Additional scan result of Farbar Recovery Scan Tool (x86) Version: 15-03-2017 Ran by KLUCAS (20-03-2017 20:43:35) Running from C:\Users\KLUCAS\Desktop Microsoft® Windows Vista™ Home Basic Service Pack 2 (X86) (2008-07-02 13:35:16) Boot Mode: Normal ========================================================== ==================== Accounts: ============================= Administrator (S-1-5-21-3402600103-2626558384-1099160823-500 - Administrator - Disabled) Guest (S-1-5-21-3402600103-2626558384-1099160823-501 - Limited - Disabled) KLUCAS (S-1-5-21-3402600103-2626558384-1099160823-1000 - Administrator - Enabled) => C:\Users\KLUCAS ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Microsoft Security Essentials (Enabled - Up to date) {768124D7-F5F7-6D2F-DDC2-94DFA4017C95} AS: Microsoft Security Essentials (Enabled - Up to date) {CDE0C533-D3CD-62A1-E772-AFADDF863628} AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) 32 Bit HP CIO Components Installer (Version: 2.1.4 - Hewlett-Packard) Hidden Adobe Flash Player 16 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated) Adobe Flash Player 20 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 20.0.0.306 - Adobe Systems Incorporated) Adobe Reader XI (11.0.10) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated) AnswerWorks 5.0 English Runtime (HKLM\...\{9E5A03E3-6246-4920-9630-0527D5DA9B07}) (Version: 008.000.0003 - Vantage Linguistics) Apple Application Support (HKLM\...\{853A4763-6643-4604-8D64-28BDD8925F4C}) (Version: 1.5.1 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{CACAEB5F-174D-4C7C-AC56-A33289A807CA}) (Version: 3.4.0.25 - Apple Inc.) Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.) Bonjour (HKLM\...\{C2E4B5BD-32DB-4817-A060-341AB17C3F90}) (Version: 2.0.5.0 - Apple Inc.) Browser Address Error Redirector (HKLM\...\{62230596-37E5-4618-A329-0D21F529A86F}) (Version: 1.00.0000 - Dell) BufferChm (Version: 110.0.180.000 - Hewlett-Packard) Hidden Cards_Calendar_OrderGift_DoMorePlugout (Version: 2.03.0000 - Hewlett-Packard) Hidden CCleaner (HKLM\...\CCleaner) (Version: 4.09 - Piriform) Compatibility Pack for the 2007 Office system (HKLM\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation) Copy (Version: 110.0.180.000 - Hewlett-Packard) Hidden CryptoPrevent (HKLM\...\{5C5B24E7-4694-4049-A222-CCE7D3FAC63F}_is1) (Version: - Foolish IT LLC) CustomerResearchQFolder (Version: 1.00.0000 - Hewlett-Packard) Hidden Dell DataSafe Online (HKLM\...\{4D3C9F4B-4B7D-4E5D-99B9-0123AB0D51ED}) (Version: 1.0.21 - Dell, Inc.) Dell Getting Started Guide (HKLM\...\{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}) (Version: 1.00.0000 - Dell Inc.) Dell Support Center (HKLM\...\{E3BFEE55-39E2-4BE0-B966-89FE583822C1}) (Version: 2.1.08060 - Dell) Destination Component (Version: 110.0.0.0 - Hewlett-Packard) Hidden DeviceDiscovery (Version: 110.0.180.000 - Hewlett-Packard) Hidden DeviceManagementQFolder (Version: 1.00.0000 - Hewlett-Packard) Hidden DocProc (Version: 11.0.0.0 - Hewlett-Packard) Hidden DocProcQFolder (Version: 1.00.0000 - Hewlett-Packard) Hidden EDocs (HKLM\...\{6B7B6D4D-8F9B-4CB3-8CA4-BCA9CC4C1A22}) (Version: - ) ESET Online Scanner v3 (HKLM\...\ESET Online Scanner) (Version: - ) eSupportQFolder (Version: 1.00.0000 - Hewlett-Packard) Hidden Google Desktop (HKLM\...\Google Desktop) (Version: 5.9.1005.12335 - Google) GoToAssist 8.0.0.514 (HKLM\...\GoToAssist) (Version: - ) GPBaseService (Version: 110.0.180.000 - Hewlett-Packard) Hidden HP Customer Participation Program 11.0 (HKLM\...\HPExtendedCapabilities) (Version: 11.0 - HP) HP Imaging Device Functions 11.0 (HKLM\...\HP Imaging Device Functions) (Version: 11.0 - HP) HP Photosmart C4400 All-In-One Driver Software 11.0 Rel .3 (HKLM\...\{86732AE7-CB91-4f15-B091-FBA3D3926CD6}) (Version: 11.0 - HP) HP Photosmart Essential 3.0 (HKLM\...\HP Photosmart Essential) (Version: 3.0 - HP) HP Smart Web Printing (HKLM\...\HP Smart Web Printing) (Version: 4.0 - HP) HP Solution Center 11.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 11.0 - HP) HP Update (HKLM\...\{D063F201-FAC4-4D5C-B10B-615058ADE5A7}) (Version: 4.000.009.002 - Hewlett-Packard) HPPhotoSmartPhotobookWebPack1 (Version: 2.03.0000 - Hewlett-Packard) Hidden HPProductAssistant (Version: 110.0.180.000 - Hewlett-Packard) Hidden HPSSupply (Version: 110.0.180.000 - Hewlett-Packard) Hidden IHA_MessageCenter (HKLM\...\{BE2DDF55-4C42-44CC-A56E-C8E4A65CB2FF}) (Version: 1.6.0 - Verizon) Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: - ) Intel(R) PRO Network Connections 12.1.11.0 (HKLM\...\PROSetDX) (Version: - Intel) iTunes (HKLM\...\{F59A9E08-A6A4-4ACF-91F2-D0344956C30B}) (Version: 10.2.2.14 - Apple Inc.) Jasc Paint Shop Photo Album (HKLM\...\{CC000127-5E5D-4A1C-90CB-EEAAAC1E3AC0}) (Version: 4.0.4 - Jasc Software, Inc.) Jasc Paint Shop Pro 8 Dell Edition (HKLM\...\{81A34902-9D0B-4920-A25C-4CDC5D14B328}) (Version: 8.10.0000 - Jasc Software Inc) Java 8 Update 121 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F32180121F0}) (Version: 8.0.1210.13 - Oracle Corporation) Malwarebytes Anti-Malware version 2.1.4.1018 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.4.1018 - Malwarebytes Corporation) MarketResearch (Version: 110.0.180.000 - Hewlett-Packard) Hidden Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation) Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation) Microsoft Office PowerPoint Viewer 2007 (English) (HKLM\...\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation) Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.9.218.0 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation) Microsoft Works (HKLM\...\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}) (Version: 9.7.0621 - Microsoft Corporation) Mozilla Firefox 52.0.1 ESR (x86 en-US) (HKLM\...\Mozilla Firefox 52.0.1 ESR (x86 en-US)) (Version: 52.0.1 - Mozilla) Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 52.0.1.6284 - Mozilla) MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) Music, Photos & Videos Launcher (HKLM\...\{D7769185-9A7C-48D4-8874-5388743A1DE2}) (Version: 1.00.0000 - Dell Inc.) OCR Software by I.R.I.S. 11.0 (HKLM\...\HPOCR) (Version: 11.0 - HP) OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0 - Microsoft Corporation) Hidden PanoStandAlone (Version: 110.0.180.000 - Hewlett-Packard) Hidden PowerDVD (HKLM\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 7.0 - Dell) Product Documentation Launcher (HKLM\...\{89CEAE14-DD0F-448E-9554-15781EC9DB24}) (Version: 1.00.0000 - Dell Inc.) PS_AIO_03_C4400_ProductContext (Version: 110.0.201.000 - Hewlett-Packard) Hidden PS_AIO_03_C4400_Software (Version: 110.0.201.000 - Hewlett-Packard) Hidden PS_AIO_03_C4400_Software_Min (Version: 110.0.201.000 - Hewlett-Packard) Hidden PSSWCORE (Version: 2.03.0000 - Hewlett-Packard) Hidden QuickTime (HKLM\...\{57752979-A1C9-4C02-856B-FBB27AC4E02C}) (Version: 7.69.80.9 - Apple Inc.) Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: - ) RogueKiller version 11 (HKLM\...\8B3D7924-ED89-486B-8322-E8594065D5CB_is1) (Version: 11 - Adlice Software) Roxio Creator DE (HKLM\...\{09760D42-E223-42AD-8C3E-55B47D0DDAC3}) (Version: 10.1 - ) Scan (Version: 11.0.0.0 - Hewlett-Packard) Hidden Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 11.0 - HP) SmartWebPrinting (Version: 110.0.182.000 - Hewlett-Packard) Hidden SolutionCenter (Version: 110.0.180.000 - Hewlett-Packard) Hidden Status (Version: 110.0.180.000 - Hewlett-Packard) Hidden Toolbox (Version: 110.0.180.000 - Hewlett-Packard) Hidden TrayApp (Version: 110.0.180.000 - Hewlett-Packard) Hidden TurboTax 2008 (HKLM\...\TurboTax 2008) (Version: - ) TurboTax 2009 (HKLM\...\TurboTax 2009) (Version: - Intuit, Inc) TurboTax 2010 (HKLM\...\TurboTax 2010) (Version: - Intuit, Inc) TurboTax 2011 (HKLM\...\TurboTax 2011) (Version: - Intuit, Inc) TurboTax 2012 (HKLM\...\TurboTax 2012) (Version: 2012.0 - Intuit, Inc) TurboTax 2013 (HKLM\...\TurboTax 2013) (Version: 2013.0 - Intuit, Inc) TurboTax 2014 (HKLM\...\TurboTax 2014) (Version: 2014.0 - Intuit, Inc) TurboTax 2015 (HKLM\...\TurboTax 2015) (Version: 2015.0 - Intuit, Inc) Unchecky v1.0.2 (HKLM\...\Unchecky) (Version: 1.0.2 - RaMMicHaeL) UnloadSupport (Version: 11.0.0 - Hewlett-Packard) Hidden Verizon Broadband Toolbar (IE only) (HKLM\...\verizon_broad) (Version: - ) Verizon FiOS Activation (HKLM\...\Verizon FiOS Activation_is1) (Version: - Verizon) Verizon Online Help and Support (HKLM\...\Verizon Online Help and Support) (Version: - ) VideoToolkit01 (Version: 110.0.171.000 - Hewlett-Packard) Hidden VoiceOver Kit (HKLM\...\{7C5B4583-7CBF-4289-B195-03B553959DEA}) (Version: 1.40.128.0 - Apple Inc.) Vz In-Home Agent (HKLM\...\VzInHomeAgent) (Version: 9.0.93.0 - Verizon) Vz In-Home Agent (HKU\S-1-5-21-3402600103-2626558384-1099160823-1000\...\VzInHomeAgent) (Version: 9.0.35.0 - Verizon) WebReg (Version: 110.0.180.000 - Hewlett-Packard) Hidden WinPatrol (HKLM\...\{6A206A04-6BC1-411B-AA04-4E52EDEEADF2}) (Version: 33.6.2015.18 - Ruiware) Wrapper (HKLM\...\{394E7D98-28C7-4CD8-B503-7E43BC43A0F2}) (Version: 1.00.0000 - Verizon) ==================== Custom CLSID (Whitelisted): ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) CustomCLSID: HKU\S-1-5-21-3402600103-2626558384-1099160823-1000_Classes\CLSID\{4052D303-74C5-49EA-BC6B-66099C8D4007}\InprocServer32 -> C:\Program Files\Google\Google Desktop Search\GoogleDesktopAPI2.dll (Google) ==================== Scheduled Tasks (Whitelisted) ============= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) Task: {2D2DEC4F-74BB-4FB5-9626-21B3A60365F1} - System32\Tasks\Microsoft\Windows\PLA\System\ConvertLogEntries => Rundll32.exe %windir%\system32\pla.dll,PlaConvertLogEntries Task: {306A24F1-8341-48A3-97FC-BCD24FFAFEC5} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2016-03-03] (Adobe Systems Incorporated) Task: {399B879D-C421-41E5-A2CF-91B2F1EE6359} - System32\Tasks\Norton Identity Safe\Norton Error Processor => C:\Program Files\Norton Identity Safe\Engine\2014.7.6.15\SymErr.exe Task: {5861A001-E304-4F30-9EEB-390E514FC969} - System32\Tasks\Norton Identity Safe\Norton Error Analyzer => C:\Program Files\Norton Identity Safe\Engine\2014.7.6.15\SymErr.exe Task: {879C8518-1DFB-459A-919F-90D412B2FFA3} - System32\Tasks\{FC5ED9EE-72FB-4876-A615-3068B6E97D89} => pcalua.exe -a C:\Windows\system32\spool\drivers\w32x86\3\DLBCUN5C.EXE -c -dDell Photo Printer 720 Task: {89E6E377-087E-4321-BD9C-25D8DBA852FE} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {BADED546-1E1D-44BC-99DE-9C73BA0711C3} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-12-17] (Piriform Ltd) (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe ==================== Shortcuts ============================= (The entries could be listed to be restored or removed.) Shortcut: C:\Users\KLUCAS\Favorites\Verizon Links\About Verizon.lnk -> hxxp://wapp.verizon.net/bookmarks/bmredir.asp?region=all&bw=fiber&cd=7.0unattached&bm=ho_cor Shortcut: C:\Users\KLUCAS\Favorites\Verizon Links\Help.lnk -> hxxp://wapp.verizon.net/bookmarks/bmredir.asp?region=all&bw=fiber&cd=7.0unattached&bm=ho_hel Shortcut: C:\Users\KLUCAS\Favorites\Verizon Links\Safety & Security.lnk -> hxxp://wapp.verizon.net/bookmarks/bmredir.asp?region=all&bw=fiber&cd=7.0unattached&bm=wc_safet Shortcut: C:\Users\KLUCAS\Favorites\Verizon Links\Search.lnk -> hxxp://wapp.verizon.net/bookmarks/bmredir.asp?region=all&bw=fiber&cd=7.0unattached&bm=ho_allsearc Shortcut: C:\Users\KLUCAS\Favorites\Verizon Links\SuperPages.lnk -> hxxp://wapp.verizon.net/bookmarks/bmredir.asp?region=all&bw=fiber&cd=7.0unattached&bm=ho_superp Shortcut: C:\Users\KLUCAS\Favorites\Verizon Links\Switching Tips.lnk -> hxxp://wapp.verizon.net/bookmarks/bmredir.asp?region=all&bw=fiber&cd=7.0unattached&bm=ho_switc Shortcut: C:\Users\KLUCAS\Favorites\Verizon Links\Verizon Wireless.lnk -> hxxp://wapp.verizon.net/bookmarks/bmredir.asp?region=all&bw=fiber&cd=7.0unattached&bm=ho_vzwireles Shortcut: C:\Users\KLUCAS\Favorites\Verizon Links\Welcome Page.lnk -> hxxp://wapp.verizon.net/bookmarks/bmredir.asp?region=all&bw=fiber&cd=7.0unattached&bm=wc_welcom Shortcut: C:\Users\KLUCAS\Favorites\Verizon Central\Broadband Beat.lnk -> hxxp://wapp.verizon.net/bookmarks/bmredir.asp?region=all&bw=fiber&cd=7.0unattached&bm=ho_dslliv Shortcut: C:\Users\KLUCAS\Favorites\Verizon Central\E-Mail & More.lnk -> hxxp://wapp.verizon.net/bookmarks/bmredir.asp?region=all&bw=fiber&cd=7.0unattached&bm=ho_webmai Shortcut: C:\Users\KLUCAS\Favorites\Verizon Central\Help.lnk -> hxxp://wapp.verizon.net/bookmarks/bmredir.asp?region=all&bw=fiber&cd=7.0unattached&bm=ho_hel Shortcut: C:\Users\KLUCAS\Favorites\Verizon Central\My Account.lnk -> hxxp://wapp.verizon.net/bookmarks/bmredir.asp?region=all&bw=fiber&cd=7.0unattached&bm=ho_myacc Shortcut: C:\Users\KLUCAS\Favorites\Verizon Central\My Web Space.lnk -> hxxp://wapp.verizon.net/bookmarks/bmredir.asp?region=all&bw=fiber&cd=7.0unattached&bm=ho_mywebs Shortcut: C:\Users\KLUCAS\Favorites\Verizon Central\Shop Verizon.lnk -> hxxp://wapp.verizon.net/bookmarks/bmredir.asp?region=all&bw=fiber&cd=7.0unattached&bm=ho_shopv ShortcutWithArgument: C:\Users\KLUCAS\Desktop\Verizon Webmail.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://webmail.verizon.net ==================== Loaded Modules (Whitelisted) ============== 2016-03-02 17:31 - 2007-01-31 23:11 - 00102400 _____ () C:\Windows\system32\spool\PRTPROCS\W32X86\dlbcpp5c.dll 2009-03-25 19:43 - 2009-03-25 19:43 - 00755712 _____ () C:\Windows\assembly\GAC_32\System.Data.SQLite\1.0.56.0__28c9bcd4dddc48a1\System.Data.SQLite.dll 2009-03-25 19:43 - 2009-03-25 19:43 - 00471040 _____ () C:\Windows\assembly\GAC_MSIL\Intuit.Spc.Map.Reporter\4.0.114.0__7ce6deabcb36a8ea\Intuit.Spc.Map.Reporter.dll 2010-04-10 12:24 - 2010-04-10 12:24 - 00854016 _____ () C:\Windows\assembly\GAC_32\System.Data.SQLite\1.0.61.0__db937bc2d44ff139\System.Data.SQLite.dll 2010-04-10 12:24 - 2010-04-10 12:24 - 00471040 _____ () C:\Windows\assembly\GAC_MSIL\Intuit.Spc.Map.Reporter\5.0.104.0__7ce6deabcb36a8ea\Intuit.Spc.Map.Reporter.dll 2011-04-08 16:00 - 2011-04-08 16:00 - 00476520 _____ () C:\Windows\assembly\GAC_MSIL\Intuit.Spc.Map.Reporter\5.0.136.0__7ce6deabcb36a8ea\Intuit.Spc.Map.Reporter.dll ==================== Alternate Data Streams (Whitelisted) ========= (If an entry is included in the fixlist, only the ADS will be removed.) ==================== Safe Mode (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\GoToAssist => ""="Service" ==================== Association (Whitelisted) =============== (If an entry is included in the fixlist, the registry item will be restored to default or removed.) HKLM\...\.scr: CryptoPreventSCR => "C:\Program Files\Foolish IT\CryptoPrevent\CryptoPreventFilterMod.CryptoPreventEXEC" "%1" /S %* ==================== Internet Explorer trusted/restricted =============== (If an entry is included in the fixlist, it will be removed from the registry.) ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2006-11-02 06:23 - 2017-03-20 20:26 - 00001961 ____A C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 localhost 0.0.0.0 tracking.opencandy.com.s3.amazonaws.com 0.0.0.0 media.opencandy.com 0.0.0.0 cdn.opencandy.com 0.0.0.0 tracking.opencandy.com 0.0.0.0 api.opencandy.com 0.0.0.0 api.recommendedsw.com 0.0.0.0 installer.betterinstaller.com 0.0.0.0 installer.filebulldog.com 0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net 0.0.0.0 inno.bisrv.com 0.0.0.0 nsis.bisrv.com 0.0.0.0 cdn.file2desktop.com 0.0.0.0 cdn.goateastcach.us 0.0.0.0 cdn.guttastatdk.us 0.0.0.0 cdn.inskinmedia.com 0.0.0.0 cdn.insta.oibundles2.com 0.0.0.0 cdn.insta.playbryte.com 0.0.0.0 cdn.llogetfastcach.us 0.0.0.0 cdn.montiera.com 0.0.0.0 cdn.msdwnld.com 0.0.0.0 cdn.mypcbackup.com 0.0.0.0 cdn.ppdownload.com 0.0.0.0 cdn.riceateastcach.us 0.0.0.0 cdn.shyapotato.us 0.0.0.0 cdn.solimba.com 0.0.0.0 cdn.tuto4pc.com 0.0.0.0 cdn.appround.biz 0.0.0.0 cdn.bigspeedpro.com 0.0.0.0 cdn.bispd.com There are 5 more lines. ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-3402600103-2626558384-1099160823-1000\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\img17.jpg DNS Servers: 192.168.0.1 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 2) (ConsentPromptBehaviorUser: 1) (EnableLUA: 1) Windows Firewall is enabled. ==================== MSCONFIG/TASK MANAGER disabled items == MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3 MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk => C:\Windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" MSCONFIG\startupreg: dscactivate => "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" MSCONFIG\startupreg: Google Desktop Search => "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup MSCONFIG\startupreg: HotKeysCmds => C:\Windows\system32\hkcmd.exe MSCONFIG\startupreg: HP Software Update => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe MSCONFIG\startupreg: hpqSRMon => C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe MSCONFIG\startupreg: IgfxTray => C:\Windows\system32\igfxtray.exe MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe" MSCONFIG\startupreg: Malwarebytes Anti-Malware (cleanup) => "C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\mbamdor.exe" "C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware" MSCONFIG\startupreg: PDVDDXSrv => "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" MSCONFIG\startupreg: Persistence => C:\Windows\system32\igfxpers.exe MSCONFIG\startupreg: QuickTime Task => "C:\Program Files\QuickTime\QTTask.exe" -atboottime MSCONFIG\startupreg: RtHDVCpl => RtHDVCpl.exe MSCONFIG\startupreg: Sidebar => C:\Program Files\Windows Sidebar\sidebar.exe /autoRun MSCONFIG\startupreg: SmartAccess AutoStart => "C:\Program Files\Verizon\FIOS\smartaccess\FIOS.exe" /file:///C:/Program Files/Verizon/FIOS/sscommon/common/snapins/shell/ss_shell.htm "" MSCONFIG\startupreg: Verizon_McciTrayApp => C:\Program Files\Verizon\McciTrayApp.exe MSCONFIG\startupreg: Windows Defender => %ProgramFiles%\Windows Defender\MSASCui.exe -hide MSCONFIG\startupreg: WMPNSCFG => C:\Program Files\Windows Media Player\WMPNSCFG.exe ==================== FirewallRules (Whitelisted) =============== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) FirewallRules: [WinCollab-Out-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe FirewallRules: [WinCollab-In-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe FirewallRules: [WinCollab-Out-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe FirewallRules: [WinCollab-In-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe FirewallRules: [WinCollab-DFSR-Out-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe FirewallRules: [WinCollab-DFSR-In-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe FirewallRules: [{3D84C16D-7FD3-4BE6-B87F-7370926AB057}] => (Allow) C:\Program Files\CyberLink\PowerDVD DX\PowerDVD.exe FirewallRules: [{2301A351-6981-428F-ADBE-C37C389A5F9D}] => (Allow) C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe FirewallRules: [{46B64A67-CB28-4AB9-B064-F999909166EB}] => (Allow) C:\Windows\System32\dlbccoms.exe FirewallRules: [{97BE632D-5A18-426F-943F-C5CEA9287294}] => (Allow) C:\Windows\System32\dlbccoms.exe FirewallRules: [{20261853-16DC-4B69-B2F1-1491D840E007}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe FirewallRules: [{9B0B9E69-53AE-48CD-9F42-C550D788C253}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe FirewallRules: [{58423259-57A1-4D34-AD19-F96D21FA250A}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hposid01.exe FirewallRules: [{CF8691CD-7B55-4405-B78A-9BB3F633D286}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe FirewallRules: [{FC3F9A50-625A-4F77-BE19-C15C3AB51412}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe FirewallRules: [{B24A9505-C3B1-4687-B5D9-65B33D224E4F}] => (Allow) C:\Program Files\Common Files\HP\Digital Imaging\bin\hpqphotocrm.exe FirewallRules: [{5D075E2A-EDDE-4B88-89E6-70D48D787F87}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe FirewallRules: [{50EEDFD9-4498-425D-A924-35A3AC85B45A}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe FirewallRules: [{137944C8-7A6C-4515-9063-D705963A2BF3}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqcopy2.exe FirewallRules: [{EE222D04-81FD-48DF-80AF-8AEA35D23B99}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe FirewallRules: [{548B80A8-B1DA-4559-B8B7-5C203C8BF330}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe FirewallRules: [{330A141D-0A6C-48CC-BFAF-279C74A0F267}] => (Allow) C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe FirewallRules: [{0F3C0227-8DD1-45D0-A34C-FFE2AB2766FD}] => (Allow) LPort=80 FirewallRules: [{E0651634-7A86-4E1D-A6F8-324BB88D3C46}] => (Allow) LPort=80 FirewallRules: [{61FCFC9A-8A3F-423D-AF4F-ABD33D22C3C2}] => (Allow) LPort=80 FirewallRules: [{81A7253B-00C3-4DB7-AF67-1C4B00760CE6}] => (Allow) C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdater.exe FirewallRules: [{874BBD58-E781-45CD-B387-E1EBD385FBC7}] => (Allow) C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe FirewallRules: [{9E3E3E75-68F7-4895-8784-B5FF0AC278F6}] => (Allow) C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe FirewallRules: [{C3705DF5-98E0-44F1-ABA5-F63E3BF04EA9}] => (Allow) C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe FirewallRules: [{A4D1DC8E-D154-45B5-BBD6-D12DDC2221BC}] => (Allow) C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe FirewallRules: [{221EC99A-6E06-4EEB-8906-4B5BD1C7F5E8}] => (Allow) C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe FirewallRules: [{27E44BF8-5BA4-45AA-95F2-345886996943}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{2F3AAFD2-42C2-44BE-B837-26595738D174}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{8E0675B9-DD69-458C-80D5-582CB219BA51}] => (Allow) C:\Program Files\iTunes\iTunes.exe FirewallRules: [{F651ABA7-F1EE-4A05-BDF8-6DEF15EB99D0}] => (Allow) LPort=50000 FirewallRules: [{EAC200AA-1ED5-4C59-80DA-F168462554A3}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe FirewallRules: [{C6A05375-00D4-48A4-BEAA-3E249A1092CD}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe FirewallRules: [{23839F7F-D419-4B06-B335-D3F1413FAAA0}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe FirewallRules: [TCP Query User{C579178C-AC86-4808-9045-E2258B0CE8B3}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe FirewallRules: [UDP Query User{E7B48F29-810E-4C1F-9CCE-59DD503659BE}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe FirewallRules: [{CADE7EAA-B815-4F6C-BDAD-A488216E6B3A}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe FirewallRules: [{3FC0BF13-8789-489D-A474-67D7468F6560}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe FirewallRules: [{39322250-808E-4045-B023-2FA66250FD1B}] => (Allow) LPort=50000 FirewallRules: [{E223AED9-6BA1-4914-B33E-66639AE19A81}] => (Allow) C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdater.exe FirewallRules: [{B049BAFA-81F2-4D6E-B19D-6F1809A76A1B}] => (Allow) C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe FirewallRules: [{C042BDA6-A868-40F4-8A82-181D823D1EC7}] => (Allow) C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe FirewallRules: [{8B06766C-9C3C-4128-8BF7-A5A46732652A}] => (Allow) C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe FirewallRules: [{8E051C17-F324-421B-B20F-2E6ABCAD7992}] => (Allow) C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe FirewallRules: [{84DBE278-497B-4692-8CE0-8F446BA35418}] => (Allow) C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe ==================== Restore Points ========================= 30-04-2016 10:35:01 Windows Update 07-05-2016 09:56:08 Windows Update 27-05-2016 14:38:04 Windows Update 05-06-2016 12:18:00 Windows Update 16-06-2016 11:19:03 Windows Update 16-06-2016 14:21:07 Windows Update 28-06-2016 09:17:57 Windows Update 06-07-2016 10:01:46 Windows Update 18-07-2016 09:10:29 Windows Update 29-07-2016 09:50:36 Windows Update 16-08-2016 08:36:58 Windows Update 16-09-2016 09:36:13 Windows Update 27-09-2016 09:48:27 Windows Update 03-11-2016 10:07:58 Windows Update 17-11-2016 09:29:46 Windows Update 02-12-2016 10:59:10 Windows Update 19-12-2016 12:41:37 Windows Update 29-12-2016 11:06:42 Windows Update 05-01-2017 09:25:17 Windows Update 15-01-2017 12:07:17 Windows Update 03-02-2017 12:39:33 Windows Update 16-02-2017 09:17:53 Windows Update 03-03-2017 11:34:34 Windows Update 17-03-2017 10:48:50 Windows Update 20-03-2017 16:34:58 Removed TECHNICAL ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (03/20/2017 08:27:53 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected. Error: (03/20/2017 06:01:06 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected. Error: (03/20/2017 05:44:20 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected. Error: (03/20/2017 05:01:24 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected. Error: (03/20/2017 04:20:48 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected. Error: (03/17/2017 10:47:10 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected. Error: (03/03/2017 11:32:46 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected. Error: (02/24/2017 04:41:24 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected. Error: (02/16/2017 09:15:44 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected. Error: (02/03/2017 12:37:16 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected. System errors: ============= Error: (03/20/2017 08:28:03 PM) (Source: Service Control Manager) (EventID: 7022) (User: ) Description: The HP CUE DeviceDiscovery Service service hung on starting. Error: (03/20/2017 08:26:17 PM) (Source: Microsoft-Windows-TaskScheduler) (EventID: 412) (User: NT AUTHORITY) Description: Event-ID 412 Error: (03/20/2017 06:25:20 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: ) Description: Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.237.1420.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.13504.0 Error code: 0x8024001e Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support. Error: (03/20/2017 06:01:27 PM) (Source: Service Control Manager) (EventID: 7022) (User: ) Description: The HP CUE DeviceDiscovery Service service hung on starting. Error: (03/20/2017 05:59:29 PM) (Source: Microsoft-Windows-TaskScheduler) (EventID: 412) (User: NT AUTHORITY) Description: Event-ID 412 Error: (03/20/2017 05:58:23 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: ) Description: Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.237.1420.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.13504.0 Error code: 0x8024001e Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support. Error: (03/20/2017 05:44:36 PM) (Source: Service Control Manager) (EventID: 7022) (User: ) Description: The HP CUE DeviceDiscovery Service service hung on starting. Error: (03/20/2017 05:42:46 PM) (Source: Microsoft-Windows-TaskScheduler) (EventID: 412) (User: NT AUTHORITY) Description: Event-ID 412 Error: (03/20/2017 05:41:23 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: ) Description: Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.237.1420.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.13504.0 Error code: 0x8024001e Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support. Error: (03/20/2017 05:01:55 PM) (Source: Service Control Manager) (EventID: 7022) (User: ) Description: The HP CUE DeviceDiscovery Service service hung on starting. CodeIntegrity: =================================== Date: 2017-03-20 20:28:32.169 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system. Date: 2017-03-20 18:01:53.387 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system. Date: 2017-03-20 17:45:02.763 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system. Date: 2017-03-20 17:23:14.793 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system. Date: 2017-03-20 17:23:14.341 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system. Date: 2017-03-20 17:23:13.873 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system. Date: 2017-03-20 17:23:13.421 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system. Date: 2017-03-20 17:23:12.953 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system. Date: 2017-03-20 17:23:12.500 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system. Date: 2017-03-20 17:19:09.827 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system. ==================== Memory info =========================== Processor: Intel(R) Core(TM)2 Duo CPU E4600 @ 2.40GHz Percentage of memory in use: 72% Total physical RAM: 3316.27 MB Available physical RAM: 897.33 MB Total Virtual: 6872.55 MB Available Virtual: 4284 MB ==================== Drives ================================ Drive c: (OS) (Fixed) (Total:222.78 GB) (Free:152.17 GB) NTFS ==>[drive with boot components (obtained from BCD)] Drive d: (RECOVERY) (Fixed) (Total:10 GB) (Free:6.55 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 232.8 GB) (Disk ID: 38000000) Partition 1: (Not Active) - (Size=55 MB) - (Type=DE) Partition 2: (Not Active) - (Size=10 GB) - (Type=07 NTFS) Partition 3: (Active) - (Size=222.8 GB) - (Type=07 NTFS) ==================== End of Addition.txt ============================