Solved Dual Boot Laptop with win 7 win7 will not update

[Solved] Dual Boot Laptop with win 7 win7 will not update

My friend gave me a laptop to remove the xp from the dual boot. Since I am having trouble doing that, I figured I would try to find out why Win 7 will not update.

Downloaded a fresh copy of MBAM. Will not install properly (runtime errors) and will not run once installed.

DDS Log is here:

DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 8.0.7100.0
Run by M1530 at 18:38:33 on 2014-06-07
Microsoft Windows 7 Ultimate 6.1.7100.0.1252.1.1033.18.3582.2358 [GMT -5:00]
.
AV: avast! Antivirus *Enabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: avast! Antivirus *Enabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
FW: avast! Antivirus *Enabled* {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}
.
============== Running Processes ================
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Program Files\Fingerprint Reader Suite\upeksvr.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\conhost.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Alwil Software\Avast5\afwServ.exe
C:\Windows\system32\aestsrv.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Windows\system32\STacSV.exe
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Google\Update\1.3.24.7\GoogleCrashHandler.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\OEM02Mon.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Program Files\Fingerprint Reader Suite\psqltray.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
C:\Program Files\HP\HP Software Update\hpwuschd2.exe
C:\Program Files\Alwil Software\Avast5\avastui.exe
C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxps://www.yahoo.com?fr=hp-avast&type=avastbcl
uSearch Bar = hxxps://www.yahoo.com?fr=hp-avast&type=avastbcl
uSearch Page = hxxp://us.yhs4.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms}
mStart Page = hxxps://www.yahoo.com?fr=hp-avast&type=avastbcl
uProxyServer = hxxp=127.0.0.1:49721;https=127.0.0.1:49721;
uProxyOverride = <-loopback>
BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\alwil software\avast5\aswWebRepIE.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [TomTomHOME.exe] "c:\program files\tomtom home 2\TomTomHOMERunner.exe "
mRun: [PSQLLauncher] "c:\program files\fingerprint reader suite\launcher.exe" /startup
mRun: [OEM02Mon.exe] c:\windows\OEM02Mon.exe
mRun: [Apoint] c:\program files\delltpad\Apoint.exe
mRun: [NvSvc] RUNDLL32.EXE c:\windows\system32\nvsvc.dll,nvsvcStart
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NVHotkey] rundll32.exe c:\windows\system32\nvHotkey.dll,Start
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe "
mRun: [PDVDDXSrv] "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe "
mRun: [SigmatelSysTrayApp] c:\program files\sigmatel\c-major audio\wdm\sttray.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [AvastUI.exe] "c:\program files\alwil software\avast5\AvastUI.exe" /nogui
mRun: [FromDocToPDF EPM Support] "c:\progra~1\fromdo~2\bar\1.bin\65medint.exe" T8EPMSUP.DLL,S
mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon
mRun: [CanonSolutionMenuEx] c:\program files\canon\solution menu ex\CNSEMAIN.EXE /logon
StartupFolder: c:\users\m1530\appdata\roaming\micros~1\windows\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: DisableCAD = dword:1
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: NameServer = 192.168.2.1
TCP: Interfaces\{ABAF5542-EE62-4AEF-9D31-E08DE8CE7769} : DHCPNameServer = 192.168.15.1
TCP: Interfaces\{C91E28D7-98DD-448E-AD54-F8F8BC27B290} : DHCPNameServer = 192.168.2.1
TCP: Interfaces\{C91E28D7-98DD-448E-AD54-F8F8BC27B290}\75966696D22556075616475627 : DHCPNameServer = 192.168.10.1
TCP: Interfaces\{F68C8AE9-DDA8-4BF1-BC50-FCAF7363D230} : DHCPNameServer = 192.168.1.254
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Notify: psfus - c:\windows\system32\psqlpwd.dll
AppInit_DLLs= c:\progra~1\searchprotect\searchprotect\bin\spvc32loader.dll
SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
LSA: Notification Packages = scecli psqlpwd
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\35.0.1916.114\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
.
============= SERVICES / DRIVERS ===============
.
R0 aswNdisFlt;Avast! Firewall Driver;c:\windows\system32\drivers\aswNdisFlt.sys [2014-5-29 270240]
R0 aswRvrt;avast! Revert;c:\windows\system32\drivers\aswRvrt.sys [2014-3-23 49944]
R0 aswVmm;avast! VM Monitor;c:\windows\system32\drivers\aswVmm.sys [2014-3-23 180632]
R1 aswKbd;aswKbd;c:\windows\system32\drivers\aswKbd.sys [2014-5-29 26136]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswsnx.sys [2014-3-23 777488]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswsp.sys [2010-4-21 411680]
R2 {1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7};Power Control [2010/02/11 13:34:13];c:\program files\cyberlink\powerdvd dx\000.fcl [2010-2-11 87536]
R2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\AEstSrv.exe [2010-2-11 73728]
R2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys [2014-4-28 24184]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-4-21 67824]
R2 aswStm;aswStm;c:\windows\system32\drivers\aswstm.sys [2014-3-23 68312]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2014-4-28 50344]
R2 avast! Firewall;avast! Firewall;c:\program files\alwil software\avast5\afwServ.exe [2014-5-29 109048]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2013-8-27 93072]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\drivers\yk62x86.sys [2009-9-28 315392]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 globalUpdate;globalUpdate Update Service (globalUpdate);c:\program files\globalupdate\update\GoogleUpdate.exe [2014-5-26 68608]
S3 AngelUsb;Angel USB MPEG Device;c:\windows\system32\drivers\AngelUsb.sys [2009-3-20 393472]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-4-21 229888]
S3 globalUpdatem;globalUpdate Update Service (globalUpdatem);c:\program files\globalupdate\update\GoogleUpdate.exe [2014-5-26 68608]
S3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\netw5v32.sys [2009-4-8 4231168]
.
=============== Created Last 30 ================
.
2014-06-07 23:38:08 74456 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-06-07 23:38:08 51928 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-06-07 23:38:08 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-06-07 23:38:08 -------- d-----w- c:\program files\Malwarebytes Anti-Malware
2014-06-07 23:23:49 -------- d-sh--w- C:\Boot
2014-06-05 18:23:16 -------- d-----w- c:\program files\ESET
2014-06-05 03:22:18 -------- d-----w- c:\windows\pss
2014-06-05 03:17:15 -------- d-----w- c:\programdata\Malwarebytes
2014-06-04 18:14:48 -------- d--h--w- c:\programdata\CanonIJEGV
2014-06-04 18:14:11 -------- d--h--w- c:\programdata\CanonIJMyPrinter
2014-06-04 18:02:40 -------- d--h--w- c:\programdata\CanonIJEPPEX2
2014-06-04 18:02:40 -------- d--h--w- c:\programdata\CanonEPP
2014-06-02 02:59:32 48128 ----a-w- c:\windows\system32\drivers\rimmptsk.sys
2014-06-02 02:59:32 44544 ----a-w- c:\windows\system32\drivers\rimsptsk.sys
2014-06-02 02:59:32 38400 ----a-w- c:\windows\system32\drivers\rixdptsk.sys
2014-06-02 02:59:31 172032 ----a-w- c:\windows\system32\rixdicon.dll
2014-06-02 02:39:45 8073384 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{017b6193-4aab-4f3a-aae6-71e6e66784c7}\mpengine.dll
2014-05-30 02:36:17 -------- d-----w- c:\users\m1530\appdata\local\Macromedia
2014-05-29 23:51:58 26136 ----a-w- c:\windows\system32\drivers\aswKbd.sys
2014-05-29 23:51:42 270240 ----a-w- c:\windows\system32\drivers\aswNdisFlt.sys
2014-05-26 21:32:49 -------- d-----w- c:\users\m1530\appdata\local\globalUpdate
2014-05-26 21:32:49 -------- d-----w- c:\program files\globalUpdate
2014-05-26 21:32:45 -------- d-----w- c:\program files\NewPlayer
2014-05-26 21:30:24 -------- d-----w- c:\users\m1530\appdata\local\Programs
2014-05-26 21:28:50 -------- d-----w- c:\users\m1530\appdata\local\SearchProtect
2014-05-13 01:34:02 -------- d-----w- c:\users\m1530\appdata\local\IAC
.
==================== Find3M ====================
.
2014-05-16 00:04:59 70832 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-05-16 00:04:59 692400 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-05-16 00:00:33 777488 ----a-w- c:\windows\system32\drivers\aswsnx.sys
2014-05-16 00:00:33 68312 ----a-w- c:\windows\system32\drivers\aswstm.sys
2014-04-28 12:18:45 81768 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2014-04-28 12:18:45 776976 ----a-w- c:\windows\system32\drivers\aswsnx.sys.1400198433162
2014-04-28 12:18:45 67824 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2014-04-28 12:18:45 49944 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2014-04-28 12:18:45 411552 ----a-w- c:\windows\system32\drivers\aswsp.sys.1400198433162
2014-04-28 12:18:45 24184 ----a-w- c:\windows\system32\drivers\aswHwid.sys
2014-04-28 12:18:45 180632 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2014-04-28 12:18:44 43152 ----a-w- c:\windows\avastSS.scr
.
============= FINISH: 18:39:10.43 ===============


Attach:

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Ultimate
Boot Device: \Device\HarddiskVolume1
Install Date: 2/11/2010 11:49:45 AM
System Uptime: 6/7/2014 5:55:19 PM (1 hours ago)
.
Motherboard: Dell Inc. | | 0XR148
Processor: Intel(R) Core(TM)2 Duo CPU T8100 @ 2.10GHz | Microprocessor | 2079/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 75 GiB total, 39.268 GiB free.
D: is FIXED (NTFS) - 73 GiB total, 52.197 GiB free.
E: is FIXED (NTFS) - 150 GiB total, 149.73 GiB free.
F: is CDROM ()
G: is CDROM (UDF)
H: is FIXED (NTFS) - 1397 GiB total, 1259.665 GiB free.
.
==== Disabled Device Manager Items =============
.
Class GUID:
Description: WD SES Device USB Device
Device ID: USBSTOR\OTHER&VEN_WD&PROD_SES_DEVICE&REV_2003\574D415A4130373634373637&2
Manufacturer:
Name: WD SES Device USB Device
PNP Device ID: USBSTOR\OTHER&VEN_WD&PROD_SES_DEVICE&REV_2003\574D415A4130373634373637&2
Service:
.
==== System Restore Points ===================
.
No restore point in system.
.
==== Installed Programs ======================
.
Adobe Flash Player 13 ActiveX
Adobe Flash Player 13 Plugin
Adobe Shockwave Player 11.5
Adobe Shockwave Player 12.1
avast! Internet Security
Canon Easy-PhotoPrint EX
CANON iMAGE GATEWAY Task for ZoomBrowser EX
Canon Internet Library for ZoomBrowser EX
Canon MOV Decoder
Canon MP Navigator EX 4.0
Canon MP495 series MP Drivers
Canon MP495 series User Registration
Canon My Printer
Canon Solution Menu EX
Canon Utilities CameraWindow
Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
Canon Utilities Digital Photo Professional 3.6
Canon Utilities EOS Utility
Canon Utilities MyCamera
Canon Utilities Original Data Security Tools
Canon Utilities PhotoStitch
Canon Utilities Picture Style Editor
Canon Utilities RemoteCapture Task for ZoomBrowser EX
Canon Utilities WFT-E1/E2/E3/E4 Utility
Canon Utilities ZoomBrowser EX
Canon ZoomBrowser EX Memory Card Utility
Dell Touchpad
EasyBCD 1.7.2
ESET Online Scanner v3
Fingerprint Reader Suite 5.6
FromDocToPDF Internet Explorer Toolbar
Google Chrome
Google Update Helper
HP Officejet Pro 8500 A910 Basic Device Software
HP Officejet Pro 8500 A910 Help
HP Officejet Pro 8500 A910 Product Improvement Study
HP Update
I.R.I.S. OCR
Intel(R) PROSet/Wireless Software
Laptop Integrated Webcam Driver (1.04.01.1011)
Malwarebytes Anti-Malware version 2.0.2.1012
Marketsplash Shortcuts
Marvell Miniport Driver
mCore
mDriver
mHelp
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
mMHouse
mPfMgr
mWMI
NewPlayer
NVIDIA Drivers
PowerDVD
RICOH Media Driver ver.2.07.01.04
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01
SigmaTel Audio
TomTom HOME
TomTom HOME Visual Studio Merge Modules
VLC media player 2.1.3
WIDCOMM Bluetooth Software 6.0.1.3100
Windows Live ID Sign-in Assistant
.
==== Event Viewer Messages From Past Week ========
.
6/7/2014 5:58:35 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Microsoft .NET Framework NGEN v4.0.30319_X86 service to connect.
6/7/2014 5:56:12 PM, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
6/7/2014 5:56:12 PM, Error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error %%-1073473535.
6/5/2014 12:40:12 PM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 1 time(s).
6/5/2014 12:39:56 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the MBAMScheduler service to connect.
6/5/2014 12:39:56 PM, Error: Service Control Manager [7000] - The MBAMScheduler service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/5/2014 12:37:44 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
6/5/2014 12:37:43 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments " " in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
6/5/2014 12:37:43 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments " " in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
6/5/2014 12:37:43 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments " " in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
6/5/2014 12:37:43 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments " " in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
6/5/2014 12:37:42 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
6/5/2014 12:37:37 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments " " in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
6/5/2014 12:37:26 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD aswNdisFlt aswRdr aswRvrt aswSnx aswSP aswVmm CSC DfsC discache NetBIOS NetBT nsiproxy Psched rdbss spldr tdx vwififlt Wanarpv6 WfpLwf
6/5/2014 12:37:26 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
6/5/2014 12:37:26 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
6/5/2014 12:37:26 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
6/5/2014 12:37:26 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
6/5/2014 12:37:26 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
6/5/2014 12:37:26 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.
6/5/2014 12:37:26 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
6/5/2014 12:37:26 PM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
6/5/2014 12:37:26 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
6/5/2014 12:37:26 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
6/4/2014 10:20:41 PM, Error: Service Control Manager [7000] - The FromDocToPDFService service failed to start due to the following error: The system cannot find the file specified.
6/1/2014 6:48:53 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0x00000004, 0x00000002, 0x00000001, 0x82c77651). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 060114-18798-01.
6/1/2014 6:27:26 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001a (0x00000031, 0x8a48d6c8, 0x80596000, 0xb20ebf6d). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 060114-19734-01.
6/1/2014 1:15:40 PM, Error: Schannel [36888] - The following fatal alert was generated: 40. The internal error state is 107.
6/1/2014 1:15:40 PM, Error: Schannel [36874] - An SSL 3.0 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed.
5/31/2014 3:52:44 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0x00001004, 0x00000002, 0x00000001, 0x82c3f651). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 053114-19422-01.
.
==== End Of File ===========================

 

Here is the RogueKiller report:

RogueKiller V9.0.2.0 [Jun 3 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7100 ) 32 bits version
Started in : Normal mode
User : M1530 [Admin rights]
Mode : Scan -- Date : 06/07/2014 21:38:55

¤¤¤ Bad processes : 1 ¤¤¤
[Suspicious.Path] OEM02Mon.exe -- C:\Windows\OEM02Mon.exe[7] -> KILLED [TermProc]

¤¤¤ Registry Entries : 13 ¤¤¤
[Suspicious.Path] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | OEM02Mon.exe : C:\Windows\OEM02Mon.exe -> FOUND
[PUM.Proxy] HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> FOUND
[PUM.Proxy] HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> FOUND
[PUM.Proxy] HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:49721;https=127.0.0.1:49721; -> FOUND
[PUM.Proxy] HKEY_USERS\S-1-5-21-199525533-572720544-984425971-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:49721;https=127.0.0.1:49721; -> FOUND
[PUM.Proxy] HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:49721;https=127.0.0.1:49721; -> FOUND
[PUM.SecurityCenter] HKEY_LOCAL_MACHINE\RK_Software_ON_D_A6DB\Microsoft\Security Center | AntiVirusDisableNotify : 1 -> FOUND
[PUM.SecurityCenter] HKEY_LOCAL_MACHINE\RK_Software_ON_D_A6DB\Microsoft\Security Center | FirewallDisableNotify : 1 -> FOUND
[PUM.SecurityCenter] HKEY_LOCAL_MACHINE\RK_Software_ON_D_A6DB\Microsoft\Security Center | UpdatesDisableNotify : 1 -> FOUND
[PUM.StartMenu] HKEY_USERS\RK_M1530_ON_D_B0B2\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowRecentDocs : 0 -> FOUND
[PUM.DesktopIcons] HKEY_LOCAL_MACHINE\RK_Software_ON_D_A6DB\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> FOUND
[PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> FOUND
[PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ HOSTS File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: WDC WD3200BEVT-60ZCT0 ATA Device +++++
--- User ---
[MBR] ee456c2591149e6c218c1898eb39c48d
[BSP] 178aeaa5b3b08f945226ec21d0f14918 : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 75022 MB
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 153645660 | Size: 76802 MB
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 310938075 | Size: 153417 MB
User = LL1 ... OK
User = LL2 ... OK


============================================
RKreport_SCN_06072014_202247.log

Attach:

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Ultimate
Boot Device: \Device\HarddiskVolume1
Install Date: 2/11/2010 11:49:45 AM
System Uptime: 6/7/2014 5:55:19 PM (1 hours ago)
.
Motherboard: Dell Inc. | | 0XR148
Processor: Intel(R) Core(TM)2 Duo CPU T8100 @ 2.10GHz | Microprocessor | 2079/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 75 GiB total, 39.268 GiB free.
D: is FIXED (NTFS) - 73 GiB total, 52.197 GiB free.
E: is FIXED (NTFS) - 150 GiB total, 149.73 GiB free.
F: is CDROM ()
G: is CDROM (UDF)
H: is FIXED (NTFS) - 1397 GiB total, 1259.665 GiB free.
.
==== Disabled Device Manager Items =============
.
Class GUID:
Description: WD SES Device USB Device
Device ID: USBSTOR\OTHER&VEN_WD&PROD_SES_DEVICE&REV_2003\574D415A4130373634373637&2
Manufacturer:
Name: WD SES Device USB Device
PNP Device ID: USBSTOR\OTHER&VEN_WD&PROD_SES_DEVICE&REV_2003\574D415A4130373634373637&2
Service:
.
==== System Restore Points ===================
.
No restore point in system.
.
==== Installed Programs ======================
.
Adobe Flash Player 13 ActiveX
Adobe Flash Player 13 Plugin
Adobe Shockwave Player 11.5
Adobe Shockwave Player 12.1
avast! Internet Security
Canon Easy-PhotoPrint EX
CANON iMAGE GATEWAY Task for ZoomBrowser EX
Canon Internet Library for ZoomBrowser EX
Canon MOV Decoder
Canon MP Navigator EX 4.0
Canon MP495 series MP Drivers
Canon MP495 series User Registration
Canon My Printer
Canon Solution Menu EX
Canon Utilities CameraWindow
Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
Canon Utilities Digital Photo Professional 3.6
Canon Utilities EOS Utility
Canon Utilities MyCamera
Canon Utilities Original Data Security Tools
Canon Utilities PhotoStitch
Canon Utilities Picture Style Editor
Canon Utilities RemoteCapture Task for ZoomBrowser EX
Canon Utilities WFT-E1/E2/E3/E4 Utility
Canon Utilities ZoomBrowser EX
Canon ZoomBrowser EX Memory Card Utility
Dell Touchpad
EasyBCD 1.7.2
ESET Online Scanner v3
Fingerprint Reader Suite 5.6
FromDocToPDF Internet Explorer Toolbar
Google Chrome
Google Update Helper
HP Officejet Pro 8500 A910 Basic Device Software
HP Officejet Pro 8500 A910 Help
HP Officejet Pro 8500 A910 Product Improvement Study
HP Update
I.R.I.S. OCR
Intel(R) PROSet/Wireless Software
Laptop Integrated Webcam Driver (1.04.01.1011)
Malwarebytes Anti-Malware version 2.0.2.1012
Marketsplash Shortcuts
Marvell Miniport Driver
mCore
mDriver
mHelp
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
mMHouse
mPfMgr
mWMI
NewPlayer
NVIDIA Drivers
PowerDVD
RICOH Media Driver ver.2.07.01.04
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01
SigmaTel Audio
TomTom HOME
TomTom HOME Visual Studio Merge Modules
VLC media player 2.1.3
WIDCOMM Bluetooth Software 6.0.1.3100
Windows Live ID Sign-in Assistant
.
==== Event Viewer Messages From Past Week ========
.
6/7/2014 5:58:35 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Microsoft .NET Framework NGEN v4.0.30319_X86 service to connect.
6/7/2014 5:56:12 PM, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
6/7/2014 5:56:12 PM, Error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error %%-1073473535.
6/5/2014 12:40:12 PM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 1 time(s).
6/5/2014 12:39:56 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the MBAMScheduler service to connect.
6/5/2014 12:39:56 PM, Error: Service Control Manager [7000] - The MBAMScheduler service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/5/2014 12:37:44 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
6/5/2014 12:37:43 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments " " in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
6/5/2014 12:37:43 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments " " in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
6/5/2014 12:37:43 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments " " in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
6/5/2014 12:37:43 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments " " in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
6/5/2014 12:37:42 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
6/5/2014 12:37:37 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments " " in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
6/5/2014 12:37:26 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD aswNdisFlt aswRdr aswRvrt aswSnx aswSP aswVmm CSC DfsC discache NetBIOS NetBT nsiproxy Psched rdbss spldr tdx vwififlt Wanarpv6 WfpLwf
6/5/2014 12:37:26 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
6/5/2014 12:37:26 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
6/5/2014 12:37:26 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
6/5/2014 12:37:26 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
6/5/2014 12:37:26 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
6/5/2014 12:37:26 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.
6/5/2014 12:37:26 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
6/5/2014 12:37:26 PM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
6/5/2014 12:37:26 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
6/5/2014 12:37:26 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
6/4/2014 10:20:41 PM, Error: Service Control Manager [7000] - The FromDocToPDFService service failed to start due to the following error: The system cannot find the file specified.
6/1/2014 6:48:53 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0x00000004, 0x00000002, 0x00000001, 0x82c77651). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 060114-18798-01.
6/1/2014 6:27:26 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000001a (0x00000031, 0x8a48d6c8, 0x80596000, 0xb20ebf6d). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 060114-19734-01.
6/1/2014 1:15:40 PM, Error: Schannel [36888] - The following fatal alert was generated: 40. The internal error state is 107.
6/1/2014 1:15:40 PM, Error: Schannel [36874] - An SSL 3.0 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed.
5/31/2014 3:52:44 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000000a (0x00001004, 0x00000002, 0x00000001, 0x82c3f651). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 053114-19422-01.
.
==== End Of File ===========================


MBAR:

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1012

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7100 Windows 7 x86

Account is Administrative

Internet Explorer version: 8.0.7100.0

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, E:\ DRIVE_FIXED
CPU speed: 2.094000 GHz
Memory total: 3756064768, free: 2278133760

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1012

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7100 Windows 7 x86

Account is Administrative

Internet Explorer version: 8.0.7100.0

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, E:\ DRIVE_FIXED
CPU speed: 2.094000 GHz
Memory total: 3756064768, free: 2291941376

Downloaded database version: v2014.06.08.01
Downloaded database version: v2014.06.02.01
=======================================


---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1012

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7100 Windows 7 x86

Account is Administrative

Internet Explorer version: 8.0.7100.0

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, E:\ DRIVE_FIXED
CPU speed: 2.094000 GHz
Memory total: 3756064768, free: 2033856512

Downloaded database version: v2014.06.08.01
Downloaded database version: v2014.06.02.01
Initializing...
======================
------------ Kernel report ------------
06/07/2014 22:21:36
------------ Loaded modules -----------
\SystemRoot\system32\ntkrnlpa.exe
\SystemRoot\system32\halmacpi.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\BOOTVID.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\DRIVERS\ACPI.sys
\SystemRoot\system32\DRIVERS\WMILIB.SYS
\SystemRoot\system32\DRIVERS\msisadrv.sys
\SystemRoot\system32\DRIVERS\pci.sys
\SystemRoot\system32\DRIVERS\vdrvroot.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\DRIVERS\compbatt.sys
\SystemRoot\system32\DRIVERS\BATTC.SYS
\SystemRoot\system32\DRIVERS\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\system32\DRIVERS\intelide.sys
\SystemRoot\system32\DRIVERS\PCIIDEX.SYS
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\DRIVERS\atapi.sys
\SystemRoot\system32\DRIVERS\ataport.SYS
\SystemRoot\system32\DRIVERS\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\DRIVERS\aswNdisFlt.sys
\SystemRoot\system32\DRIVERS\vmstorfl.sys
\SystemRoot\system32\DRIVERS\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\DRIVERS\disk.sys
\SystemRoot\system32\DRIVERS\CLASSPNP.SYS
\SystemRoot\System32\Drivers\aswVmm.sys
\SystemRoot\System32\Drivers\aswRvrt.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\system32\drivers\aswSnx.sys
\SystemRoot\system32\drivers\aswSP.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\system32\drivers\aswKbd.sys
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\system32\drivers\aswRdr2.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\vwififlt.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\system32\drivers\csc.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\nvlddmkm.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\DRIVERS\usbuhci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\yk62x86.sys
\SystemRoot\system32\DRIVERS\NETw4v32.sys
\SystemRoot\system32\DRIVERS\1394ohci.sys
\SystemRoot\system32\DRIVERS\sdbus.sys
\SystemRoot\system32\DRIVERS\rimmptsk.sys
\SystemRoot\system32\DRIVERS\rimsptsk.sys
\SystemRoot\system32\DRIVERS\rixdptsk.sys
\SystemRoot\system32\DRIVERS\i8042prt.sys
\SystemRoot\system32\DRIVERS\Apfiltr.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\CmBatt.sys
\SystemRoot\system32\DRIVERS\wmiacpi.sys
\SystemRoot\system32\DRIVERS\CompositeBus.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\rdpbus.sys
\SystemRoot\system32\DRIVERS\serscan.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\stwrt.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\OEM02Dev.sys
\SystemRoot\system32\DRIVERS\OEM02Vfx.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\System32\Drivers\tcusb.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_dumpata.sys
\SystemRoot\System32\Drivers\dump_atapi.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\drivers\aswMonFlt.sys
\SystemRoot\system32\drivers\WudfPf.sys
\SystemRoot\system32\drivers\aswStm.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\drivers\aswHwid.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\??\C:\Program Files\CyberLink\PowerDVD DX\000.fcl
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\??\C:\Windows\System32\drivers\TrueSight.sys
\SystemRoot\system32\drivers\spsys.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
\Windows\System32\autochk.exe
\Windows\System32\user32.dll
\Windows\System32\imagehlp.dll
\Windows\System32\ws2_32.dll
\Windows\System32\shlwapi.dll
\Windows\System32\msvcrt.dll
\Windows\System32\urlmon.dll
\Windows\System32\psapi.dll
\Windows\System32\rpcrt4.dll
\Windows\System32\difxapi.dll
\Windows\System32\iertutil.dll
\Windows\System32\setupapi.dll
\Windows\System32\sechost.dll
\Windows\System32\kernel32.dll
\Windows\System32\ole32.dll
\Windows\System32\normaliz.dll
\Windows\System32\advapi32.dll
\Windows\System32\comdlg32.dll
\Windows\System32\wininet.dll
\Windows\System32\shell32.dll
\Windows\System32\gdi32.dll
\Windows\System32\lpk.dll
\Windows\System32\nsi.dll
\Windows\System32\imm32.dll
\Windows\System32\oleaut32.dll
\Windows\System32\msctf.dll
\Windows\System32\Wldap32.dll
\Windows\System32\usp10.dll
\Windows\System32\clbcatq.dll
\Windows\System32\KernelBase.dll
\Windows\System32\wintrust.dll
\Windows\System32\crypt32.dll
\Windows\System32\devobj.dll
\Windows\System32\cfgmgr32.dll
\Windows\System32\comctl32.dll
\Windows\System32\msasn1.dll
----------- End -----------
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xffffffff86509030
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP1T0L0-1\
Lower Device Object: 0xffffffff8609c340
Lower Device Driver Name: \Driver\atapi\
<<<2>>>
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff86509030, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff865082e8, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff86509030, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff8609c340, DeviceName: \Device\Ide\IdeDeviceP1T0L0-1\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
Done!
Drive 0
This is a System drive
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 836EB4FE

Partition information:

Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 63 Numsec = 153645597
Partition file system is NTFS
Partition is bootable

Partition 1 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 153645660 Numsec = 157292415

Partition 2 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 310938075 Numsec = 314199270

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 320072933376 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-62-625122448-625142448)...
Done!
Scan finished
=======================================


Removal queue found; removal started
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-0-63-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
Removal finished

 

Sorry.

I believe this is it:

RogueKiller V9.0.2.0 [Jun 3 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7100 ) 32 bits version
Started in : Normal mode
User : M1530 [Admin rights]
Mode : Remove -- Date : 06/07/2014 22:19:16

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 13 ¤¤¤
[Suspicious.Path] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | OEM02Mon.exe : C:\Windows\OEM02Mon.exe [x] -> DELETED
[PUM.Proxy] HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> NOT SELECTED
[PUM.Proxy] HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> NOT SELECTED
[PUM.Proxy] HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:49721;https=127.0.0.1:49721; -> NOT SELECTED
[PUM.Proxy] HKEY_USERS\S-1-5-21-199525533-572720544-984425971-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:49721;https=127.0.0.1:49721; -> NOT SELECTED
[PUM.Proxy] HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:49721;https=127.0.0.1:49721; -> NOT SELECTED
[PUM.SecurityCenter] HKEY_LOCAL_MACHINE\RK_Software_ON_D_C0E2\Microsoft\Security Center | AntiVirusDisableNotify : 1 -> NOT SELECTED
[PUM.SecurityCenter] HKEY_LOCAL_MACHINE\RK_Software_ON_D_C0E2\Microsoft\Security Center | FirewallDisableNotify : 1 -> NOT SELECTED
[PUM.SecurityCenter] HKEY_LOCAL_MACHINE\RK_Software_ON_D_C0E2\Microsoft\Security Center | UpdatesDisableNotify : 1 -> NOT SELECTED
[PUM.StartMenu] HKEY_USERS\RK_M1530_ON_D_3332\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowRecentDocs : 0 -> NOT SELECTED
[PUM.DesktopIcons] HKEY_LOCAL_MACHINE\RK_Software_ON_D_C0E2\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> NOT SELECTED
[PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> NOT SELECTED
[PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> NOT SELECTED

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ HOSTS File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: WDC WD3200BEVT-60ZCT0 ATA Device +++++
--- User ---
[MBR] ee456c2591149e6c218c1898eb39c48d
[BSP] 178aeaa5b3b08f945226ec21d0f14918 : Windows Vista/7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 75022 MB
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 153645660 | Size: 76802 MB
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 310938075 | Size: 153417 MB
User = LL1 ... OK
User = LL2 ... OK


============================================
RKreport_SCN_06072014_202247.log - RKreport_SCN_06072014_213855.log - RKreport_SCN_06072014_221058.log

 

Broni,

Here is Rkill. Combofix will not run. keeps telling me not to run it "in compatibility mode" in normal and safemode.

Rkill 2.6.6 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2014 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 06/08/2014 07:27:41 PM in x86 mode. (Safe Mode)
Windows Version: Windows 7 Ultimate

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* No malware processes found to kill.

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* No issues found.

Checking Windows Service Integrity:

* Base Filtering Engine (BFE) is not Running.
Startup Type set to: Automatic

* DHCP Client (Dhcp) is not Running.
Startup Type set to: Automatic

* DNS Client (Dnscache) is not Running.
Startup Type set to: Automatic

* COM+ Event System (EventSystem) is not Running.
Startup Type set to: Automatic

* Windows Firewall (MpsSvc) is not Running.
Startup Type set to: Automatic

* Network Connections (Netman) is not Running.
Startup Type set to: Manual

* Network Store Interface Service (nsi) is not Running.
Startup Type set to: Automatic

* Security Center (wscsvc) is not Running.
Startup Type set to: Automatic (Delayed Start)

* Windows Update (wuauserv) is not Running.
Startup Type set to: Automatic (Delayed Start)

* Ancillary Function Driver for Winsock (AFD) is not Running.
Startup Type set to: System

* Windows Firewall Authorization Driver (mpsdrv) is not Running.
Startup Type set to: Manual

* NetBT (NetBT) is not Running.
Startup Type set to: System

* NSI proxy service driver. (nsiproxy) is not Running.
Startup Type set to: System

* NetIO Legacy TDI Support Driver (tdx) is not Running.
Startup Type set to: System

Searching for Missing Digital Signatures:

* No issues found.

Checking HOSTS File:

* No issues found.

Program finished at: 06/08/2014 07:28:21 PM
Execution time: 0 hours(s), 0 minute(s), and 40 seconds(s)

 

awdcleaner:

# AdwCleaner v3.212 - Report created 08/06/2014 at 19:48:19
# Updated 05/06/2014 by Xplode
# Operating System : Windows 7 Ultimate (32 bits)
# Username : M1530 - M1530-PC
# Running from : C:\Users\M1530\Downloads\adwcleaner_3.212.exe
# Option : Clean

***** [ Services ] *****

[#] Service Deleted : globalUpdate
[#] Service Deleted : globalUpdatem

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NewPlayer
Folder Deleted : C:\Program Files\globalUpdate
Folder Deleted : C:\Program Files\NewPlayer
Folder Deleted : C:\Users\M1530\AppData\Local\globalUpdate
Folder Deleted : C:\Users\M1530\AppData\Local\iac
Folder Deleted : C:\Users\M1530\AppData\Local\SearchProtect
Folder Deleted : C:\Users\M1530\AppData\LocalLow\FromDocToPDF_65
Folder Deleted : C:\Users\M1530\AppData\LocalLow\iac
File Deleted : C:\END
File Deleted : C:\Users\Public\Desktop\NewPlayer.lnk
File Deleted : C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job
File Deleted : C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineCore
File Deleted : C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job
File Deleted : C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineUA

***** [ Shortcuts ] *****


***** [ Registry ] *****

[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{8CDF4AD9-DEC8-4CDE-850A-E0F7329371A1}
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8CDF4AD9-DEC8-4CDE-850A-E0F7329371A1}
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{881F3109-904A-4EF0-86AA-7E19465C3C6E}
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{881F3109-904A-4EF0-86AA-7E19465C3C6E}
[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{870CAA10-C1DB-4BC9-95FC-3DFBA57E06B1}
Key Deleted : HKLM\SOFTWARE\Classes\FromDocToPDF_65.FeedManager
Key Deleted : HKLM\SOFTWARE\Classes\FromDocToPDF_65.FeedManager.1
Key Deleted : HKLM\SOFTWARE\Classes\FromDocToPDF_65.HTMLMenu
Key Deleted : HKLM\SOFTWARE\Classes\FromDocToPDF_65.HTMLMenu.1
Key Deleted : HKLM\SOFTWARE\Classes\FromDocToPDF_65.HTMLPanel
Key Deleted : HKLM\SOFTWARE\Classes\FromDocToPDF_65.HTMLPanel.1
Key Deleted : HKLM\SOFTWARE\Classes\FromDocToPDF_65.MultipleButton
Key Deleted : HKLM\SOFTWARE\Classes\FromDocToPDF_65.MultipleButton.1
Key Deleted : HKLM\SOFTWARE\Classes\FromDocToPDF_65.PseudoTransparentPlugin
Key Deleted : HKLM\SOFTWARE\Classes\FromDocToPDF_65.PseudoTransparentPlugin.1
Key Deleted : HKLM\SOFTWARE\Classes\FromDocToPDF_65.Radio
Key Deleted : HKLM\SOFTWARE\Classes\FromDocToPDF_65.Radio.1
Key Deleted : HKLM\SOFTWARE\Classes\FromDocToPDF_65.RadioSettings
Key Deleted : HKLM\SOFTWARE\Classes\FromDocToPDF_65.RadioSettings.1
Key Deleted : HKLM\SOFTWARE\Classes\FromDocToPDF_65.ScriptButton
Key Deleted : HKLM\SOFTWARE\Classes\FromDocToPDF_65.ScriptButton.1
Key Deleted : HKLM\SOFTWARE\Classes\FromDocToPDF_65.SettingsPlugin
Key Deleted : HKLM\SOFTWARE\Classes\FromDocToPDF_65.SettingsPlugin.1
Key Deleted : HKLM\SOFTWARE\Classes\FromDocToPDF_65.ThirdPartyInstaller
Key Deleted : HKLM\SOFTWARE\Classes\FromDocToPDF_65.ThirdPartyInstaller.1
Key Deleted : HKLM\SOFTWARE\Classes\FromDocToPDF_65.ToolbarProtector
Key Deleted : HKLM\SOFTWARE\Classes\FromDocToPDF_65.ToolbarProtector.1
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\optimizerpro_rasapi32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\optimizerpro_rasmancs
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\optprostart_rasapi32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\optprostart_rasmancs
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\wajam_download_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\wajam_download_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\wajam_install_rasapi32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\wajam_install_rasmancs
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WajamInternetEnhancer_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WajamInternetEnhancer_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WajamInternetEnhancerService_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WajamInternetEnhancerService_RASMANCS
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=10
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=4
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{017D68F2-19B3-41AE-9D8A-8B09DBD25479}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{2BD4465D-669A-42E6-B449-636B0B10EBB8}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3700B685-D795-4E17-9B78-73BCEE5D4086}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3E6260AC-BC6F-44B4-942B-1568C367543A}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{504B4AA9-9952-4490-B0E1-80A5321C35F7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{72D05120-DF65-4C27-921E-899B5267FEF2}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE84501A-2CB6-41D6-B3A7-9679BDBDFA0B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AFA196F4-80E5-47AD-B7BC-C671487D36FB}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B7FD68F7-D28B-431E-9EE8-E45D915B7F17}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{BC7E25D7-4681-46A3-AF5A-9A1B865783ED}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CBBEA4B9-B183-47AC-8B1F-FD526AC99A8D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CD1D181E-C654-4CA5-9D09-B3648537FD7D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E0C3A839-0E5E-4EBC-9F8F-E56F8FC732CE}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E1C4699E-5E74-4F30-A4A2-378E45D44F07}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FC2B119B-2352-4E7A-9197-B9E1BBADE61B}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{36B445BF-1B84-466A-A623-A360A8CFF8C3}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6CBF5C01-C876-481B-867E-111CB1D2A7D6}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{1747AE4D-0A83-4336-84D4-48500BF1554F}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2C9D27D8-C81E-4968-8026-E725E01650C1}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{3BB1BA04-1B88-4690-9AD3-0D38412F5FF1}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{3EFEC319-72E8-42AA-AC38-8CF8A0661CDD}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4D8AEB1D-4ED4-44AC-A039-4775B2575DB0}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{6191571E-F7EE-47C3-B229-2DFAC70DB5D2}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74C02D12-FAEE-4834-80D2-5B7D2480AD61}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{840AE8AE-D547-433E-985C-6BF6C74F5084}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{A85ACA7E-5CD2-461B-877A-994CCCCF491C}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{BF6FDBB8-7CD5-402D-AB4F-E4F13D3490C8}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{E3CDDB72-3ADC-4920-B42B-68A8C29FA942}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{2BD4465D-669A-42E6-B449-636B0B10EBB8}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{BC7E25D7-4681-46A3-AF5A-9A1B865783ED}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{CBBEA4B9-B183-47AC-8B1F-FD526AC99A8D}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{E1C4699E-5E74-4F30-A4A2-378E45D44F07}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{FC2B119B-2352-4E7A-9197-B9E1BBADE61B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{36B445BF-1B84-466A-A623-A360A8CFF8C3}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6CBF5C01-C876-481B-867E-111CB1D2A7D6}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{701F5C41-BB30-46DA-A56B-68784B0B762B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A3B975A0-F679-444E-9D94-6D292FA53140}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0C3A839-0E5E-4EBC-9F8F-E56F8FC732CE}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9A216821-0EC5-49A3-85AC-FB72AE79A1E8}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9A216821-0EC5-49A3-85AC-FB72AE79A1E8}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{C66A678D-5E6C-4AF9-8F57-C6192F42CF74}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{C66A678D-5E6C-4AF9-8F57-C6192F42CF74}]
Key Deleted : HKCU\Software\FreeSoftToday
Key Deleted : HKCU\Software\installedbrowserextensions
Key Deleted : HKCU\Software\Tutorials
Key Deleted : HKCU\Software\TutoTag
Key Deleted : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Deleted : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Deleted : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Deleted : HKLM\Software\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Key Deleted : HKLM\Software\installedbrowserextensions
Key Deleted : HKLM\Software\NewPlayer
Key Deleted : HKLM\Software\Tutorials
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FromDocToPDF_65bar Uninstall Firefox
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FromDocToPDF_65bar Uninstall Internet Explorer
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NewPlayer

***** [ Browsers ] *****

-\\ Internet Explorer v8.0.7100.0


-\\ Mozilla Firefox v

[ File : C:\Users\M1530\AppData\Roaming\Mozilla\Firefox\Profiles\d8cxbk6y.default\prefs.js ]

Line Deleted : user_pref( "extensions.acda2aa034bc94ec79498460a0930b748ad411bc85385474c96adae0bd30853a6com53170.53170.internaldb.monetization_plugin_bundledUrls.value ", "%7B%22dealply_s%22%3A%7B%22urls%22%3A%5B%22ssf[...]

-\\ Google Chrome v35.0.1916.114

[ File : C:\Users\M1530\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted [Search Provider] : hxxp://search.aol.com/aol/search?query={searchTerms}
Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}
Deleted [Search Provider] : hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3324921&octid=EB_ORIGINAL_CTID&ISID=MFAEF9399-D35A-418D-A464-EBC41AB8EDB4&SearchSource=58&CUI=&UM=5&UP=SP572C9A46-A7FA-44FC-AE06-D47B8D602E12&q={searchTerms}&SSPV=
Deleted [Extension] : booedmolknjekdopkepjjeckmjkdpfgl
Deleted [Extension] : flpcjncodpafbgdpnkljologafpionhb

*************************

AdwCleaner[R0].txt - [10449 octets] - [08/06/2014 19:47:05]
AdwCleaner[S0].txt - [10637 octets] - [08/06/2014 19:48:19]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [10698 octets] ##########

JRT:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Ultimate x86
Ran by M1530 on Sun 06/08/2014 at 19:52:37.64
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sun 06/08/2014 at 19:55:50.09
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Farbar:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:06-06-2014
Ran by M1530 (administrator) on M1530-PC on 08-06-2014 19:57:05
Running from C:\Users\M1530\Downloads
Platform: Microsoft Windows 7 Ultimate (X86) OS Language: English(US)
Internet Explorer Version 8
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(UPEK Inc.) C:\Program Files\Fingerprint Reader Suite\upeksvr.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\afwServ.exe
(Andrea Electronics Corporation) C:\Windows\System32\AEstSrv.exe
(Intel Corporation) C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\VS7DEBUG\mdm.exe
(Intel Corporation) C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
(IDT, Inc.) C:\Windows\System32\stacsv.exe
(TomTom) C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Google Inc.) C:\Program Files\Google\Update\1.3.24.7\GoogleCrashHandler.exe
(UPEK Inc.) C:\Program Files\Fingerprint Reader Suite\psqltray.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
(IDT, Inc.) C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\avastui.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(CANON INC.) C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(TomTom) C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApntEx.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\hidfind.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [PSQLLauncher] => C:\Program Files\Fingerprint Reader Suite\launcher.exe [49168 2007-04-16] (UPEK Inc.)
HKLM\...\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [159744 2007-07-02] (Alps Electric Co., Ltd.)
HKLM\...\Run: [NvSvc] => C:\Windows\system32\nvsvc.dll [86016 2007-09-13] (NVIDIA Corporation)
HKLM\...\Run: [NvCplDaemon] => C:\Windows\system32\NvCpl.dll [8497696 2007-09-13] (NVIDIA Corporation)
HKLM\...\Run: [NvMediaCenter] => C:\Windows\system32\NvMcTray.dll [81920 2007-09-13] (NVIDIA Corporation)
HKLM\...\Run: [NVHotkey] => C:\Windows\system32\nvHotkey.dll [81920 2007-09-13] (NVIDIA Corporation)
HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM\...\Run: [PDVDDXSrv] => C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe [128296 2008-10-27] (CyberLink Corp.)
HKLM\...\Run: [SigmatelSysTrayApp] => C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe [405504 2007-09-07] (IDT, Inc.)
HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2010-03-12] (Hewlett-Packard)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [3888648 2014-05-26] (AVAST Software)
HKLM\...\Run: [FromDocToPDF EPM Support] => "C:\PROGRA~1\FROMDO~2\bar\1.bin\65medint.exe" T8EPMSUP.DLL,S
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2516296 2010-03-24] (CANON INC.)
HKLM\...\Run: [CanonSolutionMenuEx] => C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE [1185112 2010-04-02] (CANON INC.)
Winlogon\Notify\psfus: C:\Windows\system32\psqlpwd.dll (UPEK Inc.)
HKU\S-1-5-21-199525533-572720544-984425971-1000\...\Run: [TomTomHOME.exe] => C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe [248208 2013-08-27] (TomTom)
HKU\S-1-5-21-199525533-572720544-984425971-1000\...\MountPoints2: {1946fbc9-eda4-11e3-b52b-806e6f6e6963} - "G:\WD SmartWare.exe" autoplay=true
HKU\S-1-5-21-199525533-572720544-984425971-1000\...\MountPoints2: {6ee3abf9-1063-11e0-aa57-806e6f6e6963} - G:\VZAccess_Manager.exe /z detect
Lsa: [Notification Packages] scecli psqlpwd
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\Users\M1530\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

ProxyServer: http=127.0.0.1:49721;https=127.0.0.1:49721;
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.yhs4.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.yahoo.com?fr=hp-avast&type=avastbcl
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.yahoo.com?fr=hp-avast&type=avastbcl
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.yahoo.com?fr=hp-avast&type=avastbcl
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = http://us.yhs4.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms}
SearchScopes: HKCU - {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = http://us.yhs4.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms}
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\M1530\AppData\Roaming\Mozilla\Firefox\Profiles\d8cxbk6y.default
FF DefaultSearchEngine: Bing
FF Keyword.URL: hxxp://www.bing.com/search?FORM=IP2TDF&PC=IP2TDF&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @canon.com/EPPEX - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin: @canon.com/MycameraPlugin - C:\Program Files\Canon\ZoomBrowser EX\Program\NPCIG.dll (CANON INC.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.3 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Extension: Microsoft .NET Framework Assistant - C:\Users\M1530\AppData\Roaming\Mozilla\Firefox\Profiles\d8cxbk6y.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-05-10]
FF Extension: avast! Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2014-03-23]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2014-03-23]

Chrome:
=======
CHR HomePage: https://www.yahoo.com?fr=hp-avast&type=avastbcl
CHR StartupUrls: "https://www.yahoo.com?fr=hp-avast&type=avastbcl "
CHR DefaultSearchKeyword: www.yahoo.com
CHR DefaultSearchProvider: Yahoo! (Avast)
CHR DefaultSearchURL: http://us.yhs4.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms}
CHR DefaultNewTabURL:
CHR Extension: (Google Docs) - C:\Users\M1530\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-23]
CHR Extension: (Google Drive) - C:\Users\M1530\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-23]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\M1530\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-26]
CHR Extension: (YouTube) - C:\Users\M1530\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-23]
CHR Extension: (Google Search) - C:\Users\M1530\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-23]
CHR Extension: (Google Wallet) - C:\Users\M1530\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-03-23]
CHR Extension: (Gmail) - C:\Users\M1530\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-23]
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\Alwil Software\Avast5\WebRep\Chrome\aswWebRepChrome.crx [2014-04-28]

========================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [50344 2014-04-28] (AVAST Software)
R2 avast! Firewall; C:\Program Files\Alwil Software\Avast5\afwServ.exe [109048 2014-05-29] (AVAST Software)
S4 sppuinotify; %SystemRoot%\system32\sppuinotify.dll [X]

==================== Drivers (Whitelisted) ====================

S3 amdsata; C:\Windows\system32\DRIVERS\amdsata.sys [77904 2009-04-22] (AMD)
R0 amdxata; C:\Windows\System32\DRIVERS\amdxata.sys [23120 2009-04-22] (AMD)
S3 AngelUsb; C:\Windows\System32\DRIVERS\AngelUsb.sys [393472 2009-04-21] (Lumanate, Inc.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-04-28] ()
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [26136 2014-05-29] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [67824 2014-04-28] (AVAST Software)
R0 aswNdisFlt; C:\Windows\System32\DRIVERS\aswNdisFlt.sys [270240 2014-05-29] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [81768 2014-04-28] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2014-04-28] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [777488 2014-05-15] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [411680 2014-05-15] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [68312 2014-05-15] (AVAST Software)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [180632 2014-04-28] ()
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [26624 2014-06-08] ()
R3 yukonw7; C:\Windows\System32\DRIVERS\yk62x86.sys [315392 2009-09-28] ()
R2 {1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7}; C:\Program Files\CyberLink\PowerDVD DX\000.fcl [87536 2008-10-27] (CyberLink Corp.)
S3 DFUBTUSB; System32\Drivers\frmupgr.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-08 19:57 - 2014-06-08 19:57 - 00013334 _____ () C:\Users\M1530\Downloads\FRST.txt
2014-06-08 19:56 - 2014-06-08 19:57 - 00000000 ____D () C:\FRST
2014-06-08 19:55 - 2014-06-08 19:56 - 00000629 _____ () C:\Users\M1530\Desktop\JRT.txt
2014-06-08 19:52 - 2014-06-08 19:52 - 00010779 _____ () C:\Users\M1530\Desktop\AdwCleaner[S0].txt
2014-06-08 19:52 - 2014-06-08 19:52 - 00000000 ____D () C:\Windows\ERUNT
2014-06-08 19:47 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll
2014-06-08 19:41 - 2014-06-08 19:48 - 00000000 ____D () C:\AdwCleaner
2014-06-08 19:40 - 2014-06-08 19:41 - 01063424 _____ (Farbar) C:\Users\M1530\Downloads\FRST.exe
2014-06-08 19:40 - 2014-06-08 19:40 - 01333465 _____ () C:\Users\M1530\Downloads\adwcleaner_3.212.exe
2014-06-08 19:40 - 2014-06-08 19:40 - 01016261 _____ (Thisisu) C:\Users\M1530\Downloads\JRT.exe
2014-06-08 19:22 - 2014-06-08 19:22 - 05205146 ____R (Swearware) C:\Users\M1530\Desktop\mitch_cooley.exe
2014-06-08 19:20 - 2014-06-08 19:28 - 00004456 _____ () C:\Users\M1530\Desktop\Rkill.txt
2014-06-08 19:18 - 2014-06-08 19:18 - 01940216 _____ (Bleeping Computer, LLC) C:\Users\M1530\Downloads\rkill.exe
2014-06-08 19:15 - 2014-06-08 19:29 - 00000000 ___SD () C:\32788R22FWJFW
2014-06-08 19:15 - 2014-06-08 19:15 - 00000000 ____D () C:\Windows\erdnt
2014-06-08 07:43 - 2014-06-08 07:43 - 00144120 _____ () C:\Windows\Minidump\060814-33852-01.dmp
2014-06-07 22:21 - 2014-06-07 22:28 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-06-07 22:21 - 2014-06-07 22:21 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-07 21:49 - 2014-06-07 22:28 - 00000000 ____D () C:\Users\M1530\Desktop\mbar
2014-06-07 21:49 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-07 21:48 - 2014-06-07 21:48 - 00003251 _____ () C:\Users\M1530\Desktop\RKreport_SCN_06072014_213855.log
2014-06-07 21:28 - 2014-06-08 07:43 - 260816951 _____ () C:\Windows\MEMORY.DMP
2014-06-07 21:28 - 2014-06-07 21:28 - 00144120 _____ () C:\Windows\Minidump\060714-37580-01.dmp
2014-06-07 20:14 - 2014-06-08 15:21 - 00026624 _____ () C:\Windows\system32\Drivers\TrueSight.sys
2014-06-07 20:14 - 2014-06-07 20:14 - 14349744 _____ (Malwarebytes Corp.) C:\Users\M1530\Downloads\mbar-1.07.0.1012.exe
2014-06-07 20:14 - 2014-06-07 20:14 - 00000000 ____D () C:\ProgramData\RogueKiller
2014-06-07 20:13 - 2014-06-07 20:13 - 04686336 _____ () C:\Users\M1530\Downloads\RogueKiller.exe
2014-06-07 18:39 - 2014-06-07 18:39 - 00013043 _____ () C:\Users\M1530\Desktop\dds.txt
2014-06-07 18:39 - 2014-06-07 18:39 - 00011039 _____ () C:\Users\M1530\Desktop\attach.txt
2014-06-07 18:37 - 2014-06-07 18:37 - 00688992 ____R (Swearware) C:\Users\M1530\Downloads\dds.com
2014-06-07 18:36 - 2014-06-07 18:37 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\M1530\Downloads\mbam-setup-2.0.2.1012 (2).exe
2014-06-07 18:06 - 2014-06-07 18:06 - 00002626 _____ () C:\Users\M1530\Downloads\legitcheck (1).hta
2014-06-07 18:05 - 2014-06-07 18:05 - 00002626 _____ () C:\Users\M1530\Downloads\legitcheck.hta
2014-06-05 13:23 - 2014-06-05 13:23 - 00000000 ____D () C:\Program Files\ESET
2014-06-05 13:22 - 2014-06-05 13:23 - 02347384 _____ (ESET) C:\Users\M1530\Downloads\esetsmartinstaller_enu.exe
2014-06-05 12:40 - 2014-06-05 12:41 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\M1530\Downloads\mbam-setup-2.0.2.1012 (1).exe
2014-06-05 12:18 - 2014-06-05 12:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-06-05 12:08 - 2014-06-05 12:08 - 00400968 _____ (www.patchmypc.net) C:\Users\M1530\Downloads\PatchMyPC.exe
2014-06-04 22:22 - 2014-06-08 19:29 - 00000000 ____D () C:\Windows\pss
2014-06-04 22:17 - 2014-06-07 22:21 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-04 22:14 - 2014-06-04 22:16 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\M1530\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-04 13:14 - 2014-06-04 13:14 - 00000000 ___HD () C:\ProgramData\CanonIJMyPrinter
2014-06-04 13:14 - 2014-06-04 13:14 - 00000000 ___HD () C:\ProgramData\CanonIJEGV
2014-06-04 13:12 - 2014-06-04 13:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MP495 series User Registration
2014-06-04 13:09 - 2014-06-04 13:09 - 00002022 _____ () C:\Users\Public\Desktop\Canon Solution Menu EX.lnk
2014-06-04 13:06 - 2014-06-04 13:06 - 00002301 _____ () C:\Users\Public\Desktop\Canon MP495 series On-screen Manual.lnk
2014-06-04 13:06 - 2014-06-04 13:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MP495 series Manual
2014-06-04 13:05 - 2014-06-04 13:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MP495 series
2014-06-04 13:02 - 2014-06-04 13:02 - 00000000 ___HD () C:\ProgramData\CanonIJEPPEX2
2014-06-04 13:02 - 2014-06-04 13:02 - 00000000 ___HD () C:\ProgramData\CanonEPP
2014-06-01 21:59 - 2009-06-25 16:58 - 00048128 _____ (REDC) C:\Windows\system32\Drivers\rimmptsk.sys
2014-06-01 21:59 - 2009-06-25 16:25 - 00038400 _____ (REDC) C:\Windows\system32\Drivers\rixdptsk.sys
2014-06-01 21:59 - 2009-06-25 16:10 - 00044544 _____ (REDC) C:\Windows\system32\Drivers\rimsptsk.sys
2014-06-01 21:59 - 2007-07-25 12:48 - 00172032 _____ (Ricoh Company,Ltd) C:\Windows\system32\rixdicon.dll
2014-06-01 13:00 - 2014-06-01 13:00 - 00001414 _____ () C:\Users\M1530\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-05-31 09:39 - 2014-05-31 09:39 - 00282928 _____ (Mozilla) C:\Users\M1530\Downloads\Firefox Setup Stub 29.0.1(3).exe
2014-05-31 09:37 - 2014-05-31 09:38 - 00282928 _____ (Mozilla) C:\Users\M1530\Downloads\Firefox Setup Stub 29.0.1(2).exe
2014-05-30 20:50 - 2014-05-30 20:51 - 00282928 _____ (Mozilla) C:\Users\M1530\Downloads\Firefox Setup Stub 29.0.1.exe
2014-05-29 21:36 - 2014-05-29 21:36 - 00000000 ____D () C:\Users\M1530\AppData\Local\Macromedia
2014-05-29 18:53 - 2014-05-29 18:53 - 00002069 _____ () C:\Users\Public\Desktop\avast! Internet Security.lnk
2014-05-29 18:51 - 2014-05-29 18:52 - 00270240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswNdisFlt.sys
2014-05-29 18:51 - 2014-05-29 18:51 - 00026136 _____ (AVAST Software) C:\Windows\system32\Drivers\aswKbd.sys
2014-05-28 21:24 - 2014-06-08 07:43 - 00000000 ____D () C:\Windows\Minidump
2014-05-26 16:36 - 2014-05-26 16:36 - 00000000 ____D () C:\ProgramData\TEMP
2014-05-26 16:30 - 2014-05-26 16:30 - 00000000 ____D () C:\Users\M1530\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Weather Alerts

==================== One Month Modified Files and Folders =======

2014-06-08 19:57 - 2014-06-08 19:57 - 00013334 _____ () C:\Users\M1530\Downloads\FRST.txt
2014-06-08 19:57 - 2014-06-08 19:56 - 00000000 ____D () C:\FRST
2014-06-08 19:57 - 2010-02-11 12:49 - 00000000 ____D () C:\Users\M1530\AppData\Local\Temp
2014-06-08 19:57 - 2009-04-22 03:08 - 00012656 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-08 19:57 - 2009-04-22 03:08 - 00012656 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-08 19:56 - 2014-06-08 19:55 - 00000629 _____ () C:\Users\M1530\Desktop\JRT.txt
2014-06-08 19:53 - 2010-02-11 15:40 - 01831228 _____ () C:\Windows\WindowsUpdate.log
2014-06-08 19:52 - 2014-06-08 19:52 - 00010779 _____ () C:\Users\M1530\Desktop\AdwCleaner[S0].txt
2014-06-08 19:52 - 2014-06-08 19:52 - 00000000 ____D () C:\Windows\ERUNT
2014-06-08 19:51 - 2014-03-23 11:17 - 00000880 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-08 19:51 - 2010-04-04 21:08 - 00027335 _____ () C:\Users\M1530\AppData\Roaming\nvModes.001
2014-06-08 19:49 - 2010-02-11 13:44 - 00323096 _____ () C:\Windows\PFRO.log
2014-06-08 19:49 - 2009-04-22 03:27 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-08 19:49 - 2009-04-22 03:12 - 00052448 _____ () C:\Windows\setupact.log
2014-06-08 19:48 - 2014-06-08 19:41 - 00000000 ____D () C:\AdwCleaner
2014-06-08 19:41 - 2014-06-08 19:40 - 01063424 _____ (Farbar) C:\Users\M1530\Downloads\FRST.exe
2014-06-08 19:40 - 2014-06-08 19:40 - 01333465 _____ () C:\Users\M1530\Downloads\adwcleaner_3.212.exe
2014-06-08 19:40 - 2014-06-08 19:40 - 01016261 _____ (Thisisu) C:\Users\M1530\Downloads\JRT.exe
2014-06-08 19:39 - 2014-03-23 11:17 - 00000884 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-08 19:29 - 2014-06-08 19:15 - 00000000 ___SD () C:\32788R22FWJFW
2014-06-08 19:29 - 2014-06-04 22:22 - 00000000 ____D () C:\Windows\pss
2014-06-08 19:28 - 2014-06-08 19:20 - 00004456 _____ () C:\Users\M1530\Desktop\Rkill.txt
2014-06-08 19:22 - 2014-06-08 19:22 - 05205146 ____R (Swearware) C:\Users\M1530\Desktop\mitch_cooley.exe
2014-06-08 19:18 - 2014-06-08 19:18 - 01940216 _____ (Bleeping Computer, LLC) C:\Users\M1530\Downloads\rkill.exe
2014-06-08 19:15 - 2014-06-08 19:15 - 00000000 ____D () C:\Windows\erdnt
2014-06-08 19:12 - 2014-03-21 08:00 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-08 15:21 - 2014-06-07 20:14 - 00026624 _____ () C:\Windows\system32\Drivers\TrueSight.sys
2014-06-08 07:43 - 2014-06-08 07:43 - 00144120 _____ () C:\Windows\Minidump\060814-33852-01.dmp
2014-06-08 07:43 - 2014-06-07 21:28 - 260816951 _____ () C:\Windows\MEMORY.DMP
2014-06-08 07:43 - 2014-05-28 21:24 - 00000000 ____D () C:\Windows\Minidump
2014-06-07 22:28 - 2014-06-07 22:21 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-06-07 22:28 - 2014-06-07 21:49 - 00000000 ____D () C:\Users\M1530\Desktop\mbar
2014-06-07 22:21 - 2014-06-07 22:21 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-07 22:21 - 2014-06-04 22:17 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-07 21:48 - 2014-06-07 21:48 - 00003251 _____ () C:\Users\M1530\Desktop\RKreport_SCN_06072014_213855.log
2014-06-07 21:28 - 2014-06-07 21:28 - 00144120 _____ () C:\Windows\Minidump\060714-37580-01.dmp
2014-06-07 20:53 - 2009-04-22 01:17 - 00000000 ____D () C:\Windows\system32\Msdtc
2014-06-07 20:14 - 2014-06-07 20:14 - 14349744 _____ (Malwarebytes Corp.) C:\Users\M1530\Downloads\mbar-1.07.0.1012.exe
2014-06-07 20:14 - 2014-06-07 20:14 - 00000000 ____D () C:\ProgramData\RogueKiller
2014-06-07 20:13 - 2014-06-07 20:13 - 04686336 _____ () C:\Users\M1530\Downloads\RogueKiller.exe
2014-06-07 18:39 - 2014-06-07 18:39 - 00013043 _____ () C:\Users\M1530\Desktop\dds.txt
2014-06-07 18:39 - 2014-06-07 18:39 - 00011039 _____ () C:\Users\M1530\Desktop\attach.txt
2014-06-07 18:37 - 2014-06-07 18:37 - 00688992 ____R (Swearware) C:\Users\M1530\Downloads\dds.com
2014-06-07 18:37 - 2014-06-07 18:36 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\M1530\Downloads\mbam-setup-2.0.2.1012 (2).exe
2014-06-07 18:06 - 2014-06-07 18:06 - 00002626 _____ () C:\Users\M1530\Downloads\legitcheck (1).hta
2014-06-07 18:05 - 2014-06-07 18:05 - 00002626 _____ () C:\Users\M1530\Downloads\legitcheck.hta
2014-06-07 18:01 - 2010-02-11 12:49 - 00000000 ____D () C:\Users\M1530
2014-06-07 17:55 - 2009-04-22 05:25 - 00000000 ____D () C:\Windows\CSC
2014-06-07 13:42 - 2009-04-22 05:24 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-06-07 13:09 - 2009-04-22 03:55 - 00000000 ____D () C:\Windows\system32\restore
2014-06-07 13:07 - 2009-04-22 03:27 - 00032576 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-06-06 12:59 - 2010-02-11 12:53 - 00778150 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-05 13:23 - 2014-06-05 13:23 - 00000000 ____D () C:\Program Files\ESET
2014-06-05 13:23 - 2014-06-05 13:22 - 02347384 _____ (ESET) C:\Users\M1530\Downloads\esetsmartinstaller_enu.exe
2014-06-05 12:41 - 2014-06-05 12:40 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\M1530\Downloads\mbam-setup-2.0.2.1012 (1).exe
2014-06-05 12:18 - 2014-06-05 12:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-06-05 12:17 - 2010-11-10 19:06 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-06-05 12:16 - 2010-02-11 13:33 - 00000000 ____D () C:\Windows\system32\Macromed
2014-06-05 12:16 - 2010-02-11 13:33 - 00000000 ____D () C:\Windows\system32\Adobe
2014-06-05 12:08 - 2014-06-05 12:08 - 00400968 _____ (www.patchmypc.net) C:\Users\M1530\Downloads\PatchMyPC.exe
2014-06-04 22:16 - 2014-06-04 22:14 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\M1530\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-04 13:21 - 2014-04-06 15:02 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-06-04 13:14 - 2014-06-04 13:14 - 00000000 ___HD () C:\ProgramData\CanonIJMyPrinter
2014-06-04 13:14 - 2014-06-04 13:14 - 00000000 ___HD () C:\ProgramData\CanonIJEGV
2014-06-04 13:12 - 2014-06-04 13:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MP495 series User Registration
2014-06-04 13:12 - 2010-07-25 17:39 - 00000000 ____D () C:\Program Files\Canon
2014-06-04 13:09 - 2014-06-04 13:09 - 00002022 _____ () C:\Users\Public\Desktop\Canon Solution Menu EX.lnk
2014-06-04 13:09 - 2010-07-25 17:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities
2014-06-04 13:06 - 2014-06-04 13:06 - 00002301 _____ () C:\Users\Public\Desktop\Canon MP495 series On-screen Manual.lnk
2014-06-04 13:06 - 2014-06-04 13:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MP495 series Manual
2014-06-04 13:06 - 2014-06-04 13:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MP495 series
2014-06-04 13:02 - 2014-06-04 13:02 - 00000000 ___HD () C:\ProgramData\CanonIJEPPEX2
2014-06-04 13:02 - 2014-06-04 13:02 - 00000000 ___HD () C:\ProgramData\CanonEPP
2014-06-04 13:01 - 2009-04-22 03:55 - 00000000 ____D () C:\Windows\twain_32
2014-06-04 13:01 - 2009-04-22 01:17 - 00000000 __RSD () C:\Windows\Media
2014-06-02 09:36 - 2014-04-04 19:08 - 00005120 _____ () C:\Windows\IE11_main.log
2014-06-01 21:59 - 2010-02-11 13:13 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2014-06-01 18:26 - 2014-03-23 11:22 - 00002202 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-06-01 17:44 - 2009-04-22 01:17 - 00000000 ____D () C:\Windows\rescache
2014-06-01 13:29 - 2009-04-22 01:17 - 00000000 __RHD () C:\Users\Public\Libraries
2014-06-01 13:00 - 2014-06-01 13:00 - 00001414 _____ () C:\Users\M1530\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-05-31 09:39 - 2014-05-31 09:39 - 00282928 _____ (Mozilla) C:\Users\M1530\Downloads\Firefox Setup Stub 29.0.1(3).exe
2014-05-31 09:38 - 2014-05-31 09:37 - 00282928 _____ (Mozilla) C:\Users\M1530\Downloads\Firefox Setup Stub 29.0.1(2).exe
2014-05-30 20:51 - 2014-05-30 20:50 - 00282928 _____ (Mozilla) C:\Users\M1530\Downloads\Firefox Setup Stub 29.0.1.exe
2014-05-30 17:33 - 2010-02-11 13:33 - 00001025 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2014-05-30 17:33 - 2010-02-11 13:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-05-29 21:36 - 2014-05-29 21:36 - 00000000 ____D () C:\Users\M1530\AppData\Local\Macromedia
2014-05-29 18:53 - 2014-05-29 18:53 - 00002069 _____ () C:\Users\Public\Desktop\avast! Internet Security.lnk
2014-05-29 18:52 - 2014-05-29 18:51 - 00270240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswNdisFlt.sys
2014-05-29 18:51 - 2014-05-29 18:51 - 00026136 _____ (AVAST Software) C:\Windows\system32\Drivers\aswKbd.sys
2014-05-26 16:39 - 2009-04-22 01:17 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-05-26 16:38 - 2010-02-11 13:29 - 00000000 ____D () C:\Program Files\Microsoft.NET
2014-05-26 16:36 - 2014-05-26 16:36 - 00000000 ____D () C:\ProgramData\TEMP
2014-05-26 16:32 - 2009-04-22 01:17 - 00000000 ____D () C:\Windows\system32\LogFiles
2014-05-26 16:30 - 2014-05-26 16:30 - 00000000 ____D () C:\Users\M1530\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Weather Alerts
2014-05-15 19:04 - 2014-03-21 08:00 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-05-15 19:04 - 2014-03-21 08:00 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-05-15 19:00 - 2014-03-23 10:51 - 00068312 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-05-15 19:00 - 2014-03-23 10:39 - 00777488 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2014-05-15 19:00 - 2010-04-21 17:21 - 00411680 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2014-05-12 07:25 - 2014-06-07 21:49 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

Some content of TEMP:
====================
C:\Users\M1530\AppData\Local\Temp\BackupSetup.exe
C:\Users\M1530\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\M1530\AppData\Local\Temp\FlashPlayerUpdate01.exe
C:\Users\M1530\AppData\Local\Temp\FlashPlayerUpdate02.exe
C:\Users\M1530\AppData\Local\Temp\MSETUP4.EXE
C:\Users\M1530\AppData\Local\Temp\MSN1FEE.exe
C:\Users\M1530\AppData\Local\Temp\optimizerpro.exe
C:\Users\M1530\AppData\Local\Temp\Quarantine.exe
C:\Users\M1530\AppData\Local\Temp\vcredist_x86.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe
[2009-04-21 22:40] - [2009-04-22 00:19] - 2607616 ____A (Microsoft Corporation) C133788B393EEC01439AD997D24E66ED

C:\Windows\system32\winlogon.exe
[2009-04-21 22:35] - [2009-04-22 00:19] - 0285696 ____A (Microsoft Corporation) B9CFF761509E6C95E964B29B279D7721

C:\Windows\system32\wininit.exe
[2009-04-21 22:35] - [2009-04-22 00:19] - 0096256 ____A (Microsoft Corporation) 2E4264C95BAB587431C79C101899CCC8

C:\Windows\system32\svchost.exe
[2009-04-21 22:16] - [2009-04-22 00:19] - 0020992 ____A (Microsoft Corporation) 5F1FE2F551E74B069C436152F06CCFDC

C:\Windows\system32\services.exe
[2009-04-21 22:08] - [2009-04-22 00:19] - 0259072 ____A (Microsoft Corporation) 77474E495E99CCE05AD2720E6FA85A35

C:\Windows\system32\User32.dll
[2009-04-21 22:22] - [2009-04-22 00:22] - 0811520 ____A (Microsoft Corporation) 5CF35E5261DAA5C68DEBA4618DBE4121

C:\Windows\system32\userinit.exe
[2009-04-21 22:32] - [2009-04-22 00:19] - 0026112 ____A (Microsoft Corporation) 50771CA86FF1ADAF5FD1920F8CB5665E

C:\Windows\system32\rpcss.dll
[2009-04-21 22:43] - [2009-04-22 00:21] - 0376832 ____A (Microsoft Corporation) 0E829890E9E00BBBA3352B02C718CB63

ATTENTION ======> If the system is having audio adware rpcss.dll is patched. Google the MD5, if the MD5 is unique the file is infected.
C:\Windows\system32\Drivers\volsnap.sys
[2009-04-21 22:08] - [2009-04-22 00:23] - 0244304 ____A (Microsoft Corporation) 803F111D3DBA35D34DE1F0AC12517DE8



LastRegBack: 2010-02-11 15:37

==================== End Of Log ============================

======================

 

Addition:

Additional scan result of Farbar Recovery Scan Tool (x86) Version:06-06-2014
Ran by M1530 at 2014-06-08 19:57:41
Running from C:\Users\M1530\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
FW: avast! Antivirus (Enabled) {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}

==================== Installed Programs ======================

Adobe Flash Player 13 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.5 (HKLM\...\Adobe Shockwave Player) (Version: 11.5 - Adobe Systems, Inc.)
Adobe Shockwave Player 12.1 (HKLM\...\{E52432C6-87E3-4F21-8F6A-AF43224220D1}) (Version: 12.1.2.152 - Adobe Systems, Inc)
avast! Internet Security (HKLM\...\avast) (Version: 9.0.2018 - Avast Software)
Canon Easy-PhotoPrint EX (HKLM\...\Easy-PhotoPrint EX) (Version: - )
CANON iMAGE GATEWAY Task for ZoomBrowser EX (HKLM\...\CANON iMAGE GATEWAY Task) (Version: 1.7.0.4 - Canon Inc.)
Canon Internet Library for ZoomBrowser EX (HKLM\...\Canon Internet Library for ZoomBrowser EX) (Version: 1.6.3.9 - Canon Inc.)
Canon MOV Decoder (HKLM\...\Canon MOV Decoder) (Version: 1.3.0.14 - Canon Inc.)
Canon MP Navigator EX 4.0 (HKLM\...\MP Navigator EX 4.0) (Version: - )
Canon MP495 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP495_series) (Version: - )
Canon MP495 series User Registration (HKLM\...\Canon MP495 series User Registration) (Version: - )
Canon My Printer (HKLM\...\CanonMyPrinter) (Version: - )
Canon Solution Menu EX (HKLM\...\CanonSolutionMenuEX) (Version: - )
Canon Utilities CameraWindow (HKLM\...\CameraWindowLauncher) (Version: 7.2.0.2 - Canon Inc.)
Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX (HKLM\...\CameraWindowDVC6) (Version: 6.5.0.3 - Canon Inc.)
Canon Utilities Digital Photo Professional 3.6 (HKLM\...\DPP) (Version: 3.6.0.0 - Canon Inc.)
Canon Utilities EOS Utility (HKLM\...\EOS Utility) (Version: 2.6.0.0 - Canon Inc.)
Canon Utilities MyCamera (HKLM\...\MyCamera) (Version: 7.2.0.4 - Canon Inc.)
Canon Utilities Original Data Security Tools (HKLM\...\Original Data Security Tools) (Version: 1.6.0.1 - Canon Inc.)
Canon Utilities PhotoStitch (HKLM\...\PhotoStitch) (Version: 3.1.22.46 - Canon Inc.)
Canon Utilities Picture Style Editor (HKLM\...\Picture Style Editor) (Version: 1.5.0.0 - Canon Inc.)
Canon Utilities RemoteCapture Task for ZoomBrowser EX (HKLM\...\RemoteCaptureTask) (Version: 1.8.0.1 - Canon Inc.)
Canon Utilities WFT-E1/E2/E3/E4 Utility (HKLM\...\WFTK) (Version: 3.3.0.0 - Canon Inc.)
Canon Utilities ZoomBrowser EX (HKLM\...\ZoomBrowser EX) (Version: 6.3.1.8 - Canon Inc.)
Canon ZoomBrowser EX Memory Card Utility (HKLM\...\ZoomBrowser EX Memory Card Utility) (Version: 1.2.2.11 - Canon Inc.)
Dell Touchpad (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 7.1.102.7 - Alps Electric)
EasyBCD 1.7.2 (HKLM\...\EasyBCD) (Version: 1.7.2 - NeoSmart Technologies)
ESET Online Scanner v3 (HKLM\...\ESET Online Scanner) (Version: - )
Fingerprint Reader Suite 5.6 (HKLM\...\{A2289997-10A3-48F2-AA03-99180D761661}) (Version: 5.6.2.3476 - UPEK Inc.)
Google Chrome (HKLM\...\Google Chrome) (Version: 35.0.1916.114 - Google Inc.)
Google Update Helper (Version: 1.3.24.7 - Google Inc.) Hidden
HP Officejet Pro 8500 A910 Basic Device Software (HKLM\...\{869D453C-53E8-4DE0-92EA-F574A22E82AE}) (Version: 22.0.334.0 - Hewlett-Packard Co.)
HP Officejet Pro 8500 A910 Help (HKLM\...\{13D324E9-9DB1-478D-944C-28BBE1BB80DC}) (Version: 140.0.2.2 - Hewlett Packard)
HP Officejet Pro 8500 A910 Product Improvement Study (HKLM\...\{E3624DFE-B0AB-410A-9BDC-5D1681E5E388}) (Version: 22.0.334.0 - Hewlett-Packard Co.)
HP Update (HKLM\...\{787D1A33-A97B-4245-87C0-7174609A540C}) (Version: 5.002.005.003 - Hewlett-Packard)
I.R.I.S. OCR (HKLM\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4 - HP)
Intel(R) PROSet/Wireless Software (HKLM\...\ProInst) (Version: 11.01.0000 - Intel Corporation)
Laptop Integrated Webcam Driver (1.04.01.1011) (HKLM\...\Creative OEM002) (Version: - )
Marketsplash Shortcuts (HKLM\...\{FB0C267C-8B4F-4867-8161-A6A3B66D42C1}) (Version: 1.0.0.9 - Hewlett-Packard)
Marvell Miniport Driver (HKLM\...\{C950420B-4182-49EA-850A-A6A2ABF06C6B}) (Version: 10.22.6.3 - Marvell)
mCore (Version: 9.24.0000 - Intel Corporation) Hidden
mDriver (Version: 9.24.0000 - Intel) Hidden
mHelp (Version: 9.24.0000 - Intel) Hidden
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Access Setup Metadata MUI (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Groove Setup Metadata MUI (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (Spanish) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
mMHouse (Version: 9.24.0000 - Intel Corporation) Hidden
mPfMgr (Version: 9.24.0000 - Intel Corporation) Hidden
mWMI (Version: 9.24.0000 - Intel Corporation) Hidden
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: - )
PowerDVD (HKLM\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 7.0 - Dell)
RICOH Media Driver ver.2.07.01.04 (HKLM\...\{2B818257-E6C7-4841-8C29-C5C9A982BCE5}) (Version: 2.07.01.04 - RICOH)
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01 (HKLM\...\{59F6A514-9813-47A3-948C-8A155460CC2A}) (Version: 3.51.01 - )
SigmaTel Audio (HKLM\...\{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}) (Version: 5.10.5207.0 - SigmaTel)
TomTom HOME (HKLM\...\{99072AB4-D795-44D5-9D65-E3C9F8322C97}) (Version: 2.9.7 - TomTom)
TomTom HOME Visual Studio Merge Modules (HKLM\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
VLC media player 2.1.3 (HKLM\...\VLC media player) (Version: 2.1.3 - VideoLAN)
WIDCOMM Bluetooth Software 6.0.1.3100 (HKLM\...\{A13E07E1-A423-44FB-9DEE-B24C75C1BAF2}) (Version: 6.0.1.3100 - Dell)
Windows Live ID Sign-in Assistant (HKLM\...\{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}) (Version: 6.500.3165.0 - Microsoft Corporation)

==================== Restore Points =========================

08-06-2014 03:02:45 after rogue killer
08-06-2014 03:20:38 after rouguekiller

==================== Hosts content: ==========================

2009-04-22 00:57 - 2009-03-20 10:31 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0060488F-2B25-46C6-9022-B88E2C5D0ACB} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-03-23] (Google Inc.)
Task: {209A086B-CC0D-40BF-91C8-8BFD5607CDF1} - System32\Tasks\8ea0c577-e089-4802-960c-23d572680af5-2 => C:\Program Files\HD-Plus10\8ea0c577-e089-4802-960c-23d572680af5-2.exe
Task: {2B477B94-A5D7-4F54-A285-FFF73CDF0BC6} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-03-23] (Google Inc.)
Task: {873F7C60-27ED-4DD9-950D-236AA3E5B070} - System32\Tasks\HPCustParticipation HP Officejet Pro 8500 A910 => C:\Program Files\HP\HP Officejet Pro 8500 A910\Bin\HPCustPartic.exe [2010-06-14] (Hewlett-Packard Co.)
Task: {A6A6A221-2681-402A-ABD5-BC0A6384EAC6} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-15] (Adobe Systems Incorporated)
Task: {EFB68F8C-B9FB-4955-8362-330ED20808DF} - System32\Tasks\8ea0c577-e089-4802-960c-23d572680af5-5 => C:\Program Files\HD-Plus10\8ea0c577-e089-4802-960c-23d572680af5-5.exe
Task: {FFBAF5B6-F10C-44DF-9F5D-7AAF2E0A033C} - System32\Tasks\avast! Emergency Update => C:\Program Files\Alwil Software\Avast5\AvastEmUpdate.exe [2014-04-28] (AVAST Software)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-06-08 15:18 - 2014-06-08 15:18 - 02775040 _____ () C:\Program Files\Alwil Software\Avast5\defs\14060801\algo.dll
2007-04-25 10:55 - 2007-04-25 10:55 - 01167360 _____ () C:\Program Files\Intel\Wireless\Bin\acAuth.dll
2007-07-25 16:25 - 2007-07-25 16:25 - 00118784 _____ () C:\Program Files\Intel\Wireless\Bin\IWMSPROV.DLL
2014-03-23 10:50 - 2014-03-23 10:50 - 19336120 _____ () C:\Program Files\Alwil Software\Avast5\libcef.dll
2006-11-03 17:25 - 2006-11-03 17:25 - 00389120 _____ () C:\Windows\system32\btwhidcs.DLL
2006-11-03 17:46 - 2006-11-03 17:46 - 00126976 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => " "= "Service "
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => " "= "Driver "
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => " "= "Driver "
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => " "= "Service "
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => " "= "Driver "
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => " "= "Driver "

==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

==================== Memory info ===========================

Percentage of memory in use: 28%
Total physical RAM: 3582.06 MB
Available physical RAM: 2560 MB
Total Pagefile: 7162.4 MB
Available Pagefile: 6091.5 MB
Total Virtual: 2047.88 MB
Available Virtual: 1896.73 MB

==================== Drives ================================

Drive c: (Seven) (Fixed) (Total:75 GB) (Free:38.16 GB) NTFS
Drive d: () (Fixed) (Total:73.26 GB) (Free:51.41 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (Data) (Fixed) (Total:149.82 GB) (Free:149.73 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 836EB4FE)
Partition 1: (Active) - (Size=73 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=75 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=150 GB) - (Type=07 NTFS)

==================== End Of Log ======

 

I have some additional information about this system. My friend bought this computer on Ebay with XP and Windows 7 Ultimate already loaded. While I was waiting on replies I was trying to figure why it would not update at all and why it wouldn't boot after XP partition was removed----- I did everything right. When I ran "activate" it could not find the "shui.exe(?) file (may not be the right name). So I downloaded the validation tool. This copy of Windows 7 Ultimate is an evaluation copy and has expired. The owner had no idea. I just called him and he is going to buy a genuine copy of 7 when he gets back from his camping trip tomorrow.

The security check at virustotal came back ok. didn't see any way to download the result.

here is the frst search

Farbar Recovery Scan Tool (x86) Version:06-06-2014
Ran by M1530 at 2014-06-08 21:34:02
Running from C:\Users\M1530\Downloads
Boot Mode: Normal

================== Search: "rpcss.dll" ===================

C:\Windows\winsxs\x86_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7100.0_none_dabdd45d92f5cf85\rpcss.dll
[2009-04-21 22:43] - [2009-04-22 00:21] - 0376832 ____A (Microsoft Corporation) 0E829890E9E00BBBA3352B02C718CB63

C:\Windows\System32\rpcss.dll
[2009-04-21 22:43] - [2009-04-22 00:21] - 0376832 ____A (Microsoft Corporation) 0E829890E9E00BBBA3352B02C718CB63

=== End Of Search ===

 

yes it was

 

Here is the result:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:06-06-2014
Ran by M1530 at 2014-06-08 22:20:36 Run:1
Running from C:\Users\M1530\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
HKLM\...\Run: [] => [X]
HKU\S-1-5-21-199525533-572720544-984425971-1000\...\MountPoints2: {1946fbc9-eda4-11e3-b52b-806e6f6e6963} - "G:\WD SmartWare.exe" autoplay=true
HKU\S-1-5-21-199525533-572720544-984425971-1000\...\MountPoints2: {6ee3abf9-1063-11e0-aa57-806e6f6e6963} - G:\VZAccess_Manager.exe /z detect
ProxyServer: http=127.0.0.1:49721;https=127.0.0.1:49721;
SearchScopes: HKLM - DefaultScope value is missing.
S4 sppuinotify; %SystemRoot%\system32\sppuinotify.dll [X]
S3 DFUBTUSB; System32\Drivers\frmupgr.sys [X]
C:\Users\M1530\AppData\Local\Temp\BackupSetup.exe
C:\Users\M1530\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\M1530\AppData\Local\Temp\FlashPlayerUpdate01.exe
C:\Users\M1530\AppData\Local\Temp\FlashPlayerUpdate02.exe
C:\Users\M1530\AppData\Local\Temp\MSETUP4.EXE
C:\Users\M1530\AppData\Local\Temp\MSN1FEE.exe
C:\Users\M1530\AppData\Local\Temp\optimizerpro.exe
C:\Users\M1530\AppData\Local\Temp\Quarantine.exe
C:\Users\M1530\AppData\Local\Temp\vcredist_x86.exe

*****************

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully.
'HKU\S-1-5-21-199525533-572720544-984425971-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1946fbc9-eda4-11e3-b52b-806e6f6e6963}' => Key deleted successfully.
'HKCR\CLSID\{1946fbc9-eda4-11e3-b52b-806e6f6e6963}'=> Key not found.
'HKU\S-1-5-21-199525533-572720544-984425971-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6ee3abf9-1063-11e0-aa57-806e6f6e6963}' => Key deleted successfully.
'HKCR\CLSID\{6ee3abf9-1063-11e0-aa57-806e6f6e6963}'=> Key not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
sppuinotify => Service deleted successfully.
DFUBTUSB => Service deleted successfully.
C:\Users\M1530\AppData\Local\Temp\BackupSetup.exe => Moved successfully.
C:\Users\M1530\AppData\Local\Temp\FlashPlayerUpdate.exe => Moved successfully.
C:\Users\M1530\AppData\Local\Temp\FlashPlayerUpdate01.exe => Moved successfully.
C:\Users\M1530\AppData\Local\Temp\FlashPlayerUpdate02.exe => Moved successfully.
C:\Users\M1530\AppData\Local\Temp\MSETUP4.EXE => Moved successfully.
C:\Users\M1530\AppData\Local\Temp\MSN1FEE.exe => Moved successfully.
C:\Users\M1530\AppData\Local\Temp\optimizerpro.exe => Moved successfully.
C:\Users\M1530\AppData\Local\Temp\Quarantine.exe => Moved successfully.
C:\Users\M1530\AppData\Local\Temp\vcredist_x86.exe => Moved successfully.

==== End of Fixlog ====

 

Here is FSS:

Farbar Service Scanner Version: 21-05-2014
Ran by M1530 (administrator) on 08-06-2014 at 22:42:42
Running from "C:\Users\M1530\Downloads "
Microsoft Windows 7 Ultimate (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============

Other Services:
==============


File Check:
========
C:\Windows\system32\nsisvc.dll
[2009-04-21 22:09] - [2009-04-22 00:21] - 0019456 ____A (Microsoft Corporation) C1C48F6496FE20AB17C93ACC5FB51230

C:\Windows\system32\Drivers\nsiproxy.sys
[2009-04-21 22:09] - [2009-04-21 22:09] - 0016896 ____A (Microsoft Corporation) D65BA02F291B42FA3C2910EE25BF4251

C:\Windows\system32\dhcpcore.dll
[2009-04-21 22:09] - [2009-04-22 00:20] - 0252928 ____A (Microsoft Corporation) DD0C4C2864E69696B51A3BDBD9DD009B

C:\Windows\system32\Drivers\afd.sys
[2009-04-21 22:10] - [2009-04-21 22:10] - 0338944 ____A (Microsoft Corporation) 183C34872F51D34A41C0EDD3BA05C973

C:\Windows\system32\Drivers\tdx.sys
[2009-04-21 22:09] - [2009-04-21 22:09] - 0074240 ____A (Microsoft Corporation) 890765BBEE701E758E35BF8E2EF1857C

C:\Windows\system32\Drivers\tcpip.sys
[2009-04-21 22:11] - [2009-04-22 00:23] - 1267280 ____A (Microsoft Corporation) 4EB1831B5C67AFF9CFFA5269A3905505

C:\Windows\system32\dnsrslvr.dll
[2009-04-21 22:09] - [2009-04-22 00:20] - 0132608 ____A (Microsoft Corporation) 227A62E6B51EEA26EAA2668037007E28

C:\Windows\system32\mpssvc.dll
[2009-04-21 22:52] - [2009-04-22 00:20] - 0565248 ____A (Microsoft Corporation) 4308BD2A6D5FDDF04BE174E5FA5C288B

C:\Windows\system32\bfe.dll
[2009-04-21 22:53] - [2009-04-22 00:19] - 0494592 ____A (Microsoft Corporation) F52F01B7010D916E90C97EEBF4B35082

C:\Windows\system32\Drivers\mpsdrv.sys
[2009-04-21 22:51] - [2009-04-21 22:51] - 0060416 ____A (Microsoft Corporation) 1733A3D120E048DFFBA7FD069E2905BA

C:\Windows\system32\SDRSVC.dll
[2009-04-21 22:21] - [2009-04-22 00:21] - 0125952 ____A (Microsoft Corporation) D351E8ABFB6CA57501EB291B7510C723

C:\Windows\system32\vssvc.exe
[2009-04-21 22:22] - [2009-04-22 00:19] - 1021952 ____A (Microsoft Corporation) B593871B748F4C2F246FEEFDA1D04939

C:\Windows\system32\wscsvc.dll
[2009-04-21 22:29] - [2009-04-22 00:22] - 0072192 ____A (Microsoft Corporation) 58B05154B6BD934A529FE547BF74A847

C:\Windows\system32\wbem\WMIsvc.dll
[2009-04-21 22:28] - [2009-04-22 00:22] - 0166912 ____A (Microsoft Corporation) 596234DFAEABD61D4AC9BC19E5D20DFD

C:\Windows\system32\wuaueng.dll
[2009-04-21 23:14] - [2009-04-22 00:22] - 1909760 ____A (Microsoft Corporation) D598DCD9CDF64336377B6A84F1B63608

C:\Windows\system32\qmgr.dll
[2009-04-21 22:27] - [2009-04-22 00:21] - 0582144 ____A (Microsoft Corporation) 3FDDF12B48AA2C44EA742EA6C7398F32

C:\Windows\system32\es.dll
[2009-04-21 22:43] - [2009-04-22 00:20] - 0271872 ____A (Microsoft Corporation) CF1602A6FE49BAC4E27A2A51E5B1F448

C:\Windows\system32\cryptsvc.dll
[2009-04-21 22:31] - [2009-04-22 00:20] - 0135168 ____A (Microsoft Corporation) 3DA62576A423BB1A9D882F7CDEAF21BB

C:\Program Files\Windows Defender\MpSvc.dll
[2009-04-21 22:36] - [2009-04-22 00:20] - 0680448 ____A (Microsoft Corporation) 5B149783C197C78A2CED7C9F4765DEC9

C:\Windows\system32\ipnathlp.dll
[2009-04-21 22:53] - [2009-04-22 00:20] - 0300544 ____A (Microsoft Corporation) 5C73BAFCF18C1AB78C8607825C23842A

C:\Windows\system32\iphlpsvc.dll
[2009-04-21 22:53] - [2009-04-22 00:20] - 0496128 ____A (Microsoft Corporation) 614859865CDC33A103083976B9211AB8

C:\Windows\system32\svchost.exe
[2009-04-21 22:16] - [2009-04-22 00:19] - 0020992 ____A (Microsoft Corporation) 5F1FE2F551E74B069C436152F06CCFDC

C:\Windows\system32\rpcss.dll
[2009-04-21 22:43] - [2009-04-22 00:21] - 0376832 ____A (Microsoft Corporation) 0E829890E9E00BBBA3352B02C718CB63



**** End of log ****

TFC did what is was supposed to do.

ESET is going to take a while longer. If there is anything to post I will do so in the a.m.

Mitch

 

ESET had nothing to report. All seems well.....