Solved Laptop Very Slow, Stops Responding, Fails to Install Outlook Security Updates

Working on a friend's computer - HP Laptop Pavilion 1245, Windows Vista, 64 Bity. Initial problem was Outlook that failed to recieve emails but would send. That's still a problem with Outlook but I have installed Thunderbird and it is working fine. As I was working with the unit, I noticed it was extremely slow and, at times, stopped responding. I ran Malwarebytes and it found about 70 instances of Malware including Yontoo and Condutuit. I also discovered that a couple of Microsoft Office security updated have been failing to install for several months - possibly the cause of the Outlook receiving problem.

So I thought I would have you take a look to see if there is anything lingering before I spend much more time on the other issues. Here are the Farbar logs:

FARBAR NotePad
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 29-06-2016
Ran by Barbara (administrator) on BARBARA-PC (29-06-2016 13:30:27)
Running from C:\Users\Barbara\Desktop
Loaded Profiles: Barbara (Available Profiles: Barbara)
Platform: Windows Vista (TM) Home Premium Service Pack 2 (X64) Language: English (United States)
Internet Explorer Version 9 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_1b06afce\stacsv64.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Eastman Kodak Company) C:\Program Files (x86)\Kodak\KODAK Share Button App\Listener.exe
(Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_1b06afce\AESTSr64.exe
(Agere Systems) C:\Windows\System32\agr64svc.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
() C:\Program Files (x86)\SMINST\BLService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(CyberLink Corp.) C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe
(CyberLink Corp.) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe
(CyberLink) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
(Hewlett-Packard) C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
() C:\Program Files (x86)\Hewlett-Packard\Shared\HpqToaster.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Adobe Systems Incorporated) C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_22_0_0_192_ActiveX.exe
(ESET spol. s r.o.) C:\Users\Barbara\AppData\Local\ESET\ESETOnlineScanner\esetonlinescanner_enu_upd.exe
(ESET spol. s r.o.) C:\Users\Barbara\AppData\Local\ESET\ESETOnlineScanner\esetonlinescanner_enu_upd.exe
(ESET spol. s r.o.) C:\Users\Barbara\AppData\Local\ESET\ESETOnlineScanner\esetonlinescanner_enu_upd.exe

==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2832168 2011-10-01] (Synaptics Incorporated)
HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-20] (Microsoft Corporation)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1340192 2016-01-29] (Microsoft Corporation)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [456192 2009-08-13] (IDT, Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [61440 2008-08-01] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [DVDAgent] => C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe [1148200 2008-09-26] (CyberLink Corp.)
HKLM-x32\...\Run: [TSMAgent] => C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe [1152296 2008-09-25] (CyberLink Corp.)
HKLM-x32\...\Run: [CLMLServer for HP TouchSmart] => C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe [189736 2008-09-25] (CyberLink)
HKLM-x32\...\Run: [UCam_Menu] => C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe [210216 2008-06-13] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateLBPShortCut] => C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [210216 2008-06-13] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdatePSTShortCut] => C:\Program Files (x86)\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe [210216 2008-09-26] (CyberLink Corp.)
HKLM-x32\...\Run: [QlbCtrl.exe] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [202032 2008-08-01] ( Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [UpdateP2GoShortCut] => C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [210216 2008-06-13] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdatePDIRShortCut] => C:\Program Files (x86)\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe [210216 2008-06-13] (CyberLink Corp.)
HKLM-x32\...\Run: [hpWirelessAssistant] => C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [488752 2008-04-15] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2010-03-12] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-333120211-1585552344-2278992193-1000\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2008-06-09] (Hewlett-Packard Company)
HKU\S-1-5-21-333120211-1585552344-2278992193-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [138240 2008-01-20] (Microsoft Corporation)
HKU\S-1-5-21-333120211-1585552344-2278992193-1000\...\Run: [SPMTray] => "C:\Program Files (x86)\PC Speed Maximizer\SPMTray.exe "
HKU\S-1-5-21-333120211-1585552344-2278992193-1000\...\MountPoints2: {9b0dd307-262c-11e1-8c8c-00235a2941cc} - F:\KODAK_Camera_Setup_App.exe
HKU\S-1-5-18\...\Run: [SearchProtect] => \SearchProtect\bin\cltmng.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 68.100.16.30 68.10.16.30 8.8.8.8 8.8.4.4
Tcpip\..\Interfaces\{355D607A-85C1-434A-8BEA-1B39988D01D7}: [DhcpNameServer] 68.100.16.30 68.10.16.30 8.8.8.8 8.8.4.4
Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
SearchScopes: HKLM -> DefaultScope {934BCD49-C81A-4ED0-86DF-56EE1B6DA341} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&FORM=HPNTDF
SearchScopes: HKLM -> {934BCD49-C81A-4ED0-86DF-56EE1B6DA341} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&FORM=HPNTDF
SearchScopes: HKLM -> {C4B887F1-E634-4BCC-8BA4-6E91B16D2814} URL = hxxp://www.ask.com/web?q={searchterms}&l=dis&o=ushpl
SearchScopes: HKLM-x32 -> DefaultScope {584B1ED9-8A43-4956-895E-AF86252744CC} URL =
SearchScopes: HKLM-x32 -> {934BCD49-C81A-4ED0-86DF-56EE1B6DA341} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&FORM=HPNTDF
SearchScopes: HKLM-x32 -> {C4B887F1-E634-4BCC-8BA4-6E91B16D2814} URL = hxxp://www.ask.com/web?q={searchterms}&l=dis&o=ushpl
SearchScopes: HKU\S-1-5-21-333120211-1585552344-2278992193-1000 -> {934BCD49-C81A-4ED0-86DF-56EE1B6DA341} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-333120211-1585552344-2278992193-1000 -> {C4B887F1-E634-4BCC-8BA4-6E91B16D2814} URL =
BHO-x32: No Name -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> No File
BHO-x32: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-02-08] (Skype Technologies S.A.)
BHO-x32: Microsoft Live Search Toolbar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> c:\Program Files (x86)\MSN\Toolbar\3.0.0541.0\msneshellx.dll [2008-08-28] (Microsoft Corp.)
Toolbar: HKLM-x32 - Microsoft Live Search Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0541.0\msneshellx.dll [2008-08-28] (Microsoft Corp.)
Toolbar: HKU\S-1-5-21-333120211-1585552344-2278992193-1000 -> No Name - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab
Handler-x32: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\BelarcAdvisor\System\BAVoilaX.dll [2013-04-16] (Belarc, Inc.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-02-08] (Skype Technologies S.A.)
FireFox:
========
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2015-07-10] (Google, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-10] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-10] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2015-09-24] (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-06-25] [not signed]
Chrome:
=======
CHR StartupUrls: Default -> "hxxp://google.com/ "
CHR Profile: C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-07-28]
CHR Extension: (Google Docs) - C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-07-28]
CHR Extension: (Google Drive) - C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-12-26]
CHR Extension: (YouTube) - C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-12-26]
CHR Extension: (Google Search) - C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-12-26]
CHR Extension: (Google Sheets) - C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-07-28]
CHR Extension: (Google Docs Offline) - C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-12-26]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-28]
CHR Extension: (Gmail) - C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-07-28]
CHR HKLM-x32\...\Chrome\Extension: [niapdbllcanepiiimjjndipklodoedlc] - <no Path/update_url>
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_1b06afce\AESTSr64.exe [89600 2009-03-02] (Andrea Electronics Corporation)
S4 HP Health Check Service; c:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe [94208 2008-06-16] (Hewlett-Packard) [File not signed]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2008-06-09] (Hewlett-Packard Company) [File not signed]
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2016-01-29] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [374344 2016-01-29] (Microsoft Corporation)
R2 Recovery Service for Windows; C:\Program Files (x86)\SMINST\BLService.exe [365952 2008-10-06] ()
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [241734 2008-06-29] () [File not signed]
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_1b06afce\STacSV64.exe [240640 2009-08-13] (IDT, Inc.)
S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [383544 2008-01-20] (Microsoft Corporation)
S2 Norton Internet Security; "C:\Program Files (x86)\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe" /s "Norton Internet Security" /m "C:\Program Files (x86)\Norton Internet Security\Engine\16.0.0.125\diMaster.dll" /prefetch:1
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 Linksys_adapter; C:\Windows\System32\DRIVERS\AE2500vista64.sys [1227840 2011-03-30] (Broadcom Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [289120 2015-11-13] (Microsoft Corporation)
R3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133816 2015-11-13] (Microsoft Corporation)
R2 {55662437-DA8C-40c0-AADA-2C816A897A49}; C:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl [27632 2008-09-26] (Cyberlink Corp.)
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\ENG64.SYS [X]
S3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\EX64.SYS [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S1 SRTSP; \??\C:\Windows\system32\drivers\NISx64\1000000.07D\SRTSP64.SYS [X]
S1 SRTSPX; \??\C:\Windows\system32\drivers\NISx64\1000000.07D\SRTSPX64.SYS [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-06-29 13:30 - 2016-06-29 13:32 - 00016674 _____ C:\Users\Barbara\Desktop\FRST.txt
2016-06-29 13:28 - 2016-06-29 13:30 - 00000000 ____D C:\FRST
2016-06-29 13:27 - 2016-06-29 13:27 - 02390016 _____ (Farbar) C:\Users\Barbara\Desktop\FRST64.exe
2016-06-29 13:20 - 2016-06-29 13:20 - 00000000 ____D C:\Users\Barbara\AppData\Local\ESET
2016-06-29 13:18 - 2016-06-29 13:18 - 09908936 _____ (Microsoft Corporation) C:\Users\Barbara\Downloads\xlconv2007-kb3114895-fullfile-x86-glb.exe
2016-06-29 09:22 - 2016-06-29 09:22 - 00000000 ____D C:\Windows\CheckSur
2016-06-29 09:17 - 2016-06-29 09:19 - 218486747 _____ C:\Users\Barbara\Downloads\Windows6.0-KB947821-v35-x64.msu
2016-06-28 20:24 - 2016-06-28 20:24 - 00000898 _____ C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
2016-06-28 20:24 - 2016-06-28 20:24 - 00000000 ____D C:\Users\Barbara\AppData\Roaming\Thunderbird
2016-06-28 20:24 - 2016-06-28 20:24 - 00000000 ____D C:\Users\Barbara\AppData\Local\Thunderbird
2016-06-28 20:24 - 2016-06-28 20:24 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2016-06-28 20:24 - 2016-06-28 20:24 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-06-28 20:22 - 2016-06-28 20:22 - 34098512 _____ (Mozilla) C:\Users\Barbara\Downloads\Thunderbird Setup 38.5.0.exe
2016-06-25 13:43 - 2009-08-04 04:12 - 01103872 _____ (Microsoft Corporation) C:\Windows\system32\webservices.dll
2016-06-25 13:43 - 2009-08-04 04:02 - 00754688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webservices.dll
2016-06-25 13:42 - 2016-06-25 13:42 - 00000000 ____D C:\Program Files\LSI SoftModem
2016-06-25 13:38 - 2016-06-25 13:38 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_SynTP_01009.Wdf
2016-06-24 19:48 - 2016-06-24 19:48 - 00000277 _____ C:\Users\Barbara\Desktop\Inbox - Outlook.url
2016-06-15 03:15 - 2016-05-14 11:54 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2016-06-15 03:15 - 2016-05-14 11:53 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\netevent.dll
2016-06-15 03:15 - 2016-05-14 11:42 - 00077312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2016-06-15 03:15 - 2016-05-14 11:41 - 00175616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2016-06-15 03:15 - 2016-05-14 11:41 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netevent.dll
2016-06-15 03:15 - 2016-05-14 10:38 - 00450560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2016-06-15 03:15 - 2016-05-14 10:38 - 00176128 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2016-06-15 03:15 - 2016-05-14 10:38 - 00147456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2016-06-15 03:15 - 2016-05-11 09:10 - 00516328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2016-06-15 03:14 - 2016-05-18 11:55 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2016-06-15 03:14 - 2016-05-18 11:34 - 00305152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2016-06-15 03:06 - 2016-05-14 11:58 - 00383208 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2016-06-15 03:06 - 2016-05-14 11:53 - 00048128 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2016-06-15 03:06 - 2016-05-14 11:47 - 00306408 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2016-06-15 03:06 - 2016-05-14 11:41 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2016-06-15 03:04 - 2016-05-12 10:39 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2016-06-15 03:04 - 2016-05-12 10:17 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2016-06-15 03:03 - 2016-05-12 10:45 - 02801664 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-06-15 03:03 - 2016-05-10 11:55 - 00264704 _____ (Microsoft Corporation) C:\Windows\system32\ws2_32.dll
2016-06-15 03:03 - 2016-05-10 11:54 - 00442880 _____ (Microsoft Corporation) C:\Windows\system32\winhttp.dll
2016-06-15 03:03 - 2016-05-10 11:54 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2016-06-15 03:03 - 2016-05-10 11:31 - 00377344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winhttp.dll
2016-06-15 03:03 - 2016-05-10 11:31 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2016-06-15 03:03 - 2016-05-10 11:31 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ws2_32.dll
2016-06-15 03:03 - 2016-05-10 10:55 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbt.sys
2016-06-15 03:03 - 2016-05-10 10:55 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\netbtugc.exe
2016-06-15 03:03 - 2016-05-10 10:28 - 00021504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netbtugc.exe
2016-06-15 03:01 - 2016-05-12 11:56 - 00534528 _____ (Microsoft Corporation) C:\Windows\system32\IPSECSVC.DLL
2016-06-15 03:01 - 2016-05-12 11:56 - 00381952 _____ (Microsoft Corporation) C:\Windows\system32\polstore.dll
2016-06-15 03:01 - 2016-05-12 11:56 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\winipsec.dll
2016-06-15 03:01 - 2016-05-12 11:56 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\FwRemoteSvr.dll
2016-06-15 03:01 - 2016-05-12 11:34 - 00273920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\polstore.dll
2016-06-15 03:01 - 2016-05-12 11:34 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winipsec.dll
2016-06-15 03:01 - 2016-05-12 11:33 - 00028672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FwRemoteSvr.dll
2016-06-15 03:00 - 2016-05-12 11:56 - 00726016 _____ (Microsoft Corporation) C:\Windows\system32\gpsvc.dll
2016-06-15 03:00 - 2016-05-12 11:56 - 00084480 _____ (Microsoft Corporation) C:\Windows\system32\gpapi.dll
2016-06-15 03:00 - 2016-05-12 11:33 - 00075264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gpapi.dll
2016-06-15 00:21 - 2016-05-12 15:52 - 18804224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-06-15 00:21 - 2016-05-12 15:49 - 02351616 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-06-15 00:21 - 2016-05-12 15:46 - 00448512 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2016-06-15 00:21 - 2016-05-12 15:45 - 10940416 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-06-15 00:21 - 2016-05-12 15:44 - 01389056 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-06-15 00:21 - 2016-05-12 15:43 - 01392640 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 02159104 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 01494528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-06-15 00:21 - 2016-05-12 15:42 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 00579584 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 00173568 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2016-06-15 00:21 - 2016-05-12 15:42 - 00096256 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2016-06-15 00:21 - 2016-05-12 15:42 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2016-06-15 00:21 - 2016-05-12 15:41 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2016-06-15 00:21 - 2016-05-12 15:11 - 01815552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-06-15 00:21 - 2016-05-12 15:10 - 12840960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-06-15 00:21 - 2016-05-12 15:08 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2016-06-15 00:21 - 2016-05-12 15:06 - 09755136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-06-15 00:21 - 2016-05-12 15:06 - 01140224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-06-15 00:21 - 2016-05-12 15:05 - 01129984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2016-06-15 00:21 - 2016-05-12 15:04 - 01804800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2016-06-15 00:21 - 2016-05-12 15:04 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2016-06-15 00:21 - 2016-05-12 15:04 - 00719360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2016-06-15 00:21 - 2016-05-12 15:04 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2016-06-15 00:21 - 2016-05-12 15:04 - 00425472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2016-06-15 00:21 - 2016-05-12 15:04 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2016-06-15 00:21 - 2016-05-12 15:04 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2016-06-15 00:21 - 2016-05-12 15:04 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2016-06-15 00:21 - 2016-05-12 15:04 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2016-06-15 00:21 - 2016-05-12 15:03 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2016-06-15 00:21 - 2016-05-12 15:03 - 00354304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2016-06-15 00:21 - 2016-05-12 15:03 - 00223744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2016-06-15 00:21 - 2016-05-12 15:03 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2016-06-15 00:21 - 2016-05-12 15:03 - 00072704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2016-06-15 00:21 - 2016-05-12 15:03 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2016-06-15 00:21 - 2016-05-12 15:03 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-06-29 13:31 - 2013-03-12 21:28 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-06-29 12:52 - 2006-11-02 11:22 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2016-06-29 12:52 - 2006-11-02 11:22 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2016-06-29 12:42 - 2015-07-28 14:01 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-06-29 10:53 - 2015-07-28 14:01 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-06-29 10:52 - 2006-11-02 11:42 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-06-29 10:50 - 2008-10-23 03:45 - 00000012 _____ C:\Windows\bthservsdp.dat
2016-06-29 10:50 - 2006-11-02 11:42 - 00032654 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2016-06-29 08:28 - 2014-05-15 13:45 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-06-29 08:05 - 2009-03-28 19:08 - 00000000 ____D C:\Windows\Minidump
2016-06-29 08:05 - 2006-11-02 09:33 - 00000000 ____D C:\Windows\inf
2016-06-29 06:33 - 2014-05-15 13:45 - 00000901 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-06-29 06:33 - 2014-05-15 13:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-06-29 06:33 - 2014-05-15 13:45 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-06-28 14:46 - 2006-11-02 08:46 - 00759582 _____ C:\Windows\system32\PerfStringBackup.INI
2016-06-28 13:46 - 2014-05-17 13:29 - 00002425 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2016-06-26 18:49 - 2015-06-24 18:27 - 00003110 _____ C:\Windows\System32\Tasks\HPCeeScheduleForBarbara
2016-06-26 18:49 - 2015-06-24 18:27 - 00000342 _____ C:\Windows\Tasks\HPCeeScheduleForBarbara.job
2016-06-25 14:37 - 2006-11-02 09:33 - 00000000 ____D C:\Windows\rescache
2016-06-25 13:42 - 2009-03-15 12:20 - 00000000 ____D C:\Users\Barbara
2016-06-24 19:13 - 2014-07-28 15:17 - 00002611 _____ C:\Users\Barbara\Desktop\Microsoft Office Word 2007.lnk
2016-06-24 16:32 - 2008-10-23 05:42 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2016-06-24 03:02 - 2010-06-04 03:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2016-06-17 01:32 - 2013-03-12 21:28 - 00003682 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2016-06-17 01:31 - 2013-03-12 21:28 - 00796352 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-06-17 01:31 - 2013-03-12 21:28 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-06-15 16:40 - 2009-10-03 00:16 - 00484008 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2016-06-15 03:39 - 2006-11-02 11:21 - 00315152 _____ C:\Windows\system32\FNTCACHE.DAT
2016-06-15 03:14 - 2013-07-14 03:28 - 00000000 ____D C:\Windows\system32\MRT
2016-06-15 03:06 - 2006-11-02 08:35 - 142482544 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
==================== Files in the root of some directories =======
2009-03-15 12:35 - 2009-03-15 12:35 - 0000000 _____ () C:\Users\Barbara\AppData\Local\AtStart.txt
2012-12-22 04:19 - 2014-04-09 03:26 - 0006836 _____ () C:\Users\Barbara\AppData\Local\d3d9caps.dat
2009-05-09 19:15 - 2011-03-15 10:15 - 0003584 _____ () C:\Users\Barbara\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2011-12-27 12:43 - 2011-12-27 12:44 - 0422154 _____ () C:\Users\Barbara\AppData\Local\dd_vcredistMSI599B.txt
2011-12-27 12:43 - 2011-12-27 12:44 - 0011684 _____ () C:\Users\Barbara\AppData\Local\dd_vcredistUI599B.txt
2009-03-15 12:35 - 2009-03-15 12:35 - 0000000 _____ () C:\Users\Barbara\AppData\Local\DSwitch.txt
2009-08-11 14:05 - 2009-08-11 14:05 - 0000000 _____ () C:\Users\Barbara\AppData\Local\FnF4.txt
2009-03-15 12:35 - 2009-03-15 12:35 - 0000000 _____ () C:\Users\Barbara\AppData\Local\QSwitch.txt
2010-04-03 15:14 - 2010-04-03 15:14 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2009-02-15 17:44 - 2009-02-15 17:44 - 0000032 _____ () C:\ProgramData\{051B9612-4D82-42AC-8C63-CD2DCEDC1CB3}.log
2008-10-23 05:36 - 2008-10-23 05:37 - 0000109 _____ () C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log
2009-02-15 17:42 - 2009-02-15 17:42 - 0000032 _____ () C:\ProgramData\{23F3DA62-2D9E-4A69-B8D5-BE8E9E148092}.log
2008-10-23 05:24 - 2008-10-23 05:27 - 0000105 _____ () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
2009-02-15 17:39 - 2009-02-15 17:39 - 0000032 _____ () C:\ProgramData\{4FC670EB-5F02-4B07-90DB-022B86BFEFD0}.log
2009-02-15 17:43 - 2009-02-15 17:43 - 0000032 _____ () C:\ProgramData\{9867824A-C86D-4A83-8F3C-E7A86BE0AFD3}.log
2008-10-23 05:22 - 2008-10-23 05:24 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
2008-10-23 05:27 - 2008-10-23 05:36 - 0000110 _____ () C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log
2009-02-15 17:44 - 2009-02-15 17:44 - 0000105 _____ () C:\ProgramData\{d36dd326-7280-11d8-97c8-000129760cbe}.log
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2016-06-29 10:58
==================== End of FRST.txt ============================

 

FARBAR Addition

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-06-2016
Ran by Barbara (2016-06-29 13:32:53)
Running from C:\Users\Barbara\Desktop
Windows Vista (TM) Home Premium Service Pack 2 (X64) (2009-02-15 20:34:59)
Boot Mode: Normal
==========================================================

==================== Accounts: =============================
Administrator (S-1-5-21-333120211-1585552344-2278992193-500 - Administrator - Disabled)
Barbara (S-1-5-21-333120211-1585552344-2278992193-1000 - Administrator - Enabled) => C:\Users\Barbara
Guest (S-1-5-21-333120211-1585552344-2278992193-501 - Limited - Disabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Microsoft Security Essentials (Enabled - Up to date) {768124D7-F5F7-6D2F-DDC2-94DFA4017C95}
AS: Microsoft Security Essentials (Enabled - Up to date) {CDE0C533-D3CD-62A1-E772-AFADDF863628}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Acrobat.com (HKLM-x32\...\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.1.377 - Adobe Systems Incorporated)
Acrobat.com (x32 Version: 0.0.0 - Adobe Systems Incorporated) Hidden
Activation Assistant for the 2007 Microsoft Office suites (HKLM-x32\...\Activation Assistant for the 2007 Microsoft Office suites) (Version: - Microsoft Corporation)
Activation Assistant for the 2007 Microsoft Office suites (x32 Version: 1.0 - Microsoft Corporation) Hidden
ActiveCheck component for HP Active Support Library (x32 Version: 3.0.0.2 - Hewlett-Packard) Hidden
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.0.4990 - Adobe Systems Inc.)
Adobe Flash Player 10 ActiveX (HKLM-x32\...\Adobe Flash Player 10 ActiveX) (Version: 10.0.2.13 - Adobe Systems Incorporated)
Adobe Flash Player 22 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 22.0.0.192 - Adobe Systems Incorporated)
Adobe Reader X (10.1.16) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.16 - Adobe Systems Incorporated)
Agere Systems HDA Modem (HKLM\...\Agere Systems Soft Modem) (Version: - LSI Corporation)
AMD USB Audio Driver Filter (HKLM-x32\...\{A3AB35FA-943E-4799-99DC-46EFD59E998F}) (Version: 1.0.7.0031 - Advanced Micro Devices, Inc.)
Atheros Driver Installation Program (HKLM-x32\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 5.2 - Atheros)
ATI Catalyst Install Manager (HKLM\...\{7510991E-FE80-7466-2E31-561B52059618}) (Version: 3.0.691.0 - ATI Technologies, Inc.)
Belarc Advisor 8.4 (HKLM-x32\...\Belarc Advisor) (Version: 8.4.0.0 - Belarc Inc.)
ccc-core-static (x32 Version: 2008.0917.337.4556 - ATI) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.13 - Piriform)
Cisco EAP-FAST Module (HKLM-x32\...\{415B2719-AD3A-4944-B404-C472DB6085B3}) (Version: 2.1.6 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{83770D14-21B9-44B3-8689-F7B523F94560}) (Version: 1.0.12 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{669C7BD8-DAA2-49B6-966C-F1E2AAE6B17E}) (Version: 1.0.13 - Cisco Systems, Inc.)
Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6425.1000 - Microsoft Corporation)
CyberLink DVD Suite (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 6.0.2126 - CyberLink Corp.)
DMUninstaller (HKLM-x32\...\DMUninstaller) (Version: - ) <==== ATTENTION
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
ESU for Microsoft Vista (HKLM-x32\...\{3877C901-7B90-4727-A639-B6ED2DD59D43}) (Version: 1.0.0 - Hewlett-Packard)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 49.0.2623.112 - Google Inc.)
Google Update Helper (x32 Version: 1.3.30.3 - Google Inc.) Hidden
HP Customer Experience Enhancements (HKLM-x32\...\{57A5AEC1-97FC-474D-92C4-908FCC2253D4}) (Version: 5.7.0.2664 - Hewlett-Packard)
HP Doc Viewer (HKLM-x32\...\{082702D5-5DD8-4600-BCE5-48B15174687F}) (Version: 1.01.0005 - Hewlett-Packard)
HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.0.71 - WildTangent)
HP Help and Support (HKLM-x32\...\{0054A0F6-00C9-4498-B821-B5C9578F433E}) (Version: 2.1.0.0 - Hewlett-Packard Company)
HP MediaSmart DVD (HKLM-x32\...\InstallShield_{DCCAD079-F92C-44DA-B258-624FC6517A5A}) (Version: 2.0.2126 - Hewlett-Packard)
HP MediaSmart Music/Photo/Video (HKLM-x32\...\InstallShield_{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}) (Version: 2.0.2125 - Hewlett-Packard)
HP MediaSmart SmartMenu (HKLM\...\{D2F7994F-661E-46D1-A1DF-67F2887AAA7E}) (Version: 2.0.8 - Hewlett-Packard)
HP MediaSmart Webcam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 2.0.0926 - Hewlett-Packard)
HP MULTIPLE MODEM INSTALLER for VISTA (HKLM-x32\...\{45A136EC-88BF-4B95-99F5-C45D3930E1CC}) (Version: 1.0.0.30 - Hewlett Packard)
HP Quick Launch Buttons 6.40 H2 (HKLM-x32\...\{34D2AB40-150D-475D-AE32-BD23FB5EE355}) (Version: 6.40 H2 - Hewlett-Packard)
HP Total Care Advisor (HKLM-x32\...\{154A4184-1A3D-4BF9-A5AE-4FA1660445F3}) (Version: 2.4.4941.2798 - Hewlett-Packard)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HP User Guides 0129 (HKLM-x32\...\{149BBCB8-674F-48D2-969C-9D0EA88DA7D6}) (Version: 1.00.0000 - Hewlett-Packard)
HP Wireless Assistant (HKLM-x32\...\{9ADABDDE-9644-461B-9E73-83FA3EFCAB50}) (Version: 3.00 K2 - Hewlett-Packard)
HPAsset component for HP Active Support Library (x32 Version: 3.0.2.2 - Hewlett-Packard) Hidden
HPTCSSetup (HKLM-x32\...\{30D3B7BC-5798-45D9-822D-05CA18F39E99}) (Version: 1.1.1955.2793 - Hewlett-Packard Company)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6087.0 - IDT)
JMicron JMB38X Flash Media Controller (HKLM-x32\...\{26604C7E-A313-4D12-867F-7C6E7820BE4C}) (Version: 1.00.17.07 - JMicron Technology Corp.)
Juno Preloader (HKLM-x32\...\{6423EF83-6E1D-4D22-A36F-689CD19FD4D2}) (Version: 1.0.0 - Juno, Inc.)
KODAK Share Button App (HKLM-x32\...\{19F1A99A-196F-4D18-BC36-C1DAD6ABCCF3}) (Version: 4.00.0000.0000 - Eastman Kodak Company)
LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.0919 - CyberLink Corp.)
LabelPrint (x32 Version: 2.5.0919 - CyberLink Corp.) Hidden
LightScribe System Software 1.14.17.1 (HKLM-x32\...\{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}) (Version: 1.14.17.1 - LightScribe)
Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Live Search Toolbar (HKLM-x32\...\{6A370610-3778-44AF-9AAC-69B2FD1A3356}) (Version: 3.0.541.0 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-001A-0000-0000-0000000FF1CE}_OUTLOOKR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Outlook 2007 (HKLM-x32\...\OUTLOOKR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\...\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.9.218.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50428.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (HKLM\...\{EE936C7A-EA40-31D5-9B65-8E3E089C3828}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{4FFA2088-8317-3B14-93CD-4C699DB37843}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218 (HKLM-x32\...\{E503B4BF-F7BB-3D5F-8BC8-F694B1CFF942}) (Version: 9.0.21022.218 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Works (HKLM-x32\...\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}) (Version: 9.7.0621 - Microsoft Corporation)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 38.5.0 - Mozilla)
Mozilla Thunderbird 38.5.0 (x86 en-US) (HKLM-x32\...\Mozilla Thunderbird 38.5.0 (x86 en-US)) (Version: 38.5.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
muvee Reveal (HKLM-x32\...\{DD35C328-F115-BEDA-6EEE-E00C5AACCCBC}) (Version: 7.0.35.6951 - muvee Technologies Pte Ltd)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9.140.239 - Google, Inc.)
Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.2119 - CyberLink Corp.)
Power2Go (x32 Version: 6.0.2119 - CyberLink Corp.) Hidden
PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 7.0.2119 - CyberLink Corp.)
PowerDirector (x32 Version: 7.0.2119 - CyberLink Corp.) Hidden
ProtectSmart Hard Drive Protection (HKLM\...\{2F97CE84-9C33-4631-821B-85EA371EA254}) (Version: 3.10.1.7 - Hewlett-Packard)
Realtek 8169, 8168, 8101E and 8102E Ethernet Network Card Driver for Windows Vista (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0000 - Realtek)
Skins (x32 Version: 2008.0917.337.4556 - ATI) Hidden
Skype Toolbars (HKLM-x32\...\{981029E0-7FC9-4CF3-AB39-6F133621921A}) (Version: 1.0.4051 - Skype Technologies S.A.)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Slingbox - Watch Your TV Anywhere (HKLM-x32\...\{7B798B31-2F33-4DC8-BDA4-D36488E86636}) (Version: 1.0.0 - Sling Media)
SlingPlayer (HKLM-x32\...\InstallShield_{004B0DCB-4C60-465B-8F01-44B0A4111187}) (Version: 1.04.0206 - Sling Media)
SlingPlayer (x32 Version: 1.04.0206 - Sling Media) Hidden
Spelling Dictionaries Support For Adobe Reader 9 (HKLM-x32\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
SPORE Creature Creator Trial Edition (HKLM-x32\...\{ECEE0279-785F-4CB3-9F28-E69813234BF8}) (Version: 1.00.0000 - Electronic Arts)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.27.1 - Synaptics Incorporated)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-001A-0000-0000-0000000FF1CE}_OUTLOOKR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Windows Driver Package - Eastman Kodak KODAK Digital Camera (01/29/2010 1.4.1.0) (HKLM\...\3D970B9F930E7AAE23C06D39A1AC98548C90B442) (Version: 01/29/2010 1.4.1.0 - Eastman Kodak)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {036E36E9-7ECA-463D-BEE9-BF0AE989698F} - System32\Tasks\{10EF5062-FADE-4238-95E4-4EA61663B88F}-Kodak Share Button App Camera detect => C:\Program Files (x86)\Kodak\KODAK Share Button App\Listener.exe [2011-09-22] (Eastman Kodak Company)
Task: {14E70405-9297-4B33-9136-262275B7A6C6} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)
Task: {2270EE6E-FD3D-4397-B6EB-3C409AA6A9CE} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Barbara => C:\Program Files (x86)\Windows Calendar\wincal.exe [2009-04-11] (Microsoft Corporation)
Task: {480F399F-EEC0-4DBD-A0A9-EB470720D5A1} - System32\Tasks\HPCeeScheduleForBarbara => C:\Program Files (x86)\hewlett-packard\sdp\ceement\HPCEE.exe [2008-05-19] (Hewlett-Packard)
Task: {70FAABFB-DAEB-4BF6-AC18-65D2944EB407} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-07-28] (Google Inc.)
Task: {874C940B-C79D-4A0D-8CB9-F30EF61BB7D9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-07-28] (Google Inc.)
Task: {9F3A227D-0B84-4572-90B9-7493B3C9E26C} - System32\Tasks\HP Health Check => c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2008-06-16] (Hewlett-Packard)
Task: {AD863B1F-E583-4E14-AA75-928868F5ECE5} - System32\Tasks\{C4479596-C7A9-4AB2-9B3A-5844A8DEAA6D} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2014-12-11] (Skype Technologies S.A.)
Task: {B8A13BC7-683F-45C8-A79E-74C7526403EA} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-04-17] (Piriform Ltd)
Task: {DA12C612-354A-436E-8182-6DB911689B7F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-06-17] (Adobe Systems Incorporated)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForBarbara.job => C:\Program Files (x86)\hewlett-packard\sdp\ceement\HPCEE.exe
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk -> hxxp://redirect.hp.com/svs/rdr?TYPE=4&tp=onlinesvs&s=ebay&pf=cnnb&locale=en_us&bd=all&c=914C:\Program Files (x86)\Online Services\eBay\ebay.ico (No File)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Quicken Financial Center.lnk -> hxxp://redirect.hp.com/svs/rdr?TYPE=4&tp=onlinesvs&s=quickenfc&pf=cnnb&locale=en_us&bd=pavilion&c=91EC:\Program Files (x86)\Online Services\quickenfc\financial_center.ico (No File)
==================== Loaded Modules (Whitelisted) ==============
2008-09-17 00:16 - 2008-09-17 00:16 - 00117248 _____ () C:\Windows\system32\atitmm64.dll
2008-10-23 05:48 - 2008-10-06 12:54 - 00365952 _____ () C:\Program Files (x86)\SMINST\BLService.exe
2008-10-23 05:36 - 2008-06-29 19:10 - 00241734 _____ () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
2008-10-23 04:36 - 2008-04-11 12:04 - 00685360 _____ () C:\Program Files (x86)\Hewlett-Packard\Shared\HpqToaster.exe
2009-02-15 16:44 - 2009-02-15 16:44 - 00014848 _____ () C:\Windows\assembly\GAC_MSIL\AxInterop.WBOCXLib\1.0.0.0__90ba9c70f846762e\AxInterop.WBOCXLib.dll
2008-08-22 14:03 - 2008-08-22 14:03 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2008-10-23 05:48 - 2008-10-06 12:54 - 00132480 _____ () C:\Program Files (x86)\SMINST\STWmiM.dll
2007-07-12 17:55 - 2007-07-12 17:55 - 01581056 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll
2007-08-14 17:59 - 2007-08-14 17:59 - 06365184 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll
2007-07-12 17:55 - 2007-07-12 17:55 - 00131072 _____ () C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll
2008-09-25 22:42 - 2008-09-25 22:42 - 00881960 ____N () C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMediaLibrary.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => " "= "Driver "
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => " "= "Driver "
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
HKLM\...\cmdfile\DefaultIcon: %SystemRoot%\System32\shell32.dll,-153 <===== ATTENTION
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2006-11-02 08:34 - 2006-09-18 17:37 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-333120211-1585552344-2278992193-1000\Control Panel\Desktop\\Wallpaper -> C:\windows\web\wallpaper\Bronze1.jpg
DNS Servers: 68.100.16.30 - 68.10.16.30
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 2) (ConsentPromptBehaviorUser: 1) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\startupreg: HP Health Check Scheduler => c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
MSCONFIG\startupreg: SmartMenu => %ProgramFiles%\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [WinCollab-Out-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-In-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-Out-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-In-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-DFSR-Out-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
FirewallRules: [WinCollab-DFSR-In-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
FirewallRules: [{2D720E0B-FB17-4C8A-9F86-B55938CFA8A9}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDirector\PDR.EXE
FirewallRules: [{6C19D66F-67C0-4616-8F12-CDC866456086}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\Media\DVD\HPTouchSmartMusic.exe
FirewallRules: [{3E357E02-B7C9-4F2E-B3B4-5619DF9CEA96}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\Media\DVD\HPTouchSmartPhoto.exe
FirewallRules: [{F5864058-E43B-4A74-8C6C-5F2E053A95F4}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\Media\DVD\HPTouchSmartVideo.exe
FirewallRules: [{12E20DB7-1EEB-4780-AD3D-3C9DEF2F9855}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\Media\DVD\TSMAgent.exe
FirewallRules: [{57464C92-B65A-4DC1-AFF9-6D7C4FF1EFD5}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\Media\DVD\Kernel\CLML\CLMLSvc.exe
FirewallRules: [{9C1BBABE-541E-4AE4-8C4A-DD1EAFD37324}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\Media\DVD\HPDVDSmart.exe
FirewallRules: [{4DBFF9F9-3622-42EF-9B74-0A91B2F49642}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\HPTouchSmartMusic.exe
FirewallRules: [{95AA8929-76A7-49D4-A5FA-CE242771C311}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\HPTouchSmartPhoto.exe
FirewallRules: [{0E0D3F80-CE25-46F5-BFB5-9524CAFF2D31}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\HPTouchSmartVideo.exe
FirewallRules: [{4ABC1618-7C7D-460C-A171-3F03E6BF6B38}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe
FirewallRules: [{3B7CB015-AA77-462D-9168-0AC13423A040}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
FirewallRules: [{49027FB1-07DE-4A80-9C75-C2B03C9A8163}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\Media\TV\QP.exe
FirewallRules: [{0AABC289-FE10-4E12-8DD4-F3E6296E302E}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\Media\TV\QPService.exe
FirewallRules: [{86E0556D-48B5-4D8D-839A-1273240490A6}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{6A5D9B48-3B83-4704-815C-DB7E3F75AF58}] => (Allow) LPort=80
FirewallRules: [{46CC1CE8-C770-419E-AA2A-6B69FA1920E4}] => (Allow) LPort=80
FirewallRules: [{9DCC2800-DCEA-4EA5-B8EC-E358B1EBD5DE}] => (Allow) LPort=80
FirewallRules: [{B6DCAD06-E8A1-4BA2-8B3C-06A8AE2AFA16}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Restore Points =========================
04-06-2016 03:00:33 Windows Update
05-06-2016 03:00:13 Windows Update
06-06-2016 03:00:13 Windows Update
09-06-2016 19:02:43 Windows Update
10-06-2016 03:00:13 Windows Update
11-06-2016 03:00:13 Windows Update
12-06-2016 03:00:13 Windows Update
13-06-2016 03:00:14 Windows Update
14-06-2016 03:00:15 Windows Update
15-06-2016 03:00:22 Windows Update
16-06-2016 03:00:13 Windows Update
17-06-2016 03:00:14 Windows Update
18-06-2016 03:00:13 Windows Update
19-06-2016 03:00:13 Windows Update
20-06-2016 03:00:14 Windows Update
21-06-2016 03:00:13 Windows Update
22-06-2016 03:00:13 Windows Update
23-06-2016 03:00:13 Windows Update
24-06-2016 03:00:13 Windows Update
25-06-2016 03:00:32 Windows Update
25-06-2016 13:27:05 Windows Update
25-06-2016 13:33:50 Windows Update
26-06-2016 03:00:14 Windows Update
27-06-2016 03:00:14 Windows Update
28-06-2016 03:00:14 Windows Update
29-06-2016 03:00:15 Windows Update
29-06-2016 09:04:34 Windows Update
29-06-2016 09:21:02 Windows Update
29-06-2016 10:47:53 Windows Update
29-06-2016 13:08:45 Windows Update
==================== Faulty Device Manager Devices =============
Name: Microsoft 6to4 Adapter #3
Description: Microsoft 6to4 Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

==================== Event log errors: =========================
Application errors:
==================
Error: (06/29/2016 10:53:09 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/29/2016 10:50:37 AM) (Source: EventSystem) (EventID: 4621) (User: )
Description: 80070005EventSystem.EventSubscription{CEB8B221-89C5-41A8-98CE-79B413BF150B}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}
Error: (06/29/2016 09:12:10 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/29/2016 04:37:00 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/28/2016 02:50:38 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program OUTLOOK.EXE version 12.0.6744.5000 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel.
Process ID: d44
Start Time: 01d1d16d567a48b2
Termination Time: 21
Error: (06/28/2016 02:40:43 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/28/2016 02:07:50 PM) (Source: EventSystem) (EventID: 4621) (User: )
Description: 80070005EventSystem.EventSubscription{CEB8B221-89C5-41A8-98CE-79B413BF150B}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}
Error: (06/28/2016 01:33:08 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: PNRPsvcC:\Windows\system32\pnrpperf.dll8
Error: (06/28/2016 01:33:06 PM) (Source: Perflib) (EventID: 1010) (User: )
Description: EmdCacheC:\Windows\system32\emdmgmt.dll8
Error: (06/28/2016 01:33:06 PM) (Source: Perflib) (EventID: 1008) (User: )
Description: BITSC:\Windows\system32\bitsperf.dll8

System errors:
=============
Error: (06/29/2016 01:14:42 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: 0x80070663Security Update for Microsoft Office Compatibility Pack Service Pack 3 (KB3115115){4D789B7A-515B-4179-BC71-D3137709FCE6}201
Error: (06/29/2016 01:14:42 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: 0x80070663Security Update for Microsoft Office Compatibility Pack Service Pack 3 (KB3114895){10075F40-EDB1-4FEE-BE9E-7E2499449BEF}201
Error: (06/29/2016 10:56:59 AM) (Source: PlugPlayManager) (EventID: 12) (User: )
Description: The device 'JMB38X xD Host Controller' (PCI\VEN_197B&DEV_2384&SUBSYS_30FC103C&REV_00\4&3b4983b4&0&0428) disappeared from the system without first being prepared for removal.
Error: (06/29/2016 10:56:59 AM) (Source: PlugPlayManager) (EventID: 12) (User: )
Description: The device 'JMB38X MS Host Controller' (PCI\VEN_197B&DEV_2383&SUBSYS_30FC103C&REV_00\4&3b4983b4&0&0328) disappeared from the system without first being prepared for removal.
Error: (06/29/2016 10:56:59 AM) (Source: PlugPlayManager) (EventID: 12) (User: )
Description: The device 'JMB38X SD Host Controller' (PCI\VEN_197B&DEV_2381&SUBSYS_30FC103C&REV_00\4&3b4983b4&0&0228) disappeared from the system without first being prepared for removal.
Error: (06/29/2016 10:56:58 AM) (Source: PlugPlayManager) (EventID: 12) (User: )
Description: The device 'JMB38X SD/MMC Host Controller' (PCI\VEN_197B&DEV_2382&SUBSYS_30FC103C&REV_00\4&3b4983b4&0&0028) disappeared from the system without first being prepared for removal.
Error: (06/29/2016 10:53:09 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: SRTSP
SRTSPX
Error: (06/29/2016 10:53:09 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Norton Internet Security%%3 = The system cannot find the path specified.

Error: (06/29/2016 10:50:48 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: 0x80070663Security Update for Microsoft Office Compatibility Pack Service Pack 3 (KB3115115){4D789B7A-515B-4179-BC71-D3137709FCE6}201
Error: (06/29/2016 10:50:48 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: 0x80070663Security Update for Microsoft Office Compatibility Pack Service Pack 3 (KB3114895){10075F40-EDB1-4FEE-BE9E-7E2499449BEF}201

CodeIntegrity:
===================================
Date: 2016-06-29 06:48:04.793
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.
Date: 2016-06-29 06:48:02.850
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.
Date: 2016-06-29 06:48:00.704
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.
Date: 2016-06-29 06:47:58.390
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.
Date: 2016-06-29 06:47:56.189
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.
Date: 2016-06-29 06:47:53.928
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.
Date: 2016-06-29 06:47:51.355
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.
Date: 2016-06-29 06:47:49.160
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.
Date: 2016-06-29 06:47:46.962
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.
Date: 2016-06-29 06:47:44.762
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

==================== Memory info ===========================
Processor: AMD Turion(tm) X2 Dual-Core Mobile RM-72
Percentage of memory in use: 52%
Total physical RAM: 3836.89 MB
Available physical RAM: 1825.18 MB
Total Virtual: 7906.31 MB
Available Virtual: 5536.64 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:285.18 GB) (Free:155.86 GB) NTFS ==>[drive with boot components (obtained from BCD)]
Drive d: (RECOVERY) (Fixed) (Total:12.9 GB) (Free:2.02 GB) NTFS ==>[system with boot components (obtained from drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 298.1 GB) (Disk ID: 89900F6B)
Partition 1: (Active) - (Size=285.2 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=12.9 GB) - (Type=07 NTFS)
==================== End of Addition.txt ============================

 

Broni,

Here are the logs:

RogueKiller:

RogueKiller V12.3.6.0 [Jun 27 2016] (Free) by Adlice Software
mail : Contact - Adlice Software
Feedback : Adlice forum
Website : RogueKiller Anti-Malware Free Download - Official Website
Blog : Adlice Software
Operating System : Windows Vista (6.0.6002 Service Pack 2) 64 bits version
Started in : Normal mode
User : Barbara [Administrator]
Started from : C:\Users\Barbara\Desktop\RogueKiller.exe
Mode : Delete -- Date : 06/30/2016 09:30:15
¤¤¤ Processes : 0 ¤¤¤
¤¤¤ Registry : 17 ¤¤¤
[PUP] (X64) HKEY_LOCAL_MACHINE\Software\DomaIQ -> Not selected
[PUP] (X64) HKEY_LOCAL_MACHINE\Software\Tarma Installer -> Not selected
[PUP] (X86) HKEY_LOCAL_MACHINE\Software\CompeteInc -> Not selected
[PUP] (X86) HKEY_LOCAL_MACHINE\Software\Conduit -> Not selected
[PUP] (X86) HKEY_LOCAL_MACHINE\Software\InstallIQ -> Not selected
[PUP] (X86) HKEY_LOCAL_MACHINE\Software\SearchProtect -> Not selected
[PUP] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670} -> Not selected
[PUP] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run | SearchProtect : \SearchProtect\bin\cltmng.exe [x] -> Not selected
[PUP] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run | SearchProtect : \SearchProtect\bin\cltmng.exe [x] -> Not selected
[PUP] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run | SearchProtect : \SearchProtect\bin\cltmng.exe [x] -> Not selected
[PUP] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run | SearchProtect : \SearchProtect\bin\cltmng.exe [x] -> Not selected
[PUM.HomePage] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Start Page : News, Sports, Weather, Entertainment, Local & Lifestyle - AOL -> Not selected
[PUM.HomePage] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Start Page : News, Sports, Weather, Entertainment, Local & Lifestyle - AOL -> Not selected
[PUM.HomePage] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : News, Sports, Weather, Entertainment, Local & Lifestyle - AOL -> Not selected
[PUM.HomePage] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Default_Page_URL : http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb -> Not selected
[PUM.SearchPage] (X64) HKEY_USERS\S-1-5-21-333120211-1585552344-2278992193-1000\Software\Microsoft\Internet Explorer\Main | Search Bar : Preserve -> Not selected
[PUM.SearchPage] (X86) HKEY_USERS\S-1-5-21-333120211-1585552344-2278992193-1000\Software\Microsoft\Internet Explorer\Main | Search Bar : Preserve -> Not selected
¤¤¤ Tasks : 0 ¤¤¤
¤¤¤ Files : 1 ¤¤¤
[PUP][Folder] C:\Program Files (x86)\SearchProtect -> Deleted
[PUP][File] C:\Program Files (x86)\SearchProtect\bin\msvcp100.dll -> Deleted
[PUP][File] C:\Program Files (x86)\SearchProtect\bin\msvcr100.dll -> Deleted
[PUP][Folder] C:\Program Files (x86)\SearchProtect\bin -> Deleted
[PUP][Folder] C:\Program Files (x86)\SearchProtect\Dialogs\lib -> Deleted
[PUP][Folder] C:\Program Files (x86)\SearchProtect\Dialogs\spbd\images -> Deleted
[PUP][Folder] C:\Program Files (x86)\SearchProtect\Dialogs\spbd -> Deleted
[PUP][Folder] C:\Program Files (x86)\SearchProtect\Dialogs\spsd\images -> Deleted
[PUP][Folder] C:\Program Files (x86)\SearchProtect\Dialogs\spsd -> Deleted
[PUP][Folder] C:\Program Files (x86)\SearchProtect\Dialogs -> Deleted
[PUP][Folder] C:\Program Files (x86)\SearchProtect\ffprotect -> Deleted
¤¤¤ Hosts File : 0 ¤¤¤
¤¤¤ Antirootkit : 0 (Driver: Not loaded [0xc000036b]) ¤¤¤
¤¤¤ Web browsers : 0 ¤¤¤
¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: TOSHIBA MK3252GSX ATA Device +++++
--- User ---
[MBR] b424df27bf04a85c6a2b283f75a9bf42
[BSP] 0046ad4d393ab0194bcc5e4e3109c6c0 : Toshiba MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 292028 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 598075392 | Size: 13213 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
User = LL1 ... OK
User = LL2 ... OK

Malwarebytes:

Malwarebytes Anti-Malware
www.malwarebytes.org
Scan Date: 6/30/2016
Scan Time: 9:34:12 AM
Logfile: MBAM.txt
Administrator: Yes
Version: 2.2.1.1043
Malware Database: v2016.06.30.07
Rootkit Database: v2016.05.27.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled
OS: Windows Vista Service Pack 2
CPU: x64
File System: NTFS
User: Barbara
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 301364
Time Elapsed: 24 min, 6 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Warn
PUM: Enabled
Processes: 0
(No malicious items detected)
Modules: 0
(No malicious items detected)
Registry Keys: 40
PUP.Optional.Yontoo, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}, Quarantined, [46d913f047539f97e675643033cf669a],
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\TYPELIB\{D372567D-67C1-4B29-B3F0-159B52B3E967}, Quarantined, [46d913f047539f97e675643033cf669a],
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\INTERFACE\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}, Quarantined, [46d913f047539f97e675643033cf669a],
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\INTERFACE\{1AD27395-1659-4DFF-A319-2CFA243861A5}, Quarantined, [46d913f047539f97e675643033cf669a],
PUP.Optional.Yontoo, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}, Quarantined, [46d913f047539f97e675643033cf669a],
PUP.Optional.Yontoo, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{1AD27395-1659-4DFF-A319-2CFA243861A5}, Quarantined, [46d913f047539f97e675643033cf669a],
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}, Quarantined, [46d913f047539f97e675643033cf669a],
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{1AD27395-1659-4DFF-A319-2CFA243861A5}, Quarantined, [46d913f047539f97e675643033cf669a],
PUP.Optional.Yontoo, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{D372567D-67C1-4B29-B3F0-159B52B3E967}, Quarantined, [46d913f047539f97e675643033cf669a],
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\WOW6432NODE\TYPELIB\{D372567D-67C1-4B29-B3F0-159B52B3E967}, Quarantined, [46d913f047539f97e675643033cf669a],
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\YontooIEClient.Layers.1, Quarantined, [46d913f047539f97e675643033cf669a],
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\YontooIEClient.Layers, Quarantined, [46d913f047539f97e675643033cf669a],
PUP.Optional.Yontoo, HKLM\SOFTWARE\WOW6432NODE\CLASSES\YontooIEClient.Layers, Quarantined, [46d913f047539f97e675643033cf669a],
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\WOW6432NODE\YontooIEClient.Layers, Quarantined, [46d913f047539f97e675643033cf669a],
PUP.Optional.Yontoo, HKLM\SOFTWARE\WOW6432NODE\CLASSES\YontooIEClient.Layers.1, Quarantined, [46d913f047539f97e675643033cf669a],
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\WOW6432NODE\YontooIEClient.Layers.1, Quarantined, [46d913f047539f97e675643033cf669a],
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}, Quarantined, [46d913f047539f97e675643033cf669a],
PUP.Optional.Yontoo, HKU\S-1-5-21-333120211-1585552344-2278992193-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}, Quarantined, [46d913f047539f97e675643033cf669a],
PUP.Optional.Yontoo, HKU\S-1-5-21-333120211-1585552344-2278992193-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}, Quarantined, [46d913f047539f97e675643033cf669a],
PUP.Optional.ConduitTB.Gen, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{3c471948-f874-49f5-b338-4f214a2ee0b1}, Quarantined, [22fd9d66dbbfb48289cdf1acca39de22],
PUP.Optional.ConduitTB.Gen, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}, Quarantined, [22fd9d66dbbfb48289cdf1acca39de22],
PUP.Optional.DomaIQ, HKLM\SOFTWARE\DomaIQ, Quarantined, [b7689271a0faff370723a2ffc142af51],
PUP.Optional.ConduitTB.Gen, HKLM\SOFTWARE\CLASSES\Toolbar.CT3298570, Quarantined, [4bd4a1623961e254aa72ade57e85ca36],
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\YontooIEClient.Api, Quarantined, [96890af927732b0b1d8fe4d9aa591be5],
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\YontooIEClient.Api.1, Quarantined, [7ca3d92afb9f86b01993f3ca22e1ec14],
PUP.Optional.BetterSurf, HKLM\SOFTWARE\CLASSES\APPID\YontooIEClient.DLL, Quarantined, [8f9080830595aa8cab639bfeb84ba060],
PUP.Optional.ConduitTB.Gen, HKLM\SOFTWARE\CLASSES\WOW6432NODE\Toolbar.CT3298570, Quarantined, [988710f31d7db185eb310c865aa9f907],
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\WOW6432NODE\YontooIEClient.Api, Quarantined, [44db748f148660d6a10bc9f4f70cbc44],
PUP.Optional.Yontoo, HKLM\SOFTWARE\CLASSES\WOW6432NODE\YontooIEClient.Api.1, Quarantined, [74ab4cb7326880b67933c6f7cc3739c7],
PUP.Optional.BetterSurf, HKLM\SOFTWARE\CLASSES\WOW6432NODE\APPID\YontooIEClient.DLL, Quarantined, [859a27dcd1c95cdade30cacf9c6733cd],
PUP.Optional.ConsumerInput, HKLM\SOFTWARE\WOW6432NODE\CompeteInc, Quarantined, [bb6450b36a30a294e18cf89c49ba3cc4],
PUP.Optional.InstallBrain, HKLM\SOFTWARE\WOW6432NODE\InstallIQ, Quarantined, [24fbc04355459e986b5e3275b1523ac6],
PUP.Optional.ConduitTB.Gen, HKLM\SOFTWARE\WOW6432NODE\CLASSES\Toolbar.CT3298570, Quarantined, [2ff02ed58b0fb48262ba6b27f40f56aa],
PUP.Optional.Yontoo, HKLM\SOFTWARE\WOW6432NODE\CLASSES\YontooIEClient.Api, Quarantined, [20ff8083e6b472c4703c5865d42f48b8],
PUP.Optional.Yontoo, HKLM\SOFTWARE\WOW6432NODE\CLASSES\YontooIEClient.Api.1, Quarantined, [c55aac57415961d574387647010227d9],
PUP.Optional.BetterSurf, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\YontooIEClient.DLL, Quarantined, [48d7be452f6b0e28c04e4a4ffb086e92],
PUP.Optional.Yontoo, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\niapdbllcanepiiimjjndipklodoedlc, Quarantined, [d44b6d965b3f71c5535a0cb142c13dc3],
PUP.Optional.SearchProtect.AppFlsh, HKU\S-1-5-21-333120211-1585552344-2278992193-1000\SOFTWARE\SearchProtect, Quarantined, [96897d86bae072c4fec6815db2519868],
PUP.Optional.Conduit, HKU\S-1-5-21-333120211-1585552344-2278992193-1000\SOFTWARE\APPDATALOW\SOFTWARE\ConduitSearchScopes, Quarantined, [100f41c2455581b55de2f9a4ae555ca4],
PUP.Optional.PriceGong, HKU\S-1-5-21-333120211-1585552344-2278992193-1000\SOFTWARE\APPDATALOW\SOFTWARE\PriceGong, Quarantined, [2df213f0297180b623f9664bc043f10f],
Registry Values: 1
PUP.Optional.ConduitSearchProtect, HKU\S-1-5-18\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|SearchProtect, \SearchProtect\bin\cltmng.exe, Quarantined, [c7581de6346663d3104ce497d82b7a86]
Registry Data: 0
(No malicious items detected)
Folders: 34
PUP.Optional.ConduitTB.Gen, C:\Program Files (x86)\Conduit\Community Alerts, Quarantined, [22fd9d66dbbfb48289cdf1acca39de22],
PUP.Optional.ConduitTB.Gen, C:\Program Files (x86)\Conduit, Quarantined, [22fd9d66dbbfb48289cdf1acca39de22],
PUP.Optional.APNToolBar.Gen, C:\ProgramData\APN\APN-Stub, Quarantined, [bd6243c09a0069cd27b105a69b67cc34],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong, Delete-on-Reboot, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.Yontoo, C:\Program Files (x86)\Yontoo, Quarantined, [908fc83b9406bb7b4c12576ae0228f71],
PUP.Optional.Blekko, C:\Users\Barbara\AppData\LocalLow\blekkotb_019, Quarantined, [aa7515eebcdeef473d7dbb0a897917e9],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\Local\Conduit, Quarantined, [28f7da290e8c0f275e088f380af86799],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit, Delete-on-Reboot, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts, Delete-on-Reboot, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs, Delete-on-Reboot, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog, Delete-on-Reboot, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images, Delete-on-Reboot, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\dark, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\light, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Feeds, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\LanguagePacks, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Log, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.SearchProtect.AppFlsh, C:\Users\Barbara\AppData\Roaming\SearchProtect, Delete-on-Reboot, [31ee956edbbf072feb09a522fc06ba46],
PUP.Optional.SearchProtect.AppFlsh, C:\Users\Barbara\AppData\Roaming\SearchProtect\bin, Quarantined, [31ee956edbbf072feb09a522fc06ba46],
PUP.Optional.SearchProtect.AppFlsh, C:\Users\Barbara\AppData\Roaming\SearchProtect\Dialogs, Delete-on-Reboot, [31ee956edbbf072feb09a522fc06ba46],
PUP.Optional.SearchProtect.AppFlsh, C:\Users\Barbara\AppData\Roaming\SearchProtect\Dialogs\lib, Quarantined, [31ee956edbbf072feb09a522fc06ba46],
PUP.Optional.SearchProtect.AppFlsh, C:\Users\Barbara\AppData\Roaming\SearchProtect\Dialogs\spbd, Delete-on-Reboot, [31ee956edbbf072feb09a522fc06ba46],
PUP.Optional.SearchProtect.AppFlsh, C:\Users\Barbara\AppData\Roaming\SearchProtect\Dialogs\spbd\images, Quarantined, [31ee956edbbf072feb09a522fc06ba46],
PUP.Optional.SearchProtect.AppFlsh, C:\Users\Barbara\AppData\Roaming\SearchProtect\Dialogs\spsd, Delete-on-Reboot, [31ee956edbbf072feb09a522fc06ba46],
PUP.Optional.SearchProtect.AppFlsh, C:\Users\Barbara\AppData\Roaming\SearchProtect\Dialogs\spsd\images, Quarantined, [31ee956edbbf072feb09a522fc06ba46],
PUP.Optional.SearchProtect.AppFlsh, C:\Users\Barbara\AppData\Roaming\SearchProtect\ffprotect, Delete-on-Reboot, [31ee956edbbf072feb09a522fc06ba46],
PUP.Optional.SearchProtect.AppFlsh, C:\Users\Barbara\AppData\Roaming\SearchProtect\ffprotect\Dialogs, Delete-on-Reboot, [31ee956edbbf072feb09a522fc06ba46],
PUP.Optional.SearchProtect.AppFlsh, C:\Users\Barbara\AppData\Roaming\SearchProtect\ffprotect\Dialogs\lib, Quarantined, [31ee956edbbf072feb09a522fc06ba46],
PUP.Optional.SearchProtect.AppFlsh, C:\Users\Barbara\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spbd, Delete-on-Reboot, [31ee956edbbf072feb09a522fc06ba46],
PUP.Optional.SearchProtect.AppFlsh, C:\Users\Barbara\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spbd\images, Quarantined, [31ee956edbbf072feb09a522fc06ba46],
PUP.Optional.SearchProtect.AppFlsh, C:\Users\Barbara\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spsd, Delete-on-Reboot, [31ee956edbbf072feb09a522fc06ba46],
PUP.Optional.SearchProtect.AppFlsh, C:\Users\Barbara\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spsd\images, Quarantined, [31ee956edbbf072feb09a522fc06ba46],
PUP.Optional.SearchProtect.AppFlsh, C:\Users\Barbara\AppData\Roaming\SearchProtect\ffprotect\SProtectorRepository, Quarantined, [31ee956edbbf072feb09a522fc06ba46],
Files: 83
PUP.Optional.ConduitTB.Gen, C:\Program Files (x86)\Conduit\Community Alerts\Alert.dll, Quarantined, [22fd9d66dbbfb48289cdf1acca39de22],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\1.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\20256.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\2229.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\26928.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\27472.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\371.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\4436.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\4489.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\450.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\8963.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\946.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\a.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\b.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\c.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\d.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\e.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\f.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\g.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\h.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\i.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\j.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\k.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\l.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\m.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\mru.xml, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\n.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\o.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\p.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\q.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\r.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\s.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\t.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\u.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\v.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\w.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\wlu.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\x.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\y.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.PriceGong, C:\Users\Barbara\AppData\LocalLow\PriceGong\Data\z.txt, Quarantined, [8996ca39dbbfd165c7735962b05246ba],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\DialogsAPI.js, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\PIE.htc, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\settings.js, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\version.txt, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\AppNotification.js, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\initialNotification.html, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\main.html, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\NotificationDialogStyle.css, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\NotificationDialogStyleIE9.css, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\sampleNotification.html, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\close.png, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\like.png, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Next.png, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Next_hover.png, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\powered-by.png, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Prev.png, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Prev_hover.png, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\settings.png, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Thumbs.db, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\dark\close.png, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\dark\closeBtn.png, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\dark\Next.png, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\dark\Next_hover.png, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\dark\powered-by.png, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\dark\Prev.png, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\dark\Prev_hover.png, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\dark\settings.png, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\dark\settingsBtn.png, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\light\close.png, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\light\closeBtn.png, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\light\Next.png, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\light\Next_hover.png, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\light\powered-by.png, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\light\Prev.png, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\light\Prev_hover.png, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\light\settings.png, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\light\settingsBtn.png, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\light\Thumbs.db, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\Feeds\http___alerts_conduit-services_com_root_1783530_1774071_US.xml, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.Conduit, C:\Users\Barbara\AppData\LocalLow\Conduit\Community Alerts\LanguagePacks\en.xml, Quarantined, [859abf44efab122414539136c0427c84],
PUP.Optional.SearchProtect.AppFlsh, C:\Users\Barbara\AppData\Roaming\SearchProtect\bin\msvcp100.dll, Quarantined, [31ee956edbbf072feb09a522fc06ba46],
PUP.Optional.SearchProtect.AppFlsh, C:\Users\Barbara\AppData\Roaming\SearchProtect\bin\msvcr100.dll, Quarantined, [31ee956edbbf072feb09a522fc06ba46],
PUP.Optional.SearchProtect.AppFlsh, C:\Users\Barbara\AppData\Roaming\SearchProtect\bin\rep.dat, Quarantined, [31ee956edbbf072feb09a522fc06ba46],
Physical Sectors: 0
(No malicious items detected)

(end)

AdwareCleaner:

# AdwCleaner v5.200 - Logfile created 30/06/2016 at 10:32:10
# Updated 14/06/2016 by ToolsLib
# Database : 2016-06-14.1 [Local]
# Operating system : Windows (TM) Vista Home Premium Service Pack 2 (X64)
# Username : Barbara - BARBARA-PC
# Running from : C:\Users\Barbara\Desktop\adwcleaner_5.200.exe
# Option : Clean
# Support : https://toolslib.net/forum
***** [ Services ] *****

***** [ Folders ] *****
[#] Folder Deleted : C:\SearchProtect
[#] Folder Deleted : C:\ProgramData\apn
[#] Folder Deleted : C:\ProgramData\blekko toolbars
[#] Folder Deleted : C:\ProgramData\Application Data\apn
[#] Folder Deleted : C:\ProgramData\Application Data\blekko toolbars
[#] Folder Deleted : C:\Users\Public\Documents\iWin
[#] Folder Deleted : C:\Users\Barbara\AppData\Local\TopArcadeHits
[#] Folder Deleted : C:\Users\Barbara\AppData\LocalLow\Conduit
[#] Folder Deleted : C:\Users\Barbara\AppData\Roaming\iWin
[#] Folder Deleted : C:\Users\Barbara\AppData\Roaming\SearchProtect
***** [ Files ] *****
[-] File Deleted : C:\END
[-] File Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk
***** [ DLLs ] *****

***** [ WMI ] *****

***** [ Shortcuts ] *****

***** [ Scheduled tasks ] *****

***** [ Registry ] *****
[-] Key Deleted : HKLM\SOFTWARE\Classes\Sample.BrowserHandler
[-] Key Deleted : HKLM\SOFTWARE\Classes\Sample.BrowserHandler.1
[-] Key Deleted : HKLM\SOFTWARE\Classes\Sample.YTBPartnerSample
[-] Key Deleted : HKLM\SOFTWARE\Classes\Sample.YTBPartnerSample.1
[-] Key Deleted : HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar
[-] Key Deleted : HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar.1
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{7375D127-3955-4654-8E7D-1949A7A9C902}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{058F0E48-61CA-4964-9FBA-1978A1BB060D}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{18F33C35-8EF2-40D7-8BA4-932B0121B472}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{761F6A83-F007-49E4-8EAC-CDB6808EF06F}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{97D69524-BB57-4185-9C7F-5F05593B771A}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{371AD4A5-1520-4AA2-A8A4-F9AD3BAC6957}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7F124846-5453-4BB8-A41D-E11481FFC9DF}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8FD65019-BF09-45DA-AD81-E95AE911F1FD}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{F6C2BABA-9E4C-425F-9AEC-24AB8F2B640D}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
[-] Key Deleted : HKCU\Software\Yahoo\Companion
[-] Key Deleted : HKCU\Software\Yahoo\YFriendsBar
[-] Key Deleted : HKCU\Software\YahooPartnerToolbar
[-] Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
[-] Key Deleted : HKCU\Software\AppDataLow\Software\Yahoo\Companion
[-] Key Deleted : HKLM\SOFTWARE\Conduit
[-] Key Deleted : HKLM\SOFTWARE\SearchProtect
[-] Key Deleted : HKLM\SOFTWARE\Yahoo\Companion
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SearchProtect
[-] Key Deleted : [x64] HKLM\SOFTWARE\Tarma Installer
[-] Value Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [DoNotAskAgain]
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C4B887F1-E634-4BCC-8BA4-6E91B16D2814}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C4B887F1-E634-4BCC-8BA4-6E91B16D2814}
[#] Value Deleted : HKU\S-1-5-21-333120211-1585552344-2278992193-1000\Software\Microsoft\Internet Explorer\SearchScopes [DoNotAskAgain]
***** [ Web browsers ] *****
[-] [C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : aol.com
[-] [C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : ask.com
*************************
:: "Tracing" keys deleted
:: Winsock settings cleared
*************************
C:\AdwCleaner\AdwCleaner[C1].txt - [4821 bytes] - [30/06/2016 10:32:10]
C:\AdwCleaner\AdwCleaner[S1].txt - [5483 bytes] - [30/06/2016 10:15:02]
########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [4967 bytes] ##########

Junkware Removal Tool:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.6 (04.25.2016)
Operating System: Windows (TM) Vista Home Premium x64
Ran by Barbara (Administrator) on Thu 06/30/2016 at 10:45:10.89
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

File System: 17
Successfully deleted: C:\Program Files (x86)\lesstabs (Folder)
Successfully deleted: C:\Users\Barbara\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2U9M35IT (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Barbara\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GFN67J52 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Barbara\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M5M8VNOQ (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Barbara\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NY9D9563 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Barbara\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q4OAK8FC (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Barbara\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UGFI3ED2 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Barbara\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UHXXFROW (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Barbara\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YGT5T3UH (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2U9M35IT (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GFN67J52 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M5M8VNOQ (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NY9D9563 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q4OAK8FC (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UGFI3ED2 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UHXXFROW (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YGT5T3UH (Temporary Internet Files Folder)
Registry: 5
Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page (Registry Value)
Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} (Registry Value)
Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{C4B887F1-E634-4BCC-8BA4-6E91B16D2814} (Registry Key)
Successfully deleted: HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL (Registry Value)
Successfully deleted: HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page (Registry Value)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Thu 06/30/2016 at 10:50:08.10
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

Broni,

Here is the ComboFix report. While ComboFix was running I got a dialog box that said that ComboFix had stopped running and asked if I wanted to close it. I could see that ComboFix was still running in the background so I ignored the dialog box. ComboFix finished running and produced the below report.

ComboFix

ComboFix 16-06-30.01 - Barbara 07/01/2016 6:54.1.2 - x64
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3837.2455 [GMT -4:00]
Running from: c:\users\Barbara\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {768124D7-F5F7-6D2F-DDC2-94DFA4017C95}
SP: Microsoft Security Essentials *Disabled/Updated* {CDE0C533-D3CD-62A1-E772-AFADDF863628}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe
c:\program files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe
c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe
c:\program files (x86)\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe
c:\program files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe
c:\windows\SysWow64\Packet.dll
c:\windows\SysWow64\pthreadVC.dll
c:\windows\SysWow64\WanPacket.dll
c:\windows\SysWow64\wpcap.dll
.
.
((((((((((((((((((((((((( Files Created from 2016-06-01 to 2016-07-01 )))))))))))))))))))))))))))))))
.
.
2016-07-01 10:32 . 2016-07-01 10:32 75888 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9EE3E5A2-8465-4D65-A27F-1296A674F19E}\offreg.992.dll
2016-06-30 17:18 . 2016-06-21 22:04 12007136 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9EE3E5A2-8465-4D65-A27F-1296A674F19E}\mpengine.dll
2016-06-30 14:14 . 2016-06-30 14:32 -------- d-----w- C:\AdwCleaner
2016-06-30 12:59 . 2016-06-30 12:59 24688 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2016-06-30 12:53 . 2016-06-30 12:53 -------- d-----w- c:\programdata\RogueKiller
2016-06-29 17:28 . 2016-06-29 17:35 -------- d-----w- C:\FRST
2016-06-29 17:20 . 2016-06-29 17:20 -------- d-----w- c:\users\Barbara\AppData\Local\ESET
2016-06-29 13:22 . 2016-06-29 13:22 -------- d-----w- c:\windows\CheckSur
2016-06-29 00:24 . 2016-06-29 00:24 -------- d-----w- c:\users\Barbara\AppData\Local\Thunderbird
2016-06-29 00:24 . 2016-06-29 00:24 -------- d-----w- c:\users\Barbara\AppData\Roaming\Thunderbird
2016-06-29 00:24 . 2016-06-29 00:24 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service
2016-06-29 00:24 . 2016-06-29 00:24 -------- d-----w- c:\program files (x86)\Mozilla Thunderbird
2016-06-28 18:58 . 2016-05-26 20:28 11895896 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2016-06-25 17:43 . 2009-08-04 08:12 1103872 ----a-w- c:\windows\system32\webservices.dll
2016-06-25 17:43 . 2009-08-04 08:02 754688 ----a-w- c:\windows\SysWow64\webservices.dll
2016-06-25 17:42 . 2016-06-25 17:42 -------- d-----w- c:\program files\LSI SoftModem
2016-06-17 07:56 . 2016-05-11 13:29 1167568 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{45C013C2-C73B-4DB6-BEA0-3540A5C37FE6}\gapaengine.dll
2016-06-15 07:15 . 2016-05-14 15:53 17920 ----a-w- c:\windows\system32\netevent.dll
2016-06-15 07:15 . 2016-05-14 15:41 17920 ----a-w- c:\windows\SysWow64\netevent.dll
2016-06-15 07:15 . 2016-05-14 15:42 77312 ----a-w- c:\windows\SysWow64\secur32.dll
2016-06-15 07:15 . 2016-05-14 14:38 450560 ----a-w- c:\windows\system32\drivers\srv.sys
2016-06-15 07:15 . 2016-05-14 14:38 176128 ----a-w- c:\windows\system32\drivers\srv2.sys
2016-06-15 07:15 . 2016-05-14 14:38 147456 ----a-w- c:\windows\system32\drivers\srvnet.sys
2016-06-15 07:15 . 2016-05-14 15:54 205824 ----a-w- c:\windows\system32\wdigest.dll
2016-06-15 07:15 . 2016-05-14 15:41 175616 ----a-w- c:\windows\SysWow64\wdigest.dll
2016-06-15 07:15 . 2016-05-11 13:10 516328 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2016-06-15 07:14 . 2016-05-18 15:55 391168 ----a-w- c:\windows\system32\gdi32.dll
2016-06-15 07:14 . 2016-05-18 15:34 305152 ----a-w- c:\windows\SysWow64\gdi32.dll
2016-06-15 07:06 . 2016-05-14 15:53 48128 ----a-w- c:\windows\system32\atmlib.dll
2016-06-15 07:06 . 2016-05-14 15:41 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2016-06-15 07:06 . 2016-05-14 15:58 383208 ----a-w- c:\windows\system32\atmfd.dll
2016-06-15 07:06 . 2016-05-14 15:47 306408 ----a-w- c:\windows\SysWow64\atmfd.dll
2016-06-15 07:04 . 2016-05-12 14:39 2048 ----a-w- c:\windows\system32\tzres.dll
2016-06-15 07:04 . 2016-05-12 14:17 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2016-06-15 07:03 . 2016-05-10 14:55 24064 ----a-w- c:\windows\system32\netbtugc.exe
2016-06-15 07:03 . 2016-05-10 14:28 21504 ----a-w- c:\windows\SysWow64\netbtugc.exe
2016-06-15 07:03 . 2016-05-10 15:55 264704 ----a-w- c:\windows\system32\ws2_32.dll
2016-06-15 07:03 . 2016-05-10 15:54 442880 ----a-w- c:\windows\system32\winhttp.dll
2016-06-15 07:03 . 2016-05-10 15:54 304128 ----a-w- c:\windows\system32\mswsock.dll
2016-06-15 07:03 . 2016-05-10 15:31 179200 ----a-w- c:\windows\SysWow64\ws2_32.dll
2016-06-15 07:03 . 2016-05-10 15:31 377344 ----a-w- c:\windows\SysWow64\winhttp.dll
2016-06-15 07:03 . 2016-05-10 15:31 223232 ----a-w- c:\windows\SysWow64\mswsock.dll
2016-06-15 07:03 . 2016-05-10 14:55 248320 ----a-w- c:\windows\system32\drivers\netbt.sys
2016-06-15 07:03 . 2016-05-12 14:45 2801664 ----a-w- c:\windows\system32\win32k.sys
2016-06-15 07:01 . 2016-05-12 15:56 50176 ----a-w- c:\windows\system32\FwRemoteSvr.dll
2016-06-15 07:01 . 2016-05-12 15:33 28672 ----a-w- c:\windows\SysWow64\FwRemoteSvr.dll
2016-06-15 07:01 . 2016-05-12 15:56 381952 ----a-w- c:\windows\system32\polstore.dll
2016-06-15 07:01 . 2016-05-12 15:34 61440 ----a-w- c:\windows\SysWow64\winipsec.dll
2016-06-15 07:01 . 2016-05-12 15:34 273920 ----a-w- c:\windows\SysWow64\polstore.dll
2016-06-15 07:01 . 2016-05-12 15:56 100864 ----a-w- c:\windows\system32\winipsec.dll
2016-06-15 07:01 . 2016-05-12 15:56 534528 ----a-w- c:\windows\system32\IPSECSVC.DLL
2016-06-15 07:00 . 2016-05-12 15:56 84480 ----a-w- c:\windows\system32\gpapi.dll
2016-06-15 07:00 . 2016-05-12 15:33 75264 ----a-w- c:\windows\SysWow64\gpapi.dll
2016-06-15 07:00 . 2016-05-12 15:56 726016 ----a-w- c:\windows\system32\gpsvc.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2016-06-30 14:08 . 2014-05-15 17:45 192216 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2016-06-17 05:31 . 2013-03-13 01:28 796352 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2016-06-17 05:31 . 2013-03-13 01:28 142528 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2016-06-15 20:40 . 2009-10-03 04:16 484008 ------w- c:\windows\system32\MpSigStub.exe
2016-06-15 07:06 . 2006-11-02 12:35 142482544 ----a-w- c:\windows\system32\mrt.exe
2016-05-11 13:29 . 2013-11-07 18:10 1167568 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2016-04-09 21:39 . 2016-05-11 07:19 4692200 ----a-w- c:\windows\system32\ntoskrnl.exe
2016-04-09 21:17 . 2016-05-11 07:23 975360 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll
2016-04-09 20:53 . 2016-05-11 07:18 901352 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2016-04-09 20:48 . 2016-05-11 07:23 1209856 ----a-w- c:\windows\system32\WindowsCodecs.dll
2016-04-09 20:46 . 2016-05-11 07:19 47104 ----a-w- c:\windows\system32\cdd.dll
2016-04-09 20:01 . 2016-05-11 07:24 566272 ----a-w- c:\windows\system32\d3d10level9.dll
2016-04-09 19:07 . 2016-05-11 07:24 486912 ----a-w- c:\windows\SysWow64\d3d10level9.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel "= "c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]
"ehTray.exe "= "c:\windows\ehome\ehTray.exe" [2008-01-21 138240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC "= "c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-01 61440]
"DVDAgent "= "c:\program files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe" [2008-09-26 1148200]
"TSMAgent "= "c:\program files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe" [2008-09-26 1152296]
"CLMLServer for HP TouchSmart "= "c:\program files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe" [2008-09-26 189736]
"QlbCtrl.exe "= "c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-08-01 202032]
"hpWirelessAssistant "= "c:\program files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"HP Software Update "= "c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle "= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@= "Service "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@= "Driver "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@= "Service "
.
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_1b06afce\AESTSr64.exe;c:\windows\SYSNATIVE\DriverStore\FileRepository\stwrt64.inf_1b06afce\AESTSr64.exe [x]
.
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
Themes
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 18:14 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2016-04-11 19:37 1106072 ----a-w- c:\program files (x86)\Google\Chrome\Application\49.0.2623.112\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2016-07-01 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-03-13 05:31]
.
2016-07-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2015-07-28 18:01]
.
2016-07-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2015-07-28 18:01]
.
2016-06-30 c:\windows\Tasks\HPCeeScheduleForBarbara.job
- c:\program files (x86)\hewlett-packard\sdp\ceement\HPCEE.exe [2008-10-23 18:34]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC "= "c:\program files\Microsoft Security Client\msseces.exe" [2016-01-30 1340192]
"SysTrayApp "= "c:\program files\IDT\WDM\sttray64.exe" [2009-08-13 456192]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 68.100.16.30 68.10.16.30 8.8.8.8 8.8.4.4
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKCU-Run-SPMTray - c:\program files (x86)\PC Speed Maximizer\SPMTray.exe
Wow6432Node-HKLM-Run-UCam_Menu - c:\program files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe
Wow6432Node-HKLM-Run-UpdateLBPShortCut - c:\program files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe
Wow6432Node-HKLM-Run-UpdatePSTShortCut - c:\program files (x86)\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe
Wow6432Node-HKLM-Run-UpdateP2GoShortCut - c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe
Wow6432Node-HKLM-Run-UpdatePDIRShortCut - c:\program files (x86)\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
SafeBoot-WudfPf
SafeBoot-WudfRd
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-Adobe Flash Player 10 ActiveX - c:\windows\SysWOW64\Macromed\Flash\uninstall_activeX.exe
AddRemove-WT066101 - c:\program files (x86)\HP Games\Jewel Quest Solitaire 3\Uninstall.exe
AddRemove-WT067373 - c:\program files (x86)\HP Games\5 Card Deluxe\Uninstall.exe
AddRemove-WT074486 - c:\program files (x86)\HP Games\Jewel Quest II\Uninstall.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Norton Internet Security]
"ImagePath "= "\ "c:\program files (x86)\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe\" /s \ "Norton Internet Security\" /m \ "c:\program files (x86)\Norton Internet Security\Engine\16.0.0.125\diMaster.dll\" /prefetch:1 "
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{55662437-DA8C-40c0-AADA-2C816A897A49}]
"ImagePath "= "\??\c:\program files (x86)\Hewlett-Packard\Media\DVD\000.fcl "
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_22_0_0_192_ActiveX.exe,-101 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled "=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@= "c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_22_0_0_192_ActiveX.exe "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker6 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_22_0_0_192_ActiveX.exe,-101 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled "=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_22_0_0_192_ActiveX.exe "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@= "Shockwave Flash Object "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_22_0_0_192.ocx "
"ThreadingModel "= "Apartment "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@= "0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@= "ShockwaveFlash.ShockwaveFlash.22 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_22_0_0_192.ocx, 1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@= "{D27CDB6B-AE6D-11cf-96B8-444553540000} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@= "1.0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@= "ShockwaveFlash.ShockwaveFlash "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@= "Macromedia Flash Factory Object "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_22_0_0_192.ocx "
"ThreadingModel "= "Apartment "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@= "FlashFactory.FlashFactory.1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_22_0_0_192.ocx, 1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@= "{D27CDB6B-AE6D-11cf-96B8-444553540000} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@= "1.0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@= "FlashFactory.FlashFactory "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker6 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
@Denied: (A 2) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
@= "Shockwave Flash "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
@Denied: (A 2) (Everyone)
@=" "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
@= "FlashBroker "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes]
"SymbolicLinkValue "=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
"MSCurrentCountry "=dword:000000b5
.
Completion time: 2016-07-01 07:10:47
ComboFix-quarantined-files.txt 2016-07-01 11:10
.
Pre-Run: 168,990,842,880 bytes free
Post-Run: 168,878,080,000 bytes free
.
- - End Of File - - A470F8972ECBC7FA08178989F22D90AC
5C86ADEC17B739C437E145E3B3FC2E6D

 

Broni,

Here is the most recent FRST file. I couldn't find the Addition file. Do you know where it is located?

FRST

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 29-06-2016
Ran by Barbara (administrator) on BARBARA-PC (04-07-2016 14:16:25)
Running from C:\Users\Barbara\Desktop
Loaded Profiles: Barbara (Available Profiles: Barbara)
Platform: Windows Vista (TM) Home Premium Service Pack 2 (X64) Language: English (United States)
Internet Explorer Version 9 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_1b06afce\stacsv64.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Eastman Kodak Company) C:\Program Files (x86)\Kodak\KODAK Share Button App\Listener.exe
(Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_1b06afce\AESTSr64.exe
(Agere Systems) C:\Windows\System32\agr64svc.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
() C:\Program Files (x86)\SMINST\BLService.exe
(CyberLink Corp.) C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe
(CyberLink Corp.) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe
(CyberLink) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
(Hewlett-Packard) C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
() C:\Program Files (x86)\Hewlett-Packard\Shared\HpqToaster.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Adobe Systems Incorporated) C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_22_0_0_192_ActiveX.exe

==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2832168 2011-10-01] (Synaptics Incorporated)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1340192 2016-01-29] (Microsoft Corporation)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [456192 2009-08-13] (IDT, Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [61440 2008-08-01] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [DVDAgent] => C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe [1148200 2008-09-26] (CyberLink Corp.)
HKLM-x32\...\Run: [TSMAgent] => C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe [1152296 2008-09-25] (CyberLink Corp.)
HKLM-x32\...\Run: [CLMLServer for HP TouchSmart] => C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe [189736 2008-09-25] (CyberLink)
HKLM-x32\...\Run: [QlbCtrl.exe] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [202032 2008-08-01] ( Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [hpWirelessAssistant] => C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [488752 2008-04-15] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2010-03-12] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-333120211-1585552344-2278992193-1000\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2008-06-09] (Hewlett-Packard Company)
HKU\S-1-5-21-333120211-1585552344-2278992193-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [138240 2008-01-20] (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 68.100.16.30 68.10.16.30 8.8.8.8 8.8.4.4
Tcpip\..\Interfaces\{355D607A-85C1-434A-8BEA-1B39988D01D7}: [DhcpNameServer] 68.100.16.30 68.10.16.30 8.8.8.8 8.8.4.4
Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-333120211-1585552344-2278992193-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-333120211-1585552344-2278992193-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM -> DefaultScope {934BCD49-C81A-4ED0-86DF-56EE1B6DA341} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&FORM=HPNTDF
SearchScopes: HKLM -> {934BCD49-C81A-4ED0-86DF-56EE1B6DA341} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&FORM=HPNTDF
SearchScopes: HKLM-x32 -> DefaultScope {584B1ED9-8A43-4956-895E-AF86252744CC} URL =
SearchScopes: HKLM-x32 -> {934BCD49-C81A-4ED0-86DF-56EE1B6DA341} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&FORM=HPNTDF
SearchScopes: HKU\S-1-5-21-333120211-1585552344-2278992193-1000 -> {934BCD49-C81A-4ED0-86DF-56EE1B6DA341} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=HPNTDF&pc=HPNTDF&src=IE-SearchBox
BHO-x32: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-02-08] (Skype Technologies S.A.)
BHO-x32: Microsoft Live Search Toolbar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> c:\Program Files (x86)\MSN\Toolbar\3.0.0541.0\msneshellx.dll [2008-08-28] (Microsoft Corp.)
Toolbar: HKLM-x32 - Microsoft Live Search Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0541.0\msneshellx.dll [2008-08-28] (Microsoft Corp.)
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab
Handler-x32: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\BelarcAdvisor\System\BAVoilaX.dll [2013-04-16] (Belarc, Inc.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-02-08] (Skype Technologies S.A.)
FireFox:
========
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2015-07-10] (Google, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-10] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-10] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2015-09-24] (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-06-25] [not signed]
Chrome:
=======
CHR StartupUrls: Default -> "hxxp://google.com/ "
CHR Profile: C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-07-28]
CHR Extension: (Google Docs) - C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-07-28]
CHR Extension: (Google Drive) - C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-12-26]
CHR Extension: (YouTube) - C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-12-26]
CHR Extension: (Google Search) - C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-12-26]
CHR Extension: (Google Sheets) - C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-07-28]
CHR Extension: (Google Docs Offline) - C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-12-26]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-28]
CHR Extension: (Gmail) - C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-07-28]
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_1b06afce\AESTSr64.exe [89600 2009-03-02] (Andrea Electronics Corporation)
S4 HP Health Check Service; c:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe [94208 2008-06-16] (Hewlett-Packard) [File not signed]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2008-06-09] (Hewlett-Packard Company) [File not signed]
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2016-01-29] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [374344 2016-01-29] (Microsoft Corporation)
R2 Recovery Service for Windows; C:\Program Files (x86)\SMINST\BLService.exe [365952 2008-10-06] ()
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [241734 2008-06-29] () [File not signed]
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_1b06afce\STacSV64.exe [240640 2009-08-13] (IDT, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [383544 2008-01-20] (Microsoft Corporation)
S2 Norton Internet Security; "C:\Program Files (x86)\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe" /s "Norton Internet Security" /m "C:\Program Files (x86)\Norton Internet Security\Engine\16.0.0.125\diMaster.dll" /prefetch:1
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27648 2008-01-20] (Microsoft Corporation)
S1 Beep; no ImagePath
R3 Linksys_adapter; C:\Windows\System32\DRIVERS\AE2500vista64.sys [1227840 2011-03-30] (Broadcom Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [289120 2015-11-13] (Microsoft Corporation)
R3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133816 2015-11-13] (Microsoft Corporation)
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [24688 2016-06-30] ()
R2 {55662437-DA8C-40c0-AADA-2C816A897A49}; C:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl [27632 2008-09-26] (Cyberlink Corp.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\ENG64.SYS [X]
S3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\EX64.SYS [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S1 SRTSP; \??\C:\Windows\system32\drivers\NISx64\1000000.07D\SRTSP64.SYS [X]
S1 SRTSPX; \??\C:\Windows\system32\drivers\NISx64\1000000.07D\SRTSPX64.SYS [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-07-01 07:26 - 2016-07-01 07:26 - 00018839 _____ C:\Users\Barbara\Desktop\ComboFixLog.txt
2016-07-01 07:10 - 2016-07-01 07:10 - 00018839 _____ C:\ComboFix.txt
2016-07-01 07:07 - 2016-07-01 07:07 - 00000000 ____D C:\Users\Barbara\AppData\Local\CrashDumps
2016-07-01 06:49 - 2016-07-01 07:10 - 00000000 ____D C:\Qoobox
2016-07-01 06:49 - 2011-06-26 02:45 - 00256000 _____ C:\Windows\PEV.exe
2016-07-01 06:49 - 2010-11-07 13:20 - 00208896 _____ C:\Windows\MBR.exe
2016-07-01 06:49 - 2009-04-20 00:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2016-07-01 06:49 - 2000-08-30 20:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2016-07-01 06:49 - 2000-08-30 20:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2016-07-01 06:49 - 2000-08-30 20:00 - 00098816 _____ C:\Windows\sed.exe
2016-07-01 06:49 - 2000-08-30 20:00 - 00080412 _____ C:\Windows\grep.exe
2016-07-01 06:49 - 2000-08-30 20:00 - 00068096 _____ C:\Windows\zip.exe
2016-07-01 06:48 - 2016-07-01 07:08 - 00000000 ____D C:\Windows\erdnt
2016-07-01 06:40 - 2016-07-01 06:40 - 05659337 ____R (Swearware) C:\Users\Barbara\Desktop\ComboFix.exe
2016-06-30 13:18 - 2016-06-30 13:18 - 00001826 _____ C:\Users\Barbara\Desktop\Microsoft Security Essentials.lnk
2016-06-30 10:50 - 2016-06-30 10:50 - 00003883 _____ C:\Users\Barbara\Desktop\JRT.txt
2016-06-30 10:44 - 2016-06-30 10:44 - 01610816 _____ (Malwarebytes) C:\Users\Barbara\Desktop\JRT.exe
2016-06-30 10:41 - 2016-06-30 10:41 - 00005054 _____ C:\Users\Barbara\Desktop\AdwCleaner[C1].txt
2016-06-30 10:14 - 2016-06-30 10:32 - 00000000 ____D C:\AdwCleaner
2016-06-30 10:13 - 2016-06-30 10:13 - 03703360 _____ C:\Users\Barbara\Desktop\adwcleaner_5.200.exe
2016-06-30 10:10 - 2016-06-30 10:10 - 00024753 _____ C:\Users\Barbara\Desktop\MBAM.txt
2016-06-30 09:31 - 2016-06-30 09:31 - 00008670 _____ C:\Users\Barbara\Desktop\rk_66DE.tmp.txt
2016-06-30 08:59 - 2016-06-30 08:59 - 00024688 _____ C:\Windows\system32\Drivers\TrueSight.sys
2016-06-30 08:58 - 2016-06-30 08:58 - 24207432 _____ C:\Users\Barbara\Desktop\RogueKillerX64.exe
2016-06-30 08:53 - 2016-06-30 08:53 - 00000000 ____D C:\ProgramData\RogueKiller
2016-06-30 08:52 - 2016-06-30 08:52 - 19927624 _____ C:\Users\Barbara\Desktop\RogueKiller.exe
2016-06-29 16:05 - 2016-06-29 16:05 - 00068459 _____ C:\Users\Barbara\Documents\AddBkToTBird.CSV
2016-06-29 16:05 - 2016-06-29 16:05 - 00009329 _____ C:\Users\Barbara\AppData\Roaming\Comma Separated Values (Windows).EML
2016-06-29 13:32 - 2016-06-29 13:35 - 00033072 _____ C:\Users\Barbara\Desktop\Addition.txt
2016-06-29 13:30 - 2016-07-04 14:16 - 00014981 _____ C:\Users\Barbara\Desktop\FRST.txt
2016-06-29 13:28 - 2016-07-04 14:16 - 00000000 ____D C:\FRST
2016-06-29 13:27 - 2016-06-29 13:27 - 02390016 _____ (Farbar) C:\Users\Barbara\Desktop\FRST64.exe
2016-06-29 13:20 - 2016-06-29 13:20 - 00000000 ____D C:\Users\Barbara\AppData\Local\ESET
2016-06-29 13:18 - 2016-06-29 13:18 - 09908936 _____ (Microsoft Corporation) C:\Users\Barbara\Downloads\xlconv2007-kb3114895-fullfile-x86-glb.exe
2016-06-29 09:22 - 2016-06-29 09:22 - 00000000 ____D C:\Windows\CheckSur
2016-06-29 09:17 - 2016-06-29 09:19 - 218486747 _____ C:\Users\Barbara\Downloads\Windows6.0-KB947821-v35-x64.msu
2016-06-28 20:24 - 2016-06-28 20:24 - 00000898 _____ C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
2016-06-28 20:24 - 2016-06-28 20:24 - 00000000 ____D C:\Users\Barbara\AppData\Roaming\Thunderbird
2016-06-28 20:24 - 2016-06-28 20:24 - 00000000 ____D C:\Users\Barbara\AppData\Local\Thunderbird
2016-06-28 20:24 - 2016-06-28 20:24 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2016-06-28 20:24 - 2016-06-28 20:24 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-06-28 20:22 - 2016-06-28 20:22 - 34098512 _____ (Mozilla) C:\Users\Barbara\Downloads\Thunderbird Setup 38.5.0.exe
2016-06-25 13:43 - 2009-08-04 04:12 - 01103872 _____ (Microsoft Corporation) C:\Windows\system32\webservices.dll
2016-06-25 13:43 - 2009-08-04 04:02 - 00754688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webservices.dll
2016-06-25 13:42 - 2016-06-25 13:42 - 00000000 ____D C:\Program Files\LSI SoftModem
2016-06-25 13:38 - 2016-06-25 13:38 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_SynTP_01009.Wdf
2016-06-24 19:48 - 2016-06-24 19:48 - 00000277 _____ C:\Users\Barbara\Desktop\Inbox - Outlook.url
2016-06-15 03:15 - 2016-05-14 11:54 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2016-06-15 03:15 - 2016-05-14 11:53 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\netevent.dll
2016-06-15 03:15 - 2016-05-14 11:42 - 00077312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2016-06-15 03:15 - 2016-05-14 11:41 - 00175616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2016-06-15 03:15 - 2016-05-14 11:41 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netevent.dll
2016-06-15 03:15 - 2016-05-14 10:38 - 00450560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2016-06-15 03:15 - 2016-05-14 10:38 - 00176128 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2016-06-15 03:15 - 2016-05-14 10:38 - 00147456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2016-06-15 03:15 - 2016-05-11 09:10 - 00516328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2016-06-15 03:14 - 2016-05-18 11:55 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2016-06-15 03:14 - 2016-05-18 11:34 - 00305152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2016-06-15 03:06 - 2016-05-14 11:58 - 00383208 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2016-06-15 03:06 - 2016-05-14 11:53 - 00048128 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2016-06-15 03:06 - 2016-05-14 11:47 - 00306408 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2016-06-15 03:06 - 2016-05-14 11:41 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2016-06-15 03:04 - 2016-05-12 10:39 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2016-06-15 03:04 - 2016-05-12 10:17 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2016-06-15 03:03 - 2016-05-12 10:45 - 02801664 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-06-15 03:03 - 2016-05-10 11:55 - 00264704 _____ (Microsoft Corporation) C:\Windows\system32\ws2_32.dll
2016-06-15 03:03 - 2016-05-10 11:54 - 00442880 _____ (Microsoft Corporation) C:\Windows\system32\winhttp.dll
2016-06-15 03:03 - 2016-05-10 11:54 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2016-06-15 03:03 - 2016-05-10 11:31 - 00377344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winhttp.dll
2016-06-15 03:03 - 2016-05-10 11:31 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2016-06-15 03:03 - 2016-05-10 11:31 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ws2_32.dll
2016-06-15 03:03 - 2016-05-10 10:55 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbt.sys
2016-06-15 03:03 - 2016-05-10 10:55 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\netbtugc.exe
2016-06-15 03:03 - 2016-05-10 10:28 - 00021504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netbtugc.exe
2016-06-15 03:01 - 2016-05-12 11:56 - 00534528 _____ (Microsoft Corporation) C:\Windows\system32\IPSECSVC.DLL
2016-06-15 03:01 - 2016-05-12 11:56 - 00381952 _____ (Microsoft Corporation) C:\Windows\system32\polstore.dll
2016-06-15 03:01 - 2016-05-12 11:56 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\winipsec.dll
2016-06-15 03:01 - 2016-05-12 11:56 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\FwRemoteSvr.dll
2016-06-15 03:01 - 2016-05-12 11:34 - 00273920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\polstore.dll
2016-06-15 03:01 - 2016-05-12 11:34 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winipsec.dll
2016-06-15 03:01 - 2016-05-12 11:33 - 00028672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FwRemoteSvr.dll
2016-06-15 03:00 - 2016-05-12 11:56 - 00726016 _____ (Microsoft Corporation) C:\Windows\system32\gpsvc.dll
2016-06-15 03:00 - 2016-05-12 11:56 - 00084480 _____ (Microsoft Corporation) C:\Windows\system32\gpapi.dll
2016-06-15 03:00 - 2016-05-12 11:33 - 00075264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gpapi.dll
2016-06-15 00:21 - 2016-05-12 15:52 - 18804224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-06-15 00:21 - 2016-05-12 15:49 - 02351616 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-06-15 00:21 - 2016-05-12 15:46 - 00448512 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2016-06-15 00:21 - 2016-05-12 15:45 - 10940416 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-06-15 00:21 - 2016-05-12 15:44 - 01389056 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-06-15 00:21 - 2016-05-12 15:43 - 01392640 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 02159104 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 01494528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-06-15 00:21 - 2016-05-12 15:42 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 00579584 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 00173568 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2016-06-15 00:21 - 2016-05-12 15:42 - 00096256 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2016-06-15 00:21 - 2016-05-12 15:42 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2016-06-15 00:21 - 2016-05-12 15:41 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2016-06-15 00:21 - 2016-05-12 15:11 - 01815552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-06-15 00:21 - 2016-05-12 15:10 - 12840960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-06-15 00:21 - 2016-05-12 15:08 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2016-06-15 00:21 - 2016-05-12 15:06 - 09755136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-06-15 00:21 - 2016-05-12 15:06 - 01140224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-06-15 00:21 - 2016-05-12 15:05 - 01129984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2016-06-15 00:21 - 2016-05-12 15:04 - 01804800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2016-06-15 00:21 - 2016-05-12 15:04 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2016-06-15 00:21 - 2016-05-12 15:04 - 00719360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2016-06-15 00:21 - 2016-05-12 15:04 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2016-06-15 00:21 - 2016-05-12 15:04 - 00425472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2016-06-15 00:21 - 2016-05-12 15:04 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2016-06-15 00:21 - 2016-05-12 15:04 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2016-06-15 00:21 - 2016-05-12 15:04 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2016-06-15 00:21 - 2016-05-12 15:04 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2016-06-15 00:21 - 2016-05-12 15:03 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2016-06-15 00:21 - 2016-05-12 15:03 - 00354304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2016-06-15 00:21 - 2016-05-12 15:03 - 00223744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2016-06-15 00:21 - 2016-05-12 15:03 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2016-06-15 00:21 - 2016-05-12 15:03 - 00072704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2016-06-15 00:21 - 2016-05-12 15:03 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2016-06-15 00:21 - 2016-05-12 15:03 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-07-04 13:42 - 2015-07-28 14:01 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-07-04 13:31 - 2013-03-12 21:28 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-07-04 13:11 - 2006-11-02 11:22 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2016-07-04 13:11 - 2006-11-02 11:22 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2016-07-03 18:49 - 2015-06-24 18:27 - 00003110 _____ C:\Windows\System32\Tasks\HPCeeScheduleForBarbara
2016-07-03 18:49 - 2015-06-24 18:27 - 00000342 _____ C:\Windows\Tasks\HPCeeScheduleForBarbara.job
2016-07-03 17:42 - 2015-07-28 14:01 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-07-01 19:12 - 2009-03-22 12:25 - 00002617 _____ C:\Users\Barbara\Desktop\Microsoft Office Outlook 2007.lnk
2016-07-01 19:11 - 2006-11-02 11:42 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-07-01 09:48 - 2008-10-23 03:45 - 00000012 _____ C:\Windows\bthservsdp.dat
2016-07-01 09:48 - 2006-11-02 11:42 - 00032654 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2016-07-01 07:07 - 2006-11-02 08:34 - 00000215 _____ C:\Windows\system.ini
2016-07-01 06:30 - 2012-12-22 04:19 - 00006836 _____ C:\Users\Barbara\AppData\Local\d3d9caps.dat
2016-06-30 10:08 - 2014-05-15 13:45 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-06-30 08:40 - 2006-11-02 09:33 - 00000000 ____D C:\Windows\inf
2016-06-29 16:02 - 2008-10-23 05:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2016-06-29 08:05 - 2009-03-28 19:08 - 00000000 ____D C:\Windows\Minidump
2016-06-29 06:33 - 2014-05-15 13:45 - 00000901 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-06-29 06:33 - 2014-05-15 13:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-06-29 06:33 - 2014-05-15 13:45 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-06-28 14:46 - 2006-11-02 08:46 - 00759582 _____ C:\Windows\system32\PerfStringBackup.INI
2016-06-28 13:46 - 2014-05-17 13:29 - 00002425 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2016-06-25 14:37 - 2006-11-02 09:33 - 00000000 ____D C:\Windows\rescache
2016-06-25 13:42 - 2009-03-15 12:20 - 00000000 ____D C:\Users\Barbara
2016-06-24 19:13 - 2014-07-28 15:17 - 00002611 _____ C:\Users\Barbara\Desktop\Microsoft Office Word 2007.lnk
2016-06-24 16:32 - 2008-10-23 05:42 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2016-06-24 03:02 - 2010-06-04 03:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2016-06-17 01:32 - 2013-03-12 21:28 - 00003682 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2016-06-17 01:31 - 2013-03-12 21:28 - 00796352 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-06-17 01:31 - 2013-03-12 21:28 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-06-15 16:40 - 2009-10-03 00:16 - 00484008 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2016-06-15 03:39 - 2006-11-02 11:21 - 00315152 _____ C:\Windows\system32\FNTCACHE.DAT
2016-06-15 03:14 - 2013-07-14 03:28 - 00000000 ____D C:\Windows\system32\MRT
2016-06-15 03:06 - 2006-11-02 08:35 - 142482544 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
==================== Files in the root of some directories =======
2016-06-29 16:05 - 2016-06-29 16:05 - 0009329 _____ () C:\Users\Barbara\AppData\Roaming\Comma Separated Values (Windows).EML
2009-03-15 12:35 - 2009-03-15 12:35 - 0000000 _____ () C:\Users\Barbara\AppData\Local\AtStart.txt
2012-12-22 04:19 - 2016-07-01 06:30 - 0006836 _____ () C:\Users\Barbara\AppData\Local\d3d9caps.dat
2009-05-09 19:15 - 2011-03-15 10:15 - 0003584 _____ () C:\Users\Barbara\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2011-12-27 12:43 - 2011-12-27 12:44 - 0422154 _____ () C:\Users\Barbara\AppData\Local\dd_vcredistMSI599B.txt
2011-12-27 12:43 - 2011-12-27 12:44 - 0011684 _____ () C:\Users\Barbara\AppData\Local\dd_vcredistUI599B.txt
2009-03-15 12:35 - 2009-03-15 12:35 - 0000000 _____ () C:\Users\Barbara\AppData\Local\DSwitch.txt
2009-08-11 14:05 - 2009-08-11 14:05 - 0000000 _____ () C:\Users\Barbara\AppData\Local\FnF4.txt
2009-03-15 12:35 - 2009-03-15 12:35 - 0000000 _____ () C:\Users\Barbara\AppData\Local\QSwitch.txt
2010-04-03 15:14 - 2010-04-03 15:14 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2009-02-15 17:44 - 2009-02-15 17:44 - 0000032 _____ () C:\ProgramData\{051B9612-4D82-42AC-8C63-CD2DCEDC1CB3}.log
2008-10-23 05:36 - 2008-10-23 05:37 - 0000109 _____ () C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log
2009-02-15 17:42 - 2009-02-15 17:42 - 0000032 _____ () C:\ProgramData\{23F3DA62-2D9E-4A69-B8D5-BE8E9E148092}.log
2008-10-23 05:24 - 2008-10-23 05:27 - 0000105 _____ () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
2009-02-15 17:39 - 2009-02-15 17:39 - 0000032 _____ () C:\ProgramData\{4FC670EB-5F02-4B07-90DB-022B86BFEFD0}.log
2009-02-15 17:43 - 2009-02-15 17:43 - 0000032 _____ () C:\ProgramData\{9867824A-C86D-4A83-8F3C-E7A86BE0AFD3}.log
2008-10-23 05:22 - 2008-10-23 05:24 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
2008-10-23 05:27 - 2008-10-23 05:36 - 0000110 _____ () C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log
2009-02-15 17:44 - 2009-02-15 17:44 - 0000105 _____ () C:\ProgramData\{d36dd326-7280-11d8-97c8-000129760cbe}.log
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2016-07-04 07:36
==================== End of FRST.txt ============================

 

Sorry about that Broni. I didn't read your instructions as closely as I should have - again.

Make sure you checkmark Addition.txt box.

Here are the reports:

FRST

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 29-06-2016
Ran by Barbara (administrator) on BARBARA-PC (05-07-2016 13:15:09)
Running from C:\Users\Barbara\Desktop
Loaded Profiles: Barbara (Available Profiles: Barbara)
Platform: Windows Vista (TM) Home Premium Service Pack 2 (X64) Language: English (United States)
Internet Explorer Version 9 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_1b06afce\stacsv64.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Eastman Kodak Company) C:\Program Files (x86)\Kodak\KODAK Share Button App\Listener.exe
(Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_1b06afce\AESTSr64.exe
(Agere Systems) C:\Windows\System32\agr64svc.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
() C:\Program Files (x86)\SMINST\BLService.exe
(CyberLink Corp.) C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe
(CyberLink Corp.) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe
(CyberLink) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
(Hewlett-Packard) C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
() C:\Program Files (x86)\Hewlett-Packard\Shared\HpqToaster.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Adobe Systems Incorporated) C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_22_0_0_192_ActiveX.exe

==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2832168 2011-10-01] (Synaptics Incorporated)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1340192 2016-01-29] (Microsoft Corporation)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [456192 2009-08-13] (IDT, Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [61440 2008-08-01] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [DVDAgent] => C:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe [1148200 2008-09-26] (CyberLink Corp.)
HKLM-x32\...\Run: [TSMAgent] => C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe [1152296 2008-09-25] (CyberLink Corp.)
HKLM-x32\...\Run: [CLMLServer for HP TouchSmart] => C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe [189736 2008-09-25] (CyberLink)
HKLM-x32\...\Run: [QlbCtrl.exe] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [202032 2008-08-01] ( Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [hpWirelessAssistant] => C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [488752 2008-04-15] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2010-03-12] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-333120211-1585552344-2278992193-1000\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2008-06-09] (Hewlett-Packard Company)
HKU\S-1-5-21-333120211-1585552344-2278992193-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [138240 2008-01-20] (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 68.100.16.30 68.10.16.30 8.8.8.8 8.8.4.4
Tcpip\..\Interfaces\{355D607A-85C1-434A-8BEA-1B39988D01D7}: [DhcpNameServer] 68.100.16.30 68.10.16.30 8.8.8.8 8.8.4.4
Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-333120211-1585552344-2278992193-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Pavilion&pf=cnnb
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-333120211-1585552344-2278992193-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM -> DefaultScope {934BCD49-C81A-4ED0-86DF-56EE1B6DA341} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&FORM=HPNTDF
SearchScopes: HKLM -> {934BCD49-C81A-4ED0-86DF-56EE1B6DA341} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&FORM=HPNTDF
SearchScopes: HKLM-x32 -> DefaultScope {584B1ED9-8A43-4956-895E-AF86252744CC} URL =
SearchScopes: HKLM-x32 -> {934BCD49-C81A-4ED0-86DF-56EE1B6DA341} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&FORM=HPNTDF
SearchScopes: HKU\S-1-5-21-333120211-1585552344-2278992193-1000 -> {934BCD49-C81A-4ED0-86DF-56EE1B6DA341} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=HPNTDF&pc=HPNTDF&src=IE-SearchBox
BHO-x32: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-02-08] (Skype Technologies S.A.)
BHO-x32: Microsoft Live Search Toolbar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> c:\Program Files (x86)\MSN\Toolbar\3.0.0541.0\msneshellx.dll [2008-08-28] (Microsoft Corp.)
Toolbar: HKLM-x32 - Microsoft Live Search Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0541.0\msneshellx.dll [2008-08-28] (Microsoft Corp.)
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab
Handler-x32: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\BelarcAdvisor\System\BAVoilaX.dll [2013-04-16] (Belarc, Inc.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-02-08] (Skype Technologies S.A.)
FireFox:
========
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2015-07-10] (Google, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-10] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-10] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2015-09-24] (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-06-25] [not signed]
Chrome:
=======
CHR StartupUrls: Default -> "hxxp://google.com/ "
CHR Profile: C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-07-28]
CHR Extension: (Google Docs) - C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-07-28]
CHR Extension: (Google Drive) - C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-12-26]
CHR Extension: (YouTube) - C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-12-26]
CHR Extension: (Google Search) - C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-12-26]
CHR Extension: (Google Sheets) - C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-07-28]
CHR Extension: (Google Docs Offline) - C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-12-26]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-28]
CHR Extension: (Gmail) - C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-07-28]
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_1b06afce\AESTSr64.exe [89600 2009-03-02] (Andrea Electronics Corporation)
S4 HP Health Check Service; c:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe [94208 2008-06-16] (Hewlett-Packard) [File not signed]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2008-06-09] (Hewlett-Packard Company) [File not signed]
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2016-01-29] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [374344 2016-01-29] (Microsoft Corporation)
R2 Recovery Service for Windows; C:\Program Files (x86)\SMINST\BLService.exe [365952 2008-10-06] ()
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [241734 2008-06-29] () [File not signed]
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_1b06afce\STacSV64.exe [240640 2009-08-13] (IDT, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [383544 2008-01-20] (Microsoft Corporation)
S2 Norton Internet Security; "C:\Program Files (x86)\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe" /s "Norton Internet Security" /m "C:\Program Files (x86)\Norton Internet Security\Engine\16.0.0.125\diMaster.dll" /prefetch:1
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27648 2008-01-20] (Microsoft Corporation)
S1 Beep; no ImagePath
R3 Linksys_adapter; C:\Windows\System32\DRIVERS\AE2500vista64.sys [1227840 2011-03-30] (Broadcom Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [289120 2015-11-13] (Microsoft Corporation)
R3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133816 2015-11-13] (Microsoft Corporation)
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [24688 2016-06-30] ()
R2 {55662437-DA8C-40c0-AADA-2C816A897A49}; C:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl [27632 2008-09-26] (Cyberlink Corp.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\ENG64.SYS [X]
S3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\EX64.SYS [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S1 SRTSP; \??\C:\Windows\system32\drivers\NISx64\1000000.07D\SRTSP64.SYS [X]
S1 SRTSPX; \??\C:\Windows\system32\drivers\NISx64\1000000.07D\SRTSPX64.SYS [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-07-04 21:56 - 2016-07-05 13:07 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2016-07-04 14:37 - 2016-07-04 14:37 - 00000000 ____D C:\Users\Barbara\AppData\Roaming\TeamViewer
2016-07-04 14:35 - 2016-07-04 14:35 - 07470328 _____ (TeamViewer) C:\Users\Barbara\Desktop\TeamViewerQS_en.exe
2016-07-04 14:18 - 2016-07-04 14:18 - 00035439 _____ C:\Users\Barbara\Desktop\FRST2.txt
2016-07-01 07:26 - 2016-07-01 07:26 - 00018839 _____ C:\Users\Barbara\Desktop\ComboFixLog.txt
2016-07-01 07:10 - 2016-07-01 07:10 - 00018839 _____ C:\ComboFix.txt
2016-07-01 07:07 - 2016-07-01 07:07 - 00000000 ____D C:\Users\Barbara\AppData\Local\CrashDumps
2016-07-01 06:49 - 2016-07-01 07:10 - 00000000 ____D C:\Qoobox
2016-07-01 06:49 - 2011-06-26 02:45 - 00256000 _____ C:\Windows\PEV.exe
2016-07-01 06:49 - 2010-11-07 13:20 - 00208896 _____ C:\Windows\MBR.exe
2016-07-01 06:49 - 2009-04-20 00:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2016-07-01 06:49 - 2000-08-30 20:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2016-07-01 06:49 - 2000-08-30 20:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2016-07-01 06:49 - 2000-08-30 20:00 - 00098816 _____ C:\Windows\sed.exe
2016-07-01 06:49 - 2000-08-30 20:00 - 00080412 _____ C:\Windows\grep.exe
2016-07-01 06:49 - 2000-08-30 20:00 - 00068096 _____ C:\Windows\zip.exe
2016-07-01 06:48 - 2016-07-01 07:08 - 00000000 ____D C:\Windows\erdnt
2016-07-01 06:40 - 2016-07-01 06:40 - 05659337 ____R (Swearware) C:\Users\Barbara\Desktop\ComboFix.exe
2016-06-30 13:18 - 2016-06-30 13:18 - 00001826 _____ C:\Users\Barbara\Desktop\Microsoft Security Essentials.lnk
2016-06-30 10:50 - 2016-06-30 10:50 - 00003883 _____ C:\Users\Barbara\Desktop\JRT.txt
2016-06-30 10:44 - 2016-06-30 10:44 - 01610816 _____ (Malwarebytes) C:\Users\Barbara\Desktop\JRT.exe
2016-06-30 10:41 - 2016-06-30 10:41 - 00005054 _____ C:\Users\Barbara\Desktop\AdwCleaner[C1].txt
2016-06-30 10:14 - 2016-06-30 10:32 - 00000000 ____D C:\AdwCleaner
2016-06-30 10:13 - 2016-06-30 10:13 - 03703360 _____ C:\Users\Barbara\Desktop\adwcleaner_5.200.exe
2016-06-30 10:10 - 2016-06-30 10:10 - 00024753 _____ C:\Users\Barbara\Desktop\MBAM.txt
2016-06-30 09:31 - 2016-06-30 09:31 - 00008670 _____ C:\Users\Barbara\Desktop\rk_66DE.tmp.txt
2016-06-30 08:59 - 2016-06-30 08:59 - 00024688 _____ C:\Windows\system32\Drivers\TrueSight.sys
2016-06-30 08:58 - 2016-06-30 08:58 - 24207432 _____ C:\Users\Barbara\Desktop\RogueKillerX64.exe
2016-06-30 08:53 - 2016-06-30 08:53 - 00000000 ____D C:\ProgramData\RogueKiller
2016-06-30 08:52 - 2016-06-30 08:52 - 19927624 _____ C:\Users\Barbara\Desktop\RogueKiller.exe
2016-06-29 16:05 - 2016-06-29 16:05 - 00068459 _____ C:\Users\Barbara\Documents\AddBkToTBird.CSV
2016-06-29 16:05 - 2016-06-29 16:05 - 00009329 _____ C:\Users\Barbara\AppData\Roaming\Comma Separated Values (Windows).EML
2016-06-29 13:32 - 2016-06-29 13:35 - 00033072 _____ C:\Users\Barbara\Desktop\Addition.txt
2016-06-29 13:30 - 2016-07-05 13:15 - 00015063 _____ C:\Users\Barbara\Desktop\FRST.txt
2016-06-29 13:28 - 2016-07-05 13:15 - 00000000 ____D C:\FRST
2016-06-29 13:27 - 2016-06-29 13:27 - 02390016 _____ (Farbar) C:\Users\Barbara\Desktop\FRST64.exe
2016-06-29 13:20 - 2016-06-29 13:20 - 00000000 ____D C:\Users\Barbara\AppData\Local\ESET
2016-06-29 13:18 - 2016-06-29 13:18 - 09908936 _____ (Microsoft Corporation) C:\Users\Barbara\Downloads\xlconv2007-kb3114895-fullfile-x86-glb.exe
2016-06-29 09:22 - 2016-06-29 09:22 - 00000000 ____D C:\Windows\CheckSur
2016-06-29 09:17 - 2016-06-29 09:19 - 218486747 _____ C:\Users\Barbara\Downloads\Windows6.0-KB947821-v35-x64.msu
2016-06-28 20:24 - 2016-07-05 13:07 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-06-28 20:24 - 2016-06-28 20:24 - 00000898 _____ C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
2016-06-28 20:24 - 2016-06-28 20:24 - 00000000 ____D C:\Users\Barbara\AppData\Roaming\Thunderbird
2016-06-28 20:24 - 2016-06-28 20:24 - 00000000 ____D C:\Users\Barbara\AppData\Local\Thunderbird
2016-06-28 20:22 - 2016-06-28 20:22 - 34098512 _____ (Mozilla) C:\Users\Barbara\Downloads\Thunderbird Setup 38.5.0.exe
2016-06-25 13:43 - 2009-08-04 04:12 - 01103872 _____ (Microsoft Corporation) C:\Windows\system32\webservices.dll
2016-06-25 13:43 - 2009-08-04 04:02 - 00754688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webservices.dll
2016-06-25 13:42 - 2016-06-25 13:42 - 00000000 ____D C:\Program Files\LSI SoftModem
2016-06-25 13:38 - 2016-06-25 13:38 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_SynTP_01009.Wdf
2016-06-24 19:48 - 2016-06-24 19:48 - 00000277 _____ C:\Users\Barbara\Desktop\Inbox - Outlook.url
2016-06-15 03:15 - 2016-05-14 11:54 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2016-06-15 03:15 - 2016-05-14 11:53 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\netevent.dll
2016-06-15 03:15 - 2016-05-14 11:42 - 00077312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2016-06-15 03:15 - 2016-05-14 11:41 - 00175616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2016-06-15 03:15 - 2016-05-14 11:41 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netevent.dll
2016-06-15 03:15 - 2016-05-14 10:38 - 00450560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2016-06-15 03:15 - 2016-05-14 10:38 - 00176128 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2016-06-15 03:15 - 2016-05-14 10:38 - 00147456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2016-06-15 03:15 - 2016-05-11 09:10 - 00516328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2016-06-15 03:14 - 2016-05-18 11:55 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2016-06-15 03:14 - 2016-05-18 11:34 - 00305152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2016-06-15 03:06 - 2016-05-14 11:58 - 00383208 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2016-06-15 03:06 - 2016-05-14 11:53 - 00048128 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2016-06-15 03:06 - 2016-05-14 11:47 - 00306408 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2016-06-15 03:06 - 2016-05-14 11:41 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2016-06-15 03:04 - 2016-05-12 10:39 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2016-06-15 03:04 - 2016-05-12 10:17 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2016-06-15 03:03 - 2016-05-12 10:45 - 02801664 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-06-15 03:03 - 2016-05-10 11:55 - 00264704 _____ (Microsoft Corporation) C:\Windows\system32\ws2_32.dll
2016-06-15 03:03 - 2016-05-10 11:54 - 00442880 _____ (Microsoft Corporation) C:\Windows\system32\winhttp.dll
2016-06-15 03:03 - 2016-05-10 11:54 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2016-06-15 03:03 - 2016-05-10 11:31 - 00377344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winhttp.dll
2016-06-15 03:03 - 2016-05-10 11:31 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2016-06-15 03:03 - 2016-05-10 11:31 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ws2_32.dll
2016-06-15 03:03 - 2016-05-10 10:55 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbt.sys
2016-06-15 03:03 - 2016-05-10 10:55 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\netbtugc.exe
2016-06-15 03:03 - 2016-05-10 10:28 - 00021504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netbtugc.exe
2016-06-15 03:01 - 2016-05-12 11:56 - 00534528 _____ (Microsoft Corporation) C:\Windows\system32\IPSECSVC.DLL
2016-06-15 03:01 - 2016-05-12 11:56 - 00381952 _____ (Microsoft Corporation) C:\Windows\system32\polstore.dll
2016-06-15 03:01 - 2016-05-12 11:56 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\winipsec.dll
2016-06-15 03:01 - 2016-05-12 11:56 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\FwRemoteSvr.dll
2016-06-15 03:01 - 2016-05-12 11:34 - 00273920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\polstore.dll
2016-06-15 03:01 - 2016-05-12 11:34 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winipsec.dll
2016-06-15 03:01 - 2016-05-12 11:33 - 00028672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FwRemoteSvr.dll
2016-06-15 03:00 - 2016-05-12 11:56 - 00726016 _____ (Microsoft Corporation) C:\Windows\system32\gpsvc.dll
2016-06-15 03:00 - 2016-05-12 11:56 - 00084480 _____ (Microsoft Corporation) C:\Windows\system32\gpapi.dll
2016-06-15 03:00 - 2016-05-12 11:33 - 00075264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gpapi.dll
2016-06-15 00:21 - 2016-05-12 15:52 - 18804224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-06-15 00:21 - 2016-05-12 15:49 - 02351616 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-06-15 00:21 - 2016-05-12 15:46 - 00448512 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2016-06-15 00:21 - 2016-05-12 15:45 - 10940416 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-06-15 00:21 - 2016-05-12 15:44 - 01389056 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-06-15 00:21 - 2016-05-12 15:43 - 01392640 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 02159104 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 01494528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-06-15 00:21 - 2016-05-12 15:42 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 00579584 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 00173568 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2016-06-15 00:21 - 2016-05-12 15:42 - 00096256 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2016-06-15 00:21 - 2016-05-12 15:42 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2016-06-15 00:21 - 2016-05-12 15:42 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2016-06-15 00:21 - 2016-05-12 15:41 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2016-06-15 00:21 - 2016-05-12 15:11 - 01815552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-06-15 00:21 - 2016-05-12 15:10 - 12840960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-06-15 00:21 - 2016-05-12 15:08 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2016-06-15 00:21 - 2016-05-12 15:06 - 09755136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-06-15 00:21 - 2016-05-12 15:06 - 01140224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-06-15 00:21 - 2016-05-12 15:05 - 01129984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2016-06-15 00:21 - 2016-05-12 15:04 - 01804800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2016-06-15 00:21 - 2016-05-12 15:04 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2016-06-15 00:21 - 2016-05-12 15:04 - 00719360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2016-06-15 00:21 - 2016-05-12 15:04 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2016-06-15 00:21 - 2016-05-12 15:04 - 00425472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2016-06-15 00:21 - 2016-05-12 15:04 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2016-06-15 00:21 - 2016-05-12 15:04 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2016-06-15 00:21 - 2016-05-12 15:04 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2016-06-15 00:21 - 2016-05-12 15:04 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2016-06-15 00:21 - 2016-05-12 15:03 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2016-06-15 00:21 - 2016-05-12 15:03 - 00354304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2016-06-15 00:21 - 2016-05-12 15:03 - 00223744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2016-06-15 00:21 - 2016-05-12 15:03 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2016-06-15 00:21 - 2016-05-12 15:03 - 00072704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2016-06-15 00:21 - 2016-05-12 15:03 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2016-06-15 00:21 - 2016-05-12 15:03 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-07-05 13:12 - 2009-03-22 12:25 - 00002617 _____ C:\Users\Barbara\Desktop\Microsoft Office Outlook 2007.lnk
2016-07-05 13:11 - 2006-11-02 11:22 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2016-07-05 13:11 - 2006-11-02 11:22 - 00003216 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2016-07-05 12:42 - 2015-07-28 14:01 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-07-05 12:31 - 2013-03-12 21:28 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-07-04 17:42 - 2015-07-28 14:01 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-07-03 18:49 - 2015-06-24 18:27 - 00003110 _____ C:\Windows\System32\Tasks\HPCeeScheduleForBarbara
2016-07-03 18:49 - 2015-06-24 18:27 - 00000342 _____ C:\Windows\Tasks\HPCeeScheduleForBarbara.job
2016-07-01 19:11 - 2006-11-02 11:42 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-07-01 09:48 - 2008-10-23 03:45 - 00000012 _____ C:\Windows\bthservsdp.dat
2016-07-01 09:48 - 2006-11-02 11:42 - 00032654 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2016-07-01 07:07 - 2006-11-02 08:34 - 00000215 _____ C:\Windows\system.ini
2016-07-01 06:30 - 2012-12-22 04:19 - 00006836 _____ C:\Users\Barbara\AppData\Local\d3d9caps.dat
2016-06-30 10:08 - 2014-05-15 13:45 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-06-30 08:40 - 2006-11-02 09:33 - 00000000 ____D C:\Windows\inf
2016-06-29 16:02 - 2008-10-23 05:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2016-06-29 08:05 - 2009-03-28 19:08 - 00000000 ____D C:\Windows\Minidump
2016-06-29 06:33 - 2014-05-15 13:45 - 00000901 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-06-29 06:33 - 2014-05-15 13:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-06-29 06:33 - 2014-05-15 13:45 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-06-28 14:46 - 2006-11-02 08:46 - 00759582 _____ C:\Windows\system32\PerfStringBackup.INI
2016-06-28 13:46 - 2014-05-17 13:29 - 00002425 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2016-06-25 14:37 - 2006-11-02 09:33 - 00000000 ____D C:\Windows\rescache
2016-06-25 13:42 - 2009-03-15 12:20 - 00000000 ____D C:\Users\Barbara
2016-06-24 19:13 - 2014-07-28 15:17 - 00002611 _____ C:\Users\Barbara\Desktop\Microsoft Office Word 2007.lnk
2016-06-24 16:32 - 2008-10-23 05:42 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2016-06-24 03:02 - 2010-06-04 03:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2016-06-17 01:32 - 2013-03-12 21:28 - 00003682 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2016-06-17 01:31 - 2013-03-12 21:28 - 00796352 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-06-17 01:31 - 2013-03-12 21:28 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-06-15 16:40 - 2009-10-03 00:16 - 00484008 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2016-06-15 03:39 - 2006-11-02 11:21 - 00315152 _____ C:\Windows\system32\FNTCACHE.DAT
2016-06-15 03:14 - 2013-07-14 03:28 - 00000000 ____D C:\Windows\system32\MRT
2016-06-15 03:06 - 2006-11-02 08:35 - 142482544 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
==================== Files in the root of some directories =======
2016-06-29 16:05 - 2016-06-29 16:05 - 0009329 _____ () C:\Users\Barbara\AppData\Roaming\Comma Separated Values (Windows).EML
2009-03-15 12:35 - 2009-03-15 12:35 - 0000000 _____ () C:\Users\Barbara\AppData\Local\AtStart.txt
2012-12-22 04:19 - 2016-07-01 06:30 - 0006836 _____ () C:\Users\Barbara\AppData\Local\d3d9caps.dat
2009-05-09 19:15 - 2011-03-15 10:15 - 0003584 _____ () C:\Users\Barbara\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2011-12-27 12:43 - 2011-12-27 12:44 - 0422154 _____ () C:\Users\Barbara\AppData\Local\dd_vcredistMSI599B.txt
2011-12-27 12:43 - 2011-12-27 12:44 - 0011684 _____ () C:\Users\Barbara\AppData\Local\dd_vcredistUI599B.txt
2009-03-15 12:35 - 2009-03-15 12:35 - 0000000 _____ () C:\Users\Barbara\AppData\Local\DSwitch.txt
2009-08-11 14:05 - 2009-08-11 14:05 - 0000000 _____ () C:\Users\Barbara\AppData\Local\FnF4.txt
2009-03-15 12:35 - 2009-03-15 12:35 - 0000000 _____ () C:\Users\Barbara\AppData\Local\QSwitch.txt
2010-04-03 15:14 - 2010-04-03 15:14 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2009-02-15 17:44 - 2009-02-15 17:44 - 0000032 _____ () C:\ProgramData\{051B9612-4D82-42AC-8C63-CD2DCEDC1CB3}.log
2008-10-23 05:36 - 2008-10-23 05:37 - 0000109 _____ () C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log
2009-02-15 17:42 - 2009-02-15 17:42 - 0000032 _____ () C:\ProgramData\{23F3DA62-2D9E-4A69-B8D5-BE8E9E148092}.log
2008-10-23 05:24 - 2008-10-23 05:27 - 0000105 _____ () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
2009-02-15 17:39 - 2009-02-15 17:39 - 0000032 _____ () C:\ProgramData\{4FC670EB-5F02-4B07-90DB-022B86BFEFD0}.log
2009-02-15 17:43 - 2009-02-15 17:43 - 0000032 _____ () C:\ProgramData\{9867824A-C86D-4A83-8F3C-E7A86BE0AFD3}.log
2008-10-23 05:22 - 2008-10-23 05:24 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
2008-10-23 05:27 - 2008-10-23 05:36 - 0000110 _____ () C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log
2009-02-15 17:44 - 2009-02-15 17:44 - 0000105 _____ () C:\ProgramData\{d36dd326-7280-11d8-97c8-000129760cbe}.log
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2016-07-05 07:45
==================== End of FRST.txt ============================

 

Addition TXT

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-06-2016
Ran by Barbara (2016-07-05 13:16:12)
Running from C:\Users\Barbara\Desktop
Windows Vista (TM) Home Premium Service Pack 2 (X64) (2009-02-15 20:34:59)
Boot Mode: Normal
==========================================================

==================== Accounts: =============================
Administrator (S-1-5-21-333120211-1585552344-2278992193-500 - Administrator - Disabled)
Barbara (S-1-5-21-333120211-1585552344-2278992193-1000 - Administrator - Enabled) => C:\Users\Barbara
Guest (S-1-5-21-333120211-1585552344-2278992193-501 - Limited - Disabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Microsoft Security Essentials (Enabled - Up to date) {768124D7-F5F7-6D2F-DDC2-94DFA4017C95}
AS: Microsoft Security Essentials (Enabled - Up to date) {CDE0C533-D3CD-62A1-E772-AFADDF863628}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Acrobat.com (HKLM-x32\...\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.1.377 - Adobe Systems Incorporated)
Acrobat.com (x32 Version: 0.0.0 - Adobe Systems Incorporated) Hidden
Activation Assistant for the 2007 Microsoft Office suites (HKLM-x32\...\Activation Assistant for the 2007 Microsoft Office suites) (Version: - Microsoft Corporation)
Activation Assistant for the 2007 Microsoft Office suites (x32 Version: 1.0 - Microsoft Corporation) Hidden
ActiveCheck component for HP Active Support Library (x32 Version: 3.0.0.2 - Hewlett-Packard) Hidden
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.0.4990 - Adobe Systems Inc.)
Adobe Flash Player 10 ActiveX (HKLM-x32\...\Adobe Flash Player 10 ActiveX) (Version: 10.0.2.13 - Adobe Systems Incorporated)
Adobe Flash Player 22 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 22.0.0.192 - Adobe Systems Incorporated)
Adobe Reader X (10.1.16) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.16 - Adobe Systems Incorporated)
Agere Systems HDA Modem (HKLM\...\Agere Systems Soft Modem) (Version: - LSI Corporation)
AMD USB Audio Driver Filter (HKLM-x32\...\{A3AB35FA-943E-4799-99DC-46EFD59E998F}) (Version: 1.0.7.0031 - Advanced Micro Devices, Inc.)
Atheros Driver Installation Program (HKLM-x32\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 5.2 - Atheros)
ATI Catalyst Install Manager (HKLM\...\{7510991E-FE80-7466-2E31-561B52059618}) (Version: 3.0.691.0 - ATI Technologies, Inc.)
Belarc Advisor 8.4 (HKLM-x32\...\Belarc Advisor) (Version: 8.4.0.0 - Belarc Inc.)
ccc-core-static (x32 Version: 2008.0917.337.4556 - ATI) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.13 - Piriform)
Cisco EAP-FAST Module (HKLM-x32\...\{415B2719-AD3A-4944-B404-C472DB6085B3}) (Version: 2.1.6 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{83770D14-21B9-44B3-8689-F7B523F94560}) (Version: 1.0.12 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{669C7BD8-DAA2-49B6-966C-F1E2AAE6B17E}) (Version: 1.0.13 - Cisco Systems, Inc.)
Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6425.1000 - Microsoft Corporation)
CyberLink DVD Suite (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 6.0.2126 - CyberLink Corp.)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
ESU for Microsoft Vista (HKLM-x32\...\{3877C901-7B90-4727-A639-B6ED2DD59D43}) (Version: 1.0.0 - Hewlett-Packard)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 49.0.2623.112 - Google Inc.)
Google Update Helper (x32 Version: 1.3.30.3 - Google Inc.) Hidden
HP Customer Experience Enhancements (HKLM-x32\...\{57A5AEC1-97FC-474D-92C4-908FCC2253D4}) (Version: 5.7.0.2664 - Hewlett-Packard)
HP Doc Viewer (HKLM-x32\...\{082702D5-5DD8-4600-BCE5-48B15174687F}) (Version: 1.01.0005 - Hewlett-Packard)
HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.0.71 - WildTangent)
HP Help and Support (HKLM-x32\...\{0054A0F6-00C9-4498-B821-B5C9578F433E}) (Version: 2.1.0.0 - Hewlett-Packard Company)
HP MediaSmart DVD (HKLM-x32\...\InstallShield_{DCCAD079-F92C-44DA-B258-624FC6517A5A}) (Version: 2.0.2126 - Hewlett-Packard)
HP MediaSmart Music/Photo/Video (HKLM-x32\...\InstallShield_{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}) (Version: 2.0.2125 - Hewlett-Packard)
HP MediaSmart SmartMenu (HKLM\...\{D2F7994F-661E-46D1-A1DF-67F2887AAA7E}) (Version: 2.0.8 - Hewlett-Packard)
HP MediaSmart Webcam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 2.0.0926 - Hewlett-Packard)
HP MULTIPLE MODEM INSTALLER for VISTA (HKLM-x32\...\{45A136EC-88BF-4B95-99F5-C45D3930E1CC}) (Version: 1.0.0.30 - Hewlett Packard)
HP Quick Launch Buttons 6.40 H2 (HKLM-x32\...\{34D2AB40-150D-475D-AE32-BD23FB5EE355}) (Version: 6.40 H2 - Hewlett-Packard)
HP Total Care Advisor (HKLM-x32\...\{154A4184-1A3D-4BF9-A5AE-4FA1660445F3}) (Version: 2.4.4941.2798 - Hewlett-Packard)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HP User Guides 0129 (HKLM-x32\...\{149BBCB8-674F-48D2-969C-9D0EA88DA7D6}) (Version: 1.00.0000 - Hewlett-Packard)
HP Wireless Assistant (HKLM-x32\...\{9ADABDDE-9644-461B-9E73-83FA3EFCAB50}) (Version: 3.00 K2 - Hewlett-Packard)
HPAsset component for HP Active Support Library (x32 Version: 3.0.2.2 - Hewlett-Packard) Hidden
HPTCSSetup (HKLM-x32\...\{30D3B7BC-5798-45D9-822D-05CA18F39E99}) (Version: 1.1.1955.2793 - Hewlett-Packard Company)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6087.0 - IDT)
JMicron JMB38X Flash Media Controller (HKLM-x32\...\{26604C7E-A313-4D12-867F-7C6E7820BE4C}) (Version: 1.00.17.07 - JMicron Technology Corp.)
Juno Preloader (HKLM-x32\...\{6423EF83-6E1D-4D22-A36F-689CD19FD4D2}) (Version: 1.0.0 - Juno, Inc.)
KODAK Share Button App (HKLM-x32\...\{19F1A99A-196F-4D18-BC36-C1DAD6ABCCF3}) (Version: 4.00.0000.0000 - Eastman Kodak Company)
LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.0919 - CyberLink Corp.)
LabelPrint (x32 Version: 2.5.0919 - CyberLink Corp.) Hidden
LightScribe System Software 1.14.17.1 (HKLM-x32\...\{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}) (Version: 1.14.17.1 - LightScribe)
Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Live Search Toolbar (HKLM-x32\...\{6A370610-3778-44AF-9AAC-69B2FD1A3356}) (Version: 3.0.541.0 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-001A-0000-0000-0000000FF1CE}_OUTLOOKR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Outlook 2007 (HKLM-x32\...\OUTLOOKR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\...\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.9.218.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50428.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (HKLM\...\{EE936C7A-EA40-31D5-9B65-8E3E089C3828}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{4FFA2088-8317-3B14-93CD-4C699DB37843}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218 (HKLM-x32\...\{E503B4BF-F7BB-3D5F-8BC8-F694B1CFF942}) (Version: 9.0.21022.218 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Works (HKLM-x32\...\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}) (Version: 9.7.0621 - Microsoft Corporation)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 45.1.1.5990 - Mozilla)
Mozilla Thunderbird 38.5.0 (x86 en-US) (HKLM-x32\...\Mozilla Thunderbird 38.5.0 (x86 en-US)) (Version: 38.5.0 - Mozilla)
Mozilla Thunderbird 45.1.1 (x86 en-US) (HKU\S-1-5-21-333120211-1585552344-2278992193-1000\...\Mozilla Thunderbird 45.1.1 (x86 en-US)) (Version: 45.1.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
muvee Reveal (HKLM-x32\...\{DD35C328-F115-BEDA-6EEE-E00C5AACCCBC}) (Version: 7.0.35.6951 - muvee Technologies Pte Ltd)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9.140.239 - Google, Inc.)
Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.2119 - CyberLink Corp.)
Power2Go (x32 Version: 6.0.2119 - CyberLink Corp.) Hidden
PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 7.0.2119 - CyberLink Corp.)
PowerDirector (x32 Version: 7.0.2119 - CyberLink Corp.) Hidden
ProtectSmart Hard Drive Protection (HKLM\...\{2F97CE84-9C33-4631-821B-85EA371EA254}) (Version: 3.10.1.7 - Hewlett-Packard)
Realtek 8169, 8168, 8101E and 8102E Ethernet Network Card Driver for Windows Vista (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0000 - Realtek)
Skins (x32 Version: 2008.0917.337.4556 - ATI) Hidden
Skype Toolbars (HKLM-x32\...\{981029E0-7FC9-4CF3-AB39-6F133621921A}) (Version: 1.0.4051 - Skype Technologies S.A.)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Slingbox - Watch Your TV Anywhere (HKLM-x32\...\{7B798B31-2F33-4DC8-BDA4-D36488E86636}) (Version: 1.0.0 - Sling Media)
SlingPlayer (HKLM-x32\...\InstallShield_{004B0DCB-4C60-465B-8F01-44B0A4111187}) (Version: 1.04.0206 - Sling Media)
SlingPlayer (x32 Version: 1.04.0206 - Sling Media) Hidden
Spelling Dictionaries Support For Adobe Reader 9 (HKLM-x32\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
SPORE Creature Creator Trial Edition (HKLM-x32\...\{ECEE0279-785F-4CB3-9F28-E69813234BF8}) (Version: 1.00.0000 - Electronic Arts)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.27.1 - Synaptics Incorporated)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-001A-0000-0000-0000000FF1CE}_OUTLOOKR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Windows Driver Package - Eastman Kodak KODAK Digital Camera (01/29/2010 1.4.1.0) (HKLM\...\3D970B9F930E7AAE23C06D39A1AC98548C90B442) (Version: 01/29/2010 1.4.1.0 - Eastman Kodak)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {036E36E9-7ECA-463D-BEE9-BF0AE989698F} - System32\Tasks\{10EF5062-FADE-4238-95E4-4EA61663B88F}-Kodak Share Button App Camera detect => C:\Program Files (x86)\Kodak\KODAK Share Button App\Listener.exe [2011-09-22] (Eastman Kodak Company)
Task: {14E70405-9297-4B33-9136-262275B7A6C6} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)
Task: {70FAABFB-DAEB-4BF6-AC18-65D2944EB407} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-07-28] (Google Inc.)
Task: {874C940B-C79D-4A0D-8CB9-F30EF61BB7D9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-07-28] (Google Inc.)
Task: {9F3A227D-0B84-4572-90B9-7493B3C9E26C} - System32\Tasks\HP Health Check => c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2008-06-16] (Hewlett-Packard)
Task: {AD863B1F-E583-4E14-AA75-928868F5ECE5} - System32\Tasks\{C4479596-C7A9-4AB2-9B3A-5844A8DEAA6D} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2014-12-11] (Skype Technologies S.A.)
Task: {AE9C160B-665D-419C-9C31-C20AB2BADE8B} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Barbara => C:\Program Files (x86)\Windows Calendar\wincal.exe [2009-04-11] (Microsoft Corporation)
Task: {B8A13BC7-683F-45C8-A79E-74C7526403EA} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-04-17] (Piriform Ltd)
Task: {C04A2384-3DB7-435D-A365-764FEE1E78DE} - System32\Tasks\HPCeeScheduleForBarbara => C:\Program Files (x86)\hewlett-packard\sdp\ceement\HPCEE.exe [2008-05-19] (Hewlett-Packard)
Task: {DA12C612-354A-436E-8182-6DB911689B7F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-06-17] (Adobe Systems Incorporated)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForBarbara.job => C:\Program Files (x86)\hewlett-packard\sdp\ceement\HPCEE.exe
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Quicken Financial Center.lnk -> hxxp://redirect.hp.com/svs/rdr?TYPE=4&tp=onlinesvs&s=quickenfc&pf=cnnb&locale=en_us&bd=pavilion&c=91EC:\Program Files (x86)\Online Services\quickenfc\financial_center.ico (No File)
==================== Loaded Modules (Whitelisted) ==============
2008-09-17 00:16 - 2008-09-17 00:16 - 00117248 _____ () C:\Windows\system32\atitmm64.dll
2008-10-23 05:48 - 2008-10-06 12:54 - 00365952 _____ () C:\Program Files (x86)\SMINST\BLService.exe
2008-10-23 05:36 - 2008-06-29 19:10 - 00241734 _____ () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
2009-02-15 16:44 - 2009-02-15 16:44 - 00014848 _____ () C:\Windows\assembly\GAC_MSIL\AxInterop.WBOCXLib\1.0.0.0__90ba9c70f846762e\AxInterop.WBOCXLib.dll
2008-08-22 14:03 - 2008-08-22 14:03 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2008-10-23 04:36 - 2008-04-11 12:04 - 00685360 _____ () C:\Program Files (x86)\Hewlett-Packard\Shared\HpqToaster.exe
2007-07-12 17:55 - 2007-07-12 17:55 - 01581056 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll
2007-08-14 17:59 - 2007-08-14 17:59 - 06365184 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll
2007-07-12 17:55 - 2007-07-12 17:55 - 00131072 _____ () C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll
2008-10-23 05:48 - 2008-10-06 12:54 - 00132480 _____ () C:\Program Files (x86)\SMINST\STWmiM.dll
2008-09-25 22:42 - 2008-09-25 22:42 - 00881960 ____N () C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMediaLibrary.dll
2008-10-23 05:36 - 2008-06-29 19:10 - 00028672 _____ () C:\Program Files (x86)\Cyberlink\Shared files\RichVideops.dll
2009-02-26 13:46 - 2009-02-26 13:46 - 00064344 _____ () C:\Program Files (x86)\Microsoft Office\Office12\ADDINS\ColleagueImport.dll
2011-06-22 11:46 - 2011-06-22 11:46 - 00434016 _____ () C:\Program Files (x86)\Microsoft Office\Office12\ADDINS\UmOutlookAddin.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => " "= "Driver "
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => " "= "Driver "
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2006-11-02 08:34 - 2016-07-01 07:07 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-333120211-1585552344-2278992193-1000\Control Panel\Desktop\\Wallpaper -> C:\windows\web\wallpaper\Bronze1.jpg
DNS Servers: 68.100.16.30 - 68.10.16.30
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 2) (ConsentPromptBehaviorUser: 1) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\startupreg: HP Health Check Scheduler => c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
MSCONFIG\startupreg: SmartMenu => %ProgramFiles%\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [WinCollab-Out-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-In-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-Out-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-In-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-DFSR-Out-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
FirewallRules: [WinCollab-DFSR-In-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
FirewallRules: [{2D720E0B-FB17-4C8A-9F86-B55938CFA8A9}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDirector\PDR.EXE
FirewallRules: [{6C19D66F-67C0-4616-8F12-CDC866456086}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\Media\DVD\HPTouchSmartMusic.exe
FirewallRules: [{3E357E02-B7C9-4F2E-B3B4-5619DF9CEA96}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\Media\DVD\HPTouchSmartPhoto.exe
FirewallRules: [{F5864058-E43B-4A74-8C6C-5F2E053A95F4}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\Media\DVD\HPTouchSmartVideo.exe
FirewallRules: [{12E20DB7-1EEB-4780-AD3D-3C9DEF2F9855}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\Media\DVD\TSMAgent.exe
FirewallRules: [{57464C92-B65A-4DC1-AFF9-6D7C4FF1EFD5}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\Media\DVD\Kernel\CLML\CLMLSvc.exe
FirewallRules: [{9C1BBABE-541E-4AE4-8C4A-DD1EAFD37324}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\Media\DVD\HPDVDSmart.exe
FirewallRules: [{4DBFF9F9-3622-42EF-9B74-0A91B2F49642}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\HPTouchSmartMusic.exe
FirewallRules: [{95AA8929-76A7-49D4-A5FA-CE242771C311}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\HPTouchSmartPhoto.exe
FirewallRules: [{0E0D3F80-CE25-46F5-BFB5-9524CAFF2D31}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\HPTouchSmartVideo.exe
FirewallRules: [{4ABC1618-7C7D-460C-A171-3F03E6BF6B38}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe
FirewallRules: [{3B7CB015-AA77-462D-9168-0AC13423A040}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
FirewallRules: [{49027FB1-07DE-4A80-9C75-C2B03C9A8163}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\Media\TV\QP.exe
FirewallRules: [{0AABC289-FE10-4E12-8DD4-F3E6296E302E}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\Media\TV\QPService.exe
FirewallRules: [{86E0556D-48B5-4D8D-839A-1273240490A6}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{6A5D9B48-3B83-4704-815C-DB7E3F75AF58}] => (Allow) LPort=80
FirewallRules: [{46CC1CE8-C770-419E-AA2A-6B69FA1920E4}] => (Allow) LPort=80
FirewallRules: [{9DCC2800-DCEA-4EA5-B8EC-E358B1EBD5DE}] => (Allow) LPort=80
FirewallRules: [{B6DCAD06-E8A1-4BA2-8B3C-06A8AE2AFA16}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Restore Points =========================
14-06-2016 03:00:15 Windows Update
15-06-2016 03:00:22 Windows Update
16-06-2016 03:00:13 Windows Update
17-06-2016 03:00:14 Windows Update
18-06-2016 03:00:13 Windows Update
19-06-2016 03:00:13 Windows Update
20-06-2016 03:00:14 Windows Update
21-06-2016 03:00:13 Windows Update
22-06-2016 03:00:13 Windows Update
23-06-2016 03:00:13 Windows Update
24-06-2016 03:00:13 Windows Update
25-06-2016 03:00:32 Windows Update
25-06-2016 13:27:05 Windows Update
25-06-2016 13:33:50 Windows Update
26-06-2016 03:00:14 Windows Update
27-06-2016 03:00:14 Windows Update
28-06-2016 03:00:14 Windows Update
29-06-2016 03:00:15 Windows Update
29-06-2016 09:04:34 Windows Update
29-06-2016 09:21:02 Windows Update
29-06-2016 10:47:53 Windows Update
29-06-2016 13:08:45 Windows Update
30-06-2016 08:36:02 Windows Update
30-06-2016 10:45:11 JRT Pre-Junkware Removal
02-07-2016 03:00:15 Windows Update
03-07-2016 03:00:16 Windows Update
04-07-2016 03:00:16 Windows Update
05-07-2016 03:00:15 Windows Update
==================== Faulty Device Manager Devices =============
Name: Microsoft 6to4 Adapter #3
Description: Microsoft 6to4 Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

==================== Event log errors: =========================
Application errors:
==================
Error: (07/01/2016 07:11:46 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/01/2016 06:55:37 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application PEV.exe, version 0.0.0.0, time stamp 0x4e06cfe8, faulting module PEV.exe, version 0.0.0.0, time stamp 0x4e06cfe8, exception code 0x40000015, fault offset 0x0008d1c0,
process id 0x520, application start time 0xPEV.exe0.
Error: (07/01/2016 06:30:59 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/30/2016 07:26:07 PM) (Source: EventSystem) (EventID: 4621) (User: )
Description: 80070005EventSystem.EventSubscription{CEB8B221-89C5-41A8-98CE-79B413BF150B}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}
Error: (06/30/2016 07:06:37 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/30/2016 10:35:02 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/30/2016 10:06:26 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/30/2016 08:38:33 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application svchost.exe_SysMain, version 6.0.6001.18000, time stamp 0x47919291, faulting module sysmain.dll, version 6.0.6002.18005, time stamp 0x49e04208, exception code 0xc0000005, fault offset 0x000000000000c269,
process id 0x3ac, application start time 0xsvchost.exe_SysMain0.
Error: (06/30/2016 08:35:53 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program iexplore.exe version 9.0.8112.16789 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel.
Process ID: 1294
Start Time: 01d1d2cbb30e6ca6
Termination Time: 10
Error: (06/30/2016 08:31:36 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

System errors:
=============
Error: (07/05/2016 03:05:07 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: 0x80070663Security Update for Microsoft Office Compatibility Pack Service Pack 3 (KB3114982){F817BA34-8961-47DE-8490-BB7F01A3F0BD}201
Error: (07/05/2016 03:05:07 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: 0x80070663Security Update for Microsoft Office Compatibility Pack Service Pack 3 (KB3114745){0FFECF24-D183-4499-99AE-D20E5D2C5C01}201
Error: (07/04/2016 03:05:08 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: 0x80070663Security Update for Microsoft Office Compatibility Pack Service Pack 3 (KB3114982){F817BA34-8961-47DE-8490-BB7F01A3F0BD}201
Error: (07/04/2016 03:05:08 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: 0x80070663Security Update for Microsoft Office Compatibility Pack Service Pack 3 (KB3114745){0FFECF24-D183-4499-99AE-D20E5D2C5C01}201
Error: (07/03/2016 03:05:08 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: 0x80070663Security Update for Microsoft Office Compatibility Pack Service Pack 3 (KB3114982){F817BA34-8961-47DE-8490-BB7F01A3F0BD}201
Error: (07/03/2016 03:05:08 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: 0x80070663Security Update for Microsoft Office Compatibility Pack Service Pack 3 (KB3114745){0FFECF24-D183-4499-99AE-D20E5D2C5C01}201
Error: (07/02/2016 03:05:25 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: 0x80070663Security Update for Microsoft Office Compatibility Pack Service Pack 3 (KB3114982){F817BA34-8961-47DE-8490-BB7F01A3F0BD}201
Error: (07/02/2016 03:05:25 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: 0x80070663Security Update for Microsoft Office Compatibility Pack Service Pack 3 (KB3114745){0FFECF24-D183-4499-99AE-D20E5D2C5C01}201
Error: (07/01/2016 07:15:52 PM) (Source: PlugPlayManager) (EventID: 12) (User: )
Description: The device 'JMB38X xD Host Controller' (PCI\VEN_197B&DEV_2384&SUBSYS_30FC103C&REV_00\4&3b4983b4&0&0428) disappeared from the system without first being prepared for removal.
Error: (07/01/2016 07:15:52 PM) (Source: PlugPlayManager) (EventID: 12) (User: )
Description: The device 'JMB38X MS Host Controller' (PCI\VEN_197B&DEV_2383&SUBSYS_30FC103C&REV_00\4&3b4983b4&0&0328) disappeared from the system without first being prepared for removal.

CodeIntegrity:
===================================
Date: 2016-07-01 07:06:15.884
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2016-07-01 07:06:13.520
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2016-06-30 09:47:18.914
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.
Date: 2016-06-30 09:47:16.601
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.
Date: 2016-06-30 09:47:14.503
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.
Date: 2016-06-30 09:47:12.376
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.
Date: 2016-06-30 09:47:10.251
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.
Date: 2016-06-30 09:47:08.083
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.
Date: 2016-06-30 09:47:05.799
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.
Date: 2016-06-30 09:47:03.727
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

==================== Memory info ===========================
Processor: AMD Turion(tm) X2 Dual-Core Mobile RM-72
Percentage of memory in use: 51%
Total physical RAM: 3836.89 MB
Available physical RAM: 1857.38 MB
Total Virtual: 7908.31 MB
Available Virtual: 5538.49 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:285.18 GB) (Free:158.14 GB) NTFS ==>[drive with boot components (obtained from BCD)]
Drive d: (RECOVERY) (Fixed) (Total:12.9 GB) (Free:2.02 GB) NTFS ==>[system with boot components (obtained from drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 298.1 GB) (Disk ID: 89900F6B)
Partition 1: (Active) - (Size=285.2 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=12.9 GB) - (Type=07 NTFS)
==================== End of Addition.txt ============================

 

FixLog Text

Fix result of Farbar Recovery Scan Tool (x64) Version: 02-07-2016
Ran by Barbara (2016-07-06 14:05:47) Run:1
Running from C:\Users\Barbara\Desktop
Loaded Profiles: Barbara (Available Profiles: Barbara)
Boot Mode: Normal
==============================================
fixlist content:
*****************
HKLM-x32\...\Run: [] => [X]
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-333120211-1585552344-2278992193-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
SearchScopes: HKLM-x32 -> DefaultScope {584B1ED9-8A43-4956-895E-AF86252744CC} URL =
S1 Beep; no ImagePath
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\ENG64.SYS [X]
S3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\EX64.SYS [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S1 SRTSP; \??\C:\Windows\system32\drivers\NISx64\1000000.07D\SRTSP64.SYS [X]
S1 SRTSPX; \??\C:\Windows\system32\drivers\NISx64\1000000.07D\SRTSPX64.SYS [X]
2016-06-29 16:05 - 2016-06-29 16:05 - 0009329 _____ () C:\Users\Barbara\AppData\Roaming\Comma Separated Values (Windows).EML
2009-03-15 12:35 - 2009-03-15 12:35 - 0000000 _____ () C:\Users\Barbara\AppData\Local\AtStart.txt
2012-12-22 04:19 - 2016-07-01 06:30 - 0006836 _____ () C:\Users\Barbara\AppData\Local\d3d9caps.dat
2009-05-09 19:15 - 2011-03-15 10:15 - 0003584 _____ () C:\Users\Barbara\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2011-12-27 12:43 - 2011-12-27 12:44 - 0422154 _____ () C:\Users\Barbara\AppData\Local\dd_vcredistMSI599B.txt
2011-12-27 12:43 - 2011-12-27 12:44 - 0011684 _____ () C:\Users\Barbara\AppData\Local\dd_vcredistUI599B.txt
2009-03-15 12:35 - 2009-03-15 12:35 - 0000000 _____ () C:\Users\Barbara\AppData\Local\DSwitch.txt
2009-08-11 14:05 - 2009-08-11 14:05 - 0000000 _____ () C:\Users\Barbara\AppData\Local\FnF4.txt
2009-03-15 12:35 - 2009-03-15 12:35 - 0000000 _____ () C:\Users\Barbara\AppData\Local\QSwitch.txt
2010-04-03 15:14 - 2010-04-03 15:14 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2009-02-15 17:44 - 2009-02-15 17:44 - 0000032 _____ () C:\ProgramData\{051B9612-4D82-42AC-8C63-CD2DCEDC1CB3}.log
2008-10-23 05:36 - 2008-10-23 05:37 - 0000109 _____ () C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log
2009-02-15 17:42 - 2009-02-15 17:42 - 0000032 _____ () C:\ProgramData\{23F3DA62-2D9E-4A69-B8D5-BE8E9E148092}.log
2008-10-23 05:24 - 2008-10-23 05:27 - 0000105 _____ () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
2009-02-15 17:39 - 2009-02-15 17:39 - 0000032 _____ () C:\ProgramData\{4FC670EB-5F02-4B07-90DB-022B86BFEFD0}.log
2009-02-15 17:43 - 2009-02-15 17:43 - 0000032 _____ () C:\ProgramData\{9867824A-C86D-4A83-8F3C-E7A86BE0AFD3}.log
2008-10-23 05:22 - 2008-10-23 05:24 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
2008-10-23 05:27 - 2008-10-23 05:36 - 0000110 _____ () C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log
2009-02-15 17:44 - 2009-02-15 17:44 - 0000105 _____ () C:\ProgramData\{d36dd326-7280-11d8-97c8-000129760cbe}.log
*****************
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value removed successfully
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully
"HKU\S-1-5-21-333120211-1585552344-2278992193-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
Beep => service removed successfully
catchme => service removed successfully
IpInIp => service removed successfully
NAVENG => service removed successfully
NAVEX15 => service removed successfully
NwlnkFlt => service removed successfully
NwlnkFwd => service removed successfully
SRTSP => service removed successfully
SRTSPX => service removed successfully
C:\Users\Barbara\AppData\Roaming\Comma Separated Values (Windows).EML => moved successfully
C:\Users\Barbara\AppData\Local\AtStart.txt => moved successfully
C:\Users\Barbara\AppData\Local\d3d9caps.dat => moved successfully
C:\Users\Barbara\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini => moved successfully
C:\Users\Barbara\AppData\Local\dd_vcredistMSI599B.txt => moved successfully
C:\Users\Barbara\AppData\Local\dd_vcredistUI599B.txt => moved successfully
C:\Users\Barbara\AppData\Local\DSwitch.txt => moved successfully
C:\Users\Barbara\AppData\Local\FnF4.txt => moved successfully
C:\Users\Barbara\AppData\Local\QSwitch.txt => moved successfully
C:\ProgramData\ezsidmv.dat => moved successfully
C:\ProgramData\{051B9612-4D82-42AC-8C63-CD2DCEDC1CB3}.log => moved successfully
C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log => moved successfully
C:\ProgramData\{23F3DA62-2D9E-4A69-B8D5-BE8E9E148092}.log => moved successfully
C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log => moved successfully
C:\ProgramData\{4FC670EB-5F02-4B07-90DB-022B86BFEFD0}.log => moved successfully
C:\ProgramData\{9867824A-C86D-4A83-8F3C-E7A86BE0AFD3}.log => moved successfully
C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log => moved successfully
C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log => moved successfully
C:\ProgramData\{d36dd326-7280-11d8-97c8-000129760cbe}.log => moved successfully
==== End of Fixlog 14:05:48 ====

 

Below are the Checkup.txt and FSS.txt files. The Sophos scan was clean so no report was generated.

Checkup.txt

Results of screen317's Security Check version 1.014 --- 12/23/15
Windows Vista Service Pack 2 x64 (UAC is enabled)
Internet Explorer 9
Internet Explorer 8
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Microsoft Security Essentials
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Adobe Flash Player 10 Flash Player out of Date!
Adobe Reader 9 Adobe Reader out of Date!
Adobe Reader 10.1.16 Adobe Reader out of Date!
Mozilla Thunderbird (38.5.0)
Google Chrome (49.0.2623.110)
Google Chrome (49.0.2623.112)
````````Process Check: objlist.exe by Laurent````````
Microsoft Security Essentials MSMpEng.exe
Microsoft Security Essentials msseces.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 3 % Defragment your hard drive soon! (Do NOT defrag if SSD!)
````````````````````End of Log``````````````````````

FSS Txt

Farbar Service Scanner Version: 27-01-2016
Ran by Barbara (administrator) on 07-07-2016 at 12:52:04
Running from "C:\Users\Barbara\Desktop "
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X64)
Boot Mode: Normal
****************************************************************
Internet Services:
============
Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.

Windows Firewall:
=============
Firewall Disabled Policy:
==================

System Restore:
============
System Restore Policy:
========================

Security Center:
============

Windows Update:
============
Windows Autoupdate Disabled Policy:
============================

Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.

Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware "=DWORD:1

Other Services:
==============

File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcsvc.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed

**** End of log ****

 

Broni,
Thanks so much for all your time and effort. We have covered all your instructions in your last post. Hopefully we can keep it clean.

The "Not responding" problem has gone away. The unit seems to be much more responsive but still slow at times - but I think that is inherent in the age of the computer, insufficient memory, and Vista in general. I just tried Windows Update again and I still get important Office updates that fail to install. However, that is a problem that I need to work on over in the Vista Forum so I will start a new thread and see if some of the folks over there can give me a hand.

Again, thanks.