Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-01-2017 Ran by Avery (03-02-2017 14:47:23) Running from C:\Users\Avery\Downloads Windows 10 Home Version 1607 (X64) (2016-12-28 01:40:04) Boot Mode: Normal ========================================================== ==================== Accounts: ============================= Administrator (S-1-5-21-1265099400-3855610176-2687105521-500 - Administrator - Disabled) Avery (S-1-5-21-1265099400-3855610176-2687105521-1001 - Administrator - Enabled) => C:\Users\Avery DefaultAccount (S-1-5-21-1265099400-3855610176-2687105521-503 - Limited - Disabled) defaultuser0 (S-1-5-21-1265099400-3855610176-2687105521-1000 - Limited - Disabled) => C:\Users\defaultuser0 Guest (S-1-5-21-1265099400-3855610176-2687105521-501 - Limited - Disabled) ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) 12 Labours of Hercules III: Girl Power (x32 Version: 3.0.2.118 - WildTangent) Hidden 7-Zip 16.04 (x64) (HKLM\...\7-Zip) (Version: 16.04 - Igor Pavlov) Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.7.157 - Adobe Systems, Inc.) AirDroid 3.4.0.1 (HKLM-x32\...\AirDroid) (Version: 3.4.0.1 - Sand Studio) Avast SecureLine (HKLM\...\{2CD3C92F-EDC5-4B02-9B0A-9C1D37C58EF5}_is1) (Version: 1.0.239.2 - AVAST Software) Azkend 2: The World Beneath (x32 Version: 2.2.0.98 - WildTangent) Hidden Barn Yarn Collector's Edition (x32 Version: 3.0.2.48 - WildTangent) Hidden Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.) Borderlands Game Of The Year Edition version 1.0.0.0 (HKLM-x32\...\Borderlands Game Of The Year Edition_is1) (Version: 1.0.0.0 - Mr DJ) Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.) Cisco LEAP Module (HKLM-x32\...\{AF312B06-5C5C-468E-89B3-BE6DE2645722}) (Version: 1.0.19 - Cisco Systems, Inc.) Cisco PEAP Module (HKLM-x32\...\{0A4EF0E6-A912-4CDE-A7F3-6E56E7C13A2F}) (Version: 1.1.6 - Cisco Systems, Inc.) Coyote The Outlander (x32 Version: 3.0.2.59 - WildTangent) Hidden CyberLink PhotoDirector (HKLM-x32\...\InstallShield_{5A454EC5-217A-42a5-8CE1-2DDEC4E70E01}) (Version: 5.0.5.6713 - CyberLink Corp.) CyberLink PhotoDirector (Version: 5.0.5.6713 - CyberLink Corp.) Hidden CyberLink Power Media Player 14 (HKLM-x32\...\{32C8E300-BDB4-4398-92C2-E9B7D8A233DB}) (Version: 14.0.1.5418 - CyberLink Corp.) CyberLink PowerDirector 12 (HKLM-x32\...\InstallShield_{E1646825-D391-42A0-93AA-27FA810DA093}) (Version: 12.0.4.4301 - CyberLink Corp.) CyberLink PowerDirector 12 (Version: 12.0.4.4301 - CyberLink Corp.) Hidden CyberLink YouCam (HKLM-x32\...\{A9CEDD6E-4792-493e-BB35-D86D2E188A5A}) (Version: 6.0.1.4301 - CyberLink Corp.) Delicious: Emily's Wonder Wedding Premium Edition (x32 Version: 3.0.2.59 - WildTangent) Hidden DisableMSDefender (Version: 1.0.0 - Hewlett-Packard Company) Hidden Discord (HKU\S-1-5-21-1265099400-3855610176-2687105521-1001\...\Discord) (Version: 0.0.296 - Hammer & Chisel, Inc.) Dropbox 25 GB (HKLM-x32\...\{597A58EC-42D6-4940-8739-FB94491B013C}) (Version: 1.0.8.2 - Dropbox, Inc.) Energy Star (HKLM\...\{465CA2B6-98AF-4E77-BE22-A908C34BB9EC}) (Version: 1.0.9 - Hewlett-Packard Company) Entwined: The Perfect Murder (x32 Version: 3.0.2.59 - WildTangent) Hidden Evernote v. 5.8.6 (HKLM-x32\...\{FEDC7C10-EF67-11E4-9B07-00505695D7B0}) (Version: 5.8.6.7519 - Evernote Corp.) Family Vacation 2: Road Trip (x32 Version: 3.0.2.59 - WildTangent) Hidden Google Chrome (HKLM-x32\...\Google Chrome) (Version: 55.0.2883.87 - Google Inc.) Google Update Helper (x32 Version: 1.3.32.7 - Google Inc.) Hidden Home Makeover (x32 Version: 3.0.2.59 - WildTangent) Hidden HP Documentation (HKLM\...\HP_Documentation) (Version: - HP) HP Registration Service (HKLM\...\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.8293.5264 - Hewlett-Packard) HP Support Assistant (HKLM-x32\...\{61EB474B-67A6-47F4-B1B7-386851BAB3D0}) (Version: 8.0.29.6 - Hewlett-Packard Company) HP Support Solutions Framework (HKLM-x32\...\{D7D5F438-26EF-45AB-AB89-C476FBCF8584}) (Version: 12.5.32.203 - Hewlett-Packard Company) HP System Event Utility (HKLM-x32\...\{D17A3B70-B75E-4C49-83D6-C17DDF65B35F}) (Version: 1.3.4 - Hewlett-Packard Company) HP Welcome (HKLM\...\HPWelcome) (Version: 1.0 - Hewlett-Packard Company) HP Wireless Button Driver (HKLM-x32\...\{EFA01423-3857-468C-B7B6-F30AA08E50BC}) (Version: 1.1.5.1 - Hewlett-Packard) IGT Slots: Paradise Garden (x32 Version: 3.0.2.59 - WildTangent) Hidden Imperial Island: Birth of an Empire (x32 Version: 3.0.2.59 - WildTangent) Hidden Intel(R) Chipset Device Software (x32 Version: 10.1.1.7 - Intel(R) Corporation) Hidden Intel(R) Dynamic Platform and Thermal Framework (HKLM-x32\...\{654EE65D-FAA4-4EA6-8C07-DC94E6A304D4}) (Version: 8.1.10603.192 - Intel Corporation) Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.0.0.1156 - Intel Corporation) Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.4549 - Intel Corporation) Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 14.5.2.1088 - Intel Corporation) Jewel Match Snowscapes (x32 Version: 3.0.2.118 - WildTangent) Hidden join.me (HKU\S-1-5-21-1265099400-3855610176-2687105521-1001\...\JoinMe) (Version: 3.0.0.4054 - LogMeIn, Inc.) Lightshot-5.4.0.1 (HKLM-x32\...\{30A5B3C9-2084-4063-A32A-628A98DE512B}_is1) (Version: 5.4.0.1 - Skillbrains) Living Legends: Frozen Beauty Collector's Edition (x32 Version: 3.0.2.59 - WildTangent) Hidden Lost Lands: Dark Overlord Collector's Edition (x32 Version: 3.0.2.59 - WildTangent) Hidden Lost Souls: Timeless Fables Collector's Edition (x32 Version: 3.0.2.59 - WildTangent) Hidden Magic Heroes: Save Our Park (x32 Version: 3.0.2.59 - WildTangent) Hidden Manor Memoirs Collector's Edition (x32 Version: 3.0.2.59 - WildTangent) Hidden Microsoft OneDrive (HKU\S-1-5-21-1265099400-3855610176-2687105521-1001\...\OneDriveSetup.exe) (Version: 17.3.6743.1212 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 Redistributable - x86 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23918 (HKLM-x32\...\{dab68466-3a7d-41a8-a5cf-415e3ff8ef71}) (Version: 14.0.23918.0 - Microsoft Corporation) Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation) Mystery Expedition: Prisoners of Ice (x32 Version: 3.0.2.59 - WildTangent) Hidden NVIDIA PhysX (HKLM-x32\...\{DA909E62-3B45-4BA1-8B58-FCAEBA4BCEC9}) (Version: 9.12.0213 - NVIDIA Corporation) Plagiarii (x32 Version: 3.0.2.59 - WildTangent) Hidden Polar Bowler 1st Frame (x32 Version: 3.0.2.59 - WildTangent) Hidden Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.9600.31213 - Realtek Semiconductor Corp.) Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.1.505.2015 - Realtek) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7944 - Realtek Semiconductor Corp.) REALTEK Wireless LAN Driver (HKLM-x32\...\{A5107464-AA9B-4177-8129-5FF2F42DD322}) (Version: 1.0.0.60 - REALTEK Semiconductor Corp.) Runefall (x32 Version: 3.0.2.126 - WildTangent) Hidden RuneScape Launcher 2.2.2 (HKLM\...\RuneScape Launcher_is1) (Version: 2.2.2 - Jagex Ltd) Rush Hour! Gas Station (x32 Version: 3.0.2.59 - WildTangent) Hidden Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.16084.2 - Samsung Electronics Co., Ltd.) Samsung Kies3 (x32 Version: 3.2.16084.2 - Samsung Electronics Co., Ltd.) Hidden Samsung USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.61.0 - Samsung Electronics Co., Ltd.) Sky High Farm (x32 Version: 3.0.2.59 - WildTangent) Hidden Skype™ 7.30 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.30.105 - Skype Technologies S.A.) Speccy (HKLM\...\Speccy) (Version: 1.30 - Piriform) Stardew Valley (HKLM-x32\...\1453375253_is1) (Version: 2.8.0.10 - GOG.com) swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 19.2.4.10 - Synaptics Incorporated) Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.4 - VideoLAN) WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent) WildTangent Games App for HP (x32 Version: 4.0.11.16 - WildTangent) Hidden WPS Office (9.1.0.5113) (HKLM-x32\...\Kingsoft Office) (Version: 9.1.0.5113 - Kingsoft Corp.) ==================== Custom CLSID (Whitelisted): ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== Scheduled Tasks (Whitelisted) ============= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) Task: {0855FCD3-16EC-4EB8-912A-C05B6EFCBF72} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-12-27] (Google Inc.) Task: {14869988-B8F9-42C2-90FB-3149D77CD5CB} - \Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater -> No File <==== ATTENTION Task: {3771E12C-4A9B-404D-BADB-F045D94C9CDF} - \DropboxOEM -> No File <==== ATTENTION Task: {40F2F8FA-6867-46CF-9458-86CF28206448} - \WpsNotifyTask_Administrator -> No File <==== ATTENTION Task: {5845985F-B590-4C93-AD65-810C98B545ED} - \avast! SL Update -> No File <==== ATTENTION Task: {59313051-D0D1-4D30-94C0-BC7C0F6AB49F} - \Hewlett-Packard\HP Support Assistant\First Boot -> No File <==== ATTENTION Task: {838E24D9-EC4F-4F64-939C-5C613C47D569} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation) Task: {8AAAF870-2B37-4C32-A243-A36D97C25F15} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-12-27] (Google Inc.) Task: {92AFF815-10F6-428F-8511-81A338CD4D0D} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation) Task: {972CD0C2-49AF-40DB-A43E-B89D3D93146D} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation) Task: {9958D229-13FA-4777-B12C-B80D45D1CE67} - \YCMServiceAgent -> No File <==== ATTENTION Task: {A072405F-9070-4697-8680-1514FCD711D5} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\Program Files\Windows Defender\\MpCmdRun.exe [2016-07-16] (Microsoft Corporation) Task: {A89CFCA8-A87A-4D17-A65E-9D21B882A25B} - \WpsUpdateTask_Administrator -> No File <==== ATTENTION Task: {C688AE1F-2EEC-498A-B6A2-5A245CBBE476} - \Avast SecureLine -> No File <==== ATTENTION Task: {E1297181-F1BD-473D-AF8A-14A48DA12411} - \Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start -> No File <==== ATTENTION Task: {E6010D43-6AE7-4B59-8E67-EC78FD8E8E96} - \Microsoft\Windows\NetCfg\BindingWorkItemQueueHandler -> No File <==== ATTENTION (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) Task: C:\WINDOWS\Tasks\WpsNotifyTask_Administrator.job => C:\Program Files (x86)\Kingsoft\WPS Office\9.1.0.5113\wtoolex\wpsnotify.exe Task: C:\WINDOWS\Tasks\WpsUpdateTask_Administrator.job => C:\Program Files (x86)\Kingsoft\WPS Office\9.1.0.5113\wtoolex\wpsupdate.exe ==================== Shortcuts ============================= (The entries could be listed to be restored or removed.) ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Priceline.com.lnk -> C:\Program Files (x86)\Hewlett-Packard\Shared\WizLink.exe () -> hxxp://www.priceline.com/?refid=PLHBC6240OPQ&refclickid=square ==================== Loaded Modules (Whitelisted) ============== 2016-07-16 05:42 - 2016-07-16 05:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll 2016-12-18 04:06 - 2016-12-09 04:29 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll 2015-11-05 10:54 - 2014-04-14 20:59 - 00389896 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe 2016-12-27 19:49 - 2016-12-27 19:53 - 00592392 _____ () C:\Program Files\AVAST Software\SecureLine\VpnSvc.exe 2016-12-18 04:06 - 2016-12-09 04:29 - 02681200 _____ () C:\WINDOWS\System32\CoreUIComponents.dll 2016-12-18 04:06 - 2016-12-09 04:29 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll 2017-01-24 13:55 - 2017-01-24 13:55 - 00072192 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.10.152.0_x64__kzf8qxf38zg5c\SkypeHost.exe 2017-01-24 13:55 - 2017-01-24 13:55 - 00179712 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.10.152.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll 2017-01-24 13:55 - 2017-01-24 13:56 - 42130432 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.10.152.0_x64__kzf8qxf38zg5c\SkyWrap.dll 2016-12-29 01:15 - 2016-12-29 01:15 - 02216448 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.10.152.0_x64__kzf8qxf38zg5c\roottools.dll 2017-01-10 20:42 - 2016-12-21 00:48 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll 2016-09-18 20:55 - 2016-09-06 22:56 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll 2017-01-10 20:44 - 2016-12-21 01:09 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll 2017-01-10 20:42 - 2016-12-21 00:54 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll 2017-01-10 20:42 - 2016-12-21 00:48 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll 2017-01-10 20:42 - 2016-12-21 00:48 - 01033216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll 2017-01-10 20:42 - 2016-12-21 00:48 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll 2017-01-10 20:43 - 2016-12-21 00:53 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll ==================== Alternate Data Streams (Whitelisted) ========= (If an entry is included in the fixlist, only the ADS will be removed.) ==================== Safe Mode (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""="" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""="" ==================== Association (Whitelisted) =============== (If an entry is included in the fixlist, the registry item will be restored to default or removed.) ==================== Internet Explorer trusted/restricted =============== (If an entry is included in the fixlist, it will be removed from the registry.) ==================== Hosts content: =============================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2015-07-10 05:04 - 2015-07-10 05:02 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-1265099400-3855610176-2687105521-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Avery\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\img13.jpg DNS Servers: 192.168.1.1 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) Windows Firewall is enabled. ==================== MSCONFIG/TASK MANAGER disabled items == HKLM\...\StartupApproved\Run: => "WindowsDefender" HKLM\...\StartupApproved\Run32: => "HPMessageService" HKLM\...\StartupApproved\Run32: => "PowerDVD14Agent" HKU\S-1-5-21-1265099400-3855610176-2687105521-1001\...\StartupApproved\Run: => "uTorrent" HKU\S-1-5-21-1265099400-3855610176-2687105521-1001\...\StartupApproved\Run: => "AirDroid 3" ==================== FirewallRules (Whitelisted) =============== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) FirewallRules: [vm-monitoring-nb-session] => LPort=139 FirewallRules: [{E981BE0C-9CD1-4594-AB7E-E5A6A5C7B032}] => c:\Program Files\CyberLink\PowerDirector12\PDR10.EXE FirewallRules: [{D930C64F-C38E-485C-8746-03F786D4B944}] => C:\Program Files (x86)\CyberLink\PowerDVD14\Movie\PowerDVD Cinema\PowerDVDCinema.exe FirewallRules: [{E54F11C6-91C0-4667-A4EB-2E019103AB4D}] => C:\Program Files (x86)\CyberLink\PowerDVD14\Movie\PowerDVDMovie.exe FirewallRules: [{CB38AA25-A99D-4C24-943F-0FCBB49DDFF7}] => C:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14Agent.exe FirewallRules: [{DD138A81-CC8E-4039-8878-D3BAC2E1DDBE}] => C:\Program Files (x86)\CyberLink\PowerDVD14\Kernel\DMS\CLMSServerPDVD14.exe FirewallRules: [{5D106D0F-FF2A-4D11-A746-8C82B9AEC83B}] => C:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD.exe FirewallRules: [{1A8E8C6D-3D92-41E8-A039-B72FB9BD8212}] => C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPSOCKSVC.exe FirewallRules: [{8EBCA008-9691-420F-A950-9F975F859B25}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{74E56DDD-2C49-4D12-9587-562B1206A9DF}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{F8364F06-AD0A-474C-95C1-DC6BCC4A1386}] => C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{0BF2255B-DDD1-4D73-9ABE-442A67552081}] => C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{6CF5ED85-6769-4B2F-BBE8-B944DFAF9CF2}] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe FirewallRules: [TCP Query User{1F84EAA9-0F67-4254-9302-69F05068071E}C:\users\avery\appdata\roaming\utorrent\utorrent.exe] => C:\users\avery\appdata\roaming\utorrent\utorrent.exe FirewallRules: [UDP Query User{A94726A4-4D3D-4C05-99FC-C14750FBED59}C:\users\avery\appdata\roaming\utorrent\utorrent.exe] => C:\users\avery\appdata\roaming\utorrent\utorrent.exe FirewallRules: [{1280603A-F614-46B9-8E01-EDC6249C3C2B}] => C:\Program Files (x86)\Skype\Phone\Skype.exe FirewallRules: [TCP Query User{5E474393-B7A7-401F-8FD0-38C935A51B22}C:\gog games\stardew valley\stardewmoddingapi.exe] => C:\gog games\stardew valley\stardewmoddingapi.exe FirewallRules: [UDP Query User{97DE64A4-1D25-4CD3-BA90-4336DBA3953C}C:\gog games\stardew valley\stardewmoddingapi.exe] => C:\gog games\stardew valley\stardewmoddingapi.exe FirewallRules: [TCP Query User{B2D8FA44-00C9-41FA-BD1D-BDE8478C0957}C:\program files (x86)\airdroid\airdroid.exe] => C:\program files (x86)\airdroid\airdroid.exe FirewallRules: [UDP Query User{8A70FD53-0961-45C1-958F-EE1723B8C444}C:\program files (x86)\airdroid\airdroid.exe] => C:\program files (x86)\airdroid\airdroid.exe FirewallRules: [{04A634B1-EBBF-4C17-891D-BBA4286C0A32}] => C:\Program Files (x86)\Mr DJ\Borderlands Game Of The Year Edition\Binaries\Borderlands.exe FirewallRules: [{A96571C1-7A41-45CE-A535-F9BB95094C7D}] => C:\Program Files (x86)\Mr DJ\Borderlands Game Of The Year Edition\Binaries\Borderlands.exe ==================== Restore Points ========================= 03-02-2017 04:50:48 Scheduled Checkpoint 03-02-2017 13:07:03 JRT Pre-Junkware Removal ==================== Faulty Device Manager Devices ============= Name: Generic PnP Monitor Description: Generic PnP Monitor Class Guid: {4d36e96e-e325-11ce-bfc1-08002be10318} Manufacturer: (Standard monitor types) Service: monitor Problem: : This device is disabled. (Code 22) Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. Name: Generic PnP Monitor Description: Generic PnP Monitor Class Guid: {4d36e96e-e325-11ce-bfc1-08002be10318} Manufacturer: (Standard monitor types) Service: monitor Problem: : This device is disabled. (Code 22) Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. Name: Wireless Device Description: Wireless Device Class Guid: {4d36e97d-e325-11ce-bfc1-08002be10318} Manufacturer: Microsoft Service: WUDFRd Problem: : This device is disabled. (Code 22) Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. ==================== Event log errors: ========================= Application errors: ================== Error: (02/03/2017 01:07:27 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: ) Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object. Details: AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol. System Error: Access is denied. . Error: (02/03/2017 01:03:34 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-MF8UBHK) Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2147024865 See the Microsoft-Windows-TWinUI/Operational log for additional information. Error: (02/03/2017 01:03:33 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-MF8UBHK) Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2147024865 See the Microsoft-Windows-TWinUI/Operational log for additional information. Error: (02/03/2017 01:03:33 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-MF8UBHK) Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2147024865 See the Microsoft-Windows-TWinUI/Operational log for additional information. Error: (02/03/2017 01:03:33 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-MF8UBHK) Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2147023170 See the Microsoft-Windows-TWinUI/Operational log for additional information. Error: (02/03/2017 01:03:33 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-MF8UBHK) Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2147023170 See the Microsoft-Windows-TWinUI/Operational log for additional information. Error: (02/03/2017 01:03:33 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DESKTOP-MF8UBHK) Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information. Error: (02/03/2017 08:38:08 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: svchost.exe_TimeBrokerSvc, version: 10.0.14393.0, time stamp: 0x57899b1c Faulting module name: combase.dll, version: 10.0.14393.576, time stamp: 0x584a7796 Exception code: 0xc0000005 Fault offset: 0x00000000000b071c Faulting process id: 0x3ec Faulting application start time: 0x01d27e2725435114 Faulting application path: C:\WINDOWS\system32\svchost.exe Faulting module path: C:\WINDOWS\System32\combase.dll Report Id: bd1e2fb6-04df-44de-9332-3cbc4e95d17c Faulting package full name: Faulting package-relative application ID: Error: (02/03/2017 08:30:33 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: SearchUI.exe, version: 10.0.14393.693, time stamp: 0x585a272f Faulting module name: Windows.UI.Xaml.dll, version: 10.0.14393.594, time stamp: 0x5850ccd3 Exception code: 0xc000027b Fault offset: 0x00000000006d682b Faulting process id: 0x1068 Faulting application start time: 0x01d27e276e90a968 Faulting application path: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe Faulting module path: C:\Windows\System32\Windows.UI.Xaml.dll Report Id: 348900a7-154b-4c31-b805-7aa744f1189a Faulting package full name: Microsoft.Windows.Cortana_1.7.0.14393_neutral_neutral_cw5n1h2txyewy Faulting package-relative application ID: CortanaUI Error: (02/03/2017 08:30:30 AM) (Source: Application Hang) (EventID: 1002) (User: ) Description: The program mmc.exe version 10.0.14393.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel. Process ID: 1d8c Start Time: 01d27e27e1907628 Termination Time: 33 Application Path: C:\Windows\System32\mmc.exe Report Id: 4b879f9a-ea1d-11e6-bca7-d259f641775a Faulting package full name: Faulting package-relative application ID: System errors: ============= Error: (02/03/2017 01:03:34 PM) (Source: DCOM) (EventID: 10001) (User: DESKTOP-MF8UBHK) Description: Unable to start a DCOM Server: CortanaUI.AppX8z5q44mt1b9k6x2nkjj0bkr2e1ac0dxy.mca as Unavailable/Unavailable. The error: "31" Happened while starting this command: "C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca Error: (02/03/2017 01:03:33 PM) (Source: DCOM) (EventID: 10001) (User: DESKTOP-MF8UBHK) Description: Unable to start a DCOM Server: CortanaUI.AppX7g6j8enbgfgf1t15yx40msgc684ay3k5.mca as Unavailable/Unavailable. The error: "31" Happened while starting this command: "C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca Error: (02/03/2017 01:03:33 PM) (Source: DCOM) (EventID: 10001) (User: DESKTOP-MF8UBHK) Description: Unable to start a DCOM Server: CortanaUI.AppXjytc7c0yvwb8n3cw0r82k4364sd1s7bv.mca as Unavailable/Unavailable. The error: "31" Happened while starting this command: "C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppXy7vb4pc2dr3kc93kfc509b1d0arkfb2x.mca Error: (02/03/2017 01:03:33 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-MF8UBHK) Description: The server CortanaPlaces.PlaceStore did not register with DCOM within the required timeout. Error: (02/03/2017 01:00:50 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY) Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {8D8F4F83-3594-4F07-8369-FC3C3CAE4919} and APPID {F72671A9-012C-4725-9D2F-2A4D32D65169} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool. Error: (02/03/2017 01:00:16 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The Kingsoft_WPS_UpdateService service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. Error: (02/03/2017 01:00:16 PM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: A timeout was reached (30000 milliseconds) while waiting for the Kingsoft_WPS_UpdateService service to connect. Error: (02/03/2017 12:58:44 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY) Description: WLAN Extensibility Module has stopped unexpectedly. Module Path: C:\WINDOWS\system32\Rtlihvs.dll Error: (02/03/2017 12:58:44 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY) Description: WLAN Extensibility Module has stopped unexpectedly. Module Path: C:\WINDOWS\system32\Rtlihvs.dll Error: (02/03/2017 12:58:41 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT AUTHORITY) Description: WLAN Extensibility Module has stopped unexpectedly. Module Path: C:\WINDOWS\system32\Rtlihvs.dll CodeIntegrity: =================================== Date: 2017-02-01 06:17:18.179 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\PROCEXP152.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2017-02-01 05:33:50.806 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\PROCEXP152.SYS because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. ==================== Memory info =========================== Processor: Intel(R) Core(TM) i5-5200U CPU @ 2.20GHz Percentage of memory in use: 40% Total physical RAM: 6059.39 MB Available physical RAM: 3616.99 MB Total Virtual: 24059.39 MB Available Virtual: 21582.5 MB ==================== Drives ================================ Drive c: (Windows) (Fixed) (Total:910.65 GB) (Free:683.15 GB) NTFS Drive d: (RECOVERY) (Fixed) (Total:19.65 GB) (Free:2.29 GB) NTFS ==>[system with boot components (obtained from drive)] ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 931.5 GB) (Disk ID: B65C61FD) Partition: GPT. ==================== End of Addition.txt ============================