[Braind]

No, it still will not download due to a virus. Again, when I try to download I get a message from Windows Defender saying g it found malware and is removing it (which it fails to do).

[Advertisements]

Have you tried re- starting the computer, then try FRST again.

If does not work disable windows defender for a bit.

Have to call it a nite, getting late here.

Thanks
Joe

[zep516]

Have you tried re- starting the computer, then try FRST again.

If does not work disable windows defender for a bit.

Have to call it a nite, getting late here.

Thanks
Joe

[Braind]

Thanks.

Yes I restarted my PC before I tried the download.

Tomorrow, I will be at work until around 5:30 PM CDT or so and I won't be able to come back to work on this until then. Good Night.

[zep516]

It looks like you have Sophos Home Anti Virus installed. Will that run or scan ?

[Braind]

I did everything again; same result, adware still present. Windows Defender found and deleted a trojan virus.

 

Fixlog:

 

Fix result of Farbar Recovery Scan Tool (x64) Version: 31-08-2016

Ran by Brian (12-09-2016 08:18:27) Run:1

Running from C:\Users\Brian\Desktop

Loaded Profiles: Brian (Available Profiles: Brian & DefaultAppPool)

Boot Mode: Normal

==============================================

 

fixlist content:

*****************

start

CloseProcesses:

CreateRestorePoint:

HKLM-x32\...\Run: [] => [X]

HKU\S-1-5-21-1563961910-250262785-1644635927-1001\Software MICROSOFT\Internet Explorer\Main,Start Page = hxxps://www.yahoo.com/?fr=yset_ie_syc_oracle&type=orcl_hpset

SearchScopes: HKLM -> OldSearch URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox

SearchScopes: HKLM -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF

SearchScopes: HKLM -> {C46296C9-9FB6-4509-8294-68FA8F44E6DB} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}

SearchScopes: HKLM -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://en.wikipedia.org/wiki SPECIAL:Search?search={searchTerms}

SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-30572-11896-1/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}

SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox

SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox

SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF

SearchScopes: HKLM-x32 -> {C46296C9-9FB6-4509-8294-68FA8F44E6DB} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}

SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://en.wikipedia.org/wiki/Special:Search?search={searchTerms}

SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-30572-11896-1/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}

SearchScopes: HKU\S-1-5-21-1563961910-250262785-1644635927-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com SEARCH?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox

SearchScopes: HKU\S-1-5-21-1563961910-250262785-1644635927-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox

SearchScopes: HKU\S-1-5-21-1563961910-250262785-1644635927-1001 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = 

SearchScopes: HKU\S-1-5-21-1563961910-250262785-1644635927-1001 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF

SearchScopes: HKU\S-1-5-21-1563961910-250262785-1644635927-1001 -> {C46296C9-9FB6-4509-8294-68FA8F44E6DB} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}

SearchScopes: HKU\S-1-5-21-1563961910-250262785-1644635927-1001 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://en.wikipedia.org/wiki/Special:Search?search={searchTerms}

SearchScopes: HKU\S-1-5-21-1563961910-250262785-1644635927-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-30572-11896-1/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}

SearchScopes: HKU\S-1-5-21-1563961910-250262785-1644635927-1001 -> {F2B5E2C6-4DFD-420A-80B7-6DDC3D8989CA} URL = hxxps://search.yahoo.com/search?p={searchTerms}&fr=yset_ie_syc_oracle&type=orcl_default

SearchScopes: HKU\S-1-5-21-1563961910-250262785-1644635927-1001 -> {F813F595-1DA6-4476-915D-E3C2FDF0B758} URL = hxxp://www GOOGLE.com/cse?cx=partner-pub-6697027465779297:3144322079&ie=ISO-8859-1&sa=Search&q={searchTerms}

C:\ProgramData\fontcacheev1.dat

Task: {1FCFDC38-73AA-4DD7-87D9-99A1ABEE1600} - \OfficeSoftwareProtectionPlatform\SvcRestartTask -> No File <==== ATTENTION

AlternateDataStreams: C:\ProgramData\Temp:5C321E34 [125]

HKLM SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SAVService => ""="service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SAVService => ""="service"

CMD: bitsadmin /reset /allusers

CMD: netsh winsock reset catalog

CMD: ipconfig /flushdns

RemoveProxy:

hosts:

Emptytemp:

*****************

 

Processes closed successfully.

Restore point was successfully created.

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value removed successfully

HKU\S-1-5-21-1563961910-250262785-1644635927-1001\Software\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully

"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\OldSearch" => key removed successfully

HKCR\CLSID\OldSearch => key not found. 

"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}" => key removed successfully

HKCR\CLSID\{b7fca997-d0fb-4fe0-8afd-255e89cf9671} => key not found. 

"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C46296C9-9FB6-4509-8294-68FA8F44E6DB}" => key removed successfully

HKCR\CLSID\{C46296C9-9FB6-4509-8294-68FA8F44E6DB} => key not found. 

"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}" => key removed successfully

HKCR\CLSID\{d43b3890-80c7-4010-a95d-1e77b5924dc3} => key not found. 

"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}" => key removed successfully

HKCR\CLSID\{D944BB61-2E34-4DBF-A683-47E505C587DC} => key not found. 

HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully

"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => key removed successfully

HKCR\Wow6432Node\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found. 

"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}" => key removed successfully

HKCR\Wow6432Node\CLSID\{b7fca997-d0fb-4fe0-8afd-255e89cf9671} => key not found. 

HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{C46296C9-9FB6-4509-8294-68FA8F44E6DB} => key not found. 

HKCR\Wow6432Node\CLSID\{C46296C9-9FB6-4509-8294-68FA8F44E6DB} => key not found. 

"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}" => key removed successfully

HKCR\Wow6432Node\CLSID\{d43b3890-80c7-4010-a95d-1e77b5924dc3} => key not found. 

"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}" => key removed successfully

HKCR\Wow6432Node\CLSID\{D944BB61-2E34-4DBF-A683-47E505C587DC} => key not found. 

HKU\S-1-5-21-1563961910-250262785-1644635927-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully

"HKU\S-1-5-21-1563961910-250262785-1644635927-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => key removed successfully

HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found. 

HKU\S-1-5-21-1563961910-250262785-1644635927-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827} => key not found. 

HKCR\CLSID\{2fa28606-de77-4029-af96-b231e3b8f827} => key not found. 

"HKU\S-1-5-21-1563961910-250262785-1644635927-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}" => key removed successfully

HKCR\CLSID\{b7fca997-d0fb-4fe0-8afd-255e89cf9671} => key not found. 

HKU\S-1-5-21-1563961910-250262785-1644635927-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C46296C9-9FB6-4509-8294-68FA8F44E6DB} => key not found. 

HKCR\CLSID\{C46296C9-9FB6-4509-8294-68FA8F44E6DB} => key not found. 

"HKU\S-1-5-21-1563961910-250262785-1644635927-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}" => key removed successfully

HKCR\CLSID\{d43b3890-80c7-4010-a95d-1e77b5924dc3} => key not found. 

"HKU\S-1-5-21-1563961910-250262785-1644635927-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}" => key removed successfully

HKCR\CLSID\{D944BB61-2E34-4DBF-A683-47E505C587DC} => key not found. 

"HKU\S-1-5-21-1563961910-250262785-1644635927-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{F2B5E2C6-4DFD-420A-80B7-6DDC3D8989CA}" => key removed successfully

HKCR\CLSID\{F2B5E2C6-4DFD-420A-80B7-6DDC3D8989CA} => key not found. 

HKU\S-1-5-21-1563961910-250262785-1644635927-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{F813F595-1DA6-4476-915D-E3C2FDF0B758} => key not found. 

HKCR\CLSID\{F813F595-1DA6-4476-915D-E3C2FDF0B758} => key not found. 

C:\ProgramData\fontcacheev1.dat => moved successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{1FCFDC38-73AA-4DD7-87D9-99A1ABEE1600}" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1FCFDC38-73AA-4DD7-87D9-99A1ABEE1600}" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\OfficeSoftwareProtectionPlatform\SvcRestartTask" => key removed successfully

C:\ProgramData\Temp => ":5C321E34" ADS removed successfully.

HKLM SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SAVService => ""="service" => Error: No automatic fix found for this entry.

"HKLM\System\CurrentControlSet\Control\SafeBoot\Network\SAVService" => key removed successfully

 

========= bitsadmin /reset /allusers =========

 

 

BITSADMIN version 3.0

BITS administration utility.

© Copyright 2000-2006 Microsoft Corp.

 

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.

Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

 

0 out of 0 jobs canceled.

 

========= End of CMD: =========

 

 

========= netsh winsock reset catalog =========

 

 

Sucessfully reset the Winsock Catalog.

You must restart the computer in order to complete the reset.

 

 

========= End of CMD: =========

 

 

========= ipconfig /flushdns =========

 

 

Windows IP Configuration

 

Successfully flushed the DNS Resolver Cache.

 

========= End of CMD: =========

 

 

========= RemoveProxy: =========

 

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully

HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully

HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully

HKU\S-1-5-21-1563961910-250262785-1644635927-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully

HKU\S-1-5-21-1563961910-250262785-1644635927-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully

 

 

========= End of RemoveProxy: =========

 

C:\Windows\System32\Drivers\etc\hosts => moved successfully

Hosts restored successfully.

 

=========== EmptyTemp: ==========

 

BITS transfer queue => 6891268 B

DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 34558824 B

Java, Flash, Steam htmlcache => 506 B

Windows/system/drivers => 70367413 B

Edge => 305029051 B

Chrome => 457728979 B

Firefox => 0 B

Opera => 0 B

 

Temp, IE cache, history, cookies, recent:

Default => 13828 B

ProgramData => 0 B

Public => 0 B

systemprofile => 0 B

systemprofile32 => 0 B

LocalService => 2634 B

NetworkService => 184463368 B

Brian => 2390881 B

DefaultAppPool => 6148 B

 

RecycleBin => 145158799 B

EmptyTemp: => 1.1 GB temporary data Removed.

 

================================

 

 

The system needed a reboot.

 

==== End of Fixlog 08:22:39 ====

 

 

Sophos scan is running. I am off to work now.

[zep516]

Nice work ! I want to see 2 new logs from FRST. Delete any logs currently on your desktop so there's no confusion.

Then

Re-run Farbar Recovery Scan Tool (FRST/FRST64)

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Make sure you checkmark Addition.txt box.
• Press Scan button.
• Scan will create two logs, FRST.txt and Addition.txt in the same location the tool is run. (Desktop) Please copy and paste them to your reply.

[Braind]

Here are the two new FRST logs:

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 12-09-2016

Ran by Brian (administrator) on BRIAN-HP (12-09-2016 17:33:57)

Running from C:\Users\Brian\Desktop

Loaded Profiles: Brian (Available Profiles: Brian & DefaultAppPool)

Platform: Windows 10 Home Version 1607 (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

 

==================== Processes (Whitelisted) =================

 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

 

(AMD) C:\Windows\System32\atiesrxx.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe

(SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe

(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe

(Performix LLC) C:\Program Files (x86)\Adguard\AdguardSvc.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe

(Fitbit, Inc.) C:\Program Files (x86)\Fitbit Connect\FitbitConnectService.exe

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Microsoft Corporation) C:\Windows\System32\mqsvc.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_filter.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Management Communications System\Endpoint\McsAgent.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Management Communications System\Endpoint\McsClient.exe

(Sophos Limited) C:\Program Files (x86)\Common Files\Sophos\Web Intelligence\swi_fc.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe

(Microsoft Corporation) C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe

(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

(Fitbit, Inc.) C:\Program Files (x86)\Fitbit Connect\Fitbit Connect.exe

(Prosoftnet) C:\Program Files (x86)\IDriveWindows\id_bglaunch.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler64.exe

(Prosoftnet) C:\Program Files (x86)\IDriveWindows\id_tray.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe

(Repkasoft) C:\Program Files (x86)\YoWindow\yowindow.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Sophos UI\SophosUI.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Sophos UI\SophosUI.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Dashlane, Inc.) C:\Users\Brian\AppData\Roaming\Dashlane\Dashlane.exe

(Condusiv Technologies) C:\Program Files\Condusiv Technologies\Diskeeper\DKService.exe

() C:\Users\Brian\AppData\Roaming\Dashlane\DashlanePlugin.exe

(HP Inc.) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe

(Prosoftnet) C:\Program Files (x86)\IDriveWindows\id_service.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\System32\cmd.exe

() C:\Users\Brian\AppData\Roaming\Dashlane\DashlanePlugin.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\System32\smartscreen.exe

 

 

==================== Registry (Whitelisted) ===========================

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

 

HKLM\...\Run: [hpsysdrv] => c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard)

HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176952 2016-07-26] (Apple Inc.)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-11-04] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [PDF Complete] => C:\Program Files (x86)\PDF Complete\pdfsty.exe [656920 2011-02-01] (PDF Complete Inc)

HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)

HKLM-x32\...\Run: [TkBellExe] => C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe [286992 2015-11-15] (RealNetworks, Inc.)

HKLM-x32\...\Run: [RealDownloader] => C:\Program Files (x86)\RealNetworks\RealDownloader\downloader2.exe [719632 2015-11-04] ()

HKLM-x32\...\Run: [IDrive Background process] => C:\Program Files (x86)\IDriveWindows\id_bglaunch.exe [72736 2016-01-18] (Prosoftnet)

HKLM-x32\...\Run: [IDrive Tray] => C:\Program Files (x86)\IDriveWindows\id_tray.exe [1985056 2016-01-18] (Prosoftnet)

HKLM-x32\...\Run: [Fitbit Connect] => C:\Program Files (x86)\Fitbit Connect\Fitbit Connect.exe [4567720 2015-10-28] (Fitbit, Inc.)

HKLM-x32\...\Run: [Sophos AutoUpdate Monitor] => C:\Program Files (x86)\Sophos\AutoUpdate\almon.exe [1596200 2016-01-15] (Sophos Limited)

HKLM-x32\...\Run: [Malwarebytes Anti-Exploit] => C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe [2631120 2016-07-28] (Malwarebytes Corporation)

HKLM-x32\...\Run: [SunJavaUpdateSched] => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

HKLM-x32\...\Run: [Digital Coupon Print Driver] => C:\Program Files (x86)\Digital Coupon Printer\DigitalCouponPrinter.exe [90048 2015-09-22] (Inmar, Inc.)

HKLM Group Policy restriction on software: *.txt*.bat <====== ATTENTION

HKLM Group Policy restriction on software: C:\Users\*.exe <====== ATTENTION

HKLM Group Policy restriction on software: %appdata%\*\*.pif <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.divx*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: *.wma*.jse <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.pif <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\*.js <====== ATTENTION

HKLM Group Policy restriction on software: *.doc*.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.jpeg*.jse <====== ATTENTION

HKLM Group Policy restriction on software: *.avi*.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.xlsx*.jse <====== ATTENTION

HKLM Group Policy restriction on software: *.xls*.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.pif <====== ATTENTION

HKLM Group Policy restriction on software: %appdata%\*.js <====== ATTENTION

HKLM Group Policy restriction on software: *.wma*.com <====== ATTENTION

HKLM Group Policy restriction on software: *.docx*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.pub*.bat <====== ATTENTION

HKLM Group Policy restriction on software: *.ppt*.scr <====== ATTENTION

HKLM Group Policy restriction on software: %systemdrive%\*\svchost.exe <====== ATTENTION

HKLM Group Policy restriction on software: %allusersprofile%\*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.jpg*.com <====== ATTENTION

HKLM Group Policy restriction on software: *.xlsx*.js <====== ATTENTION

HKLM Group Policy restriction on software: %programdata%\*.js <====== ATTENTION

HKLM Group Policy restriction on software: %programdata%\*.bat <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.jse <====== ATTENTION

HKLM Group Policy restriction on software: *.ppt*.com <====== ATTENTION

HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.js <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.bat <====== ATTENTION

HKLM Group Policy restriction on software: *.jpeg*.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.png*.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.bmp*.com <====== ATTENTION

HKLM Group Policy restriction on software: *.rar*.js <====== ATTENTION

HKLM Group Policy restriction on software: *.pub*.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.jpeg*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.png*.bat <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.ppt*.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.mp3*.com <====== ATTENTION

HKLM Group Policy restriction on software: *.divx*.jse <====== ATTENTION

HKLM Group Policy restriction on software: *.rar*.bat <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.js <====== ATTENTION

HKLM Group Policy restriction on software: *.wav*.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.pdf*.js <====== ATTENTION

HKLM Group Policy restriction on software: *.rar*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: *.doc*.js <====== ATTENTION

HKLM Group Policy restriction on software: %appdata%\*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: *.png*.pif <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\*.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: *.gif*.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.wav*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.rar*.jse <====== ATTENTION

HKLM Group Policy restriction on software: *.mp4*.jse <====== ATTENTION

HKLM Group Policy restriction on software: *.xls*.pif <====== ATTENTION

HKLM Group Policy restriction on software: %appdata%\*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.xlsx*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: *.avi*.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.mp3*.exe <====== ATTENTION

HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: *.doc*.bat <====== ATTENTION

HKLM Group Policy restriction on software: *.rtf*.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.wmv*.pif <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\*.exe <====== ATTENTION

HKLM Group Policy restriction on software: *:\$Recycle.Bin <====== ATTENTION

HKLM Group Policy restriction on software: *.txt*.exe <====== ATTENTION

HKLM Group Policy restriction on software: %allusersprofile%\*.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.avi*.bat <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.js <====== ATTENTION

HKLM Group Policy restriction on software: *.avi*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.wmv*.com <====== ATTENTION

HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.com <====== ATTENTION

HKLM Group Policy restriction on software: *.rar*.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.jpeg*.com <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\*.bat <====== ATTENTION

HKLM Group Policy restriction on software: *.wav*.com <====== ATTENTION

HKLM Group Policy restriction on software: *.rtf*.bat <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.exe <====== ATTENTION

HKLM Group Policy restriction on software: %programdata%\*\svchost.exe <====== ATTENTION

HKLM Group Policy restriction on software: %allusersprofile%\*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: *.doc*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.jse <====== ATTENTION

HKLM Group Policy restriction on software: *.mp3*.scr <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.divx*.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.pub*.js <====== ATTENTION

HKLM Group Policy restriction on software: *.mp4*.com <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\*.jse <====== ATTENTION

HKLM Group Policy restriction on software: *.gif*.jse <====== ATTENTION

HKLM Group Policy restriction on software: *.pdf*.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.jpeg*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: *.zip*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: *.mp4*.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.mp3*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: *.png*.scr <====== ATTENTION

HKLM Group Policy restriction on software: %appdata%\*.jse <====== ATTENTION

HKLM Group Policy restriction on software: *.xls*.bat <====== ATTENTION

HKLM Group Policy restriction on software: *.ppt*.js <====== ATTENTION

HKLM Group Policy restriction on software: *.jpg*.scr <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\*.com <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.ppt*.jse <====== ATTENTION

HKLM Group Policy restriction on software: *.mp4*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.xls*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: *.gif*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.jpeg*.bat <====== ATTENTION

HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.bat <====== ATTENTION

HKLM Group Policy restriction on software: *.wmv*.js <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.pif <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.jse <====== ATTENTION

HKLM Group Policy restriction on software: *.7z*.bat <====== ATTENTION

HKLM Group Policy restriction on software: *.mp4*.js <====== ATTENTION

HKLM Group Policy restriction on software: *.pdf*.jse <====== ATTENTION

HKLM Group Policy restriction on software: *.mp4*.bat <====== ATTENTION

HKLM Group Policy restriction on software: scsvserv.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.doc*.com <====== ATTENTION

HKLM Group Policy restriction on software: %allusersprofile%\*.com <====== ATTENTION

HKLM Group Policy restriction on software: *.jpg*.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.7z*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: *.pptx*.exe <====== ATTENTION

HKLM Group Policy restriction on software: %programdata%\*.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.7z*.com <====== ATTENTION

HKLM Group Policy restriction on software: %appdata%\*\*.bat <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.jse <====== ATTENTION

HKLM Group Policy restriction on software: syskey.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.avi*.jse <====== ATTENTION

HKLM Group Policy restriction on software: *.gif*.js <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.js <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.exe <====== ATTENTION

HKLM Group Policy restriction on software: ** <====== ATTENTION

HKLM Group Policy restriction on software: *.avi*.com <====== ATTENTION

HKLM Group Policy restriction on software: *.pptx*.js <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.jse <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.bat <====== ATTENTION

HKLM Group Policy restriction on software: *.wma*.bat <====== ATTENTION

HKLM Group Policy restriction on software: *.jpeg*.js <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: *.pdf*.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.wma*.exe <====== ATTENTION

HKLM Group Policy restriction on software: %allusersprofile%\*.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.divx*.com <====== ATTENTION

HKLM Group Policy restriction on software: *.pdf*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.docx*.jse <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: *.divx*.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.wav*.js <====== ATTENTION

HKLM Group Policy restriction on software: *.xlsx*.pif <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\*.com <====== ATTENTION

HKLM Group Policy restriction on software: C:\Users\*.js <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.gif*.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.pif <====== ATTENTION

HKLM Group Policy restriction on software: %appdata%\*\*.jse <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.com <====== ATTENTION

HKLM Group Policy restriction on software: *.divx*.bat <====== ATTENTION

HKLM Group Policy restriction on software: *.rar*.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.xlsx*.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.wav*.bat <====== ATTENTION

HKLM Group Policy restriction on software: *.pub*.com <====== ATTENTION

HKLM Group Policy restriction on software: *.pptx*.jse <====== ATTENTION

HKLM Group Policy restriction on software: *.mp4*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: *.bmp*.js <====== ATTENTION

HKLM Group Policy restriction on software: *.txt*.com <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.com <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.txt*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.jpeg*.pif <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.bat <====== ATTENTION

HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.jse <====== ATTENTION

HKLM Group Policy restriction on software: *.pptx*.com <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.js <====== ATTENTION

HKLM Group Policy restriction on software: *.xlsx*.com <====== ATTENTION

HKLM Group Policy restriction on software: %programfiles(x86)%\*\svchost.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.pub*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: %appdata%\*\*.com <====== ATTENTION

HKLM Group Policy restriction on software: *.ppt*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: *.zip*.com <====== ATTENTION

HKLM Group Policy restriction on software: *.jpg*.jse <====== ATTENTION

HKLM Group Policy restriction on software: *.jpg*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.png*.com <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\*.jse <====== ATTENTION

HKLM Group Policy restriction on software: *.pptx*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: %appdata%\*.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.7z*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.pdf*.bat <====== ATTENTION

HKLM Group Policy restriction on software: *.zip*.js <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: *.wav*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.gif*.bat <====== ATTENTION

HKLM Group Policy restriction on software: C:\Users\*.scr <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.js <====== ATTENTION

HKLM Group Policy restriction on software: *.rtf*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.jpg*.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.pdf*.com <====== ATTENTION

HKLM Group Policy restriction on software: *.jpg*.bat <====== ATTENTION

HKLM Group Policy restriction on software: *.avi*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: *.7z*.exe <====== ATTENTION

HKLM Group Policy restriction on software: %appdata%\*\*.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.txt*.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.docx*.exe <====== ATTENTION

HKLM Group Policy restriction on software: C:\Users\*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.com <====== ATTENTION

HKLM Group Policy restriction on software: *.pdf*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: *.gif*.com <====== ATTENTION

HKLM Group Policy restriction on software: *.mp3*.bat <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.pub*.scr <====== ATTENTION

HKLM Group Policy restriction on software: %programdata%\*.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.divx*.scr <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.bat <====== ATTENTION

HKLM Group Policy restriction on software: %appdata%\*\*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: *.wav*.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.jpg*.js <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.js <====== ATTENTION

HKLM Group Policy restriction on software: *.rar*.com <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.txt*.jse <====== ATTENTION

HKLM Group Policy restriction on software: *.ppt*.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.scr <====== ATTENTION

HKLM Group Policy restriction on software: C:\Users\*.pif <====== ATTENTION

HKLM Group Policy restriction on software: lsassvrtdbks.exe <====== ATTENTION

HKLM Group Policy restriction on software: %appdata%\*\*.js <====== ATTENTION

HKLM Group Policy restriction on software: *.pub*.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.docx*.pif <====== ATTENTION

HKLM Group Policy restriction on software: cipher.exe <====== ATTENTION

HKLM Group Policy restriction on software: %appdata%\*.bat <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\*.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.doc*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.zip*.bat <====== ATTENTION

HKLM Group Policy restriction on software: %programdata%\*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: *.mp3*.js <====== ATTENTION

HKLM Group Policy restriction on software: *.png*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: *.mp3*.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.xlsx*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.wmv*.jse <====== ATTENTION

HKLM Group Policy restriction on software: *.doc*.jse <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.pub*.jse <====== ATTENTION

HKLM Group Policy restriction on software: *.wma*.js <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.jse <====== ATTENTION

HKLM Group Policy restriction on software: *.bmp*.jse <====== ATTENTION

HKLM Group Policy restriction on software: *.txt*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: *.zip*.jse <====== ATTENTION

HKLM Group Policy restriction on software: vssadmin.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.com <====== ATTENTION

HKLM Group Policy restriction on software: %appdata%\*.com <====== ATTENTION

HKLM Group Policy restriction on software: *.wma*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.rtf*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: C:\Users\*.jse <====== ATTENTION

HKLM Group Policy restriction on software: *.docx*.js <====== ATTENTION

HKLM Group Policy restriction on software: *.xls*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.avi*.js <====== ATTENTION

HKLM Group Policy restriction on software: *.docx*.bat <====== ATTENTION

HKLM Group Policy restriction on software: *.7z*.pif <====== ATTENTION

HKLM Group Policy restriction on software: %programfiles%\*\svchost.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.wmv*.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.bat <====== ATTENTION

HKLM Group Policy restriction on software: %programdata%\*.jse <====== ATTENTION

HKLM Group Policy restriction on software: *.pptx*.bat <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.bat <====== ATTENTION

HKLM Group Policy restriction on software: *.doc*.exe <====== ATTENTION

HKLM Group Policy restriction on software: %programdata%\*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.divx*.js <====== ATTENTION

HKLM Group Policy restriction on software: *.7z*.js <====== ATTENTION

HKLM Group Policy restriction on software: *.wmv*.bat <====== ATTENTION

HKLM Group Policy restriction on software: *.zip*.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.bmp*.bat <====== ATTENTION

HKLM Group Policy restriction on software: C:\Users\*.bat <====== ATTENTION

HKLM Group Policy restriction on software: *.xls*.js <====== ATTENTION

HKLM Group Policy restriction on software: %allusersprofile%\*.bat <====== ATTENTION

HKLM Group Policy restriction on software: *.xls*.jse <====== ATTENTION

HKLM Group Policy restriction on software: *.docx*.com <====== ATTENTION

HKLM Group Policy restriction on software: *.rtf*.com <====== ATTENTION

HKLM Group Policy restriction on software: lsassw86s.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.wmv*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: *.bmp*.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.rtf*.js <====== ATTENTION

HKLM Group Policy restriction on software: *.mp3*.jse <====== ATTENTION

HKLM Group Policy restriction on software: *.rtf*.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.bmp*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: *.zip*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.png*.jse <====== ATTENTION

HKLM Group Policy restriction on software: *.wma*.pif <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\Appdata\Roaming\Microsoft\Windows\IEUpdate\*.exe <====== ATTENTION

HKLM Group Policy restriction on software: %programdata%\*.com <====== ATTENTION

HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.wmv*.scr <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.com <====== ATTENTION

HKLM Group Policy restriction on software: *.mp4*.pif <====== ATTENTION

HKLM Group Policy restriction on software: %appdata%\*.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.zip*.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.xlsx*.bat <====== ATTENTION

HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.wma*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: %appdata%\*\*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.xls*.com <====== ATTENTION

HKLM Group Policy restriction on software: *.bmp*.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.png*.js <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\*.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.docx*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: *.wav*.jse <====== ATTENTION

HKLM Group Policy restriction on software: *.pptx*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.7z*.jse <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: *.gif*.cmd <====== ATTENTION

HKLM Group Policy restriction on software: *.ppt*.bat <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.com <====== ATTENTION

HKLM Group Policy restriction on software: *.bmp*.scr <====== ATTENTION

HKLM Group Policy restriction on software: %allusersprofile%\*.js <====== ATTENTION

HKLM Group Policy restriction on software: *.txt*.js <====== ATTENTION

HKLM Group Policy restriction on software: *.rar*.scr <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\*.bat <====== ATTENTION

HKLM Group Policy restriction on software: *.rtf*.jse <====== ATTENTION

HKLM Group Policy restriction on software: %allusersprofile%\*.jse <====== ATTENTION

HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.pptx*.pif <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\*.js <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\dashlane\dashlane.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\dashlane\dashlane.exe <====== ATTENTION

HKLM Group Policy restriction on software: %appdata%\dashlane\procdump.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\dashlane\dashlaneplugin.exe <====== ATTENTION

HKLM Group Policy restriction on software: %appdata%\dashlane\dashlaneplugin.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Local\dashlane\procdump.exe <====== ATTENTION

HKLM Group Policy restriction on software: %appdata%\dashlane\dashlane.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Local\dashlane\dashlaneplugin.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\dashlane\procdump.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\dashlane\procdump.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Local\dashlane\dashlane.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\dashlane\dashlaneplugin.exe <====== ATTENTION

HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7943072 2016-08-30] (SUPERAntiSpyware)

HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\Run: [Dashlane] => C:\Users\Brian\AppData\Roaming\Dashlane\Dashlane.exe [228224 2016-08-31] (Dashlane, Inc.)

HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\Run: [DashlanePlugin] => C:\Users\Brian\AppData\Roaming\Dashlane\DashlanePlugin.exe [286080 2016-08-31] ()

HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\Run: [FileHippo.com] => C:\Program Files (x86)\FileHippo.com\FileHippo.AppManager.exe [10566352 2015-09-02] ()

HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\Run: [Fitbit Connect] => C:\Program Files (x86)\Fitbit Connect\Fitbit Connect.exe [4567720 2015-10-28] (Fitbit, Inc.)

HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\Run: [Adguard] => C:\Program Files (x86)\Adguard\Adguard.exe [5608440 2016-08-26] (Performix LLC)

HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\Run: [eM Client] => "C:\Program Files (x86)\eM Client\MailClient.exe" /startup

HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8894680 2016-08-05] (Piriform Ltd)

HKU\S-1-5-21-1563961910-250262785-1644635927-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\yowindow.scr [859080 2016-07-10] (repkasoft)

AppInit_DLLs-x32: C:\PROGRA~2\Sophos\SOPHOS~1\\SOPHOS~1.DLL => C:\Program Files (x86)\Sophos\Sophos Anti-Virus\\sophos_detoured.dll [275352 2016-02-22] (Sophos Limited)

ShellIconOverlayIdentifiers: [  0001IDSIcon1] -> {0FA6DCC0-CF0B-427D-A8AF-97C466AB5769} => C:\Program Files (x86)\IDriveWindows\IDSyncIntIcon64.dll [2015-11-25] (Pro-Softnet Corporation, U.S.A)

ShellIconOverlayIdentifiers: [  0001IDSIcon2] -> {66357BBE-D2E5-453C-95FF-8102EB32419D} => C:\Program Files (x86)\IDriveWindows\IDSyncIntIcon64.dll [2015-11-25] (Pro-Softnet Corporation, U.S.A)

ShellIconOverlayIdentifiers: [  0001IDSIcon3] -> {904E6336-8B13-43FA-B4C3-5B62C1C91971} => C:\Program Files (x86)\IDriveWindows\IDSyncIntIcon64.dll [2015-11-25] (Pro-Softnet Corporation, U.S.A)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\RealTimes.lnk [2015-11-15]

ShortcutTarget: RealTimes.lnk -> C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin\rpsystray.exe (RealNetworks, Inc.)

Startup: C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk [2015-12-18]

ShortcutTarget: Send to OneNote.lnk -> C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE (Microsoft Corporation)

Startup: C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YoWindow.lnk [2016-01-22]

ShortcutTarget: YoWindow.lnk -> C:\Program Files (x86)\YoWindow\yowindow.exe (Repkasoft)

Startup: C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~Disabled [2016-08-04] ()

GroupPolicy: Restriction - Chrome <======= ATTENTION

CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

 

==================== Internet (Whitelisted) ====================

 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

 

Tcpip\Parameters: [DhcpNameServer] 209.18.47.61 209.18.47.62

Tcpip\..\Interfaces\{136f715d-1007-4cf1-8adb-aa43da411b61}: [DhcpNameServer] 209.18.47.61 209.18.47.62

 

Internet Explorer:

==================

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin64.dll [2015-11-04] (RealDownloader)

BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2016-08-25] (Microsoft Corporation)

BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2016-08-25] (Microsoft Corporation)

BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2015-11-04] (RealDownloader)

BHO-x32: Dashlane BHO -> {42D79B50-CC4A-4A8E-860F-BE674AF053A2} -> C:\Users\Brian\AppData\Roaming\Dashlane\ie\Dashlanei.dll [2016-08-31] (Dashlane, Inc.)

BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\ssv.dll [2016-07-23] (Oracle Corporation)

BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\jp2ssv.dll [2016-07-23] (Oracle Corporation)

Toolbar: HKLM-x32 - Dashlane Toolbar - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\Users\Brian\AppData\Roaming\Dashlane\ie\KWIEBar.dll [2016-08-31] (Dashlane, Inc.)

Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-08-25] (Microsoft Corporation)

Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-08-25] (Microsoft Corporation)

Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-08-25] (Microsoft Corporation)

Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-08-25] (Microsoft Corporation)

 

FireFox:

========

FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_22_0_0_209.dll [2016-07-12] ()

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_22_0_0_209.dll [2016-07-12] ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-12-18] ()

FF Plugin-x32: @java.com/DTPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\dtplugin\npDeployJava1.dll [2016-07-23] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\plugin2\npjp2.dll [2016-07-23] (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2016-08-25] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)

FF Plugin-x32: @Motive.com/NpMotive,version=1.1 -> C:\Program Files (x86)\ATT\8.5.1.16\ma\bin\npMotive.dll [No File]

FF Plugin-x32: @real.com/nppl3260;version=18.1.2.175 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll [2015-11-15] (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprpplugin;version=18.1.2.175 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll [2015-11-15] (RealPlayer)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.2.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-01-20] (VideoLAN)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-06-30] (Adobe Systems Inc.)

FF Extension: (AT&T Extension) - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\[email protected] [2016-04-02] [not signed]

 

Chrome: 

=======

CHR DefaultSearchURL: Default -> hxxps://search.yahoo.com/search?p={searchTerms}&fr=yset_chr_syc_oracle&type=default

CHR DefaultSearchKeyword: Default -> Yahoo

CHR DefaultSuggestURL: Default -> hxxps://search.yahoo.com/sugg/ie?output=fxjson&command={searchTerms}&nResults=10

CHR Profile: C:\Users\Brian\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Xmarks Bookmark Sync) - C:\Users\Brian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajpgkpeckebdhofmmjfgcjjiiejpodla [2016-09-10]

CHR Extension: (Adguard AdBlocker) - C:\Users\Brian\AppData\Local\Google\Chrome\User Data\Default\Extensions\bgnkhhnnamicmpeenaelnjfhikgbkllg [2016-08-29]

CHR Extension: (WOT: Web of Trust, Website Reputation Ratings) - C:\Users\Brian\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhmmomiinigofkjcapegjjndpbikblnp [2016-08-08]

CHR Extension: (Adblock Plus) - C:\Users\Brian\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-08-25]

CHR Extension: (Incognito-Filter) - C:\Users\Brian\AppData\Local\Google\Chrome\User Data\Default\Extensions\cifilbmpnkjinlkchohdfcpdkmpngiik [2016-07-01]

CHR Extension: (Blur Privacy Dashboard) - C:\Users\Brian\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjidbdiahninbecbcigapoocbkfncobc [2016-07-01]

CHR Extension: (Adblock for Youtube™) - C:\Users\Brian\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmedhionkhpnakcndndgjdbohmhepckk [2016-07-01]

CHR Extension: (PriceJump) - C:\Users\Brian\AppData\Local\Google\Chrome\User Data\Default\Extensions\dblfcnaanidhgjbmcfgebdcifkaffcpb [2016-07-01]

CHR Extension: (Facebook Customizer (by Adblock Plus)) - C:\Users\Brian\AppData\Local\Google\Chrome\User Data\Default\Extensions\deoeenbkoccjaefmmhpmlegngdjohdcm [2016-07-01]

CHR Extension: (Blur) - C:\Users\Brian\AppData\Local\Google\Chrome\User Data\Default\Extensions\epanfjkfahimkgomnigadpkobaefekcd [2016-08-31]

CHR Extension: (YoWindow Free Weather) - C:\Users\Brian\AppData\Local\Google\Chrome\User Data\Default\Extensions\fanogbnclpilemkifpjeglokomebpnef [2016-09-10]

CHR Extension: (Dashlane) - C:\Users\Brian\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdjamakpfbbddfjaooikfcpapjohcfmg [2016-09-07]

CHR Extension: (Just Not Sorry -- the Gmail Plug-in) - C:\Users\Brian\AppData\Local\Google\Chrome\User Data\Default\Extensions\fmegmibednnlgojepmidhlhpjbppmlci [2016-07-01]

CHR Extension: (HTTPS Everywhere) - C:\Users\Brian\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcbommkclmclpchllfjekcdonpmejbdp [2016-09-02]

CHR Extension: (Assassin's Creed III) - C:\Users\Brian\AppData\Local\Google\Chrome\User Data\Default\Extensions\geadmffjboclimmeiaimcafapjaefnfn [2016-07-01]

CHR Extension: (The Camelizer) - C:\Users\Brian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghnomdcacenbmilgjigehppbamfndblo [2016-07-01]

CHR Extension: (AmazonSmile 1Button for Chrome) - C:\Users\Brian\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdgenjhkjihnmigcommchefpajjhdmba [2016-07-01]

CHR Extension: (Protect My Choices) - C:\Users\Brian\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdgloanjhdcenjgiafkpbehddcnonlic [2016-07-18]

CHR Extension: (The Weather Channel for Chrome) - C:\Users\Brian\AppData\Local\Google\Chrome\User Data\Default\Extensions\iflpcokdamgefbghpdipcibmhlkdopop [2016-07-01]

CHR Extension: (Google Voice (by Google)) - C:\Users\Brian\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcnhkahnjcbndmmehfkdnkjomaanaooo [2016-07-01]

CHR Extension: (Advanced Extensions) - C:\Users\Brian\AppData\Local\Google\Chrome\User Data\Default\Extensions\knchccdpckooledklhnooegnniofcfip [2016-07-01]

CHR Extension: (iCloud Dashboard) - C:\Users\Brian\AppData\Local\Google\Chrome\User Data\Default\Extensions\mgojgddhfhekopdpkocobommepgdeffb [2016-09-06]

CHR Extension: (Ghostery Fixer) - C:\Users\Brian\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkaegpmdlhnpldpoadmnnbddbkcdmbhb [2016-07-01]

CHR Extension: (Ghostery) - C:\Users\Brian\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlomiejdfkolichcflejclcbmpeaniij [2016-09-06]

CHR Extension: (Chrome Web Store Payments) - C:\Users\Brian\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-06-30]

CHR Extension: (Buffer) - C:\Users\Brian\AppData\Local\Google\Chrome\User Data\Default\Extensions\noojglkidnpfjbincgijbaiedldjfbhh [2016-09-09]

CHR Extension: (Readability) - C:\Users\Brian\AppData\Local\Google\Chrome\User Data\Default\Extensions\oknpjjbmpnndlpmnhmekjpocelpnlfdi [2016-07-01]

CHR Extension: (Chrome Media Router) - C:\Users\Brian\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-08-29]

CHR HKLM-x32\...\Chrome\Extension: [bhfhojbhbnajajgihpicejdalbjlpcep] - hxxps://clients2.google.com/service/update2/crx

CHR HKLM-x32\...\Chrome\Extension: [nogdfjjfhknacchjpiccacoimeelkajb] - hxxps://clients2.google.com/service/update2/crx

 

==================== Services (Whitelisted) ========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-07-22] (SUPERAntiSpyware.com)

R2 Adguard Service; C:\Program Files (x86)\Adguard\AdguardSvc.exe [149496 2016-08-26] (Performix LLC)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-03-02] (Apple Inc.)

R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [2981056 2016-08-11] (Microsoft Corporation)

R2 Diskeeper; C:\Program Files\Condusiv Technologies\Diskeeper\DKService.exe [2695920 2015-03-05] (Condusiv Technologies)

R2 Fitbit Connect; C:\Program Files (x86)\Fitbit Connect\FitbitConnectService.exe [5906088 2015-10-28] (Fitbit, Inc.)

R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [135496 2016-09-09] (SurfRight B.V.)

R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [29728 2016-08-15] (HP Inc.)

R2 IDriveService; C:\Program Files (x86)\IDriveWindows\id_service.exe [154656 2016-01-18] (Prosoftnet)

R2 MbaeSvc; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe [750032 2016-07-28] (Malwarebytes Corporation)

S4 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1127448 2011-02-01] (PDF Complete Inc)

S4 RealPlayerUpdateSvc; C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe [33088 2015-11-04] ()

S4 RealTimes Desktop Service; C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin\rpdsvc.exe [1095976 2015-11-15] (RealNetworks, Inc.)

R2 SAVAdminService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe [288552 2016-02-14] (Sophos Limited)

R2 SAVService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe [208168 2016-02-14] (Sophos Limited)

R2 Sophos AutoUpdate Service; C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe [636224 2016-01-15] (Sophos Limited)

R2 Sophos MCS Agent; C:\Program Files (x86)\Sophos\Management Communications System\Endpoint\McsAgent.exe [331048 2016-02-14] (Sophos Limited)

R2 Sophos MCS Client; C:\Program Files (x86)\Sophos\Management Communications System\Endpoint\McsClient.exe [909608 2016-02-14] (Sophos Limited)

R2 Sophos Web Control Service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe [341768 2016-02-14] (Sophos Limited)

R2 swi_filter; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_filter.exe [307848 2016-02-22] (Sophos Limited)

R2 swi_service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe [3285640 2016-02-22] (Sophos Limited)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)

 

===================== Drivers (Whitelisted) ==========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

R1 adgnetworkwfpdrv; C:\Windows\System32\drivers\adgnetworkwfpdrv.sys [108656 2016-07-21] ()

R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWT6.sys [102912 2015-05-28] (Advanced Micro Devices)

R0 DKDFM; C:\Windows\System32\drivers\DKDFM.sys [41744 2013-05-06] (Condusiv Technologies)

R3 DKRtWrt; C:\WINDOWS\system32\drivers\DKRtWrt.sys [53520 2014-10-24] (Condusiv Technologies)

R0 DKTLFSMF; C:\Windows\System32\drivers\DKTLFSMF.sys [119536 2014-04-14] (Condusiv Technologies)

R1 ESProtectionDriver; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.sys [74984 2016-07-28] ()

S3 NetAdapterCx; C:\Windows\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()

R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [589824 2016-07-16] (Realtek                                            )

R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)

R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)

R1 SAVOnAccess; C:\Windows\System32\DRIVERS\savonaccess.sys [161024 2016-02-14] (Sophos Limited)

S3 sdcfilter; C:\Windows\system32\DRIVERS\sdcfilter.sys [38144 2016-02-14] (Sophos Limited)

S4 SophosBootDriver; C:\Windows\system32\DRIVERS\SophosBootDriver.sys [27904 2016-02-14] (Sophos Limited)

R1 swi_callout; C:\Windows\system32\DRIVERS\swi_callout.sys [32512 2016-02-22] (Sophos Limited)

S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)

S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)

R3 WirelessKeyboardFilter; C:\Windows\System32\drivers\WirelessKeyboardFilter.sys [49384 2016-03-29] (Microsoft Corporation)

R1 ZAM_Guard; C:\WINDOWS\System32\drivers\zamguard64.sys [203680 2016-06-29] (Zemana Ltd.)

 

==================== NetSvcs (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

 

==================== One Month Created files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2016-09-12 17:33 - 2016-09-12 17:35 - 00054814 _____ C:\Users\Brian\Desktop\FRST.txt

2016-09-12 17:33 - 2016-09-12 17:33 - 00000000 ____D C:\Users\Brian\Desktop\FRST-OlderVersion

2016-09-12 17:24 - 2016-09-12 17:24 - 00000000 ___SH C:\DkHyperbootSync

2016-09-12 08:19 - 2016-09-12 08:19 - 00000257 _____ C:\ProgramData\fontcacheev1.dat

2016-09-12 07:40 - 2016-09-12 17:33 - 02398720 _____ (Farbar) C:\Users\Brian\Desktop\FRST64.exe

2016-09-12 07:26 - 2016-09-12 07:26 - 02397696 _____ (Farbar) C:\Users\Brian\Downloads\FRST64 (7).exe

2016-09-11 23:35 - 2016-09-12 07:30 - 00046941 _____ C:\Users\Brian\Downloads\Addition.txt

2016-09-11 23:28 - 2016-09-12 07:29 - 00109985 _____ C:\Users\Brian\Downloads\FRST.txt

2016-09-11 23:27 - 2016-09-12 17:33 - 00000000 ____D C:\FRST

2016-09-11 17:29 - 2016-09-11 21:48 - 00000350 _____ C:\WINDOWS\Tasks\HPCeeScheduleForBrian.job

2016-09-11 14:04 - 2016-09-11 14:04 - 00022200 _____ (Phoenix Technologies) C:\WINDOWS\SysWOW64\Drivers\DrvAgent64.SYS

2016-09-11 14:04 - 2016-09-11 14:04 - 00000000 ____D C:\Users\Brian\AppData\Local\eSupport.com

2016-09-11 14:04 - 2016-09-11 14:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eSupport.com

2016-09-11 14:04 - 2016-09-11 14:04 - 00000000 ____D C:\Program Files (x86)\eSupport.com

2016-09-11 14:03 - 2016-09-11 14:03 - 01225680 _____ (Copyright © 2015 eSupport.com, Inc • All Rights Reserved ) C:\Users\Brian\Downloads\driveragent-setup-1578.exe

2016-09-11 14:03 - 2016-09-11 14:03 - 01225680 _____ (Copyright © 2015 eSupport.com, Inc • All Rights Reserved ) C:\Users\Brian\Downloads\driveragent-setup-1578 (1).exe

2016-09-11 14:01 - 2016-09-11 14:02 - 01191072 _____ (ALCPU ) C:\Users\Brian\Downloads\Core-Temp-setup (2).exe

2016-09-10 20:42 - 2016-09-10 20:42 - 00000000 ____D C:\Program Files (x86)\Digital Coupon Printer

2016-09-10 20:36 - 2016-09-10 20:36 - 18640896 _____ C:\Users\Brian\Downloads\DigitalCouponPrinter-3.50.0.0 (10).msi

2016-09-10 18:39 - 2016-09-10 18:39 - 01610560 _____ (Malwarebytes) C:\Users\Brian\Downloads\JRT.exe

2016-09-10 18:21 - 2016-09-10 18:21 - 03826240 _____ C:\Users\Brian\Downloads\adwcleaner_6.010 (1).exe

2016-09-08 07:08 - 2016-09-08 07:08 - 00001426 _____ C:\WINDOWS\system32\.crusader

2016-09-07 22:50 - 2016-09-07 22:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro

2016-09-07 22:50 - 2016-09-07 22:50 - 00000000 ____D C:\Program Files\HitmanPro

2016-09-07 22:49 - 2016-09-07 22:49 - 11438608 _____ (SurfRight B.V.) C:\Users\Brian\Downloads\hitmanpro_x64 (1).exe

2016-09-07 22:43 - 2016-09-07 22:43 - 00000000 ____D C:\Users\Default\AppData\Roaming\Performix LLC

2016-09-07 22:43 - 2016-09-07 22:43 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Performix LLC

2016-09-07 22:33 - 2016-09-07 22:33 - 03826240 _____ C:\Users\Brian\Downloads\adwcleaner_6.010.exe

2016-09-07 21:32 - 2016-09-12 08:15 - 00000000 ____D C:\ProgramData\Malwarebytes Anti-Exploit

2016-09-07 21:32 - 2016-09-07 21:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Exploit

2016-09-07 21:32 - 2016-09-07 21:32 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Exploit

2016-09-07 21:25 - 2016-09-11 21:54 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys

2016-09-07 21:25 - 2016-09-07 21:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2016-09-07 21:24 - 2016-09-07 21:25 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware

2016-09-07 21:24 - 2016-09-07 21:24 - 00000826 _____ C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\mbam-setup-2.2.1.lnk

2016-09-07 21:24 - 2016-03-10 14:09 - 00065408 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys

2016-09-07 21:24 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys

2016-09-07 21:24 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys

2016-09-07 21:22 - 2016-09-07 21:22 - 22851472 _____ (Malwarebytes ) C:\Users\Brian\Downloads\mbam-setup-cnet.35891-2.2.1.1043.exe

2016-09-06 18:43 - 2016-09-06 18:43 - 01706112 _____ (Malwarebytes) C:\Users\Brian\Downloads\mbam-check-2.3.2.0 (2).exe

2016-09-06 18:43 - 2016-09-06 18:43 - 01706112 _____ (Malwarebytes) C:\Users\Brian\Downloads\mbam-check-2.3.2.0 (1).exe

2016-09-06 18:37 - 2016-09-06 18:37 - 01706112 _____ (Malwarebytes) C:\Users\Brian\Downloads\mbam-check-2.3.2.0.exe

2016-09-06 17:54 - 2016-02-22 11:17 - 00032512 _____ (Sophos Limited) C:\WINDOWS\system32\Drivers\swi_callout.sys

2016-09-06 17:44 - 2016-09-06 17:44 - 00346728 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2016-09-04 22:05 - 2016-09-04 22:05 - 00000000 ____D C:\WINDOWS\Panther

2016-09-04 20:28 - 2016-09-04 20:28 - 00000000 ____D C:\zoek_backup

2016-09-04 20:26 - 2016-09-04 20:27 - 01309184 _____ C:\Users\Brian\Downloads\zoek.exe

2016-09-04 18:02 - 2016-09-11 17:29 - 00003242 _____ C:\WINDOWS\System32\Tasks\HPCeeScheduleForBrian

2016-09-02 21:49 - 2016-09-02 21:49 - 18309328 _____ (Microsoft Corporation) C:\Users\Brian\Downloads\MediaCreationTool.exe

2016-09-02 21:32 - 2016-09-02 21:32 - 05737808 _____ (Microsoft Corporation) C:\Users\Brian\Downloads\Windows10Upgrade9252 (1).exe

2016-09-02 21:11 - 2016-09-02 21:12 - 00000000 ____D C:\Users\Brian\Downloads\produkey-x64

2016-09-02 21:03 - 2016-09-12 00:47 - 00000000 ____D C:\WINDOWS\Microsoft Antimalware

2016-09-02 19:21 - 2016-08-27 00:12 - 04130944 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll

2016-09-02 19:21 - 2016-08-27 00:12 - 00244816 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll

2016-09-02 19:21 - 2016-08-26 23:58 - 03893376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll

2016-09-02 19:21 - 2016-08-26 23:58 - 00121368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfps.dll

2016-09-02 19:21 - 2016-08-26 23:39 - 00314880 _____ (Microsoft Corporation) C:\WINDOWS\system32\FSClient.dll

2016-09-02 19:21 - 2016-08-26 23:38 - 00294912 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsensorgroup.dll

2016-09-02 19:21 - 2016-08-26 23:38 - 00181760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsensorgroup.dll

2016-09-02 19:21 - 2016-08-26 23:37 - 00198144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FSClient.dll

2016-09-02 19:21 - 2016-08-26 23:25 - 00804864 _____ (Microsoft Corporation) C:\WINDOWS\system32\FrameServer.dll

2016-09-02 19:21 - 2016-08-20 01:05 - 01377008 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipUp.exe

2016-09-02 19:21 - 2016-08-20 01:04 - 07814488 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe

2016-09-02 19:21 - 2016-08-20 01:03 - 01883784 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll

2016-09-02 19:21 - 2016-08-20 00:52 - 07219672 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll

2016-09-02 19:21 - 2016-08-20 00:52 - 02190688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys

2016-09-02 19:21 - 2016-08-20 00:52 - 01859264 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll

2016-09-02 19:21 - 2016-08-20 00:52 - 00857440 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWAHost.exe

2016-09-02 19:21 - 2016-08-20 00:52 - 00658776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys

2016-09-02 19:21 - 2016-08-20 00:52 - 00402272 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys

2016-09-02 19:21 - 2016-08-20 00:51 - 00681312 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ClipSp.sys

2016-09-02 19:21 - 2016-08-20 00:50 - 02913104 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll

2016-09-02 19:21 - 2016-08-20 00:50 - 01099608 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe

2016-09-02 19:21 - 2016-08-20 00:50 - 00987992 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe

2016-09-02 19:21 - 2016-08-20 00:50 - 00073568 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hvservice.sys

2016-09-02 19:21 - 2016-08-20 00:50 - 00026408 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe

2016-09-02 19:21 - 2016-08-20 00:50 - 00020320 _____ (Microsoft Corporation) C:\WINDOWS\system32\kdhvcom.dll

2016-09-02 19:21 - 2016-08-20 00:47 - 22218808 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll

2016-09-02 19:21 - 2016-08-20 00:47 - 01453992 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetsrc.dll

2016-09-02 19:21 - 2016-08-20 00:47 - 01071728 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetcore.dll

2016-09-02 19:21 - 2016-08-20 00:46 - 01570680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll

2016-09-02 19:21 - 2016-08-20 00:43 - 01418312 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll

2016-09-02 19:21 - 2016-08-20 00:34 - 01430200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll

2016-09-02 19:21 - 2016-08-20 00:34 - 00782176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWAHost.exe

2016-09-02 19:21 - 2016-08-20 00:33 - 05722312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll

2016-09-02 19:21 - 2016-08-20 00:32 - 02166232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll

2016-09-02 19:21 - 2016-08-20 00:32 - 00846552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinTypes.dll

2016-09-02 19:21 - 2016-08-20 00:29 - 20965240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll

2016-09-02 19:21 - 2016-08-20 00:29 - 01360464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetsrc.dll

2016-09-02 19:21 - 2016-08-20 00:29 - 00980832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetcore.dll

2016-09-02 19:21 - 2016-08-20 00:25 - 01264912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll

2016-09-02 19:21 - 2016-08-20 00:22 - 22571008 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll

2016-09-02 19:21 - 2016-08-20 00:22 - 00028672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Management.Provisioning.ProxyStub.dll

2016-09-02 19:21 - 2016-08-20 00:21 - 00227840 _____ (Microsoft Corporation) C:\WINDOWS\system32\C_G18030.DLL

2016-09-02 19:21 - 2016-08-20 00:21 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakrathunk.dll

2016-09-02 19:21 - 2016-08-20 00:21 - 00032768 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll

2016-09-02 19:21 - 2016-08-20 00:21 - 00014848 _____ (Microsoft Corporation) C:\WINDOWS\system32\c_GSM7.DLL

2016-09-02 19:21 - 2016-08-20 00:20 - 00076800 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanprotdim.dll

2016-09-02 19:21 - 2016-08-20 00:20 - 00017408 _____ (Microsoft Corporation) C:\WINDOWS\system32\C_IS2022.DLL

2016-09-02 19:21 - 2016-08-20 00:15 - 00231424 _____ (Microsoft Corporation) C:\WINDOWS\system32\shutdownux.dll

2016-09-02 19:21 - 2016-08-20 00:15 - 00211456 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe

2016-09-02 19:21 - 2016-08-20 00:14 - 00225280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\C_G18030.DLL

2016-09-02 19:21 - 2016-08-20 00:14 - 00121344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakrathunk.dll

2016-09-02 19:21 - 2016-08-20 00:14 - 00014336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\C_IS2022.DLL

2016-09-02 19:21 - 2016-08-20 00:13 - 01081856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll

2016-09-02 19:21 - 2016-08-20 00:13 - 00743424 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll

2016-09-02 19:21 - 2016-08-20 00:13 - 00259584 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgentUserBroker.exe

2016-09-02 19:21 - 2016-08-20 00:12 - 00476672 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll

2016-09-02 19:21 - 2016-08-20 00:12 - 00453120 _____ (Microsoft Corporation) C:\WINDOWS\system32\CredProvDataModel.dll

2016-09-02 19:21 - 2016-08-20 00:12 - 00261120 _____ (Microsoft Corporation) C:\WINDOWS\system32\indexeddbserver.dll

2016-09-02 19:21 - 2016-08-20 00:12 - 00215040 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapibase.dll

2016-09-02 19:21 - 2016-08-20 00:11 - 00320000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll

2016-09-02 19:21 - 2016-08-20 00:09 - 06285312 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll

2016-09-02 19:21 - 2016-08-20 00:08 - 00471552 _____ (Microsoft Corporation) C:\WINDOWS\system32\DscCore.dll

2016-09-02 19:21 - 2016-08-20 00:08 - 00179712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe

2016-09-02 19:21 - 2016-08-20 00:07 - 01403392 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Editing.dll

2016-09-02 19:21 - 2016-08-20 00:07 - 00822784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll

2016-09-02 19:21 - 2016-08-20 00:07 - 00554496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StoreAgent.dll

2016-09-02 19:21 - 2016-08-20 00:07 - 00203776 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXApplicabilityBlob.dll

2016-09-02 19:21 - 2016-08-20 00:07 - 00104960 _____ (Microsoft Corporation) C:\WINDOWS\system32\CastLaunch.dll

2016-09-02 19:21 - 2016-08-20 00:06 - 00389632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll

2016-09-02 19:21 - 2016-08-20 00:06 - 00222720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgentUserBroker.exe

2016-09-02 19:21 - 2016-08-20 00:04 - 23682560 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2016-09-02 19:21 - 2016-08-20 00:04 - 00253952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll

2016-09-02 19:21 - 2016-08-20 00:04 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\indexeddbserver.dll

2016-09-02 19:21 - 2016-08-20 00:03 - 05398016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aclui.dll

2016-09-02 19:21 - 2016-08-20 00:01 - 04612096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll

2016-09-02 19:21 - 2016-08-20 00:01 - 00936960 _____ (Microsoft Corporation) C:\WINDOWS\system32\MCRecvSrc.dll

2016-09-02 19:21 - 2016-08-20 00:01 - 00468992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.InkControls.dll

2016-09-02 19:21 - 2016-08-20 00:00 - 19423232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll

2016-09-02 19:21 - 2016-08-20 00:00 - 08124416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll

2016-09-02 19:21 - 2016-08-19 23:59 - 05511680 _____ (Microsoft Corporation) C:\WINDOWS\system32\aclui.dll

2016-09-02 19:21 - 2016-08-19 23:59 - 01077760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Editing.dll

2016-09-02 19:21 - 2016-08-19 23:57 - 01282048 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll

2016-09-02 19:21 - 2016-08-19 23:56 - 02315264 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll

2016-09-02 19:21 - 2016-08-19 23:56 - 02289664 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll

2016-09-02 19:21 - 2016-08-19 23:56 - 00391168 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll

2016-09-02 19:21 - 2016-08-19 23:55 - 19418624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2016-09-02 19:21 - 2016-08-19 23:55 - 00726016 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll

2016-09-02 19:21 - 2016-08-19 23:52 - 00640000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MCRecvSrc.dll

2016-09-02 19:21 - 2016-08-19 23:51 - 06044672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll

2016-09-02 19:21 - 2016-08-19 23:51 - 01992704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll

2016-09-02 19:20 - 2016-08-27 07:45 - 00268800 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfksproxy.dll

2016-09-02 19:20 - 2016-08-27 04:37 - 00184832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfksproxy.dll

2016-09-02 19:20 - 2016-08-26 23:44 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\system32\encapi.dll

2016-09-02 19:20 - 2016-08-26 23:43 - 00022528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\encapi.dll

2016-09-02 19:20 - 2016-08-20 01:26 - 00484584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll

2016-09-02 19:20 - 2016-08-20 01:13 - 00590952 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll

2016-09-02 19:20 - 2016-08-20 01:06 - 01046976 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi

2016-09-02 19:20 - 2016-08-20 01:06 - 00885832 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe

2016-09-02 19:20 - 2016-08-20 01:06 - 00108384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys

2016-09-02 19:20 - 2016-08-20 01:04 - 01349120 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi

2016-09-02 19:20 - 2016-08-20 01:04 - 01163696 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe

2016-09-02 19:20 - 2016-08-20 01:03 - 02257248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys

2016-09-02 19:20 - 2016-08-20 00:52 - 01279328 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll

2016-09-02 19:20 - 2016-08-20 00:52 - 00178528 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHostUser.dll

2016-09-02 19:20 - 2016-08-20 00:50 - 01267512 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinTypes.dll

2016-09-02 19:20 - 2016-08-20 00:50 - 00942424 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.efi

2016-09-02 19:20 - 2016-08-20 00:50 - 00807776 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.exe

2016-09-02 19:20 - 2016-08-20 00:42 - 02537824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys

2016-09-02 19:20 - 2016-08-20 00:34 - 00136032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudExperienceHostUser.dll

2016-09-02 19:20 - 2016-08-20 00:33 - 00852824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll

2016-09-02 19:20 - 2016-08-20 00:21 - 02755584 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb

2016-09-02 19:20 - 2016-08-20 00:21 - 00568832 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Speech.UXRes.dll

2016-09-02 19:20 - 2016-08-20 00:21 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\system32\RemovableMediaProvisioningPlugin.dll

2016-09-02 19:20 - 2016-08-20 00:20 - 00119808 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCsp.dll

2016-09-02 19:20 - 2016-08-20 00:20 - 00085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\BarcodeProvisioningPlugin.dll

2016-09-02 19:20 - 2016-08-20 00:20 - 00043520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\xinputhid.sys

2016-09-02 19:20 - 2016-08-20 00:19 - 00097792 _____ (Microsoft Corporation) C:\WINDOWS\system32\NFCProvisioningPlugin.dll

2016-09-02 19:20 - 2016-08-20 00:19 - 00083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProvPluginEng.dll

2016-09-02 19:20 - 2016-08-20 00:18 - 00200704 _____ (Microsoft Corporation) C:\WINDOWS\system32\provisioningcsp.dll

2016-09-02 19:20 - 2016-08-20 00:18 - 00186880 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe

2016-09-02 19:20 - 2016-08-20 00:18 - 00066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\provtool.exe

2016-09-02 19:20 - 2016-08-20 00:17 - 00235008 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCore.dll

2016-09-02 19:20 - 2016-08-20 00:17 - 00227840 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdd.dll

2016-09-02 19:20 - 2016-08-20 00:17 - 00026112 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManagerSvc.dll

2016-09-02 19:20 - 2016-08-20 00:16 - 02755584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb

2016-09-02 19:20 - 2016-08-20 00:16 - 00380928 _____ (Microsoft Corporation) C:\WINDOWS\system32\wincorlib.dll

2016-09-02 19:20 - 2016-08-20 00:16 - 00200704 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipboardServer.dll

2016-09-02 19:20 - 2016-08-20 00:15 - 00349184 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll

2016-09-02 19:20 - 2016-08-20 00:15 - 00295424 _____ (Microsoft Corporation) C:\WINDOWS\system32\provhandlers.dll

2016-09-02 19:20 - 2016-08-20 00:14 - 00220672 _____ (Microsoft Corporation) C:\WINDOWS\system32\provops.dll

2016-09-02 19:20 - 2016-08-20 00:14 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\provdatastore.dll

2016-09-02 19:20 - 2016-08-20 00:14 - 00012800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\c_GSM7.DLL

2016-09-02 19:20 - 2016-08-20 00:13 - 00568832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Speech.UXRes.dll

2016-09-02 19:20 - 2016-08-20 00:12 - 01014784 _____ (Microsoft Corporation) C:\WINDOWS\system32\XblAuthManager.dll

2016-09-02 19:20 - 2016-08-20 00:12 - 00605184 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvr.exe

2016-09-02 19:20 - 2016-08-20 00:12 - 00521728 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll

2016-09-02 19:20 - 2016-08-20 00:11 - 00410624 _____ (Microsoft Corporation) C:\WINDOWS\system32\facecredentialprovider.dll

2016-09-02 19:20 - 2016-08-20 00:11 - 00089600 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatepolicy.dll

2016-09-02 19:20 - 2016-08-20 00:10 - 00956416 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll

2016-09-02 19:20 - 2016-08-20 00:10 - 00775168 _____ (Microsoft Corporation) C:\WINDOWS\system32\GamePanel.exe

2016-09-02 19:20 - 2016-08-20 00:10 - 00539136 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll

2016-09-02 19:20 - 2016-08-20 00:09 - 09128448 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll

2016-09-02 19:20 - 2016-08-20 00:09 - 00642048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.InkControls.dll

2016-09-02 19:20 - 2016-08-20 00:09 - 00491520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcastdvr.exe

2016-09-02 19:20 - 2016-08-20 00:08 - 01906176 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_fs.dll

2016-09-02 19:20 - 2016-08-20 00:08 - 01547264 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_health.dll

2016-09-02 19:20 - 2016-08-20 00:08 - 00204288 _____ (Windows ® Win 7 DDK provider) C:\WINDOWS\system32\DscCoreConfProv.dll

2016-09-02 19:20 - 2016-08-20 00:08 - 00171520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ClipboardServer.dll

2016-09-02 19:20 - 2016-08-20 00:07 - 00288768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wincorlib.dll

2016-09-02 19:20 - 2016-08-20 00:07 - 00023552 _____ (Microsoft Corporation) C:\WINDOWS\system32\smphost.dll

2016-09-02 19:20 - 2016-08-20 00:06 - 00025600 _____ (Microsoft Corporation) C:\WINDOWS\system32\storagewmi_passthru.dll

2016-09-02 19:20 - 2016-08-20 00:05 - 00715264 _____ (Microsoft Corporation) C:\WINDOWS\system32\clusapi.dll

2016-09-02 19:20 - 2016-08-20 00:05 - 00380928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredProvDataModel.dll

2016-09-02 19:20 - 2016-08-20 00:04 - 03245056 _____ (Microsoft Corporation) C:\WINDOWS\system32\mispace.dll

2016-09-02 19:20 - 2016-08-20 00:04 - 00592384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GamePanel.exe

2016-09-02 19:20 - 2016-08-20 00:04 - 00074240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\updatepolicy.dll

2016-09-02 19:20 - 2016-08-20 00:04 - 00026112 _____ (Microsoft Corporation) C:\WINDOWS\system32\delegatorprovider.dll

2016-09-02 19:20 - 2016-08-20 00:03 - 04749312 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll

2016-09-02 19:20 - 2016-08-20 00:03 - 02846208 _____ (Microsoft Corporation) C:\WINDOWS\system32\storagewmi.dll

2016-09-02 19:20 - 2016-08-20 00:03 - 00944640 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll

2016-09-02 19:20 - 2016-08-20 00:02 - 01217024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Audio.dll

2016-09-02 19:20 - 2016-08-20 00:00 - 01316352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_fs.dll

2016-09-02 19:20 - 2016-08-20 00:00 - 00141824 _____ (Windows ® Win 7 DDK provider) C:\WINDOWS\SysWOW64\DscCoreConfProv.dll

2016-09-02 19:20 - 2016-08-19 23:59 - 07624192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll

2016-09-02 19:20 - 2016-08-19 23:59 - 02510848 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkMobileSettings.dll

2016-09-02 19:20 - 2016-08-19 23:59 - 01690112 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll

2016-09-02 19:20 - 2016-08-19 23:59 - 01106944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_health.dll

2016-09-02 19:20 - 2016-08-19 23:59 - 00020992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\smphost.dll

2016-09-02 19:20 - 2016-08-19 23:58 - 01643008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Speech.dll

2016-09-02 19:20 - 2016-08-19 23:58 - 00020480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\storagewmi_passthru.dll

2016-09-02 19:20 - 2016-08-19 23:57 - 02680832 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll

2016-09-02 19:20 - 2016-08-19 23:57 - 02264064 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll

2016-09-02 19:20 - 2016-08-19 23:57 - 00558080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\clusapi.dll

2016-09-02 19:20 - 2016-08-19 23:56 - 02711040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mispace.dll

2016-09-02 19:20 - 2016-08-19 23:56 - 02143232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\storagewmi.dll

2016-09-02 19:20 - 2016-08-19 23:56 - 01006080 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3D12.dll

2016-09-02 19:20 - 2016-08-19 23:56 - 00020992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\delegatorprovider.dll

2016-09-02 19:20 - 2016-08-19 23:54 - 00806912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3D12.dll

2016-09-02 19:20 - 2016-08-19 23:53 - 03617792 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys

2016-09-02 19:20 - 2016-08-19 23:53 - 03299328 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstsc.exe

2016-09-02 19:20 - 2016-08-19 23:53 - 01220608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Audio.dll

2016-09-02 19:20 - 2016-08-19 23:51 - 01170944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Speech.dll

2016-09-02 19:20 - 2016-08-19 23:50 - 01875456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll

2016-09-02 19:20 - 2016-08-19 23:49 - 02999296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys

2016-09-02 19:20 - 2016-08-19 23:46 - 03105792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstsc.exe

2016-09-02 19:20 - 2016-08-18 20:33 - 00162850 _____ C:\WINDOWS\system32\C_932.NLS

2016-09-02 19:19 - 2016-08-20 00:14 - 00058880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ConfigureExpandedStorage.dll

2016-09-02 19:19 - 2016-08-20 00:11 - 00156672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BcastDVRHelper.dll

2016-09-02 19:19 - 2016-08-19 23:56 - 00909312 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Search.dll

2016-08-30 15:58 - 2016-08-30 15:58 - 00050977 _____ C:\Users\Brian\Downloads\Act150.pdf

2016-08-25 19:26 - 2016-08-05 23:17 - 00450400 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys

2016-08-25 19:26 - 2016-08-05 23:17 - 00224096 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys

2016-08-25 19:26 - 2016-08-05 23:16 - 00435040 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys

2016-08-25 19:26 - 2016-08-05 22:19 - 01812480 _____ (Microsoft Corporation) C:\WINDOWS\system32\ResetEngine.dll

2016-08-25 19:25 - 2016-08-05 22:40 - 00239104 _____ (Microsoft Corporation) C:\WINDOWS\system32\dafpos.dll

2016-08-25 19:23 - 2016-08-05 23:29 - 00128352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\partmgr.sys

2016-08-25 19:23 - 2016-08-05 22:31 - 00100864 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpninprc.dll

2016-08-25 19:21 - 2016-08-05 04:12 - 05622600 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe

2016-08-25 19:20 - 2016-08-05 23:33 - 00354264 _____ (Microsoft Corporation) C:\WINDOWS\system32\systemreset.exe

2016-08-25 19:20 - 2016-08-05 23:31 - 00041824 _____ (Microsoft Corporation) C:\WINDOWS\system32\SysResetErr.exe

2016-08-25 19:20 - 2016-08-05 04:14 - 01066328 _____ (Microsoft Corporation) C:\WINDOWS\system32\pidgenx.dll

2016-08-25 19:20 - 2016-08-05 04:10 - 00939872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\pidgenx.dll

2016-08-25 19:20 - 2016-08-05 04:05 - 00665768 _____ (Microsoft Corporation) C:\WINDOWS\system32\GenValObj.exe

2016-08-25 19:12 - 2016-08-05 22:33 - 01082368 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll

2016-08-25 19:12 - 2016-08-05 03:20 - 00538112 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcext.dll

2016-08-25 19:10 - 2016-08-05 22:41 - 00068096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncPolicy.dll

2016-08-25 19:10 - 2016-08-05 03:22 - 00138240 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppc.dll

2016-08-25 19:08 - 2016-08-05 03:08 - 00135168 _____ (Microsoft Corporation) C:\WINDOWS\system32\slc.dll

2016-08-25 19:05 - 2016-08-05 03:28 - 00022016 _____ (Microsoft Corporation) C:\WINDOWS\system32\slcext.dll

2016-08-25 19:04 - 2016-08-05 22:48 - 00011264 _____ (Microsoft Corporation) C:\WINDOWS\system32\ResetEngine.exe

2016-08-25 18:17 - 2016-08-05 23:18 - 00396168 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanapi.dll

2016-08-25 18:17 - 2016-08-05 22:48 - 00015872 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanhlp.dll

2016-08-25 18:17 - 2016-08-05 22:47 - 00027648 _____ (Microsoft Corporation) C:\WINDOWS\system32\WiFiConfigSP.dll

2016-08-25 18:17 - 2016-08-05 22:43 - 00026112 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvcpal.dll

2016-08-25 18:17 - 2016-08-05 22:41 - 00462336 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansec.dll

2016-08-25 18:17 - 2016-08-05 22:41 - 00412160 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanmsm.dll

2016-08-25 18:17 - 2016-08-05 22:39 - 00298496 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifiprofilessettinghandler.dll

2016-08-25 18:17 - 2016-08-05 22:38 - 17187328 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll

2016-08-25 18:17 - 2016-08-05 22:30 - 13080576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll

2016-08-25 18:17 - 2016-08-05 22:23 - 02370048 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll

2016-08-25 18:16 - 2016-08-05 23:08 - 00509784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe

2016-08-25 18:16 - 2016-08-05 22:40 - 00426496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OneDriveSettingSyncProvider.dll

2016-08-25 18:16 - 2016-08-05 22:23 - 00860672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll

2016-08-25 18:13 - 2016-08-05 22:31 - 12174336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll

2016-08-25 18:11 - 2016-08-05 23:26 - 01176664 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll

2016-08-25 18:11 - 2016-08-05 23:03 - 00529928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mf.dll

2016-08-25 18:11 - 2016-08-05 22:48 - 01631232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll

2016-08-25 18:11 - 2016-08-05 22:28 - 00210432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\offlinesam.dll

2016-08-25 18:11 - 2016-08-05 22:21 - 00102400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\offlinelsa.dll

2016-08-25 18:10 - 2016-08-05 23:17 - 00790760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll

2016-08-25 18:10 - 2016-08-05 23:13 - 00381760 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppHost.exe

2016-08-25 18:10 - 2016-08-05 22:46 - 00047104 _____ (Microsoft Corporation) C:\WINDOWS\system32\wfdprov.dll

2016-08-25 18:10 - 2016-08-05 22:43 - 00280064 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_WorkAccess.dll

2016-08-25 18:10 - 2016-08-05 22:28 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\samlib.dll

2016-08-25 18:09 - 2016-08-05 23:09 - 00151224 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll

2016-08-25 18:09 - 2016-08-05 23:03 - 00036168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfpmp.exe

2016-08-25 18:08 - 2016-08-05 22:47 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\system32\iernonce.dll

2016-08-25 18:08 - 2016-08-05 22:45 - 00066560 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesetup.dll

2016-08-25 18:08 - 2016-08-05 22:45 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iernonce.dll

2016-08-25 18:08 - 2016-08-05 22:44 - 00061440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesetup.dll

2016-08-25 18:08 - 2016-08-05 22:42 - 00223744 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe

2016-08-25 18:08 - 2016-08-05 22:40 - 00387584 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll

2016-08-25 18:08 - 2016-08-05 22:39 - 00181760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tcpipcfg.dll

2016-08-25 18:08 - 2016-08-05 22:37 - 00340480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll

2016-08-25 18:08 - 2016-08-05 22:26 - 00758784 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll

2016-08-25 18:08 - 2016-08-05 22:26 - 00691712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll

2016-08-25 18:08 - 2016-08-05 22:24 - 02095616 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl

2016-08-25 18:08 - 2016-08-05 22:24 - 02026496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl

2016-08-25 18:07 - 2016-08-05 23:18 - 00584032 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe

2016-08-25 18:07 - 2016-08-05 23:15 - 00408600 _____ (Microsoft Corporation) C:\WINDOWS\system32\tsmf.dll

2016-08-25 18:07 - 2016-08-05 23:08 - 02251432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll

2016-08-25 18:07 - 2016-08-05 23:04 - 00361096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tsmf.dll

2016-08-25 18:07 - 2016-08-05 23:03 - 01343928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsrcsnk.dll

2016-08-25 18:07 - 2016-08-05 23:03 - 00955008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll

2016-08-25 18:07 - 2016-08-05 22:45 - 00327680 _____ (Microsoft Corporation) C:\WINDOWS\system32\container.dll

2016-08-25 18:07 - 2016-08-05 22:45 - 00049664 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorageUsage.dll

2016-08-25 18:07 - 2016-08-05 22:45 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\netiougc.exe

2016-08-25 18:07 - 2016-08-05 22:45 - 00025600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netiougc.exe

2016-08-25 18:07 - 2016-08-05 22:44 - 00035328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\deviceassociation.dll

2016-08-25 18:07 - 2016-08-05 22:40 - 00234496 _____ (Microsoft Corporation) C:\WINDOWS\system32\tcpipcfg.dll

2016-08-25 18:07 - 2016-08-05 22:39 - 00431616 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpAXHolder.dll

2016-08-25 18:07 - 2016-08-05 22:38 - 00526848 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneDriveSettingSyncProvider.dll

2016-08-25 18:07 - 2016-08-05 22:33 - 00396800 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorSvc.dll

2016-08-25 18:07 - 2016-08-05 22:25 - 03116032 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSAJApi.dll

2016-08-25 18:07 - 2016-08-05 22:23 - 01062400 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll

2016-08-25 18:06 - 2016-08-05 23:31 - 00077664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\stornvme.sys

2016-08-25 18:06 - 2016-08-05 23:23 - 00168800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys

2016-08-25 18:06 - 2016-08-05 23:17 - 00619368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys

2016-08-25 18:06 - 2016-08-05 23:13 - 01847048 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsrcsnk.dll

2016-08-25 18:06 - 2016-08-05 23:13 - 01066096 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll

2016-08-25 18:06 - 2016-08-05 23:13 - 00595488 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf.dll

2016-08-25 18:06 - 2016-08-05 23:13 - 00044472 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfpmp.exe

2016-08-25 18:06 - 2016-08-05 23:03 - 01557296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll

2016-08-25 18:06 - 2016-08-05 22:48 - 01631232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Resources.dll

2016-08-25 18:06 - 2016-08-05 22:47 - 00038400 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidusb.sys

2016-08-25 18:06 - 2016-08-05 22:46 - 00040960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidparse.sys

2016-08-25 18:06 - 2016-08-05 22:43 - 00268800 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCensus.exe

2016-08-25 18:06 - 2016-08-05 22:43 - 00156672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidclass.sys

2016-08-25 18:06 - 2016-08-05 22:41 - 13867520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll

2016-08-25 18:06 - 2016-08-05 22:41 - 00323584 _____ (Microsoft Corporation) C:\WINDOWS\system32\domgmt.dll

2016-08-25 18:06 - 2016-08-05 22:41 - 00266240 _____ (Microsoft Corporation) C:\WINDOWS\system32\ConsoleLogon.dll

2016-08-25 18:06 - 2016-08-05 22:31 - 00884224 _____ (Microsoft Corporation) C:\WINDOWS\system32\samsrv.dll

2016-08-25 18:06 - 2016-08-05 22:30 - 01255936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AzureSettingSyncProvider.dll

2016-08-25 18:06 - 2016-08-05 22:29 - 00237568 _____ (Microsoft Corporation) C:\WINDOWS\system32\offlinesam.dll

2016-08-25 18:06 - 2016-08-05 22:29 - 00123904 _____ (Microsoft Corporation) C:\WINDOWS\system32\samlib.dll

2016-08-25 18:06 - 2016-08-05 22:28 - 00544768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\uReFS.dll

2016-08-25 18:06 - 2016-08-05 22:26 - 02422784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSAJApi.dll

2016-08-25 18:06 - 2016-08-05 22:23 - 01491456 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll

2016-08-25 18:06 - 2016-08-05 22:23 - 01231872 _____ (Microsoft Corporation) C:\WINDOWS\system32\dosvc.dll

2016-08-25 18:06 - 2016-08-05 22:19 - 00114688 _____ (Microsoft Corporation) C:\WINDOWS\system32\offlinelsa.dll

2016-08-25 18:06 - 2016-08-05 03:29 - 00019968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\slcext.dll

2016-08-25 18:06 - 2016-08-05 03:20 - 00466432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sppcext.dll

2016-08-25 18:05 - 2016-08-05 22:46 - 00057344 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinBioDataModelOOBE.exe

2016-08-25 18:05 - 2016-08-05 22:41 - 00243712 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinBioDataModel.dll

2016-08-25 18:05 - 2016-08-05 22:25 - 01595904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll

2016-08-25 18:04 - 2016-08-05 23:29 - 00199008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wof.sys

2016-08-25 18:04 - 2016-08-05 22:46 - 00094720 _____ (Microsoft Corporation) C:\WINDOWS\system32\dasHost.exe

2016-08-25 18:04 - 2016-08-05 22:44 - 00047616 _____ (Microsoft Corporation) C:\WINDOWS\system32\deviceassociation.dll

2016-08-25 18:04 - 2016-08-05 22:39 - 00295424 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudBackupSettings.dll

2016-08-25 18:04 - 2016-08-05 22:36 - 00447488 _____ (Microsoft Corporation) C:\WINDOWS\system32\das.dll

2016-08-25 18:04 - 2016-08-05 22:23 - 01780736 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll

2016-08-25 18:04 - 2016-08-05 22:23 - 01508864 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys

2016-08-25 18:02 - 2016-08-05 23:18 - 02745224 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll

2016-08-25 18:02 - 2016-08-05 22:29 - 00627200 _____ (Microsoft Corporation) C:\WINDOWS\system32\uReFS.dll

2016-08-25 18:01 - 2016-08-05 23:13 - 01694200 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmde.dll

2016-08-25 18:01 - 2016-08-05 22:23 - 00520192 _____ (Microsoft Corporation) C:\WINDOWS\system32\w32time.dll

2016-08-25 18:00 - 2016-08-05 22:31 - 01052672 _____ (Microsoft Corporation) C:\WINDOWS\system32\qmgr.dll

2016-08-25 17:57 - 2016-08-05 23:08 - 00313560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlanapi.dll

2016-08-25 17:57 - 2016-08-05 22:48 - 00015360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlanhlp.dll

2016-08-25 17:57 - 2016-08-05 22:45 - 00038912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wfdprov.dll

2016-08-25 17:54 - 2016-08-05 22:45 - 00226304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\container.dll

2016-08-25 17:54 - 2016-08-05 22:41 - 00231424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudBackupSettings.dll

2016-08-25 17:54 - 2016-08-05 22:29 - 13433856 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll

2016-08-25 17:51 - 2016-08-05 22:30 - 12345344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll

2016-08-25 17:39 - 2016-08-05 22:31 - 01908224 _____ (Microsoft Corporation) C:\WINDOWS\system32\AzureSettingSyncProvider.dll

2016-08-25 17:37 - 2016-08-05 23:08 - 01469120 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll

2016-08-25 17:31 - 2016-08-05 23:08 - 00587968 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll

2016-08-25 17:31 - 2016-08-05 23:08 - 00050880 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe

2016-08-25 17:31 - 2016-08-05 23:02 - 00321280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LockAppHost.exe

2016-08-25 17:31 - 2016-08-05 22:48 - 00010752 _____ (Microsoft Corporation) C:\WINDOWS\system32\spwmp.dll

2016-08-25 17:31 - 2016-08-05 22:48 - 00009216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\spwmp.dll

2016-08-25 17:31 - 2016-08-05 22:48 - 00005120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msdxm.ocx

2016-08-25 17:31 - 2016-08-05 22:48 - 00005120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxmasf.dll

2016-08-25 17:31 - 2016-08-05 22:47 - 00006656 _____ (Microsoft Corporation) C:\WINDOWS\system32\msdxm.ocx

2016-08-25 17:31 - 2016-08-05 22:47 - 00006656 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxmasf.dll

2016-08-25 17:31 - 2016-08-05 22:46 - 09260032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmploc.DLL

2016-08-25 17:31 - 2016-08-05 22:46 - 09260032 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmploc.DLL

2016-08-25 17:31 - 2016-08-05 22:40 - 00083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncPolicy.dll

2016-08-25 17:31 - 2016-08-05 03:23 - 00105984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sppc.dll

2016-08-25 17:31 - 2016-08-05 03:18 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\slc.dll

2016-08-22 18:18 - 2016-08-22 18:18 - 00000000 ____D C:\Users\Brian\Documents\Personal and Confidential - Copy

2016-08-22 18:17 - 2016-09-04 20:20 - 00000000 ____D C:\Users\Brian\Documents\Personal and Confidential

2016-08-21 23:25 - 2016-08-21 23:25 - 08227032 _____ (Piriform Ltd) C:\Users\Brian\Downloads\ccsetup521.exe

2016-08-13 23:02 - 2016-08-13 23:03 - 01190712 _____ (Alcpu ) C:\Users\Brian\Downloads\Core-Temp-setup (1).exe

 

==================== One Month Modified files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2016-09-12 17:36 - 2016-03-21 18:25 - 00000000 ____D C:\ProgramData\Adguard

2016-09-12 17:34 - 2016-06-29 19:29 - 00057229 _____ C:\WINDOWS\ZAM_Guard.krnl.trace

2016-09-12 17:34 - 2015-11-08 16:29 - 00000000 ____D C:\Users\Brian\AppData\Local\Packages

2016-09-12 17:29 - 2015-11-09 19:12 - 00000000 ____D C:\Users\Brian\Documents\Outlook Files

2016-09-12 17:28 - 2016-07-16 06:47 - 00000000 ___HD C:\Program Files\WindowsApps

2016-09-12 17:28 - 2016-07-16 06:47 - 00000000 ____D C:\WINDOWS\AppReadiness

2016-09-12 09:05 - 2016-08-04 00:16 - 00000000 ____D C:\WINDOWS\system32\SleepStudy

2016-09-12 09:00 - 2016-08-11 23:14 - 00000000 ____D C:\IBVSSTEMP

2016-09-12 09:00 - 2015-12-09 18:52 - 00000000 ____D C:\ProgramData\IDrive

2016-09-12 08:56 - 2011-07-15 01:06 - 00000000 ____D C:\Program Files (x86)\Microsoft Office

2016-09-12 08:38 - 2016-08-04 00:40 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2016-09-12 08:38 - 2016-03-21 18:25 - 00000000 ____D C:\Program Files (x86)\Adguard

2016-09-12 08:36 - 2016-07-16 01:04 - 00524288 _____ C:\WINDOWS\system32\config\BBI

2016-09-12 08:22 - 2015-12-18 18:47 - 00000000 ____D C:\Users\Brian\AppData\LocalLow\Temp

2016-09-11 14:02 - 2016-07-31 03:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Core Temp

2016-09-11 14:02 - 2016-07-31 03:26 - 00000000 ____D C:\Program Files\Core Temp

2016-09-10 20:40 - 2016-02-27 22:03 - 18640896 _____ C:\Users\Brian\Downloads\DigitalCouponPrinter-3.50.0.0.msi

2016-09-10 18:25 - 2016-06-29 19:34 - 00000000 ____D C:\AdwCleaner

2016-09-10 04:47 - 2016-02-07 04:20 - 00000000 ____D C:\Users\Brian\AppData\Roaming\brave

2016-09-09 20:59 - 2016-05-26 21:49 - 00000000 ____D C:\Users\Brian\AppData\Local\brave

2016-09-09 20:59 - 2016-01-28 19:11 - 00000000 ____D C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Brave Inc

2016-09-08 07:09 - 2016-06-29 19:26 - 00000000 ____D C:\ProgramData\HitmanPro

2016-09-07 22:43 - 2016-08-04 00:18 - 00000000 ____D C:\ProgramData\Package Cache

2016-09-07 22:43 - 2016-03-21 18:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adguard

2016-09-07 22:38 - 2016-07-23 00:43 - 00000000 ____D C:\Program Files (x86)\Yahoo!

2016-09-07 21:24 - 2015-11-09 23:23 - 00000000 ____D C:\ProgramData\Malwarebytes

2016-09-06 06:23 - 2016-07-16 06:45 - 00000000 ____D C:\WINDOWS\INF

2016-09-05 12:02 - 2015-11-15 13:58 - 00000000 ____D C:\Users\Brian\AppData\Roaming\Dashlane

2016-09-05 02:16 - 2016-07-16 06:47 - 00000000 ____D C:\WINDOWS\LiveKernelReports

2016-09-04 22:07 - 2015-09-10 00:42 - 00000000 __RHD C:\Users\Public\AccountPictures

2016-09-04 21:58 - 2016-07-16 06:47 - 00000000 ___SD C:\WINDOWS\system32\dsc

2016-09-04 21:58 - 2016-07-16 06:47 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns

2016-09-04 21:58 - 2016-07-16 06:47 - 00000000 ____D C:\WINDOWS\system32\lv-LV

2016-09-04 21:58 - 2016-07-16 06:47 - 00000000 ____D C:\WINDOWS\system32\lt-LT

2016-09-04 21:58 - 2016-07-16 06:47 - 00000000 ____D C:\WINDOWS\system32\et-EE

2016-09-04 21:58 - 2016-07-16 06:47 - 00000000 ____D C:\WINDOWS\system32\es-MX

2016-09-04 21:58 - 2016-07-16 06:47 - 00000000 ____D C:\WINDOWS\system32\en-GB

2016-09-04 21:57 - 2016-07-16 06:47 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel

2016-09-04 21:57 - 2016-07-16 06:47 - 00000000 ____D C:\WINDOWS\ShellExperiences

2016-09-04 21:57 - 2016-07-16 06:47 - 00000000 ____D C:\WINDOWS\Provisioning

2016-09-04 21:12 - 2015-11-08 15:33 - 00000000 ____D C:\ESD

2016-09-04 21:08 - 2016-07-16 06:36 - 00000000 ____D C:\WINDOWS\CbsTemp

2016-09-04 15:57 - 2016-08-04 03:07 - 00000000 ____D C:\WINDOWS\system32\msmq

2016-09-02 18:43 - 2016-07-16 06:42 - 00409952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS

2016-09-02 18:41 - 2016-07-16 06:43 - 06474752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mspaint.exe

2016-09-02 18:41 - 2016-07-16 06:43 - 00496128 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettings.UserAccountsHandlers.dll

2016-09-02 18:41 - 2016-07-16 06:43 - 00374784 _____ (Microsoft Corporation) C:\WINDOWS\system32\resutils.dll

2016-09-02 18:41 - 2016-07-16 06:43 - 00298496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\resutils.dll

2016-09-02 18:41 - 2016-07-16 06:43 - 00289792 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeveloperOptionsSettingsHandlers.dll

2016-09-02 18:41 - 2016-07-16 06:43 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll

2016-09-02 18:41 - 2016-07-16 06:43 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LaunchWinApp.exe

2016-09-02 18:41 - 2016-07-16 06:42 - 06664192 _____ (Microsoft Corporation) C:\WINDOWS\system32\mspaint.exe

2016-09-02 18:41 - 2016-07-16 06:42 - 00711680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Search.dll

2016-09-02 18:41 - 2016-07-16 06:42 - 00241504 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHost.dll

2016-09-02 18:41 - 2016-07-16 06:42 - 00210944 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys

2016-09-02 18:41 - 2016-07-16 06:42 - 00150528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32k.sys

2016-09-02 18:41 - 2016-07-16 06:42 - 00114192 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32u.dll

2016-09-02 18:41 - 2016-07-16 06:42 - 00079544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32u.dll

2016-09-02 18:41 - 2016-07-16 06:42 - 00058880 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Shell.Search.UriHandler.dll

2016-09-02 18:41 - 2016-07-16 06:42 - 00047104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Shell.Search.UriHandler.dll

2016-09-02 18:41 - 2016-07-16 06:42 - 00043008 _____ (Microsoft Corporation) C:\WINDOWS\system32\LaunchWinApp.exe

2016-09-02 18:15 - 2016-06-25 19:28 - 00073600 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys

2016-09-01 23:19 - 2016-01-22 23:21 - 00000000 ____D C:\Program Files\SUPERAntiSpyware

2016-08-27 19:42 - 2016-07-16 06:47 - 00000000 ____D C:\WINDOWS\system32\appraiser

2016-08-26 00:43 - 2016-07-16 06:49 - 00828408 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe

2016-08-26 00:43 - 2016-07-16 06:49 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl

2016-08-25 08:09 - 2016-07-16 06:47 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft

2016-08-22 18:21 - 2016-01-31 22:57 - 00000000 ____D C:\Users\Brian\Documents\Drive K - Documents Backup

2016-08-21 23:26 - 2016-08-09 21:05 - 00000865 _____ C:\Users\Public\Desktop\CCleaner.lnk

2016-08-21 16:08 - 2016-08-04 00:40 - 00003290 _____ C:\WINDOWS\System32\Tasks\HPCeeScheduleForBRIAN-HP$

2016-08-18 19:23 - 2016-03-21 19:42 - 00000000 ____D C:\Users\Brian\Documents\Latest Reumes

2016-08-16 19:52 - 2015-11-16 18:43 - 00000000 _____ C:\Users\Brian\AppData\LocalLow\rightsCheck_1.txt

2016-08-13 23:43 - 2016-08-04 00:22 - 00000000 ____D C:\Users\Brian

 

==================== Files in the root of some directories =======

 

2016-03-17 20:24 - 2016-03-17 20:24 - 0007602 _____ () C:\Users\Brian\AppData\Local\Resmon.ResmonCfg

2015-11-08 17:13 - 2015-11-08 17:13 - 0000057 _____ () C:\ProgramData\Ament.ini

2016-09-12 08:19 - 2016-09-12 08:19 - 0000257 _____ () C:\ProgramData\fontcacheev1.dat

 

Files to move or delete:

====================

C:\ProgramData\fontcacheev1.dat

 

 

==================== Bamital & volsnap =================

 

(There is no automatic fix for files that do not pass verification.)

 

C:\WINDOWS\system32\winlogon.exe => File is digitally signed

C:\WINDOWS\system32\wininit.exe => File is digitally signed

C:\WINDOWS\explorer.exe => File is digitally signed

C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed

C:\WINDOWS\system32\svchost.exe => File is digitally signed

C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed

C:\WINDOWS\system32\services.exe => File is digitally signed

C:\WINDOWS\system32\User32.dll => File is digitally signed

C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed

C:\WINDOWS\system32\userinit.exe => File is digitally signed

C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed

C:\WINDOWS\system32\rpcss.dll => File is digitally signed

C:\WINDOWS\system32\dnsapi.dll => File is digitally signed

C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed

C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

 

 

LastRegBack: 2016-09-08 05:55

 

==================== End of FRST.txt ============================

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-09-2016

Ran by Brian (12-09-2016 17:36:25)

Running from C:\Users\Brian\Desktop

Windows 10 Home Version 1607 (X64) (2016-08-04 08:27:25)

Boot Mode: Normal

==========================================================

 

 

==================== Accounts: =============================

 

Administrator (S-1-5-21-1563961910-250262785-1644635927-500 - Administrator - Disabled)

Brian (S-1-5-21-1563961910-250262785-1644635927-1001 - Administrator - Enabled) => C:\Users\Brian

DefaultAccount (S-1-5-21-1563961910-250262785-1644635927-503 - Limited - Disabled)

Guest (S-1-5-21-1563961910-250262785-1644635927-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-1563961910-250262785-1644635927-1002 - Limited - Enabled)

SophosSAUBRIAN-HP0 (S-1-5-21-1563961910-250262785-1644635927-1009 - Limited - Enabled)

 

==================== Security Center ========================

 

(If an entry is included in the fixlist, it will be removed.)

 

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AV: Sophos Home (Enabled - Up to date) {6BABF8F7-3EB6-BD1D-9167-8C5ECA060A29}

AS: Sophos Home (Enabled - Up to date) {D0CA1913-188C-B293-ABD7-B72CB1814094}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 

==================== Installed Programs ======================

 

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 

ActiveCheck component for HP Active Support Library (x32 Version: 3.0.0.3 - Hewlett-Packard) Hidden

Adguard (HKLM-x32\...\{25902abd-601f-4fb7-9932-5c5064fe3392}) (Version: 6.1.258.1302 - Performix LLC)

Adguard (x32 Version: 6.1.258.1302 - Performix LLC) Hidden

Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.017.20053 - Adobe Systems Incorporated)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 20.0.0.196 - Adobe Systems Incorporated)

Adobe Flash Player 10 ActiveX (HKLM-x32\...\{18BBF24A-6D04-4CA4-B6B4-1CF372162EEC}) (Version: 10.2.152.32 - Adobe Systems Incorporated)

Adobe Flash Player 22 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 22.0.0.209 - Adobe Systems Incorporated)

Adobe Flash Player 22 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 22.0.0.209 - Adobe Systems Incorporated)

Amazon Kindle (HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\Amazon Kindle) (Version: 1.15.0.43061 - Amazon)

AMD Catalyst Control Center (HKLM-x32\...\WUCCCApp) (Version: 1.00.0000 - AMD)

Apple Application Support (32-bit) (HKLM-x32\...\{D4B07658-F443-4445-A261-E643996E139D}) (Version: 4.3.2 - Apple Inc.)

Apple Application Support (64-bit) (HKLM\...\{A6B0442B-E159-444B-B49D-6B9AC531EAE3}) (Version: 4.3.2 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{2E4AF2A6-50EA-4260-9BA4-5E582D11879A}) (Version: 9.3.0.15 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)

ATI Catalyst Install Manager (HKLM\...\{3001791D-2CA6-6FE3-BE0F-8EA7522B32D4}) (Version: 3.0.795.0 - ATI Technologies, Inc.)

ATI Stream SDK v2 Developer (HKLM\...\{80C27FE9-C6C4-F5C8-EAD3-09E7E0102E78}) (Version: 2.2.0.0 - ATI Technologies Inc.)

Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)

Brave (HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\Brave) (Version: 0.12.0 - Brave Software)

ccc-core-static (x32 Version: 2010.1123.1002.17926 - ATI) Hidden

CCleaner (HKLM\...\CCleaner) (Version: 5.21 - Piriform)

Core Temp 1.3 (HKLM\...\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1) (Version: 1.3 - ALCPU)

CryptoPrevent (HKLM-x32\...\{5C5B24E7-4694-4049-A222-CCE7D3FAC63F}_is1) (Version:  - Foolish IT LLC)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

Dashlane (HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\Dashlane) (Version: 4.6.0.17042 - Dashlane SAS)

DetectorTools (HKLM-x32\...\{E8F0431A-A158-49F6-96AC-7C1380D9AF21}) (Version: 1.11.60 - Escort)

Digital Coupon Printer (HKLM-x32\...\{2CDD20A5-DFDE-4AC0-97DD-F60B1196BF98}) (Version: 3.50.0.0 - Hopster, Inc. an Inmar company)

Diskeeper 15 (HKLM\...\{9A17EDA8-85DD-4B99-AB97-6B5D58A878E0}) (Version: 18.0.1104.64 - Condusiv Technologies)

DriverAgent by eSupport.com (HKLM-x32\...\DriverAgent_is1) (Version:  - Copyright © 2015 eSupport.com, Inc • All Rights Reserved)

FileHippo App Manager (HKLM-x32\...\FileHippo.com) (Version:  - FileHippo.com)

Fitbit Connect (HKLM-x32\...\{6EB73D9D-645E-415B-8008-83C3CB865968}) (Version: 2.0.1.6742 - Fitbit Inc.)

Fort - File encryption for Windows (HKLM\...\{9A974296-4913-4776-9892-F4EB17B513FB}_is1) (Version: 2.0.0.0 - Niko Rosvall)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 52.0.2743.116 - Google Inc.)

Google Update Helper (x32 Version: 1.3.31.5 - Google Inc.) Hidden

HitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.14.276 - SurfRight B.V.)

HP Odometer (HKLM-x32\...\{B8AC1A89-FFD1-4F97-8051-E505A160F562}) (Version: 2.10.0000 - Hewlett-Packard)

HP Officejet 6500 E710a-f Basic Device Software (HKLM\...\{22FCD3B0-CAA7-444A-84AC-75716545EAB9}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)

HP Officejet 6500 E710a-f Help (HKLM-x32\...\{037CD593-D760-4A00-B030-7BBAFA1123FE}) (Version: 140.0.2.2 - Hewlett Packard)

HP Officejet 6500 E710a-f Product Improvement Study (HKLM\...\{8F3591D0-074B-4F7B-A269-39FE61C9CB5C}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)

HP Setup (HKLM-x32\...\{210A03F5-B2ED-4947-B27E-516F50CBB292}) (Version: 8.6.4530.3651 - Hewlett-Packard Company)

HP Setup Manager (HKLM-x32\...\{AE856388-AFAD-4753-81DF-D96B19D0A17C}) (Version: 1.1.13253.3682 - Hewlett-Packard Company)

HP Support Assistant (HKLM-x32\...\{79C54A05-F146-4EA0-8A70-D4EFE6181E52}) (Version: 8.3.34.7 - Hewlett-Packard Company)

HP Support Information (HKLM-x32\...\{7F2A11F4-EAE8-4325-83EC-E3E99F85169E}) (Version: 10.1.1000 - Hewlett-Packard)

HP Support Solutions Framework (HKLM-x32\...\{F6A11738-3EE4-4573-AEA5-6CD5D491C167}) (Version: 12.5.32.37 - Hewlett-Packard Company)

HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)

HP Vision Hardware Diagnostics (HKLM\...\{D79A02E9-6713-4335-9668-AAC7474C0C0E}) (Version: 2.5.0.0 - Hewlett-Packard)

HPAsset component for HP Active Support Library (x32 Version: 3.0.0.3 - Hewlett-Packard) Hidden

Hulu Desktop (HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\HuluDesktop) (Version: 0.9.13 - Hulu LLC)

HydraVision (x32 Version: 4.2.180.0 - ATI Technologies Inc.) Hidden

I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)

IDrive Version - 6.0 (HKLM-x32\...\IDrive_is1) (Version: 6.0 - Pro Softnet Corp)

Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)

iTunes (HKLM\...\{955524E7-79EB-4CA9-BA4D-FD2DF587651B}) (Version: 12.4.3.1 - Apple Inc.)

Java 8 Update 101 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180101F0}) (Version: 8.0.1010.13 - Oracle Corporation)

Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

Malwarebytes Anti-Exploit version 1.8.1.2572 (HKLM\...\Malwarebytes Anti-Exploit_is1) (Version: 1.8.1.2572 - Malwarebytes)

Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)

Microsoft Office 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 16.0.7167.2040 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50428.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)

MiniTool Power Data Recovery Edition 7.0 (HKLM\...\MiniTool Power Data Recovery Edition_is1) (Version:  - MiniTool Solution Ltd.)

Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

MyHarmony (HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\036a0e4fc6a247ec) (Version: 1.0.1.257 - Logitech)

NirSoft RegScanner (HKLM-x32\...\NirSoft RegScanner) (Version:  - )

NirSoft Wireless Network Watcher (HKLM-x32\...\NirSoft Wireless Network Watcher) (Version:  - )

Office 16 Click-to-Run Extensibility Component (x32 Version: 16.0.7167.2040 - Microsoft Corporation) Hidden

Office 16 Click-to-Run Licensing Component (Version: 16.0.7167.2040 - Microsoft Corporation) Hidden

Office 16 Click-to-Run Localization Component (x32 Version: 16.0.7167.2040 - Microsoft Corporation) Hidden

Pale Moon 26.3.3 (x86 en-US) (HKLM-x32\...\Pale Moon 26.3.3 (x86 en-US)) (Version: 26.3.3 - Moonchild Productions)

PDF Complete Special Edition (HKLM-x32\...\PDF Complete) (Version: 4.0.35 - PDF Complete, Inc)

PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)

RealDownloader (x32 Version: 18.1.2.176 - RealNetworks, Inc.) Hidden

RealDownloader (x32 Version: 18.1.2.179 - RealNetworks) Hidden

RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden

RealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0 - RealNetworks, Inc) Hidden

RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0 - RealNetworks, Inc) Hidden

RealPlayer (RealTimes) (HKLM-x32\...\RealPlayer 18.1) (Version: 18.1.2 - RealNetworks)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6662 - Realtek Semiconductor Corp.)

RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) Hidden

Recovery Manager (x32 Version: 5.5.3621 - CyberLink Corp.) Hidden

Revo Uninstaller Pro 3.1.6 (HKLM\...\{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1) (Version: 3.1.6 - VS Revo Group, Ltd.)

Should I Remove It (HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\Should I Remove It 1.0.4) (Version: 1.0.4 - Reason Software Company Inc.)

Should I Remove It (x32 Version: 1.0.4 - Reason Software Company Inc.) Hidden

Skype™ 7.17 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.17.106 - Skype Technologies S.A.)

Sophos Anti-Virus (HKLM-x32\...\{D929B3B5-56C6-46CC-B3A3-A1A784CBB8E4}) (Version: 10.5.4 - Sophos Limited)

Sophos AutoUpdate (HKLM-x32\...\{9D1B8594-5DD2-4CDC-A5BD-98E7E9D75520}) (Version: 5.3.0.516 - Sophos Limited)

Sophos Management Communications System (HKLM-x32\...\{1FFD3F20-5D24-4C9A-B9F6-A207A53CF179}) (Version: 2.0.1 - Sophos Limited)

SpywareBlaster 5.5 (HKLM-x32\...\SpywareBlaster_is1) (Version: 5.5.0 - BrightFort LLC)

SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 6.0.1212 - SUPERAntiSpyware.com)

TunesKit Audiobook Converter 2.3.2.10 (HKLM-x32\...\TunesKit Audiobook Converter_is1) (Version:  - TunesKit, Inc.)

UpdateService (x32 Version: 1.0.0 - RealNetworks, Inc.) Hidden

Video Downloader (x32 Version: 1.0.0 - RealNetworks) Hidden

VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.2 - VideoLAN)

Windows 10 Upgrade Assistant (HKLM-x32\...\{D5C69738-B486-402E-85AC-2456D98A64E4}) (Version: 1.4.9200.17346 - Microsoft Corporation)

Windows Driver Package - ESCORT Inc. (WinUSB) MyDeviceClass  (07/22/2014 ) (HKLM\...\D0C35FE98CEDEF60A59F31DC022A63EFCF48559E) (Version: 07/22/2014  - ESCORT Inc.)

Windows Driver Package - ESCORT, Inc. (usbser) Ports  (04/24/2013 1.0.0.0) (HKLM\...\81CF09C262F2AF50FED94F55B77F731D76C948F2) (Version: 04/24/2013 1.0.0.0 - ESCORT, Inc.)

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)

WinX DVD Ripper Platinum 7.5.12 (HKLM-x32\...\WinX DVD Ripper Platinum_is1) (Version:  - Digiarty Software, Inc.)

WonderFox DVD Video Converter 8.8 (HKLM-x32\...\WonderFox DVD Video Converter) (Version: 8.8 - WonderFox Soft, Inc.)

YoWindow (HKLM-x32\...\yowindow) (Version: 3 - RepkaSoft)

 

==================== Custom CLSID (Whitelisted): ==========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

CustomCLSID: HKU\S-1-5-21-1563961910-250262785-1644635927-1001_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\Brian\AppData\Local\Microsoft\OneDrive\17.3.6390.0509_1\FileCoAuth.exe (Microsoft Corporation)

 

==================== Scheduled Tasks (Whitelisted) =============

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

Task: {042937CB-5476-4C2A-8480-C5E036578E2B} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\Windows\ehome\ehPrivJob.exe

Task: {06D58ED9-2FD4-4825-B8AB-6324F047E5A0} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)

Task: {0F276872-AB99-46F3-A08E-BA357BF36A48} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater - Resources => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2016-08-03] (HP Inc.)

Task: {0F7CAE4F-9DE1-43E3-A6E8-C77313EB7E10} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2016-08-23] (HP Inc.)

Task: {18AD7D57-DFD5-4BCC-8EEA-E63435130B8D} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe

Task: {2384715A-B350-4B09-BBDE-65B9C6613BB6} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-08-11] (Microsoft Corporation)

Task: {2B790A28-F946-4A0F-97B5-0EB97BE9934C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2016-08-03] (HP Inc.)

Task: {31073B34-AB62-4B97-8E12-4DF0CAF76CDD} - System32\Tasks\Hewlett-Packard\HP Active Health\HP Active Health Scan (HPSA) => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2016-08-18] (HP Inc.)

Task: {341A5A91-8362-4F47-B457-2E871B4B19FF} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2016-08-23] (HP Inc.)

Task: {35A742C1-2971-4943-A2E3-29AD462FFAAC} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\Windows\ehome\ehPrivJob.exe

Task: {3ACF76E4-F5DF-431C-BEA2-BE70CF85AE6D} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\Windows\ehome\mcupdate.exe

Task: {448270B0-5154-498D-B24D-AE71E7DB5927} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\Windows\ehome\ehPrivJob.exe

Task: {4EF9C94A-BEB8-4886-8EFB-6F8DC72DE967} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\Windows\ehome\ehPrivJob.exe

Task: {53ABC437-1B0B-41C8-BFA8-0949927B2CAE} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\Windows\ehome\ehPrivJob.exe

Task: {55FDF64B-3C5A-49F4-9EC4-597B575CA285} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\Windows\ehome\ehPrivJob.exe

Task: {60C6872D-D8C5-4B88-8980-45D08F81447E} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\Windows\ehome\mcupdate.exe

Task: {66373DB8-4A8D-49A8-88A9-7AC45A9257AE} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\Windows\ehome\MCUpdate.exe

Task: {6675AE0A-1AF3-4EF4-9D78-CEF029F9787F} - System32\Tasks\HPCeeScheduleForBrian => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2015-06-16] (Hewlett-Packard)

Task: {67BBD5B0-09A6-42B4-A932-D4A5B0DB3FBF} - System32\Tasks\HPCeeScheduleForBRIAN-HP$ => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2015-06-16] (Hewlett-Packard)

Task: {682DA36B-41EA-48BB-AD0E-5670EA640788} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSFReport.exe [2016-05-09] (Hewlett-Packard)

Task: {74BAAB6C-9202-448E-97EB-8382C309EDAB} - System32\Tasks\Core Temp Autostart Brian => C:\Program Files\Core Temp\Core Temp.exe [2016-09-11] ()

Task: {76028AB5-AC97-4F06-8327-7D5A47A19935} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\Windows\ehome\ehPrivJob.exe

Task: {7DC143D8-FA11-431D-A879-265CA3F1262E} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2016-08-05] (Piriform Ltd)

Task: {7FA484FA-6FF3-4578-B7CD-EA43C11F09A0} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_22_0_0_209_pepper.exe [2016-07-13] (Adobe Systems Incorporated)

Task: {8019363D-BCAD-4773-B90D-F17D42075CBA} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\Windows\ehome\mcupdate.exe

Task: {80B1311C-5F20-47B4-803A-7383240C33B8} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1563961910-250262785-1644635927-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\RealUpgrade.exe [2015-11-04] (RealNetworks, Inc.)

Task: {8D77A25D-FD6A-481A-B0D6-9678902CB9A5} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\Windows\ehome\mcupdate.exe

Task: {90F8F102-DDDF-438D-84F8-76C4849950F3} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe [2016-08-25] (Microsoft Corporation)

Task: {92741044-7CFA-4BF0-97B3-DF05B539CA26} - System32\Tasks\ModemBooster_Run => C:\Program Files (x86)\inKline Global\Modem Booster\ModemBooster.exe

Task: {97D57FBC-B035-440C-88E7-9E676CD64057} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\Windows\ehome\ehPrivJob.exe

Task: {9EE88514-786B-4C6B-B761-AD00A3815399} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\Windows\ehome\ehrec.exe

Task: {A9B32E4E-00E9-4C0A-81EA-FAC4E87128FD} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-1563961910-250262785-1644635927-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe [2015-11-04] (RealNetworks, Inc.)

Task: {ABE81196-0AAC-419A-993A-CA0F9FA7E738} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\Windows\ehome\mcupdate.exe

Task: {AECF3AE5-8D63-4D4A-90F7-33B40365CD04} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-07-13] (Adobe Systems Incorporated)

Task: {B0783751-AFAE-4BFF-B02A-3C74BBADC98E} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\Windows\ehome\ehPrivJob.exe

Task: {B4D4E86B-D688-44B1-BAC9-DE56CFA8FE85} - System32\Tasks\{4ABB3C9A-AA10-471F-BBDD-71AB9D4E726D} => pcalua.exe -a "C:\Program Files (x86)\VS Revo Group\Revo Uninstaller\Revouninstaller.exe" -d "C:\Program Files (x86)\VS Revo Group\Revo Uninstaller"

Task: {B9F1C6BE-AD04-4C0E-B7BB-5A691C4175DF} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1563961910-250262785-1644635927-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\RealUpgrade.exe [2015-11-04] (RealNetworks, Inc.)

Task: {BB891099-3F04-45DA-8DFA-066AB33B0F7D} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\Windows\ehome\ehPrivJob.exe

Task: {C0F395F2-9715-4314-A840-2E6C417F6A32} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\Windows\ehome\ehPrivJob.exe

Task: {C20D3F74-A273-407C-8621-C05C4C3635DC} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2016-08-09] (Microsoft Corporation)

Task: {C6429797-F491-4F5C-BD36-6AC08CF60D18} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\Windows\ehome\ehPrivJob.exe

Task: {CA6A9F35-9B89-4DCE-A21C-451C70916B9F} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-08-11] (Microsoft Corporation)

Task: {CF077B7A-6F49-449F-BC12-B3A17BE7D4F2} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-11-08] (Google Inc.)

Task: {D49161D9-1CF6-4461-958A-72743729BE58} - System32\Tasks\RealDownloader Update Check => C:\Program Files (x86)\RealNetworks\RealDownloader\downloader2.exe [2015-11-04] ()

Task: {D7C5CE96-D2C3-4346-9789-E2A1D5394191} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-11-08] (Google Inc.)

Task: {EE44F1BC-3A65-4249-BBAC-F4DEB17CDF61} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\Windows\ehome\mcupdate.exe

Task: {F2511BEE-366D-49C8-BB06-D1D74AAAE162} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\Windows\ehome\ehPrivJob.exe

Task: {F31E9816-34F9-4F79-95EA-B0036CA1DAB2} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2016-08-08] (HP Inc.)

Task: {F8934F0C-AEF2-4BC2-B941-09264B17B041} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\Windows\ehome\ehrec.exe

Task: {FC0FA31B-488F-4E7A-814B-0831FD99207C} - System32\Tasks\HPCustParticipation HP Officejet 6500 E710a-f => C:\Program Files\HP\HP Officejet 6500 E710a-f\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)

Task: {FFA4E59E-1368-492D-8C57-BF5870FC78A9} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-06-25] (Adobe Systems Incorporated)

 

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

 

Task: C:\WINDOWS\Tasks\HPCeeScheduleForBrian.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

 

==================== Shortcuts =============================

 

(The entries could be listed to be restored or removed.)

 

==================== Loaded Modules (Whitelisted) ==============

 

2016-07-16 06:42 - 2016-07-16 06:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll

2016-07-16 06:42 - 2016-07-16 06:42 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll

2016-03-18 22:56 - 2016-03-18 22:56 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll

2016-07-05 15:23 - 2016-07-05 15:23 - 01354040 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll

2016-07-16 06:42 - 2016-07-16 06:42 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll

2016-08-04 03:40 - 2016-08-04 03:40 - 00959168 _____ () C:\Users\Brian\AppData\Local\Microsoft\OneDrive\17.3.6390.0509_1\amd64\ClientTelemetry.dll

2016-03-15 05:24 - 2016-08-25 07:46 - 08921800 _____ () C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\1033\GrooveIntlResource.dll

2015-12-09 18:52 - 2015-11-25 14:03 - 00601600 _____ () C:\Program Files (x86)\IDriveWindows\IDContextMenu.dll

2016-07-16 06:42 - 2016-07-16 06:42 - 00130048 _____ () C:\WINDOWS\SYSTEM32\CHARTV.dll

2016-07-16 06:42 - 2016-07-16 06:42 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll

2016-07-16 06:43 - 2016-09-02 18:41 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll

2016-07-16 06:43 - 2016-09-02 18:42 - 09761280 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll

2016-09-02 19:20 - 2016-08-19 23:54 - 01401344 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll

2016-07-16 06:43 - 2016-09-02 18:42 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll

2016-07-16 06:43 - 2016-09-02 18:42 - 01033728 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll

2016-09-02 19:19 - 2016-08-19 23:54 - 02438144 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll

2016-09-02 19:20 - 2016-08-19 23:56 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll

2016-01-18 20:16 - 2015-11-25 14:03 - 00412672 _____ () C:\Program Files (x86)\IDriveWindows\Sync.dll

2015-11-15 13:59 - 2016-08-31 07:42 - 00286080 _____ () C:\Users\Brian\AppData\Roaming\Dashlane\DashlanePlugin.exe

2015-12-09 18:52 - 2016-01-18 17:27 - 00043520 _____ () C:\Program Files (x86)\IDriveWindows\RemoteManagement.dll

2015-12-09 18:52 - 2016-01-18 17:27 - 00013312 _____ () C:\Program Files (x86)\IDriveWindows\SqliteWrapper.dll

2015-12-09 18:52 - 2015-11-25 14:03 - 00834048 _____ () C:\Program Files (x86)\IDriveWindows\sqlite3.dll

2016-08-08 18:10 - 2016-08-02 18:41 - 02366280 _____ () C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\libglesv2.dll

2016-08-08 18:10 - 2016-08-02 18:40 - 00107848 _____ () C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\libegl.dll

2016-02-15 00:31 - 2016-02-22 11:17 - 00109592 _____ () C:\Program Files (x86)\Sophos\Sophos Anti-Virus\rkdisk.dll

2016-08-19 15:11 - 2016-08-19 15:11 - 01426424 _____ () C:\Program Files (x86)\Adguard\AdguardNetApi.DLL

2016-08-19 15:11 - 2016-08-19 15:11 - 00140280 _____ () C:\Program Files (x86)\Adguard\AdguardNetLib.DLL

2016-02-14 23:59 - 2016-02-14 23:59 - 00306472 _____ () C:\Program Files (x86)\Sophos\Management Communications System\Endpoint\log4cplus.dll

2014-12-11 18:40 - 2014-12-11 18:40 - 40622592 ____R () C:\Program Files (x86)\Fitbit Connect\libcef.dll

2016-02-14 23:59 - 2016-02-14 23:59 - 40629032 _____ () C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Sophos UI\libcef.dll

2016-02-14 23:59 - 2016-02-14 23:59 - 00956712 _____ () C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Sophos UI\ffmpegsumo.dll

2016-08-31 07:41 - 2016-08-31 07:41 - 00347520 _____ () C:\Users\Brian\AppData\Roaming\Dashlane\4.6.0.17042\bin\Firefox_Extension\{442718d9-475e-452a-b3e1-fb1ee16b8e9f}\components\KWDebugDll_win32.4.6.0.17042.dll

2016-08-31 07:41 - 2016-08-31 07:41 - 00436096 _____ () C:\Users\Brian\AppData\Roaming\Dashlane\4.6.0.17042\bin\Firefox_Extension\{442718d9-475e-452a-b3e1-fb1ee16b8e9f}\components\KWDebug.4.6.0.17042.dll

2016-08-31 07:41 - 2016-08-31 07:41 - 00469376 _____ () C:\Users\Brian\AppData\Roaming\Dashlane\4.6.0.17042\bin\Firefox_Extension\{442718d9-475e-452a-b3e1-fb1ee16b8e9f}\components\KWUtils.4.6.0.17042.dll

2016-08-31 07:41 - 2016-08-31 07:41 - 63120256 _____ () C:\Users\Brian\AppData\Roaming\Dashlane\4.6.0.17042\bin\Firefox_Extension\{442718d9-475e-452a-b3e1-fb1ee16b8e9f}\components\KWExternLib.4.6.0.17042.dll

2016-08-31 07:41 - 2016-08-31 07:41 - 00292736 _____ () C:\Users\Brian\AppData\Roaming\Dashlane\4.6.0.17042\bin\Firefox_Extension\{442718d9-475e-452a-b3e1-fb1ee16b8e9f}\components\KWMainLib_win.4.6.0.17042.dll

2016-08-31 07:41 - 2016-08-31 07:41 - 06295936 _____ () C:\Users\Brian\AppData\Roaming\Dashlane\4.6.0.17042\bin\Firefox_Extension\{442718d9-475e-452a-b3e1-fb1ee16b8e9f}\components\KWData.4.6.0.17042.dll

2016-08-31 07:41 - 2016-08-31 07:41 - 07406976 _____ () C:\Users\Brian\AppData\Roaming\Dashlane\4.6.0.17042\bin\Firefox_Extension\{442718d9-475e-452a-b3e1-fb1ee16b8e9f}\components\KWApplication.4.6.0.17042.dll

2016-08-31 07:41 - 2016-08-31 07:41 - 13651840 _____ () C:\Users\Brian\AppData\Roaming\Dashlane\4.6.0.17042\bin\Firefox_Extension\{442718d9-475e-452a-b3e1-fb1ee16b8e9f}\components\KWMainLib.4.6.0.17042.dll

2016-08-31 07:41 - 2016-08-31 07:41 - 02284928 _____ () C:\Users\Brian\AppData\Roaming\Dashlane\4.6.0.17042\bin\Firefox_Extension\{442718d9-475e-452a-b3e1-fb1ee16b8e9f}\components\KWMainLibData.4.6.0.17042.dll

2016-08-31 07:41 - 2016-08-31 07:41 - 00334208 _____ () C:\Users\Brian\AppData\Roaming\Dashlane\4.6.0.17042\bin\Firefox_Extension\{442718d9-475e-452a-b3e1-fb1ee16b8e9f}\components\Kwift_DP.4.6.0.17042.dll

2016-05-06 18:09 - 2016-08-25 07:33 - 03598536 _____ () C:\Program Files (x86)\Microsoft Office\root\Office16\gfx.dll

2016-03-15 05:17 - 2016-08-25 07:28 - 00158408 _____ () C:\Program Files (x86)\Microsoft Office\root\Office16\JitV.dll

 

==================== Alternate Data Streams (Whitelisted) =========

 

(If an entry is included in the fixlist, only the ADS will be removed.)

 

 

==================== Safe Mode (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SAVService => ""="service"

 

==================== Association (Whitelisted) ===============

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

 

HKLM\...\.scr: CryptoPreventSCR => "C:\Program Files (x86)\Foolish IT\CryptoPrevent\CryptoPreventFilterMod.CryptoPreventEXEC" "%1" /S %*

 

==================== Internet Explorer trusted/restricted ===============

 

(If an entry is included in the fixlist, it will be removed from the registry.)

 

IE restricted site: HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\008i.com -> 008i.com

IE restricted site: HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\008k.com -> 008k.com

IE restricted site: HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\00hq.com -> 00hq.com

IE restricted site: HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\0190-dialers.com -> 0190-dialers.com

IE restricted site: HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\01i.info -> 01i.info

IE restricted site: HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com

IE restricted site: HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\0411dd.com -> 0411dd.com

IE restricted site: HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\0511zfhl.com -> 0511zfhl.com

IE restricted site: HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\05p.com -> 05p.com

IE restricted site: HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\0632qyw.com -> 0632qyw.com

IE restricted site: HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com

IE restricted site: HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com

IE restricted site: HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com

IE restricted site: HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\0calories.net -> 0calories.net

IE restricted site: HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\0cj.net -> 0cj.net

IE restricted site: HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\0scan.com -> 0scan.com

IE restricted site: HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\1-britney-spears-nude.com -> 1-britney-spears-nude.com

IE restricted site: HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\1-domains-registrations.com -> 1-domains-registrations.com

IE restricted site: HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\1-se.com -> 1-se.com

IE restricted site: HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\1001movie.com -> 1001movie.com

 

There are 6091 more sites.

 

 

==================== Hosts content: ===============================

 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

 

2009-07-13 21:34 - 2016-09-12 08:19 - 00000027 ____A C:\WINDOWS\system32\Drivers\etc\hosts

 

127.0.0.1       localhost

 

==================== Other Areas ============================

 

(Currently there is no automatic fix for this section.)

 

HKU\S-1-5-21-1563961910-250262785-1644635927-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper

DNS Servers: 209.18.47.61 - 209.18.47.62

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall is enabled.

 

==================== MSCONFIG/TASK MANAGER disabled items ==

 

(Currently there is no automatic fix for this section.)

 

HKLM\...\StartupApproved\StartupFolder: => "RealTimes.lnk"

HKLM\...\StartupApproved\Run: => "hpsysdrv"

HKLM\...\StartupApproved\Run: => "iTunesHelper"

HKLM\...\StartupApproved\Run: => "ATT_McciTrayApp"

HKLM\...\StartupApproved\Run32: => "HP Software Update"

HKLM\...\StartupApproved\Run32: => "PDF Complete"

HKLM\...\StartupApproved\Run32: => "RealDownloader"

HKLM\...\StartupApproved\Run32: => "TkBellExe"

HKLM\...\StartupApproved\Run32: => "QuickTime Task"

HKLM\...\StartupApproved\Run32: => "Digital Coupon Print Driver"

HKLM\...\StartupApproved\Run32: => "hpsysdrv"

HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\StartupApproved\StartupFolder: => "Send to OneNote.lnk"

HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\StartupApproved\Run: => "CCleaner Monitoring"

HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\StartupApproved\Run: => "OneDrive"

HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\StartupApproved\Run: => "Dashlane"

HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\StartupApproved\Run: => "DashlanePlugin"

HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\StartupApproved\Run: => "FileHippo.com"

HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\StartupApproved\Run: => "Adguard"

HKU\S-1-5-21-1563961910-250262785-1644635927-1001\...\StartupApproved\Run: => "Uninstall C:\Users\Brian\AppData\Local\Microsoft\OneDrive\17.3.6201.1019_1\amd64"

 

==================== FirewallRules (Whitelisted) ===============

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139

FirewallRules: [MSMQ-In-TCP] => (Allow) %systemroot%\system32\mqsvc.exe

FirewallRules: [MSMQ-Out-TCP] => (Allow) %systemroot%\system32\mqsvc.exe

FirewallRules: [MSMQ-In-UDP] => (Allow) %systemroot%\system32\mqsvc.exe

FirewallRules: [MSMQ-Out-UDP] => (Allow) %systemroot%\system32\mqsvc.exe

FirewallRules: [WCF-NetTcpActivator-In-TCP-64bit] => (Allow) LPort=808

FirewallRules: [{C663F75D-888B-40E8-A457-C0901704F615}] => (Allow) C:\Program Files\iTunes\iTunes.exe

FirewallRules: [{75A935F3-5BA9-436C-B60F-1AD94CFC5AAD}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe

FirewallRules: [{A2FA46EE-AC6E-4063-8F11-584FC5831ED3}] => (Allow) C:\Program Files (x86)\Adguard\AdguardSvc.exe

FirewallRules: [UDP Query User{92EE037D-C18A-406D-9C23-5B92587D2DE6}C:\program files (x86)\idrivewindows\cmd_util\idwutil_600.exe] => (Allow) C:\program files (x86)\idrivewindows\cmd_util\idwutil_600.exe

FirewallRules: [TCP Query User{FF75E0B2-8507-49F6-83C0-C6071AEFC6D1}C:\program files (x86)\idrivewindows\cmd_util\idwutil_600.exe] => (Allow) C:\program files (x86)\idrivewindows\cmd_util\idwutil_600.exe

FirewallRules: [{0082FA77-F435-422F-B60F-3ACA819FE190}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe

FirewallRules: [{424B4445-F486-4BA1-8C0A-7536EB2C4C84}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

FirewallRules: [{4FAD6C30-49C7-412C-A75B-4C1F51FB4224}] => (Allow) LPort=15600

 

==================== Restore Points =========================

 

 

==================== Faulty Device Manager Devices =============

 

 

==================== Event log errors: =========================

 

Application errors:

==================

Error: (09/12/2016 08:35:05 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: Activation context generation failed for "C:\Windows\Installer\{692AC224-5A8F-4F71-B539-5145190C0A60}\recordingmanager.exe".

Dependent Assembly rpshellextension.1.0,language="&#x2a;",type="win32",version="1.0.0.0" could not be found.

Please use sxstrace.exe for detailed diagnosis.

 

Error: (09/12/2016 08:19:31 AM) (Source: VSS) (EventID: 8193) (User: )

Description: Volume Shadow Copy Service error: Unexpected error calling routine QueryFullProcessImageNameW.  hr = 0x80070006, The handle is invalid.

.

 

 

Operation:

   Executing Asynchronous Operation

 

Context:

   Current State: DoSnapshotSet

 

Error: (09/12/2016 08:18:55 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

 

Details:

AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

 

System Error:

Access is denied.

.

 

Error: (09/12/2016 08:18:31 AM) (Source: VSS) (EventID: 8194) (User: )

Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005, Access is denied.

.

This is often caused by incorrect security settings in either the writer or requestor process.

 

 

Operation:

   Gathering Writer Data

 

Context:

   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}

   Writer Name: System Writer

   Writer Instance ID: {ecacc6af-1f73-4612-b079-03627df70594}

 

Error: (09/12/2016 07:34:42 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: chrome.exe, version: 52.0.2743.116, time stamp: 0x57a12717

Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000

Exception code: 0xc0000005

Fault offset: 0x0000000000000000

Faulting process id: 0x1c0c

Faulting application start time: 0x01d20cf205b9e502

Faulting application path: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Faulting module path: unknown

Report Id: 683d513e-8aa7-45d3-b4e1-5ca75f80ce24

Faulting package full name: 

Faulting package-relative application ID:

 

Error: (09/12/2016 07:12:56 AM) (Source: Perflib) (EventID: 1008) (User: )

Description: The Open Procedure for service "BITS" in DLL "C:\Windows\System32\bitsperf.dll" failed. Performance data for this service will not be available. The first four bytes (DWORD) of the Data section contains the error code.

 

Error: (09/11/2016 03:10:55 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 3890

 

Error: (09/11/2016 03:10:55 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 3890

 

Error: (09/11/2016 03:10:55 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second

 

Error: (09/11/2016 03:10:53 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 2593

 

 

System errors:

=============

Error: (09/12/2016 05:33:37 PM) (Source: DCOM) (EventID: 10010) (User: BRIAN-HP)

Description: The server {37998346-3765-45B1-8C66-AA88CA6B20B8} did not register with DCOM within the required timeout.

 

Error: (09/12/2016 05:31:37 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: The Connected Devices Platform Service service terminated with the following error: 

Unspecified error

 

Error: (09/12/2016 05:31:33 PM) (Source: DCOM) (EventID: 10010) (User: BRIAN-HP)

Description: The server {37998346-3765-45B1-8C66-AA88CA6B20B8} did not register with DCOM within the required timeout.

 

Error: (09/12/2016 05:29:33 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: The Connected Devices Platform Service service terminated with the following error: 

Unspecified error

 

Error: (09/12/2016 05:26:47 PM) (Source: DCOM) (EventID: 10010) (User: BRIAN-HP)

Description: The server {37998346-3765-45B1-8C66-AA88CA6B20B8} did not register with DCOM within the required timeout.

 

Error: (09/12/2016 05:24:47 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: The Connected Devices Platform Service service terminated with the following error: 

Unspecified error

 

Error: (09/12/2016 09:05:04 AM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )

Description: 4

 

Error: (09/12/2016 08:48:53 AM) (Source: DCOM) (EventID: 10010) (User: BRIAN-HP)

Description: The server {37998346-3765-45B1-8C66-AA88CA6B20B8} did not register with DCOM within the required timeout.

 

Error: (09/12/2016 08:46:53 AM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: The Connected Devices Platform Service service terminated with the following error: 

Unspecified error

 

Error: (09/12/2016 08:41:51 AM) (Source: DCOM) (EventID: 10010) (User: BRIAN-HP)

Description: The server {37998346-3765-45B1-8C66-AA88CA6B20B8} did not register with DCOM within the required timeout.

 

 

CodeIntegrity:

===================================

  Date: 2016-09-12 05:47:42.165

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2016-09-12 05:47:42.161

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2016-09-12 05:47:42.139

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2016-09-12 05:47:42.134

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2016-09-12 05:47:42.102

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2016-09-12 05:47:42.094

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2016-09-12 05:47:42.077

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2016-09-12 05:47:42.074

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2016-09-12 05:47:02.333

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

  Date: 2016-09-12 05:47:02.330

  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

 

 

==================== Memory info =========================== 

 

Processor: Intel® Core™ i5-2400S CPU @ 2.50GHz

Percentage of memory in use: 65%

Total physical RAM: 6126.53 MB

Available physical RAM: 2101.11 MB

Total Virtual: 8174.53 MB

Available Virtual: 2963.3 MB

 

==================== Drives ================================

 

Drive c: (OS) (Fixed) (Total:919.73 GB) (Free:631.62 GB) NTFS ==>[system with boot components (obtained from drive)]

Drive d: (HP_RECOVERY) (Fixed) (Total:11.25 GB) (Free:1.36 GB) NTFS ==>[system with boot components (obtained from drive)]

 

==================== MBR & Partition Table ==================

 

========================================================

Disk: 0 (Size: 931.5 GB) (Disk ID: 7EF8BB38)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=919.7 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=449 MB) - (Type=27)

Partition 4: (Not Active) - (Size=11.2 GB) - (Type=07 NTFS)

 

==================== End of Addition.txt ============================

 

 

Sophos is still scanning!!

[zep516]

Hello,

Stop the sophos scan, everyone seems to have an issue with it.


Can you scan with adwcleaner once more, it should still be on the desktop.

I think we may end up uninstalling Chrome
Do you have a lot of bookmarks ? Because we can save them if needed.

Post the adwCleaner log

[Braind]

Which is better for anti-virus - Sophos or Windows Defender? Or Both (if they are compatible together)?

 

Yes, I have a boatload of bookmarks on Chrome!

 

Log:

 

# AdwCleaner v6.010 - Logfile created 12/09/2016 at 18:50:07

# Updated on 12/08/2016 by ToolsLib

# Database : 2016-09-12.1 [Server]

# Operating System : Windows 10 Home  (X64)

# Username : Brian - BRIAN-HP

# Running from : C:\Users\Brian\Desktop\adwcleaner_6.010.exe

# Mode: Clean

# Support : https://toolslib.net/forum

 

 

 

***** [ Services ] *****

 

 

 

***** [ Folders ] *****

 

[-] Folder deleted: C:\Users\Brian\AppData\Local\eSupport.com

[-] Folder deleted: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eSupport.com

[-] Folder deleted: C:\Program Files (x86)\Digital Coupon Printer

[-] Folder deleted: C:\Program Files (x86)\eSupport.com

 

 

***** [ Files ] *****

 

 

 

***** [ DLL ] *****

 

 

 

***** [ WMI ] *****

 

 

 

***** [ Shortcuts ] *****

 

 

 

***** [ Scheduled Tasks ] *****

 

 

 

***** [ Registry ] *****

 

[-] Key deleted: HKU\S-1-5-21-1563961910-250262785-1644635927-1001\Software\eSupport.com

[#] Key deleted on reboot: HKCU\Software\eSupport.com

[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DriverAgent_is1

 

 

***** [ Web browsers ] *****

 

 

 

*************************

 

:: "Tracing" keys deleted

:: Winsock settings cleared

 

*************************

 

C:\AdwCleaner\AdwCleaner[C1].txt - [5137 Bytes] - [29/06/2016 20:50:33]

C:\AdwCleaner\AdwCleaner[C2].txt - [2416 Bytes] - [07/09/2016 22:39:08]

C:\AdwCleaner\AdwCleaner[C3].txt - [1728 Bytes] - [10/09/2016 18:25:40]

C:\AdwCleaner\AdwCleaner[C4].txt - [1465 Bytes] - [12/09/2016 18:50:07]

C:\AdwCleaner\AdwCleaner[S1].txt - [7111 Bytes] - [29/06/2016 19:35:09]

C:\AdwCleaner\AdwCleaner[S2].txt - [4996 Bytes] - [29/06/2016 20:45:50]

C:\AdwCleaner\AdwCleaner[S3].txt - [2796 Bytes] - [07/09/2016 22:37:36]

C:\AdwCleaner\AdwCleaner[S4].txt - [2193 Bytes] - [10/09/2016 18:25:02]

C:\AdwCleaner\AdwCleaner[S5].txt - [2037 Bytes] - [12/09/2016 18:48:53]

 

########## EOF - C:\AdwCleaner\AdwCleaner[C4].txt - [1903 Bytes] ##########

[zep516]

Uninstall sophos for now, keep Defender. Defender will automatically kick in once sophos is removed.

Better run JRT (Junk removal tool) again just in case we picked up other adware, JRT is very good with Chrome and I'm trying not to have to reinstall Chrome.

I also see a bad file has come back in the frst log, we will get to that.

Please run JRT
post the log

[Braind]

Here is the latest JRT Log:

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Malwarebytes

Version: 8.0.7 (07.03.2016)

Operating System: Windows 10 Home x64 

Ran by Brian (Administrator) on Mon 09/12/2016 at 20:28:05.87

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

 

 

File System: 8 

 

Successfully deleted: C:\Users\Brian\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajpgkpeckebdhofmmjfgcjjiiejpodla (Folder) 

Successfully deleted: C:\Users\Brian\AppData\Local\Google\Chrome\User Data\Default\Extensions\fanogbnclpilemkifpjeglokomebpnef (Folder) 

Successfully deleted: C:\Users\Brian\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ajpgkpeckebdhofmmjfgcjjiiejpodla_0.localstorage-journal (File) 

Successfully deleted: C:\Users\Brian\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ajpgkpeckebdhofmmjfgcjjiiejpodla_0.localstorage (File) 

Successfully deleted: C:\WINDOWS\prefetch\DRIVERAGENT-SETUP-1578 (1).EX-14CA9149.pf (File) 

Successfully deleted: C:\WINDOWS\prefetch\DRIVERAGENT-SETUP-1578 (1).TM-A4CA1E2F.pf (File) 

Successfully deleted: C:\WINDOWS\prefetch\DRIVERAGENT-SETUP-1578 (1).TM-AD1918D0.pf (File) 

Successfully deleted: C:\WINDOWS\prefetch\DRIVERAGENT.EXE-31EB465E.pf (File) 

 

 

 

Registry: 0 

 

 

 

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Mon 09/12/2016 at 20:30:56.57

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[zep516]

Hello,

1 More fix and reset Chrome once more..

A few items to fix

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Open notepad (Start =>All Programs => Accessories => Notepad).
Copy/Paste the contents of the code box below into Notepad.

start
CloseProcesses:
CreateRestorePoint:
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
2016-09-12 08:19 - 2016-09-12 08:19 - 00000257 _____ C:\ProgramData\fontcacheev1.dat
2016-09-11 14:04 - 2016-09-11 14:04 - 00000000 ____D C:\Users\Brian\AppData\Local\eSupport.com
2016-09-11 14:04 - 2016-09-11 14:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eSupport.com
2016-09-11 14:04 - 2016-09-11 14:04 - 00000000 ____D C:\Program Files (x86)\eSupport.com
2016-09-11 14:03 - 2016-09-11 14:03 - 01225680 _____ (Copyright © 2015 eSupport.com, Inc • All Rights Reserved ) C:\Users\Brian\Downloads\driveragent-setup-1578.exe
2016-09-11 14:03 - 2016-09-11 14:03 - 01225680 _____ (Copyright © 2015 eSupport.com, Inc • All Rights Reserved ) C:\Users\Brian\Downloads\driveragent-setup-1578 (1).exe
Emptytemp:

• Click Format and ensure Wordwrap is unchecked.
• Save as Fixlist.txt to your Desktop (Must be in this location)
• Run FRST/FRST64 and press the Fix button just once and wait.
• If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.
• The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

Next

Reset your Chrome browser settings
1.In the top-right corner of the browser window, click the Chrome menu
2.Select Settings.
3.At the bottom, click Show advanced settings.
4.Under the section "Reset settings,” click Reset settings.
5.In the dialog that appears, click Reset.

[Braind]

Will I lose all my bookmarks if I reset Chrome?

 

Fixlog results:

 

Fix result of Farbar Recovery Scan Tool (x64) Version: 12-09-2016

Ran by Brian (12-09-2016 21:20:55) Run:2

Running from C:\Users\Brian\Desktop

Loaded Profiles: Brian (Available Profiles: Brian & DefaultAppPool)

Boot Mode: Normal

==============================================

 

fixlist content:

*****************

start

CloseProcesses:

CreateRestorePoint:

SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

2016-09-12 08:19 - 2016-09-12 08:19 - 00000257 _____ C:\ProgramData\fontcacheev1.dat

2016-09-11 14:04 - 2016-09-11 14:04 - 00000000 ____D C:\Users\Brian\AppData\Local\eSupport.com

2016-09-11 14:04 - 2016-09-11 14:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eSupport.com

2016-09-11 14:04 - 2016-09-11 14:04 - 00000000 ____D C:\Program Files (x86)\eSupport.com

2016-09-11 14:03 - 2016-09-11 14:03 - 01225680 _____ (Copyright © 2015 eSupport.com, Inc • All Rights Reserved ) C:\Users\Brian\Downloads\driveragent-setup-1578.exe

2016-09-11 14:03 - 2016-09-11 14:03 - 01225680 _____ (Copyright © 2015 eSupport.com, Inc • All Rights Reserved ) C:\Users\Brian\Downloads\driveragent-setup-1578 (1).exe

Emptytemp:

*****************

 

Processes closed successfully.

Restore point was successfully created.

HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully

C:\ProgramData\fontcacheev1.dat => moved successfully

"C:\Users\Brian\AppData\Local\eSupport.com" => not found.

"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eSupport.com" => not found.

"C:\Program Files (x86)\eSupport.com" => not found.

C:\Users\Brian\Downloads\driveragent-setup-1578.exe => moved successfully

C:\Users\Brian\Downloads\driveragent-setup-1578 (1).exe => moved successfully

 

=========== EmptyTemp: ==========

 

BITS transfer queue => 0 B

DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 10791914 B

Java, Flash, Steam htmlcache => 9260 B

Windows/system/drivers => 18926668 B

Edge => 36814666 B

Chrome => 356284680 B

Firefox => 0 B

Opera => 0 B

 

Temp, IE cache, history, cookies, recent:

Default => 0 B

ProgramData => 0 B

Public => 0 B

systemprofile => 0 B

systemprofile32 => 0 B

LocalService => 10706 B

NetworkService => -646 B

Brian => 10809218 B

DefaultAppPool => 0 B

 

RecycleBin => 198622833 B

EmptyTemp: => 603 MB temporary data Removed.

 

================================

 

 

The system needed a reboot.

 

==== End of Fixlog 21:21:17 ====

[zep516]

No you can reset chrome, bookmarks will stay in place.

I'll be back later

Thanks
joe

[Braind]

After resetting Chrome, it looks like the adware is gone! Finally! This was a pesky one.