Solved Computer Very Slow and Hanging Up

[Solved] Computer Very Slow and Hanging Up

Hi,
I posted this in the Vista section but was told to post it in this Malware and Virus Removal. This is what I said in the Vista Section.

Hi,
I brought home my friend's Vista Computer to try to get it running better as she can not afford to buy a new one right now.
She has told me that it takes at least 10 times for her to get the computer to start up, also it hangs up on various programs and it is very very slow.
I brought it home last night and have been trying to do a little cleaning with Windows security Essentials and Malware Bytes (no problems). When I ran Malware Bytes the first time it said I deleted 14 of 16 potential problems. I then ran it in Safe Mode and it only found one so now I am running it again.

I did take pictures of the Threats, such as:
PUP.Optional.Updater c:\users\Patricia\AppData\Roaming\UpdaterEX\Update Proc

I did supposedly delete this problem.

Then I looked at threads that were quarteened and deleted the following:
PUP.Optional.Amonetize-Registry Key
PUP.Optional.Amonetize-Registry Key
PUP.Optional.Amonetize-Registry Key
PUP.Optional.Updater-Folder
PUP.Optional DealPly-File

I just finished running the Malware-Bytes again in Safe Mode and it said no threats were detected but I am sure something is hiding in the background.

Please advise me what I should do to help my friend.

Thanks, Jean

OK now I will post the information from both the FRST and Addition texts:

FRST
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:05-03-2016 01
Ran by Patricia (administrator) on PATRICIA-PC (01-04-2016 15:04:06)
Running from C:\Users\Patricia\Desktop\jean
Loaded Profiles: Patricia (Available Profiles: Patricia)
Platform: Microsoft® Windows Vistaâ„¢ Home Premium Service Pack 2 (X86) Language: English (United States)
Internet Explorer Version 9 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(SupportSoft, Inc.) C:\Program Files\VERIZONDM\bin\sprtsvc.exe
(SupportSoft, Inc.) C:\Program Files\VERIZONDM\bin\tgsrvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(SigmaTel, Inc.) C:\Windows\sttray.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil32_21_0_0_197_ActiveX.exe
(Microsoft Corporation) C:\Windows\System32\RacAgent.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [] => [X]
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [986872 2016-01-29] (Microsoft Corporation)
HKLM\...\Run: [SigmatelSysTrayApp] => C:\Windows\sttray.exe [303104 2007-02-08] (SigmaTel, Inc.)
HKLM\...\RunOnce: [AvgUninstallURL] => cmd.exe /c start hxxp://www.avg.com/ww.special-uninstallation-feedback-appf?lic=NFVZOVgtTlNWVkwtTzRCWlEtUUlNQ0wtUVREQ0gtNElKTUg "& "inst=NzctNTg5NzE1MzM2LVQ0LVU4NSsxLUJBKzEtS1YzKzctWEwrMS1GUDkrNi1CQVI5R (the data entry has 119 more characters).
Winlogon\Notify\GoToAssist: C:\Program Files\Citrix\GoToAssist\480\G2AWinLogon.dll [X]
HKU\S-1-5-21-3093961477-3918382610-3448824889-1002\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-3093961477-3918382610-3448824889-1002\...\MountPoints2: {616d5547-d147-11db-8ce6-806e6f6e6963} - E:\install\PnpCheck.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{2475FFFD-53DB-4A60-8F84-21EA36D190EE}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKU\S-1-5-21-3093961477-3918382610-3448824889-1002\Software\Microsoft\Internet Explorer\Main,Old Start Page = hxxp://entertainment.verizon.com/news/
SearchScopes: HKU\.DEFAULT -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKU\S-1-5-21-3093961477-3918382610-3448824889-1002 -> {6CF1F009-EA2B-4F68-AA98-43C9CF795621} URL = hxxp://search.avg.com/route/?d=4da4c928&v=6.103.18.1&i=23&tp=chrome&q={searchTerms}&lng={language}&iy=&ychte=us
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-07-27] (Adobe Systems Incorporated)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-05-10] (Oracle Corporation)
BHO: CBrowserHelperObject Object -> {CA6319C0-31B7-401E-A518-A07C3DB8F777} -> C:\Program Files\BAE\BAE.dll [2006-11-17] (Dell Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-05-10] (Oracle Corporation)
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

FireFox:
========
FF ProfilePath: C:\Users\Patricia\AppData\Roaming\Mozilla\Firefox\Profiles\btur9qkk.default
FF DefaultSearchEngine.US: Google
FF Homepage: hxxp://www.google.com/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_21_0_0_197.dll [2016-03-24] ()
FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-05-10] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-05-10] (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2012-07-27] (Adobe Systems Inc.)
FF Extension: BeFrugal Coupons Add-On - C:\Users\Patricia\AppData\Roaming\Mozilla\Firefox\Profiles\btur9qkk.default\Extensions\shopcbtoolbar2@befrugal.com [2015-08-17]
FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi [2016-04-01] [not signed]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-09-02] [not signed]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 BrYNSvc; C:\Program Files\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.) [File not signed]
S4 DSBrokerService; C:\Program Files\DellSupport\brkrsvc.exe [70656 2006-11-07] () [File not signed]
S3 GoToAssist; C:\Program Files\Citrix\GoToAssist\480\g2aservice.exe [16936 2008-02-19] (Citrix Online, a division of Citrix Systems, Inc.)
S4 IDriverT; C:\Program Files\Roxio\Roxio MyDVD DE\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22216 2016-01-29] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [292816 2016-01-29] (Microsoft Corporation)
S4 RoxMediaDB9; C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe [880640 2006-11-05] (Sonic Solutions) [File not signed]
S4 RoxWatch9; C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe [159744 2006-11-05] (Sonic Solutions) [File not signed]
R2 sprtsvc_verizondm; C:\Program Files\VERIZONDM\bin\sprtsvc.exe [206120 2010-07-20] (SupportSoft, Inc.)
S4 stllssvr; C:\Program Files\Common Files\SureThing Shared\stllssvr.exe [73728 2006-09-14] (MicroVision Development, Inc.) [File not signed]
R2 tgsrvc_verizondm; C:\Program Files\VERIZONDM\bin\tgsrvc.exe [185640 2010-07-20] (SupportSoft, Inc.)
S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-19] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 DSproct; C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys [4736 2006-10-05] (Gteko Ltd.) [File not signed]
R2 dsunidrv; C:\Program Files\DellSupport\Drivers\dsunidrv.sys [7424 2006-08-17] (Gteko Ltd.) [File not signed]
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [253704 2015-11-13] (Microsoft Corporation)
R0 PxHelp20; C:\Windows\System32\Drivers\PxHelp20.sys [36528 2006-07-24] (Sonic Solutions) [File not signed]
R3 STHDA; C:\Windows\System32\drivers\stwrt.sys [647680 2007-02-08] (SigmaTel, Inc.)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-04-01 15:03 - 2016-04-01 15:04 - 00000000 ___DC C:\FRST
2016-04-01 15:01 - 2016-04-01 15:04 - 00000000 ____D C:\Users\Patricia\Desktop\jean
2016-04-01 15:01 - 2016-04-01 15:01 - 01725440 _____ (Farbar) C:\Users\Patricia\Desktop\FRST.exe
2016-04-01 14:57 - 2016-04-01 14:57 - 01725440 _____ (Farbar) C:\Users\Patricia\Documents\FRST.exe
2016-04-01 14:51 - 2016-04-01 14:51 - 01725440 _____ (Farbar) C:\Users\Patricia\Downloads\FRST.exe
2016-04-01 14:47 - 2016-04-01 14:47 - 00000104 _____ C:\Users\Patricia\Desktop\E-mail - Shortcut.lnk
2016-04-01 14:44 - 2016-04-01 14:44 - 00000000 ____D C:\Users\Patricia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
2016-04-01 14:41 - 2016-04-01 14:41 - 00000000 ____D C:\Program Files\Mozilla Firefox
2016-04-01 13:15 - 2016-04-01 13:15 - 06869352 _____ (Piriform Ltd) C:\Users\Patricia\Downloads\ccsetup516pro.exe
2016-04-01 11:19 - 2016-04-01 12:31 - 00170200 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-04-01 11:18 - 2016-04-01 11:18 - 00000901 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-04-01 11:18 - 2016-04-01 11:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-04-01 11:18 - 2016-04-01 11:18 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware
2016-04-01 11:18 - 2016-03-10 14:09 - 00053120 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-04-01 11:18 - 2016-03-10 14:08 - 00126336 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-04-01 11:18 - 2016-03-10 14:08 - 00024448 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-04-01 11:17 - 2016-04-01 11:17 - 22851472 _____ (Malwarebytes ) C:\Users\Patricia\Downloads\mbam-setup-2.2.1.1043.exe
2016-04-01 10:43 - 2016-04-01 10:43 - 22851472 _____ (Malwarebytes ) C:\Users\Patricia\Downloads\latest version.exe
2016-03-09 04:34 - 2016-02-19 17:34 - 01208776 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2016-03-09 04:34 - 2016-02-05 22:17 - 03609024 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2016-03-09 04:34 - 2016-02-05 22:17 - 03556800 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2016-03-09 04:34 - 2016-02-05 22:12 - 00783872 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2016-03-09 04:34 - 2016-02-05 22:11 - 00802304 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2016-03-09 04:34 - 2016-02-05 22:11 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2016-03-09 04:34 - 2016-02-05 20:32 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2016-03-09 04:33 - 2015-11-20 10:15 - 00922432 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00066400 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00022368 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00019808 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00016224 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00015712 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00015200 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00013664 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00013664 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00013664 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00011104 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00011104 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2016-03-09 04:32 - 2016-02-05 22:12 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\seclogon.dll
2016-03-09 04:32 - 2016-02-05 22:11 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2016-03-09 04:32 - 2016-02-05 20:33 - 00297472 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2016-03-09 04:31 - 2016-02-02 11:30 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS
2016-03-09 04:29 - 2016-02-03 13:06 - 00564736 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2016-03-09 04:29 - 2016-02-03 13:06 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\olepro32.dll
2016-03-09 04:29 - 2016-02-03 13:05 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\asycfilt.dll
2016-03-09 04:03 - 2016-02-04 11:25 - 02068992 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-03-08 21:16 - 2016-02-08 20:17 - 01815552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-03-08 21:16 - 2016-02-08 20:12 - 01140224 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-03-08 21:16 - 2016-02-08 20:11 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-03-08 21:16 - 2016-02-08 20:10 - 01804800 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-03-08 21:16 - 2016-02-08 20:10 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-03-08 21:16 - 2016-02-08 20:10 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-03-08 21:16 - 2016-02-08 20:10 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-03-08 21:16 - 2016-02-08 20:10 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2016-03-08 21:16 - 2016-02-08 20:10 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2016-03-08 21:16 - 2016-02-08 20:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2016-03-08 21:16 - 2016-02-08 20:09 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2016-03-08 21:16 - 2016-02-08 20:09 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-03-08 21:16 - 2016-02-08 20:09 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2016-03-08 21:16 - 2016-02-08 20:09 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2016-03-08 21:16 - 2016-02-08 20:09 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2016-03-08 21:16 - 2016-02-08 20:09 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2016-03-08 21:16 - 2016-02-08 20:09 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2016-03-08 21:15 - 2016-02-08 20:15 - 12392960 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-03-08 21:15 - 2016-02-08 20:13 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2016-03-08 21:15 - 2016-02-08 20:12 - 09753600 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-03-08 21:15 - 2016-02-08 20:09 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2016-03-08 21:15 - 2016-02-08 20:09 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2016-03-08 20:55 - 2016-03-08 20:55 - 00000000 ____D C:\e7ff8178703db26a6663decbdbafd0b4
2016-03-04 08:31 - 2016-03-04 08:31 - 00000000 ___DC C:\67025d12f6c47c8f4a03a04d4c12e91e

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-04-01 14:51 - 2006-11-02 08:47 - 00003568 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2016-04-01 14:51 - 2006-11-02 08:47 - 00003568 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2016-04-01 14:44 - 2013-10-13 11:50 - 00001059 _____ C:\Users\Patricia\Desktop\Revo Uninstaller.lnk
2016-04-01 14:44 - 2013-10-13 11:50 - 00000000 ____D C:\Program Files\VS Revo Group
2016-04-01 14:41 - 2015-05-31 11:46 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2016-04-01 14:38 - 2012-04-04 16:50 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-04-01 13:42 - 2006-11-02 09:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-04-01 13:36 - 2006-11-10 09:22 - 00000000 ____D C:\Windows\Panther
2016-04-01 13:36 - 2006-11-02 07:18 - 00000000 ____D C:\Windows\inf
2016-04-01 13:25 - 2006-11-02 09:01 - 00032618 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2016-04-01 13:10 - 2009-02-12 13:13 - 00000000 ____D C:\Users\Patricia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CleanUp!
2016-04-01 13:10 - 2009-02-12 13:12 - 00000000 ____D C:\Program Files\CleanUp!
2016-04-01 13:00 - 2014-04-27 11:33 - 00000000 ____D C:\Users\Patricia\AppData\Roaming\UpdaterEX
2016-04-01 12:19 - 2009-02-12 12:58 - 00002595 _____ C:\Users\Patricia\Desktop\Microsoft Word.lnk
2016-04-01 10:11 - 2010-10-29 16:45 - 00000000 ____D C:\Users\Patricia\AppData\Roaming\Malwarebytes
2016-03-31 20:22 - 2015-02-06 18:26 - 00000000 ____D C:\found.000
2016-03-31 20:21 - 2010-10-29 17:08 - 00000000 ____D C:\Windows\Minidump
2016-03-24 00:30 - 2012-04-04 16:50 - 00797376 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2016-03-24 00:30 - 2011-05-17 23:54 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2016-03-20 13:34 - 2007-03-13 06:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell Games
2016-03-20 13:32 - 2007-03-13 06:05 - 00000000 ____D C:\ProgramData\WildTangent
2016-03-15 17:41 - 2006-11-02 06:33 - 00772030 _____ C:\Windows\system32\PerfStringBackup.INI
2016-03-09 05:24 - 2006-11-02 07:18 - 00000000 ____D C:\Windows\rescache
2016-03-09 04:57 - 2006-11-02 08:47 - 00389528 _____ C:\Windows\system32\FNTCACHE.DAT
2016-03-09 04:53 - 2006-11-02 08:37 - 00000000 ____D C:\Windows\system32\XPSViewer
2016-03-09 04:53 - 2006-11-02 07:18 - 00000000 ____D C:\Program Files\Common Files\System
2016-03-09 04:24 - 2013-08-15 07:10 - 00000000 ____D C:\Windows\system32\MRT
2016-03-09 04:08 - 2006-11-02 06:24 - 141270216 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

==================== Files in the root of some directories =======

2011-04-18 19:39 - 2011-04-18 19:39 - 0031007 _____ () C:\Users\Patricia\AppData\Roaming\UserTile.png
2014-04-27 11:33 - 2014-04-28 06:34 - 0000085 _____ () C:\Users\Patricia\AppData\Roaming\WB.CFG
2007-03-19 11:29 - 2009-02-09 17:49 - 0045910 _____ () C:\Users\Patricia\AppData\Roaming\wklnhst.dat
2014-11-23 15:02 - 2015-05-10 10:29 - 0000680 _____ () C:\Users\Patricia\AppData\Local\d3d9caps.dat
2007-03-19 10:53 - 2011-04-19 00:04 - 0025600 _____ () C:\Users\Patricia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2007-03-19 10:47 - 2007-03-19 10:47 - 0000096 _____ () C:\Users\Patricia\AppData\Local\fusioncache.dat
2012-07-15 19:53 - 2012-07-19 19:35 - 0000792 _____ () C:\Users\Patricia\AppData\Local\RAExpertHistory.xml

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-04-01 14:08

==================== End of FRST.txt ============================

Addition
Additional scan result of Farbar Recovery Scan Tool (x86) Version:05-03-2016 01
Ran by Patricia (2016-04-01 15:07:02)
Running from C:\Users\Patricia\Desktop\jean
Microsoft® Windows Vistaâ„¢ Home Premium Service Pack 2 (X86) (2007-03-13 09:47:08)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3093961477-3918382610-3448824889-500 - Administrator - Disabled)
ASPNET (S-1-5-21-3093961477-3918382610-3448824889-1001 - Limited - Enabled)
Guest (S-1-5-21-3093961477-3918382610-3448824889-501 - Limited - Disabled)
Patricia (S-1-5-21-3093961477-3918382610-3448824889-1002 - Administrator - Enabled) => C:\Users\Patricia

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {768124D7-F5F7-6D2F-DDC2-94DFA4017C95}
AS: Microsoft Security Essentials (Enabled - Up to date) {CDE0C533-D3CD-62A1-E772-AFADDF863628}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Acrobat.com (Version: 0.0.0 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 21 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 21.0.0.197 - Adobe Systems Incorporated)
Adobe Flash Player 21 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 21.0.0.197 - Adobe Systems Incorporated)
Adobe Reader X (10.1.4) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.4 - Adobe Systems Incorporated)
ATI Catalyst Control Center Ex (HKLM\...\{F08F36A8-7EEA-DB4D-00D1-2CA68C2DD445}) (Version: 2.0.2488.36465 - ATI Technologies Inc.)
Banctec Service Agreement (HKLM\...\{4B9F45E8-E3CE-40B4-9463-80A9B3481DEF}) (Version: 1.11.0000 - Dell)
CleanUp! (HKLM\...\CleanUp!) (Version: - )
Compatibility Pack for the 2007 Office system (HKLM\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Conexant D850 PCI V.92 Modem (HKLM\...\CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200F14F1) (Version: - )
Dell System Customization Wizard (HKLM\...\{13BA7B44-B712-4DEE-A7B8-1DD564F37AE5}) (Version: 1.00.0000 - Dell Inc.)
DellSupport (HKLM\...\{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}) (Version: 6.0.3030 - Dell)
Digital Line Detect (HKLM\...\{E646DCF0-5A68-11D5-B229-002078017FBF}) (Version: 1.20 - BVRP Software, Inc)
Documentation & Support Launcher (HKLM\...\{89CEAE14-DD0F-448E-9554-15781EC9DB24}) (Version: 1.00.0000 - Dell Inc.)
Dreams Working Interactive (HKLM\...\ST6UNST #1) (Version: - )
EasyCleaner (HKLM\...\{F5346614-B7C4-4E94-826A-E2363155233D}) (Version: 2.0.6.380 - ToniArts)
Expert Tarot Card (HKLM\...\xtarot32DeinstKey) (Version: - )
Four Pillars & Feng Shui (HKU\S-1-5-21-3093961477-3918382610-3448824889-1002\...\Four Pillars & Feng Shui) (Version: - )
Games, Music, & Photos Launcher (HKLM\...\{3E25E350-949F-4DB7-8288-2A60E018B4C1}) (Version: 1.00.0000 - Dell Inc.)
GoToAssist 8.0.0.480 (HKLM\...\GoToAssist) (Version: - )
HiDef Media Player 1.1.12 (HKLM\...\HiDef Media Player) (Version: 1.1.12 - HiDefMedia)
HL-2270DW (HKLM\...\{E2A97415-BD97-4867-B906-05E39E9EE51F}) (Version: 1.0.7.0 - Brother Industries, Ltd.)
Internet Service Offers Launcher (HKLM\...\{CCFF1E13-77A2-4032-8B12-7566982A27DF}) (Version: 1.00.0000 - Dell Inc.)
Macromedia Shockwave Player (HKLM\...\Macromedia Shockwave Player) (Version: - )
Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Microsoft .NET Framework 1.1 (HKLM\...\Microsoft .NET Framework 1.1 (1033)) (Version: - )
Microsoft .NET Framework 1.1 Security Update (KB2698023) (HKLM\...\M2698023) (Version: - )
Microsoft .NET Framework 1.1 Security Update (KB2833941) (HKLM\...\M2833941) (Version: - )
Microsoft .NET Framework 1.1 Security Update (KB979906) (HKLM\...\M979906) (Version: - )
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2000 Professional (HKLM\...\{00010409-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2720 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.9.218.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Word 2002 (HKLM\...\{911B0409-6000-11D3-8CFE-0050048383C9}) (Version: 10.0.6626.0 - Microsoft Corporation)
Microsoft Works 2002 Setup Launcher (HKLM\...\Works2002Setup) (Version: - )
Microsoft Works 6.0 (HKLM\...\{A1B7B9B3-E1D2-41CA-9B4A-F18DC2710704}) (Version: 06.00.0000 - Microsoft Corporation)
Microsoft Works Suite Add-in for Microsoft Word (HKLM\...\{C3A439E4-7303-491F-A678-CEA36A87D517}) (Version: 2.0.0.0000 - Microsoft Corporation)
Modem Diagnostic Tool (HKLM\...\{F63A3748-B93D-4360-9AD4-B064481A5C7B}) (Version: 1.0.17.8 - Dell)
Mozilla Firefox 45.0.1 (x86 en-US) (HKLM\...\Mozilla Firefox 45.0.1 (x86 en-US)) (Version: 45.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 45.0.1.5918 - Mozilla)
MSXML 4.0 SP2 (KB927978) (HKLM\...\{37477865-A3F1-4772-AD43-AAFC6BCFF99F}) (Version: 4.20.9841.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB936181) (HKLM\...\{C04E32E0-0416-434D-AFB9-6969D703A9EF}) (Version: 4.20.9848.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB941833) (HKLM\...\{C523D256-313D-4866-B36A-F3DE528246EF}) (Version: 4.20.9849.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
NetWaiting (HKLM\...\{3F92ABBB-6BBF-11D5-B229-002078017FBF}) (Version: 2.5.41 - BVRP Software, Inc)
Oracle 32 (HKLM\...\Oracle 32) (Version: - )
Revo Uninstaller 1.50 (HKLM\...\Revo Uninstaller) (Version: 1.50 - VS Revo Group)
Roxio Creator Audio (HKLM\...\{83FFCFC7-88C6-41c6-8752-958A45325C82}) (Version: 3.3.0 - Roxio)
Roxio Creator BDAV Plugin (HKLM\...\{880AF49C-34F7-4285-A8AD-8F7A3D1C33DC}) (Version: 3.3.0 - Roxio)
Roxio Creator Copy (HKLM\...\{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}) (Version: 3.3.0 - Roxio)
Roxio Creator Data (HKLM\...\{0D397393-9B50-4c52-84D5-77E344289F87}) (Version: 3.3.0 - Roxio)
Roxio Creator DE (HKLM\...\{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}) (Version: 3.3.0 - Roxio)
Roxio Creator Tools (HKLM\...\{0394CDC8-FABD-4ed8-B104-03393876DFDF}) (Version: 3.3.0 - Roxio)
Roxio Drag-to-Disc (HKLM\...\{2F4C24E6-CBD4-4AAC-B56F-C9FD44DE5668}) (Version: 9.0 - Roxio)
Roxio Express Labeler (HKLM\...\{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}) (Version: 2.1.0 - Roxio)
Roxio MyDVD DE (HKLM\...\{D639085F-4B6E-4105-9F37-A0DBB023E2FB}) (Version: 9.0.116 - Roxio, Inc.)
Roxio Update Manager (HKLM\...\{30465B6C-B53F-49A1-9EBA-A3F187AD502E}) (Version: 3.0.0 - Roxio)
SigmaTel Audio (HKLM\...\{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}) (Version: 5.10.5102.0 - SigmaTel)
Sonic Activation Module (Version: 1.0 - Sonic Solutions) Hidden
Spelling Dictionaries Support For Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
URL Assistant (HKLM\...\{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}) (Version: - )
User's Guides (HKLM\...\{5CD29180-A95E-11D3-A4EB-00C04F7BDB2C}) (Version: - )
Verizon Download Manager (HKLM\...\{CCD35D5A-7B97-46E0-AB2E-21C59BA253B6}) (Version: 1.0.0 - Verizon)
Vz In Home Agent (HKLM\...\{2746B4DE-A2EE-4B33-A7CE-B33BAD5EF6FE}) (Version: 7.08.22 - Verizon)
Works Suite OS Pack (Version: 1.0.0.0000 - Microsoft Corporation) Hidden
Works Synchronization (Version: 1.0.0.0000 - Your Company Name) Hidden
Works Upgrade (Version: 8.0.0.0000 - Microsoft Corporation) Hidden

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-3093961477-3918382610-3448824889-1002_Classes\CLSID\{b2b568c8-3712-4a75-b806-4b3c2fdb06d5}\localserver32 -> no filepath

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0B19D3FF-D22E-4AAD-8ACC-50E0B3DC62A3} - System32\Tasks\Secunia PSI Logon Task => C:\Program Files\Secunia\PSI\psi.exe
Task: {2EB6777E-D544-4656-987F-CBBAB2821B47} - System32\Tasks\Microsoft\Windows\RestartManager\{96061901-2D53-4e6b-926D-63155BC76274} => C:\Windows\system32\rmclient.exe [2006-11-02] (Microsoft Corporation)
Task: {B45CB1D9-5441-4BCC-AC20-B8A03D8263D8} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2016-03-24] (Adobe Systems Incorporated)
Task: {C8A54FF6-2945-4024-B1D4-B8929649EB7F} - System32\Tasks\{11C4B5CD-E762-4C7D-8DCD-C4E65F1F3A52} => pcalua.exe -a "E:\ALL DOCUMENTS\SETUP.EXE" -d "E:\ALL DOCUMENTS "

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2007-03-27 12:33 - 2006-10-26 16:21 - 00056056 _____ () C:\Windows\system32\DLAAPI_W.DLL
2007-03-13 13:37 - 2006-10-25 00:44 - 00159744 _____ () C:\Windows\system32\atitmmxx.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\Patricia\Desktop\Pleasure of Tarot - Lessons:Roxio EMC Stream [38]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 06:23 - 2006-09-18 17:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1 localhost
::1 localhost

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3093961477-3918382610-3448824889-1002\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 2) (ConsentPromptBehaviorUser: 1) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: Ati External Event Utility => 2
MSCONFIG\Services: DSBrokerService => 3
MSCONFIG\Services: GoToAssist => 3
MSCONFIG\Services: IDriverT => 3
MSCONFIG\Services: RoxMediaDB9 => 3
MSCONFIG\Services: RoxWatch9 => 2
MSCONFIG\Services: STacSV => 2
MSCONFIG\Services: stllssvr => 3
MSCONFIG\Services: XAudioService => 2
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk => C:\Windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Digital Line Detect.lnk => C:\Windows\pss\Digital Line Detect.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk => C:\Windows\pss\Microsoft Office.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk => C:\Windows\pss\Microsoft Works Calendar Reminders.lnk.CommonStartup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
MSCONFIG\startupreg: ATICCC => "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe "
MSCONFIG\startupreg: Corel Photo Downloader => C:\Program Files\Corel\Corel Snapfire Plus\PhotoDownloader.exe
MSCONFIG\startupreg: DellSupport => "C:\Program Files\DellSupport\DSAgnt.exe" /startup
MSCONFIG\startupreg: ECenter => c:\dell\E-Center\EULALauncher.exe
MSCONFIG\startupreg: ISUSPM Startup => C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
MSCONFIG\startupreg: ISUSScheduler => "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
MSCONFIG\startupreg: Microsoft Works Portfolio => C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
MSCONFIG\startupreg: Microsoft Works Update Detection => C:\Program Files\Microsoft Works\WkDetect.exe
MSCONFIG\startupreg: RoxWatchTray => "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe "
MSCONFIG\startupreg: Sidebar => C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
MSCONFIG\startupreg: VERIZONDM => "C:\Program Files\VERIZONDM\bin\sprtcmd.exe" /P VERIZONDM
MSCONFIG\startupreg: Windows Defender => %ProgramFiles%\Windows Defender\MSASCui.exe -hide
MSCONFIG\startupreg: WMPNSCFG => C:\Program Files\Windows Media Player\WMPNSCFG.exe
MSCONFIG\startupreg: WorksFUD => C:\Program Files\Microsoft Works\wkfud.exe

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [WinCollab-DFSR-In-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
FirewallRules: [WinCollab-DFSR-Out-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
FirewallRules: [WinCollab-In-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-Out-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-In-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-Out-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [TCP Query User{3F97E2F9-C74E-4373-9516-634E4F34B8B7}C:\program files\internet explorer\iexplore.exe] => (Allow) C:\program files\internet explorer\iexplore.exe
FirewallRules: [UDP Query User{1E3D2045-E0A9-4690-8F19-D5D4E2C93E58}C:\program files\internet explorer\iexplore.exe] => (Allow) C:\program files\internet explorer\iexplore.exe
FirewallRules: [TCP Query User{370E31CB-4B20-4093-98A8-974307442367}F:\techwizard.exe] => (Allow) F:\techwizard.exe
FirewallRules: [UDP Query User{E86AF728-3D5B-448C-BB8E-942FB9F21E53}F:\techwizard.exe] => (Allow) F:\techwizard.exe
FirewallRules: [{9452BCBA-41B5-481B-B092-85F2BE73B9A0}] => (Allow) LPort=80
FirewallRules: [{FB67CAA6-36E6-432C-B70C-91F0828C0317}] => (Allow) LPort=80
FirewallRules: [{0239D7EE-9228-4163-A1FC-7E48AFFC29D8}] => (Allow) LPort=80
FirewallRules: [{2FD45197-32F5-492D-AB71-56F031A896E4}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [{44905157-C518-4E2A-BECB-20B243B60918}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{F6823AED-6D11-4DE3-8B8A-AD67C0356CC5}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{3E100883-9578-4412-AF7A-67ECBE6462EE}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{ABAE8FA6-7DD9-40D9-9A4B-6CD13BEEB5A2}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe

==================== Restore Points =========================

26-03-2016 02:33:21 Scheduled Checkpoint
27-03-2016 02:04:02 Scheduled Checkpoint
28-03-2016 21:25:20 Windows Update
30-03-2016 01:54:49 Scheduled Checkpoint
31-03-2016 01:21:24 Scheduled Checkpoint
31-03-2016 18:36:15 Scheduled Checkpoint
01-04-2016 10:48:16 Revo Uninstaller's restore point - Malwarebytes Anti-Malware version 1.75.0.1300
01-04-2016 14:45:13 Revo Uninstaller's restore point - CCleaner

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (04/01/2016 02:45:11 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005.
This is often caused by incorrect security settings in either the writer or requestor process.


Operation:
Gathering Writer Data

Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {ec5c5d50-ea00-49e5-8d5b-d06956fd6eca}

Error: (04/01/2016 01:42:39 PM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: The application cannot be initialized.

Context: Windows Application

Details:
The content index metadata cannot be read. (0xc0041801)

Error: (04/01/2016 01:42:39 PM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: The gatherer object cannot be initialized.

Context: Windows Application, SystemIndex Catalog

Details:
The content index metadata cannot be read. (0xc0041801)

Error: (04/01/2016 01:42:39 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: The plug-in in <Search.TripoliIndexer> cannot be initialized.

Context: Windows Application, SystemIndex Catalog

Details:
Element not found. (0x80070490)

Error: (04/01/2016 01:42:35 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: The plug-in in <Search.JetPropStore> cannot be initialized.

Context: Windows Application, SystemIndex Catalog

Details:
The content index metadata cannot be read. (0xc0041801)

Error: (04/01/2016 01:42:35 PM) (Source: Windows Search Service) (EventID: 9002) (User: )
Description: The Windows Search Service cannot load the property store information.

Context: Windows Application, SystemIndex Catalog

Details:
0x%08x (0x8004117f - The content index server cannot update or access information because of a database error. Stop and restart the search service. If the problem persists, reset and recrawl the content index. In some cases it may be necessary to delete and recreate the content index. )

Error: (04/01/2016 01:42:34 PM) (Source: Windows Search Service) (EventID: 9000) (User: )
Description: The Windows Search Service cannot open the Jet property store.

Details:
0x%08x (0x8004117f - The content index server cannot update or access information because of a database error. Stop and restart the search service. If the problem persists, reset and recrawl the content index. In some cases it may be necessary to delete and recreate the content index. )

Error: (04/01/2016 01:40:24 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Failed to create restore point on volume (Process = C:\Users\Patricia\Desktop\New Clean Up\EClea2_0.exe -deleter ; Descripton = Configured EasyCleaner; Hr = 0x8007043c).

Error: (04/01/2016 01:27:40 PM) (Source: EventSystem) (EventID: 4609) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c

Error: (04/01/2016 01:11:16 PM) (Source: EventSystem) (EventID: 4609) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c


System errors:
=============
Error: (04/01/2016 01:43:53 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Windows Search1300001Restart the service

Error: (04/01/2016 01:43:53 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Windows Search2147749155 (0x80040D23)

Error: (04/01/2016 01:42:13 PM) (Source: Microsoft-Windows-TaskScheduler) (EventID: 412) (User: NT AUTHORITY)
Description: 2147942402

Error: (04/01/2016 01:39:12 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1084MSIServer{000C101C-0000-0000-C000-000000000046}

Error: (04/01/2016 01:28:48 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Network List ServiceNetwork Location Awareness%%1068

Error: (04/01/2016 01:28:48 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Network List ServiceNetwork Location Awareness%%1068

Error: (04/01/2016 01:28:48 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Network List ServiceNetwork Location Awareness%%1068

Error: (04/01/2016 01:28:48 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Network List ServiceNetwork Location Awareness%%1068

Error: (04/01/2016 01:28:48 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: AFD
DfsC
MpFilter
NetBIOS
netbt
nsiproxy
PSched
RasAcd
rdbss
Smb
spldr
tdx
Wanarpv6

Error: (04/01/2016 01:28:48 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Network List ServiceNetwork Location Awareness%%1068


CodeIntegrity:
===================================
Date: 2016-04-01 15:06:38.909
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-04-01 15:06:37.629
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-04-01 15:06:36.319
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-04-01 15:06:35.024
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-04-01 15:06:33.059
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-04-01 15:06:31.764
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-04-01 15:06:30.485
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-04-01 15:06:29.190
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-04-01 13:01:51.797
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-04-01 13:01:50.659
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 3800+
Percentage of memory in use: 87%
Total physical RAM: 1021.76 MB
Available physical RAM: 129.15 MB
Total Virtual: 2308.1 MB
Available Virtual: 1098.95 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:138.96 GB) (Free:83.94 GB) NTFS ==>[drive with boot components (obtained from BCD)]
Drive d: (RECOVERY) (Fixed) (Total:10 GB) (Free:5.19 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 149 GB) (Disk ID: 50000000)
Partition 1: (Not Active) - (Size=55 MB) - (Type=DE)
Partition 2: (Not Active) - (Size=10 GB) - (Type=07 NTFS)
Partition 3: (Active) - (Size=139 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

Thanks for your help.

 

I just want you to know I am trying to run Rogue Killer but having a bad time. The computer is just so slow and hangs up. I'll post again when I get your instructions finished.

Jean

 

I finally got the rogue.exe to start after I named it as you said. It found 5 entries that I deleted and here is the report. Now I will start Malware Bytes.

RogueKiller V12.0.3.0 [Mar 21 2016] (Free) by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/software/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Started in : Normal mode
User : Patricia [Administrator]
Started from : C:\Users\Patricia\Desktop\jean\winlogon.exe
Mode : Delete -- Date : 04/02/2016 09:59:34

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 4 ¤¤¤
[PUP] HKEY_LOCAL_MACHINE\Software\SpeedBit -> Deleted
[Hj.RegVal] HKEY_LOCAL_MACHINE\RK_Software_ON_D_10F0\Microsoft\Windows NT\CurrentVersion\Winlogon | Shell : cmd.exe /k start cmd.exe -> Replaced (explorer.exe)
[PUM.Proxy] HKEY_LOCAL_MACHINE\RK_System_ON_D_BD56\ControlSet001\Services\NlaSvc\Parameters\Internet\ManualProxies | (default) : -> Deleted
[PUM.StartMenu] HKEY_USERS\S-1-5-21-3093961477-3918382610-3448824889-1002\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowPrinters : 0 -> Replaced (1)

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

¤¤¤ Web browsers : 1 ¤¤¤
[PUP][FIREFX:Addon] btur9qkk.default : BeFrugal Coupons Add-On [shopcbtoolbar2@befrugal.com] -> Deleted

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: ST316081 2AS SCSI Disk Device +++++
--- User ---
[MBR] b6df8d9fe137da498a282327b23fc053
[BSP] e5ecab62487d0dea97643843967a883e : HP MBR Code
Partition table:
0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 54 MB
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 112640 | Size: 10240 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
2 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 21084160 | Size: 142291 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
Error reading LL2 MBR! ([1] Incorrect function. )

+++++ PhysicalDrive1: LEXAR JUMPDRIVE USB Device +++++
--- User ---
[MBR] 2701f4ea6a27a524b3af4ce3fd8a96a1
[BSP] 34f027b5dd288de55b6aae963cd44baf : Unknown|VT.Unknown MBR Code
Partition table:
0 - [ACTIVE] FAT16 (0x6) [VISIBLE] Offset (sectors): 32 | Size: 122 MB
User = LL1 ... OK
Error reading LL2 MBR! ([32] The request is not supported. )

 

OK, this is what I found:
There were NO threats in Malwarebytes so no log.

I ran AdwCleaner and the following is the contents of the .txt file:
# AdwCleaner v5.108 - Logfile created 02/04/2016 at 10:41:49
# Updated 30/03/2016 by Xplode
# Database : 2016-03-30.1 [Server]
# Operating system : Windows Vista (TM) Home Premium Service Pack 2 (x86)
# Username : Patricia - PATRICIA-PC
# Running from : C:\Users\Patricia\Desktop\jean\adwcleaner_5.108.exe
# Option : Scan
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****

Folder Found : C:\Program Files\HiDefMedia
Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HiDefMedia
Folder Found : C:\Users\Patricia\AppData\LocalLow\AVG Security Toolbar
Folder Found : C:\Users\Patricia\AppData\Roaming\UpdaterEX

***** [ Files ] *****

File Found : C:\END
File Found : C:\Users\Patricia\Documents\ELECTIONAL ASTROLOGY FOR MARRIAGE RULES.doc
File Found : C:\Users\Patricia\Documents\Electional Astrology Rules for SURGERY.doc
File Found : C:\Users\Public\Desktop\HiDef Media Player.lnk

***** [ DLL ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}
Key Found : HKCU\Software\SpeedBit
Key Found : HKCU\Software\UpdaterEX
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\UpdaterEX
Key Found : HKU\S-1-5-21-3093961477-3918382610-3448824889-1002\Software\SpeedBit
Key Found : HKU\S-1-5-21-3093961477-3918382610-3448824889-1002\Software\UpdaterEX
Key Found : HKU\S-1-5-21-3093961477-3918382610-3448824889-1002\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\UpdaterEX
Key Found : HKCU\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3093961477-3918382610-3448824889-1002\Software\AVG Security Toolbar
Key Found : HKCU\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3093961477-3918382610-3448824889-1002\Software\BEFRUGAL
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6CF1F009-EA2B-4F68-AA98-43C9CF795621}
Key Found : HKU\S-1-5-21-3093961477-3918382610-3448824889-1002\Software\Microsoft\Internet Explorer\SearchScopes\{6CF1F009-EA2B-4F68-AA98-43C9CF795621}

***** [ Web browsers ] *****


*************************

C:\AdwCleaner\AdwCleaner[S1].txt - [2422 bytes] - [02/04/2016 10:41:49]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [2495 bytes] ##########


I ran the Junkware Removal Tool and here is the text file:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.4 (03.14.2016)
Operating System: Windows Vista (TM) Home Premium x86
Ran by Patricia (Administrator) on Sat 04/02/2016 at 10:48:55.71
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 23

Successfully deleted: C:\end (File)
Successfully deleted: C:\ProgramData\Start Menu\Programs\hidefmedia (Folder)
Successfully deleted: C:\Users\Patricia\Appdata\LocalLow\avg security toolbar (Folder)
Successfully deleted: C:\Users\Patricia\AppData\Roaming\updaterex (Folder)
Successfully deleted: C:\Users\Public\Desktop\hidef media player.lnk (Shortcut)
Successfully deleted: C:\Windows\wininit.ini (File)
Successfully deleted: C:\Program Files\hidefmedia (Folder)
Successfully deleted: C:\Users\Patricia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\054J2ZSS (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Patricia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0ZAO3G78 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Patricia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3UU22LI0 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Patricia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\443BSHSW (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Patricia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5740A3LJ (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Patricia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\91VQP98G (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Patricia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B2MPTX04 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Patricia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LWR89DFT (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\054J2ZSS (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0ZAO3G78 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3UU22LI0 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\443BSHSW (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5740A3LJ (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\91VQP98G (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B2MPTX04 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LWR89DFT (Temporary Internet Files Folder)



Registry: 2

Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6CF1F009-EA2B-4F68-AA98-43C9CF795621} (Registry Key)
Successfully deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA6319C0-31B7-401E-A518-A07C3DB8F777} (Registry Key)




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sat 04/02/2016 at 10:51:32.72
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Please let me know what the next step is. Thank you so much.
Jean

 

OK I was able to run both rKill.txt and Combofix.txt. I hope you can figure out if there is a problem or if this computer just lacks memory. It is slow yet but not as bad. Thank you again.

Combofix
ComboFix 16-04-01.01 - Patricia 04/02/2016 17:04:03.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1022.453 [GMT -4:00]
Running from: c:\users\Patricia\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {768124D7-F5F7-6D2F-DDC2-94DFA4017C95}
SP: Microsoft Security Essentials *Disabled/Updated* {CDE0C533-D3CD-62A1-E772-AFADDF863628}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Patricia\GoToAssistDownloadHelper.exe
.
.
((((((((((((((((((((((((( Files Created from 2016-03-02 to 2016-04-02 )))))))))))))))))))))))))))))))
.
.
2016-04-02 21:12 . 2016-04-02 21:12 -------- d-----w- c:\users\Patricia\AppData\Local\temp
2016-04-02 21:12 . 2016-04-02 21:12 -------- d-----w- c:\users\Default\AppData\Local\temp
2016-04-02 20:53 . 2016-04-02 20:53 62576 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{42093198-4C98-417B-B10A-8DCA3AD3F74F}\offreg.976.dll
2016-04-02 15:08 . 2016-03-17 01:50 9302992 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{42093198-4C98-417B-B10A-8DCA3AD3F74F}\mpengine.dll
2016-04-02 14:56 . 2016-03-28 16:07 9302992 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{07872F6C-1D97-4370-A1B7-9DE9E8AA6DDD}\mpengine.dll
2016-04-02 14:41 . 2016-04-02 14:41 -------- dc----w- C:\AdwCleaner
2016-04-02 14:03 . 2016-04-02 14:03 13298 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\LocalCopy\{88C4D8D4-2A87-6431-03EA-C51A3E19DA42}-rpc_shindig_random[1].js
2016-04-02 11:10 . 2016-04-02 13:04 24688 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2016-04-02 11:09 . 2016-04-02 11:22 -------- d-----w- c:\programdata\RogueKiller
2016-04-01 19:03 . 2016-04-01 19:08 -------- dc----w- C:\FRST
2016-04-01 15:19 . 2016-04-02 14:08 170200 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2016-04-01 15:18 . 2016-03-10 18:08 126336 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2016-04-01 15:18 . 2016-04-01 15:18 -------- d-----w- c:\program files\Malwarebytes Anti-Malware
2016-04-01 15:18 . 2016-03-10 18:09 53120 ----a-w- c:\windows\system32\drivers\mwac.sys
2016-04-01 15:18 . 2016-03-10 18:08 24448 ----a-w- c:\windows\system32\drivers\mbam.sys
2016-03-31 21:50 . 2016-03-17 01:50 9302992 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2016-03-22 22:16 . 2015-06-24 19:00 912000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{81D3BD4C-12D2-4312-9138-A38D3023F83C}\gapaengine.dll
2016-03-09 08:34 . 2016-02-06 02:11 802304 ----a-w- c:\windows\system32\advapi32.dll
2016-03-09 08:34 . 2016-02-19 21:34 1208776 ----a-w- c:\windows\system32\ntdll.dll
2016-03-09 08:34 . 2016-02-06 02:12 783872 ----a-w- c:\windows\system32\rpcrt4.dll
2016-03-09 08:34 . 2016-02-06 02:11 49664 ----a-w- c:\windows\system32\csrsrv.dll
2016-03-09 08:34 . 2016-02-06 00:32 64000 ----a-w- c:\windows\system32\smss.exe
2016-03-09 08:34 . 2016-02-06 02:17 3609024 ----a-w- c:\windows\system32\ntkrnlpa.exe
2016-03-09 08:34 . 2016-02-06 02:17 3556800 ----a-w- c:\windows\system32\ntoskrnl.exe
2016-03-09 08:32 . 2016-02-06 02:12 19968 ----a-w- c:\windows\system32\seclogon.dll
2016-03-09 08:32 . 2016-02-06 02:11 34304 ----a-w- c:\windows\system32\atmlib.dll
2016-03-09 08:32 . 2016-02-06 00:33 297472 ----a-w- c:\windows\system32\atmfd.dll
2016-03-09 08:30 . 2016-02-06 02:12 41984 ----a-w- c:\program files\Windows Mail\wabimp.dll
2016-03-09 08:30 . 2016-02-06 02:12 33280 ----a-w- c:\program files\Windows Mail\wabfind.dll
2016-03-09 08:30 . 2016-02-06 00:37 65536 ----a-w- c:\program files\Windows Mail\wabmig.exe
2016-03-09 08:30 . 2016-02-06 02:12 707584 ----a-w- c:\program files\Common Files\System\wab32.dll
2016-03-09 08:30 . 2016-02-06 00:37 515584 ----a-w- c:\program files\Windows Mail\wab.exe
2016-03-09 08:29 . 2016-02-03 17:06 89600 ----a-w- c:\windows\system32\olepro32.dll
2016-03-09 08:29 . 2016-02-03 17:05 67072 ----a-w- c:\windows\system32\asycfilt.dll
2016-03-09 08:29 . 2016-02-03 17:06 564736 ----a-w- c:\windows\system32\oleaut32.dll
2016-03-09 08:03 . 2016-02-04 15:25 2068992 ----a-w- c:\windows\system32\win32k.sys
2016-03-09 01:15 . 2016-02-09 00:13 367616 ----a-w- c:\windows\system32\html.iec
2016-03-09 01:15 . 2016-02-09 00:10 768512 ----a-w- c:\program files\Common Files\Microsoft Shared\vgx\VGX.dll
2016-03-09 00:55 . 2016-03-09 00:55 -------- d-----w- C:\e7ff8178703db26a6663decbdbafd0b4
2016-03-04 12:31 . 2016-03-04 12:31 -------- dc----w- C:\67025d12f6c47c8f4a03a04d4c12e91e
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2016-03-24 04:30 . 2012-04-04 20:50 797376 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2016-03-24 04:30 . 2011-05-18 03:54 142528 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2016-02-05 04:13 . 2016-02-05 04:13 875720 ----a-w- c:\windows\system32\msvcr120_clr0400.dll
2016-02-05 04:13 . 2016-02-05 04:13 536776 ----a-w- c:\windows\system32\msvcp120_clr0400.dll
2016-01-30 03:09 . 2016-02-10 08:26 324608 ----a-w- c:\windows\system32\sdohlp.dll
2016-01-30 03:09 . 2016-02-10 08:26 153088 ----a-w- c:\windows\system32\sbeio.dll
2016-01-30 03:09 . 2016-02-10 08:26 323072 ----a-w- c:\windows\system32\sbe.dll
2016-01-30 03:09 . 2016-02-10 08:26 293376 ----a-w- c:\windows\system32\psisdecd.dll
2016-01-30 03:09 . 2016-02-10 08:25 429056 ----a-w- c:\windows\system32\EncDec.dll
2016-01-30 03:09 . 2016-02-10 08:25 217600 ----a-w- c:\windows\system32\psisrndr.ax
2016-01-30 03:09 . 2016-02-10 08:24 1316864 ----a-w- c:\windows\system32\ole32.dll
2016-01-30 03:08 . 2016-02-10 08:25 107520 ----a-w- c:\windows\system32\mtxoci.dll
2016-01-30 03:08 . 2016-02-10 08:26 80896 ----a-w- c:\windows\system32\MSNP.ax
2016-01-30 03:08 . 2016-02-10 08:25 180224 ----a-w- c:\windows\system32\msorcl32.dll
2016-01-30 03:08 . 2016-02-10 08:26 57856 ----a-w- c:\windows\system32\MSDvbNP.ax
2016-01-30 03:08 . 2016-02-10 08:26 69632 ----a-w- c:\windows\system32\Mpeg2Data.ax
2016-01-30 03:08 . 2016-02-10 08:26 48128 ----a-w- c:\windows\system32\iasdatastore.dll
2016-01-30 03:08 . 2016-02-10 08:26 57344 ----a-w- c:\windows\system32\iasads.dll
2016-01-30 03:08 . 2016-02-10 08:26 119296 ----a-w- c:\windows\system32\iasrecst.dll
2016-01-30 01:32 . 2016-02-10 08:26 17408 ----a-w- c:\windows\system32\iashost.exe
2016-01-09 17:06 . 2016-02-10 08:01 501760 ----a-w- c:\windows\system32\kerberos.dll
2016-01-07 15:18 . 2016-02-10 08:05 115200 ----a-w- c:\windows\system32\drivers\mrxdav.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe "= "c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC "= "c:\program files\Microsoft Security Client\msseces.exe" [2016-01-29 986872]
"SigmatelSysTrayApp "= "sttray.exe" [2007-02-08 303104]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL "= "start http://www.avg.com/ww.special-uninstallation-feedback-appf?lic=NFVZOVgtTlNWVkwtTzRCWlEtUUlNQ0wtUVREQ0gtNElKTUg&inst=NzctNTg5NzE1MzM2LVQ0LVU4NSsxLUJBKzEtS1YzKzctWEwrMS1GUDkrNi1CQVI5RysxLVRCOSsyLUZMKzktUUlYMSs0LVgyMDEwKzItRjEwTTEwRCsxLUxJQysyMi1TUDErMS1TVUQrMS1TMUkrMS1TVTMrMQ&prod=90&ver=10.0.1321" [?]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle "= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@= "Service "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@= "Service "
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk
backup=c:\windows\pss\Microsoft Works Calendar Reminders.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-07-27 20:51 919008 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
2006-07-11 21:12 90112 ----a-w- c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
2006-11-12 06:19 446976 ----a-w- c:\program files\DellSupport\DSAgnt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ECenter]
2006-11-17 21:19 17920 ----a-w- c:\dell\E-Center\EULALauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2006-10-03 15:35 221184 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2006-10-03 15:37 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Portfolio]
2001-08-23 21:52 331830 ----a-w- c:\program files\Microsoft Works\wkssb.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray]
2006-11-05 15:22 221184 ----a-w- c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2009-04-11 03:28 1233920 ----a-w- c:\program files\Windows Sidebar\sidebar.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VERIZONDM]
2010-07-20 05:29 206120 ----a-w- c:\program files\VERIZONDM\bin\sprtcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-19 07:38 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-19 07:33 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WorksFUD]
2001-10-06 00:34 24576 ----a-w- c:\program files\Microsoft Works\wkfud.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring "=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2016-04-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 04:30]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Patricia\AppData\Roaming\Mozilla\Firefox\Profiles\btur9qkk.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.aol.com/?mtmhp=hyplogusaolp00000014&tb_uuid=F52419115D6FDAB8C534148E5D63D870s_pt=ff-aolmail&s_chn=&s_chn2=&pt_uid=
.
- - - - ORPHANS REMOVED - - - -
.
Notify-GoToAssist - c:\program files\Citrix\GoToAssist\480\G2AWinLogon.dll
SafeBoot-WudfPf
SafeBoot-WudfRd
MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe
MSConfigStartUp-Corel Photo Downloader - c:\program files\Corel\Corel Snapfire Plus\PhotoDownloader.exe
MSConfigStartUp-Microsoft Works Update Detection - c:\program files\Microsoft Works\WkDetect.exe
AddRemove-HiDef Media Player - c:\program files\HiDefMedia\HiDefMedia\uninstall.exe
AddRemove-{3F92ABBB-6BBF-11D5-B229-002078017FBF} - c:\program files\InstallShield Installation Information\{3F92ABBB-6BBF-11D5-B229-002078017FBF}\setup.exe
AddRemove-{E646DCF0-5A68-11D5-B229-002078017FBF} - c:\program files\InstallShield Installation Information\{E646DCF0-5A68-11D5-B229-002078017FBF}\Setup.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2016-04-02 17:12
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aac\UserChoice]
@Denied: (2) (LocalSystem)
"Progid "= "YMP.Media "
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid "= "YMP.Media "
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid "= "YMP.Media "
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid "= "YMP.Media "
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\UserChoice]
@Denied: (2) (LocalSystem)
"Progid "= "YMP.Media "
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.flac\UserChoice]
@Denied: (2) (LocalSystem)
"Progid "= "YMP.Media "
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\UserChoice]
@Denied: (2) (LocalSystem)
"Progid "= "YMP.Media "
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\UserChoice]
@Denied: (2) (LocalSystem)
"Progid "= "YMP.Media "
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\UserChoice]
@Denied: (2) (LocalSystem)
"Progid "= "YMP.Media "
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\UserChoice]
@Denied: (2) (LocalSystem)
"Progid "= "YMP.Media "
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice]
@Denied: (2) (LocalSystem)
"Progid "= "YMP.Media "
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\UserChoice]
@Denied: (2) (LocalSystem)
"Progid "= "YMP.Media "
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ogg\UserChoice]
@Denied: (2) (LocalSystem)
"Progid "= "YMP.Media "
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid "= "YMP.Media "
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pls\UserChoice]
@Denied: (2) (LocalSystem)
"Progid "= "YMP.Media "
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid "= "YMP.Media "
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.spx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid "= "YMP.Media "
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\UserChoice]
@Denied: (2) (LocalSystem)
"Progid "= "YMP.Media "
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\UserChoice]
@Denied: (2) (LocalSystem)
"Progid "= "YMP.Media "
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
Completion time: 2016-04-02 17:15:38
ComboFix-quarantined-files.txt 2016-04-02 21:15
.
Pre-Run: 90,159,161,344 bytes free
Post-Run: 90,210,635,776 bytes free
.
- - End Of File - - DF7FDC0AD0F564A227352B5EFC0C8CA0
5C616939100B85E558DA92B899A0FC36

 

Here is rKill.txt

Rkill 2.8.3 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2016 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 04/02/2016 05:50:21 PM in x86 mode. (Safe Mode)
Windows Version: Windows Vista (TM) Home Premium Service Pack 2

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* No malware processes found to kill.

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* No issues found.

Checking Windows Service Integrity:

* Base Filtering Engine (BFE) is not Running.
Startup Type set to: Automatic

* DHCP Client (Dhcp) is not Running.
Startup Type set to: Automatic

* DNS Client (Dnscache) is not Running.
Startup Type set to: Automatic

* COM+ Event System (EventSystem) is not Running.
Startup Type set to: Automatic

* Windows Firewall (MpsSvc) is not Running.
Startup Type set to: Automatic

* Network Connections (Netman) is not Running.
Startup Type set to: Manual

* Network Store Interface Service (nsi) is not Running.
Startup Type set to: Automatic

* Security Center (wscsvc) is not Running.
Startup Type set to: Automatic (Delayed Start)

* Windows Update (wuauserv) is not Running.
Startup Type set to: Automatic (Delayed Start)

* Windows Update (AFD) is not Running.
Startup Type set to: Automatic (Delayed Start)

* Windows Firewall Authorization Driver (mpsdrv) is not Running.
Startup Type set to: Manual

* NETBT (NetBT) is not Running.
Startup Type set to: System

* NSI proxy service (nsiproxy) is not Running.
Startup Type set to: System

* NetIO Legacy TDI Support Driver (tdx) is not Running.
Startup Type set to: System

Searching for Missing Digital Signatures:

* No issues found.

Checking HOSTS File:

* HOSTS file entries found:

127.0.0.1 localhost

Program finished at: 04/02/2016 05:54:38 PM
Execution time: 0 hours(s), 4 minute(s), and 16 seconds(s)

 

OK. I ran both programs as you advised, Frst.txt:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:05-03-2016 01
Ran by Patricia (administrator) on PATRICIA-PC (02-04-2016 21:14:27)
Running from C:\Users\Patricia\Desktop
Loaded Profiles: Patricia (Available Profiles: Patricia)
Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) Language: English (United States)
Internet Explorer Version 9 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(SupportSoft, Inc.) C:\Program Files\VERIZONDM\bin\sprtsvc.exe
(SupportSoft, Inc.) C:\Program Files\VERIZONDM\bin\tgsrvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(SigmaTel, Inc.) C:\Windows\sttray.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [986872 2016-01-29] (Microsoft Corporation)
HKLM\...\Run: [SigmatelSysTrayApp] => C:\Windows\sttray.exe [303104 2007-02-08] (SigmaTel, Inc.)
HKLM\...\RunOnce: [AvgUninstallURL] => cmd.exe /c start hxxp://www.avg.com/ww.special-uninstallation-feedback-appf?lic=NFVZOVgtTlNWVkwtTzRCWlEtUUlNQ0wtUVREQ0gtNElKTUg "& "inst=NzctNTg5NzE1MzM2LVQ0LVU4NSsxLUJBKzEtS1YzKzctWEwrMS1GUDkrNi1CQVI5R (the data entry has 119 more characters).
HKU\S-1-5-21-3093961477-3918382610-3448824889-1002\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{2475FFFD-53DB-4A60-8F84-21EA36D190EE}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-3093961477-3918382610-3448824889-1002\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3093961477-3918382610-3448824889-1002\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-3093961477-3918382610-3448824889-1002\Software\Microsoft\Internet Explorer\Main,Old Start Page = hxxp://entertainment.verizon.com/news/
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-07-27] (Adobe Systems Incorporated)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-05-10] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-05-10] (Oracle Corporation)
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

FireFox:
========
FF ProfilePath: C:\Users\Patricia\AppData\Roaming\Mozilla\Firefox\Profiles\btur9qkk.default
FF NewTab: hxxp://www.aol.com/?s_pt=ff-aolmail&s_chn=&s_chn2=&pt_uid=
FF DefaultSearchEngine.US: AOL Search
FF Homepage: hxxps://www.google.com/?gws_rd=ssl
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_21_0_0_197.dll [2016-03-24] ()
FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-05-10] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-05-10] (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2012-07-27] (Adobe Systems Inc.)
FF Extension: AOL Mail Toolbar - C:\Users\Patricia\AppData\Roaming\Mozilla\Firefox\Profiles\btur9qkk.default\Extensions\{fa1cfe8c-66b4-4469-b360-b60c79d70c28}.xpi [2016-04-02]
FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi [2016-04-01] [not signed]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-09-02] [not signed]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 BrYNSvc; C:\Program Files\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.) [File not signed]
S4 DSBrokerService; C:\Program Files\DellSupport\brkrsvc.exe [70656 2006-11-07] () [File not signed]
S3 GoToAssist; C:\Program Files\Citrix\GoToAssist\480\g2aservice.exe [16936 2008-02-19] (Citrix Online, a division of Citrix Systems, Inc.)
S4 IDriverT; C:\Program Files\Roxio\Roxio MyDVD DE\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22216 2016-01-29] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [292816 2016-01-29] (Microsoft Corporation)
S4 RoxMediaDB9; C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe [880640 2006-11-05] (Sonic Solutions) [File not signed]
S4 RoxWatch9; C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe [159744 2006-11-05] (Sonic Solutions) [File not signed]
R2 sprtsvc_verizondm; C:\Program Files\VERIZONDM\bin\sprtsvc.exe [206120 2010-07-20] (SupportSoft, Inc.)
S4 stllssvr; C:\Program Files\Common Files\SureThing Shared\stllssvr.exe [73728 2006-09-14] (MicroVision Development, Inc.) [File not signed]
R2 tgsrvc_verizondm; C:\Program Files\VERIZONDM\bin\tgsrvc.exe [185640 2010-07-20] (SupportSoft, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-19] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 DSproct; C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys [4736 2006-10-05] (Gteko Ltd.) [File not signed]
R2 dsunidrv; C:\Program Files\DellSupport\Drivers\dsunidrv.sys [7424 2006-08-17] (Gteko Ltd.) [File not signed]
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [253704 2015-11-13] (Microsoft Corporation)
R0 PxHelp20; C:\Windows\System32\Drivers\PxHelp20.sys [36528 2006-07-24] (Sonic Solutions) [File not signed]
R3 STHDA; C:\Windows\System32\drivers\stwrt.sys [647680 2007-02-08] (SigmaTel, Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-19] (Microsoft Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 catchme; \??\C:\Users\Patricia\AppData\Local\Temp\catchme.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-04-02 21:14 - 2016-04-02 21:15 - 00008964 _____ C:\Users\Patricia\Desktop\FRST.txt
2016-04-02 17:38 - 2016-04-02 17:38 - 02032072 _____ (Bleeping Computer, LLC) C:\Users\Patricia\Desktop\iExplore.exe
2016-04-02 17:29 - 2016-04-02 17:46 - 00000000 ____D C:\Users\Patricia\Desktop\Pictures Moved
2016-04-02 17:01 - 2011-06-26 02:45 - 00256000 _____ C:\Windows\PEV.exe
2016-04-02 17:01 - 2010-11-07 13:20 - 00208896 _____ C:\Windows\MBR.exe
2016-04-02 17:01 - 2009-04-20 00:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2016-04-02 17:01 - 2000-08-30 20:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2016-04-02 17:01 - 2000-08-30 20:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2016-04-02 17:01 - 2000-08-30 20:00 - 00098816 _____ C:\Windows\sed.exe
2016-04-02 17:01 - 2000-08-30 20:00 - 00080412 _____ C:\Windows\grep.exe
2016-04-02 17:01 - 2000-08-30 20:00 - 00068096 _____ C:\Windows\zip.exe
2016-04-02 17:00 - 2016-04-02 17:15 - 00000000 ___DC C:\Qoobox
2016-04-02 17:00 - 2016-04-02 17:14 - 00000000 ____D C:\Windows\erdnt
2016-04-02 10:41 - 2016-04-02 10:41 - 00000000 ___DC C:\AdwCleaner
2016-04-02 07:45 - 2016-04-02 17:50 - 00267480 _____ C:\Windows\ntbtlog.txt
2016-04-02 07:10 - 2016-04-02 09:04 - 00024688 _____ C:\Windows\system32\Drivers\TrueSight.sys
2016-04-02 07:09 - 2016-04-02 07:22 - 00000000 ____D C:\ProgramData\RogueKiller
2016-04-01 15:03 - 2016-04-02 21:14 - 00000000 ___DC C:\FRST
2016-04-01 15:01 - 2016-04-02 19:06 - 00000000 ____D C:\Users\Patricia\Desktop\jean
2016-04-01 15:01 - 2016-04-01 15:01 - 01725440 _____ (Farbar) C:\Users\Patricia\Desktop\FRST.exe
2016-04-01 14:57 - 2016-04-01 14:57 - 01725440 _____ (Farbar) C:\Users\Patricia\Documents\FRST.exe
2016-04-01 14:51 - 2016-04-01 14:51 - 01725440 _____ (Farbar) C:\Users\Patricia\Downloads\FRST.exe
2016-04-01 14:47 - 2016-04-01 14:47 - 00000104 _____ C:\Users\Patricia\Desktop\E-mail - Shortcut.lnk
2016-04-01 14:44 - 2016-04-01 14:44 - 00000000 ____D C:\Users\Patricia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
2016-04-01 14:41 - 2016-04-01 20:23 - 00000000 ____D C:\Program Files\Mozilla Firefox
2016-04-01 13:15 - 2016-04-01 13:15 - 06869352 _____ (Piriform Ltd) C:\Users\Patricia\Downloads\ccsetup516pro.exe
2016-04-01 11:19 - 2016-04-02 10:08 - 00170200 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-04-01 11:18 - 2016-04-01 11:18 - 00000901 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-04-01 11:18 - 2016-04-01 11:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-04-01 11:18 - 2016-04-01 11:18 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware
2016-04-01 11:18 - 2016-03-10 14:09 - 00053120 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-04-01 11:18 - 2016-03-10 14:08 - 00126336 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-04-01 11:18 - 2016-03-10 14:08 - 00024448 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-04-01 11:17 - 2016-04-01 11:17 - 22851472 _____ (Malwarebytes ) C:\Users\Patricia\Downloads\mbam-setup-2.2.1.1043.exe
2016-04-01 10:43 - 2016-04-01 10:43 - 22851472 _____ (Malwarebytes ) C:\Users\Patricia\Downloads\latest version.exe
2016-03-09 04:34 - 2016-02-19 17:34 - 01208776 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2016-03-09 04:34 - 2016-02-05 22:17 - 03609024 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2016-03-09 04:34 - 2016-02-05 22:17 - 03556800 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2016-03-09 04:34 - 2016-02-05 22:12 - 00783872 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2016-03-09 04:34 - 2016-02-05 22:11 - 00802304 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2016-03-09 04:34 - 2016-02-05 22:11 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2016-03-09 04:34 - 2016-02-05 20:32 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2016-03-09 04:33 - 2015-11-20 10:15 - 00922432 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00066400 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00022368 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00019808 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00016224 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00015712 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00015200 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00013664 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00013664 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00013664 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00011104 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2016-03-09 04:33 - 2015-11-20 10:15 - 00011104 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2016-03-09 04:32 - 2016-02-05 22:12 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\seclogon.dll
2016-03-09 04:32 - 2016-02-05 22:11 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2016-03-09 04:32 - 2016-02-05 20:33 - 00297472 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2016-03-09 04:31 - 2016-02-02 11:30 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS
2016-03-09 04:29 - 2016-02-03 13:06 - 00564736 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2016-03-09 04:29 - 2016-02-03 13:06 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\olepro32.dll
2016-03-09 04:29 - 2016-02-03 13:05 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\asycfilt.dll
2016-03-09 04:03 - 2016-02-04 11:25 - 02068992 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-03-08 21:16 - 2016-02-08 20:17 - 01815552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-03-08 21:16 - 2016-02-08 20:12 - 01140224 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-03-08 21:16 - 2016-02-08 20:11 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-03-08 21:16 - 2016-02-08 20:10 - 01804800 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-03-08 21:16 - 2016-02-08 20:10 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-03-08 21:16 - 2016-02-08 20:10 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-03-08 21:16 - 2016-02-08 20:10 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-03-08 21:16 - 2016-02-08 20:10 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2016-03-08 21:16 - 2016-02-08 20:10 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2016-03-08 21:16 - 2016-02-08 20:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2016-03-08 21:16 - 2016-02-08 20:09 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2016-03-08 21:16 - 2016-02-08 20:09 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-03-08 21:16 - 2016-02-08 20:09 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2016-03-08 21:16 - 2016-02-08 20:09 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2016-03-08 21:16 - 2016-02-08 20:09 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2016-03-08 21:16 - 2016-02-08 20:09 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2016-03-08 21:16 - 2016-02-08 20:09 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2016-03-08 21:15 - 2016-02-08 20:15 - 12392960 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-03-08 21:15 - 2016-02-08 20:13 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2016-03-08 21:15 - 2016-02-08 20:12 - 09753600 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-03-08 21:15 - 2016-02-08 20:09 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2016-03-08 21:15 - 2016-02-08 20:09 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2016-03-08 20:55 - 2016-03-08 20:55 - 00000000 ____D C:\e7ff8178703db26a6663decbdbafd0b4
2016-03-04 08:31 - 2016-03-04 08:31 - 00000000 ___DC C:\67025d12f6c47c8f4a03a04d4c12e91e

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-04-02 20:30 - 2012-04-04 16:50 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-04-02 19:57 - 2006-11-02 08:47 - 00003568 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2016-04-02 19:57 - 2006-11-02 08:47 - 00003568 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2016-04-02 17:57 - 2006-11-02 09:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-04-02 17:47 - 2006-11-02 09:01 - 00032618 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2016-04-02 17:12 - 2006-11-02 06:23 - 00000215 ____C C:\Windows\system.ini
2016-04-02 17:11 - 2007-03-19 10:37 - 00000000 ____D C:\Users\Patricia
2016-04-01 21:35 - 2006-11-02 07:18 - 00000000 ____D C:\Windows\inf
2016-04-01 21:35 - 2006-11-02 06:33 - 00772030 _____ C:\Windows\system32\PerfStringBackup.INI
2016-04-01 20:23 - 2015-05-31 11:46 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2016-04-01 14:44 - 2013-10-13 11:50 - 00001059 _____ C:\Users\Patricia\Desktop\Revo Uninstaller.lnk
2016-04-01 14:44 - 2013-10-13 11:50 - 00000000 ____D C:\Program Files\VS Revo Group
2016-04-01 13:36 - 2006-11-10 09:22 - 00000000 ____D C:\Windows\Panther
2016-04-01 13:10 - 2009-02-12 13:13 - 00000000 ____D C:\Users\Patricia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CleanUp!
2016-04-01 13:10 - 2009-02-12 13:12 - 00000000 ____D C:\Program Files\CleanUp!
2016-04-01 12:19 - 2009-02-12 12:58 - 00002595 _____ C:\Users\Patricia\Desktop\Microsoft Word.lnk
2016-04-01 10:11 - 2010-10-29 16:45 - 00000000 ____D C:\Users\Patricia\AppData\Roaming\Malwarebytes
2016-03-31 20:22 - 2015-02-06 18:26 - 00000000 ____D C:\found.000
2016-03-31 20:21 - 2010-10-29 17:08 - 00000000 ____D C:\Windows\Minidump
2016-03-24 00:30 - 2012-04-04 16:50 - 00797376 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2016-03-24 00:30 - 2011-05-17 23:54 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2016-03-20 13:34 - 2007-03-13 06:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell Games
2016-03-20 13:32 - 2007-03-13 06:05 - 00000000 ____D C:\ProgramData\WildTangent
2016-03-09 05:24 - 2006-11-02 07:18 - 00000000 ____D C:\Windows\rescache
2016-03-09 04:57 - 2006-11-02 08:47 - 00389528 _____ C:\Windows\system32\FNTCACHE.DAT
2016-03-09 04:53 - 2006-11-02 08:37 - 00000000 ____D C:\Windows\system32\XPSViewer
2016-03-09 04:53 - 2006-11-02 07:18 - 00000000 ____D C:\Program Files\Common Files\System
2016-03-09 04:24 - 2013-08-15 07:10 - 00000000 ____D C:\Windows\system32\MRT
2016-03-09 04:08 - 2006-11-02 06:24 - 141270216 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

==================== Files in the root of some directories =======

2011-04-18 19:39 - 2011-04-18 19:39 - 0031007 _____ () C:\Users\Patricia\AppData\Roaming\UserTile.png
2014-04-27 11:33 - 2014-04-28 06:34 - 0000085 _____ () C:\Users\Patricia\AppData\Roaming\WB.CFG
2007-03-19 11:29 - 2009-02-09 17:49 - 0045910 _____ () C:\Users\Patricia\AppData\Roaming\wklnhst.dat
2014-11-23 15:02 - 2015-05-10 10:29 - 0000680 _____ () C:\Users\Patricia\AppData\Local\d3d9caps.dat
2007-03-19 10:53 - 2011-04-19 00:04 - 0025600 _____ () C:\Users\Patricia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2007-03-19 10:47 - 2007-03-19 10:47 - 0000096 _____ () C:\Users\Patricia\AppData\Local\fusioncache.dat
2012-07-15 19:53 - 2012-07-19 19:35 - 0000792 _____ () C:\Users\Patricia\AppData\Local\RAExpertHistory.xml

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-04-02 18:03

==================== End of FRST.txt ============================


Here is Addition.txt:

Additional scan result of Farbar Recovery Scan Tool (x86) Version:05-03-2016 01
Ran by Patricia (2016-04-02 21:16:24)
Running from C:\Users\Patricia\Desktop
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) (2007-03-13 09:47:08)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3093961477-3918382610-3448824889-500 - Administrator - Disabled)
ASPNET (S-1-5-21-3093961477-3918382610-3448824889-1001 - Limited - Enabled)
Guest (S-1-5-21-3093961477-3918382610-3448824889-501 - Limited - Disabled)
Patricia (S-1-5-21-3093961477-3918382610-3448824889-1002 - Administrator - Enabled) => C:\Users\Patricia

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {768124D7-F5F7-6D2F-DDC2-94DFA4017C95}
AS: Microsoft Security Essentials (Enabled - Up to date) {CDE0C533-D3CD-62A1-E772-AFADDF863628}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Acrobat.com (Version: 0.0.0 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 21 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 21.0.0.197 - Adobe Systems Incorporated)
Adobe Flash Player 21 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 21.0.0.197 - Adobe Systems Incorporated)
Adobe Reader X (10.1.4) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.4 - Adobe Systems Incorporated)
ATI Catalyst Control Center Ex (HKLM\...\{F08F36A8-7EEA-DB4D-00D1-2CA68C2DD445}) (Version: 2.0.2488.36465 - ATI Technologies Inc.)
Banctec Service Agreement (HKLM\...\{4B9F45E8-E3CE-40B4-9463-80A9B3481DEF}) (Version: 1.11.0000 - Dell)
CleanUp! (HKLM\...\CleanUp!) (Version: - )
Compatibility Pack for the 2007 Office system (HKLM\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Conexant D850 PCI V.92 Modem (HKLM\...\CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200F14F1) (Version: - )
Dell System Customization Wizard (HKLM\...\{13BA7B44-B712-4DEE-A7B8-1DD564F37AE5}) (Version: 1.00.0000 - Dell Inc.)
DellSupport (HKLM\...\{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}) (Version: 6.0.3030 - Dell)
Documentation & Support Launcher (HKLM\...\{89CEAE14-DD0F-448E-9554-15781EC9DB24}) (Version: 1.00.0000 - Dell Inc.)
Dreams Working Interactive (HKLM\...\ST6UNST #1) (Version: - )
EasyCleaner (HKLM\...\{F5346614-B7C4-4E94-826A-E2363155233D}) (Version: 2.0.6.380 - ToniArts)
Expert Tarot Card (HKLM\...\xtarot32DeinstKey) (Version: - )
Four Pillars & Feng Shui (HKU\S-1-5-21-3093961477-3918382610-3448824889-1002\...\Four Pillars & Feng Shui) (Version: - )
Games, Music, & Photos Launcher (HKLM\...\{3E25E350-949F-4DB7-8288-2A60E018B4C1}) (Version: 1.00.0000 - Dell Inc.)
GoToAssist 8.0.0.480 (HKLM\...\GoToAssist) (Version: - )
HL-2270DW (HKLM\...\{E2A97415-BD97-4867-B906-05E39E9EE51F}) (Version: 1.0.7.0 - Brother Industries, Ltd.)
Internet Service Offers Launcher (HKLM\...\{CCFF1E13-77A2-4032-8B12-7566982A27DF}) (Version: 1.00.0000 - Dell Inc.)
Macromedia Shockwave Player (HKLM\...\Macromedia Shockwave Player) (Version: - )
Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Microsoft .NET Framework 1.1 (HKLM\...\Microsoft .NET Framework 1.1 (1033)) (Version: - )
Microsoft .NET Framework 1.1 Security Update (KB2698023) (HKLM\...\M2698023) (Version: - )
Microsoft .NET Framework 1.1 Security Update (KB2833941) (HKLM\...\M2833941) (Version: - )
Microsoft .NET Framework 1.1 Security Update (KB979906) (HKLM\...\M979906) (Version: - )
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2000 Professional (HKLM\...\{00010409-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2720 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.9.218.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Word 2002 (HKLM\...\{911B0409-6000-11D3-8CFE-0050048383C9}) (Version: 10.0.6626.0 - Microsoft Corporation)
Microsoft Works 2002 Setup Launcher (HKLM\...\Works2002Setup) (Version: - )
Microsoft Works 6.0 (HKLM\...\{A1B7B9B3-E1D2-41CA-9B4A-F18DC2710704}) (Version: 06.00.0000 - Microsoft Corporation)
Microsoft Works Suite Add-in for Microsoft Word (HKLM\...\{C3A439E4-7303-491F-A678-CEA36A87D517}) (Version: 2.0.0.0000 - Microsoft Corporation)
Modem Diagnostic Tool (HKLM\...\{F63A3748-B93D-4360-9AD4-B064481A5C7B}) (Version: 1.0.17.8 - Dell)
Mozilla Firefox 45.0.1 (x86 en-US) (HKLM\...\Mozilla Firefox 45.0.1 (x86 en-US)) (Version: 45.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 45.0.1.5918 - Mozilla)
MSXML 4.0 SP2 (KB927978) (HKLM\...\{37477865-A3F1-4772-AD43-AAFC6BCFF99F}) (Version: 4.20.9841.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB936181) (HKLM\...\{C04E32E0-0416-434D-AFB9-6969D703A9EF}) (Version: 4.20.9848.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB941833) (HKLM\...\{C523D256-313D-4866-B36A-F3DE528246EF}) (Version: 4.20.9849.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Oracle 32 (HKLM\...\Oracle 32) (Version: - )
Revo Uninstaller 1.50 (HKLM\...\Revo Uninstaller) (Version: 1.50 - VS Revo Group)
Roxio Creator Audio (HKLM\...\{83FFCFC7-88C6-41c6-8752-958A45325C82}) (Version: 3.3.0 - Roxio)
Roxio Creator BDAV Plugin (HKLM\...\{880AF49C-34F7-4285-A8AD-8F7A3D1C33DC}) (Version: 3.3.0 - Roxio)
Roxio Creator Copy (HKLM\...\{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}) (Version: 3.3.0 - Roxio)
Roxio Creator Data (HKLM\...\{0D397393-9B50-4c52-84D5-77E344289F87}) (Version: 3.3.0 - Roxio)
Roxio Creator DE (HKLM\...\{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}) (Version: 3.3.0 - Roxio)
Roxio Creator Tools (HKLM\...\{0394CDC8-FABD-4ed8-B104-03393876DFDF}) (Version: 3.3.0 - Roxio)
Roxio Drag-to-Disc (HKLM\...\{2F4C24E6-CBD4-4AAC-B56F-C9FD44DE5668}) (Version: 9.0 - Roxio)
Roxio Express Labeler (HKLM\...\{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}) (Version: 2.1.0 - Roxio)
Roxio MyDVD DE (HKLM\...\{D639085F-4B6E-4105-9F37-A0DBB023E2FB}) (Version: 9.0.116 - Roxio, Inc.)
Roxio Update Manager (HKLM\...\{30465B6C-B53F-49A1-9EBA-A3F187AD502E}) (Version: 3.0.0 - Roxio)
SigmaTel Audio (HKLM\...\{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}) (Version: 5.10.5102.0 - SigmaTel)
Sonic Activation Module (Version: 1.0 - Sonic Solutions) Hidden
Spelling Dictionaries Support For Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
URL Assistant (HKLM\...\{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}) (Version: - )
User's Guides (HKLM\...\{5CD29180-A95E-11D3-A4EB-00C04F7BDB2C}) (Version: - )
Verizon Download Manager (HKLM\...\{CCD35D5A-7B97-46E0-AB2E-21C59BA253B6}) (Version: 1.0.0 - Verizon)
Vz In Home Agent (HKLM\...\{2746B4DE-A2EE-4B33-A7CE-B33BAD5EF6FE}) (Version: 7.08.22 - Verizon)
Works Suite OS Pack (Version: 1.0.0.0000 - Microsoft Corporation) Hidden
Works Synchronization (Version: 1.0.0.0000 - Your Company Name) Hidden
Works Upgrade (Version: 8.0.0.0000 - Microsoft Corporation) Hidden

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-3093961477-3918382610-3448824889-1002_Classes\CLSID\{b2b568c8-3712-4a75-b806-4b3c2fdb06d5}\localserver32 -> no filepath

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0B19D3FF-D22E-4AAD-8ACC-50E0B3DC62A3} - System32\Tasks\Secunia PSI Logon Task => C:\Program Files\Secunia\PSI\psi.exe
Task: {2EB6777E-D544-4656-987F-CBBAB2821B47} - System32\Tasks\Microsoft\Windows\RestartManager\{96061901-2D53-4e6b-926D-63155BC76274} => C:\Windows\system32\rmclient.exe [2006-11-02] (Microsoft Corporation)
Task: {B45CB1D9-5441-4BCC-AC20-B8A03D8263D8} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2016-03-24] (Adobe Systems Incorporated)
Task: {C8A54FF6-2945-4024-B1D4-B8929649EB7F} - System32\Tasks\{11C4B5CD-E762-4C7D-8DCD-C4E65F1F3A52} => pcalua.exe -a "E:\ALL DOCUMENTS\SETUP.EXE" -d "E:\ALL DOCUMENTS "

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2007-03-27 12:33 - 2006-10-26 16:21 - 00056056 _____ () C:\Windows\system32\DLAAPI_W.DLL
2007-03-13 13:37 - 2006-10-25 00:44 - 00159744 _____ () C:\Windows\system32\atitmmxx.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\Patricia\Desktop\Pleasure of Tarot - Lessons:Roxio EMC Stream [38]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 06:23 - 2016-04-02 17:12 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1 localhost

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3093961477-3918382610-3448824889-1002\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 2) (ConsentPromptBehaviorUser: 1) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: Ati External Event Utility => 2
MSCONFIG\Services: DSBrokerService => 3
MSCONFIG\Services: GoToAssist => 3
MSCONFIG\Services: IDriverT => 3
MSCONFIG\Services: RoxMediaDB9 => 3
MSCONFIG\Services: RoxWatch9 => 2
MSCONFIG\Services: STacSV => 2
MSCONFIG\Services: stllssvr => 3
MSCONFIG\Services: XAudioService => 2
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk => C:\Windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Digital Line Detect.lnk => C:\Windows\pss\Digital Line Detect.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk => C:\Windows\pss\Microsoft Office.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk => C:\Windows\pss\Microsoft Works Calendar Reminders.lnk.CommonStartup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
MSCONFIG\startupreg: ATICCC => "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe "
MSCONFIG\startupreg: DellSupport => "C:\Program Files\DellSupport\DSAgnt.exe" /startup
MSCONFIG\startupreg: ECenter => c:\dell\E-Center\EULALauncher.exe
MSCONFIG\startupreg: ISUSPM Startup => C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
MSCONFIG\startupreg: ISUSScheduler => "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
MSCONFIG\startupreg: Microsoft Works Portfolio => C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
MSCONFIG\startupreg: RoxWatchTray => "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe "
MSCONFIG\startupreg: Sidebar => C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
MSCONFIG\startupreg: VERIZONDM => "C:\Program Files\VERIZONDM\bin\sprtcmd.exe" /P VERIZONDM
MSCONFIG\startupreg: Windows Defender => %ProgramFiles%\Windows Defender\MSASCui.exe -hide
MSCONFIG\startupreg: WMPNSCFG => C:\Program Files\Windows Media Player\WMPNSCFG.exe
MSCONFIG\startupreg: WorksFUD => C:\Program Files\Microsoft Works\wkfud.exe

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [WinCollab-DFSR-In-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
FirewallRules: [WinCollab-DFSR-Out-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
FirewallRules: [WinCollab-In-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-Out-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-In-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-Out-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [TCP Query User{3F97E2F9-C74E-4373-9516-634E4F34B8B7}C:\program files\internet explorer\iexplore.exe] => (Allow) C:\program files\internet explorer\iexplore.exe
FirewallRules: [UDP Query User{1E3D2045-E0A9-4690-8F19-D5D4E2C93E58}C:\program files\internet explorer\iexplore.exe] => (Allow) C:\program files\internet explorer\iexplore.exe
FirewallRules: [TCP Query User{370E31CB-4B20-4093-98A8-974307442367}F:\techwizard.exe] => (Allow) F:\techwizard.exe
FirewallRules: [UDP Query User{E86AF728-3D5B-448C-BB8E-942FB9F21E53}F:\techwizard.exe] => (Allow) F:\techwizard.exe
FirewallRules: [{9452BCBA-41B5-481B-B092-85F2BE73B9A0}] => (Allow) LPort=80
FirewallRules: [{FB67CAA6-36E6-432C-B70C-91F0828C0317}] => (Allow) LPort=80
FirewallRules: [{0239D7EE-9228-4163-A1FC-7E48AFFC29D8}] => (Allow) LPort=80
FirewallRules: [{2FD45197-32F5-492D-AB71-56F031A896E4}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [{44905157-C518-4E2A-BECB-20B243B60918}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{F6823AED-6D11-4DE3-8B8A-AD67C0356CC5}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{3E100883-9578-4412-AF7A-67ECBE6462EE}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{ABAE8FA6-7DD9-40D9-9A4B-6CD13BEEB5A2}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe

==================== Restore Points =========================

27-03-2016 02:04:02 Scheduled Checkpoint
28-03-2016 21:25:20 Windows Update
30-03-2016 01:54:49 Scheduled Checkpoint
31-03-2016 01:21:24 Scheduled Checkpoint
31-03-2016 18:36:15 Scheduled Checkpoint
01-04-2016 10:48:16 Revo Uninstaller's restore point - Malwarebytes Anti-Malware version 1.75.0.1300
01-04-2016 14:45:13 Revo Uninstaller's restore point - CCleaner
01-04-2016 20:42:02 Windows Update
02-04-2016 10:48:55 JRT Pre-Junkware Removal

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (04/02/2016 05:49:50 PM) (Source: EventSystem) (EventID: 4609) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c

Error: (04/02/2016 05:44:29 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program Explorer.EXE version 6.0.6002.18005 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel.
Process ID: 7a4
Start Time: 01d18d2744ca1892
Termination Time: 2839

Error: (04/02/2016 05:27:12 PM) (Source: EventSystem) (EventID: 4609) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c

Error: (04/02/2016 05:03:41 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: The entry <C:\USERS\PATRICIA\APPDATA\LOCAL\MICROSOFT\WINDOWS\HISTORY\HISTORY.IE5\MSHIST012016040220160403> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

Error: (04/02/2016 04:51:02 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: The entry <C:\USERS\PATRICIA\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\MACROMEDIA.COM\SUPPORT\FLASHPLAYER\SYS\#MY.SCREENNAME.AOL.COM> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

Error: (04/02/2016 04:51:02 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: The entry <C:\USERS\PATRICIA\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\MACROMEDIA.COM\SUPPORT\FLASHPLAYER\SYS\#MY.SCREENNAME.AOL.COM> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

Error: (04/02/2016 07:46:12 AM) (Source: EventSystem) (EventID: 4609) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c

Error: (04/01/2016 09:21:26 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program WinMail.exe version 6.0.6001.18000 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel.
Process ID: c9c
Start Time: 01d18c7d187efdbd
Termination Time: 9064

Error: (04/01/2016 03:20:04 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program iexplore.exe version 9.0.8112.16749 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel.
Process ID: e58
Start Time: 01d18c4b61ec74b9
Termination Time: 15

Error: (04/01/2016 02:45:11 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005.
This is often caused by incorrect security settings in either the writer or requestor process.


Operation:
Gathering Writer Data

Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {ec5c5d50-ea00-49e5-8d5b-d06956fd6eca}


System errors:
=============
Error: (04/02/2016 05:57:10 PM) (Source: Microsoft-Windows-TaskScheduler) (EventID: 412) (User: NT AUTHORITY)
Description: 2147942402

Error: (04/02/2016 05:50:56 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Network List ServiceNetwork Location Awareness%%1068

Error: (04/02/2016 05:50:56 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Network List ServiceNetwork Location Awareness%%1068

Error: (04/02/2016 05:50:56 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Network List ServiceNetwork Location Awareness%%1068

Error: (04/02/2016 05:50:56 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Network List ServiceNetwork Location Awareness%%1068

Error: (04/02/2016 05:50:56 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: AFD
DfsC
MpFilter
NetBIOS
netbt
nsiproxy
PSched
RasAcd
rdbss
Smb
spldr
tdx
Wanarpv6
ws2ifsl

Error: (04/02/2016 05:50:56 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Network List ServiceNetwork Location Awareness%%1068

Error: (04/02/2016 05:50:56 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Network Location AwarenessNetwork Store Interface Service%%1068

Error: (04/02/2016 05:50:56 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Network ConnectionsNetwork Store Interface Service%%1068

Error: (04/02/2016 05:50:56 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: IP HelperNetwork Store Interface Service%%1068


CodeIntegrity:
===================================
Date: 2016-04-02 21:16:01.202
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-04-02 21:15:59.908
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-04-02 21:15:58.597
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-04-02 21:15:57.302
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-04-02 21:15:55.524
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-04-02 21:15:54.214
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-04-02 21:15:52.903
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-04-02 21:15:51.593
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-04-02 17:05:43.404
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

Date: 2016-04-02 17:05:42.203
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 3800+
Percentage of memory in use: 59%
Total physical RAM: 1021.76 MB
Available physical RAM: 417.68 MB
Total Virtual: 2308.1 MB
Available Virtual: 1459.64 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:138.96 GB) (Free:83.9 GB) NTFS ==>[drive with boot components (obtained from BCD)]
Drive d: (RECOVERY) (Fixed) (Total:10 GB) (Free:5.19 GB) NTFS
Drive g: (LEXAR MEDIA) (Removable) (Total:0.12 GB) (Free:0.09 GB) FAT

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 149 GB) (Disk ID: 50000000)
Partition 1: (Not Active) - (Size=55 MB) - (Type=DE)
Partition 2: (Not Active) - (Size=10 GB) - (Type=07 NTFS)
Partition 3: (Active) - (Size=139 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 123 MB) (Disk ID: FB093AF2)
Partition 1: (Active) - (Size=122 MB) - (Type=06)

==================== End of Addition.txt ============================

 

Here is the Fixlog.txt:

Fix result of Farbar Recovery Scan Tool (x86) Version:05-03-2016 01
Ran by Patricia (2016-04-02 22:45:37) Run:1
Running from C:\Users\Patricia\Desktop
Loaded Profiles: Patricia (Available Profiles: Patricia)
Boot Mode: Normal

==============================================

fixlist content:
*****************
HKLM\...\RunOnce: [AvgUninstallURL] => cmd.exe /c start hxxp://www.avg.com/ww.special-uninstallation-feedback-appf?lic=NFVZOVgtTlNWVkwtTzRCWlEtUUlNQ0wtUVREQ0gtNElKTUg "& "inst=NzctNTg5NzE
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-3093961477-3918382610-3448824889-1002\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 catchme; \??\C:\Users\Patricia\AppData\Local\Temp\catchme.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
2011-04-18 19:39 - 2011-04-18 19:39 - 0031007 _____ () C:\Users\Patricia\AppData\Roaming\UserTile.png
2014-04-27 11:33 - 2014-04-28 06:34 - 0000085 _____ () C:\Users\Patricia\AppData\Roaming\WB.CFG
2007-03-19 11:29 - 2009-02-09 17:49 - 0045910 _____ () C:\Users\Patricia\AppData\Roaming\wklnhst.dat
2014-11-23 15:02 - 2015-05-10 10:29 - 0000680 _____ () C:\Users\Patricia\AppData\Local\d3d9caps.dat
2007-03-19 10:53 - 2011-04-19 00:04 - 0025600 _____ () C:\Users\Patricia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2007-03-19 10:47 - 2007-03-19 10:47 - 0000096 _____ () C:\Users\Patricia\AppData\Local\fusioncache.dat
2012-07-15 19:53 - 2012-07-19 19:35 - 0000792 _____ () C:\Users\Patricia\AppData\Local\RAExpertHistory.xml
AlternateDataStreams: C:\Users\Patricia\Desktop\Pleasure of Tarot - Lessons:Roxio EMC Stream [38]

*****************

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\\AvgUninstallURL => value removed successfully.
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully.
"HKU\S-1-5-21-3093961477-3918382610-3448824889-1002\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully.
blbdrive => service removed successfully.
catchme => service removed successfully.
IpInIp => service removed successfully.
NwlnkFlt => service removed successfully.
NwlnkFwd => service removed successfully.
C:\Users\Patricia\AppData\Roaming\UserTile.png => moved successfully
C:\Users\Patricia\AppData\Roaming\WB.CFG => moved successfully
C:\Users\Patricia\AppData\Roaming\wklnhst.dat => moved successfully
C:\Users\Patricia\AppData\Local\d3d9caps.dat => moved successfully
C:\Users\Patricia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini => moved successfully
C:\Users\Patricia\AppData\Local\fusioncache.dat => moved successfully
C:\Users\Patricia\AppData\Local\RAExpertHistory.xml => moved successfully
C:\Users\Patricia\Desktop\Pleasure of Tarot - Lessons => ":Roxio EMC Stream" ADS removed successfully..

==== End of Fixlog 22:45:37 ====

 

Pat Darrow had to have her computer back to do some work so I brought it back tonight but will try to go there tomorrow night to finish the cleanup process.

I'll write later.

Jean

 

Hi,
I went over to Pat's house tonight and was able to run two of the three programs that you instructed me run.
But it was getting very late and since Sophos Free Virus Removal Tool was taking so long and it was late, I had to leave and go home. I gave Pat instructions on if there was a problem to save it to a .txt file.

In the meantime I am sending Security Check txt document and Farbar Service txt document.

I will try to get the last scan tomorrow or next day. Thanks for your patience.


checkup.txt

Results of screen317's Security Check version 1.014 --- 12/23/15
Windows Vista Service Pack 2 x86 (UAC is enabled)
Internet Explorer 9
Internet Explorer 8
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Microsoft Security Essentials
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.75.0.1300
MBAM out of Date!
EasyCleaner
Java version 32-bit out of Date!
Adobe Flash Player 21.0.0.197
Adobe Reader 9 Adobe Reader out of Date!
Adobe Reader 10.1.16 Adobe Reader out of Date!
Mozilla Firefox (45.0.1)
````````Process Check: objlist.exe by Laurent````````
Microsoft Security Essentials MSMpEng.exe
Microsoft Security Essentials msseces.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 2 % Defragment your hard drive soon! (Do NOT defrag if SSD!)
````````````````````End of Log``````````````````````


FSS.txt

Farbar Service Scanner Version: 27-01-2016
Ran by Patricia (administrator) on 05-04-2016 at 18:45:41
Running from "C:\Users\Patricia\Desktop "
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Policy:
========================


Security Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware "=DWORD:1


Other Services:
==============


File Check:
========
C:\Windows\system32\nsisvc.dll => File is digitally signed
C:\Windows\system32\Drivers\nsiproxy.sys => File is digitally signed
C:\Windows\system32\dhcpcsvc.dll => File is digitally signed
C:\Windows\system32\Drivers\afd.sys => File is digitally signed
C:\Windows\system32\Drivers\tdx.sys => File is digitally signed
C:\Windows\system32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\system32\dnsrslvr.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\mpssvc.dll => File is digitally signed
C:\Windows\system32\bfe.dll => File is digitally signed
C:\Windows\system32\Drivers\mpsdrv.sys => File is digitally signed
C:\Windows\system32\SDRSVC.dll => File is digitally signed
C:\Windows\system32\vssvc.exe => File is digitally signed
C:\Windows\system32\wscsvc.dll => File is digitally signed
C:\Windows\system32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\system32\wuaueng.dll => File is digitally signed
C:\Windows\system32\qmgr.dll => File is digitally signed
C:\Windows\system32\es.dll => File is digitally signed
C:\Windows\system32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\system32\ipnathlp.dll => File is digitally signed
C:\Windows\system32\iphlpsvc.dll => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed


**** End of log ****

 

OK, Pat called me last night and said that the virus checker, Sophos Free Virus Removal Tool, did not find any problems so there was no report.
Do you believe it is free from viruses? The computer is definitely not as slow as it was.
Thanks.
Jean

 

I promise I will run everything that you said to do but I can't do it until Sunday because I won't be able to go over to her house until then.

Thank you for all the help and I will let you know how her computer is doing on Sunday night.