need to fix

suzannewillis · February 4, 2015

Susanne, i did not ask for a Junkware Removal Scan log !!! That is the same log you ran near the begining of our fix !! You tend to not follow my instructions, i asked for the Frst Scan Script fix and the Eset Scan, logs !!!

so sorry I am having hard time following, thought I sent frst scan script fix and have been running the eset scan for over an hour and half now

suzannewillis · February 4, 2015

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-02-2015

Ran by Suzanne (administrator) on MYLAPTOP on 02-02-2015 14:21:02

Running from C:\Users\Suzanne\Downloads

Loaded Profiles: Suzanne (Available profiles: Suzanne & Administrator)

Platform: Windows 8.1 (X64) OS Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

() C:\Program Files\Hewlett-Packard\SimplePass\cachesrvr.exe

(Softex Inc.) C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe

(IBM Corp.) C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe

(AMD) C:\Windows\System32\atiesrxx.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

() C:\Program Files\ATI Technologies\ATI.ACE\a4\AdaptiveSleepService.exe

(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe

(Microsoft Corporation) C:\Windows\System32\dasHost.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(IBM Corp.) C:\Program Files (x86)\Trusteer\Rapport\bin\RapportService.exe

() C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe

(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\livecomm.exe

(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe

(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe

(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Flux Software LLC) C:\Users\Suzanne\AppData\Local\FluxSoftware\Flux\flux.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe

(Microsoft Corporation) C:\Windows\System32\WWAHost.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\SysWOW64\backgroundTaskHost.exe

(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17477_none_fa2b7d3b9b36c7b4\TiWorker.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [simplePass] => C:\Program Files\Hewlett-Packard\SimplePass\HPSmplPass.exe [2758200 2013-10-14] (Hewlett-Packard)

HKLM\...\Run: [OPBHOBroker] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe [155704 2013-10-14] (Hewlett-Packard)

HKLM\...\Run: [OPBHOBrokerDesktop] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe [155704 2013-10-14] (Hewlett-Packard)

HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7634288 2014-11-05] (Realtek Semiconductor)

HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1386712 2014-11-05] (Realtek Semiconductor)

HKLM\...\Run: [synTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2818800 2014-11-12] (Synaptics Incorporated)

HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [267224 2013-09-01] (CyberLink Corp.)

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3890208 2015-01-30] (AVAST Software)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2011-09-27] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2011-10-24] (Apple Inc.)

HKLM-x32\...\Run: [startCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767200 2014-04-17] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [HPMessageService] => C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe [509192 2014-10-09] (Hewlett-Packard Development Company, L.P.)

HKLM\...\RunOnce: [NCPluginUpdater] => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe [21720 2014-12-16] (Hewlett-Packard)

HKU\S-1-5-21-1036139224-3964361190-1435687704-1002\...\Run: [f.lux] => C:\Users\Suzanne\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2013-10-23] (Flux Software LLC)

HKU\S-1-5-21-1036139224-3964361190-1435687704-1002\...\MountPoints2: {51c56f1f-5f1f-11e4-8285-a01d480c7667} - "F:\VZW_Software_upgrade_assistant.exe"

HKU\S-1-5-21-1036139224-3964361190-1435687704-1002\...\MountPoints2: {a7709de9-d667-11e3-8265-a01d480c7667} - "F:\MotorolaDeviceManagerSetup.exe" -a

HKU\S-1-5-18\...\RunOnce: [spUninstallDeleteDir] => rmdir /s /q "\SearchProtect"

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT14/1

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT14/1

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT14/1

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT14/1

HKU\S-1-5-21-1036139224-3964361190-1435687704-1002\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/

HKU\S-1-5-21-1036139224-3964361190-1435687704-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT14/1

SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}

SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-21-1036139224-3964361190-1435687704-1002 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}

BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)

BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll No File

BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll No File

BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 67.215.21.202 72.21.70.3

FireFox:

========

FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll ()

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll ()

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1204144.dll (Adobe Systems, Inc.)

FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll No File

FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll No File

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll ()

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-05-01]

Chrome:

=======

CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}

CHR Profile: C:\Users\Suzanne\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Facebook Video Plugin) - C:\Users\Suzanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\akagdpdjofpfkeolfhccmfbahdeokpog [2014-08-17]

CHR Extension: (Google Drive) - C:\Users\Suzanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-21]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Suzanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-22]

CHR Extension: (YouTube) - C:\Users\Suzanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-21]

CHR Extension: (Google Search) - C:\Users\Suzanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-21]

CHR Extension: (Google Wallet) - C:\Users\Suzanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-21]

CHR Extension: (Gmail) - C:\Users\Suzanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-21]

CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-01-30]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdaptiveSleepService; C:\Program Files\ATI Technologies\ATI.ACE\A4\AdaptiveSleepService.exe [140288 2014-04-17] () [File not signed]

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2014-04-17] (Advanced Micro Devices, Inc.) [File not signed]

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-05-01] (AVAST Software)

R2 Cachedrv server; C:\Program Files\Hewlett-Packard\SimplePass\cachesrvr.exe [109568 2013-10-14] () [File not signed]

S2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-04-24] (WildTangent)

R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]

R2 HPWMISVC; c:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe [569608 2014-10-09] (Hewlett-Packard Development Company, L.P.)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)

R2 omniserv; C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe [87552 2013-10-14] (Softex Inc.) [File not signed]

R2 RapportMgmtService; C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe [1919256 2014-12-22] (IBM Corp.)

R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [290520 1999-12-31] (Realtek Semiconductor)

R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [191728 2014-11-12] (Synaptics Incorporated)

S3 w3logsvc; C:\Windows\system32\inetsrv\w3logsvc.dll [76800 2013-08-25] (Microsoft Corporation)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-21] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-21] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 AmdAS4; C:\Windows\System32\drivers\AmdAS4.sys [17640 2014-06-11] (Advanced Micro Devices, INC.)

S2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-05-01] ()

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-05-01] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-05-01] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-05-01] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2015-01-30] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2015-01-30] (AVAST Software)

R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2015-01-30] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-05-01] ()

R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [222720 2014-06-11] (Advanced Micro Devices)

R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink)

R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-02] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-11-21] (Malwarebytes Corporation)

R1 RapportCerberus_80120; C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus64_80120.sys [845464 2015-01-15] (IBM Corp.)

R1 RapportEI64; C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys [445816 2014-12-22] (IBM Corp.)

R0 RapportHades64; C:\Windows\System32\Drivers\RapportHades64.sys [290520 2014-12-22] (IBM Corp.)

R0 RapportKE64; C:\Windows\System32\Drivers\RapportKE64.sys [535576 2014-12-22] (IBM Corp.)

R1 RapportPG64; C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys [558872 2014-12-22] (IBM Corp.)

R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [294104 2014-11-05] (Realtek Semiconductor Corp.)

R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [3529944 2014-12-04] (Realtek Semiconductor Corporation )

S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [30448 2013-10-01] (Synaptics Incorporated)

S3 SmbDrvI; C:\Windows\System32\drivers\Smb_driver_Intel.sys [34544 2013-10-01] (Synaptics Incorporated)

S3 ssmirrdr; C:\Windows\system32\DRIVERS\ssmirrdr.sys [10112 2011-03-14] (support.com, Inc)

S3 SWDUMon; C:\Windows\system32\DRIVERS\SWDUMon.sys [16152 2015-01-26] ()

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-21] (Microsoft Corporation)

R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2013-07-22] (Hewlett-Packard Development Company, L.P.)

U3 McAPExe; No ImagePath

U3 McMPFSvc; No ImagePath

U3 McNaiAnn; No ImagePath

U3 mcpltsvc; No ImagePath

U3 mfecore; No ImagePath

S1 MpKsl1217d9f4; \??\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{2FCBC09C-7A87-4749-A296-7D4A3C03C57C}\MpKsl1217d9f4.sys [X]

U3 MSK80Service; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-02 14:21 - 2015-02-02 14:22 - 00019068 _____ () C:\Users\Suzanne\Downloads\FRST.txt

2015-02-02 14:20 - 2015-02-02 14:21 - 00000000 ____D () C:\FRST

2015-02-02 14:19 - 2015-02-02 14:19 - 02131456 _____ (Farbar) C:\Users\Suzanne\Downloads\FRST64.exe

2015-01-31 16:49 - 2015-01-31 16:49 - 00688992 _____ (Swearware) C:\Users\Suzanne\Downloads\dds.com

2015-01-31 16:48 - 2015-01-31 16:48 - 00688992 _____ (Swearware) C:\Users\Suzanne\Downloads\dds.scr

2015-01-31 14:11 - 2015-02-02 14:06 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys

2015-01-31 14:10 - 2015-01-31 14:10 - 00001125 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-01-31 14:10 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys

2015-01-31 14:10 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys

2015-01-31 14:10 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys

2015-01-31 14:08 - 2015-01-31 14:08 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Suzanne\Downloads\mbam-setup-2.0.4.1028.exe

2015-01-31 13:41 - 2015-01-31 13:41 - 00001117 _____ () C:\Users\Suzanne\Desktop\JRT.txt

2015-01-31 12:58 - 2015-01-31 12:58 - 01707939 _____ (Thisisu) C:\Users\Suzanne\Downloads\JRT (2).exe

2015-01-30 20:11 - 2015-01-30 20:11 - 01707939 _____ (Thisisu) C:\Users\Suzanne\Downloads\JRT (1).exe

2015-01-30 20:03 - 2015-01-30 20:04 - 02194432 _____ () C:\Users\Suzanne\Downloads\adwcleaner_4.109 (3).exe

2015-01-30 19:38 - 2015-01-30 19:38 - 02194432 _____ () C:\Users\Suzanne\Downloads\adwcleaner_4.109 (2).exe

2015-01-30 19:36 - 2015-01-30 19:36 - 00966191 _____ () C:\Users\Suzanne\Downloads\adwcleaner_4.109 (1).exe

2015-01-30 19:31 - 2015-01-30 19:32 - 02194432 _____ () C:\Users\Suzanne\Downloads\adwcleaner_4.109.exe

2015-01-29 20:21 - 2015-01-29 20:21 - 00102936 _____ () C:\Users\Suzanne\Downloads\needtofixpageNumber-MalwareRemoval-BestTechieForums.html

2015-01-29 11:15 - 2015-01-31 14:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-01-29 11:15 - 2015-01-31 14:10 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-01-29 11:15 - 2015-01-29 11:15 - 00000000 ____D () C:\ProgramData\Malwarebytes

2015-01-21 20:27 - 2015-01-31 13:57 - 00000358 _____ () C:\WINDOWS\Tasks\HPCeeScheduleForSuzanne.job

2015-01-21 20:27 - 2015-01-30 20:07 - 00003176 _____ () C:\WINDOWS\System32\Tasks\HPCeeScheduleForSuzanne

2015-01-13 18:26 - 2014-12-08 12:42 - 00535640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll

2015-01-13 18:26 - 2014-12-08 12:42 - 00531616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll

2015-01-13 18:26 - 2014-12-08 12:42 - 00448792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll

2015-01-13 18:26 - 2014-12-08 12:42 - 00413248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll

2015-01-13 18:26 - 2014-12-08 12:42 - 00372408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll

2015-01-13 18:26 - 2014-12-08 12:42 - 00108944 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll

2015-01-13 18:26 - 2014-12-08 12:42 - 00038264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe

2015-01-13 18:26 - 2014-12-08 12:42 - 00033584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe

2015-01-13 18:26 - 2014-12-05 18:35 - 00229888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll

2015-01-13 18:26 - 2014-10-28 21:00 - 00465320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe

2015-01-13 18:26 - 2014-10-28 21:00 - 00139984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe

2015-01-13 18:26 - 2014-10-28 20:52 - 00500016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll

2015-01-13 18:26 - 2014-10-28 20:52 - 00482872 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll

2015-01-13 18:26 - 2014-10-28 20:52 - 00394120 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll

2015-01-13 18:26 - 2014-10-28 20:52 - 00272248 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe

2015-01-13 18:26 - 2014-10-28 20:12 - 00413136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe

2015-01-13 18:26 - 2014-10-28 20:12 - 00136296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe

2015-01-13 18:26 - 2014-10-28 20:07 - 00424544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll

2015-01-13 18:26 - 2014-10-28 20:07 - 00370424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll

2015-01-13 18:26 - 2014-10-28 20:07 - 00344536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll

2015-01-13 18:26 - 2014-10-28 19:44 - 00037888 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll

2015-01-13 18:26 - 2014-10-28 18:59 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll

2015-01-13 18:26 - 2014-10-28 18:02 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll

2015-01-13 18:15 - 2014-12-18 23:26 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys

2015-01-13 18:15 - 2014-12-11 19:04 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWbPrxy.exe

2015-01-13 18:15 - 2014-12-11 17:51 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys

2015-01-13 18:15 - 2014-12-08 18:50 - 00225280 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll

2015-01-13 18:15 - 2014-12-05 20:17 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll

2015-01-13 18:15 - 2014-12-05 18:41 - 00391680 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll

2015-01-13 18:15 - 2014-10-28 18:24 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll

2015-01-13 18:15 - 2014-10-28 18:01 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nlaapi.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-02 14:15 - 2014-04-21 21:14 - 02045814 _____ () C:\WINDOWS\WindowsUpdate.log

2015-02-02 14:10 - 2014-04-21 21:16 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1036139224-3964361190-1435687704-1002

2015-02-02 14:06 - 2014-03-06 23:46 - 00000000 ___DO () C:\Users\Suzanne\SkyDrive

2015-02-02 14:05 - 2014-04-21 21:21 - 00000920 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

2015-02-02 14:04 - 2013-08-22 08:36 - 00000000 ____D () C:\WINDOWS\system32\sru

2015-01-31 23:39 - 2014-05-07 20:56 - 00000830 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job

2015-01-31 23:02 - 2014-04-21 21:21 - 00000924 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job

2015-01-31 14:02 - 2013-08-25 23:09 - 00956540 _____ () C:\WINDOWS\system32\PerfStringBackup.INI

2015-01-31 13:57 - 2014-10-05 19:45 - 00007104 _____ () C:\WINDOWS\setupact.log

2015-01-31 13:57 - 2013-08-22 07:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT

2015-01-31 13:56 - 2014-01-26 04:31 - 00065536 _____ () C:\WINDOWS\system32\spu_storage.bin

2015-01-31 13:56 - 2013-08-22 06:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI

2015-01-31 12:10 - 2013-08-22 08:36 - 00000000 ____D () C:\WINDOWS\AppReadiness

2015-01-30 19:58 - 2014-09-04 12:38 - 00022880 _____ () C:\WINDOWS\PFRO.log

2015-01-30 19:57 - 2014-05-02 14:54 - 00000000 ____D () C:\AdwCleaner

2015-01-30 19:38 - 2014-05-01 02:59 - 00001989 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk

2015-01-30 19:36 - 2014-05-01 02:56 - 01039096 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswsnx.sys

2015-01-30 19:36 - 2014-05-01 02:56 - 00423240 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswsp.sys

2015-01-30 19:36 - 2014-05-01 02:56 - 00085328 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswstm.sys

2015-01-30 19:35 - 2014-05-01 02:58 - 00003924 _____ () C:\WINDOWS\System32\Tasks\avast! Emergency Update

2015-01-30 19:24 - 2014-04-21 20:59 - 00000000 ____D () C:\Users\Suzanne

2015-01-30 19:16 - 2013-08-25 23:04 - 00000000 ____D () C:\Users\Administrator

2015-01-30 19:15 - 2013-08-22 08:36 - 00000000 ____D () C:\Program Files\Windows Defender

2015-01-30 19:15 - 2013-08-22 06:36 - 00000000 ____D () C:\WINDOWS\system32\Sysprep

2015-01-30 19:13 - 2014-11-12 12:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2015-01-30 19:13 - 2014-05-01 02:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast

2015-01-30 18:56 - 2013-08-22 08:36 - 00000000 ____D () C:\WINDOWS\registration

2015-01-30 18:49 - 2014-04-28 00:50 - 00000000 ____D () C:\Program Files (x86)\Java

2015-01-30 03:03 - 2013-08-22 06:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI(12)

2015-01-29 12:50 - 2014-04-28 00:51 - 00000000 ____D () C:\ProgramData\Oracle

2015-01-28 21:15 - 2014-05-21 19:06 - 00000000 _____ () C:\WINDOWS\system32\HP_ActiveX_Patch_NOT_DETECTED.txt

2015-01-28 18:00 - 2014-05-02 15:18 - 00000486 _____ () C:\WINDOWS\Tasks\SparkTrust Registration3.job

2015-01-27 13:28 - 2013-08-22 08:20 - 00000000 ____D () C:\WINDOWS\CbsTemp

2015-01-26 22:05 - 2014-07-16 14:49 - 00016152 _____ () C:\WINDOWS\system32\Drivers\SWDUMon.sys

2015-01-26 21:44 - 2013-08-22 06:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI(29)

2015-01-26 17:59 - 2014-04-21 21:23 - 00002210 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2015-01-24 19:40 - 2014-05-07 20:56 - 00003718 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater

2015-01-21 20:00 - 2014-09-10 19:02 - 00000052 _____ () C:\WINDOWS\SysWOW64\DOErrors.log

2015-01-19 14:32 - 2014-12-14 16:30 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe

2015-01-19 14:32 - 2014-12-14 16:30 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl

2015-01-15 15:26 - 2014-04-22 09:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trusteer Endpoint Protection

2015-01-15 12:15 - 2014-04-27 03:53 - 00000000 ____D () C:\WINDOWS\system32\MRT

2015-01-15 11:50 - 2014-04-27 03:53 - 113365784 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

2015-01-13 23:12 - 2014-12-01 12:40 - 00000000 ____D () C:\Users\Suzanne\AppData\Local\Adobe

2015-01-13 23:12 - 2014-04-21 21:08 - 00000000 ____D () C:\Users\Suzanne\AppData\Roaming\Adobe

2015-01-10 04:25 - 2014-05-02 15:17 - 00000667 _____ () C:\WINDOWS\Tasks\SparkTrust PC Cleaner Plus_sch_99C87281-D247-11E3-825F-A01D480C7667.job

==================== Files in the root of some directories =======

2014-08-17 03:25 - 2014-08-17 03:25 - 0000036 _____ () C:\Users\Suzanne\AppData\Local\housecall.guid.cache

Some content of TEMP:

====================

C:\Users\Suzanne\AppData\Local\Temp\Extract.exe

C:\Users\Suzanne\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe

C:\Users\Suzanne\AppData\Local\Temp\lihfqzkx.dll

C:\Users\Suzanne\AppData\Local\Temp\Quarantine.exe

C:\Users\Suzanne\AppData\Local\Temp\SP67263.exe

C:\Users\Suzanne\AppData\Local\Temp\SP67332.exe

C:\Users\Suzanne\AppData\Local\Temp\SP67338.exe

C:\Users\Suzanne\AppData\Local\Temp\SP67379.exe

C:\Users\Suzanne\AppData\Local\Temp\SP67385.exe

C:\Users\Suzanne\AppData\Local\Temp\SP68055.exe

C:\Users\Suzanne\AppData\Local\Temp\SP68197.exe

C:\Users\Suzanne\AppData\Local\Temp\SP68381.exe

C:\Users\Suzanne\AppData\Local\Temp\SP69229.exe

C:\Users\Suzanne\AppData\Local\Temp\sqlite3.dll

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed