Echambliss
New Member
I had read the numerous post regarding this problem and have tried all of the recommended steps to resolve it. I am starting a new thread with my farbar scan tool results in hope that someone will be able to assist me in resolving this issue. Here are the specs of the machine i am dealing with
HP desktop
Win 7 Home 64bit
Single partition.
Here are the results of my frst64 scan. Any assistance will be greatly appreciated.
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-03-2015 01
Ran by SYSTEM on MININT-8OGP7JF on 06-03-2015 10:31:48
Running from G:\
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 9
Boot Mode: Recovery
The current controlset is ControlSet003
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [hpsysdrv] => c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard)
HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-01] (Symantec Corporation)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-10-25] (Apple Inc.)
HKLM-x32\...\Run: [ISUSScheduler] => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [81920 2005-08-11] (Macrovision Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [VNT] => C:\Program Files (x86)\VNT\vntldr.exe [196048 2014-03-18] (APN LLC.)
HKLM-x32\...\Run: [QuickFinder Scheduler] => c:\Program Files (x86)\Corel\WordPerfect Office X4\Programs\QFSCHD140.EXE [83232 2008-03-21] (Corel Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-11-28] (Apple Inc.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM\...\RunOnce: [NCPluginUpdater] => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe [21720 2014-08-05] (Hewlett-Packard)
HKLM\...\RunOnce: [*WerKernelReporting] => C:\Windows\SYSTEM32\WerFault.exe [415232 2009-07-13] (Microsoft Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\Mom\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-11-20] (Google Inc.)
HKU\Mom\...\Run: [ISUSPM Startup] => "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
HKU\Mom\...\Run: [ComcastAntispyClient] => "C:\Program Files (x86)\comcasttb\ComcastSpywareScan\ComcastAntispy.exe" /hide
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S4 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2014-03-18] ()
S2 MCLIENT; C:\Program Files (x86)\Norton Management\Engine\3.2.2.12\ccSvcHst.exe [143928 2012-12-04] (Symantec Corporation)
S2 N360; C:\Program Files (x86)\Norton Security Suite\Engine\21.5.0.19\N360.exe [265040 2014-08-01] (Symantec Corporation)
S2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)
S2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1127448 2011-02-01] (PDF Complete Inc)
S2 RaMediaServer; C:\Program Files (x86)\Ralink\Common\RaMediaServer.exe [1859584 2012-07-04] (Ralink)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-13] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S1 AntiLog32; C:\Windows\system32\drivers\AntiLog64.sys [49752 2014-07-15] (Zemana Ltd.)
S1 BHDrvx64; C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\BASHDefs\20140801.001\BHDrvx64.sys [1530160 2014-05-09] (Symantec Corporation)
S1 ccSet_MCLIENT; C:\Windows\system32\drivers\MCLIENTx64\0302020.00C\ccSetx64.sys [168096 2012-10-03] (Symantec Corporation)
S1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1505000.013\ccSetx64.sys [162392 2013-09-25] (Symantec Corporation)
S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [486192 2014-06-11] (Symantec Corporation)
S3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142128 2014-06-11] (Symantec Corporation)
S1 IDSVia64; C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\IPSDefs\20140818.003\IDSvia64.sys [525016 2014-08-15] (Symantec Corporation)
S3 SRTSP; C:\Windows\System32\Drivers\N360x64\1505000.013\SRTSP64.SYS [875736 2014-07-22] (Symantec Corporation)
S1 SRTSPX; C:\Windows\system32\drivers\N360x64\1505000.013\SRTSPX64.SYS [36952 2013-09-09] (Symantec Corporation)
S0 SymDS; C:\Windows\System32\drivers\N360x64\1505000.013\SYMDS64.SYS [493656 2013-09-09] (Symantec Corporation)
S0 SymEFA; C:\Windows\System32\drivers\N360x64\1505000.013\SYMEFA64.SYS [1148120 2014-07-22] (Symantec Corporation)
S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-01-24] (Symantec Corporation)
S1 SymIRON; C:\Windows\system32\drivers\N360x64\1505000.013\Ironx64.SYS [264280 2013-09-26] (Symantec Corporation)
S1 SymNetS; C:\Windows\System32\Drivers\N360x64\1505000.013\SYMNETS.SYS [593112 2014-07-22] (Symantec Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-03-06 09:27 - 2015-03-06 10:31 - 00000000 ____D () C:\FRST
2015-02-06 09:22 - 2015-02-24 11:08 - 00000000 ____D () C:\Windows\Minidump
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-03-06 10:28 - 2011-04-26 22:59 - 00000000 ____D () C:\ProgramData\PDFC
2015-03-06 09:24 - 2011-10-23 11:25 - 00000000 ____D () C:\ProgramData\Recovery
2015-02-24 11:08 - 2011-04-26 23:06 - 00320261 ____N () C:\Windows\Minidump\022415-24882-01.dmp
2015-02-06 09:22 - 2011-04-26 23:06 - 00321925 ____N () C:\Windows\Minidump\020615-19562-01.dmp
2015-02-05 13:20 - 2014-08-18 17:50 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Security Suite
2015-02-05 13:20 - 2014-01-24 10:20 - 00000000 ____D () C:\Windows\System32\Drivers\N360x64
2015-02-05 13:20 - 2014-01-24 09:56 - 00000000 ____D () C:\Windows\SysWOW64\ZALSDK_uninst
2015-02-05 13:20 - 2014-01-24 09:55 - 00000000 ____D () C:\Program Files (x86)\Constant Guard Protection Suite
2015-02-05 13:20 - 2013-08-29 08:33 - 00000000 ____D () C:\Users\Mom\AppData\Local\Microsoft Help
2015-02-05 13:20 - 2012-09-29 17:10 - 00000000 ____D () C:\Windows\System32\Macromed
2015-02-05 13:20 - 2011-07-24 20:08 - 00000000 ____D () C:\users\Mom
2015-02-05 13:20 - 2011-04-26 23:02 - 00000000 ____D () C:\ProgramData\Norton
2015-02-05 13:20 - 2011-04-26 22:58 - 00000000 ____D () C:\Windows\SysWOW64\Macromed
2015-02-05 13:20 - 2011-04-26 22:52 - 00000000 ____D () C:\ProgramData\RoxioNow
2015-02-05 13:20 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\registration
2015-02-05 13:20 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\AppCompat
2015-02-05 13:19 - 2012-11-20 14:04 - 00000000 ____D () C:\Program Files (x86)\Google
2015-02-05 13:19 - 2011-07-28 15:25 - 00000000 ____D () C:\Users\Mom\AppData\Roaming\SoftGrid Client
2015-02-05 13:18 - 2011-07-28 15:30 - 00000000 __RHD () C:\MSOCache
2015-02-05 10:18 - 2014-01-24 09:56 - 00000000 ____D () C:\Users\Mom\AppData\Roaming\ID Vault
==================== Known DLLs (Whitelisted) ================
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== Restore Points =========================
==================== Memory info ===========================
Percentage of memory in use: 15%
Total physical RAM: 6050.53 MB
Available physical RAM: 5142.23 MB
Total Pagefile: 6048.73 MB
Available Pagefile: 5114.73 MB
Total Virtual: 8192 MB
Available Virtual: 8191.9 MB
==================== Drives ================================
Drive c: (OS) (Fixed) (Total:687.5 GB) (Free:619.7 GB) NTFS
Drive e: (HP_RECOVERY) (Fixed) (Total:11.04 GB) (Free:1.35 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive g: (KINGSTON) (Removable) (Total:29.06 GB) (Free:10.77 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.06 GB) (Free:0.06 GB) NTFS
Drive y: (SYSTEM) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 698.6 GB) (Disk ID: 883F1B4B)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=687.5 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=11 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 29.1 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=29.1 GB) - (Type=0C)
LastRegBack: 2014-08-28 10:52
==================== End Of Log ============================
HP desktop
Win 7 Home 64bit
Single partition.
Here are the results of my frst64 scan. Any assistance will be greatly appreciated.
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-03-2015 01
Ran by SYSTEM on MININT-8OGP7JF on 06-03-2015 10:31:48
Running from G:\
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 9
Boot Mode: Recovery
The current controlset is ControlSet003
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [hpsysdrv] => c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard)
HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-01] (Symantec Corporation)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-10-25] (Apple Inc.)
HKLM-x32\...\Run: [ISUSScheduler] => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [81920 2005-08-11] (Macrovision Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [VNT] => C:\Program Files (x86)\VNT\vntldr.exe [196048 2014-03-18] (APN LLC.)
HKLM-x32\...\Run: [QuickFinder Scheduler] => c:\Program Files (x86)\Corel\WordPerfect Office X4\Programs\QFSCHD140.EXE [83232 2008-03-21] (Corel Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-11-28] (Apple Inc.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM\...\RunOnce: [NCPluginUpdater] => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe [21720 2014-08-05] (Hewlett-Packard)
HKLM\...\RunOnce: [*WerKernelReporting] => C:\Windows\SYSTEM32\WerFault.exe [415232 2009-07-13] (Microsoft Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\Mom\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-11-20] (Google Inc.)
HKU\Mom\...\Run: [ISUSPM Startup] => "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
HKU\Mom\...\Run: [ComcastAntispyClient] => "C:\Program Files (x86)\comcasttb\ComcastSpywareScan\ComcastAntispy.exe" /hide
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S4 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2014-03-18] ()
S2 MCLIENT; C:\Program Files (x86)\Norton Management\Engine\3.2.2.12\ccSvcHst.exe [143928 2012-12-04] (Symantec Corporation)
S2 N360; C:\Program Files (x86)\Norton Security Suite\Engine\21.5.0.19\N360.exe [265040 2014-08-01] (Symantec Corporation)
S2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)
S2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1127448 2011-02-01] (PDF Complete Inc)
S2 RaMediaServer; C:\Program Files (x86)\Ralink\Common\RaMediaServer.exe [1859584 2012-07-04] (Ralink)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-13] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S1 AntiLog32; C:\Windows\system32\drivers\AntiLog64.sys [49752 2014-07-15] (Zemana Ltd.)
S1 BHDrvx64; C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\BASHDefs\20140801.001\BHDrvx64.sys [1530160 2014-05-09] (Symantec Corporation)
S1 ccSet_MCLIENT; C:\Windows\system32\drivers\MCLIENTx64\0302020.00C\ccSetx64.sys [168096 2012-10-03] (Symantec Corporation)
S1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1505000.013\ccSetx64.sys [162392 2013-09-25] (Symantec Corporation)
S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [486192 2014-06-11] (Symantec Corporation)
S3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142128 2014-06-11] (Symantec Corporation)
S1 IDSVia64; C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\IPSDefs\20140818.003\IDSvia64.sys [525016 2014-08-15] (Symantec Corporation)
S3 SRTSP; C:\Windows\System32\Drivers\N360x64\1505000.013\SRTSP64.SYS [875736 2014-07-22] (Symantec Corporation)
S1 SRTSPX; C:\Windows\system32\drivers\N360x64\1505000.013\SRTSPX64.SYS [36952 2013-09-09] (Symantec Corporation)
S0 SymDS; C:\Windows\System32\drivers\N360x64\1505000.013\SYMDS64.SYS [493656 2013-09-09] (Symantec Corporation)
S0 SymEFA; C:\Windows\System32\drivers\N360x64\1505000.013\SYMEFA64.SYS [1148120 2014-07-22] (Symantec Corporation)
S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-01-24] (Symantec Corporation)
S1 SymIRON; C:\Windows\system32\drivers\N360x64\1505000.013\Ironx64.SYS [264280 2013-09-26] (Symantec Corporation)
S1 SymNetS; C:\Windows\System32\Drivers\N360x64\1505000.013\SYMNETS.SYS [593112 2014-07-22] (Symantec Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-03-06 09:27 - 2015-03-06 10:31 - 00000000 ____D () C:\FRST
2015-02-06 09:22 - 2015-02-24 11:08 - 00000000 ____D () C:\Windows\Minidump
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-03-06 10:28 - 2011-04-26 22:59 - 00000000 ____D () C:\ProgramData\PDFC
2015-03-06 09:24 - 2011-10-23 11:25 - 00000000 ____D () C:\ProgramData\Recovery
2015-02-24 11:08 - 2011-04-26 23:06 - 00320261 ____N () C:\Windows\Minidump\022415-24882-01.dmp
2015-02-06 09:22 - 2011-04-26 23:06 - 00321925 ____N () C:\Windows\Minidump\020615-19562-01.dmp
2015-02-05 13:20 - 2014-08-18 17:50 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Security Suite
2015-02-05 13:20 - 2014-01-24 10:20 - 00000000 ____D () C:\Windows\System32\Drivers\N360x64
2015-02-05 13:20 - 2014-01-24 09:56 - 00000000 ____D () C:\Windows\SysWOW64\ZALSDK_uninst
2015-02-05 13:20 - 2014-01-24 09:55 - 00000000 ____D () C:\Program Files (x86)\Constant Guard Protection Suite
2015-02-05 13:20 - 2013-08-29 08:33 - 00000000 ____D () C:\Users\Mom\AppData\Local\Microsoft Help
2015-02-05 13:20 - 2012-09-29 17:10 - 00000000 ____D () C:\Windows\System32\Macromed
2015-02-05 13:20 - 2011-07-24 20:08 - 00000000 ____D () C:\users\Mom
2015-02-05 13:20 - 2011-04-26 23:02 - 00000000 ____D () C:\ProgramData\Norton
2015-02-05 13:20 - 2011-04-26 22:58 - 00000000 ____D () C:\Windows\SysWOW64\Macromed
2015-02-05 13:20 - 2011-04-26 22:52 - 00000000 ____D () C:\ProgramData\RoxioNow
2015-02-05 13:20 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\registration
2015-02-05 13:20 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\AppCompat
2015-02-05 13:19 - 2012-11-20 14:04 - 00000000 ____D () C:\Program Files (x86)\Google
2015-02-05 13:19 - 2011-07-28 15:25 - 00000000 ____D () C:\Users\Mom\AppData\Roaming\SoftGrid Client
2015-02-05 13:18 - 2011-07-28 15:30 - 00000000 __RHD () C:\MSOCache
2015-02-05 10:18 - 2014-01-24 09:56 - 00000000 ____D () C:\Users\Mom\AppData\Roaming\ID Vault
==================== Known DLLs (Whitelisted) ================
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== Restore Points =========================
==================== Memory info ===========================
Percentage of memory in use: 15%
Total physical RAM: 6050.53 MB
Available physical RAM: 5142.23 MB
Total Pagefile: 6048.73 MB
Available Pagefile: 5114.73 MB
Total Virtual: 8192 MB
Available Virtual: 8191.9 MB
==================== Drives ================================
Drive c: (OS) (Fixed) (Total:687.5 GB) (Free:619.7 GB) NTFS
Drive e: (HP_RECOVERY) (Fixed) (Total:11.04 GB) (Free:1.35 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive g: (KINGSTON) (Removable) (Total:29.06 GB) (Free:10.77 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.06 GB) (Free:0.06 GB) NTFS
Drive y: (SYSTEM) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 698.6 GB) (Disk ID: 883F1B4B)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=687.5 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=11 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 29.1 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=29.1 GB) - (Type=0C)
LastRegBack: 2014-08-28 10:52
==================== End Of Log ============================