ntdll.dll

2015-04-24 22:04:45 CBEFBE487F0C09EE0F8AC5299447450E 362496 ----a-w- C:\Windows\Sysnative\wow64win.dll

2015-04-24 22:04:45 6DEDB5E0258998C01C26280DBDB2A4B9 1461760 ----a-w- C:\Windows\Sysnative\lsasrv.dll

2015-04-24 22:04:45 5EA8A53A243ED52DA1F705D000854B2A 341504 ----a-w- C:\Windows\Sysnative\schannel.dll

2015-04-24 22:04:44 F87B5878D7621A16A0A5CF1D94BE5A53 503808 ----a-w- C:\Windows\Sysnative\srcore.dll

2015-04-24 22:04:44 B00F1AC213172C557EF84F71E4DF5EA3 243712 ----a-w- C:\Windows\Sysnative\wow64.dll

2015-04-24 22:04:44 A32CA33E8692DA882133341AF31A4C36 338432 ----a-w- C:\Windows\Sysnative\conhost.exe

2015-04-24 22:04:43 F36EF8DBE5CE842B8F04515BF422DFB4 314880 ----a-w- C:\Windows\Sysnative\msv1_0.dll

2015-04-24 22:04:43 EA32F4EA3AE06EDD122FBCD5A489E457 215040 ----a-w- C:\Windows\Sysnative\winsrv.dll

2015-04-24 22:04:43 8E615D40A652999B224EDBBFA7B4035B 728064 ----a-w- C:\Windows\Sysnative\kerberos.dll

2015-04-24 22:04:43 7220246418A40D3BF7470058A2DB939A 210944 ----a-w- C:\Windows\Sysnative\wdigest.dll

2015-04-24 22:04:43 5E9E31A2F213E757184EB2CA4B562E6C 296960 ----a-w- C:\Windows\Sysnative\rstrui.exe

2015-04-24 22:04:42 CB33B9F21F06764DCA561FC194823199 309760 ----a-w- C:\Windows\Sysnative\ncrypt.dll

2015-04-24 22:04:41 799E731B83F911A6220E678722A73DDF 86528 ----a-w- C:\Windows\Sysnative\TSpkg.dll

2015-04-24 22:04:41 234529666FB5BBE12343FF58380E8234 136192 ----a-w- C:\Windows\Sysnative\sspicli.dll

2015-04-24 22:04:41 0B6514A14631E41DE4D6D40D1C80BE68 112640 ----a-w- C:\Windows\Sysnative\smss.exe

2015-04-24 22:04:40 CFDA43CD05B94C4853042E4A9561B156 43520 ----a-w- C:\Windows\Sysnative\csrsrv.dll

2015-04-24 22:04:40 CACB6D061EAAE5CEB9203A26127843AF 64000 ----a-w- C:\Windows\Sysnative\auditpol.exe

2015-04-24 22:04:40 CA4FC33FB22D92368A0B221092B46374 31232 ----a-w- C:\Windows\Sysnative\lsass.exe

2015-04-24 22:04:40 2ABF1BA930E5CE0017D6197A06B03E07 50176 ----a-w- C:\Windows\Sysnative\srclient.dll

2015-04-24 22:04:40 1150C2D3C72887571581DF6D0E58540D 16384 ----a-w- C:\Windows\Sysnative\ntvdm64.dll

2015-04-24 22:04:39 DE328CD9E0678A55880C2189EE5BDBDC 13312 ----a-w- C:\Windows\Sysnative\wow64cpu.dll

2015-04-24 22:04:39 C631969919195C040E135CC380018A65 29184 ----a-w- C:\Windows\Sysnative\sspisrv.dll

2015-04-24 22:04:39 978BC01DD41125DED32AC03925A16578 28160 ----a-w- C:\Windows\Sysnative\secur32.dll

2015-04-24 22:04:39 5905040249D279F61AE988A7F5F0D241 22016 ----a-w- C:\Windows\Sysnative\credssp.dll

2015-04-24 22:04:34 39D0217773202CF09F13C1E420CBA6CA 6656 ----a-w- C:\Windows\Sysnative\apisetschema.dll

2015-04-24 22:04:34 3474740668B86841E999893D9314193E 686080 ----a-w- C:\Windows\Sysnative\adtschema.dll

2015-04-24 22:04:33 88B6EDA230EFEFC780AF717AA9640CAD 60416 ----a-w- C:\Windows\Sysnative\msobjs.dll

2015-04-24 22:04:33 55BF60184106FCF60B999CDEB4EACB2E 146432 ----a-w- C:\Windows\Sysnative\msaudite.dll

2015-04-24 22:02:51 3B69EBB762C52E8EFC127857C93CAC4F 48640 ----a-w- C:\Windows\Sysnative\ieetwproxystub.dll

2015-04-24 22:02:51 3278499EBA0DAA54EB4B68F695F0FB43 114688 ----a-w- C:\Windows\Sysnative\ieetwcollector.exe

2015-04-24 22:02:50 B664D90F9BFCFBBCF520C63B17736880 2724864 ----a-w- C:\Windows\Sysnative\mshtml.tlb

2015-04-24 22:02:49 9D3E174BD20A383523D5551A46C24BF6 34304 ----a-w- C:\Windows\Sysnative\iernonce.dll

2015-04-24 22:02:49 7571102ACD8A82A55D1657CDF96A1A0E 720384 ----a-w- C:\Windows\Sysnative\ie4uinit.exe

2015-04-24 22:02:49 2CBD6D22499EB13A2666F62EF33D00E2 16303 ----a-w- C:\Windows\Sysnative\ieuinit.inf

2015-04-24 22:02:48 0B077004AE4C2F7DE630445391360262 77824 ----a-w- C:\Windows\Sysnative\JavaScriptCollectionAgent.dll

2015-04-24 22:02:46 F36C78BC3D456BFB42A606A6B723F6DC 389808 ----a-w- C:\Windows\Sysnative\iedkcs32.dll

2015-04-24 22:02:46 68996E442920AD397279C3CD2AC37551 4096 ----a-w- C:\Windows\Sysnative\ieetwcollectorres.dll

2015-04-24 22:02:46 3C9D34F1F5A2C6867ECC60026F1F6CB7 1548288 ----a-w- C:\Windows\Sysnative\urlmon.dll

2015-04-24 22:02:45 B137E42258BCE4D1DA6D7F11C084983A 316928 ----a-w- C:\Windows\Sysnative\dxtrans.dll

2015-04-24 22:02:45 9171D1A18B1185A78BA33FEE884B8912 801280 ----a-w- C:\Windows\Sysnative\msfeeds.dll

2015-04-24 22:02:45 630FB85EF5FFB7441A7AFB4CC9FC9DB6 968704 ----a-w- C:\Windows\Sysnative\MsSpellCheckingFacility.exe

2015-04-24 22:02:44 706A56A863BD5F24FC98EF5E2D0582AD 2125824 ----a-w- C:\Windows\Sysnative\inetcpl.cpl

2015-04-24 22:02:44 50B2A19B2FBFEFE0FFC537C1BA6C5DD9 2886144 ----a-w- C:\Windows\Sysnative\iertutil.dll

2015-04-24 22:02:44 3408F27ABC8B2426481306336F747949 800768 ----a-w- C:\Windows\Sysnative\ieapfltr.dll

2015-04-24 22:02:44 0E98ED153699741D42472B0B429B3434 66560 ----a-w- C:\Windows\Sysnative\iesetup.dll

2015-04-24 22:02:42 E935163C8AFFEB519572CEB8AA10E8E1 144384 ----a-w- C:\Windows\Sysnative\ieUnatt.exe

2015-04-24 22:02:42 35B570D079F77FDE5D816CCB2FCE9C98 54784 ----a-w- C:\Windows\Sysnative\jsproxy.dll

2015-04-24 22:02:41 0DD9381BE8609D889F01812B7EFB1693 490496 ----a-w- C:\Windows\Sysnative\dxtmsft.dll

2015-04-24 22:02:40 FA10EC0F44A75511D13F9D93184CFC90 14397440 ----a-w- C:\Windows\Sysnative\ieframe.dll

2015-04-24 22:02:40 8E9A5B0DA4B6DFCD3CB13A69E89417D6 633856 ----a-w- C:\Windows\Sysnative\ieui.dll

2015-04-24 22:02:40 3C9C1ADE982DB6FD77AD19FFE252B80A 1359360 ----a-w- C:\Windows\Sysnative\mshtmlmedia.dll

2015-04-24 22:02:40 3457A873B2246B36F1FF58876841D7FE 92160 ----a-w- C:\Windows\Sysnative\mshtmled.dll

2015-04-24 22:02:39 E593E891B374088572AD021431EBC38B 584192 ----a-w- C:\Windows\Sysnative\vbscript.dll

2015-04-24 22:02:39 AA0640B3252BB6E9F90715F79EE77399 6025216 ----a-w- C:\Windows\Sysnative\jscript9.dll

2015-04-24 22:02:39 93B4EB4C7FF742BB834607B24EEF9F8F 814080 ----a-w- C:\Windows\Sysnative\jscript9diag.dll

2015-04-24 22:02:39 77B35D0FC22A2D2EAC8D07C3F9784DBF 2358784 ----a-w- C:\Windows\Sysnative\wininet.dll

2015-04-24 22:02:38 899C731AF8C5FF826DFA6C19D725A355 417280 ----a-w- C:\Windows\Sysnative\html.iec

2015-04-24 22:02:38 58DF183B856803E74BED39550FED0BCE 88064 ----a-w- C:\Windows\Sysnative\MshtmlDac.dll

2015-04-24 22:02:37 E0B5729CDAD0701839569A16DE68D311 199680 ----a-w- C:\Windows\Sysnative\msrating.dll

2015-04-24 22:02:36 DBC0C4554A8B2A81F68690D30F12C99E 24980480 ----a-w- C:\Windows\Sysnative\mshtml.dll

2015-04-24 22:02:21 745DE455E02693423B1B78F448D52961 79360 ----a-w- C:\Windows\Sysnative\clfsw32.dll

2015-04-24 22:02:21 404B7DF9CA4D1CB675045AF220FF3285 367552 ----a-w- C:\Windows\Sysnative\clfs.sys

====== C:\Windows\Sysnative\drivers =====

2015-04-24 22:04:43 063C09DB965E3DFD6F4F08416F6DB8F5 95672 ----a-w- C:\Windows\Sysnative\drivers\ksecdd.sys

2015-04-24 22:04:42 1FA627E63195BF3BF636BFEF0D7190D4 155576 ----a-w- C:\Windows\Sysnative\drivers\ksecpkg.sys

2015-04-24 22:02:54 F61634BEC53F73702A10DE69F6DCAF57 754688 ----a-w- C:\Windows\Sysnative\drivers\http.sys

====== C:\Windows\Tasks ======

====== C:\Windows\Temp ======

======= C:\Program Files =====

2015-04-24 22:52:05 -------- d-----w- C:\Program Files\iTunes

2015-04-24 22:52:05 -------- d-----w- C:\Program Files\iPod

======= C:\PROGRA~2 =====

2015-05-06 16:32:39 -------- d-----w- C:\PROGRA~2\Magical Jelly Bean

2015-04-24 22:52:06 -------- d-----w- C:\PROGRA~2\iTunes

======= C: =====

====== C:\Users\Renita\AppData\Roaming ======

====== C:\Users\Renita ======

2015-05-06 16:32:40 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeyFinder

2015-05-06 16:31:26 79F5C665AC1CFE9C545A84352F0E9376 1178272 ----a-w- C:\Users\Renita\Downloads\KeyFinderInstaller.exe

2015-05-04 20:32:22 6B58415594929888D1B79ED3103ECB56 5200384 ----a-w- C:\Users\Renita\Downloads\aswmbr (1).exe

2015-05-04 20:32:20 6B58415594929888D1B79ED3103ECB56 5200384 ----a-w- C:\Users\Renita\Downloads\aswmbr.exe

2015-05-04 20:22:15 50B2971B1F099EE363D0736944E59AA0 2101248 ----a-w- C:\Users\Renita\Downloads\FRST64.exe

2015-05-04 14:54:14 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud

2015-04-28 20:53:54 2EDE6612B7042D8582819CAB084E6883 13087456 ----a-w- C:\Users\Renita\Downloads\Silverlight_x64.exe

2015-04-24 22:53:06 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2015-04-24 22:52:05 -------- d-----w- C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7

====== C: exe-files ==

2015-05-06 16:32:39 E60DD5873C53F5A39C73D0EAEEBCD916 811968 ----a-w- C:\Program Files (x86)\Magical Jelly Bean\keyfinder.exe

2015-05-06 16:32:39 06CA2EE4050CFE832ED526DA3DA0E85C 1195024 ----a-w- C:\Program Files (x86)\Magical Jelly Bean\unins000.exe

2015-05-06 16:31:26 79F5C665AC1CFE9C545A84352F0E9376 1178272 ----a-w- C:\Users\Renita\Downloads\KeyFinderInstaller.exe

2015-05-05 21:56:13 8C7FB9078A63B7E5E899E7A2DBB0DB53 1114624 ----a-w- C:\Users\Renita\AppData\Local\Temp\557765.Uninstall\uninstaller.exe

2015-05-05 18:06:38 8C7FB9078A63B7E5E899E7A2DBB0DB53 1114624 ----a-w- C:\Users\Renita\AppData\Local\Temp\97520998.Uninstall\uninstaller.exe

2015-05-05 18:05:52 8C7FB9078A63B7E5E899E7A2DBB0DB53 1114624 ----a-w- C:\Users\Renita\AppData\Local\Temp\97475025.Uninstall\uninstaller.exe

2015-05-04 20:32:22 6B58415594929888D1B79ED3103ECB56 5200384 ----a-w- C:\Users\Renita\Downloads\aswmbr (1).exe

2015-05-04 20:32:20 6B58415594929888D1B79ED3103ECB56 5200384 ----a-w- C:\Users\Renita\Downloads\aswmbr.exe

2015-05-04 20:22:15 50B2971B1F099EE363D0736944E59AA0 2101248 ----a-w- C:\Users\Renita\Downloads\FRST64.exe

2015-05-04 14:52:41 2A28197A515ACC23F744FCB57E481250 77104 ----a-w- C:\Users\Renita\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FGNNFINW\SetupAdmin[1].exe

2015-05-04 14:52:41 2A28197A515ACC23F744FCB57E481250 77104 ----a-w- C:\ProgramData\Apple\Installer Cache\iCloud Control Panel 4.1.1.53\SetupAdmin.exe

2015-05-01 00:46:21 55D0E67A7C9BFD15E24C7F67A32FA6E5 25700056 ----a-w- C:\Users\Renita\AppData\Local\Temp\tmpfy5ja1\googledrivesync.exe

=== C: other files ==

2015-05-07 06:00:04 52065A5DC03D68AC6420A5CDF05AE9D7 5644 ----a-w- C:\Users\Renita\.rainlendar2\backups\20150507-Rainlendar2Backup.zip

2015-05-06 15:42:48 DE0983FE4B830699312D35A990B3AE1B 1945 ----a-w- C:\Users\Renita\AppData\Local\Temp\_MEI11642\resources\chrome_ext\nknebiagdodnminbdpflhpkgfpeijdbf_live.crx

2015-05-06 15:42:48 82F5C942549405F61A8808D0EA0FA9E2 25575 ----a-w- C:\Users\Renita\AppData\Local\Temp\_MEI11642\resources\chrome_ext\apdfllckaahabafndbhieahigkjlhalf_live.crx

2015-05-06 06:00:00 EF24EC5663793970FEB1E1A36C111B7C 5644 ----a-w- C:\Users\Renita\.rainlendar2\backups\20150506-Rainlendar2Backup.zip

2015-05-05 06:00:00 8273F81B204299B5442AFFA225D38655 5644 ----a-w- C:\Users\Renita\.rainlendar2\backups\20150505-Rainlendar2Backup.zip

2015-05-04 06:00:02 4E12A328BB7BA169D21F45A84F17AD67 5940 ----a-w- C:\Users\Renita\.rainlendar2\backups\20150504-Rainlendar2Backup.zip

2015-05-03 06:00:00 4F1B8771CEFB9CD8B2988A85A57B4373 5893 ----a-w- C:\Users\Renita\.rainlendar2\backups\20150503-Rainlendar2Backup.zip

2015-05-02 06:00:01 A2E225F6F50FFD19DD991760C459FAEA 5893 ----a-w- C:\Users\Renita\.rainlendar2\backups\20150502-Rainlendar2Backup.zip

2015-05-01 06:00:01 3A22A86A3D1363A9339427AC56DB724D 5893 ----a-w- C:\Users\Renita\.rainlendar2\backups\20150501-Rainlendar2Backup.zip

==== Firefox Start and Search pages ======================

ProfilePath: C:\Users\Renita\AppData\Roaming\Mozilla\Firefox\Profiles\wr0wpv71.default

user_pref("browser.search.defaultenginename", "Yahoo!");

user_pref("browser.search.selectedEngine", "Yahoo!");

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]

"[email protected]"="C:\ProgramData\Wondershare\Video Converter Ultimate\[email protected]" [08/12/2014 12:57 PM]

==== Firefox Extensions ======================

==== Firefox Plugins ======================

Profilepath: C:\Users\Renita\AppData\Roaming\Mozilla\Firefox\Profiles\wr0wpv71.default

D4A0F57017841F7E54B3E82B99064982 - C:\Users\Renita\AppData\Roaming\Mozilla\plugins\npo1d.dll - Google Talk Plugin Video Renderer

7EDD991C076F76CDF7C10B0487DEF155 - C:\Users\Renita\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll - Google Talk Plugin

E3B4EA121F7BDEB0F6366E2BA9608CB5 - C:\Users\Renita\AppData\Local\Citrix\Plugins\104\npappdetector.dll - Citrix Online Web Deployment Plugin 1.0.0.104

DE5A4D89C47B9A1CC97DFAB11A795ABB - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll - Shockwave Flash

==== Chromium Look ======================

Google Chrome Version: 42.0.2311.135

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions

lifbcibllhkdhoafpjfnlhfpfgnpldfl - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx[07/14/2014 07:22 PM]

HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions

apdfllckaahabafndbhieahigkjlhalf - C:\Users\Renita\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx[12/17/2014 10:01 AM]

lmjegmlicamnimmfhcmpkclmigmmcbeh - No path found[]

Google Slides - Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek

Google Docs - Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake

Google Drive - Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf

YouTube - Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo

Google Search - Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf

Google Sheets - Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap

Bookmark Manager - Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik

Secure Mail for Gmail by Streak - Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\jngdnjdobadbdemillgljnnbpomnfokn

Mailvelope - Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\kajibbejlbohfaggdiogboambcijhkke

Chrome Hotword Shared Module - Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg

Skype Click to Call - Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl

Google Wallet - Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda

Gmail - Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia

Streak for Gmail - Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\pnnfemgpilpdaojpnkjdgfgbnnjojfik

==== Chromium Fix ======================

C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.olark.com_0.localstorage deleted successfully

C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.olark.com_0.localstorage-journal deleted successfully

C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_nortonsafe.search.ask.com_0.localstorage deleted successfully

C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_nortonsafe.search.ask.com_0.localstorage-journal deleted successfully

C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.ask.com_0.localstorage deleted successfully

C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.ask.com_0.localstorage-journal deleted successfully

C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_services2.capitalone.com_0.localstorage deleted successfully

C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_services2.capitalone.com_0.localstorage-journal deleted successfully

C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_mirror-magic-deluxe.en.softonic.com_0.localstorage deleted successfully

C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_mirror-magic-deluxe.en.softonic.com_0.localstorage-journal deleted successfully

==== Set IE to Default ======================

Old Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="http://www.msn.com/?pc=MSSE"

"Search Bar"="http://www.google.com/"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]

"Tabs"="res://ieframe.dll/tabswelcome.htm"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs]

"Tabs"="res://ieframe.dll/tabswelcome.htm"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]

"DefaultScope"="{34E49D28-107C-4392-8D37-8BF3AA5C8E56}"

New Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Search Bar"="http://go.microsoft..../?LinkId=54896"

"Start Page"="http://www.msn.com/?pc=MSSE"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]

"Tabs"="about:newtab"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs]

"Tabs"="about:newtab"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]

"DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes

{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.co...={searchTerms}"

{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/...ox&FORM=IE8SRC"

{29CE6517-F6EE-460B-BF7C-267EDB453782} Unknown Url="Not_Found"

{34E49D28-107C-4392-8D37-8BF3AA5C8E56} Unknown Url="Not_Found"

{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.co...I7ADFA_enUS405"

{80c554b9-c7f8-4a21-9471-06d606da78a2} Bing Url="http://www.bing.com/...MSSEDF&pc=MSSE"

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-3026445660-3059579512-81386765-1000\Software\Microsoft\Internet Explorer\SearchScopes\{29CE6517-F6EE-460B-BF7C-267EDB453782} deleted successfully

HKEY_USERS\S-1-5-21-3026445660-3059579512-81386765-1000\Software\Microsoft\Internet Explorer\SearchScopes\{34E49D28-107C-4392-8D37-8BF3AA5C8E56} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{29CE6517-F6EE-460B-BF7C-267EDB453782} deleted successfully

==== Deleting CLSID Registry Values ======================

==== Deleting Registry Keys ======================

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0} deleted successfully

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Synchronizer deleted successfully

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aimersoft Helper Compact.exe deleted successfully

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Akamai NetSession Interface deleted successfully

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Anti-phishing Domain Advisor deleted successfully

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ApnUpdater deleted successfully

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\B06F7A4ACCD9196B7E7F219C233492C3ED2CFEDB._service_run deleted successfully

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\COMODO Internet Security deleted successfully

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CrossLoop deleted successfully

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper deleted successfully

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr deleted successfully

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl deleted successfully

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Weather deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\QBDataServiceUser21\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\Renita\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\Renita\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully

C:\Users\Renita\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

C:\Users\Renita\AppData\Local\Mozilla\Firefox\Profiles\wr0wpv71.default\cache2 emptied successfully

==== Empty Chrome Cache ======================

C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=1653 folders=136 302469889 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully

C:\Users\Default User\AppData\Local\Temp emptied successfully

C:\Users\QBDataServiceUser21\AppData\Local\Temp emptied successfully

C:\Users\Renita\AppData\Local\Temp will be emptied at reboot

C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp will be emptied at reboot

C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully

C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied

C:\Users\Renita\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp\FXSSVCDebugLogFile.txt" not deleted

"C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp\FXSTIFFDebugLogFile.txt" not deleted

"C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp\Low" not deleted

==== EOF on Thu 05/07/2015 at 9:30:45.64 ======================

#10
Naathim

Posted 08 May 2015 - 01:36 AM

GeekU Minion

Expert
4,568 posts

Hi,

yes, that was exactly it. Now it's time to run these two.

Fix with Junkware Removal Tool

Please download JRT by Thisisu and save the file to your desktop.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

Right-click on icon and select Run as Administrator to start the tool.
Follow the prompts and let this process run uninterrupted.
This scan can take a while, depending on your System specs.
Upon completion, a log (JRT.txt) will open on your desktop.

Please include the contents of that file in your reply.
Do not forget to re-enable your previously switched off protection software!
Please also manually reboot your machine after this procedure.

Fix with AdwCleaner

Please download AdwCleaner by Xplode and save the file to your desktop.

Right-click on icon and select Run as Administrator to start the tool.
The program will begin to update the database (if internet connection is operational). Please wait a little bit.
Follow the prompts and click Scan.
When finished, please click Clean.
Upon completion, click Report. A log (AdwCleaner[S*].txt) will open.

Please include the contents of that file in your reply.

#11
Renita123

Posted 08 May 2015 - 03:24 PM

Member

Topic Starter
Member
14 posts

Hi,

yes, that was exactly it. Now it's time to run these two.

Fix with Junkware Removal Tool

Please download JRT by Thisisu and save the file to your desktop.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

Right-click on icon and select Run as Administrator to start the tool.

Follow the prompts and let this process run uninterrupted.

This scan can take a while, depending on your System specs.

Upon completion, a log (JRT.txt) will open on your desktop.

Please include the contents of that file in your reply.
Do not forget to re-enable your previously switched off protection software!
Please also manually reboot your machine after this procedure.

Fix with AdwCleaner

Please download AdwCleaner by Xplode and save the file to your desktop.
Right-click on icon and select Run as Administrator to start the tool.

The program will begin to update the database (if internet connection is operational). Please wait a little bit.

Follow the prompts and click Scan.

When finished, please click Clean.

Upon completion, click Report. A log (AdwCleaner[S*].txt) will open.

Please include the contents of that file in your reply.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.6.8 (05.06.2015:1)

OS: Windows 7 Professional x64

Ran by Renita on Fri 05/08/2015 at 14:53:37.09

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Tasks

Successfully deleted: [Task] C:\Windows\system32\tasks\SymformServicesRestart

~~~ Registry Values

Successfully deleted: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\brs

Successfully deleted: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\ytdownloader

Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ytdownloader

~~~ Registry Keys

~~~ Files

~~~ Folders

Successfully deleted: [Folder] C:\ProgramData\blekko toolbars

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Fri 05/08/2015 at 14:57:00.92

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

# AdwCleaner v4.203 - Logfile created 08/05/2015 at 15:14:10

# Updated 30/04/2015 by Xplode

# Database : 2015-05-08.1 [Server]

# Operating system : Windows 7 Professional Service Pack 1 (x64)

# Username : Renita - RENITA-2010

# Running from : C:\Users\Renita\Desktop\adwcleaner_4.203.exe

# Option : Cleaning

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\Ask

Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Flash Player Pro

Folder Deleted : C:\Program Files (x86)\Flash Player Pro

Folder Deleted : C:\Users\Renita\AppData\Roaming\Microsoft\Windows\Start Menu\Video Converter

Folder Deleted : C:\Users\Renita\Documents\Flash Player Pro

File Deleted : C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_www.delta.com_0.localstorage

File Deleted : C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_www.delta.com_0.localstorage-journal

***** [ Scheduled tasks ] *****

Task Deleted : LaunchSignup

Task Deleted : SMupdate1

Task Deleted : YTDownloader

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKCU\Software\Classes\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\BabylonToolbar

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\www.superfish.com

Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap

Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho

Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\ask.com

Key Deleted : HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\SysMenuExt

Key Deleted : HKLM\SOFTWARE\Classes\AppID\SysMenu.DLL

Key Deleted : HKLM\SOFTWARE\5e0dfdbe13ce545

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9CB2CD61-FFA0-406C-9D2D-8FDE6F4A4D8A}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D813D5BB-EBC7-45F9-B8A4-36A305168069}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1663C10B-0D55-438D-8496-19A3DBAEC0E4}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A43DE495-3D00-47D4-9D2C-303115707939}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{AD79BAD6-9504-4F09-ACEC-7B319584A4C1}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{020B1D4B-5738-4C77-9E19-4F173DD9B486}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{1231839B-064E-4788-B865-465A1B5266FD}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{1F8EDE97-36D5-422A-B8F0-9406E2D87C60}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{28C3737A-32D1-492D-B76B-8D75EBBFB887}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{2DAC2231-CC35-482B-97C5-CED1D4185080}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{3F1CD84C-04A3-4EA0-9EA1-7D134FD66C82}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{3F83A9CA-B5F0-44EC-9357-35BB3E84B07F}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{47E520EA-CAD2-4F51-8F30-613B3A1C33EB}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{57C91446-8D81-4156-A70E-624551442DE9}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{70AFB7B2-9FB5-4A70-905B-0E9576142E1D}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{7AD65FD1-79E0-406D-B03C-DD7C14726D69}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{97DD820D-2E20-40AD-B01E-6730B2FCE630}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{B177446D-54A4-4869-BABC-8566110B4BE0}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{CE057E0D-2D7E-4DFF-A890-07BA69B8C762}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{D9D1DFC5-502D-43E4-B1BB-4D0B7841489A}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{E0B07188-A528-4F9E-B2F7-C7FDE8680AE4}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{F05B12E1-ADE8-4485-B45B-898748B53C37}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}

Key Deleted : HKCU\Software\BRS

Key Deleted : HKCU\Software\Conduit

Key Deleted : HKCU\Software\YahooPartnerToolbar

Key Deleted : HKCU\Software\UpdateFiles

Key Deleted : HKCU\Software\AppDataLow\Software\Conduit

Key Deleted : HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}

Key Deleted : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}

Key Deleted : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}

Key Deleted : HKLM\SOFTWARE\Conduit

Key Deleted : HKLM\SOFTWARE\GlobalUpdate

Key Deleted : HKLM\SOFTWARE\InstallCore

Key Deleted : HKLM\SOFTWARE\SearchProtect

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Video Converter

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Video Downloader_is1

Key Deleted : [x64] HKLM\SOFTWARE\ShopperPro

Key Deleted : [x64] HKLM\SOFTWARE\Tarma Installer

Key Deleted : [x64] HKLM\SOFTWARE\YTDownloader

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\ask.com

Data Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local;<local>

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17728

-\\ Mozilla Firefox v

-\\ Google Chrome v42.0.2311.135

*************************

AdwCleaner[R0].txt - [7313 bytes] - [08/05/2015 15:11:34]

AdwCleaner[S0].txt - [7112 bytes] - [08/05/2015 15:14:10]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [7171 bytes] ##########

#12
Naathim

Posted 09 May 2015 - 10:12 AM

GeekU Minion

Expert
4,568 posts

Perfect. Time to take a second look. Please also update me how is the machine behaving.

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool.

Right-click on icon and select Run as Administrator to start the tool.
> XP users click run after receipt of Windows Security Warning - Open File.
> 8 users will be prompted about Windows SmartScreen protection - click More information and Run.
Make sure that Addition option is checked.
Press Scan button and wait.
The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content in your next reply.

#13
Renita123

Posted 11 May 2015 - 09:43 AM

Member

Topic Starter
Member
14 posts

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-05-2015
Ran by Renita (administrator) on RENITA-2010 on 11-05-2015 09:37:15
Running from C:\Users\Renita\Desktop
Loaded Profiles: Renita (Available profiles: Renita & QBDataServiceUser21)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler64.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
() C:\Program Files\Rainlendar2\Rainlendar2.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\mdm.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
() C:\Program Files (x86)\Audials\Audials 11\AudialsNotifier.exe
(Intuit) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Citrix Online, LLC) C:\Program Files (x86)\Citrix\GoToAssist Remote Support Expert\758\g2ax_start.exe
(Acresso Corporation) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Symform, Inc.) C:\Program Files\Symform\Node Service\symformstatus.exe
(Seagate) C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedul2.exe
() L:\Synology Data Replicator 3\SynoDrServicex64.exe
(Pitney Bowes, Inc.) C:\Program Files (x86)\Pitney Bowes\PC Meter Connect\mailstationAssistant.exe
() C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
(RapidSolution Software AG) C:\Program Files (x86)\Audials\Audials 11\VCDWriter\64\VCDAudioService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Citrix Online, LLC) C:\Program Files (x86)\Citrix\GoToAssist Remote Support Expert\758\g2ax_comm_expert.exe
(Citrix Online, LLC) C:\Program Files (x86)\Citrix\GoToAssist Remote Support Expert\758\g2ax_user_expert.exe
(Microsoft Corporation) C:\Windows\System32\FXSSVC.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(ScanSoft, Inc.) C:\Program Files (x86)\ScanSoft\OmniPageSE4.0\OpWareSE4.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Dropbox, Inc.) C:\Users\Renita\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Symform, Inc.) C:\Program Files\Symform\Node Service\symformcontrib.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Symform, Inc.) C:\Program Files\Symform\Node Service\symformsync.exe
(Symform, Inc.) C:\Program Files\Symform\Node Service\symformupdater.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Acresso Corporation) C:\ProgramData\FLEXnet\Connect\11\agent.exe
(Avatar Systems, Inc) \\win-olcratvjngj\avatar\integra\lib\integra.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1332296 2015-01-30] (Microsoft Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-04-07] (Apple Inc.)
HKLM-x32\...\Run: [QuickBooksDB21] => C:\Program Files (x86)\Intuit\QuickBooks 2005\QBDBMgrN.exe [679936 2010-04-27] (Intuit, Inc.)
HKLM-x32\...\Run: [PC Meter Connect] => C:\Program Files (x86)\Pitney Bowes\PC Meter Connect\mailstationAssistant.exe [3514368 2012-02-07] (Pitney Bowes, Inc.)
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
HKLM-x32\...\Run: [DelaypluginInstall] => C:\ProgramData\Wondershare\Video Converter Ultimate\DelayPluginI.exe [1953792 2014-05-16] ()
HKLM-x32\...\Run: [SSBkgdUpdate] => C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [185896 2006-09-28] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [OpwareSE4] => C:\Program Files (x86)\ScanSoft\OmniPageSE4.0\OpwareSE4.exe [75304 2006-10-11] (ScanSoft, Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKLM-x32\...\Run: [IndexSearch] => C:\Program Files (x86)\Nuance\PaperPort\IndexSearch.exe [46952 2011-08-02] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PaperPort PTD] => C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe [30568 2011-08-02] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PDFHook] => C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfpro5hook.exe [636192 2010-03-05] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PDF5 Registry Controller] => C:\Program Files (x86)\Nuance\PDF Viewer Plus\RegistryController.exe [62752 2010-03-05] (Nuance Communications, Inc.)
HKU\S-1-5-21-3026445660-3059579512-81386765-1000\...\Run: [Rainlendar2] => C:\Program Files\Rainlendar2\Rainlendar2.exe [4373600 2013-03-11] ()
HKU\S-1-5-21-3026445660-3059579512-81386765-1000\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-11-08] (Google Inc.)
HKU\S-1-5-21-3026445660-3059579512-81386765-1000\...\Run: [Google Update] => C:\Users\Renita\AppData\Local\Google\Update\GoogleUpdate.exe [107912 2014-10-19] (Google Inc.)
HKU\S-1-5-21-3026445660-3059579512-81386765-1000\...\Run: [B06F7A4ACCD9196B7E7F219C233492C3ED2CFEDB._service_run] => "C:\Users\Renita\AppData\Local\Google\Chrome\Application\chrome.exe" --type=service
HKU\S-1-5-21-3026445660-3059579512-81386765-1000\...\Run: [AudialsNotifier] => C:\Program Files (x86)\Audials\Audials 11\AudialsNotifier.exe [473352 2014-02-18] ()
HKU\S-1-5-21-3026445660-3059579512-81386765-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2015-04-26] (Apple Inc.)
HKU\S-1-5-21-3026445660-3059579512-81386765-1000\...\Run: [GoToAssist Remote Support Expert] => C:\Program Files (x86)\Citrix\GoToAssist Remote Support Expert\758\g2ax_start.exe [610888 2014-12-02] (Citrix Online, LLC)
HKU\S-1-5-21-3026445660-3059579512-81386765-1000\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2009-05-05] (Acresso Corporation)
HKU\S-1-5-21-3026445660-3059579512-81386765-1000\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [25700400 2015-04-28] (Google)
HKU\S-1-5-21-3026445660-3059579512-81386765-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [31087200 2015-01-23] (Skype Technologies S.A.)
HKU\S-1-5-21-3026445660-3059579512-81386765-1000\...\Run: [Symform Status] => C:\Program Files\Symform\Node Service\symformstatus.exe [412600 2014-11-19] (Symform, Inc.)
HKU\S-1-5-21-3026445660-3059579512-81386765-1000\...\MountPoints2: O - O:\VZW_Software_upgrade_assistant.exe
HKU\S-1-5-21-3026445660-3059579512-81386765-1000\...\MountPoints2: {34f5116b-4b37-11e3-ac06-f04da2da6240} - O:\VZW_Software_upgrade_assistant.exe
HKU\S-1-5-21-3026445660-3059579512-81386765-1000\...\MountPoints2: {5b4495a7-adfa-11e0-82bd-f04da2da6240} - "K:\WD SmartWare.exe" autoplay=true
HKU\S-1-5-21-3026445660-3059579512-81386765-1000\...\MountPoints2: {adeb7974-0218-11e4-8232-f04da2da6240} - "O:\WD SmartWare.exe" autoplay=true
Startup: C:\Users\Renita\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-04-13]
ShortcutTarget: Dropbox.lnk -> C:\Users\Renita\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Renita\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Renita\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Renita\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Renita\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Renita\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Renita\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Renita\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Renita\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Renita\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Renita\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Renita\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Renita\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Renita\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Renita\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Renita\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-10] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Renita\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-10] (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft....g}&sourceid=ie7
HKU\S-1-5-21-3026445660-3059579512-81386765-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?pc=MSSE
HKU\S-1-5-21-3026445660-3059579512-81386765-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USREL/1
URLSearchHook: HKU\S-1-5-21-3026445660-3059579512-81386765-1000 - Default Value = {CFBFAE00-17A6-11D0-99CB-00C04FD64497}
SearchScopes: HKLM -> {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = http://www.bing.com/...=MSSEDF&pc=MSSE
SearchScopes: HKLM -> {FD44EDF6-5F68-43B1-BF57-03FE9B8B6565} URL = http://www.bing.com/...rc=IE-SearchBox
SearchScopes: HKLM-x32 -> {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = http://www.bing.com/...=MSSEDF&pc=MSSE
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\.DEFAULT -> {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = http://www.bing.com/...=MSSEDF&pc=MSSE
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3026445660-3059579512-81386765-1000 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = http://www.google.co...q={searchTerms}
SearchScopes: HKU\S-1-5-21-3026445660-3059579512-81386765-1000 -> {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = http://www.bing.com/...=MSSEDF&pc=MSSE
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-02] (Google Inc.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: Adobe PDF Reader Link Helper -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2012-09-23] (Adobe Systems Incorporated)
BHO-x32: Wondershare Video Converter Ultimate 7.1.0 -> {451C804F-C205-4F03-B48E-537EC94937BF} -> C:\ProgramData\Wondershare\Video Converter Ultimate\WSBrowserAppMgr.dll [2014-07-29] (Wondershare)
BHO-x32: PlusIEEventHelper Class -> {551A852F-39A6-44A7-9C13-AFBEC9185A9D} -> C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll [2009-02-06] (Zeon Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll [2015-04-01] (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-02] (Google Inc.)
BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [2011-08-30] (Adobe Systems Incorporated)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-04-01] (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-02] (Google Inc.)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll [2011-08-30] (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-02] (Google Inc.)
Toolbar: HKU\.DEFAULT -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
Toolbar: HKU\.DEFAULT -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-02] (Google Inc.)
Toolbar: HKU\S-1-5-21-3026445660-3059579512-81386765-1000 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-03-02] (Google Inc.)
Toolbar: HKU\S-1-5-21-3026445660-3059579512-81386765-1000 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
DPF: HKLM-x32 {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} http://support.dell....lSystemLite.CAB
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab
Handler-x32: intu-help-qb4 - {ACE22922-D07C-4860-B51B-8CF472FEC2CB} - C:\Program Files (x86)\Intuit\QuickBooks 2005\HelpAsyncPluggableProtocol.dll [2014-02-04] (Intuit, Inc.)
Handler-x32: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - C:\Windows\SysWOW64\mscoree.dll [2010-11-04] (Microsoft Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
Handler: WSWSVCUchrome - {1CA93FF0-A218-44F1 - No File
Tcpip\Parameters: [DhcpNameServer] 192.168.11.1
Tcpip\..\Interfaces\{2DE8D506-CAF5-42E3-BF8E-CDEC8857968A}: [NameServer] 192.168.11.1

FireFox:
========
FF ProfilePath: C:\Users\Renita\AppData\Roaming\Mozilla\Firefox\Profiles\wr0wpv71.default
FF DefaultSearchEngine: Yahoo!
FF SelectedSearchEngine: Yahoo!
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_235.dll [2012-05-04] ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll [2012-05-04] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2014-08-12] (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-04-01] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-04-01] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-04] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-04] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3026445660-3059579512-81386765-1000: @citrixonline.com/appdetectorplugin -> C:\Users\Renita\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2013-07-24] (Citrix Online)
FF Plugin HKU\S-1-5-21-3026445660-3059579512-81386765-1000: @talk.google.com/GoogleTalkPlugin -> C:\Users\Renita\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2014-04-25] (Google)
FF Plugin HKU\S-1-5-21-3026445660-3059579512-81386765-1000: @talk.google.com/O1DPlugin -> C:\Users\Renita\AppData\Roaming\Mozilla\plugins\npo1d.dll [2014-04-25] (Google)
FF Plugin HKU\S-1-5-21-3026445660-3059579512-81386765-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Renita\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin HKU\S-1-5-21-3026445660-3059579512-81386765-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Renita\AppData\Local\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Renita\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2014-04-25] (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Renita\AppData\Roaming\mozilla\plugins\npo1d.dll [2014-04-25] (Google)
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\ProgramData\Wondershare\Video Converter Ultimate\[email protected]
FF Extension: Wondershare Video Converter Ultimate - C:\ProgramData\Wondershare\Video Converter Ultimate\[email protected] [2014-08-12]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]

Chrome:
=======
CHR Profile: C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-10-06]
CHR Extension: (Google Docs) - C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-10-06]
CHR Extension: (Google Drive) - C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-12-17]
CHR Extension: (YouTube) - C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-10-06]
CHR Extension: (Google Search) - C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-10-06]
CHR Extension: (Google Sheets) - C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-10-06]
CHR Extension: (Bookmark Manager) - C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-25]
CHR Extension: (Secure Mail for Gmail (by Streak)) - C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\jngdnjdobadbdemillgljnnbpomnfokn [2014-12-12]
CHR Extension: (Mailvelope) - C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\kajibbejlbohfaggdiogboambcijhkke [2015-04-02]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-05]
CHR Extension: (Skype Click to Call) - C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2015-02-09]
CHR Extension: (Google Wallet) - C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-10-06]
CHR Extension: (Gmail) - C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-10-06]
CHR Extension: (Streak for Gmail) - C:\Users\Renita\AppData\Local\Google\Chrome\User Data\Default\Extensions\pnnfemgpilpdaojpnkjdgfgbnnjojfik [2014-12-12]
CHR HKU\S-1-5-21-3026445660-3059579512-81386765-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Renita\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [2014-12-17]
CHR HKU\S-1-5-21-3026445660-3059579512-81386765-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - https://clients2.goo...ice/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-20] (Apple Inc.)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
S4 Canon Driver Information Assist Service; C:\Program Files\Canon\DIAS\CnxDIAS.exe [2565168 2007-02-28] (CANON INC.)
S3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [654848 2010-11-09] (Macrovision Europe Ltd.) [File not signed]
S3 GSService; C:\Windows\SysWOW64\GSService.exe [249856 2012-01-23] () [File not signed]
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-04-14] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 MDM; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed]
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2015-01-30] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [366512 2015-01-30] (Microsoft Corporation)
S4 NVIDIA Performance Driver Service; C:\Program Files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe [4901888 2009-05-14] () [File not signed]
R2 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [145256 2011-08-02] (Nuance Communications, Inc.)
R2 QBCFMonitorService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe [45056 2014-02-03] (Intuit) [File not signed]
S4 QBFCService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe [61440 2009-07-23] (Intuit Inc.) [File not signed]
S4 QBVSS; C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe [1251840 2010-09-17] () [File not signed]
S4 QuickBooksDB21; C:\Program Files (x86)\Intuit\QuickBooks 2005\QBDBMgrN.exe [679936 2010-04-27] (Intuit, Inc.) [File not signed]
S3 SMServer; C:\Windows\SysWOW64\snmvtsvc.exe [244224 2012-01-24] (SMServer) [File not signed]
R2 symformcontrib; C:\Program Files\Symform\Node Service\symformcontrib.exe [18872 2014-11-19] (Symform, Inc.)
R2 symformsync; C:\Program Files\Symform\Node Service\symformsync.exe [21944 2014-11-19] (Symform, Inc.)
R2 symformupdater; C:\Program Files\Symform\Node Service\symformupdater.exe [29112 2014-11-19] (Symform, Inc.)
R2 SynoDrService; L:\Synology Data Replicator 3\SynoDrServicex64.exe [381312 2013-09-09] () [File not signed]
R2 UsbClientService; C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe [248704 2013-08-14] () [File not signed]
R2 Virtual CDAudio Service; C:\Program Files (x86)\Audials\Audials 11\VCDWriter\64\VCDAudioService.exe [179464 2014-02-18] (RapidSolution Software AG)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)
S3 BrYNSvc; "C:\Program Files (x86)\Browny02\BrYNSvc.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 DM150Drv; C:\Windows\System32\DRIVERS\DM150Drv.sys [24312 2010-07-30] (Pitney Bowes)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [136408 2015-05-08] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [274696 2014-11-15] (Microsoft Corporation)
R3 MusCAudio; C:\Windows\System32\drivers\MusCAudio.sys [34040 2012-01-24] (Windows ® Win 7 DDK provider)
S3 Netaapl; C:\Windows\System32\DRIVERS\netaapl64.sys [22528 2011-08-02] (Apple Inc.) [File not signed]
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124560 2014-11-15] (Microsoft Corporation)
R1 RrNetCapFilterDriver; C:\Windows\System32\DRIVERS\RrNetCapFilterDriver.sys [24744 2014-02-18] (Audials AG)
R3 rsvcdwdr; C:\Windows\System32\DRIVERS\rsvcdwdr.sys [45192 2014-02-18] (RapidSolution Software AG)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]
R0 vidsflt53; C:\Windows\System32\DRIVERS\vsflt53.sys [141920 2013-06-04] (Acronis)
S3 IntcAzAudAddService; system32\drivers\RTKVHD64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-11 09:37 - 2015-05-11 09:37 - 00031517 _____ () C:\Users\Renita\Desktop\FRST.txt
2015-05-11 09:34 - 2015-05-11 09:34 - 00000000 ____D () C:\Users\Renita\Desktop\FRST-OlderVersion
2015-05-08 15:11 - 2015-05-08 15:14 - 00000000 ____D () C:\AdwCleaner
2015-05-08 15:08 - 2015-05-08 15:07 - 02204160 _____ () C:\Users\Renita\Desktop\adwcleaner_4.203.exe
2015-05-08 15:07 - 2015-05-08 15:07 - 02204160 _____ () C:\Users\Renita\Downloads\adwcleaner_4.203.exe
2015-05-08 14:57 - 2015-05-08 14:57 - 00001103 _____ () C:\Users\Renita\Desktop\JRT.txt
2015-05-08 14:53 - 2015-05-08 14:53 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-RENITA-2010-Windows-7-Professional-(64-bit).dat
2015-05-08 14:53 - 2015-05-08 14:53 - 00000000 ____D () C:\RegBackup
2015-05-08 14:51 - 2015-05-08 14:51 - 02716843 _____ (Thisisu) C:\Users\Renita\Downloads\JRT.exe
2015-05-08 14:51 - 2015-05-08 14:51 - 02716843 _____ (Thisisu) C:\Users\Renita\Desktop\JRT.exe
2015-05-07 09:31 - 2015-05-07 09:31 - 00000000 ____D () C:\Users\Renita\AppData\Local\CrashRpt
2015-05-07 09:25 - 2015-05-07 09:00 - 00024064 _____ () C:\Windows\zoek-delete.exe
2015-05-07 09:14 - 2015-05-07 09:30 - 00000000 ____D () C:\zoek
2015-05-07 09:01 - 2015-05-06 09:22 - 00001468 _____ () C:\zoek-results2015-05-06-152244.log
2015-05-06 10:32 - 2015-05-06 10:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeyFinder
2015-05-06 10:32 - 2015-05-06 10:32 - 00000000 ____D () C:\Program Files (x86)\Magical Jelly Bean
2015-05-06 10:31 - 2015-05-06 10:31 - 01178272 _____ (Magical Jelly Bean ) C:\Users\Renita\Downloads\KeyFinderInstaller.exe
2015-05-06 09:18 - 2015-05-07 09:30 - 00044882 _____ () C:\zoek-results.log
2015-05-06 08:56 - 2015-05-07 09:26 - 00000000 ____D () C:\zoek_backup
2015-05-05 16:33 - 2015-05-06 08:56 - 00001437 _____ () C:\Users\Renita\Desktop\zoek.exe - Shortcut.lnk
2015-05-05 16:29 - 2015-05-05 16:29 - 01308672 _____ () C:\Users\Renita\Downloads\zoek.exe
2015-05-05 11:54 - 2015-05-05 11:54 - 00165882 _____ () C:\Users\Renita\Downloads\Malwarebytes report.txt
2015-05-04 14:41 - 2015-05-04 14:41 - 00002330 _____ () C:\Users\Renita\Downloads\aswMBR.txt
2015-05-04 14:41 - 2015-05-04 14:41 - 00000512 _____ () C:\Users\Renita\Downloads\MBR.dat
2015-05-04 14:32 - 2015-05-04 14:32 - 05200384 _____ (AVAST Software) C:\Users\Renita\Downloads\aswmbr.exe
2015-05-04 14:32 - 2015-05-04 14:32 - 05200384 _____ (AVAST Software) C:\Users\Renita\Downloads\aswmbr (1).exe
2015-05-04 14:29 - 2015-05-04 14:30 - 00085404 _____ () C:\Users\Renita\Downloads\Addition.txt
2015-05-04 14:27 - 2015-05-04 14:30 - 00072582 _____ () C:\Users\Renita\Downloads\FRST.txt
2015-05-04 14:22 - 2015-05-11 09:37 - 00000000 ____D () C:\FRST
2015-05-04 14:22 - 2015-05-11 09:34 - 02102784 _____ (Farbar) C:\Users\Renita\Desktop\FRST64.exe
2015-05-04 09:49 - 2015-05-04 09:49 - 00013966 _____ () C:\Users\Renita\Downloads\Oil Contract Differencials (1).xlsx
2015-05-04 08:54 - 2015-05-04 08:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
2015-04-28 14:53 - 2015-04-28 14:54 - 13087456 _____ (Microsoft Corporation) C:\Users\Renita\Downloads\Silverlight_x64.exe
2015-04-27 11:26 - 2015-04-27 11:26 - 00012124 _____ () C:\Users\Renita\Downloads\2015-03-17 Bills to pay with FIB loan.xlsx
2015-04-26 13:40 - 2015-04-26 14:12 - 00061184 ____N () C:\Users\Renita\Documents\$600,000.00 LoanAmortization.xlsx
2015-04-24 16:53 - 2015-04-24 16:53 - 00001792 _____ () C:\Users\Public\Desktop\iTunes.lnk
2015-04-24 16:53 - 2015-04-24 16:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-04-24 16:52 - 2015-04-24 16:52 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-04-24 16:52 - 2015-04-24 16:52 - 00000000 ____D () C:\Program Files\iTunes
2015-04-24 16:52 - 2015-04-24 16:52 - 00000000 ____D () C:\Program Files\iPod
2015-04-24 16:52 - 2015-04-24 16:52 - 00000000 ____D () C:\Program Files (x86)\iTunes
2015-04-24 16:05 - 2015-03-24 21:24 - 03298816 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-04-24 16:05 - 2015-03-24 21:24 - 02553856 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-04-24 16:05 - 2015-03-24 21:24 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-04-24 16:05 - 2015-03-24 21:24 - 00191488 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-04-24 16:05 - 2015-03-24 21:24 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-04-24 16:05 - 2015-03-24 21:24 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-04-24 16:05 - 2015-03-24 21:24 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-04-24 16:05 - 2015-03-24 21:24 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-04-24 16:05 - 2015-03-24 21:23 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-04-24 16:05 - 2015-03-24 21:23 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-04-24 16:05 - 2015-03-24 21:23 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-04-24 16:05 - 2015-03-24 21:00 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-04-24 16:05 - 2015-03-24 21:00 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-04-24 16:05 - 2015-03-24 21:00 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-04-24 16:05 - 2015-03-24 21:00 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-04-24 16:05 - 2015-03-24 21:00 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-04-24 16:05 - 2015-03-22 21:25 - 00769536 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-04-24 16:05 - 2015-03-22 21:25 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-04-24 16:05 - 2015-03-22 21:24 - 00957952 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-04-24 16:05 - 2015-03-22 21:24 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-04-24 16:05 - 2015-03-22 21:24 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-04-24 16:05 - 2015-03-22 21:24 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-04-24 16:05 - 2015-03-22 21:24 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-04-24 16:05 - 2015-03-22 21:17 - 01111552 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-04-24 16:05 - 2015-03-09 21:25 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-04-24 16:05 - 2015-03-09 21:21 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-04-24 16:05 - 2015-03-09 21:08 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2015-04-24 16:05 - 2015-03-09 21:05 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2015-04-24 16:05 - 2015-03-04 23:12 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-04-24 16:05 - 2015-03-04 22:05 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-04-24 16:04 - 2015-03-16 23:22 - 05557696 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-04-24 16:04 - 2015-03-16 23:22 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-04-24 16:04 - 2015-03-16 23:22 - 00095672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-04-24 16:04 - 2015-03-16 23:19 - 01727904 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-04-24 16:04 - 2015-03-16 23:17 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-04-24 16:04 - 2015-03-16 23:17 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-04-24 16:04 - 2015-03-16 23:17 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-04-24 16:04 - 2015-03-16 23:16 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-04-24 16:04 - 2015-03-16 23:16 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-04-24 16:04 - 2015-03-16 23:16 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-04-24 16:04 - 2015-03-16 23:16 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-04-24 16:04 - 2015-03-16 23:16 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-04-24 16:04 - 2015-03-16 23:16 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-04-24 16:04 - 2015-03-16 23:16 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-04-24 16:04 - 2015-03-16 23:16 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-04-24 16:04 - 2015-03-16 23:16 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-04-24 16:04 - 2015-03-16 23:16 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-04-24 16:04 - 2015-03-16 23:16 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-04-24 16:04 - 2015-03-16 23:16 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-04-24 16:04 - 2015-03-16 23:16 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-04-24 16:04 - 2015-03-16 23:16 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-04-24 16:04 - 2015-03-16 23:16 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-04-24 16:04 - 2015-03-16 23:16 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-04-24 16:04 - 2015-03-16 23:16 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-04-24 16:04 - 2015-03-16 23:16 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-04-24 16:04 - 2015-03-16 23:16 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-04-24 16:04 - 2015-03-16 23:16 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-04-24 16:04 - 2015-03-16 23:15 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-04-24 16:04 - 2015-03-16 23:15 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-04-24 16:04 - 2015-03-16 23:15 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-04-24 16:04 - 2015-03-16 23:13 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-04-24 16:04 - 2015-03-16 23:13 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-04-24 16:04 - 2015-03-16 23:11 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-04-24 16:04 - 2015-03-16 23:11 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-04-24 16:04 - 2015-03-16 23:11 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 23:11 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 23:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 23:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 23:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 23:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 23:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 23:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 23:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 23:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 23:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 23:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 23:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 23:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 23:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 23:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 23:01 - 03976632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-04-24 16:04 - 2015-03-16 23:01 - 03920824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-04-24 16:04 - 2015-03-16 22:59 - 01309696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-04-24 16:04 - 2015-03-16 22:57 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-04-24 16:04 - 2015-03-16 22:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-04-24 16:04 - 2015-03-16 22:57 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-04-24 16:04 - 2015-03-16 22:57 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-04-24 16:04 - 2015-03-16 22:57 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-04-24 16:04 - 2015-03-16 22:57 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-04-24 16:04 - 2015-03-16 22:57 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-04-24 16:04 - 2015-03-16 22:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-04-24 16:04 - 2015-03-16 22:57 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-04-24 16:04 - 2015-03-16 22:56 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-04-24 16:04 - 2015-03-16 22:56 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-04-24 16:04 - 2015-03-16 22:56 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-04-24 16:04 - 2015-03-16 22:56 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-04-24 16:04 - 2015-03-16 22:56 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-04-24 16:04 - 2015-03-16 22:56 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-04-24 16:04 - 2015-03-16 22:56 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-04-24 16:04 - 2015-03-16 22:53 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-04-24 16:04 - 2015-03-16 22:53 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-04-24 16:04 - 2015-03-16 22:50 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-04-24 16:04 - 2015-03-16 22:50 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-04-24 16:04 - 2015-03-16 22:50 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 22:50 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 22:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 22:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 22:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 22:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 22:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 22:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 22:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 22:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 22:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 22:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 22:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 22:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 22:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 22:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 22:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 22:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 22:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 22:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 22:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 22:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 22:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 22:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 21:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-04-24 16:04 - 2015-03-16 21:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-04-24 16:04 - 2015-03-16 21:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 21:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 21:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-04-24 16:04 - 2015-03-16 21:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-04-24 16:02 - 2015-04-01 18:17 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-04-24 16:02 - 2015-04-01 17:49 - 00342704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-04-24 16:02 - 2015-03-12 22:32 - 24980480 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-04-24 16:02 - 2015-03-12 22:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-04-24 16:02 - 2015-03-12 22:25 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-04-24 16:02 - 2015-03-12 22:09 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-04-24 16:02 - 2015-03-12 22:08 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-04-24 16:02 - 2015-03-12 22:08 - 00417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-04-24 16:02 - 2015-03-12 22:08 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-04-24 16:02 - 2015-03-12 22:07 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-04-24 16:02 - 2015-03-12 22:06 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-04-24 16:02 - 2015-03-12 22:00 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-04-24 16:02 - 2015-03-12 21:59 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-04-24 16:02 - 2015-03-12 21:55 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-04-24 16:02 - 2015-03-12 21:54 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-04-24 16:02 - 2015-03-12 21:54 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-04-24 16:02 - 2015-03-12 21:53 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-04-24 16:02 - 2015-03-12 21:50 - 06025216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-04-24 16:02 - 2015-03-12 21:44 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-04-24 16:02 - 2015-03-12 21:42 - 19695616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-04-24 16:02 - 2015-03-12 21:42 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-04-24 16:02 - 2015-03-12 21:40 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-04-24 16:02 - 2015-03-12 21:32 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-04-24 16:02 - 2015-03-12 21:28 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-04-24 16:02 - 2015-03-12 21:28 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-04-24 16:02 - 2015-03-12 21:27 - 00340992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-04-24 16:02 - 2015-03-12 21:27 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-04-24 16:02 - 2015-03-12 21:27 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-04-24 16:02 - 2015-03-12 21:26 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-04-24 16:02 - 2015-03-12 21:26 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-04-24 16:02 - 2015-03-12 21:23 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-04-24 16:02 - 2015-03-12 21:22 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-04-24 16:02 - 2015-03-12 21:20 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-04-24 16:02 - 2015-03-12 21:20 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-04-24 16:02 - 2015-03-12 21:17 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-04-24 16:02 - 2015-03-12 21:16 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-04-24 16:02 - 2015-03-12 21:15 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-04-24 16:02 - 2015-03-12 21:08 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-04-24 16:02 - 2015-03-12 21:07 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-04-24 16:02 - 2015-03-12 21:06 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-04-24 16:02 - 2015-03-12 21:05 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-04-24 16:02 - 2015-03-12 21:05 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-04-24 16:02 - 2015-03-12 21:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-04-24 16:02 - 2015-03-12 21:00 - 14397440 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-04-24 16:02 - 2015-03-12 20:57 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-04-24 16:02 - 2015-03-12 20:56 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-04-24 16:02 - 2015-03-12 20:54 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-04-24 16:02 - 2015-03-12 20:49 - 04305408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-04-24 16:02 - 2015-03-12 20:45 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-04-24 16:02 - 2015-03-12 20:44 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-04-24 16:02 - 2015-03-12 20:43 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-04-24 16:02 - 2015-03-12 20:42 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-04-24 16:02 - 2015-03-12 20:34 - 12825600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-04-24 16:02 - 2015-03-12 20:33 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-04-24 16:02 - 2015-03-12 20:22 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-04-24 16:02 - 2015-03-12 20:20 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-04-24 16:02 - 2015-03-12 20:16 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-04-24 16:02 - 2015-03-12 20:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-04-24 16:02 - 2015-03-03 22:55 - 00367552 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2015-04-24 16:02 - 2015-03-03 22:41 - 00079360 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
2015-04-24 16:02 - 2015-03-03 22:10 - 00058880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clfsw32.dll
2015-04-24 16:02 - 2015-02-24 21:18 - 00754688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2015-04-13 15:17 - 2015-04-13 15:18 - 00009394 _____ () C:\Users\Renita\Downloads\northern oil 04102015.XLSX

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-11 09:08 - 2011-03-08 11:19 - 00000912 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3026445660-3059579512-81386765-1000UA.job
2015-05-11 08:45 - 2010-11-08 14:36 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-05-11 08:41 - 2012-05-02 15:31 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-11 08:40 - 2014-12-16 14:31 - 00000000 ___RD () C:\Users\Renita\Google Drive
2015-05-11 03:01 - 2012-01-19 14:18 - 00003942 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{B959AE4A-0E56-48D4-BE57-D6E60FC0EE5C}
2015-05-11 03:00 - 2009-07-13 23:10 - 01872092 _____ () C:\Windows\WindowsUpdate.log
2015-05-11 01:45 - 2010-11-08 14:36 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-05-10 18:43 - 2013-09-09 15:56 - 00000260 _____ () C:\Windows\Tasks\Synology Data Replicator 3-RENITA-2010-Renita.job
2015-05-10 13:08 - 2011-03-08 11:19 - 00000860 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3026445660-3059579512-81386765-1000Core.job
2015-05-09 09:10 - 2009-07-13 22:45 - 00025424 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-09 09:10 - 2009-07-13 22:45 - 00025424 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-08 15:23 - 2011-03-03 10:57 - 00000000 ___RD () C:\Users\Renita\Dropbox
2015-05-08 15:21 - 2011-03-03 10:56 - 00000000 ____D () C:\Users\Renita\AppData\Roaming\Dropbox
2015-05-08 15:20 - 2015-02-07 14:23 - 00000000 ____D () C:\Users\Renita\AppData\Roaming\Skype
2015-05-08 15:19 - 2014-10-06 15:08 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-08 15:18 - 2013-03-25 09:14 - 00000000 ____D () C:\Users\Renita\.rainlendar2
2015-05-08 15:17 - 2014-04-23 10:25 - 00000398 _____ () C:\Windows\Tasks\RegInOut on user logon - Renita.job
2015-05-08 15:16 - 2014-09-09 16:07 - 00008310 _____ () C:\Windows\setupact.log
2015-05-08 15:16 - 2009-07-13 23:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-07 13:29 - 2011-03-03 10:57 - 00001027 _____ () C:\Users\Renita\Desktop\Dropbox.lnk
2015-05-07 13:29 - 2011-03-03 10:57 - 00000000 ____D () C:\Users\Renita\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-05-07 09:50 - 2012-07-24 21:37 - 00000000 ____D () C:\Users\Renita\Documents\Passwords
2015-05-07 09:28 - 2013-08-05 10:02 - 00000008 __RSH () C:\Users\Renita\ntuser.pol
2015-05-07 09:28 - 2010-11-07 14:58 - 00000000 ____D () C:\Users\Renita
2015-05-07 09:26 - 2014-09-09 16:07 - 00695480 _____ () C:\Windows\PFRO.log
2015-05-07 09:17 - 2009-07-13 21:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2015-05-07 09:17 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy
2015-05-04 09:09 - 2014-04-23 10:37 - 00000000 ____D () C:\ProgramData\Backup
2015-05-04 09:01 - 2014-10-06 15:08 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-05-04 08:58 - 2014-10-13 14:20 - 00001141 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-05-04 08:58 - 2014-10-06 15:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-04-30 18:47 - 2014-12-16 14:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2015-04-28 15:48 - 2014-10-06 15:47 - 00002222 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-04-28 11:45 - 2014-04-08 11:56 - 00020187 ____N () C:\Users\Renita\Documents\Renita's To Do List.xlsx
2015-04-28 09:46 - 2012-04-18 21:39 - 00000083 _____ () C:\Windows\SysWOW64\gpupdate.bin
2015-04-26 13:31 - 2010-11-12 13:29 - 00000000 ____D () C:\Users\Renita\AppData\Local\Apps\2.0
2015-04-25 05:24 - 2014-12-10 05:04 - 00000000 ____D () C:\Windows\rescache
2015-04-25 03:55 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\AppCompat
2015-04-25 03:29 - 2014-12-10 04:25 - 00000000 ____D () C:\Windows\system32\appraiser
2015-04-25 03:29 - 2014-05-07 03:00 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-04-25 03:13 - 2010-11-07 15:27 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-04-25 03:12 - 2010-11-07 15:46 - 00787940 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2015-04-25 03:11 - 2009-07-13 23:13 - 00787940 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-25 03:10 - 2013-07-29 03:00 - 00000000 ____D () C:\Windows\system32\MRT
2015-04-25 03:04 - 2010-11-13 04:00 - 128913832 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-04-24 16:52 - 2012-04-23 16:29 - 00000000 ____D () C:\Program Files\Common Files\Apple
2015-04-24 15:49 - 2009-07-13 21:20 - 00000000 ____D () C:\Program Files\Common Files\System
2015-04-14 09:37 - 2014-10-06 15:08 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-04-14 09:37 - 2014-10-06 15:08 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-04-14 09:37 - 2014-10-06 15:08 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-04-13 10:16 - 2012-06-12 14:52 - 00000000 ____D () C:\ProgramData\xml_param
2015-04-13 10:14 - 2014-09-05 08:58 - 00000000 ____D () C:\Users\Renita\Documents\iSkysoft DVD Ripper

==================== Files in the root of some directories =======

2013-09-12 10:15 - 1998-11-27 21:41 - 0589824 ____N (Fred's Software Company) C:\Program Files\Printkey.exe
2011-01-19 12:24 - 2011-01-19 12:24 - 0025141 _____ () C:\Users\Renita\AppData\Roaming\Comma Separated Values (Windows).ADR
2011-01-21 10:53 - 2012-11-23 14:07 - 0099384 _____ () C:\Users\Renita\AppData\Roaming\inst.exe
2011-01-21 10:53 - 2012-11-23 14:07 - 0007859 _____ () C:\Users\Renita\AppData\Roaming\pcouffin.cat
2011-01-21 10:53 - 2012-11-23 14:07 - 0001167 _____ () C:\Users\Renita\AppData\Roaming\pcouffin.inf
2011-01-21 10:53 - 2012-11-23 14:07 - 0082816 _____ (VSO Software) C:\Users\Renita\AppData\Roaming\pcouffin.sys
2011-01-21 10:53 - 2012-06-08 20:10 - 0001044 _____ () C:\Users\Renita\AppData\Roaming\vso_ts_preview.xml
2013-06-17 10:29 - 2014-01-28 01:49 - 0000005 _____ () C:\Users\Renita\AppData\Roaming\WBPU-TTL.DAT
2015-03-19 15:34 - 2015-03-19 15:34 - 0000000 _____ () C:\Users\Renita\AppData\Local\00000028.loc
2013-03-26 16:20 - 2013-03-26 16:20 - 0004096 ____H () C:\Users\Renita\AppData\Local\keyfile3.drm
2013-09-07 16:50 - 2013-09-07 18:35 - 0000600 _____ () C:\Users\Renita\AppData\Local\PUTTY.RND
2010-11-08 15:03 - 2010-11-08 15:03 - 0000017 _____ () C:\Users\Renita\AppData\Local\resmon.resmoncfg
2014-04-23 16:24 - 2014-09-04 09:03 - 0000427 _____ () C:\ProgramData\DEFRAG_HISTORY.xml
2011-07-13 15:50 - 2011-07-13 15:50 - 0000153 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
2015-01-27 15:51 - 2015-01-27 15:51 - 0002713 _____ () C:\ProgramData\regid.1997-10.net.avatarsystems,Integra_9846FE39-8447-439E-BBD0-E9FAE7B87247.swidtag
2014-09-03 16:10 - 2014-09-03 16:10 - 0000374 _____ () C:\ProgramData\SERVICES_HISTORY.xml
2014-04-23 15:22 - 2014-09-03 16:02 - 0000562 _____ () C:\ProgramData\SYSTEM_CLEANER_HISTORY.xml

Some content of TEMP:
====================
C:\Users\Renita\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpalkkou.dll
C:\Users\Renita\AppData\Local\Temp\Quarantine.exe
C:\Users\Renita\AppData\Local\Temp\sqlite3.dll

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-05-04 00:23

==================== End Of Log ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 09-05-2015
Ran by Renita at 2015-05-11 09:38:21
Running from C:\Users\Renita\Desktop
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-3026445660-3059579512-81386765-500 - Administrator - Disabled)
ASPNET (S-1-5-21-3026445660-3059579512-81386765-1005 - Limited - Enabled)
Guest (S-1-5-21-3026445660-3059579512-81386765-501 - Limited - Disabled)
QBDataServiceUser21 (S-1-5-21-3026445660-3059579512-81386765-1006 - Limited - Enabled) => C:\Users\QBDataServiceUser21
Renita (S-1-5-21-3026445660-3059579512-81386765-1000 - Administrator - Enabled) => C:\Users\Renita

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

4D Embroidery System 8.2 Documentation Update (HKLM-x32\...\{899383C5-2470-439F-B586-9FE13365A791}) (Version: 8.2 - VSM Software Ltd.)
4D Embroidery System 8.2 Update (HKLM-x32\...\{AC6947BE-7FF3-4D58-8EA7-C3BC74A19535}) (Version: 8.2 - VSM Software Ltd.)
64-bit VSM Device Drivers 8.2 (HKLM\...\{D0AAC936-67C9-47C1-9759-707844D20306}) (Version: 1.00.0000 - VSM Group AB)
ABBYY FineReader for ScanSnap ™ 5.0 (HKLM-x32\...\{FB300000-0002-0000-0000-074957833700}) (Version: 11.0.159 - ABBYY)
ACH Origination Application (x32 Version: 19.41.0.3 - Fiserv) Hidden
Adobe Acrobat 8.3.1 - CPSID_83708 (HKLM-x32\...\Adobe Acrobat 8 Standard - English, Français, Deutsch_831) (Version: - Adobe Systems Incorporated)
Adobe Acrobat 8.3.1 Standard (HKLM-x32\...\Adobe Acrobat 8 Standard - English, Français, Deutsch) (Version: 8.3.1 - Adobe Systems)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.6.0.19140 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin 64-bit (HKLM\...\Adobe Flash Player Plugin) (Version: 11.2.202.235 - Adobe Systems Incorporated)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.235 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Advantage Data Architect v11.10 (HKLM-x32\...\{2C13E985-B33D-42BD-A606-B00D4D8CFE3C}) (Version: 11.10.0022 - Sybase, Inc.)
Aimersoft Video Converter Pro(Build 4.1.2.0) (HKLM-x32\...\Aimersoft Video Converter Pro_is1) (Version: - Aimersoft Software)
AllMusicConverter 4.3.3 (HKLM-x32\...\AllMusicConverter_is1) (Version: 4.3.3 - Ramka Ltd.)
AllMusicConverter Media Suite 4.3.3 (HKLM-x32\...\{191A3E43-34AD-417C-BCA8-8D089AE59D25}_is1) (Version: 4.3.3 - Ramka Ltd.)
AnyMedia Player 3.3.3 (HKLM-x32\...\{1959CCD2-1227-4de4-97E7-04F29D526762}_is1) (Version: 3.3.3 - Ramka Ltd.)
Apple Application Support (32-bit) (HKLM-x32\...\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{D7B824DE-DA32-4772-9E5E-39C5158136A7}) (Version: 3.1.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{C4123106-B685-48E6-B9BD-E4F911841EB4}) (Version: 8.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ArcSoft Software for HP (HKLM-x32\...\ArcSoft Software for HP) (Version: - )
Audials (HKLM-x32\...\{CA50136F-9F9E-4AFC-ADD4-471F896AC922}) (Version: 11.0.51800.0 - Audials AG)
Audible Download Manager (HKLM-x32\...\AudibleDownloadManager) (Version: 6.6.0.15 - Audible, Inc.)
AudibleManager (HKLM-x32\...\AudibleManager) (Version: 1996242174.48.56.12389746 - Audible, Inc.)
BlueView (HKLM-x32\...\{EA494E7E-2624-4A83-9C7D-44E62871B99E}) (Version: 1.00.64 - Schlumberger)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Broadcom Management Programs (HKLM\...\{5DB87A63-9420-48CC-9F9A-B8801D38D6B5}) (Version: 12.35.01 - Broadcom Corporation)
Canon MF Toolbox 4.9.1.1.mf04 (HKLM-x32\...\{132CA5D9-C745-4B0B-A3B2-8C7A6EC3EE7E}) (Version: 2.3.0 - )
Canon MF Toolbox 4.9.1.1.mf04 (HKLM-x32\...\{3BDDF462-8A95-4C50-86DA-4D41F3483EA5}) (Version: 2.3.0 - Canon)
Canon MF Toolbox 4.9.1.1.mf04 (HKLM-x32\...\{DD929BD3-5D41-4407-BE04-119B4A631869}) (Version: - )
Canon MF6500 Series (HKLM\...\{3F873E63-1CA5-4bdb-A8C7-D97012496DE3}) (Version: - )
Citrix Online Launcher (HKLM-x32\...\{77463C86-BB3A-426E-A6C2-06B4D28C250F}) (Version: 1.0.223 - Citrix)
Conexant D850 PCI V.92 Modem (HKLM\...\CNXT_MODEM_PCI_HSF) (Version: 7.80.4.0 - Conexant)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dell Driver Download Manager (HKU\S-1-5-21-3026445660-3059579512-81386765-1000\...\bd4d3a0508d364f5) (Version: 3.0.0.0 - Dell Inc)
Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)
Dell Printer Software (HKLM-x32\...\{105F3CE5-FE55-408E-BF30-E78F85BA0B12}) (Version: 1.00.000 - Dell Inc.)
Desktop Ticker 1.9.3 (HKLM\...\{bb73892d-4896-4649-8bdb-e80656e1f81a}}_is1) (Version: - Mike Batt)
Digital Line Detect (HKLM-x32\...\{E646DCF0-5A68-11D5-B229-002078017FBF}) (Version: 1.21 - BVRP Software, Inc)
Disk Burner 3.3.3 (HKLM-x32\...\{3B10760F-86A3-4376-A668-AC304015D5ED}_is1) (Version: 3.3.3 - Ramka Ltd.)
Dropbox (HKU\S-1-5-21-3026445660-3059579512-81386765-1000\...\Dropbox) (Version: 3.4.6 - Dropbox, Inc.)
EasiestSoft Video Converter 1.1.3 (HKLM-x32\...\{30AB2FCD-FBF2-4bed-1369-13E6A1468621}_is1) (Version: 1.1.3 - EasiestSoft International LLC.)
Embroidery Machine Communication Software 8.2 (HKLM-x32\...\{DB5A9370-AB50-4783-B4E0-0A1672BE5CA0}) (Version: 8.2 - VSM Software Ltd.)
ExtractNow (HKLM-x32\...\ExtractNow) (Version: - Nathan Moinvaziri)
EZPhoto Browser (HKLM-x32\...\{7A393E43-9F1B-4B4D-AFC3-E4B6663F6DD3}) (Version: 2.1 - )
EZPhoto Panorama (HKLM-x32\...\{B473BAC8-6A90-4D53-96C9-97A759A76EE8}) (Version: 2.1 - )
EZPhoto Tools (HKLM-x32\...\{ED8F2441-E5B9-4F48-82AD-759C17A68ADB}) (Version: 2.1 - )
EZShowtime MMS (HKLM-x32\...\{5FB2EF0E-0254-4B7E-98C9-7F83E0C5E6C2}) (Version: 1.1 - )
EZSuite For BestOn (HKLM-x32\...\{bda8f365-7ee2-4a60-ba96-511673153311}) (Version: 1.0 - )
EZVideo Mail (HKLM-x32\...\{2E8D4B52-52E5-41EF-9C43-8CDF1527DDFD}) (Version: 2.1 - )
FARO LS 1.1.406.58 (HKLM-x32\...\{951B0F30-9F1A-4BF6-B3DA-99EB0E917B1C}) (Version: 4.6.58.2 - FARO Scanner Production)
Flash Player Pro V5.4 (HKLM-x32\...\Flash Player Pro_is1) (Version: - FlashPlayerPro.com)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 42.0.2311.135 - Google Inc.)
Google Cloud Connect for Microsoft Office (HKLM-x32\...\{56B777D9-9D85-4A81-BF59-1EED7401ADC4}) (Version: 2.0.2662.0553 - Google, Inc)
Google Drive (HKLM-x32\...\{35574F09-89F9-4B16-B69B-64F3E25901B8}) (Version: 1.21.9226.6034 - Google, Inc.)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Gmail Notifier (HKLM-x32\...\{0228e555-4f9c-4e35-a3ec-b109a192b4c2}) (Version: - Google Inc.)
Google Talk Plugin (HKLM-x32\...\{8E29C1CE-346A-3F59-AE22-8C5B7F230498}) (Version: 5.3.1.18536 - Google)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6227.252 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
GoToAssist Expert 2.2.0.758 (HKU\S-1-5-21-3026445660-3059579512-81386765-1000\...\GoToAssist Remote Support Expert) (Version: 2.2.0.758 - Citrix Online)
GoToMeeting 5.8.0.1189 (HKU\S-1-5-21-3026445660-3059579512-81386765-1000\...\GoToMeeting) (Version: 5.8.0.1189 - CitrixOnline)
GPS Buddy (HKU\S-1-5-21-3026445660-3059579512-81386765-1000\...\e2df52a94d3e2e87) (Version: 1.0.0.140 - Skybase Solutions)
iCloud (HKLM\...\{709A2D23-C25E-47B5-9268-CB6FEE648504}) (Version: 4.1.1.53 - Apple Inc.)
Integra Energy Management System (HKLM-x32\...\{089D3E4C-18EE-4B97-90EC-46C55AFC1771}) (Version: 14.15.01.27 - Avatar Systems, Inc.)
Integra Energy Management System (HKLM-x32\...\{29486D8B-FB34-45B5-849F-F53517EDB7C0}) (Version: 14.15.01.14 - Avatar Systems, Inc.)
Integra Energy Management System (HKLM-x32\...\{73A77C2B-B988-4480-B1FE-6CD888B57BB8}) (Version: 14.14.10.31 - Avatar Systems, Inc.)
Intel® Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.0.1014 - Intel Corporation)
iSkysoft DVD Ripper(Build 2.6.1.3) (HKLM-x32\...\iSkysoft DVD Ripper_is1) (Version: - iSkysoft Software)
ISO Recorder (HKLM\...\{2D7ED2A0-9553-412B-939F-D6E0AEB2ABE1}) (Version: 3.1.0 - Alex Feinman)
ISO Recorder (HKLM-x32\...\{1235083F-52F9-44CC-9DF5-F9B7802BB9B7}) (Version: 3.0.0 - Alex Feinman)
iTunes (HKLM\...\{93F2A022-6C37-48B8-B241-FFABD9F60C30}) (Version: 12.1.2.27 - Apple Inc.)
Java 8 Update 40 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218040F0}) (Version: 8.0.400 - Oracle Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Leitz Icon (HKLM-x32\...\{f5b45834-5206-4fcc-83d4-caf8250b5d43}) (Version: 1.6.2231.0 - Leitz Icon Software)
Leitz Icon Software (x32 Version: 1.6.2231.0 - Leitz Icon Software) Hidden
Magical Jelly Bean KeyFinder (HKLM-x32\...\KeyFinder_is1) (Version: 2.0.10.10 - Magical Jelly Bean)
Malwarebytes Anti-Malware version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
MapSource - North American City Select v4.01 (HKLM-x32\...\{FA524A1B-BFB8-4527-8C90-93F6F095D1DD}) (Version: - )
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 1.1 (HKLM-x32\...\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}) (Version: 1.1.4322 - Microsoft)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2007 Primary Interop Assemblies (HKLM-x32\...\{50120000-1105-0000-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Professional Plus 2007 (HKLM-x32\...\PROPLUS) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.7.205.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual Studio 2005 Tools for Office Runtime (HKLM-x32\...\Microsoft Visual Studio 2005 Tools for Office Runtime) (Version: - Microsoft Corporation)
Microsoft Web Publishing Wizard 1.52 (HKLM-x32\...\WebPost) (Version: - )
Modem Diagnostic Tool (HKLM\...\{0335701D-8E28-4A7F-B0EF-312974755BB2}) (Version: 1.0.28.0 - Dell)
Modem Diagnostic Tool (HKLM-x32\...\{294EAADF-E50F-4DD8-AD8D-19587EA10512}) (Version: 1.0.28.0 - Dell)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM-x32\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
Netwaiting (HKLM-x32\...\{3F92ABBB-6BBF-11D5-B229-002078017FBF}) (Version: 2.5.59 - BVRP Software, Inc)
Nuance PaperPort 12 (HKLM-x32\...\{88B5FBDC-967D-4B1F-B291-39284AE12201}) (Version: 12.1.0005 - Nuance Communications, Inc.)
Nuance PDF Viewer Plus (HKLM-x32\...\{28656860-4728-433C-8AD4-D1A930437BC8}) (Version: 5.30.3290 - Nuance Communications, Inc)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.4 - NVIDIA Corporation)
NVIDIA nView Desktop Manager (HKLM\...\NVIDIA nView Desktop Manager) (Version: 125.14 - NVIDIA Corporation)
NVIDIA Performance Drivers (HKLM\...\{4C0A8D65-4286-4B58-87FE-18AD24289285}) (Version: 2.0.0.18 - NVIDIA Corporation)
Oil & Gas Disbursement and JIB Manager Special Edition for Quic (HKLM-x32\...\Oil & Gas Disbursement and JIB Manager - Special~91690802_is1) (Version: 2.9.6 - SherWare, Inc.)
Paint.NET v3.5.10 (HKLM\...\{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}) (Version: 3.60.0 - dotPDN LLC)
PaperPort Image Printer 64-bit (HKLM\...\{715CAACC-579B-4831-A5F4-A83A8DE3EFE2}) (Version: 14.00.0000 - Nuance Communications, Inc.)
PatternMaker 7 (HKLM-x32\...\PatternMaker 7_is1) (Version: 7 - PatternMaker Software)
PC Meter Connect (HKLM-x32\...\{D39BAE47-1B85-41F6-9348-44E965009B56}) (Version: 05.00.0056.0000 - Pitney Bowes)
PCLReader_131 (HKLM-x32\...\{801656DA-99A3-4614-8B00-E0F9739F5A91}) (Version: 13.15 - Page Technology Marketing, Inc.)
PdaNet for Android 3.00 (HKLM-x32\...\PdaNet_is1) (Version: - June Fabrics Technology Inc)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
PowerDVD DX (HKLM-x32\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 8.3.5424 - CyberLink Corp.)
Presto! PageManager 7.15.14 (HKLM-x32\...\{D2D6B9EB-C6DC-4DAA-B4DE-BB7D9735E7DA}) (Version: 7.15.14E - NewSoft)
QB Connection Diagnostic Tool (HKLM-x32\...\QB Connection Diagnostic Tool) (Version: 3.0.0.0 - Intuit Inc.)
QBFC 5.0 (HKLM-x32\...\{0E31CA83-8E2B-4B0D-A84D-F561B6CD482D}) (Version: 5.0.00203.0 - Intuit)
QBFC 7.0 (HKLM-x32\...\{D90AD053-6F8D-4658-9EB8-D57C8BE39092}) (Version: 7.0.0.134 - Intuit Developer Network)
QuickBooks (x32 Version: 21.0.4014.904 - Intuit Inc.) Hidden
QuickBooks File Doctor (HKLM-x32\...\{DE7AA711-E66A-4BB9-B5DE-55A0729AE38A}) (Version: 3.5.3 - Intuit)
QuickBooks Pro 2011 (HKLM-x32\...\{11E0AC7D-6822-4F67-865F-EE1C13D28C38}) (Version: 21.0.4014.904 - Intuit Inc.)
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
RadioGet 3.3.3 (HKLM-x32\...\{F6C84ED7-9CAC-423b-9E00-C9BFAFBD0593}_is1) (Version: 3.3.3 - Ramka Ltd.)
Rainlendar2 (remove only) (HKLM-x32\...\Rainlendar2) (Version: - )
RegInOut System Utilities (HKLM-x32\...\RegInOut System Utilities_is1) (Version: 4.0 - SORCIM Technologies Pvt Ltd)
RipTiger 3.3.3 (HKLM-x32\...\{AFD4597D-56CC-447F-AA68-C1BF1AEA448E}_is1) (Version: 3.3.3 - Ramka Ltd.)
ScanSnap Manager (HKLM-x32\...\{DBCDB997-EEEB-4BE9-BAFF-26B4094DBDE6}) (Version: V6.2L22 - PFU)
ScanSnap Manager (x32 Version: 6.1.11.2.4 - PFU) Hidden
ScanSnap Manager (x32 Version: 6.2.22.1.2 - PFU) Hidden
ScanSnap Organizer (HKLM-x32\...\{E58F3B88-3B3E-4F85-9323-04789D979C15}) (Version: V5.1L42 - PFU)
ScanSnap Organizer (x32 Version: 5.0.11.1 - PFU LIMITED) Hidden
ScanSoft OmniPage SE 4.0 (HKLM-x32\...\{C1E693A4-B1D5-4DCD-B68D-2087835B7184}) (Version: 15.00.0020 - Nuance Communications, Inc.)
Scansoft PDF Professional (x32 Version: - ) Hidden
Seagate DiscWizard (HKLM-x32\...\{8FB2A014-A0B0-42D8-8E18-9AFC6A6E2814}) (Version: 13.0.14387 - Seagate)
SharpEye Music Reader 2 (HKLM-x32\...\SharpEye Music Reader 2) (Version: - Visiv)
Shockwave (HKLM-x32\...\Shockwave) (Version: - )
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 7.1 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.1.105 - Skype Technologies S.A.)
SmartScore X Player (HKLM-x32\...\{EE4B01A0-1ABF-463B-B242-F6ED60444737}) (Version: 1.0.0 - Musitek)
SnowFox iPad Video Converter 2.6.0.0 (HKLM-x32\...\SnowFox iPad Video Converter_is1) (Version: - )
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)
Symform (HKLM\...\{73EDDF5E-CE9E-4A77-917F-58BBA5110300}) (Version: 4.24.0.0 - Symform, Inc.)
Synology Assistant (remove only) (HKLM-x32\...\Synology Assistant) (Version: - )
Synology Data Replicator 3 (HKLM-x32\...\{8E310838-457C-4269-B177-3EFB300CBDDC}) (Version: 1.0.0.0 - Synology Inc.)
The Print Shop 20 (HKLM-x32\...\{152BF35B-56D7-4652-B519-1661AAC270EE}) (Version: 20.00.0000 - Broderbund Software)
TuneGet 3.3.3 (HKLM-x32\...\{050A0D31-6B33-4137-ADE5-C0896E5FA98D}_is1) (Version: 3.3.3 - Ramka Ltd.)
TurboCAD Designer 17 (HKLM-x32\...\{C10680FA-AC9F-4FC0-8668-361420E153AE}) (Version: 17.0 - IMSIDesign)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Visual Studio Tools for the Office system 3.0 Runtime (HKLM-x32\...\Visual Studio Tools for the Office system 3.0 Runtime) (Version: - Microsoft Corporation)
VPE View v6.10 The Virtual Print Engine Document Viewer (HKLM-x32\...\VPE View v6.10 The Virtual Print Engine Document Viewer) (Version: - IDEAL Software GmbH, Neuss, Germany)
VSO Burning SDK 4.0.21.489 (HKLM-x32\...\VSO Burning SDK_is1) (Version: 4.0.21.489 - VSO Software SARL)
Win2PDF 3.50 (HKLM\...\Win2PDF_is1) (Version: 3.50 - Dane Prairie Systems, LLC.)
Win2PDF Font Helper 1.21 (GPL Ghostscript 8.62) (HKLM\...\Win2PDF Font Helper_is1) (Version: - )
WinDirStat 1.1.2 (HKU\S-1-5-21-3026445660-3059579512-81386765-1000\...\WinDirStat) (Version: - )
Windows Driver Package - Pitney Bowes (DM150Drv) USB (07/04/2010 2.0.1.5) (HKLM\...\BD561D5D94E7AFC181BE8A098D2EC2B90BD07068) (Version: 07/04/2010 2.0.1.5 - Pitney Bowes)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Sync (HKLM-x32\...\{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
WinZip (HKLM-x32\...\WinZip) (Version: 8.1 (4331) - WinZip Computing, Inc.)
Wondershare Video Converter Ultimate(Build 7.3.0.3) (HKLM-x32\...\Wondershare Video Converter Ultimate_is1) (Version: 7.3.0.3 - Wondershare Software)
XLS to DBF Converter 2.10 (HKLM-x32\...\XLS to DBF Converter_is1) (Version: - WhiteTown Software)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3026445660-3059579512-81386765-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Renita\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3026445660-3059579512-81386765-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\Renita\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-3026445660-3059579512-81386765-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Renita\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-3026445660-3059579512-81386765-1000_Classes\CLSID\{4ddb203f-88f2-4818-a3bd-1b52046af271}\InprocServer32 -> C:\Windows\system32\dfshim.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3026445660-3059579512-81386765-1000_Classes\CLSID\{6D7AE628-FF41-4CD3-91DD-34825BB1A251}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2012 - English\acad.exe /Automation No File
CustomCLSID: HKU\S-1-5-21-3026445660-3059579512-81386765-1000_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Program Files (x86)\Citrix\GoToMeeting\1189\G2MOutlookAddin64.dll (Citrix Online, a division of Citrix Systems, Inc.)
CustomCLSID: HKU\S-1-5-21-3026445660-3059579512-81386765-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Renita\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-3026445660-3059579512-81386765-1000_Classes\CLSID\{B77E471C-FBF3-4CB5-880F-D7528AD4B349}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2012 - English\acad.exe /Automation No File
CustomCLSID: HKU\S-1-5-21-3026445660-3059579512-81386765-1000_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\Renita\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3026445660-3059579512-81386765-1000_Classes\CLSID\{C92FB640-AD4D-498A-9979-A51A2540C977}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2012 - English\acad.exe /Automation No File
CustomCLSID: HKU\S-1-5-21-3026445660-3059579512-81386765-1000_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\Renita\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-3026445660-3059579512-81386765-1000_Classes\CLSID\{D70E31AD-2614-49F2-B0FC-ACA781D81F3E}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2012 - English\acad.exe No File
CustomCLSID: HKU\S-1-5-21-3026445660-3059579512-81386765-1000_Classes\CLSID\{E2C40589-DE61-11ce-BAE0-0020AF6D7005}\InprocServer32 -> C:\Program Files\Autodesk\AutoCAD 2012 - English\acadficn.dll No File
CustomCLSID: HKU\S-1-5-21-3026445660-3059579512-81386765-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Renita\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-3026445660-3059579512-81386765-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Renita\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3026445660-3059579512-81386765-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Renita\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3026445660-3059579512-81386765-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Renita\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3026445660-3059579512-81386765-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Renita\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3026445660-3059579512-81386765-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Renita\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3026445660-3059579512-81386765-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Renita\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3026445660-3059579512-81386765-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Renita\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3026445660-3059579512-81386765-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Renita\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3026445660-3059579512-81386765-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Renita\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3026445660-3059579512-81386765-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Renita\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File

==================== Restore Points =========================

06-05-2015 09:18:08 zoek.exe restore point
07-05-2015 09:01:25 zoek.exe restore point
08-05-2015 09:39:21 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 20:34 - 2009-06-10 15:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0A1830C0-5EB0-42FA-AAC3-22CF4D410589} - System32\Tasks\{5696CB09-02F9-4BC9-B168-5F8D61705079} => C:\Program Files (x86)\SherWare\DMIE\swlaunch.EXE
Task: {0CBC279A-9041-4D39-9D01-31707DEB91B9} - System32\Tasks\{B263D1B1-BCAD-4F98-9B68-DBE0A6F84646} => pcalua.exe -a C:\Users\Renita\Downloads\LogStreamActiveXSetup.exe -d C:\Users\Renita\Downloads
Task: {16F132A6-B8BC-4B0B-9F73-BF6BD0AD4BEF} - System32\Tasks\SymformLogUploader => C:\Program Files\Symform\Node Service\LogUploader.exe [2014-11-19] (Symform, Inc.)
Task: {19D453FA-40BD-4280-A138-9B09448E1B41} - System32\Tasks\{4FC5542E-930B-4A2D-89FA-6B3C0A54F2C3} => C:\Program Files\A2DRasterViewer\A2DRasterViewer.exe
Task: {2427DA74-2E4D-4063-85BE-09641FE602D9} - System32\Tasks\{10680D97-1484-4F4E-96A6-3D9E727AE8CC} => C:\Program Files (x86)\Aimersoft\Video Converter Std\VideoConverterStd.exe
Task: {254C69F3-8472-4B22-8FBA-A460F736A9D6} - System32\Tasks\{A812DF2C-C9C9-482E-891E-1C3F6651B18B} => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe
Task: {2A98A9F4-46F6-4E14-A369-0E2073D9DB63} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-17] (Google Inc.)
Task: {31C56CCF-26A5-488A-B213-F2BCB35982ED} - System32\Tasks\{7072FB8A-676C-4DAC-B9A8-939475AE5BD0} => pcalua.exe -a C:\Users\Renita\Downloads\AudibleDM_iTunesSetup.exe -d C:\Users\Renita\Downloads
Task: {3644B764-FAB4-4D71-91F7-75C172EA240E} - System32\Tasks\{EF006BB6-DA5B-4666-A067-DDDD8C19E3E5} => pcalua.exe -a C:\PROGRA~1\A2DRAS~1\UNWISE.EXE -c C:\PROGRA~1\A2DRAS~1\INSTALL.LOG
Task: {3DB794D0-ED98-4601-96F1-786CEB564133} - System32\Tasks\{C1EA61A4-7277-45B9-AFE9-15B5305C707C} => C:\Program Files (x86)\Aimersoft\Video Converter Std\VideoConverterStd.exe
Task: {4ABAC3C2-8591-4D65-B1B1-A2CE236C37BA} - System32\Tasks\{78C478D5-77F5-4871-9608-1655D0736F04} => pcalua.exe -a J:\Garmin\Setup\NACitySel401\Setup.exe -d J:\Garmin\Setup\NACitySel401
Task: {4CABB08D-2CB1-44FF-817E-3805D768F9A4} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3026445660-3059579512-81386765-1000Core => C:\Users\Renita\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-19] (Google Inc.)
Task: {4DADDC7E-85B6-4CC1-AB03-5156BF757FA2} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {50CE9298-1469-47A5-AB4F-0F95BC52D43D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-17] (Google Inc.)
Task: {579FB5DA-ABF4-4939-9068-5D6724400F14} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {5A96A4F8-E077-45BE-9930-2584E9812F0F} - System32\Tasks\{C36146DB-286C-467B-9403-0C998F35C552} => pcalua.exe -a C:\Windows\system32\pcwrun.exe -c "C:\Program Files\A2DRasterViewer\A2DRasterViewer.exe"
Task: {5CD85708-C159-4DAD-867B-BE4D4296AAFC} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-24] (Microsoft Corporation)
Task: {5E19024E-2913-4C31-8C99-8A6451BB0A6D} - System32\Tasks\{C7587F8C-6494-4E51-9799-1C9DE8B07860} => pcalua.exe -a "C:\Program Files (x86)\Aimersoft\Video Converter Pro\Setup.exe" -d "C:\Program Files (x86)\Aimersoft\Video Converter Pro" -c 1
Task: {6530128A-4F98-4059-B979-0CC4AF6D41F8} - System32\Tasks\{974C0C0B-0560-4185-AFF9-CF377B3E66A8} => C:\Program Files (x86)\SherWare\DMIE\swlaunch.EXE
Task: {6B93737D-BBC8-4979-AFBA-FD7A69A877BB} - System32\Tasks\{6110202E-2C31-46AA-AD38-7A53D56DFDB7} => pcalua.exe -a E:\PC\SETUP.EXE -d E:\PC
Task: {6C32E6AB-6D82-4AB2-8B87-7CCCAE2852EC} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {7A28ED8C-9F00-4311-AC1F-BBBF751763A5} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {812C9645-D420-402E-A92D-E1083491D294} - System32\Tasks\RegInOut on user logon - Renita => C:\Program Files (x86)\RegInOut System Utilities\RegInOut.exe [2013-12-03] (SORCIM Technologies)
Task: {85D2A057-ADCB-4967-A1F0-EE56185BFAC6} - \SymformServicesRestart No Task File <==== ATTENTION
Task: {A5B00DB7-0E3B-484E-AD07-B76607E0F7CA} - System32\Tasks\{17B648DA-2B7B-43B9-8FCC-01FE32FDEB4F} => pcalua.exe -a D:\QBooks\setup.exe -d D:\QBooks
Task: {AA32DE9F-3C55-4B71-ABBE-AB2B788A7327} - System32\Tasks\{824116E0-A5B6-4237-9546-50E9C02010B7} => pcalua.exe -a E:\setup.exe -d E:\
Task: {AB10174A-D570-4B8B-A1E0-5A8DC880029E} - System32\Tasks\{7E63A2C9-9C78-4503-ABB1-E8BA5BFD94B6} => pcalua.exe -a C:\Users\Renita\AppData\Local\Temp\Temp1_Data_Replicator_0152.zip\0152\install\Setup.exe
Task: {B418B73F-ED90-4EAA-86E8-C5F77D5ECA02} - System32\Tasks\{F46C9B92-2F11-43F3-9470-157BBA2D31D8} => C:\Program Files\A2DRasterViewer\A2DRasterViewer.exe
Task: {B8E0D074-C7C5-4022-BCC1-A4B2A982B8D0} - System32\Tasks\{F9980395-4856-4ED6-A11C-0F770546CC6B} => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe
Task: {B9ABA8DF-8806-4EB1-83AB-A96F88A6CE30} - System32\Tasks\{9139D18A-C386-4368-A86C-39EE21E0A302} => pcalua.exe -a "C:\Users\Renita\Downloads\CouponXplorerCrxSetup (1).exe" -d C:\Users\Renita\Downloads
Task: {C8A203EE-85E4-4782-A522-BD93DCB6C695} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-17] (Adobe Systems Incorporated)
Task: {CACE1BB8-8278-4240-ADB5-87B2BA122BE5} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-24] (Microsoft Corporation)
Task: {CB0BAD09-94AA-46A4-9CB5-83FD128851D2} - System32\Tasks\{57EF64D3-5AA1-4213-B0C3-410B24C3E6C3} => pcalua.exe -a J:\netsetup.exe -d J:\
Task: {CE7B0BBF-17E8-433A-B6D8-130B6AB047E5} - System32\Tasks\{8657D917-BB53-4B72-BE4F-6D4EC51CEA38} => C:\Program Files (x86)\SherWare\DMIE\swlaunch.EXE
Task: {D166025F-7AAB-4C11-B460-46DC21AB695D} - System32\Tasks\{860CCD8A-FEAD-4B84-9751-657AB051EBF0} => pcalua.exe -a C:\Users\Renita\Downloads\bb98.exe -d C:\Users\Renita\Downloads
Task: {D2D0CA9B-A7BE-4D23-9CFD-F06EAF0BEF33} - System32\Tasks\Synology Data Replicator 3-RENITA-2010-Renita => L:\Synology Data Replicator 3\Backup.exe [2013-09-09] (Synology Inc.)
Task: {D372173E-CBC3-46F1-BB5D-5135E3370A48} - System32\Tasks\{C46CADDB-E4E7-4CED-B4A8-1CD574F52E02} => pcalua.exe -a C:\Users\Renita\Downloads\QuickBooksPro2011.exe -d C:\Users\Renita\Downloads
Task: {DB654C05-3A36-4BAB-B195-CEFA1481722E} - System32\Tasks\{F65B6B39-D7E4-4BF3-BD9A-E91C09492B64} => pcalua.exe -a E:\Setup.exe -d E:\
Task: {DEE7116D-FA51-4CDA-82A4-354BB8A5287D} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3026445660-3059579512-81386765-1000UA => C:\Users\Renita\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-19] (Google Inc.)
Task: {F6BBAC8A-3482-4624-B9F9-0CBB9E3AF07E} - System32\Tasks\{0928CB2F-D32E-4BED-8CF5-9C67D3DAF0E5} => pcalua.exe -a D:\QBooks\CleanUpUtil.Exe -d D:\QBooks
Task: {F82F257F-15EA-4712-8A19-0D5EF45F6E42} - System32\Tasks\{56862D8E-F7E6-403B-8E6A-58FEE244AC49} => C:\Program Files (x86)\Aimersoft\Video Converter Std\VideoConverterStd.exe
Task: {FCEF5340-21AC-4DC0-AEF8-F87C3B7784EA} - System32\Tasks\{2F580DF9-BFB3-4099-B6A9-51FFE7F0824A} => C:\Program Files (x86)\Aimersoft\Video Converter Std\VideoConverterStd.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3026445660-3059579512-81386765-1000Core.job => C:\Users\Renita\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3026445660-3059579512-81386765-1000UA.job => C:\Users\Renita\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\RegInOut on user logon - Renita.job => C:\Program Files (x86)\RegInOut System Utilities\RegInOut.exe
Task: C:\Windows\Tasks\Synology Data Replicator 3-RENITA-2010-Renita.job => L:\Synology Data Replicator 3\Backup.exe

==================== Loaded Modules (whitelisted) ==============

2014-10-28 18:17 - 2014-10-28 18:17 - 00014848 _____ () C:\Windows\System32\LeitzLm.DLL
2010-11-09 11:32 - 2009-09-16 10:10 - 00075056 _____ () C:\Windows\System32\win2pdfm.dll
2015-02-13 05:20 - 2015-02-13 05:20 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-02-13 05:20 - 2015-02-13 05:20 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2014-08-12 12:57 - 2013-08-23 13:36 - 00721263 _____ () C:\Windows\SysWOW64\WSCM64.dll
2013-03-11 15:10 - 2013-03-11 15:10 - 04373600 ____N () C:\Program Files\Rainlendar2\Rainlendar2.exe
2012-05-16 13:12 - 2012-05-16 13:12 - 00179200 ____N () C:\Program Files\Rainlendar2\lua52.dll
2013-03-11 15:11 - 2013-03-11 15:11 - 00334432 ____N () C:\Program Files\Rainlendar2\plugins\iCalendarPlugin.dll
2012-06-17 07:21 - 2012-06-17 07:21 - 00015360 ____N () C:\Program Files\Rainlendar2\lfs.dll
2014-02-18 15:24 - 2014-02-18 15:24 - 00473352 _____ () C:\Program Files (x86)\Audials\Audials 11\AudialsNotifier.exe
2014-10-08 10:29 - 2014-10-08 10:29 - 00292304 _____ () C:\Program Files\Symform\Node Service\AlphaFS.dll
2013-09-09 15:39 - 2013-09-09 15:39 - 00381312 _____ () L:\Synology Data Replicator 3\SynoDrServicex64.exe
2013-08-14 01:52 - 2013-08-14 01:52 - 00248704 ____N () C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
2014-11-19 15:00 - 2014-11-19 15:00 - 00163256 _____ () C:\Program Files\Symform\Node Service\symformutp.DLL
2014-10-08 10:29 - 2014-10-08 10:29 - 00057544 _____ () C:\Program Files\Symform\Node Service\Mono.Nat.dll
2014-02-18 15:24 - 2014-02-18 15:24 - 00046080 _____ () C:\Program Files (x86)\Audials\Audials 11\boost_thread-vc90-mt-1_39.dll
2014-02-18 15:24 - 2014-02-18 15:24 - 00045056 _____ () C:\Program Files (x86)\Audials\Audials 11\boost_date_time-vc90-mt-1_39.dll
2014-02-18 15:24 - 2014-02-18 15:24 - 00545032 _____ () C:\Program Files (x86)\Audials\Audials 11\StreamingClient.dll
2014-02-18 15:24 - 2014-02-18 15:24 - 00012800 _____ () C:\Program Files (x86)\Audials\Audials 11\boost_system-vc90-mt-1_39.dll
2014-02-18 15:24 - 2014-02-18 15:24 - 00068360 _____ () C:\Program Files (x86)\Audials\Audials 11\CrashRpt.dll
2014-02-18 15:24 - 2014-02-18 15:24 - 00409352 _____ () C:\Program Files (x86)\Audials\Audials 11\SQLite3.dll
2014-02-18 15:24 - 2014-02-18 15:24 - 00614912 _____ () C:\Program Files (x86)\Audials\Audials 11\boost_regex-vc90-mt-1_39.dll
2015-03-12 03:38 - 2015-03-12 03:38 - 00284160 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Utils\e5e653059906398bb73689144891e8fb\Utils.ni.dll
2015-03-12 03:38 - 2015-03-12 03:38 - 00581120 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\ManagedInterfaces\9daf9fd6cb5cf501be59de941c4a5aa7\ManagedInterfaces.ni.dll
2015-04-25 03:19 - 2015-04-25 03:19 - 02915840 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\AudialsComponents\0bcd95e87f020c2dfcbad6f1742f371d\AudialsComponents.ni.dll
2015-03-12 03:38 - 2015-03-12 03:38 - 00174592 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\fastJSON\db77e7ef68172055bf5bae4ca0d976b9\fastJSON.ni.dll
2015-02-13 05:20 - 2015-02-13 05:20 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2015-05-08 15:20 - 2015-05-08 15:20 - 00043008 _____ () c:\users\renita\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpalkkou.dll
2015-03-04 15:45 - 2015-03-04 15:45 - 00750080 _____ () C:\Users\Renita\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-03-04 15:45 - 2015-03-04 15:45 - 00047616 _____ () C:\Users\Renita\AppData\Roaming\Dropbox\bin\libEGL.dll
2015-03-04 15:45 - 2015-03-04 15:45 - 00865280 _____ () C:\Users\Renita\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2015-03-04 15:45 - 2015-03-04 15:45 - 00200704 _____ () C:\Users\Renita\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2015-05-08 15:17 - 2015-05-08 15:17 - 00098816 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\win32api.pyd
2015-05-08 15:18 - 2015-05-08 15:18 - 00110080 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\pywintypes27.dll
2015-05-08 15:17 - 2015-05-08 15:17 - 00364544 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\pythoncom27.dll
2015-05-08 15:18 - 2015-05-08 15:18 - 00045568 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\_socket.pyd
2015-05-08 15:18 - 2015-05-08 15:18 - 01161216 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\_ssl.pyd
2015-05-08 15:17 - 2015-05-08 15:17 - 00320512 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\win32com.shell.shell.pyd
2015-05-08 15:18 - 2015-05-08 15:18 - 00713216 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\_hashlib.pyd
2015-05-08 15:17 - 2015-05-08 15:17 - 01175040 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\wx._core_.pyd
2015-05-08 15:18 - 2015-05-08 15:18 - 00805888 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\wx._gdi_.pyd
2015-05-08 15:18 - 2015-05-08 15:18 - 00811008 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\wx._windows_.pyd
2015-05-08 15:18 - 2015-05-08 15:18 - 01062400 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\wx._controls_.pyd
2015-05-08 15:18 - 2015-05-08 15:18 - 00735232 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\wx._misc_.pyd
2015-05-08 15:17 - 2015-05-08 15:17 - 00682496 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\pysqlite2._sqlite.pyd
2015-05-08 15:18 - 2015-05-08 15:18 - 00128512 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\_elementtree.pyd
2015-05-08 15:18 - 2015-05-08 15:18 - 00127488 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\pyexpat.pyd
2015-05-08 15:18 - 2015-05-08 15:18 - 00087552 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\_ctypes.pyd
2015-05-08 15:18 - 2015-05-08 15:18 - 00119808 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\win32file.pyd
2015-05-08 15:18 - 2015-05-08 15:18 - 00108544 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\win32security.pyd
2015-05-08 15:18 - 2015-05-08 15:18 - 00007168 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\hashobjs_ext.pyd
2015-05-08 15:17 - 2015-05-08 15:18 - 00017408 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\usb_ext.pyd
2015-05-08 15:18 - 2015-05-08 15:18 - 00167936 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\win32gui.pyd
2015-05-08 15:18 - 2015-05-08 15:18 - 00018432 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\win32event.pyd
2015-05-08 15:18 - 2015-05-08 15:18 - 00013824 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\common.time34.pyd
2015-05-08 15:18 - 2015-05-08 15:18 - 00036864 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\_psutil_windows.pyd
2015-05-08 15:18 - 2015-05-08 15:18 - 00038912 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\win32inet.pyd
2015-05-08 15:18 - 2015-05-08 15:18 - 00011264 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\win32crypt.pyd
2015-05-08 15:17 - 2015-05-08 15:17 - 00070656 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\wx._html2.pyd
2015-05-08 15:18 - 2015-05-08 15:18 - 00027136 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\_multiprocessing.pyd
2015-05-08 15:18 - 2015-05-08 15:18 - 00020480 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\_yappi.pyd
2015-05-08 15:18 - 2015-05-08 15:18 - 00035840 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\win32process.pyd
2015-05-08 15:18 - 2015-05-08 15:18 - 00686080 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\unicodedata.pyd
2015-05-08 15:17 - 2015-05-08 15:17 - 00122368 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\wx._wizard.pyd
2015-05-08 15:18 - 2015-05-08 15:18 - 00024064 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\win32pipe.pyd
2015-05-08 15:18 - 2015-05-08 15:18 - 00010240 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\select.pyd
2015-05-08 15:18 - 2015-05-08 15:18 - 00025600 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\win32pdh.pyd
2015-05-08 15:18 - 2015-05-08 15:18 - 00525640 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\windows._lib_cacheinvalidation.pyd
2015-05-08 15:18 - 2015-05-08 15:18 - 00017408 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\win32profile.pyd
2015-05-08 15:17 - 2015-05-08 15:17 - 00022528 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\win32ts.pyd
2015-05-08 15:17 - 2015-05-08 15:17 - 00078336 _____ () C:\Users\Renita\AppData\Local\Temp\_MEI31122\wx._animate.pyd
2015-04-28 15:47 - 2015-04-27 20:07 - 01252680 _____ () C:\Program Files (x86)\Google\Chrome\Application\42.0.2311.135\libglesv2.dll
2015-04-28 15:47 - 2015-04-27 20:07 - 00080712 _____ () C:\Program Files (x86)\Google\Chrome\Application\42.0.2311.135\libegl.dll
2015-01-27 15:46 - 2015-03-17 08:41 - 08935936 _____ () X:\Integra\Lib\OGLIB1.dll
2009-04-09 22:47 - 2009-04-09 22:47 - 00198144 _____ () X:\Integra\LIB\BIN\som.dll
2003-01-18 13:41 - 2003-01-18 13:41 - 00135168 _____ () X:\Integra\LIB\BIN\JACE31XP.dll
2003-01-17 23:26 - 2003-01-17 23:26 - 00143360 _____ () X:\Integra\LIB\BIN\jace31.dll
2013-02-15 10:40 - 2013-02-15 10:40 - 00471552 _____ () X:\Integra\LIB\BIN\xpp-vpe.dll
2015-01-27 15:46 - 2015-01-27 15:46 - 08651264 _____ () X:\Integra\Lib\OGLIBF.dll
2015-01-27 15:46 - 2015-03-17 08:41 - 02633728 _____ () X:\Integra\Lib\OGLIBP.dll
2015-01-27 15:38 - 2015-01-27 15:38 - 00460288 _____ () X:\Integra\Lib\DC010.DLL

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:E138854D
AlternateDataStreams: C:\Users\Renita\Documents\Our Family-0040 (cropped).jpg:com.dropbox.attributes

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, the associated entry will be removed from the registry.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3026445660-3059579512-81386765-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Renita\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.11.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: AERTFilters => 2
MSCONFIG\Services: Apple Mobile Device => 2
MSCONFIG\Services: Autodesk Content Service => 2
MSCONFIG\Services: BPowMon => 2
MSCONFIG\Services: Canon Driver Information Assist Service => 2
MSCONFIG\Services: cmdAgent => 2
MSCONFIG\Services: CrossLoopService => 2
MSCONFIG\Services: FileOpenManagerSvc => 2
MSCONFIG\Services: FLEXnet Licensing Service => 3
MSCONFIG\Services: FLEXnet Licensing Service 64 => 3
MSCONFIG\Services: GoToAssist Express Customer => 3
MSCONFIG\Services: GoToMyPC => 2
MSCONFIG\Services: GSService => 3
MSCONFIG\Services: gupdate => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: gusvc => 3
MSCONFIG\Services: IAStorDataMgrSvc => 2
MSCONFIG\Services: iPod Service => 3
MSCONFIG\Services: NVIDIA Performance Driver Service => 2
MSCONFIG\Services: nvsvc => 2
MSCONFIG\Services: QBCFMonitorService => 2
MSCONFIG\Services: QBFCService => 3
MSCONFIG\Services: QBVSS => 2
MSCONFIG\Services: QuickBooksDB21 => 3
MSCONFIG\Services: SMServer => 3
MSCONFIG\Services: tvnserver => 3
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Audible Download Manager.lnk => C:\Windows\pss\Audible Download Manager.lnkCommon Startup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^CardMinder Viewer.lnk => C:\Windows\pss\CardMinder Viewer.lnkCommon Startup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Conversion to PDF with ScanSnap Organizer.lnk => C:\Windows\pss\Conversion to PDF with ScanSnap Organizer.lnkCommon Startup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Digital Line Detect.lnk => C:\Windows\pss\Digital Line Detect.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Intuit Data Protect.lnk => C:\Windows\pss\Intuit Data Protect.lnkCommon Startup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk => C:\Windows\pss\QuickBooks Update Agent.lnkCommon Startup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickBooks_Standard_21.lnk => C:\Windows\pss\QuickBooks_Standard_21.lnkCommon Startup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^ScanSnap Manager.lnk => C:\Windows\pss\ScanSnap Manager.lnkCommon Startup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WinZip Quick Pick.lnk => C:\Windows\pss\WinZip Quick Pick.lnkCommon Startup
MSCONFIG\startupfolder: C:^Users^Renita^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk => C:\Windows\pss\Dropbox.lnkStartup
MSCONFIG\startupfolder: C:^Users^Renita^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^PdaNet Desktop.lnk => C:\Windows\pss\PdaNet Desktop.lnkStartup
MSCONFIG\startupreg: Acrobat Assistant 8.0 => "C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: APISupport => "C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\Renita\AppData\Local\TB\APISupport\APISupport.dll",DLLRunAPISupport
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: AudialsNotifier => C:\Program Files (x86)\Audials\Audials 11\AudialsNotifier.exe
MSCONFIG\startupreg: DiscWizardMonitor.exe => "C:\Program Files (x86)\Seagate\DiscWizard\DiscWizardMonitor.exe"
MSCONFIG\startupreg: Google Update => "C:\Users\Renita\AppData\Local\Google\Update\GoogleUpdate.exe" /c
MSCONFIG\startupreg: GoogleDriveSync => "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart
MSCONFIG\startupreg: IAStorIcon => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
MSCONFIG\startupreg: iCloudServices => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
MSCONFIG\startupreg: Intuit SyncManager => C:\Program Files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe startup
MSCONFIG\startupreg: MSC => "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
MSCONFIG\startupreg: nwiz => C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /install
MSCONFIG\startupreg: OpwareSE4 => "C:\Program Files (x86)\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
MSCONFIG\startupreg: PDVDDXSrv => "C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
MSCONFIG\startupreg: QuickBooksDB21 => C:\PROGRA~2\Intuit\QUICKB~1\QBDBMgrN.exe -n QB_RENITA-2010_21 -qs -gd ALL -gk all -gp 4096 -gu all -ch 256M -c 128M -x tcpip(BroadcastListener=NO;port=55343) -ti 0 -ec simple -qi -qw -tl 120 -oe C:\PROGRA~3\Intuit\QUICKB~2\DBSTAR~1.LOG -y
MSCONFIG\startupreg: ScanSnap OnlineUpdate Watcher => "C:\Program Files (x86)\PFU\ScanSnap\Update\SsUWatcher.exe" -StartOS
MSCONFIG\startupreg: ScanSnap WIA Service Checker => C:\Windows\SSDriver\fi5110\SsWiaChecker.exe
MSCONFIG\startupreg: SSBkgdUpdate => "C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: swg => "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
MSCONFIG\startupreg: TBHostSupport => "C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\Renita\AppData\Local\TBHostSupport\TBHostSupport_0.dll",DLLRunTBHostSupportPlugin
MSCONFIG\startupreg: WrtMon.exe => C:\Windows\system32\spool\drivers\x64\3\WrtMon.exe
MSCONFIG\startupreg: {0228e555-4f9c-4e35-a3ec-b109a192b4c2} => C:\Program Files (x86)\Google\Gmail Notifier\gnotify.exe

==================== FirewallRules (whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{C4FDF1AB-6CA8-49FE-8D68-25049AF5A32E}] => (Allow) svchost.exe
FirewallRules: [{B81293FF-DF97-44E7-AE50-8F5AB807FFAD}] => (Allow) C:\Program Files (x86)\Windows Live\Sync\WindowsLiveSync.exe
FirewallRules: [{94138862-DF43-4D1A-AD61-FAF19E06F8CD}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD DX\PowerDVD.exe
FirewallRules: [{07D09E1D-A398-4515-B934-6DD0BAE3C527}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe
FirewallRules: [{5E26C9DE-4BDC-41B8-A3E1-3245E533CFE9}] => (Allow) C:\Program Files\Canon\DIAS\CnxDIAS.exe
FirewallRules: [{082BC6A7-431C-499E-8F86-8D9373F42DC8}] => (Allow) C:\Program Files\Canon\DIAS\CnxDIAS.exe
FirewallRules: [{8904AE62-507F-4F7E-833E-BF49EA2683D9}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{6636A41A-780A-49D1-8330-A6A75798F3CC}] => (Allow) LPort=2869
FirewallRules: [{5814E45B-A2D1-4822-B409-DF80D9A1AC78}] => (Allow) LPort=1900
FirewallRules: [{2C6FD3A0-721B-4B1C-BD60-08E64309BAAD}] => (Allow) C:\Program Files (x86)\Windows Live\Mesh\MOE.exe
FirewallRules: [TCP Query User{3308AD43-9361-4B63-A199-5A8812D2CB0B}C:\program files (x86)\sherware\dmie\swlaunch.exe] => (Allow) C:\program files (x86)\sherware\dmie\swlaunch.exe
FirewallRules: [UDP Query User{780CD782-A437-43F4-A387-D20588AF00C8}C:\program files (x86)\sherware\dmie\swlaunch.exe] => (Allow) C:\program files (x86)\sherware\dmie\swlaunch.exe
FirewallRules: [TCP Query User{41475C19-8E2F-453A-BE7E-7154135BD49B}C:\program files (x86)\java\jre6\bin\java.exe] => (Allow) C:\program files (x86)\java\jre6\bin\java.exe
FirewallRules: [UDP Query User{0644BF1C-E05B-4719-8FD9-10F470545235}C:\program files (x86)\java\jre6\bin\java.exe] => (Allow) C:\program files (x86)\java\jre6\bin\java.exe
FirewallRules: [{2B090A66-6602-4CA8-87A6-4837C07DE3E2}] => (Allow) C:\Users\Renita\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{DCC6853A-1DF8-420E-89E4-CB47C3B0BE49}] => (Allow) C:\Users\Renita\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{C1CAF908-4E69-4E8A-A775-793C54529752}] => (Allow) LPort=5910
FirewallRules: [TCP Query User{1E84CB2C-B5EE-4D6B-9C09-A0BEBD008290}C:\users\renita\appdata\local\crossloop\crossloopconnect.exe] => (Block) C:\users\renita\appdata\local\crossloop\crossloopconnect.exe
FirewallRules: [UDP Query User{C9590BD3-DCAE-492A-9D6D-DE326E7EDBB2}C:\users\renita\appdata\local\crossloop\crossloopconnect.exe] => (Block) C:\users\renita\appdata\local\crossloop\crossloopconnect.exe
FirewallRules: [TCP Query User{8CB067D5-98ED-4BA9-9160-6524800376BD}C:\users\renita\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\renita\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{281EA65D-4BBE-4282-8E58-7F28EF955005}C:\users\renita\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\renita\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [TCP Query User{977DC9B0-1012-457B-8F44-709D3FF79996}C:\users\renita\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\renita\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{C32A4BB4-6402-49D6-BF11-B5928F000AFD}C:\users\renita\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\renita\appdata\local\akamai\netsession_win.exe
FirewallRules: [TCP Query User{F019491E-287E-4A57-BB79-9A98AE764C7A}C:\users\renita\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\renita\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{427B3E74-A520-4AA6-9BD3-E0E6B8BE42D4}C:\users\renita\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\renita\appdata\local\akamai\netsession_win.exe
FirewallRules: [{7A2CD586-03EF-453A-8E19-1F70A2BB7ECA}] => (Allow) %ProgramFiles% (x86)\Intuit\QuickBooks 2011\QBW32Pro.exe
FirewallRules: [{3E2E8A08-D0C5-487C-87CD-0FB09F9BA8FC}] => (Allow) C:\Program Files (x86)\Intuit\QuickBooks 2011\QBW32Pro.exe
FirewallRules: [{23ED8218-0DC2-447F-BAB1-2DA8DA7E8E4E}] => (Allow) C:\Program Files (x86)\Intuit\QuickBooks 2011\QBW32Pro.exe
FirewallRules: [{EEC4D382-5D39-4AF5-8500-E9CF876F0C1B}] => (Allow) C:\Program Files (x86)\Intuit\QuickBooks 2011\QBW32Pro.exe
FirewallRules: [{182D1ED2-DF0E-4FF7-84EB-FAE2C393E5A4}] => (Allow) C:\Program Files (x86)\Intuit\QuickBooks 2011\QBW32Pro.exe
FirewallRules: [{3CA0D95A-21DE-463A-A4B1-3ABE6F414587}] => (Allow) C:\Users\Renita\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe
FirewallRules: [{FB39365C-4916-43FB-8B31-B70EB2D83B37}] => (Allow) C:\Users\Renita\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe
FirewallRules: [{446D1A27-DDFD-4C7B-B5DE-88D41D447DB2}] => (Allow) C:\Program Files (x86)\RipTiger\RipTiger.exe
FirewallRules: [{EA2DB93B-331A-45F2-9014-44280E73028E}] => (Allow) C:\Program Files (x86)\RipTiger\RipTiger.exe
FirewallRules: [{34441B1D-6DDA-4339-BFB2-EFD2D67D4554}] => (Allow) C:\Program Files (x86)\RipTiger\HTTPDownloaderApp.exe
FirewallRules: [{42A4762F-2946-4B7C-BDEE-71D6690BD131}] => (Allow) C:\Program Files (x86)\RipTiger\HTTPDownloaderApp.exe
FirewallRules: [{EFC1B3FB-7D6F-437E-8765-0BFDE030D029}] => (Allow) C:\Program Files (x86)\RipTiger\RTMPDownloaderApp.exe
FirewallRules: [{F359011B-696A-44B9-8349-1C1CF028216E}] => (Allow) C:\Program Files (x86)\RipTiger\RTMPDownloaderApp.exe
FirewallRules: [{80290D58-742E-4474-9D0C-72477236AEFF}] => (Allow) C:\Program Files (x86)\RipTiger\VideoDownloadApp_RTMP.exe
FirewallRules: [{32824817-DD3B-49CC-9C0B-363A086AA02D}] => (Allow) C:\Program Files (x86)\RipTiger\VideoDownloadApp_RTMP.exe
FirewallRules: [{EB904534-4C7D-46A1-85FC-7CEE27AD55D3}] => (Allow) C:\Program Files (x86)\RipTiger\MMSDownloaderApp.exe
FirewallRules: [{ACFEAA45-3A22-4077-8F7C-D76603F67175}] => (Allow) C:\Program Files (x86)\RipTiger\MMSDownloaderApp.exe
FirewallRules: [TCP Query User{8C49BF14-86F3-48C3-ABBA-DF28F747DCB0}C:\users\renita\downloads\nexposesetup-windows64.exe] => (Allow) C:\users\renita\downloads\nexposesetup-windows64.exe
FirewallRules: [UDP Query User{BB058D3A-8ED3-4452-ADD6-259BF73F35FA}C:\users\renita\downloads\nexposesetup-windows64.exe] => (Allow) C:\users\renita\downloads\nexposesetup-windows64.exe
FirewallRules: [TCP Query User{61DDD4E4-6C8A-4609-8938-6E760D146058}C:\sherware\dmie\swlaunch.exe] => (Allow) C:\sherware\dmie\swlaunch.exe
FirewallRules: [UDP Query User{63EBDB29-22AA-4345-B1FC-551232906669}C:\sherware\dmie\swlaunch.exe] => (Allow) C:\sherware\dmie\swlaunch.exe
FirewallRules: [{97EE6543-D9DC-477E-9BE5-A28526D70690}] => (Allow) C:\Program Files (x86)\Common Files\Comodo\GeekBuddyRSP.exe
FirewallRules: [{CE78E47B-A79B-46C2-BF5F-D3B430DCEC64}] => (Allow) C:\Program Files (x86)\Common Files\Comodo\GeekBuddyRSP.exe
FirewallRules: [{9CC28173-8DD8-4E40-B3FB-668ACD1AA302}] => (Allow) C:\Program Files (x86)\Intuit\QuickBooks 2005\qbdbmgrn.exe
FirewallRules: [{2E41721D-3F6C-41F8-920B-D3868987BF81}] => (Allow) C:\Program Files (x86)\Intuit\QuickBooks 2005\qbdbmgrn.exe
FirewallRules: [{9FA94648-91BF-4CB3-8B31-8437381BAED6}] => (Allow) C:\Program Files (x86)\Intuit\QuickBooks 2005\qbw32.exe
FirewallRules: [{0C7A0017-C7BF-4955-BDB1-859C66921BB0}] => (Allow) C:\Program Files (x86)\Intuit\QuickBooks 2005\qbw32.exe
FirewallRules: [{E63B31E1-37BE-4AE9-A57E-4AA9504958CE}] => (Allow) C:\Program Files (x86)\Intuit\QuickBooks 2005\dbmanagerexe.exe
FirewallRules: [{AAC1C7A1-E17D-4052-8ABB-7A1D0F9E2064}] => (Allow) C:\Program Files (x86)\Intuit\QuickBooks 2005\dbmanagerexe.exe
FirewallRules: [{9EAF0E55-1839-406A-8F8A-1AA0E1D7F2DB}] => (Allow) C:\Program Files (x86)\Intuit\QuickBooks 2005\filemanagement.exe
FirewallRules: [{7019501E-A346-4ABC-8297-81D933CFD3BB}] => (Allow) C:\Program Files (x86)\Intuit\QuickBooks 2005\filemanagement.exe
FirewallRules: [{9C915B3E-CE8D-45ED-9D7C-13AFB840762E}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
FirewallRules: [{6C8B6649-B014-4479-B183-5B66CD4192D5}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
FirewallRules: [{6823BC7A-8961-4B47-8144-81E9CBEEE14D}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\qblaunch.exe
FirewallRules: [{0049F5F5-2366-415F-B73D-8C918850D794}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\qblaunch.exe
FirewallRules: [TCP Query User{EAF1A577-D740-42CA-A371-6774EA4A0B17}C:\program files (x86)\badblue\ee\badblue.exe] => (Allow) C:\program files (x86)\badblue\ee\badblue.exe
FirewallRules: [UDP Query User{ADE58A1D-DC17-44A3-BA02-C9C532C430F4}C:\program files (x86)\badblue\ee\badblue.exe] => (Allow) C:\program files (x86)\badblue\ee\badblue.exe
FirewallRules: [{4086F879-B9E7-47FF-A71D-B42C3E59395B}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{C125B75A-8F32-495E-824C-250621ED3E1A}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{A3B236CF-510D-4801-A00A-38116826BCA0}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{93EA48B2-DB59-4F40-B4ED-26F1E8E3292E}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [TCP Query User{35A34513-6873-4FFB-9D5C-F8CDCF1CF891}D:\setupassistance\fscommand\dlact.exe] => (Allow) D:\setupassistance\fscommand\dlact.exe
FirewallRules: [UDP Query User{A320677E-3C36-4FCD-B73A-72B5A61BFC7C}D:\setupassistance\fscommand\dlact.exe] => (Allow) D:\setupassistance\fscommand\dlact.exe
FirewallRules: [TCP Query User{0266198A-0727-4A11-A10E-418B4E68BCFC}C:\users\renita\appdata\local\temp\set692d.tmp] => (Allow) C:\users\renita\appdata\local\temp\set692d.tmp
FirewallRules: [UDP Query User{6B8D3B36-9DD6-4320-B906-F7E06DBD87F2}C:\users\renita\appdata\local\temp\set692d.tmp] => (Allow) C:\users\renita\appdata\local\temp\set692d.tmp
FirewallRules: [TCP Query User{38FFD2BA-BDF5-4487-BD2C-6BC4867F4227}C:\users\renita\appdata\local\temp\setb192.tmp] => (Allow) C:\users\renita\appdata\local\temp\setb192.tmp
FirewallRules: [UDP Query User{18D16AAC-65E7-4B80-9A56-C24448014D3E}C:\users\renita\appdata\local\temp\setb192.tmp] => (Allow) C:\users\renita\appdata\local\temp\setb192.tmp
FirewallRules: [TCP Query User{D011B5D7-B076-4DD5-AEC7-17B882C5F58D}C:\users\renita\appdata\local\temp\set3977.tmp] => (Allow) C:\users\renita\appdata\local\temp\set3977.tmp
FirewallRules: [UDP Query User{4C18D04C-F095-422C-9E22-FC9BDD8A50BB}C:\users\renita\appdata\local\temp\set3977.tmp] => (Allow) C:\users\renita\appdata\local\temp\set3977.tmp
FirewallRules: [{B5B91651-8355-4C99-9CBA-7EF2BB82FF2D}] => (Allow) C:\Program Files (x86)\Intuit\QuickBooks 2005\QBDBMgrN.exe
FirewallRules: [{4C0F1C04-5AC8-4946-A4B4-EFAA81427A6F}] => (Allow) C:\Program Files (x86)\Intuit\QuickBooks 2005\QBDBMgrN.exe
FirewallRules: [{44D0E46A-1B4D-4F5D-9EDC-5AC1C72F37D4}] => (Allow) C:\Program Files (x86)\Intuit\QuickBooks 2005\QBW32.EXE
FirewallRules: [{CFDA4CBA-C34C-41BA-9FC8-D10A25021C91}] => (Allow) C:\Program Files (x86)\Intuit\QuickBooks 2005\QBW32.EXE
FirewallRules: [{7D82EE47-E0E8-437F-93F8-E856891A5D49}] => (Allow) C:\Program Files (x86)\Intuit\QuickBooks 2005\DBManagerExe.exe
FirewallRules: [{29A2BF07-E9E0-4288-9900-7646779E1755}] => (Allow) C:\Program Files (x86)\Intuit\QuickBooks 2005\DBManagerExe.exe
FirewallRules: [{B1E62848-B02A-48F5-9804-EF36F64DCC66}] => (Allow) C:\Program Files (x86)\Intuit\QuickBooks 2005\FileManagement.exe
FirewallRules: [{02920902-2E44-4338-8A78-FB175B72F075}] => (Allow) C:\Program Files (x86)\Intuit\QuickBooks 2005\FileManagement.exe
FirewallRules: [{FCF01DEB-AD02-4A6D-96F7-34968B9BD18F}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
FirewallRules: [{3F8DC891-B638-40FD-945D-480A5D2E6BB9}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
FirewallRules: [{DDE3398C-B3BA-41EB-94E9-DF1CCBD04DEB}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBLaunch.exe
FirewallRules: [{CB1658CC-B0DB-4435-9C49-5865219202CC}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBLaunch.exe
FirewallRules: [TCP Query User{8864EECC-6446-45FF-99B7-C01A718B12A1}C:\users\renita\downloads\dsassistant_2636\win\dsassistant.exe] => (Allow) C:\users\renita\downloads\dsassistant_2636\win\dsassistant.exe
FirewallRules: [UDP Query User{B1B443BA-A0A0-4E74-840C-700D71BDC7C7}C:\users\renita\downloads\dsassistant_2636\win\dsassistant.exe] => (Allow) C:\users\renita\downloads\dsassistant_2636\win\dsassistant.exe
FirewallRules: [TCP Query User{2E386363-F351-459C-B06C-B220F41A59F2}C:\program files (x86)\synology\assistant\dsassistant.exe] => (Allow) C:\program files (x86)\synology\assistant\dsassistant.exe
FirewallRules: [UDP Query User{ECAA8EDA-6A30-4AFA-AA83-66D6BD1C481D}C:\program files (x86)\synology\assistant\dsassistant.exe] => (Allow) C:\program files (x86)\synology\assistant\dsassistant.exe
FirewallRules: [{6F850487-ACC7-447E-8520-898442267E0F}] => (Allow) L:\Synology Data Replicator 3\Backup.exe
FirewallRules: [{51DFA5F0-1989-4433-B8FA-2753048C581E}] => (Allow) L:\Synology Data Replicator 3\Backup.exe
FirewallRules: [{B3F50E65-5BAC-472E-8C6C-584DB7949A85}] => (Allow) LPort=6262
FirewallRules: [{44FE912F-D043-436A-9AA2-FA70D639A675}] => (Allow) LPort=240
FirewallRules: [{88559645-6AEA-488C-B70A-E1E1F0DD568F}] => (Allow) C:\Program Files (x86)\Audials\Audials 11\Audials.exe
FirewallRules: [{A082747F-D162-4F0C-BDAE-6AF64B821CF2}] => (Allow) LPort=12972
FirewallRules: [{DEBD6FA6-7F7F-4302-802E-2610A3C56AB9}] => (Allow) LPort=14714
FirewallRules: [{FDCF47AB-7EFD-43BD-92D8-398BDD59B6A1}] => (Allow) LPort=31931
FirewallRules: [{494BC7DC-B823-433E-A25B-9DDAFDEFDE43}] => (Allow) LPort=49176
FirewallRules: [{4038BD05-C7A6-4FF3-8DAD-66307B48F08D}] => (Allow) LPort=5000
FirewallRules: [TCP Query User{9CA9037C-719A-4B46-94F5-937F292EBE20}C:\program files (x86)\wondershare\video converter ultimate\urlreqservice.exe] => (Allow) C:\program files (x86)\wondershare\video converter ultimate\urlreqservice.exe
FirewallRules: [UDP Query User{6C3E7336-95E0-421C-AF02-5BA57F8C8E61}C:\program files (x86)\wondershare\video converter ultimate\urlreqservice.exe] => (Allow) C:\program files (x86)\wondershare\video converter ultimate\urlreqservice.exe
FirewallRules: [TCP Query User{8B3E8B5E-57CA-4099-96B2-A0715A0E2373}\\win-olcratvjngj\avatar\integra\lib\integra.exe] => (Allow) \\win-olcratvjngj\avatar\integra\lib\integra.exe
FirewallRules: [UDP Query User{EB441DDA-CE2C-40A2-A003-1AEFB8AE0852}\\win-olcratvjngj\avatar\integra\lib\integra.exe] => (Allow) \\win-olcratvjngj\avatar\integra\lib\integra.exe
FirewallRules: [TCP Query User{FBCAF4D4-703B-47FB-83B4-71A15EBC1FAD}C:\program files (x86)\stockwatch\desktop\1.0.0.142\swticker.exe] => (Allow) C:\program files (x86)\stockwatch\desktop\1.0.0.142\swticker.exe
FirewallRules: [UDP Query User{259EE81A-A5C6-4678-8B88-F634D49F5253}C:\program files (x86)\stockwatch\desktop\1.0.0.142\swticker.exe] => (Allow) C:\program files (x86)\stockwatch\desktop\1.0.0.142\swticker.exe
FirewallRules: [{65947FDD-B52A-49A8-BE3F-21396B8393B7}] => (Allow) C:\Users\Renita\AppData\Local\Temp\nsf89F1.tmp\CnetInstaller-10968747.exe
FirewallRules: [{38148438-71ED-4147-B2DE-A2341A1DAF89}] => (Allow) C:\Users\Renita\AppData\Local\Temp\nsf89F1.tmp\CnetInstaller-10968747.exe
FirewallRules: [{4C0BDEBF-8344-49B4-91A1-786784E912A0}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{18EDC5FE-DC62-4C41-97BF-20CBB51F1D6A}] => (Allow) C:\Program Files\Symform\Node Service\symformconfig.exe
FirewallRules: [{1C56D092-54B7-49D1-881F-583F7A158842}] => (Allow) C:\Program Files\Symform\Node Service\symformcontrib.exe
FirewallRules: [{2E58E84A-201B-4054-AFBC-536055E82106}] => (Allow) C:\Users\Renita\AppData\Local\Temp\nsy7DA8.tmp\CnetInstaller-10794599.exe
FirewallRules: [{A29A41DE-38F1-476F-B123-6CC3099E7EE0}] => (Allow) C:\Users\Renita\AppData\Local\Temp\nsy7DA8.tmp\CnetInstaller-10794599.exe
FirewallRules: [{67D81B96-A59F-485D-A13B-5F263C0BE590}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{FAFD44EF-3852-402B-9FAE-92BA24ADEA6E}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft Teredo Tunneling Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Canon MF6500 Series
Description: Canon MF6500 Series
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: Canon
Service: usbscan
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

==================== Event log errors: =========================

Application errors:
==================
Error: (05/11/2015 05:09:04 AM) (Source: MsiInstaller) (EventID: 11714) (User: RENITA-2010)
Description: Product: Google Talk Plugin -- Error 1714. The older version of Google Talk Plugin cannot be removed. Contact your technical support group. System Error 1612.

Error: (05/11/2015 00:08:18 AM) (Source: MsiInstaller) (EventID: 11714) (User: RENITA-2010)
Description: Product: Google Talk Plugin -- Error 1714. The older version of Google Talk Plugin cannot be removed. Contact your technical support group. System Error 1612.

Error: (05/10/2015 07:08:51 PM) (Source: MsiInstaller) (EventID: 11714) (User: RENITA-2010)
Description: Product: Google Talk Plugin -- Error 1714. The older version of Google Talk Plugin cannot be removed. Contact your technical support group. System Error 1612.

Error: (05/10/2015 07:00:10 PM) (Source: Windows Backup) (EventID: 4104) (User: )
Description: The backup was not successful. The error is: Windows Backup failed while determining libraries location of one of the users included in backup. (0x81000031).

Error: (05/10/2015 02:08:59 PM) (Source: MsiInstaller) (EventID: 11714) (User: RENITA-2010)
Description: Product: Google Talk Plugin -- Error 1714. The older version of Google Talk Plugin cannot be removed. Contact your technical support group. System Error 1612.

Error: (05/10/2015 09:08:14 AM) (Source: MsiInstaller) (EventID: 11714) (User: RENITA-2010)
Description: Product: Google Talk Plugin -- Error 1714. The older version of Google Talk Plugin cannot be removed. Contact your technical support group. System Error 1612.

Error: (05/10/2015 04:08:55 AM) (Source: MsiInstaller) (EventID: 11714) (User: RENITA-2010)
Description: Product: Google Talk Plugin -- Error 1714. The older version of Google Talk Plugin cannot be removed. Contact your technical support group. System Error 1612.

Error: (05/09/2015 11:08:13 PM) (Source: MsiInstaller) (EventID: 11714) (User: RENITA-2010)
Description: Product: Google Talk Plugin -- Error 1714. The older version of Google Talk Plugin cannot be removed. Contact your technical support group. System Error 1612.

Error: (05/09/2015 07:00:06 PM) (Source: Windows Backup) (EventID: 4104) (User: )
Description: The backup was not successful. The error is: Windows Backup failed while determining libraries location of one of the users included in backup. (0x81000031).

Error: (05/09/2015 06:08:46 PM) (Source: MsiInstaller) (EventID: 11714) (User: RENITA-2010)
Description: Product: Google Talk Plugin -- Error 1714. The older version of Google Talk Plugin cannot be removed. Contact your technical support group. System Error 1612.

System errors:
=============
Error: (05/09/2015 03:27:36 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: The ScRegSetValueExW call failed for FailureCommand with the following error:
%%5

Error: (05/09/2015 03:27:34 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: The ScRegSetValueExW call failed for Start with the following error:
%%5

Error: (05/08/2015 03:27:34 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: The ScRegSetValueExW call failed for FailureCommand with the following error:
%%5

Error: (05/08/2015 03:27:32 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: The ScRegSetValueExW call failed for Start with the following error:
%%5

Error: (05/08/2015 03:14:51 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Search service, but this action failed with the following error:
%%1056

Error: (05/08/2015 03:14:21 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Live ID Sign-in Assistant service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.

Error: (05/08/2015 03:14:21 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Search service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.

Error: (05/08/2015 03:14:21 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The UsbClientService service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 200 milliseconds: Restart the service.

Error: (05/08/2015 03:14:21 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The SynoDrService service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 200 milliseconds: Restart the service.

Error: (05/08/2015 03:14:10 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Software Protection service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

Microsoft Office Sessions:
=========================
Error: (02/21/2014 03:32:41 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 1 seconds with 0 seconds of active time. This session ended with a crash.

Error: (01/21/2014 00:12:30 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 1 seconds with 0 seconds of active time. This session ended with a crash.

Error: (01/21/2014 00:11:49 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 1 seconds with 0 seconds of active time. This session ended with a crash.

Error: (01/21/2014 00:05:21 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 1 seconds with 0 seconds of active time. This session ended with a crash.

Error: (01/21/2014 11:22:35 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 1 seconds with 0 seconds of active time. This session ended with a crash.

Error: (01/21/2014 11:04:21 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 1 seconds with 0 seconds of active time. This session ended with a crash.

Error: (01/21/2014 11:00:33 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 1 seconds with 0 seconds of active time. This session ended with a crash.

Error: (01/21/2014 10:56:46 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 1 seconds with 0 seconds of active time. This session ended with a crash.

Error: (01/21/2014 10:55:18 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 1 seconds with 0 seconds of active time. This session ended with a crash.

Error: (01/21/2014 10:53:58 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 1 seconds with 0 seconds of active time. This session ended with a crash.

CodeIntegrity Errors:
===================================
Date: 2011-01-13 09:36:10.416
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.

==================== Memory info ===========================

Processor: Intel® Core™ i5 CPU 650 @ 3.20GHz
Percentage of memory in use: 41%
Total physical RAM: 3959.11 MB
Available physical RAM: 2311.43 MB
Total Pagefile: 7916.42 MB
Available Pagefile: 3762.69 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:232.06 GB) (Free:13.28 GB) NTFS
Drive f: (Personal Drive) (Fixed) (Total:465.76 GB) (Free:428.26 GB) NTFS
Drive k: () (Network) (Total:1397.26 GB) (Free:270.27 GB)
Drive l: (Local Disk Backup Drive) (Fixed) (Total:3725.9 GB) (Free:2182.2 GB) NTFS
Drive m: () (Fixed) (Total:465.66 GB) (Free:449.83 GB) NTFS
Drive o: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.03 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive p: () (Network) (Total:11072.02 GB) (Free:7574.54 GB)
Drive q: () (Network) (Total:11072.02 GB) (Free:7574.54 GB)
Drive r: () (Network) (Total:11072.02 GB) (Free:7574.54 GB)
Drive s: () (Network) (Total:931.51 GB) (Free:300.67 GB)
Drive v: () (Network) (Total:465.66 GB) (Free:397.01 GB)
Drive x: () (Network) (Total:31.9 GB) (Free:13.08 GB)

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 232.8 GB) (Disk ID: 259D4594)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Active) - (Size=750 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=232.1 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 3726 GB) (Disk ID: 3D353E1E)

Partition: GPT Partition Type.

========================================================
Disk: 6 (Size: 465.8 GB) (Disk ID: 12345678)
Partition 1: (Active) - (Size=465.8 GB) - (Type=07 NTFS)

========================================================
Disk: 7 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 90DDBFB2)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=465.7 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Edited by Naathim, 11 May 2015 - 10:25 AM.
removed quotations

#14
Renita123

Posted 11 May 2015 - 11:57 AM

Member

Topic Starter
Member
14 posts

I am still getting a acrobat/no disk in drive error but I am not getting any malware issues anymore.

Edited by Naathim, 12 May 2015 - 07:07 AM.
removed quotations

#15
Naathim

Posted 12 May 2015 - 07:25 AM

GeekU Minion

Expert
4,568 posts

Please do not press "quote reply" to do a post. It makes my work harder, just start typing in the window below the post to prepare a new one.

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.
Running it on another one may cause damage and render the system unstable.

Press the

+ R on your keyboard at the same time. Type Notepad and click OK.

Copy the entire content of the codebox below and paste into the Notepad document:

start
CreateRestorePoint:
CloseProcesses: 
HKU\S-1-5-21-3026445660-3059579512-81386765-1000\...\MountPoints2: O - O:\VZW_Software_upgrade_assistant.exe
HKU\S-1-5-21-3026445660-3059579512-81386765-1000\...\MountPoints2: {34f5116b-4b37-11e3-ac06-f04da2da6240} - O:\VZW_Software_upgrade_assistant.exe
HKU\S-1-5-21-3026445660-3059579512-81386765-1000\...\MountPoints2: {5b4495a7-adfa-11e0-82bd-f04da2da6240} - "K:\WD SmartWare.exe" autoplay=true
HKU\S-1-5-21-3026445660-3059579512-81386765-1000\...\MountPoints2: {adeb7974-0218-11e4-8232-f04da2da6240} - "O:\WD SmartWare.exe" autoplay=true
URLSearchHook: HKU\S-1-5-21-3026445660-3059579512-81386765-1000 - Default Value = {CFBFAE00-17A6-11D0-99CB-00C04FD64497}
SearchScopes: HKLM -> {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = http://www.bing.com/...=MSSEDF&pc=MSSE
SearchScopes: HKLM -> {FD44EDF6-5F68-43B1-BF57-03FE9B8B6565} URL = http://www.bing.com/...rc=IE-SearchBox
SearchScopes: HKLM-x32 -> {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = http://www.bing.com/...=MSSEDF&pc=MSSE
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\.DEFAULT -> {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = http://www.bing.com/...=MSSEDF&pc=MSSE
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3026445660-3059579512-81386765-1000 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = http://www.google.co...q={searchTerms}
SearchScopes: HKU\S-1-5-21-3026445660-3059579512-81386765-1000 -> {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = http://www.bing.com/...=MSSEDF&pc=MSSE
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
Toolbar: HKU\.DEFAULT -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
Toolbar: HKU\S-1-5-21-3026445660-3059579512-81386765-1000 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
C:\Users\Renita\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpalkkou.dll
C:\Users\Renita\AppData\Local\Temp\Quarantine.exe
C:\Users\Renita\AppData\Local\Temp\sqlite3.dll
CustomCLSID: HKU\S-1-5-21-3026445660-3059579512-81386765-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\Renita\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-3026445660-3059579512-81386765-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Renita\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-3026445660-3059579512-81386765-1000_Classes\CLSID\{6D7AE628-FF41-4CD3-91DD-34825BB1A251}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2012 - English\acad.exe /Automation No File
CustomCLSID: HKU\S-1-5-21-3026445660-3059579512-81386765-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Renita\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-3026445660-3059579512-81386765-1000_Classes\CLSID\{B77E471C-FBF3-4CB5-880F-D7528AD4B349}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2012 - English\acad.exe /Automation No File
CustomCLSID: HKU\S-1-5-21-3026445660-3059579512-81386765-1000_Classes\CLSID\{C92FB640-AD4D-498A-9979-A51A2540C977}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2012 - English\acad.exe /Automation No File
CustomCLSID: HKU\S-1-5-21-3026445660-3059579512-81386765-1000_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\Renita\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-3026445660-3059579512-81386765-1000_Classes\CLSID\{D70E31AD-2614-49F2-B0FC-ACA781D81F3E}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2012 - English\acad.exe No File
CustomCLSID: HKU\S-1-5-21-3026445660-3059579512-81386765-1000_Classes\CLSID\{E2C40589-DE61-11ce-BAE0-0020AF6D7005}\InprocServer32 -> C:\Program Files\Autodesk\AutoCAD 2012 - English\acadficn.dll No File
CustomCLSID: HKU\S-1-5-21-3026445660-3059579512-81386765-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Renita\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File
Task: {85D2A057-ADCB-4967-A1F0-EE56185BFAC6} - \SymformServicesRestart No Task File <==== ATTENTION
AlternateDataStreams: C:\ProgramData\TEMP:E138854D
CMD: bitsadmin /reset /allusers
RemoveProxy:
EmptyTemp:
Reboot: 
end

Click File, Save As and type fixlist.txt as the File Name.

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

Right-click on icon and select Run as Administrator to start the tool.
> XP users click run after receipt of Windows Security Warning - Open File.
> 8 users will be prompted about Windows SmartScreen protection - click More information and Run.
Press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop, called Fixlog.txt.