Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Doublecheck needed, did I miss something? [Solved]

Started by Jim Dearden , Sep 23 2015 11:50 AM

  • This topic is locked This topic is locked

#1
Jim Dearden
Posted 23 September 2015 - 11:50 AM

Jim Dearden

    Member

  • Member
  • PipPip
  • 37 posts

Hi,

 

I got hit with a media player update codec trojan. It installed a bunch of crapware, the most insidious was the nixsrv.exe adware.

 

It redirected my search engines and home pages as well. It also killed Adblock plus. Comodo Internet Security stopped some installs but not all, and didn't find anything on scan. Malwarebytes got 68 items, couldn't get rid of nixsrv.

 

Downloaded and ran Unhackme, which seems to have done the job. I also booted into linux, and removed the directory by hand. Then ran CCleaner, and cleaned registry, and checked for startup programs.

 

Did new sacns with MBAM, Unhackme, and Comodo. It seems that they system is clean, but I would like confirmation of this. Attached are the Farbar logs...

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:23-09-2015
Ran by Jim (administrator) on JIM-LAPTOP (23-09-2015 13:35:36)
Running from C:\Users\Jim\Desktop
Loaded Profiles: Jim (Available Profiles: Jim)
Platform: Microsoft Windows 7 Professional  Service Pack 1 (X86) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
(Acronis) C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
(Acronis) C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Bayer Healthcare LLC) C:\Program Files\Bayer HealthCare SmartLaunch\bin\BayerHCService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX86\officeclicktorun.exe
() C:\Program Files\Core Temp\Core Temp.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cistray.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS32.exe
(Greatis Software) C:\Program Files\UnHackMe\hackmon.exe
(VMware, Inc.) C:\Windows\System32\vmnat.exe
(VMware, Inc.) C:\Program Files\VMware\VMware Player\vmware-authd.exe
(VMware, Inc.) C:\Windows\System32\vmnetdhcp.exe
(VMware, Inc.) C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(Acronis) C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
(Acronis International GmbH) C:\Program Files\Common Files\Acronis\TibMounter\TibMounterMonitor.exe
(Acronis) C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(AVEO) C:\Program Files\DIGIOPTICS SOFTWARE R&D CENTER\DIGIOPTICS SOFTWARE R&D CENTER\AveoSTI.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe
(Flux Software LLC) C:\Users\Jim\AppData\Local\FluxSoftware\Flux\flux.exe
(ITSamples.com) C:\Program Files\ITSamples\NetworkIndicator\NetworkIndicator.exe
(Acronis) C:\Program Files\Common Files\Acronis\SyncAgent\syncagentsrv.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [COMODO Internet Security] => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [1361088 2015-08-07] (COMODO)
HKLM\...\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [159744 2015-04-29] (Alps Electric Co., Ltd.)
HKLM\...\Run: [LManager] => C:\Program Files\Launch Manager\LManager.exe [1190920 2015-04-05] (Dritek System Inc.)
HKLM\...\Run: [TrueImageMonitor.exe] => C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe [7805888 2015-07-22] (Acronis)
HKLM\...\Run: [AcronisTibMounterMonitor] => C:\Program Files\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [1102192 2015-07-22] (Acronis International GmbH)
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe [379672 2015-07-22] (Acronis)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [157968 2015-08-21] (Apple Inc.)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2015-08-21] (Apple Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [597552 2015-08-30] (Oracle Corporation)
HKLM\...\Run: [AveoSTI] => C:\Program Files\DIGIOPTICS SOFTWARE R&D CENTER\DIGIOPTICS SOFTWARE R&D CENTER\AveoSTI.exe [32768 2015-09-11] (AVEO)
HKU\S-1-5-21-225685578-4181334046-1023964479-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [6278424 2015-04-30] (Piriform Ltd)
HKU\S-1-5-21-225685578-4181334046-1023964479-1000\...\Run: [f.lux] => C:\Users\Jim\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2015-05-16] (Flux Software LLC)
HKU\S-1-5-21-225685578-4181334046-1023964479-1000\...\Run: [GarminExpressTrayApp] => C:\Program Files\Garmin\Express Tray\ExpressTray.exe [688984 2015-07-04] (Garmin Ltd or its subsidiaries)
HKU\S-1-5-21-225685578-4181334046-1023964479-1000\...\Run: [Dropbox Update] => C:\Users\Jim\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-07-07] (Dropbox, Inc.)
HKU\S-1-5-21-225685578-4181334046-1023964479-1000\...\Run: [NetworkIndicator] => C:\Program Files\ITSamples\NetworkIndicator\NetworkIndicator.exe [376832 2015-07-27] (ITSamples.com)
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jim\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jim\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jim\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jim\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jim\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jim\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jim\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jim\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-08-14] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-08-11] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-08-11] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-08-11] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [AcronisSyncError] -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} => C:\Program Files\Acronis\TrueImageHome\tishell.dll [2013-10-01] ()
ShellIconOverlayIdentifiers: [AcronisSyncInProgress] -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} => C:\Program Files\Acronis\TrueImageHome\tishell.dll [2013-10-01] ()
ShellIconOverlayIdentifiers: [AcronisSyncOk] -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} => C:\Program Files\Acronis\TrueImageHome\tishell.dll [2013-10-01] ()
BootExecute: autocheck autochk * Partizan
GroupPolicyScripts: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704 2011-08-30] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 8.8.8.8
Tcpip\..\Interfaces\{2D213D93-6FCB-4CAF-9862-0A3200604552}: [DhcpNameServer] 8.8.8.8
Tcpip\..\Interfaces\{3495CEAF-F463-4297-A6BF-D0A24D085D31}: [DhcpNameServer] 208.72.120.204 208.79.56.204
Tcpip\..\Interfaces\{C4C700DF-4E35-4F4F-97F6-94CB36E42C61}: [DhcpNameServer] 8.8.8.8

Internet Explorer:
==================
HKU\S-1-5-21-225685578-4181334046-1023964479-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://slashdot.org/
HKU\S-1-5-21-225685578-4181334046-1023964479-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/en-ca/?ocid=iehp
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll [2015-08-04] (Microsoft Corporation)
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_60\bin\ssv.dll [2015-08-30] (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2015-08-11] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-08-11] (Microsoft Corporation)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_60\bin\jp2ssv.dll [2015-08-30] (Oracle Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-03-30] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Jim\AppData\Roaming\Mozilla\Firefox\Profiles\tbcrmzbf.default
FF SelectedSearchEngine: Google
FF Homepage: hxxp://slashdot.org/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-09-08] ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2015-07-30] ()
FF Plugin: @java.com/DTPlugin,version=11.60.2 -> C:\Program Files\Java\jre1.8.0_60\bin\dtplugin\npDeployJava1.dll [2015-08-30] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.60.2 -> C:\Program Files\Java\jre1.8.0_60\bin\plugin2\npjp2.dll [2015-08-30] (Oracle Corporation)
FF Plugin: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-02-17] (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-03-30] (Microsoft Corporation)
FF Plugin: @palmsource.com/installer,version=1.0 -> C:\PROGRA~1\Palm\PACKAG~1\NPInstal.dll [2007-03-19] ()
FF Plugin: @videolan.org/vlc,version=2.2.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-07-03] (Adobe Systems Inc.)
FF Extension: Xmarks - C:\Users\Jim\AppData\Roaming\Mozilla\Firefox\Profiles\tbcrmzbf.default\Extensions\[email protected] [2015-05-29]
FF Extension: FireFTP - C:\Users\Jim\AppData\Roaming\Mozilla\Firefox\Profiles\tbcrmzbf.default\Extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f} [2015-05-29]
FF Extension: Classic Theme Restorer - C:\Users\Jim\AppData\Roaming\Mozilla\Firefox\Profiles\tbcrmzbf.default\Extensions\[email protected] [2015-03-26]
FF Extension: ClipConverter - C:\Users\Jim\AppData\Roaming\Mozilla\Firefox\Profiles\tbcrmzbf.default\Extensions\[email protected] [2015-04-02]
FF Extension: Status-4-Evar - C:\Users\Jim\AppData\Roaming\Mozilla\Firefox\Profiles\tbcrmzbf.default\Extensions\[email protected] [2015-03-26]
FF Extension: FireFTP button - C:\Users\Jim\AppData\Roaming\Mozilla\Firefox\Profiles\tbcrmzbf.default\Extensions\{9BAE5926-8513-417d-8E47-774955A7C60D}.xpi [2015-03-26]
FF Extension: Adblock Plus - C:\Users\Jim\AppData\Roaming\Mozilla\Firefox\Profiles\tbcrmzbf.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-09-22]
FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\itms.js [2015-08-28]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AcrSch2Svc; C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe [777016 2015-07-22] (Acronis)
R2 afcdpsrv; C:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exe [3873784 2015-07-22] (Acronis)
R2 BayerHealthcareService; C:\Program Files\Bayer HealthCare SmartLaunch\bin\BayerHCService.exe [135032 2015-04-01] (Bayer Healthcare LLC)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX86\OfficeClickToRun.exe [1875544 2015-09-16] (Microsoft Corporation)
R2 CmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [4353840 2015-09-07] (COMODO)
S3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [1664704 2015-08-07] (COMODO)
S2 Garmin Core Update Service; C:\Program Files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [517464 2015-07-04] (Garmin Ltd or its subsidiaries)
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2015-04-16] (Macrovision Corporation) [File not signed]
S2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-09-22] (Malwarebytes Corporation)
R2 syncagentsrv; C:\Program Files\Common Files\Acronis\SyncAgent\syncagentsrv.exe [7142320 2015-07-22] (Acronis)
R2 VMAuthdService; C:\Program Files\VMware\VMware Player\vmware-authd.exe [87256 2015-04-16] (VMware, Inc.)
R2 VMnetDHCP; C:\Windows\system32\vmnetdhcp.exe [359128 2015-04-16] (VMware, Inc.)
R2 VMUSBArbService; C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe [722624 2015-04-16] (VMware, Inc.)
R2 VMware NAT Service; C:\Windows\system32\vmnat.exe [437976 2015-04-16] (VMware, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2015-03-27] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 asmthub3; C:\Windows\System32\DRIVERS\asmthub3.sys [110408 2012-08-20] (ASMedia Technology Inc)
R1 cmderd; C:\Windows\System32\DRIVERS\cmderd.sys [17064 2015-08-04] (COMODO)
R1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [626776 2015-08-04] (COMODO)
R1 cmdHlp; C:\Windows\System32\DRIVERS\cmdhlp.sys [41736 2015-08-04] (COMODO)
S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [77808 2015-04-05] (FTDI Ltd.)
R2 hcmon; C:\Windows\system32\drivers\hcmon.sys [43968 2014-08-21] (VMware, Inc.)
R1 inspect; C:\Windows\System32\DRIVERS\inspect.sys [91176 2015-08-04] (COMODO)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-09-22] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-09-22] (Malwarebytes Corporation)
S3 PalmUSBD; C:\Windows\System32\drivers\PalmUSBD.sys [16640 2015-05-10] (PalmSource, Inc.)
U0 Partizan; C:\Windows\System32\drivers\Partizan.sys [40304 2015-09-22] (Greatis Software)
R3 rt2870; C:\Windows\System32\DRIVERS\rt2870.sys [1660488 2015-03-27] (Ralink Technology, Corp.)
S3 tdrpman; C:\Windows\System32\DRIVERS\tdrpman.sys [889888 2015-07-22] (Acronis International GmbH)
R0 tib; C:\Windows\System32\DRIVERS\tib.sys [736192 2015-07-22] (Acronis International GmbH)
R0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [143648 2015-07-22] (Acronis International GmbH)
R0 vididr; C:\Windows\System32\DRIVERS\vididr.sys [116000 2015-07-22] (Acronis International GmbH)
R0 vidsflt; C:\Windows\System32\DRIVERS\vidsflt.sys [85280 2015-07-22] (Acronis International GmbH)
R3 vmkbd; C:\Windows\system32\drivers\VMkbd.sys [26456 2015-01-16] (VMware, Inc.)
R3 VMnetAdapter; C:\Windows\System32\DRIVERS\vmnetadapter.sys [17104 2015-04-16] (VMware, Inc.)
R2 VMnetBridge; C:\Windows\System32\DRIVERS\vmnetbridge.sys [37456 2015-04-16] (VMware, Inc.)
R2 VMnetuserif; C:\Windows\system32\drivers\vmnetuserif.sys [26968 2015-01-16] (VMware, Inc.)
R2 vmx86; C:\Windows\system32\Drivers\vmx86.sys [66136 2015-01-16] (VMware, Inc.)
R0 vsock; C:\Windows\System32\drivers\vsock.sys [63824 2013-10-08] (VMware, Inc.)
R3 ALSysIO; \??\C:\Users\Jim\AppData\Local\Temp\ALSysIO.sys [X]
S1 DritekPortIO; \??\C:\Program Files\Launch Manager\DPortIO.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-09-23 13:35 - 2015-09-23 13:36 - 00017669 _____ C:\Users\Jim\Desktop\FRST.txt
2015-09-23 13:35 - 2015-09-23 13:35 - 00000000 ____D C:\Users\Jim\Desktop\FRST-OlderVersion
2015-09-22 20:53 - 2015-09-23 13:35 - 00000000 ____D C:\FRST
2015-09-22 20:51 - 2015-09-23 13:35 - 01695744 _____ (Farbar) C:\Users\Jim\Desktop\FRST.exe
2015-09-22 20:23 - 2015-09-22 20:23 - 00001176 _____ C:\mbam2.txt
2015-09-22 19:59 - 2015-09-23 05:54 - 00025119 _____ C:\Windows\Partizan.log
2015-09-22 19:56 - 2015-09-23 13:31 - 00000262 _____ C:\Windows\system32\PARTIZAN.TXT
2015-09-22 19:55 - 2015-09-22 19:56 - 00000000 ____D C:\.Trash-1000
2015-09-22 19:26 - 2015-09-22 20:03 - 00000000 ____D C:\ProgramData\RegRun
2015-09-22 19:25 - 2015-09-22 20:03 - 00000000 ____D C:\Users\Public\Documents\regruninfo
2015-09-22 19:25 - 2015-09-22 20:03 - 00000000 ____D C:\Users\Jim\Documents\RegRun2
2015-09-22 19:25 - 2015-09-22 19:25 - 00047920 _____ (Greatis Software) C:\Windows\system32\partizan.exe
2015-09-22 19:25 - 2015-09-22 19:25 - 00040304 _____ (Greatis Software) C:\Windows\system32\Drivers\Partizan.sys
2015-09-22 19:25 - 2015-09-22 19:25 - 00012800 _____ (Greatis Software, LLC.) C:\Windows\system32\Drivers\UnHackMeDrv.sys
2015-09-22 19:25 - 2015-09-22 19:25 - 00000965 _____ C:\Users\Jim\Desktop\UnHackMe.lnk
2015-09-22 19:25 - 2015-09-22 19:25 - 00000002 RSHOT C:\Windows\winstart.bat
2015-09-22 19:25 - 2015-09-22 19:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UnHackMe
2015-09-22 19:25 - 2015-09-22 19:25 - 00000000 ____D C:\Program Files\UnHackMe
2015-09-22 19:19 - 2015-09-22 19:23 - 20110015 _____ C:\Users\Jim\Desktop\unhackmeb.zip
2015-09-22 19:16 - 2015-09-23 13:31 - 00000280 _____ C:\Windows\setupact.log
2015-09-22 19:16 - 2015-09-23 05:15 - 00010282 _____ C:\Windows\PFRO.log
2015-09-22 19:16 - 2015-09-22 19:16 - 00000000 _____ C:\Windows\setuperr.log
2015-09-22 18:51 - 2015-09-22 20:34 - 00098520 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-09-22 18:51 - 2015-09-22 18:51 - 00094936 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-09-22 18:51 - 2015-09-22 18:51 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-09-22 18:51 - 2015-09-22 18:51 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-09-22 18:51 - 2015-09-22 18:51 - 00001060 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-09-22 18:51 - 2015-09-22 18:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-09-22 18:51 - 2015-09-22 18:51 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-09-22 18:51 - 2015-09-22 18:51 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware
2015-09-22 18:36 - 2015-09-22 18:36 - 00061372 _____ C:\Users\Jim\Documents\cc_20150922_183608.reg
2015-09-22 17:44 - 2015-09-22 17:44 - 00260876 _____ (VuuPC Limited) C:\Users\Jim\AppData\Local\nshDC4E.tmp
2015-09-22 17:42 - 2015-09-22 17:48 - 00000008 _____ C:\END
2015-09-12 11:23 - 2015-09-12 11:24 - 00000000 ____D C:\Users\Jim\Desktop\Reacher
2015-09-12 08:02 - 2015-09-12 08:02 - 00000000 ___HD C:\$Windows.~BT
2015-09-11 16:52 - 2015-09-11 17:00 - 00000000 ____D C:\Program Files\CoolingTech
2015-09-11 16:52 - 2015-09-11 16:52 - 00000000 ____D C:\Windows\XSxS
2015-09-11 16:52 - 2015-09-11 16:52 - 00000000 ____D C:\Users\Jim\AppData\Local\Xenocode
2015-09-11 16:52 - 2015-09-11 16:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CoolingTech
2015-09-11 16:38 - 2015-09-11 16:38 - 00001168 _____ C:\Users\Public\Desktop\CamApp.lnk
2015-09-11 16:38 - 2015-09-11 16:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\USB2.0 PC Camera
2015-09-11 16:38 - 2010-03-09 14:55 - 00230454 _____ C:\Windows\system32\SP_AIM_320_240.bmp
2015-09-11 16:38 - 2010-03-05 17:03 - 05760054 _____ C:\Windows\system32\SP_AIM_1600_1200.bmp
2015-09-11 16:38 - 2010-03-05 17:01 - 03686454 _____ C:\Windows\system32\SP_AIM_1280_960.bmp
2015-09-11 16:38 - 2010-03-05 16:59 - 00921656 _____ C:\Windows\system32\SP_AIM_640_480.bmp
2015-09-11 16:38 - 2010-03-01 13:40 - 00001320 _____ C:\Windows\system32\Language.ini
2015-09-11 16:37 - 2015-09-11 16:37 - 00000000 ____D C:\Program Files\DIGIOPTICS SOFTWARE R&D CENTER
2015-09-11 16:36 - 2015-09-11 16:36 - 00000000 ____D C:\Users\Jim\AppData\Roaming\InstallShield
2015-09-09 05:31 - 2015-08-27 13:58 - 01391104 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2015-09-09 05:31 - 2015-08-27 13:58 - 01241088 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-09-09 05:31 - 2015-08-27 13:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2015-09-09 05:31 - 2015-08-27 13:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-09-09 05:31 - 2015-08-05 13:41 - 00751104 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2015-09-09 05:31 - 2015-08-05 13:40 - 00216064 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-09-09 05:31 - 2015-08-05 13:40 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-09-09 05:31 - 2015-08-04 13:48 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-09-09 05:31 - 2015-08-04 13:47 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-09-09 05:31 - 2015-08-04 13:47 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-09-09 05:31 - 2015-08-04 13:46 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-09-09 05:31 - 2015-08-04 13:46 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-09-09 05:31 - 2015-08-04 12:53 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-09-09 05:30 - 2015-09-09 05:30 - 12857344 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-09-09 05:30 - 2015-09-09 05:30 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-09-09 05:30 - 2015-09-09 05:30 - 01951232 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-09-09 05:30 - 2015-09-09 05:30 - 01310720 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-09-09 05:30 - 2015-09-09 05:30 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-09-09 05:30 - 2015-09-09 05:30 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-09-09 05:30 - 2015-09-09 05:30 - 00689152 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-09-09 05:30 - 2015-09-09 05:30 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-09-09 05:30 - 2015-09-09 05:30 - 00479232 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-09-09 05:30 - 2015-09-09 05:30 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-09-09 05:30 - 2015-09-09 05:30 - 00344168 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-09-09 05:30 - 2015-09-09 05:30 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-09-09 05:30 - 2015-09-09 05:30 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-09-09 05:30 - 2015-09-09 05:30 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-09-09 05:30 - 2015-09-09 05:30 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-09-09 05:30 - 2015-09-09 05:30 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-09-09 05:30 - 2015-09-09 05:30 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-09-09 05:30 - 2015-09-09 05:30 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-09-09 05:30 - 2015-09-09 05:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-09-09 05:30 - 2015-09-01 22:48 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-09-09 05:30 - 2015-09-01 22:48 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-09-09 05:30 - 2015-09-01 22:48 - 00026624 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-09-09 05:30 - 2015-09-01 22:48 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-09-09 05:30 - 2015-09-01 21:36 - 02384896 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-09-09 05:30 - 2015-09-01 21:33 - 00299520 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-09-09 05:30 - 2015-08-15 01:53 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-09-09 05:30 - 2015-08-15 01:39 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-09-09 05:30 - 2015-08-15 01:39 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-09-09 05:30 - 2015-08-15 01:32 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-09-09 05:30 - 2015-08-15 01:29 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-09-09 05:30 - 2015-08-15 01:24 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-09-09 05:30 - 2015-08-15 01:16 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-09-09 05:30 - 2015-08-15 01:02 - 00685568 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-09-09 05:30 - 2015-07-22 13:57 - 03989952 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-09-09 05:30 - 2015-07-22 13:57 - 03934656 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-09-09 05:30 - 2015-07-22 13:57 - 00137664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-09-09 05:30 - 2015-07-22 13:57 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-09-09 05:30 - 2015-07-22 13:54 - 01308160 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-09-09 05:30 - 2015-07-22 13:53 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-09-09 05:30 - 2015-07-22 13:53 - 00937984 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-09-09 05:30 - 2015-07-22 13:53 - 00655360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-09-09 05:30 - 2015-07-22 13:53 - 00641536 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-09-09 05:30 - 2015-07-22 13:53 - 00635392 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-09-09 05:30 - 2015-07-22 13:53 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-09-09 05:30 - 2015-07-22 13:53 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-09-09 05:30 - 2015-07-22 13:53 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-09-09 05:30 - 2015-07-22 13:53 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-09-09 05:30 - 2015-07-22 13:53 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-09-09 05:30 - 2015-07-22 13:53 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-09-09 05:30 - 2015-07-22 13:53 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-09-09 05:30 - 2015-07-22 13:53 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-09-09 05:30 - 2015-07-22 13:53 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-09-09 05:30 - 2015-07-22 13:53 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-09-09 05:30 - 2015-07-22 13:53 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-09-09 05:30 - 2015-07-22 13:53 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-09-09 05:30 - 2015-07-22 13:53 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-09-09 05:30 - 2015-07-22 13:53 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-09-09 05:30 - 2015-07-22 13:52 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-09-09 05:30 - 2015-07-22 13:52 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-09-09 05:30 - 2015-07-22 13:52 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-09-09 05:30 - 2015-07-22 13:52 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-09-09 05:30 - 2015-07-22 13:47 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-09-09 05:30 - 2015-07-22 13:46 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-09-09 05:30 - 2015-07-22 13:42 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-09-09 05:30 - 2015-07-22 13:42 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-09-09 05:30 - 2015-07-22 12:38 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-09-09 05:30 - 2015-07-22 12:34 - 00225792 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-09-09 05:30 - 2015-07-22 12:34 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-09-09 05:30 - 2015-07-22 12:33 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-09-09 05:30 - 2015-07-09 13:42 - 01372160 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2015-09-09 05:30 - 2015-07-09 13:42 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll
2015-09-09 05:29 - 2015-09-09 05:30 - 19856896 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-09-09 05:29 - 2015-09-09 05:30 - 04520448 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-09-09 05:29 - 2015-09-09 05:30 - 02279424 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-09-09 05:29 - 2015-09-09 05:30 - 00665600 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-09-09 05:29 - 2015-09-09 05:30 - 00504832 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-09-09 05:21 - 2015-09-09 05:21 - 02953728 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-09-09 05:21 - 2015-09-09 05:21 - 02061824 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-09-09 05:21 - 2015-09-09 05:21 - 01805824 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-09-09 05:21 - 2015-09-09 05:21 - 00566784 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-09-09 05:21 - 2015-09-09 05:21 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-09-09 05:21 - 2015-09-09 05:21 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-09-09 05:21 - 2015-09-09 05:21 - 00105408 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2015-09-09 05:21 - 2015-09-09 05:21 - 00093184 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-09-09 05:21 - 2015-09-09 05:21 - 00073728 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-09-09 05:21 - 2015-09-09 05:21 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2015-09-09 05:21 - 2015-09-09 05:21 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-09-09 05:21 - 2015-09-09 05:21 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-09-09 05:21 - 2015-09-09 05:21 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-09-09 05:21 - 2015-09-09 05:21 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-09-09 05:20 - 2015-09-09 05:20 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2015-09-01 12:34 - 2015-09-01 12:34 - 00267936 _____ C:\ANG0
2015-09-01 12:30 - 2015-09-01 12:34 - 00000000 ____D C:\NST
2015-08-31 19:49 - 2015-08-31 19:49 - 05501792 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_42.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 04379984 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_40.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 04178264 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_41.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 03851784 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_39.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 03850760 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_38.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 03786760 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_37.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 03734536 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_36.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 03727720 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_35.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 03497832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_34.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 03495784 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_33.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 03426072 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 02414360 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_31.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 02388176 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_30.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 02106216 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 02036576 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_40.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 01998168 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 01868128 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 01846632 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_41.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 01493528 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_39.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 01491992 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_38.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 01420824 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_37.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 01374232 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_36.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 01358192 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_35.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 01124720 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_34.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 01123696 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_33.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00528216 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_6.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00527192 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00517448 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_4.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00515416 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_5.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00514384 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_3.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00509448 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_2.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00507400 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_1.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00479752 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_0.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00470880 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00467984 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_39.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00467984 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_38.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00462864 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_37.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00453456 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00453456 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_41.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00452440 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_40.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00444776 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_36.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00444776 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_35.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00443752 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_34.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00443752 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_33.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00440080 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00267272 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_10.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00267112 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_9.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00266088 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_8.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00261480 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_7.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00255848 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_6.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00251672 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_5.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00248672 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00239960 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00238936 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_6.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00238936 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_5.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00238088 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_2.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00238088 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_1.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00238088 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_0.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00237848 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_4.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00236824 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_3.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00235856 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_3.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00235352 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_4.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00235344 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_42.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00230168 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_2.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00230096 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_0.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00229584 _____ (Microsoft Corporation) C:\Windows\system32\xactengine2_1.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00081768 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_3.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00074072 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00074072 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_4.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00070992 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_2.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00069448 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_3.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00068616 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_1.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00065032 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_0.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00062744 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_2.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00062672 _____ (Microsoft Corporation) C:\Windows\system32\xinput1_1.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00025608 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_4.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00025608 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_3.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00023376 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_5.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00022360 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_7.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00022360 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_6.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00017928 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_2.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00015128 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_1.dll
2015-08-31 19:49 - 2015-08-31 19:49 - 00000000 ____D C:\Users\Jim\AppData\Local\CrashRpt
2015-08-31 19:48 - 2015-08-31 19:49 - 00014032 _____ (Microsoft Corporation) C:\Windows\system32\x3daudio1_0.dll
2015-08-31 19:48 - 2015-08-31 19:48 - 02337488 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_25.dll
2015-08-31 19:48 - 2015-08-31 19:48 - 02332368 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_29.dll
2015-08-31 19:48 - 2015-08-31 19:48 - 02323664 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_28.dll
2015-08-31 19:48 - 2015-08-31 19:48 - 02319568 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_27.dll
2015-08-31 19:48 - 2015-08-31 19:48 - 02297552 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_26.dll
2015-08-31 19:48 - 2015-08-31 19:48 - 02222800 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_24.dll
2015-08-31 19:44 - 2015-08-31 19:49 - 00000000 ____D C:\Windows\system32\directx
2015-08-31 19:22 - 2015-08-31 19:22 - 00809496 ____R (Creative Labs Inc.) C:\Windows\system32\tmp7D86.tmp
2015-08-31 19:22 - 2015-08-31 19:22 - 00444952 _____ (Creative Labs) C:\Windows\system32\wrap_oal.dll
2015-08-31 19:22 - 2015-08-31 19:22 - 00109080 _____ (Portions © Creative Labs Inc. and NVIDIA Corp.) C:\Windows\system32\OpenAL32.dll
2015-08-31 19:22 - 2015-08-31 19:22 - 00000000 ____D C:\Program Files\OpenAL
2015-08-31 18:56 - 2015-08-31 18:56 - 00000000 ____D C:\Users\Jim\AppData\Local\Curve Digital
2015-08-30 21:51 - 2015-08-30 21:51 - 00000000 ____D C:\Program Files\Common Files\Java
2015-08-30 21:50 - 2015-08-30 21:50 - 00000000 ____D C:\Users\Jim\AppData\Roaming\Sun
2015-08-30 21:50 - 2015-08-30 21:50 - 00000000 ____D C:\Users\Jim\.oracle_jre_usage
2015-08-30 21:44 - 2015-09-01 12:28 - 00000000 ____D C:\Users\Jim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2015-08-30 21:21 - 2015-08-30 21:21 - 00024576 _____ C:\Users\Jim\Documents\EasyBCD Backup (2015-08-30) (2).bcd
2015-08-30 21:19 - 2015-08-30 21:19 - 00024576 _____ C:\Users\Jim\Documents\EasyBCD Backup (2015-08-30).bcd
2015-08-28 21:18 - 2015-08-28 21:18 - 00000000 ____D C:\Users\Jim\AppData\Local\NeoSmart_Technologies
2015-08-28 21:17 - 2015-08-28 21:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NeoSmart Technologies
2015-08-28 21:17 - 2015-08-28 21:17 - 00000000 ____D C:\Program Files\NeoSmart Technologies
2015-08-28 21:16 - 2015-08-28 21:17 - 01618512 _____ C:\Users\Jim\Downloads\EasyBCD 2.2.exe
2015-08-28 20:48 - 2015-09-23 05:24 - 00000000 ____D C:\Program Files\Mozilla Firefox
2015-08-27 12:57 - 2015-08-27 12:57 - 00000000 ____D C:\Users\Public\Documents\My Wipe Reports
2015-08-27 12:57 - 2015-08-27 12:57 - 00000000 ____D C:\ProgramData\p2v
2015-08-26 09:19 - 2015-08-26 09:19 - 00000000 ____D C:\Users\Jim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-09-23 13:34 - 2015-03-26 08:08 - 02038810 _____ C:\Windows\WindowsUpdate.log
2015-09-23 13:31 - 2015-04-16 09:31 - 00000000 ____D C:\ProgramData\VMware
2015-09-23 13:31 - 2009-07-14 00:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-09-23 05:54 - 2015-03-26 08:44 - 01474832 _____ C:\Windows\system32\Drivers\sfi.dat
2015-09-23 05:25 - 2015-04-01 05:27 - 00000000 ____D C:\Users\Jim\AppData\Local\Transmission Remote GUI
2015-09-23 05:25 - 2009-07-14 00:34 - 00021872 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-09-23 05:25 - 2009-07-14 00:34 - 00021872 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-09-23 05:18 - 2015-07-07 09:06 - 00000910 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-225685578-4181334046-1023964479-1000UA.job
2015-09-23 05:15 - 2015-03-26 10:12 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2015-09-22 22:02 - 2015-03-30 09:27 - 00091642 _____ C:\Windows\system32\Drivers\fvstore.dat
2015-09-22 21:55 - 2015-04-04 16:07 - 00000000 ____D C:\Program Files\Tweak-7
2015-09-22 21:54 - 2015-06-03 16:16 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2015-09-22 21:54 - 2015-04-16 13:53 - 00000000 ____D C:\Program Files\Common Files\InstallShield
2015-09-22 20:40 - 2015-08-17 17:24 - 00000000 ____D C:\Program Files\Mozilla Thunderbird
2015-09-22 19:25 - 2009-07-13 22:04 - 00002577 _____ C:\Windows\system32\config.nt
2015-09-22 19:25 - 2009-07-13 22:04 - 00001688 _____ C:\Windows\system32\autoexec.nt
2015-09-22 19:12 - 2009-07-13 22:37 - 00000000 ____D C:\Windows\Microsoft.NET
2015-09-22 18:39 - 2015-04-30 17:21 - 00000000 ____D C:\Users\Jim\AppData\Roaming\TeamViewer
2015-09-22 18:38 - 2010-11-20 17:01 - 00962468 _____ C:\Windows\system32\PerfStringBackup.INI
2015-09-22 18:30 - 2009-07-14 00:33 - 00435576 _____ C:\Windows\system32\FNTCACHE.DAT
2015-09-22 18:29 - 2011-04-11 22:24 - 00000000 ____D C:\Program Files\Windows Journal
2015-09-22 18:18 - 2015-03-27 10:29 - 00000000 ____D C:\Windows\system32\MRT
2015-09-22 17:55 - 2009-07-14 00:46 - 00001515 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-09-22 17:32 - 2015-04-04 19:58 - 00000000 ____D C:\Users\Jim\AppData\Roaming\vlc
2015-09-21 20:26 - 2015-07-07 09:06 - 00000858 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-225685578-4181334046-1023964479-1000Core.job
2015-09-16 05:27 - 2015-03-30 10:47 - 00000000 ____D C:\Program Files\Microsoft Office 15
2015-09-12 18:20 - 2015-04-02 22:21 - 00000600 _____ C:\Users\Jim\AppData\Local\PUTTY.RND
2015-09-12 08:26 - 2015-03-26 12:04 - 00000000 ____D C:\Windows\Panther
2015-09-08 10:40 - 2015-05-10 06:59 - 00778440 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-09-08 10:40 - 2015-05-10 06:59 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-09-03 07:52 - 2015-01-30 12:27 - 00445472 _____ (COMODO) C:\Windows\system32\guard32.dll
2015-09-01 21:05 - 2015-03-30 09:02 - 00000000 ____D C:\Users\Jim\Documents\My Digital Editions
2015-09-01 20:23 - 2015-03-27 13:19 - 00000000 ____D C:\Program Files\Steam
2015-09-01 20:19 - 2015-03-27 13:36 - 00000000 ____D C:\Users\Jim\Documents\Calibre_Ebooks
2015-09-01 20:17 - 2015-03-30 08:54 - 00000000 ____D C:\Users\Jim\Documents\My Kindle Content
2015-08-31 19:22 - 2009-06-03 11:25 - 00809496 ____R (Creative Labs Inc.) C:\Windows\system32\tmp7D76.tmp
2015-08-31 10:44 - 2015-04-16 09:37 - 00000000 ____D C:\Users\Jim\AppData\Local\VMware
2015-08-31 10:24 - 2015-04-16 09:37 - 00000000 ____D C:\Users\Jim\AppData\Roaming\VMware
2015-08-30 21:51 - 2015-04-01 07:39 - 00000000 ____D C:\ProgramData\Oracle
2015-08-30 21:51 - 2015-04-01 07:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-08-30 21:50 - 2015-04-01 07:40 - 00097888 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2015-08-30 21:50 - 2015-03-26 08:30 - 00000000 ____D C:\Users\Jim
2015-08-30 21:49 - 2015-04-01 07:39 - 00000000 ____D C:\Program Files\Java
2015-08-26 18:36 - 2015-03-27 10:29 - 132039072 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-08-26 09:27 - 2015-03-30 08:50 - 00000000 ____D C:\Program Files\Kobo
2015-08-26 09:19 - 2015-04-01 11:06 - 00000000 ____D C:\Users\Jim\AppData\Roaming\Dropbox

==================== Files in the root of some directories =======

2015-09-22 17:44 - 2015-09-22 17:44 - 0260876 _____ (VuuPC Limited) C:\Users\Jim\AppData\Local\nshDC4E.tmp
2015-04-02 22:21 - 2015-09-12 18:20 - 0000600 _____ () C:\Users\Jim\AppData\Local\PUTTY.RND
2015-08-03 21:02 - 2015-08-03 21:02 - 0000218 _____ () C:\Users\Jim\AppData\Local\recently-used.xbel

Some files in TEMP:
====================
C:\Users\Jim\AppData\Local\Temp\beecjffhed.exe
C:\Users\Jim\AppData\Local\Temp\merles.exe
C:\Users\Jim\AppData\Local\Temp\mox.exe
C:\Users\Jim\AppData\Local\Temp\UninstallModule.exe


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-09-12 12:42

==================== End of FRST.txt ============================

 

 

Additional scan result of Farbar Recovery Scan Tool (x86) Version:23-09-2015
Ran by Jim (2015-09-23 13:36:52)
Running from C:\Users\Jim\Desktop
Microsoft Windows 7 Professional  Service Pack 1 (X86) (2015-03-26 12:30:12)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-225685578-4181334046-1023964479-500 - Administrator - Disabled)
Guest (S-1-5-21-225685578-4181334046-1023964479-501 - Limited - Disabled)
Jim (S-1-5-21-225685578-4181334046-1023964479-1000 - Administrator - Enabled) => C:\Users\Jim

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: COMODO Antivirus (Enabled - Up to date) {F25D0092-CDBE-B303-ADB7-88DE8CDECCF5}
AS: Comodo Defense+ (Enabled - Up to date) {493CE176-EB84-BC8D-9707-B3ACF7598648}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: COMODO Firewall (Enabled) {CA6681B7-87D1-B25B-86E8-21EB720D8B8E}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-225685578-4181334046-1023964479-1000\...\uTorrent) (Version: 3.4.3.40208 - BitTorrent Inc.)
7-Zip 9.20 (HKLM\...\7-Zip) (Version:  - )
Acronis True Image 2014 (HKLM\...\{8DD203F6-B966-4846-8C0C-520A555BE395}Visible) (Version: 17.0.6688 - Acronis)
Acronis True Image 2014 (Version: 17.0.6688 - Acronis) Hidden
Adobe Acrobat Reader DC (HKLM\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.008.20082 - Adobe Systems Incorporated)
Adobe Digital Editions 3.0 (HKLM\...\Adobe Digital Editions 3.0) (Version: 3.0.1 - Adobe Systems Incorporated)
Adobe Flash Player 18 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 18.0.0.232 - Adobe Systems Incorporated)
ALPS Touch Pad Driver (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version:  - Alps Electric)
Amazon Kindle (HKU\S-1-5-21-225685578-4181334046-1023964479-1000\...\Amazon Kindle) (Version:  - Amazon)
ANT Drivers Installer x86 (Version: 2.3.4 - Garmin Ltd or its subsidiaries) Hidden
Apple Application Support (32-bit) (HKLM\...\{7FE25256-B7C1-480D-B736-10A67A833AEA}) (Version: 3.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{538227C6-C74B-4A74-99E1-2C0B4F9DA5E1}) (Version: 8.2.1.3 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Arduino (HKLM\...\Arduino) (Version: 1.6.1 - Arduino LLC)
Asmedia ASM104x USB 3.0 Host Controller Driver (HKLM\...\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.16.2.0 - Asmedia Technology)
Audacity 2.0.6 (HKLM\...\Audacity_is1) (Version: 2.0.6 - Audacity Team)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
calibre (HKLM\...\{04882E0B-389F-4F58-B1B9-DE87371DEBDE}) (Version: 2.34.0 - Kovid Goyal)
CCleaner (HKLM\...\CCleaner) (Version: 5.05 - Piriform)
COMODO Internet Security Premium (HKLM\...\{68BE8BAB-5375-4C99-9116-1808F5968D40}) (Version: 8.1.0.4426 - COMODO Security Solutions Inc.)
CoolingTech version 2.0 (HKLM\...\{9D9DC4E4-BFFA-491B-9A25-25FBE27DF5A0}_is1) (Version: 2.0 - CoolingTech)
Core Temp 1.0 RC6 (HKLM\...\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1) (Version: 1.0 - Alcpu)
Defraggler (HKLM\...\Defraggler) (Version: 2.19 - Piriform)
DIGIOPTICS SOFTWARE R&D CENTER (HKLM\...\{99F9C248-7881-4F4B-8FA4-216F05287A9F}) (Version: 1.0.0.7 - DIGIOPTICS SOFTWARE R&D CENTER)
Dropbox (HKU\S-1-5-21-225685578-4181334046-1023964479-1000\...\Dropbox) (Version: 3.8.8 - Dropbox, Inc.)
EasyBCD 2.2 (HKLM\...\EasyBCD) (Version: 2.2 - NeoSmart Technologies)
EasyWorship 2009 (HKLM\...\{A92509EA-B526-4869-B8B3-A39E20DBBE7A}_is1) (Version: 2009.01.09 - Softouch Development, Inc.)
Elevated Installer (Version: 3.2.29.0 - Garmin Ltd or its subsidiaries) Hidden
f.lux (HKU\S-1-5-21-225685578-4181334046-1023964479-1000\...\Flux) (Version:  - )
FastStone Image Viewer 5.4 (HKLM\...\FastStone Image Viewer) (Version: 5.4 - FastStone Soft)
FFmpeg (Windows) for Audacity version 2.2.2 (HKLM\...\{9C7E31E3-017F-434C-AC40-24431A354A1E}_is1) (Version: 2.2.2 - )
Forté Agent (HKLM\...\{9B867430-CF67-4989-A414-68DF625D5D15}) (Version: 8.00.1272 - Forté Internet Software, Inc.)
FTL -  Advanced Edition (HKLM\...\GOGPACKFTL_is1) (Version: 2.3.0.13 - GOG.com)
Garmin City Navigator North America NT 2015.40 (HKLM\...\{502AF3EA-34FA-4BD9-BAEF-3F8D8C5E3CCC}) (Version: 2.0.0.0 - Garmin Ltd or its subsidiaries)
Garmin Express (HKLM\...\{714dc1e5-69a4-4ecd-9552-93397e084298}) (Version: 3.2.29.0 - Garmin Ltd or its subsidiaries)
Garmin Express (Version: 3.2.29.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin Express Tray (Version: 3.2.29.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin MapSource (HKLM\...\{AFBAB9A0-DDE8-49AE-8C17-A01B61BEE64B}) (Version: 6.16.3 - Garmin Ltd or its subsidiaries)
Garmin USB Drivers (HKLM\...\{65F9E1F3-A2C1-4AA9-9F33-A3AEB0255F0E}) (Version: 2.3.0.0 - Garmin Ltd or its subsidiaries)
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
GLUCOFACTS™ Deluxe (HKLM\...\{8AE1AA90-CC3A-44A3-A8D4-CC5DA967DFB5}) (Version: 3.08.02 - Bayer HealthCare)
GLUCOFACTS™ Deluxe Smart Launch (HKLM\...\{F4A04C28-4CD0-444F-9623-2553281B8235}) (Version: 1.29.01 - Bayer HealthCare)
GOG.com Downloader version 3.6.0 (HKLM\...\{456A5815-604D-4D72-94DF-346D2B978A59}_is1) (Version: 3.6.0 - GOG.com)
inSSIDer Home (HKLM\...\{9E54E4AE-B67A-4925-8E92-0E1F9817FD73}) (Version: 3.1.2.1 - MetaGeek, LLC)
Intel® Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1930 - Intel Corporation)
Intel® TV Wizard (HKLM\...\TVWiz) (Version:  - Intel Corporation)
iTunes (HKLM\...\{025E78AC-BD91-4E9E-B165-3C09D4084BA4}) (Version: 12.2.2.25 - Apple Inc.)
Java 8 Update 60 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218060F0}) (Version: 8.0.600.27 - Oracle Corporation)
Kobo (HKLM\...\Kobo) (Version: 3.17.0 - Rakuten Kobo Inc.)
LADSPA_plugins-win-0.4.15 (HKLM\...\LADSPA_plugins-win_is1) (Version:  - Audacity Team)
LAME v3.99.3 (for Windows) (HKLM\...\LAME_is1) (Version:  - )
Launch Manager (HKLM\...\LManager) (Version: 3.0.03 - Acer Inc.)
MailWasherPro (HKLM\...\{3F914D52-8A29-4E37-9BF7-7FD7A303D0D5}) (Version: 7.5 - Firetrust)
Malwarebytes Anti-Malware version 2.1.8.1057 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft LifeCam (HKLM\...\{5FC7AB5C-61FC-42DF-A923-5139BCF10D42}) (Version: 3.22.270.0 - Microsoft Corporation)
Microsoft Office 365 ProPlus - en-us (HKLM\...\O365ProPlusRetail - en-us) (Version: 15.0.4753.1002 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 40.0.3 (x86 en-US) (HKLM\...\Mozilla Firefox 40.0.3 (x86 en-US)) (Version: 40.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 40.0.3.5716 - Mozilla)
Mozilla Thunderbird 31.7.0 (x86 en-US) (HKLM\...\Mozilla Thunderbird 31.7.0 (x86 en-US)) (Version: 31.7.0 - Mozilla)
MPC-HC 1.7.8 (HKLM\...\{2624B969-7135-4EB1-B0F6-2D8C397B45F7}_is1) (Version: 1.7.8 - MPC-HC Team)
MPEG Video Wizard DVD 5.0.1.111 (02/2014) (HKLM\...\{9FD45917-95E6-449D-ACC9-01E634A34CBD}_is1) (Version: 5.0.1.111 - Womble Multimedia, Inc.)
MPEG Video Wizard DVD 5.0.1.111 (02/2014) (HKLM\...\Mpeg Video Wizard DVD 5.0) (Version: 5.0.1.111 (02/2014) - Womble Multimedia, Inc.)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML4SP2 (HKLM\...\{451BB54C-8B23-4455-8BDC-14FC7D43E056}) (Version: 1.00.0000 - Logiciel Dr Tax Software Inc.)
Network Activity Indicator for Windows 7 - 8.1 (HKLM\...\NetworkIndicator_is1) (Version: 1.7 - ITSamples.com)
Notepad++ (HKLM\...\Notepad++) (Version: 6.7.5 - Notepad++ Team)
Office 15 Click-to-Run Extensibility Component (Version: 15.0.4753.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4753.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (Version: 15.0.4753.1002 - Microsoft Corporation) Hidden
OpenAL (HKLM\...\OpenAL) (Version:  - )
Palm Desktop by ACCESS (HKLM\...\{FD6034A3-655C-49F0-B496-D4CBFD74D7A7}) (Version: 6.4.0.0 - Palm, Inc.)
Paragon Go Virtual™ 2015 (HKLM\...\{1D81BF30-9EF6-11DF-9A33-005056C00008}) (Version: 90.00.0003 - Paragon Software)
Pdf995 (HKLM\...\Pdf995) (Version: 15.1s - )
PuTTY release 0.64 (HKLM\...\PuTTY_is1) (Version: 0.64 - Simon Tatham)
Quake (HKLM\...\Steam App 2310) (Version:  - id Software)
QuickTime 7 (HKLM\...\{80CEEB1E-0A6C-45B9-A312-37A1D25FDEBC}) (Version: 7.78.80.95 - Apple Inc.)
Skype™ 7.6 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.6.103 - Skype Technologies S.A.)
Soap 3.0 Toolkit (HKLM\...\{2C464EC1-2B0C-4490-9CAC-D4562DD8377A}) (Version: 1.00.0000 - Your Company Name)
SpaceChem (HKLM\...\Steam App 92800) (Version:  - Zachtronics)
Speccy (HKLM\...\Speccy) (Version: 1.28 - Piriform)
Steam (HKLM\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Transmission Remote GUI 5.0.1 (HKLM\...\transgui_is1) (Version:  - Yury Sidorov)
UFile 2014 (HKLM\...\{BAF69D89-5F75-4872-8389-74157F5E3087}) (Version: 18.20.0000 - Thomson Reuters DT Tax and Accounting Inc.)
UFile Updater 2014 (HKLM\...\{85DEECC9-38D1-4BA9-A8DD-09282CFB97C8}) (Version: 10.12.0010 - Thomson Reuters DT Tax and Accounting Inc.)
UltraVnc (HKLM\...\Ultravnc2_is1) (Version: 1.2.0.5 - uvnc bvba)
UnHackMe 7.77 (HKLM\...\UnHackMe_is1) (Version:  - Greatis Software, LLC.)
VLC media player (HKLM\...\VLC media player) (Version: 2.2.0 - VideoLAN)
VMware Player (HKLM\...\VMware_Player) (Version: 6.0.5 - VMware, Inc)
VMware Player (Version: 6.0.5 - VMware, Inc.) Hidden

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-225685578-4181334046-1023964479-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Jim\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-225685578-4181334046-1023964479-1000_Classes\CLSID\{0A368B9B-3566-4730-B40E-EAF6858A53AF}\InprocServer32 -> C:\Users\Jim\AppData\Local\Dropbox\Update\1.3.27.33\psuser.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-225685578-4181334046-1023964479-1000_Classes\CLSID\{3059C9E6-9EDC-4C89-933E-C65623F8FD60}\localserver32 -> C:\Users\Jim\AppData\Local\Dropbox\Update\DropboxUpdate.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-225685578-4181334046-1023964479-1000_Classes\CLSID\{87DC457B-B35D-48AC-BD42-BDF35EF623CE}\localserver32 -> C:\Users\Jim\AppData\Local\Dropbox\Update\1.3.27.33\DropboxUpdateOnDemand.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-225685578-4181334046-1023964479-1000_Classes\CLSID\{9FAA38ED-5635-44F7-9BE0-8CAFE29B3783}\localserver32 -> C:\Users\Jim\AppData\Local\Dropbox\Update\1.3.27.33\DropboxUpdateOnDemand.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-225685578-4181334046-1023964479-1000_Classes\CLSID\{C0DD324D-A74F-4533-84AD-030F76771C77}\localserver32 -> C:\Users\Jim\AppData\Local\Dropbox\Update\1.3.27.33\DropboxUpdateOnDemand.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-225685578-4181334046-1023964479-1000_Classes\CLSID\{C32E3EEC-3C10-426E-95F3-38C7F139FADD}\localserver32 -> C:\Users\Jim\AppData\Local\Dropbox\Update\1.3.27.33\DropboxUpdateOnDemand.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-225685578-4181334046-1023964479-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Jim\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-225685578-4181334046-1023964479-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jim\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-225685578-4181334046-1023964479-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jim\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-225685578-4181334046-1023964479-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jim\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-225685578-4181334046-1023964479-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jim\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-225685578-4181334046-1023964479-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jim\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-225685578-4181334046-1023964479-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jim\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-225685578-4181334046-1023964479-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jim\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-225685578-4181334046-1023964479-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jim\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-225685578-4181334046-1023964479-1000_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\Jim\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-225685578-4181334046-1023964479-1000_Classes\CLSID\{FE819BE5-BADF-4370-9913-6FB84ABA6FB1}\InprocServer32 -> C:\Users\Jim\AppData\Local\Dropbox\Update\1.3.27.33\psuser.dll (Dropbox, Inc.)

==================== Restore Points =========================

12-08-2015 07:53:46 Installed Paragon Go Virtual™ 2015.
12-08-2015 08:29:48 Windows Update
14-08-2015 20:23:20 Removed FineScale Modeler
19-08-2015 17:53:35 Windows Update
26-08-2015 09:27:42 Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030
31-08-2015 19:48:26 Installed DirectX
11-09-2015 16:37:05 Installed DIGIOPTICS SOFTWARE R&D CENTER
11-09-2015 16:51:43 Configured COOLINGTECH SOFTWARE R&D CENTER
12-09-2015 08:02:30 Windows Update
22-09-2015 18:08:35 Windows Update
22-09-2015 20:02:15 RegRun Virus Scan

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 22:04 - 2009-06-10 17:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {082C2CBF-82F3-425C-84BE-14B93F3A9E54} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2015-05-12] (Microsoft Corporation)
Task: {13C8BFA6-AF74-47E3-868D-3643FBD42FA9} - System32\Tasks\{07C5F2C2-E8EC-438E-8026-D08AB9832066} => pcalua.exe -a C:\Users\Jim\AppData\Local\Temp\Temp2_EasyWorship_2009.zip\EasyWorship2009_web.exe
Task: {2539DFAE-F716-47E6-BE20-E2A94CBA8BAC} - System32\Tasks\{8528321A-4D16-4443-87DF-6F1A5856F87C} => F:\GAMES\BOLO\BOLO3.EXE
Task: {2A23E159-D1FB-4F98-9365-8412648ED204} - System32\Tasks\{CB45B94C-6225-4BF8-A625-09F9CB96FC12} => F:\GAMES\BOLO\BOLO3.EXE
Task: {3347082A-BD23-4D36-ABF4-7134AEAEE824} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-08-11] (Microsoft Corporation)
Task: {36405ED0-1C31-4174-A1DB-779829C40D58} - System32\Tasks\{ABACA8AC-0AFB-4676-807D-91B36B5D496B} => F:\GAMES\BOLO\BOLO3.EXE
Task: {3F3DEC5D-DE73-476C-9921-6A222BCCF25A} - System32\Tasks\COMODO\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-08-07] (COMODO)
Task: {414DEE60-1278-415D-9DFB-3B999622C36F} - System32\Tasks\{57ED325A-C0DB-4260-BE1C-13BA1E04DD1E} => F:\GAMES\BOLO\BOLO3.EXE
Task: {6B1266BA-7FDB-4F9F-99BA-B8FBAE84741A} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX86\OfficeC2RClient.exe [2015-09-16] (Microsoft Corporation)
Task: {6C4CE9DB-0C8B-494D-BFC1-23816868288D} - System32\Tasks\COMODO\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-08-07] (COMODO)
Task: {739D8981-9310-47DB-926A-017E87A19A08} - System32\Tasks\{3B1CBB96-FBAD-4B70-BA5D-CF447EB49A79} => pcalua.exe -a C:\Users\Jim\Desktop\EasyWorship2009_web.exe -d C:\Users\Jim\Desktop
Task: {7858E113-1211-4560-AF28-5A3CECF99773} - System32\Tasks\{BE1679FC-8E6C-4944-9206-BEBA0B7A7016} => F:\GAMES\BOLO\BOLO3.EXE
Task: {7B296D86-5684-44ED-B9D8-989E3CB2805F} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2015-05-12] (Microsoft Corporation)
Task: {8A3F84F6-68A6-425B-B6D6-618081FAA4E6} - System32\Tasks\Core Temp Autostart Jim => C:\Program Files\Core Temp\Core Temp.exe [2015-03-27] ()
Task: {8CEF43DA-3A4B-4AF2-9737-22B03B3628BD} - System32\Tasks\COMODO\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-08-07] (COMODO)
Task: {93C56268-DE0F-4E35-B8E1-FBCB1F8E8E6C} - System32\Tasks\COMODO\COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [2015-08-07] (COMODO)
Task: {9E64A59F-BE36-471A-B988-84902A81E74C} - System32\Tasks\{47D43D59-4CB8-4079-A95E-D01E19012C0A} => F:\GAMES\ISLEWAR\ISLEWAR.EXE
Task: {B8051BEB-391A-41AB-A59C-5E54FE5B0B95} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-04-30] (Piriform Ltd)
Task: {BB8B699E-64C4-4067-BD30-FD46EFDE8545} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-225685578-4181334046-1023964479-1000Core => C:\Users\Jim\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-07-07] (Dropbox, Inc.)
Task: {D03F2FCA-7F3C-4F74-B3EC-E609DFA14F6B} - System32\Tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-08-07] (COMODO)
Task: {D39CC056-7D59-4155-BB16-11B7CBEA5405} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX86\OfficeC2RClient.exe [2015-09-16] (Microsoft Corporation)
Task: {D3EFD405-2B51-4A82-B945-35DC8FE541EA} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-225685578-4181334046-1023964479-1000UA => C:\Users\Jim\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-07-07] (Dropbox, Inc.)
Task: {DA18B6BD-9F5B-43E6-A273-7F321A4920C3} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-14] (Adobe Systems Incorporated)
Task: {E3097EDD-7AAE-493F-BA18-774F846E0A34} - System32\Tasks\GarminUpdaterTask => C:\Program Files\Garmin\Express Self Updater\ExpressSelfUpdater.exe [2015-07-04] ()
Task: {E3A69036-9068-4E1B-A8CE-0C7593C2D58E} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => Rundll32.exe invagent.dll,RunUpdate -noappraiser
Task: {E5ABA21A-B537-47C1-87A5-14CCD5BE617D} - System32\Tasks\UnHackMe Task Scheduler => C:\Program Files\UnHackMe\hackmon.exe [2015-09-22] (Greatis Software)
Task: {F6DE7A1A-0E4F-45EC-B022-DBB0390D3F38} - System32\Tasks\{DAF63332-7830-4042-8495-D6DE1B6872D7} => F:\GAMES\ANTRUN\ANTRUN.EXE

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-225685578-4181334046-1023964479-1000Core.job => C:\Users\Jim\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-225685578-4181334046-1023964479-1000UA.job => C:\Users\Jim\AppData\Local\Dropbox\Update\DropboxUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2015-04-23 16:15 - 2015-04-23 16:15 - 00036864 _____ () C:\Windows\System32\pdf995mon.dll
2015-02-13 04:20 - 2015-02-13 04:20 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-05-15 16:27 - 2015-05-15 16:27 - 01044776 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-03-30 10:47 - 2014-05-20 03:11 - 00080040 _____ () C:\Program Files\Microsoft Office 15\ClientX86\ApiClient.dll
2015-03-27 13:27 - 2015-03-27 13:27 - 00794272 _____ () C:\Program Files\Core Temp\Core Temp.exe
2015-01-16 18:15 - 2015-01-16 18:15 - 01301720 _____ () C:\Program Files\VMware\VMware Player\libxml2.dll
2015-09-16 05:23 - 2015-08-11 20:57 - 08900672 _____ () C:\Program Files\Microsoft Office 15\root\Office15\1033\GrooveIntlResource.dll
2013-10-01 10:26 - 2013-10-01 10:26 - 02627672 _____ () C:\Program Files\Acronis\TrueImageHome\tishell.dll
2013-10-01 11:00 - 2013-10-01 11:00 - 00022336 _____ () C:\Program Files\Acronis\TrueImageHome\ti_managers_proxy_stub.dll
2014-05-12 05:49 - 2014-05-12 05:49 - 00260608 _____ () C:\Program Files\Notepad++\NppShell_06.dll
2013-04-15 17:39 - 2015-01-08 18:02 - 00061152 _____ () C:\Program Files\COMODO\COMODO Internet Security\scanners\smart.cav
2014-08-19 21:03 - 2014-08-19 21:03 - 00036672 _____ () C:\Program Files\Acronis\TrueImageHome\qt_icontray_ex.dll
2014-08-19 21:03 - 2014-08-19 21:03 - 00028992 _____ () C:\Program Files\Common Files\Acronis\Home\thread_pool.dll
2015-09-11 16:38 - 2015-09-11 16:38 - 00049152 _____ () C:\Program Files\DIGIOPTICS SOFTWARE R&D CENTER\DIGIOPTICS SOFTWARE R&D CENTER\AVEOCamSDK.dll
2014-08-19 21:05 - 2014-08-19 21:05 - 00420160 _____ () C:\Program Files\Common Files\Acronis\Home\ulxmlrpcpp.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Windows\explorer.exe:$CmdTcID
AlternateDataStreams: C:\Windows\notepad.exe:$CmdTcID
AlternateDataStreams: C:\Windows\UNINST32.EXE:$CmdTcID
AlternateDataStreams: C:\Windows\system32\acmigration.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\adprovider.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\aeinv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\aepdu.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\aepic.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\aitstatic.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\appinfo.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\appraiser.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\audiodg.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AudioEng.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AUDIOKSE.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\AudioSes.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\audiosrv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\authui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\basesrv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\blackbox.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\capiprovider.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cdd.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\certcli.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\certenc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\certutil.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cewmdm.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ci.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\clfs.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\clfsw32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cngprovider.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CNMLM86.DLL:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CNQU70.DLL:$CmdTcID
AlternateDataStreams: C:\Windows\system32\coin95ip.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\comctl32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\CompatTelRunner.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\conhost.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\consent.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\credui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\crypt32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cryptnet.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cryptsp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cryptsvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\cryptui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d2d1.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3d10warp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DCompiler_33.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DCompiler_34.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DCompiler_35.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DCompiler_36.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DCompiler_37.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DCompiler_38.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DCompiler_39.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DCompiler_40.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DCompiler_41.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DCompiler_42.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DCompiler_43.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dcsx_42.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dcsx_43.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx10.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx10_33.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx10_34.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx10_35.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx10_36.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx10_37.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx10_38.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx10_39.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx10_40.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx10_41.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx10_42.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx10_43.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx11_42.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx11_43.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx9_24.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx9_25.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx9_26.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx9_27.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx9_28.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx9_29.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx9_30.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx9_31.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx9_32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx9_33.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx9_34.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx9_35.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\d3dx9_36.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DX9_37.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DX9_38.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DX9_39.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DX9_40.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DX9_41.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DX9_42.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\D3DX9_43.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\davclnt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\devinv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dfshim.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dimsroam.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\diskperf.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dns-sd.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dpapiprovider.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\drmmgrtn.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\drmv2clt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\DWrite.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dxmasf.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dxtmsft.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dxtrans.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\EncDump.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\esent.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\evr.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\FlashPlayerApp.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\FntCache.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\fsutil.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ftbusui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ftcserco.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ftd2xx.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\FTLang.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ftserui2.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\FWPUCLNT.DLL:$CmdTcID
AlternateDataStreams: C:\Windows\system32\gameux.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\gdi32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\GEARAspi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\generaltel.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\hccutils.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\hkcmd.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\icardagt.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\icardres.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ieapfltr.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iedkcs32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ieetwcollectorres.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ieframe.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iertutil.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iesetup.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ieui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ieUnatt.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ig4dev32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ig4icd32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igd10umd32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igdumd32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igdumdx32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxcfg.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxCoIn_v1930.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxcpl.cpl:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxdev.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxdo.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxexps.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxext.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxpers.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxpph.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxrara.lrc:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxrchs.lrc:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxrcht.lrc:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxrcsy.lrc:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxrdan.lrc:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxrdeu.lrc:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxrell.lrc:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxrenu.lrc:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxresp.lrc:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxress.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxrfin.lrc:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxrfra.lrc:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxrheb.lrc:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxrhun.lrc:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxrita.lrc:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxrjpn.lrc:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxrkor.lrc:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxrnld.lrc:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxrnor.lrc:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxrplk.lrc:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxrptb.lrc:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxrptg.lrc:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxrrus.lrc:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxrsky.lrc:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxrslv.lrc:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxrsve.lrc:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxrtha.lrc:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxrtrk.lrc:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxsrvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxsrvc.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxTMM.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igfxtray.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\igxpun.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\IKEEXT.DLL:$CmdTcID
AlternateDataStreams: C:\Windows\system32\inetcpl.cpl:$CmdTcID
AlternateDataStreams: C:\Windows\system32\infocardapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\invagent.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iphlpsvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\jscript.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\jscript9.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\jscript9diag.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\jsproxy.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\KBDBASH.DLL:$CmdTcID
AlternateDataStreams: C:\Windows\system32\KBDRU.DLL:$CmdTcID
AlternateDataStreams: C:\Windows\system32\KBDRU1.DLL:$CmdTcID
AlternateDataStreams: C:\Windows\system32\KBDTAT.DLL:$CmdTcID
AlternateDataStreams: C:\Windows\system32\KBDYAK.DLL:$CmdTcID
AlternateDataStreams: C:\Windows\system32\kernel32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\KernelBase.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\LCCoin30.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\LCCoin32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\LcProxy.ax:$CmdTcID
AlternateDataStreams: C:\Windows\system32\localspl.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\LogiLDA.DLL:$CmdTcID
AlternateDataStreams: C:\Windows\system32\logman.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mcupdate_GenuineIntel.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mf.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mfc42.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mfc42u.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mferror.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mfplat.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mfpmp.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mfps.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mscorier.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mscories.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msdrm.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msdxm.ocx:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msfeeds.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mshtml.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MshtmlDac.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mshtmled.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mshtmlmedia.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msiexec.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msihnd.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msimsg.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msmmsp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msmpeg2vdec.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msnetobj.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msrating.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MsRdpWebAccess.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msscp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mstsc.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msvcrt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\N067UFW.DLL:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ncsi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\netcorehc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\netevent.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\nlaapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\nlasvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\notepad.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\nshwfp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ntshrui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\nx6000res.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\objsel.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\odbccp32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\odbccr32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\odbccu32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\odbcjt32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\odbctrac.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\oemdspif.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ole32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\oleaut32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\OpenAL32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\OxpsConverter.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\packager.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\partizan.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\pcadm.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\pcaevts.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\pcalua.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\pcasvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\pcawrk.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\perftrack.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\pku2u.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\powertracker.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\qdvd.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\quartz.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\RaCoInst.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\rdpcore.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\rdpcorekmts.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\rdpcorets.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\rdpendp_winip.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\RdpGroupPolicyExtension.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\rdpudd.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\rdpwsx.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\rdrmemptylst.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\rdvidcrl.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\relog.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\RMActivate.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\RMActivate_isv.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\RMActivate_ssp.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\RMActivate_ssp_isv.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\rrinstaller.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\scesrv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\sechost.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\secproc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\secproc_isv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\secproc_ssp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\secproc_ssp_isv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\services.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\shell32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\SmartcardCredentialProvider.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\spoolsv.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\spwmp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\synceng.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\sysmain.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\termsrv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\tmp7D76.tmp:$CmdTcID
AlternateDataStreams: C:\Windows\system32\tmp7D76.tmp:$CmdZnID
AlternateDataStreams: C:\Windows\system32\tmp7D86.tmp:$CmdTcID
AlternateDataStreams: C:\Windows\system32\tmp7D86.tmp:$CmdZnID
AlternateDataStreams: C:\Windows\system32\tracerpt.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\tsgqec.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\TsUsbGDCoInstaller.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\TSWbPrxy.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\TsWpfWrp.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\TVWizudlg.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\TVWSetup.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\typeperf.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\tzres.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ubpm.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\UCS32P.DLL:$CmdTcID
AlternateDataStreams: C:\Windows\system32\urlmon.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\usbaaplrc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\usp10.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\vbscript.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\vmnat.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\vmnetbridge.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\vmnetdhcp.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\vnetinst.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Vxdif.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Vxdif.dll:$CmdZnID
AlternateDataStreams: C:\Windows\system32\WdfCoInstaller01005.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Wdfres.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\wdi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\WebClnt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\wer.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\win32spl.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\wincredprovider.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\WindowsCodecs.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\wininet.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\winload.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\winlogon.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\winresume.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\WinSetupUI.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\winsrv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\winsta.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\wintrust.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\wksprt.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\wksprtPS.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\wmdrmsdk.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\wmi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\wmp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\WMPhoto.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\wmploc.DLL:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Wpc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\wpdshext.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\wrap_oal.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\WSManHTTPConfig.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\WSManMigrationPlugin.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\WsmAuto.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\WsmSvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\WsmWmiPl.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\wu.upgrade.ps.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\wuapi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\wuapp.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\wuauclt.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\wuaueng.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\wucltux.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\WUDFCoinstaller.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\WUDFHost.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\WUDFPlatform.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\WUDFSvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\WUDFx.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\wudriver.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\wups.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\wups2.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\wuwebv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\wwanprotdim.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\wwansvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\x3daudio1_0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\x3daudio1_1.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\X3DAudio1_2.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\X3DAudio1_3.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\X3DAudio1_4.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\X3DAudio1_5.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\X3DAudio1_6.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\X3DAudio1_7.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\xactengine2_0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\xactengine2_1.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\xactengine2_10.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\xactengine2_2.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\xactengine2_3.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\xactengine2_4.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\xactengine2_5.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\xactengine2_6.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\xactengine2_7.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\xactengine2_8.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\xactengine2_9.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\xactengine3_0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\xactengine3_1.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\xactengine3_2.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\xactengine3_3.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\xactengine3_4.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\xactengine3_5.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\xactengine3_6.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\xactengine3_7.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\XAPOFX1_0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\XAPOFX1_1.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\XAPOFX1_2.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\XAPOFX1_3.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\XAPOFX1_4.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\XAPOFX1_5.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\XAudio2_0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\XAudio2_1.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\XAudio2_2.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\XAudio2_3.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\XAudio2_4.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\XAudio2_5.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\XAudio2_6.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\XAudio2_7.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\xinput1_1.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\xinput1_2.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\xinput1_3.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\afcdp.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\afd.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\amdsata.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\amdxata.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\Apfiltr.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\Apfiltr.sys:$CmdZnID
AlternateDataStreams: C:\Windows\system32\Drivers\ataport.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\athr.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\bowser.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\cng.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\DKbFltr.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\dxgkrnl.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\dxgmms1.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\fltsrv.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\fs_rec.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\ftdibus.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\ftser2k.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\GEARAspiWDM.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\hidclass.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\hidparse.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\http.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\iaStorV.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\igdkmd32.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\mbam.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\mbamchameleon.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\mountmgr.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\mrxdav.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\mwac.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\nvraid.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\nvstor.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\nx6000.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\PalmUSBD.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\partmgr.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\PEAuth.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\rdpvideominiport.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\rdpwd.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\rt2870.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\snapman.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\stream.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\tcpipreg.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\tdrpman.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\tdtcp.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\tib.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\tib_mounter.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\tssecsrv.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\TsUsbFlt.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\UnHackMeDrv.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\usbaapl.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\USBAUDIO.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\usbccgp.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\usbcir.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\usbd.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\usbehci.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\usbhub.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\usbport.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\usbscan.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\USBSTOR.SYS:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\usbuhci.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\usbvideo.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\vididr.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\vidsflt.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\vmci.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\vmnetadapter.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\vmnetbridge.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\Wdf01000.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\WdfLdr.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\WUDFPf.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\WUDFRd.sys:$CmdTcID
AlternateDataStreams: C:\Users\Jim\Desktop\backup continue.bat:$CmdTcID
AlternateDataStreams: C:\Users\Jim\Desktop\DIR-850L_REVB_FIRMWARE_PATCH_2.05.B01_WW.ZIP:$CmdTcID
AlternateDataStreams: C:\Users\Jim\Desktop\DIR-850L_REVB_FIRMWARE_PATCH_2.05.B01_WW.ZIP:$CmdZnID
AlternateDataStreams: C:\Users\Jim\Desktop\DPFMate.exe:$CmdTcID
AlternateDataStreams: C:\Users\Jim\Desktop\EasyWorshipLicense.ewl:$CmdTcID
AlternateDataStreams: C:\Users\Jim\Desktop\EasyWorshipLicense.ewl:$CmdZnID
AlternateDataStreams: C:\Users\Jim\Desktop\EasyWorship_web.zip:$CmdTcID
AlternateDataStreams: C:\Users\Jim\Desktop\EasyWorship_web.zip:$CmdZnID
AlternateDataStreams: C:\Users\Jim\Desktop\Ironman Power Repulsor Complete set.mp3:$CmdZnID
AlternateDataStreams: C:\Users\Jim\Desktop\MediaCreationTool.exe:$CmdZnID
AlternateDataStreams: C:\Users\Jim\Desktop\RCC Insurance Inspection Report_May 2015.pdf:$CmdZnID
AlternateDataStreams: C:\Users\Jim\Desktop\restore continue.bat:$CmdTcID
AlternateDataStreams: C:\Users\Jim\Desktop\serials.txt:$CmdZnID
AlternateDataStreams: C:\Users\Jim\Desktop\Tired_Dunstan.mp4:$CmdTcID
AlternateDataStreams: C:\Users\Jim\Desktop\Tired_Dunstan.mp4:$CmdZnID
AlternateDataStreams: C:\Users\Jim\Desktop\transistor-tester.pdf:$CmdTcID
AlternateDataStreams: C:\Users\Jim\Desktop\transistor-tester.pdf:$CmdZnID
AlternateDataStreams: C:\Users\Jim\Desktop\unhackmeb.zip:$CmdTcID
AlternateDataStreams: C:\Users\Jim\Desktop\usr_attachment_U500X_Digital_Microscope_User_Manual.pdf:$CmdTcID
AlternateDataStreams: C:\Users\Jim\Desktop\usr_attachment_U500X_Digital_Microscope_User_Manual.pdf:$CmdZnID
AlternateDataStreams: C:\Users\Jim\Downloads\ART84344541_GFDlx_UG_UK-CA_EN_R03-12.pdf:$CmdZnID
AlternateDataStreams: C:\Users\Jim\Downloads\dravisbuildingsfreeplans.pdf:$CmdTcID
AlternateDataStreams: C:\Users\Jim\Downloads\dravisbuildingsfreeplans.pdf:$CmdZnID
AlternateDataStreams: C:\Users\Jim\Downloads\EasyBCD 2.2.exe:$CmdTcID
AlternateDataStreams: C:\Users\Jim\Downloads\EasyBCD 2.2.exe:$CmdZnID
AlternateDataStreams: C:\Users\Jim\Downloads\EasyWorship_web.zip:$CmdTcID
AlternateDataStreams: C:\Users\Jim\Downloads\EasyWorship_web.zip:$CmdZnID
AlternateDataStreams: C:\Users\Jim\Downloads\Microsoft Windows 98 Second Edition.7z:$CmdTcID
AlternateDataStreams: C:\Users\Jim\Downloads\Microsoft Windows 98 Second Edition.7z:$CmdZnID
AlternateDataStreams: C:\Users\Jim\Downloads\Paragon-415-PEE_WinInstall_10.1.25.763_000.exe:$CmdTcID
AlternateDataStreams: C:\Users\Jim\Downloads\Paragon-415-PEE_WinInstall_10.1.25.763_000.exe:$CmdZnID
AlternateDataStreams: C:\Users\Jim\Downloads\Repulsor.zip:$CmdZnID
AlternateDataStreams: C:\Users\Jim\Downloads\SleepyHead-Testing-0.9.8-1-Windows-64bit.7z:$CmdTcID
AlternateDataStreams: C:\Users\Jim\Downloads\SleepyHead-Testing-0.9.8-1-Windows-64bit.7z:$CmdZnID
AlternateDataStreams: C:\Users\Jim\Downloads\TeamViewerQS_en-jex.exe:$CmdTcID
AlternateDataStreams: C:\Users\Jim\Downloads\TeamViewerQS_en-jex.exe:$CmdZnID
AlternateDataStreams: C:\Users\Jim\Downloads\TeamViewer_Host_Setup-jex.exe:$CmdTcID
AlternateDataStreams: C:\Users\Jim\Downloads\TeamViewer_Host_Setup-jex.exe:$CmdZnID
AlternateDataStreams: C:\Users\Jim\Downloads\TeamViewer_Setup.exe:$CmdTcID
AlternateDataStreams: C:\Users\Jim\Downloads\TeamViewer_Setup.exe:$CmdZnID
AlternateDataStreams: C:\Users\Jim\Downloads\VMware-player-6.0.5-2443746.exe:$CmdTcID
AlternateDataStreams: C:\Users\Jim\Downloads\VMware-player-6.0.5-2443746.exe:$CmdZnID
AlternateDataStreams: C:\Users\Jim\Downloads\WindowsXPMode_en-us.exe:$CmdTcID
AlternateDataStreams: C:\Users\Jim\Downloads\WindowsXPMode_en-us.exe:$CmdZnID
AlternateDataStreams: C:\Users\Jim\AppData\Local\nshDC4E.tmp:$CmdTcID
AlternateDataStreams: C:\Users\Jim\Documents\Alice list 2014.wpd:$CmdTcID
AlternateDataStreams: C:\Users\Jim\Documents\Alice list 2014.wpd:$CmdZnID
AlternateDataStreams: C:\Users\Jim\Documents\digital_wood_joints.pdf:$CmdZnID
AlternateDataStreams: C:\Users\Jim\Documents\dir-850l-config.bin:$CmdZnID
AlternateDataStreams: C:\Users\Jim\Documents\healthplansbenenfits.pdf:$CmdTcID
AlternateDataStreams: C:\Users\Jim\Documents\healthplansbenenfits.pdf:$CmdZnID
AlternateDataStreams: C:\Users\Jim\Documents\Management Team Minutes from Dec 8, 2014.doc:$CmdZnID
AlternateDataStreams: C:\Users\Jim\Documents\nas-shutdown.bat:$CmdTcID
AlternateDataStreams: C:\Users\Jim\Documents\set_2015-01-03_10_26_29.tgz:$CmdTcID
AlternateDataStreams: C:\Users\Jim\Documents\set_2015-01-03_10_26_29.tgz:$CmdZnID
AlternateDataStreams: C:\Users\Jim\Documents\wget.exe:$CmdTcID

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE restricted site: HKU\S-1-5-21-225685578-4181334046-1023964479-1000\...\skype.com -> hxxps://apps.skype.com

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-225685578-4181334046-1023964479-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Jim\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 8.8.8.8
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)
Windows Firewall is disabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: AcronisTibMounterMonitor => C:\Program Files\Common Files\Acronis\TibMounter\TibMounterMonitor.exe
MSCONFIG\startupreg: LifeCam => "C:\Program Files\Microsoft LifeCam\LifeExp.exe"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{5E087981-199D-4072-A402-7A71780D9CD1}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{8BF0A84C-5C1F-4A0E-BC4F-39BA443ADBA6}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{B99CF408-DC62-43C9-BA41-0761654A2F89}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{5AFF6D3D-A3BD-4F98-AB50-12DC1D0BB1BD}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{EDBF6D21-F552-4E82-A72F-910218677D54}] => (Allow) C:\Program Files\Steam\Steam.exe
FirewallRules: [{AD70E1EA-CD9C-4B53-98AF-FEC279330BDB}] => (Allow) C:\Program Files\Steam\Steam.exe
FirewallRules: [{0C1C4187-57CE-409A-8B4E-3D4D319FCC9D}] => (Allow) C:\Program Files\uvnc bvba\UltraVNC\vncviewer.exe
FirewallRules: [{15458B64-619F-4792-AA5A-3B58BA222F00}] => (Allow) C:\Program Files\uvnc bvba\UltraVNC\vncviewer.exe
FirewallRules: [{3F3AC6AE-B38C-4B94-A033-11CCFE59B393}] => (Allow) C:\Program Files\Steam\bin\steamwebhelper.exe
FirewallRules: [{4458266E-8A8E-4808-BF2E-3715120CB67D}] => (Allow) C:\Program Files\Steam\bin\steamwebhelper.exe
FirewallRules: [{454E4A7D-785C-41D2-872C-DCFFA162F214}] => (Allow) D:\SteamLibrary\steamapps\common\Quake\Winquake.exe
FirewallRules: [{A777F77F-88E3-4105-9DC9-D1C51C64A283}] => (Allow) D:\SteamLibrary\steamapps\common\Quake\Winquake.exe
FirewallRules: [{B8B8B3E3-5D6E-4CEF-9AE3-E81190AF415C}] => (Allow) D:\SteamLibrary\steamapps\common\Quake\qwcl.exe
FirewallRules: [{4D52478F-D4F6-4E46-8BA3-A7EC8158CFB8}] => (Allow) D:\SteamLibrary\steamapps\common\Quake\qwcl.exe
FirewallRules: [{4FFE4C9E-F374-4E3E-B63B-D47B894502D5}] => (Allow) D:\SteamLibrary\steamapps\common\Quake\Glquake.exe
FirewallRules: [{93597B57-6E9F-4805-8E6F-EE1800808D7F}] => (Allow) D:\SteamLibrary\steamapps\common\Quake\Glquake.exe
FirewallRules: [{F43B134A-011F-47AD-B4D2-C5B6533F9B45}] => (Allow) D:\SteamLibrary\steamapps\common\Quake\glqwcl.exe
FirewallRules: [{187E4CEB-7EBF-4FD3-95F1-CE2C2923387E}] => (Allow) D:\SteamLibrary\steamapps\common\Quake\glqwcl.exe
FirewallRules: [{683F9336-4E16-419C-A56D-DFA7C7A256BF}] => (Allow) D:\SteamLibrary\steamapps\common\SpaceChem\SpaceChem.exe
FirewallRules: [{95DBDCE3-8479-4C75-B1AB-A7647AD84DD3}] => (Allow) D:\SteamLibrary\steamapps\common\SpaceChem\SpaceChem.exe
FirewallRules: [{870802C3-A309-4162-8784-10F499B249A2}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [{7810E564-71D6-4566-9A3E-FC36D1E721C6}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{5F30B1D7-C8D7-47C3-80A3-00F64B785CA0}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe
FirewallRules: [{ECB5D013-DA39-41E1-9298-5E53E346C6FE}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe
FirewallRules: [{3B588E61-D0A0-4C36-8682-8D8AB4715DF0}] => (Allow) C:\Program Files\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{B1AB5CC0-F0F6-4E67-8D14-BFF1FC782B22}] => (Allow) C:\Program Files\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{41D0C6D9-1D29-4B33-AFA2-3FA236111A8D}] => (Allow) C:\Users\Jim\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{E8383221-CB6A-4514-9E27-B8B3A6D43747}] => (Allow) C:\Users\Jim\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{EB309AE1-F37A-49BD-8CC9-58065B529B0B}] => (Allow) C:\Program Files\VMware\VMware Player\vmware-authd.exe
FirewallRules: [{88D5E67B-7352-4B02-B0F2-F6A55A75B8A6}] => (Allow) C:\Program Files\VMware\VMware Player\vmware-authd.exe
FirewallRules: [{6ED9A75F-F153-453D-AF3A-0E9B82AF00E3}] => (Allow) C:\Users\Jim\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{6AAF9524-A45D-47C1-B457-679A495CED74}] => (Allow) C:\Users\Jim\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{20C8EA97-59A6-4E0E-AAE6-4D22F82D4F97}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe
FirewallRules: [{33977263-849F-4A09-9800-551AF3DDCE8B}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe
FirewallRules: [{BD8E89AF-780A-4F35-8A77-681B7FA0B8BB}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe
FirewallRules: [{4E0F4854-0A3C-4A14-A08B-7E6E5090212F}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeCam.exe
FirewallRules: [{C42BDA36-3388-4A7D-A437-7F6C6C7B8582}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeCam.exe
FirewallRules: [{355D8A95-49BC-4C0F-B718-BD5D692D504B}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeEnC2.exe
FirewallRules: [{4DED53EC-5DA4-4D3C-9166-31FA8F3EDD73}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeEnC2.exe
FirewallRules: [{99E0F741-7152-406D-B805-4C82FF4463FB}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeExp.exe
FirewallRules: [{0BB32FA7-AB00-456A-B32E-8656AE2DD5FB}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeExp.exe
FirewallRules: [{637EFC9A-7939-44B9-B409-E2DAF5D6D711}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeTray.exe
FirewallRules: [{E04296E0-2A78-4883-A1DA-9E9855FECA67}] => (Allow) C:\Program Files\Microsoft LifeCam\LifeTray.exe
FirewallRules: [{DF91DDF1-3AD8-462D-9F9F-849F3E966F16}] => (Allow) C:\Program Files\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{9CA1986E-229E-46B1-BC9C-1BFE3AA7F3E2}] => (Allow) C:\Program Files\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{900F833E-7150-49BB-8FC7-3879F0031BE5}] => (Allow) C:\Program Files\iTunes\iTunes.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (09/23/2015 01:32:55 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/23/2015 05:19:53 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Client application bug: DNSServiceResolve(90:84:0d:c5:2d:6e@fe80::9284:dff:fec5:2d6e._apple-mobdev._tcp.local.) active for over two minutes. This places considerable burden on the network.

Error: (09/23/2015 05:19:53 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Client application bug: DNSServiceResolve(90:84:0d:c5:2d:6e@fe80::9284:dff:fec5:2d6e._apple-mobdev._tcp.local.) active for over two minutes. This places considerable burden on the network.

Error: (09/23/2015 05:19:53 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Client application bug: DNSServiceResolve(90:84:0d:c5:2d:6e@fe80::9284:dff:fec5:2d6e._apple-mobdev._tcp.local.) active for over two minutes. This places considerable burden on the network.

Error: (09/23/2015 05:17:39 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/23/2015 05:17:36 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: ERROR: handle_resolve_request bad interfaceIndex 24

Error: (09/23/2015 05:17:36 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: ERROR: handle_resolve_request bad interfaceIndex 23

Error: (09/23/2015 05:17:36 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: ERROR: handle_resolve_request bad interfaceIndex 22

Error: (09/23/2015 05:17:36 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: ERROR: handle_resolve_request bad interfaceIndex 21

Error: (09/23/2015 05:17:36 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: ERROR: handle_resolve_request bad interfaceIndex 20


System errors:
=============
Error: (09/23/2015 01:31:20 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Garmin Core Update Service service failed to start due to the following error:
%%1053

Error: (09/23/2015 01:31:20 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (60000 milliseconds) while waiting for the Garmin Core Update Service service to connect.

Error: (09/23/2015 01:31:04 PM) (Source: Microsoft-Windows-Kernel-Processor-Power) (EventID: 35) (User: NT AUTHORITY)
Description: Performance power management features on processor 1 in group 0 are disabled due to a firmware problem. Check with the computer manufacturer for updated firmware.

Error: (09/23/2015 01:31:04 PM) (Source: Microsoft-Windows-Kernel-Processor-Power) (EventID: 35) (User: NT AUTHORITY)
Description: Performance power management features on processor 0 in group 0 are disabled due to a firmware problem. Check with the computer manufacturer for updated firmware.

Error: (09/23/2015 05:16:03 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Garmin Core Update Service service failed to start due to the following error:
%%1053

Error: (09/23/2015 05:16:03 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (60000 milliseconds) while waiting for the Garmin Core Update Service service to connect.

Error: (09/23/2015 05:15:49 AM) (Source: Microsoft-Windows-Kernel-Processor-Power) (EventID: 35) (User: NT AUTHORITY)
Description: Performance power management features on processor 1 in group 0 are disabled due to a firmware problem. Check with the computer manufacturer for updated firmware.

Error: (09/23/2015 05:15:49 AM) (Source: Microsoft-Windows-Kernel-Processor-Power) (EventID: 35) (User: NT AUTHORITY)
Description: Performance power management features on processor 0 in group 0 are disabled due to a firmware problem. Check with the computer manufacturer for updated firmware.

Error: (09/22/2015 08:28:05 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Garmin Core Update Service service failed to start due to the following error:
%%1053

Error: (09/22/2015 08:28:05 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (60000 milliseconds) while waiting for the Garmin Core Update Service service to connect.


==================== Memory info ===========================

Processor: Intel® Core™2 Duo CPU T8300 @ 2.40GHz
Percentage of memory in use: 44%
Total physical RAM: 3061.98 MB
Available physical RAM: 1693.81 MB
Total Virtual: 6122.28 MB
Available Virtual: 4668.13 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:200.2 GB) (Free:28.93 GB) NTFS
Drive d: (Data) (Fixed) (Total:429.69 GB) (Free:231.47 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 698.6 GB) (Disk ID: B60C82BF)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=200.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=429.7 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=68.7 GB) - (Type=05)

==================== End of Addition.txt ============================

 

Thanks,

 

Jim Dearden


  • 0

Advertisements

#2
Essexboy
Posted 26 September 2015 - 05:53 AM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Hi there looks pretty clean apart from the odd line

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint:
2015-09-22 17:42 - 2015-09-22 17:48 - 00000008 _____ C:\END
RemoveProxy:
EmptyTemp:
CMD: bitsadmin /reset /allusers


Save this as fixlist.txt, in the same location as FRST.exe
FRSTfix.JPG
Run FRST and press Fix
On completion a log will be generated please post that

THEN

Please download AdwCleaner by Xplode onto your desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Scan.
  • After the scan is complete click on "Clean"
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next answer.
  • You can find the logfile at C:\AdwCleaner[Cx].txt as well.

  • 0

#3
Jim Dearden
Posted 26 September 2015 - 06:22 PM

Jim Dearden

    Member

  • Topic Starter
  • Member
  • PipPip
  • 37 posts

Hi Essexboy, thanks for the help!

 

Fixlog.txt follows...

 

---------------------------------------------------------------------------------------------

 

Fix result of Farbar Recovery Scan Tool (x86) Version:23-09-2015
Ran by Jim (2015-09-26 20:16:47) Run:1
Running from C:\Users\Jim\Desktop
Loaded Profiles: Jim (Available Profiles: Jim)
Boot Mode: Normal

==============================================

fixlist content:
*****************
CreateRestorePoint:
2015-09-22 17:42 - 2015-09-22 17:48 - 00000008 _____ C:\END
RemoveProxy:
EmptyTemp:
CMD: bitsadmin /reset /allusers
*****************

Restore point was successfully created.
C:\END => moved successfully

========= RemoveProxy: =========

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully.
HKU\S-1-5-21-225685578-4181334046-1023964479-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully.
HKU\S-1-5-21-225685578-4181334046-1023964479-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully.


========= End of RemoveProxy: =========


=========  bitsadmin /reset /allusers =========


BITSADMIN version 3.0 [ 7.5.7601 ]
BITS administration utility.
© Copyright 2000-2006 Microsoft Corp.

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

Unable to cancel {7DA63642-EA14-49F4-8AF0-CB3D566991FE}.
{6444E481-16E6-40C5-A6C5-9A7A25BAD6DC} canceled.
{24E70700-982C-411B-B630-2BBB8911214F} canceled.
{30BF9D18-37E4-46E9-8016-CA33500EF376} canceled.
{DD9A020B-9584-4766-8D1B-4B532EA93ED4} canceled.
4 out of 5 jobs canceled.

========= End of CMD: =========

EmptyTemp: => 341.4 MB temporary data Removed.


The system needed a reboot.

==== End of Fixlog 20:17:50 ====

 

Thanks,

 

Jim


  • 0

#4
Jim Dearden
Posted 26 September 2015 - 06:31 PM

Jim Dearden

    Member

  • Topic Starter
  • Member
  • PipPip
  • 37 posts

Hi Essexboy,

 

results from AdwCleaner...

 

-------------------------------------------

 

# AdwCleaner v5.008 - Logfile created 26/09/2015 at 20:26:22
# Updated 18/09/2015 by Xplode
# Database : 2015-09-23.1 [Server]
# Operating system : Windows 7 Professional Service Pack 1 (x86)
# Username : Jim - JIM-LAPTOP
# Running from : C:\Users\Jim\Desktop\AdwCleaner.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****


***** [ Files ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****


***** [ Web browsers ] *****

[-] [C:\Users\Jim\AppData\Roaming\Mozilla\Firefox\Profiles\tbcrmzbf.default\prefs.js] [Preference] Deleted : user_pref("browser.newtabpage.pinned", "[{\"url\":\"hxxp://www.biblegateway.com/\",\"title\":\"BibleGateway.com: A searchable online Bible in over 100 versions and 50 languages.\"},null,null,null,{\"u[...]

*************************

:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [935 bytes] ##########
 


  • 0

#5
Essexboy
Posted 27 September 2015 - 04:30 AM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Are any problems apparent ?
  • 0

#6
Jim Dearden
Posted 28 September 2015 - 05:21 AM

Jim Dearden

    Member

  • Topic Starter
  • Member
  • PipPip
  • 37 posts

Are any problems apparent ?

Hi,

 

no no problems with the system, seems to be running ok.

 

Jim


  • 0

#7
Essexboy
Posted 28 September 2015 - 08:14 AM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Subject to no further problems :)

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean :thumbsup:

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:

Remove tools

Download and run Delfix
Select the options as shown
delfix.JPG


: Keep Java Updated :

WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java
See this article

I would recommend that you completely uninstall Java unless you need it to run an important software.
In that instance I would recommend that you disable Java in your browsers until you need it for that software and then enable it. (See How to diasble Java in your web browser and How to unplug Java from the browser)

If you do need to keep Java then download JavaRa
Run the programme and select Remove Java Runtime. Uninstall all versions of Java present
Once done then run it again and select Update Java runtime > Download and install Latest version
javara.JPG


Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

CryptoPrevent install this programme to lock down and prevent crypto ransome ware

CryptoPrevent.JPG

Malwarebytes

Update and run weekly to keep your system clean

Unchecky

Click on the link above to be taken to Unchecky.com
click the very large Download button.
click Save
Click Open folder
Right click on the Unchecky_setup and choose to Run as Administrator
Once open click the Install button.
Then click on Finish
Unchecky is now installed and will help you keep unwanted check boxes unchecked, this is a fire and forget programme ;)

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To learn more about how to protect yourself while on the internet read this little guide Best security practices Keep safe :wave:
  • 0

#8
Jim Dearden
Posted 28 September 2015 - 06:58 PM

Jim Dearden

    Member

  • Topic Starter
  • Member
  • PipPip
  • 37 posts

thanks Essexboy! All seems well, thank you for the help and info.

 

Jim Dearden


  • 0

#9
Essexboy
Posted 29 September 2015 - 07:50 AM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
:)
  • 0

#10
Essexboy
Posted 03 October 2015 - 06:50 AM

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.


  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP