Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Trojan:Win32/dynamer!ac slowing my computer down...a lot.

Started by sportscaster88 , Sep 14 2016 03:26 PM

This topic is locked

#1
sportscaster88

Posted 14 September 2016 - 03:26 PM

Member

Member
12 posts

Hello,

Today marks the first time asking for help on this particular issue. Before I continue, I'd like to thank you for allowing me to ask for help.

Currently, my laptop is running super slow and I believe the Win32/dynamer!ac trojan is responsible. I also believe that the malware has messed with some settings on Google Chrome (mostly display/theme colors and Adblocker) and now possibly not allowing Windows Defender to update definitions. I've read where it's considered a false positive, but the symptoms are making me feel otherwise.

About two months back, Windows Defender found Win32/dynamer!ac malware on my PC in my recovery partition. Immediately, I try to remove it with Windows Defender but it stalls for a long time about 60% in. I let it run overnight and it still couldn't remove it. It took a while for the symptoms to start really affecting my laptop, but it nearly takes three minutes to open Windows Defender now compared to before. I've also noticed that start-up times are much slower now, and I'm also starting to fear that it's now not allowing me to update Windows Defender. I honestly don't know how I've come into contact with the malware, especially since it's wound up on the recovery partition.

I've tried several steps to remove the dynamer!ac trojan, such as:
- Kaspersky TDSSKILLER

- rkill/iExplore.exe

- MalwareBytes

- RogueKiller

- SpyHunter (although I read some bad things about the software and did a System Restore to undo installing this.)
- Windows Defender...countless times...even a couple times in Safe Mode.

With the exception of Defender, all of these programs couldn't find the problem. Windows Defender was the only one to actually find it, but it can't remove it.

Full description from Windows Defender:
Items: containerfile:D:\preload\install.wim

file:D:\preload\install.wim->(Image50805)\Program Files (x86)\HP Games\FATE The Cursed King\Fate-WT.exe->(EXEEmb)->(EXEEmb)

Thank you for your help! -Lee

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 12-09-2016

Ran by Lee W. Mowen (administrator) on LEE-LAPTOP (14-09-2016 14:26:29)

Running from C:\Users\Lee W. Mowen\Desktop

Loaded Profiles: Lee W. Mowen (Available Profiles: LeeW & Lee W. Mowen)

Platform: Windows 10 Home Version 1511 (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe

(AMD) C:\Windows\System32\atieclxx.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe

(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe

(Affinegy, Inc.) C:\Program Files (x86)\Time Warner Cable\TWC WiFi\AffinegyService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe

() C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler64.exe

(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe

(Microsoft Corporation) C:\Windows\System32\MusNotification.exe

(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe

(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe

(Affinegy, Inc.) C:\Program Files (x86)\Time Warner Cable\TWC WiFi\TrayApp.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Affinegy, Inc.) C:\Program Files (x86)\Time Warner Cable\TWC WiFi\TWC WiFi.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe

(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSFReport.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe

(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe

(Apple Inc.) C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe

(Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe

(Microsoft Corporation) C:\Windows\System32\InstallAgent.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Windows\System32\NetworkUXBroker.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google) C:\Users\Lee W. Mowen\AppData\Local\Google\Chrome\User Data\SwReporter\8.62.4\software_reporter_tool.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe

(Microsoft Corporation) C:\Windows\SoftwareDistribution\Download\Install\AM_Delta.exe

(Microsoft Corporation) C:\Windows\System32\MpSigStub.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe

(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.10586.486_none_7640e086266ea227\TiWorker.exe

(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe

(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1664000 2013-05-30] (IDT, Inc.)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3954352 2016-04-28] (Synaptics Incorporated)

HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176952 2016-07-26] (Apple Inc.)

HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [91432 2012-03-28] (CyberLink Corp.)

HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [580512 2012-07-09] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [67384 2016-07-05] (Apple Inc.)

HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491632 2012-09-10] (CyberLink Corp.)

HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [DigiDo] => C:\Program Files (x86)\Time Warner Cable\TWC WiFi\TrayApp.exe [1158480 2013-02-27] (Affinegy, Inc.)

HKU\S-1-5-21-947308503-1406603003-3988717595-1004\...\Run: [HP Photosmart 7520 series (NET)] => C:\Program Files\HP\HP Photosmart 7520 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)

HKU\S-1-5-21-947308503-1406603003-3988717595-1004\...\Run: [Google Update] => C:\Users\Lee W. Mowen\AppData\Local\Google\Update\GoogleUpdate.exe [144200 2015-09-02] (Google Inc.)

HKU\S-1-5-21-947308503-1406603003-3988717595-1004\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8810200 2016-06-10] (Piriform Ltd)

HKU\S-1-5-21-947308503-1406603003-3988717595-1004\...\MountPoints2: {38284558-af2a-11e4-bf23-38eaa7ed4243} - "F:\VZW_Software_upgrade_assistant.exe"

ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File

ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File

ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File

ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File

Startup: C:\Users\Lee W. Mowen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk [2013-01-26]

ShortcutTarget: OneNote 2010 Screen Clipper and Launcher.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)

CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 209.18.47.61 209.18.47.62

Tcpip\..\Interfaces\{8dbd3640-ce3b-45a6-bb4d-44b7dcb55abf}: [DhcpNameServer] 209.18.47.61 209.18.47.62

Tcpip\..\Interfaces\{a0327d37-f020-42ff-8d21-ff8b1353803a}: [DhcpNameServer] 192.168.42.129

Tcpip\..\Interfaces\{a8826247-33d6-4605-a6d6-afcea02305dc}: [DhcpNameServer] 209.18.47.61 209.18.47.62

Internet Explorer:

==================

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.msn.com/HPNOT13/1

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPNOT13/1

HKU\S-1-5-21-947308503-1406603003-3988717595-1004\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.msn.com/HPNOT13/1

HKU\S-1-5-21-947308503-1406603003-3988717595-1004\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPNOT13/1

HKU\S-1-5-21-947308503-1406603003-3988717595-1004\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.msn.com/HPNOT13/1

SearchScopes: HKLM -> {693E6B08-A7D0-431D-9FBB-3C70AC95050E} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}

SearchScopes: HKLM -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF

SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}

SearchScopes: HKLM-x32 -> {693E6B08-A7D0-431D-9FBB-3C70AC95050E} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}

SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF

SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}

SearchScopes: HKU\S-1-5-21-947308503-1406603003-3988717595-1004 -> {693E6B08-A7D0-431D-9FBB-3C70AC95050E} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}

SearchScopes: HKU\S-1-5-21-947308503-1406603003-3988717595-1004 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF

SearchScopes: HKU\S-1-5-21-947308503-1406603003-3988717595-1004 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)

BHO: No Name -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> No File

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)

BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2016-02-25] (HP)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Amolto Call Recorder for Skype\Skype4COM.dll [2015-07-14] (Skype Technologies)

FireFox:

========

FF ProfilePath: C:\Users\Lee W. Mowen\AppData\Roaming\Mozilla\Firefox\Profiles\ky46mr3q.default

FF Homepage: about:home

FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_22_0_0_209.dll [2016-07-12] ()

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_22_0_0_209.dll [2016-07-12] ()

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw.dll [2012-04-26] (Adobe Systems, Inc.)

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-12-18] ()

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)

FF Plugin-x32: @nullsoft.com/winampDetector;version=1 -> C:\Program Files (x86)\Winamp Detect\npwachk.dll [2013-07-23] (Nullsoft, Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-08-05] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-08-05] (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)

FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)

FF Plugin HKU\S-1-5-21-947308503-1406603003-3988717595-1004: @talk.google.com/GoogleTalkPlugin -> C:\Users\Lee W. Mowen\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google)

FF Plugin HKU\S-1-5-21-947308503-1406603003-3988717595-1004: @talk.google.com/O1DPlugin -> C:\Users\Lee W. Mowen\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-12-08] (Google)

FF Plugin HKU\S-1-5-21-947308503-1406603003-3988717595-1004: @tools.google.com/Google Update;version=3 -> C:\Users\Lee W. Mowen\AppData\Local\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-08-05] (Google Inc.)

FF Plugin HKU\S-1-5-21-947308503-1406603003-3988717595-1004: @tools.google.com/Google Update;version=9 -> C:\Users\Lee W. Mowen\AppData\Local\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-08-05] (Google Inc.)

FF Plugin ProgramFiles/Appdata: C:\Users\Lee W. Mowen\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google)

FF Plugin ProgramFiles/Appdata: C:\Users\Lee W. Mowen\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-12-08] (Google)

FF Extension: (Download Statusbar) - C:\Users\Lee W. Mowen\AppData\Roaming\Mozilla\Firefox\Profiles\ky46mr3q.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}.xpi [2016-05-08]

FF Extension: (Trust My Web) - C:\Users\Lee W. Mowen\AppData\Roaming\Mozilla\Firefox\Profiles\ky46mr3q.default\extensions\[email protected] [2016-05-08]

FF Extension: (Firesizer) - C:\Users\Lee W. Mowen\AppData\Roaming\Mozilla\Firefox\Profiles\ky46mr3q.default\extensions\{04426594-bce6-4705-b811-bcdba2fd9c7b}.xpi [2016-05-08]

FF Extension: (Ghostery) - C:\Users\Lee W. Mowen\AppData\Roaming\Mozilla\Firefox\Profiles\ky46mr3q.default\Extensions\[email protected] [2016-08-22]

FF Extension: (Adblock Plus) - C:\Users\Lee W. Mowen\AppData\Roaming\Mozilla\Firefox\Profiles\ky46mr3q.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-05-03]

Chrome:

=======

CHR HomePage: Default -> hxxp://en-us.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official

CHR StartupUrls: Default -> "hxxps://accounts.google.com/ServiceLogin?service=mail&passive=true&rm=false&continue=hxxps://mail.google.com/mail/&ss=1&scc=1&ltmpl=default&ltmplcache=2"

CHR Profile: C:\Users\Lee W. Mowen\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Slides) - C:\Users\Lee W. Mowen\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-07-10]

CHR Extension: (Google Docs) - C:\Users\Lee W. Mowen\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-04]

CHR Extension: (Google Drive) - C:\Users\Lee W. Mowen\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-23]

CHR Extension: (YouTube) - C:\Users\Lee W. Mowen\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-25]

CHR Extension: (Adblock Plus) - C:\Users\Lee W. Mowen\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-07-07]

CHR Extension: (Google Search) - C:\Users\Lee W. Mowen\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-26]

CHR Extension: (Google Sheets) - C:\Users\Lee W. Mowen\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-07-10]

CHR Extension: (Google Docs Offline) - C:\Users\Lee W. Mowen\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-18]

CHR Extension: (AdBlock) - C:\Users\Lee W. Mowen\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-08-06]

CHR Extension: (Windows Media Player Extension for HTML5) - C:\Users\Lee W. Mowen\AppData\Local\Google\Chrome\User Data\Default\Extensions\hokdglbhghcebcopdbanieangmcamaak [2013-04-13] [UpdateUrl: hxxp://www.interoperabilitybridges.com/ChromeWMP/wmpChromeupdates.xml] <==== ATTENTION

CHR Extension: (Build with Chrome) - C:\Users\Lee W. Mowen\AppData\Local\Google\Chrome\User Data\Default\Extensions\lbbbhbjeecagnlfgggogfclkdjamoapf [2013-05-05]

CHR Extension: (Chrome Web Store Payments) - C:\Users\Lee W. Mowen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-05]

CHR Extension: (Gmail) - C:\Users\Lee W. Mowen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-10]

CHR Extension: (Chrome Media Router) - C:\Users\Lee W. Mowen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-08-06]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AffinegyService; C:\Program Files (x86)\Time Warner Cable\TWC WiFi\AffinegyService.exe [592720 2013-02-27] (Affinegy, Inc.)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-12-19] (Advanced Micro Devices, Inc.) [File not signed]

S2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-03-02] (Apple Inc.)

R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [28552 2016-04-26] (Hewlett-Packard Company)

R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2451456 2012-07-13] (Realsil Microelectronics Inc.) [File not signed]

S3 vmicvss; C:\Windows\System32\ICSvc.dll [511488 2015-10-30] (Microsoft Corporation)

R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364464 2015-10-30] (Microsoft Corporation)

R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2016-07-01] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 APXACC; C:\Windows\system32\DRIVERS\appexDrv.sys [199008 2012-06-23] (AppEx Networks Corporation)

R3 athr; C:\Windows\System32\drivers\athw10x.sys [4318760 2015-09-05] (Qualcomm Atheros Communications, Inc.)

R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWT6.sys [102912 2015-05-28] (Advanced Micro Devices)

R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)

S3 CMUSBDAC; C:\Windows\system32\DRIVERS\CMUSBDAC.sys [3778592 2015-11-26] (C-MEDIA)

S3 dg_ssudbus; C:\Windows\system32\DRIVERS\ssudbus.sys [129152 2016-04-25] (Samsung Electronics Co., Ltd.)

U5 iaStorA; C:\Windows\System32\Drivers\iaStorA.sys [645952 2012-07-31] (Intel Corporation)

R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [310528 2015-06-05] (Realtek Semiconductor Corp.)

R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [589824 2015-10-30] (Realtek )

S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [41272 2012-08-24] (Synaptics Incorporated)

S3 SmbDrvI; C:\Windows\System32\drivers\Smb_driver_Intel.sys [43832 2012-08-24] (Synaptics Incorporated)

S3 ssudmdm; C:\Windows\system32\DRIVERS\ssudmdm.sys [221824 2016-04-25] (Samsung Electronics Co., Ltd.)

U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [28272 2016-08-22] ()

S3 usbrndis6; C:\Windows\System32\drivers\usb80236.sys [23040 2015-10-30] (Microsoft Corporation)

S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)

R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)

R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)

R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [30384 2015-06-18] (HP Inc.)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-09-14 14:26 - 2016-09-14 14:28 - 00022470 _____ C:\Users\Lee W. Mowen\Desktop\FRST.txt

2016-09-14 14:26 - 2016-09-14 14:26 - 00000000 ____D C:\Users\Lee W. Mowen\Desktop\FRST-OlderVersion

2016-09-14 14:25 - 2016-09-14 14:26 - 00000000 ____D C:\FRST

2016-09-14 14:16 - 2016-09-14 14:16 - 00000000 ____D C:\Users\Lee W. Mowen\AppData\Local\CrashDumps

2016-08-22 18:44 - 2016-09-14 14:26 - 02398720 _____ (Farbar) C:\Users\Lee W. Mowen\Desktop\FRST64.exe

2016-08-22 16:08 - 2016-08-22 16:08 - 00001822 _____ C:\Users\Public\Desktop\iTunes.lnk

2016-08-22 16:08 - 2016-08-22 16:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2016-08-22 16:07 - 2016-08-22 16:08 - 00000000 ____D C:\Program Files\iTunes

2016-08-22 16:07 - 2016-08-22 16:07 - 00000000 ____D C:\Program Files\iPod

2016-08-22 16:07 - 2016-08-22 16:07 - 00000000 ____D C:\Program Files (x86)\iTunes

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-09-14 14:23 - 2015-10-30 03:24 - 00000000 ____D C:\WINDOWS\system32\NDF

2016-09-14 14:18 - 2015-10-30 03:24 - 00000000 ____D C:\WINDOWS\AppReadiness

2016-09-14 14:15 - 2015-11-18 11:37 - 00000000 ____D C:\Users\Lee W. Mowen

2016-09-14 14:15 - 2013-01-30 00:18 - 00000384 _____ C:\WINDOWS\Tasks\ROC_JAN2013_TB_rmv.job

2016-09-14 14:15 - 2013-01-25 11:03 - 00000924 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

2016-09-14 14:14 - 2015-11-18 11:59 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2016-09-01 19:14 - 2014-11-22 23:36 - 00000000 ____D C:\Users\Lee W. Mowen\AppData\Roaming\vlc

2016-09-01 19:10 - 2013-01-25 12:58 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job

2016-09-01 18:45 - 2014-06-17 12:40 - 00000958 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-947308503-1406603003-3988717595-1004UA.job

2016-09-01 17:45 - 2014-06-17 12:40 - 00000906 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-947308503-1406603003-3988717595-1004Core.job

2016-09-01 17:08 - 2015-10-30 03:24 - 00000000 ___HD C:\Program Files\WindowsApps

2016-09-01 16:19 - 2013-01-25 11:03 - 00002232 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

2016-09-01 16:19 - 2013-01-25 11:03 - 00002220 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2016-09-01 16:10 - 2015-10-30 03:21 - 00000000 ____D C:\WINDOWS\INF

2016-09-01 16:09 - 2015-10-30 03:11 - 00000000 ____D C:\WINDOWS\CbsTemp

2016-09-01 15:45 - 2013-01-25 10:37 - 00004170 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{0F900058-F7C4-4152-AD2C-5FF520C0BB47}

2016-09-01 15:40 - 2015-12-23 11:58 - 00000000 ____D C:\Users\Lee W. Mowen\AppData\Roaming\dvdcss

2016-08-22 18:57 - 2014-06-15 21:27 - 00000000 ____D C:\Users\Lee W. Mowen\AppData\Roaming\Dropbox

2016-08-22 18:07 - 2015-11-18 11:37 - 00972104 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2016-08-22 17:58 - 2015-10-30 02:28 - 00524288 ___SH C:\WINDOWS\system32\config\BBI

2016-08-22 17:38 - 2016-07-07 08:23 - 00028272 _____ C:\WINDOWS\system32\Drivers\TrueSight.sys

2016-08-22 16:31 - 2016-08-06 16:40 - 00000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job

2016-08-22 16:28 - 2015-07-29 16:30 - 00065536 _____ C:\WINDOWS\system32\spu_storage.bin

2016-08-22 16:06 - 2013-01-28 12:48 - 00000000 ____D C:\Program Files\Common Files\Apple

2016-08-22 15:59 - 2016-06-10 18:56 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

==================== Files in the root of some directories =======

2013-02-24 14:02 - 2015-10-28 20:03 - 0000912 _____ () C:\Users\Lee W. Mowen\AppData\Roaming\buttrc

2013-02-05 22:40 - 2013-02-05 22:40 - 0000017 _____ () C:\Users\Lee W. Mowen\AppData\Local\resmon.resmoncfg

2013-12-04 18:38 - 2013-12-04 18:38 - 0000057 _____ () C:\ProgramData\Ament.ini

2013-01-17 13:55 - 2013-01-17 13:55 - 0000595 _____ () C:\ProgramData\CyberlinkOutput.txt

Some files in TEMP:

====================

C:\Users\Lee W. Mowen\AppData\Local\Temp\dllnt_dump.dll

C:\Users\Lee W. Mowen\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpbewnc7.dll

C:\Users\Lee W. Mowen\AppData\Local\Temp\mpam-e006f6af.exe

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed

C:\WINDOWS\system32\wininit.exe => File is digitally signed

C:\WINDOWS\explorer.exe => File is digitally signed

C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed

C:\WINDOWS\system32\svchost.exe => File is digitally signed

C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed

C:\WINDOWS\system32\services.exe => File is digitally signed

C:\WINDOWS\system32\User32.dll => File is digitally signed

C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed

C:\WINDOWS\system32\userinit.exe => File is digitally signed

C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed

C:\WINDOWS\system32\rpcss.dll => File is digitally signed

C:\WINDOWS\system32\dnsapi.dll => File is digitally signed

C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed

C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2016-08-05 22:49

==================== End of FRST.txt ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-09-2016

Ran by Lee W. Mowen (14-09-2016 14:31:10)

Running from C:\Users\Lee W. Mowen\Desktop

Windows 10 Home Version 1511 (X64) (2015-11-18 16:09:25)

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-947308503-1406603003-3988717595-500 - Administrator - Disabled)

DefaultAccount (S-1-5-21-947308503-1406603003-3988717595-503 - Limited - Disabled)

Guest (S-1-5-21-947308503-1406603003-3988717595-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-947308503-1406603003-3988717595-1006 - Limited - Enabled)

Lee W. Mowen (S-1-5-21-947308503-1406603003-3988717595-1004 - Administrator - Enabled) => C:\Users\Lee W. Mowen

LeeW (S-1-5-21-947308503-1406603003-3988717595-1002 - Administrator - Enabled) => C:\Users\LeeW

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 22 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 22.0.0.209 - Adobe Systems Incorporated)

Adobe Shockwave Player 11.6 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.6.5.635 - Adobe Systems, Inc.)

AMD Catalyst Install Manager (HKLM\...\{F37A899E-1745-52F5-658F-9A4DA4D46BB7}) (Version: 8.0.903.0 - Advanced Micro Devices, Inc.)

AMD Quick Stream (HKLM\...\{E9EED4AE-682B-4501-9574-D09A21717599}_is1) (Version: 3.3.26.0 - AppEx Networks)

Amolto Call Recorder for Skype (HKLM-x32\...\{55D2359E-9448-4B97-8739-0FEC0B19AC1C}) (Version: 2.9.0 - Amolto)

Apple Application Support (32-bit) (HKLM-x32\...\{D4B07658-F443-4445-A261-E643996E139D}) (Version: 4.3.2 - Apple Inc.)

Apple Application Support (64-bit) (HKLM\...\{A6B0442B-E159-444B-B49D-6B9AC531EAE3}) (Version: 4.3.2 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{2E4AF2A6-50EA-4260-9BA4-5E582D11879A}) (Version: 9.3.0.15 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)

Audacity 2.0.3 (HKLM-x32\...\Audacity_is1) (Version: 2.0.3 - Audacity Team)

Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)

butt (HKLM-x32\...\butt) (Version: - )

CCleaner (HKLM\...\CCleaner) (Version: 5.19 - Piriform)

CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.5.6902 - CyberLink Corp.)

CyberLink Media Suite 10 (HKLM-x32\...\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.4.2928 - CyberLink Corp.)

CyberLink PhotoDirector (HKLM-x32\...\InstallShield_{4862344A-A39C-4897-ACD4-A1BED5163C5A}) (Version: 2.0.2.3317 - CyberLink Corp.)

CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.2.2110 - CyberLink Corp.)

CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.1.1925 - CyberLink Corp.)

CyberLink PowerDVD (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.6.4319 - CyberLink Corp.)

CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.5.5811 - CyberLink Corp.)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

Energy Star (HKLM\...\{0FA995CC-C849-4755-B14B-5404CC75DC24}) (Version: 1.0.8 - Hewlett-Packard)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 52.0.2743.116 - Google Inc.)

Google Talk Plugin (HKLM-x32\...\{F9B579C2-D854-300A-BE62-A09EB9D722E4}) (Version: 5.41.3.0 - Google)

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.31.5 - Google Inc.) Hidden

Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden

HP 3D DriveGuard (HKLM\...\{54CE68A8-4F2D-4328-B1F7-D6C720405F7F}) (Version: 4.2.9.1 - Hewlett-Packard Company)

HP Connected Music (Meridian - installer) (HKLM-x32\...\StartHPConnectedMusic) (Version: v1.0 - Meridian Audio Ltd)

HP CoolSense (HKLM-x32\...\{0D3A6808-82B8-4BB1-BE5A-AED75B3F6C02}) (Version: 2.20.11 - Hewlett-Packard Company)

HP Documentation (HKLM-x32\...\{18DE31AE-70D0-43A7-9E3C-2ED7283ECE8A}) (Version: 1.1.0.0 - Hewlett-Packard)

HP FWUpdateEDO2 (HKLM-x32\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)

HP MyRoom (HKLM-x32\...\{9C35EDE5-4B0F-45E7-A438-314BA889948E}) (Version: 9.0.0.0 - Hewlett-Packard Company)

HP Photosmart 7520 series Basic Device Software (HKLM\...\{27ABA988-D480-4F44-B0FD-45E5656D2CFE}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)

HP Photosmart 7520 series Help (HKLM-x32\...\{08295D09-E002-48F8-905D-34E4B08509BA}) (Version: 28.0.0 - Hewlett Packard)

HP Photosmart 7520 series Product Improvement Study (HKLM\...\{16B872EE-C458-41BD-BEAE-52758A3F3168}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)

HP Quick Launch (HKLM-x32\...\{4ED7050C-9332-4FB2-AB07-E94F25A53D39}) (Version: 3.0.3 - Hewlett-Packard Company)

HP Registration Service (HKLM\...\{E4D6CCF2-0AAF-4B9C-9DE5-893EDC9B4BAA}) (Version: 1.0.5976.4186 - Hewlett-Packard)

HP Software Framework (HKLM-x32\...\{675D093B-815D-47FD-AB2C-192EC751E8E2}) (Version: 4.6.10.1 - Hewlett-Packard Company)

HP Support Assistant (HKLM-x32\...\{79C54A05-F146-4EA0-8A70-D4EFE6181E52}) (Version: 8.2.8.25 - Hewlett-Packard Company)

HP Support Solutions Framework (HKLM-x32\...\{55065080-504F-43BB-BE00-36B80D7D39A5}) (Version: 12.4.18.7 - Hewlett-Packard Company)

HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)

HP Utility Center (HKLM-x32\...\{0C57987A-A03A-4B95-A309-D23F78F406CA}) (Version: 1.0.7 - Hewlett-Packard)

HP Wireless Button Driver (HKLM-x32\...\{30B2D1D8-0A07-4B71-9553-0710C5D31E35}) (Version: 1.1.2.1 - Hewlett-Packard Company)

HPDiagnosticAlert (x32 Version: 1.00.0001 - Microsoft) Hidden

IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6425.0 - IDT)

iTunes (HKLM\...\{955524E7-79EB-4CA9-BA4D-FD2DF587651B}) (Version: 12.4.3.1 - Apple Inc.)

LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version: - )

Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50428.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)

Mozilla Firefox 47.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 47.0 (x86 en-US)) (Version: 47.0 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 47.0.0.5999 - Mozilla)

Pantum P2500W Series (HKLM\...\Pantum P2500W Series) (Version: 5.1.1.23 - Zhuhai Seine Technology Co., Ltd.)

Qualcomm Atheros Driver Installation Program (HKLM-x32\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 10.0 - Qualcomm Atheros)

Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek)

Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.2.8400.29029 - Realtek Semiconductor Corp.)

Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)

SHOUTcast Source DSP Plug-in v2 (HKLM-x32\...\SHOUTcast Source DSP) (Version: 2.3.2 - Nullsoft, Inc)

Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)

swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 19.0.12.98 - Synaptics Incorporated)

TWC WiFi (HKLM-x32\...\TWC WiFi_is1) (Version: - )

TweetDeck (HKLM-x32\...\{533B3480-EAB6-44DD-B2E4-715E958210E0}) (Version: 2.1.0 - Twitter, Inc.)

Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)

VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.4 - VideoLAN)

Winamp (HKLM-x32\...\Winamp) (Version: 5.65 - Nullsoft, Inc)

Winamp Detector Plug-in (HKU\S-1-5-21-947308503-1406603003-3988717595-1004\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc)

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-947308503-1406603003-3988717595-1004_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Lee W. Mowen\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay => No File

CustomCLSID: HKU\S-1-5-21-947308503-1406603003-3988717595-1004_Classes\CLSID\{590C4387-5EBD-4D46-8A84-CD0BA2EF2856}\InprocServer32 -> C:\Users\Lee W. Mowen\AppData\Local\Google\Update\1.3.30.3\psuser_64.dll => No File

CustomCLSID: HKU\S-1-5-21-947308503-1406603003-3988717595-1004_Classes\CLSID\{59B55F04-DE14-4BB8-92FF-C4A22EF2E5F4}\InprocServer32 -> C:\Users\Lee W. Mowen\AppData\Local\Google\Update\1.3.31.5\psuser_64.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-947308503-1406603003-3988717595-1004_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Lee W. Mowen\AppData\Local\Google\Update\1.3.31.5\psuser_64.dll (Google Inc.)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0497C61C-0BBF-4340-9E87-BF15F06E6CB1} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSFReport.exe [2016-05-09] (Hewlett-Packard)

Task: {053DC05E-6CF1-4087-9D34-36A826672BED} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2016-02-18] (Hewlett-Packard Company)

Task: {079A93C4-31FC-4C64-9E5F-361FA314EEC7} - System32\Tasks\Hewlett-Packard\HP CoolSense\HP CoolSense Start at Logon => C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe [2013-08-19] (Hewlett-Packard Development Company, L.P.)

Task: {07B8CFD4-BBD6-4D43-90D4-7898F0919CFE} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION

Task: {092FD9CD-07CC-4312-8B05-F9B3506292B8} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-947308503-1406603003-3988717595-1004Core => C:\Users\Lee W. Mowen\AppData\Local\Google\Update\GoogleUpdate.exe [2015-09-02] (Google Inc.)

Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList

Task: {12E3617B-2D8E-4F79-AD17-502D30DB6511} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION

Task: {1C1BA25B-924C-42F1-8553-F97FCAF56E5D} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION

Task: {257C7788-60EA-419D-8A80-CF295C5A2135} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)

Task: {2A9271F3-DFF8-4251-A7AD-6C1A70AAABE3} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION

Task: {3278DE69-100C-41CF-83AD-534A0E867CDA} - System32\Tasks\CLMLSvc_P2G8 => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [2012-06-07] (CyberLink)

Task: {34E64AAD-FA4B-45D8-B167-4AA8585CA2FB} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater - Resources => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2016-03-07] (Hewlett-Packard)

Task: {3FA92D35-29D9-48F9-918E-577E571F2EE7} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION

Task: {44371214-8056-4CBA-AA2F-EE90DD854F7A} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2016-04-28] (Synaptics Incorporated)

Task: {47C159A1-08A5-4D08-9532-0B8AE2E36FFC} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION

Task: {4E1F5ABD-7C26-4E26-BD78-C27AADEA63B4} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2016-02-18] (Hewlett-Packard Company)

Task: {53E59ED6-8A2F-4A0F-9DDE-1AA08D179D00} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-947308503-1406603003-3988717595-1004UA => C:\Users\Lee W. Mowen\AppData\Local\Google\Update\GoogleUpdate.exe [2015-09-02] (Google Inc.)

Task: {5738E031-9DD8-40A4-8937-0A5CDDC9C128} - System32\Tasks\HPCustParticipation HP Photosmart 7520 series => C:\Program Files\HP\HP Photosmart 7520 series\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)

Task: {5806F5F7-C70B-4E50-9AAB-A5B941B8B499} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Active Health Launcher => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2016-03-02] (Hewlett-Packard)

Task: {59DCB97E-E80B-4E9B-AE43-FA09393DEF5A} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION

Task: {5B5EE6BB-673E-467E-B3BA-D0B566B8DE15} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-07-12] (Adobe Systems Incorporated)

Task: {5FF34765-1165-4A79-87F9-2868DB1FDDEB} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION

Task: {77900579-CA91-4A0D-B281-97EB68755948} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION

Task: {7D99F7DE-1368-44DE-A23A-C28FBF3A323C} - System32\Tasks\ROC_JAN2013_TB_rmv => C:\Program Files (x86)\AVG Secure Search\PostInstall\ROC.exe

Task: {9A9F005C-F576-44DD-8A3F-E868ACD7D498} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)

Task: {B870EB3C-2061-4456-A288-B277C3E69EA0} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION

Task: {BD1020BE-C405-4227-BA5B-E834679443AE} - System32\Tasks\Hewlett-Packard\HP Active Health\HP Active Health Scan (HPSA) => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2016-03-02] (Hewlett-Packard)

Task: {C324A6DB-8CD3-40C0-BCD1-52651215C8DD} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)

Task: {D4C3B5D2-63FD-4875-8D91-85042C504FEB} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2016-06-10] (Piriform Ltd)

Task: {D7FCCE1F-1F81-4B94-96B5-8B20634A0559} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2016-03-07] (Hewlett-Packard)

Task: {E20CFABD-454B-4C23-AD93-DA90FA6B5CFA} - System32\Tasks\HPCeeScheduleForLEE-LAPTOP$ => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2015-06-16] (Hewlett-Packard)

Task: {E5DDA1D2-5EC8-445D-B5D8-EE7108AFC0A1} - System32\Tasks\Apple Diagnostics => C:\Program Files (x86)\Common Files\Apple\Internet Services\EReporter.exe

Task: {EAF63D9E-02CB-4133-9D5A-A79AF432B83D} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-947308503-1406603003-3988717595-1004Core.job => C:\Users\Lee W. Mowen\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-947308503-1406603003-3988717595-1004UA.job => C:\Users\Lee W. Mowen\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\HPCeeScheduleForLEE-LAPTOP$.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

Task: C:\WINDOWS\Tasks\ROC_JAN2013_TB_rmv.job => C:\Program Files (x86)\AVG Secure Search\PostInstall\ROC.exe

Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2015-10-30 03:18 - 2015-10-30 03:18 - 00185856 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll

2015-08-22 08:36 - 2014-09-03 06:39 - 00321536 _____ () C:\WINDOWS\System32\pt2500lm.dll

2016-08-05 17:19 - 2016-07-01 00:48 - 02656408 _____ () C:\WINDOWS\system32\CoreUIComponents.dll

2016-08-05 17:19 - 2016-07-01 00:48 - 02656408 _____ () C:\WINDOWS\System32\CoreUIComponents.dll

2016-05-03 21:05 - 2016-05-03 21:08 - 00144384 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe

2015-12-18 18:36 - 2015-12-07 00:14 - 00093696 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.Shell.SharedUtilities.dll

2016-08-05 17:21 - 2016-06-30 23:48 - 00472064 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll

2016-08-05 17:19 - 2016-06-30 23:27 - 07992832 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll

2016-08-05 17:19 - 2016-06-30 23:21 - 00591360 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll

2016-08-05 17:19 - 2016-06-30 23:22 - 02483200 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll

2016-08-05 17:19 - 2016-06-30 23:24 - 04089856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll

2016-08-05 17:21 - 2016-07-01 00:47 - 03081568 _____ () C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\ContentDeliveryManager.Background.dll

2016-08-05 17:21 - 2016-07-01 00:44 - 02394976 _____ () C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\ContentManagementSDK.dll

2016-07-22 14:21 - 2013-02-27 15:19 - 00023376 _____ () C:\Program Files (x86)\Time Warner Cable\TWC WiFi\AffinegyServicePS.dll

2013-02-05 07:57 - 2012-06-07 23:34 - 00627216 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll

2016-07-22 14:21 - 2010-03-19 21:58 - 00325632 _____ () C:\Program Files (x86)\Time Warner Cable\TWC WiFi\QtXml4.dll

2016-07-22 14:21 - 2010-03-19 21:58 - 07187456 _____ () C:\Program Files (x86)\Time Warner Cable\TWC WiFi\QtGui4.dll

2016-07-22 14:21 - 2010-03-19 21:58 - 00847360 _____ () C:\Program Files (x86)\Time Warner Cable\TWC WiFi\QtNetwork4.dll

2016-07-22 14:21 - 2010-03-19 21:58 - 01954304 _____ () C:\Program Files (x86)\Time Warner Cable\TWC WiFi\QtCore4.dll

2016-07-22 14:21 - 2013-02-27 13:56 - 00309248 _____ () C:\Program Files (x86)\Time Warner Cable\TWC WiFi\DigiDoFlavor.dll

2016-07-22 14:21 - 2012-01-31 14:43 - 00119808 _____ () C:\Program Files (x86)\Time Warner Cable\TWC WiFi\imageformats\qjpeg4.dll

2016-07-22 14:21 - 2013-02-27 14:34 - 01781248 _____ () C:\Program Files (x86)\Time Warner Cable\TWC WiFi\gateways\ArrisDG860ALOC.dll

2016-07-22 14:21 - 2013-02-27 14:30 - 01781248 _____ () C:\Program Files (x86)\Time Warner Cable\TWC WiFi\gateways\ArrisTG852GLOC.dll

2016-07-22 14:21 - 2013-02-27 14:32 - 01781248 _____ () C:\Program Files (x86)\Time Warner Cable\TWC WiFi\gateways\ArrisTG862GLOC.dll

2016-07-22 14:21 - 2013-02-27 14:25 - 01789952 _____ () C:\Program Files (x86)\Time Warner Cable\TWC WiFi\gateways\MotorolaSBG900LOC.dll

2016-07-22 14:21 - 2013-02-27 14:29 - 01760256 _____ () C:\Program Files (x86)\Time Warner Cable\TWC WiFi\gateways\NetgearWNR1000v3LOC.dll

2016-07-22 14:21 - 2013-02-27 14:35 - 01762816 _____ () C:\Program Files (x86)\Time Warner Cable\TWC WiFi\gateways\UbeeDVW3201BLOC.dll

2016-09-01 16:18 - 2016-08-02 20:24 - 01771336 _____ () C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\libglesv2.dll

2016-09-01 16:18 - 2016-08-02 20:23 - 00094024 _____ () C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\libegl.dll

2016-09-01 16:17 - 2016-08-02 19:54 - 17602240 _____ () C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\PepperFlash\pepflashplayer.dll

2016-05-03 21:05 - 2016-05-03 21:08 - 00141312 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeBackgroundTasks.dll

2016-05-03 21:05 - 2016-05-03 21:08 - 22284800 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkyWrap.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 09:25 - 2013-08-22 09:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-947308503-1406603003-3988717595-1004\Control Panel\Desktop\\Wallpaper -> C:\Users\Lee W. Mowen\Pictures\Sporting Arenas and Others\byebyevikingrowdy.jpg

DNS Servers: 209.18.47.61 - 209.18.47.62

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run: => "iTunesHelper"

HKLM\...\StartupApproved\Run32: => "APSDaemon"

HKLM\...\StartupApproved\Run32: => "MaxMenuMgr"

HKLM\...\StartupApproved\Run32: => "iTunesHelper"

HKU\S-1-5-21-947308503-1406603003-3988717595-1004\...\StartupApproved\StartupFolder: => "OneNote 2010 Screen Clipper and Launcher.lnk"

HKU\S-1-5-21-947308503-1406603003-3988717595-1004\...\StartupApproved\StartupFolder: => "Dropbox.lnk"

HKU\S-1-5-21-947308503-1406603003-3988717595-1004\...\StartupApproved\Run: => "HP Photosmart 7520 series (NET)"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139

FirewallRules: [{310CE3DE-3CB4-448B-A3DA-70C4D2A3099E}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{D4B19866-B0A1-47B2-BA71-8CB3ADC40BD4}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{05ED2D9A-692C-4D43-90B9-CA801C46A561}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{26797C18-18BE-46D1-B52D-1C05EBD58C28}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{9BD7F6C0-C2AE-4FD5-B8C4-8CA136ABA7DE}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{8883E9C4-F97E-46E1-9019-E56DCD363397}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{F5D975A3-8D31-4C2F-BE4D-05398346EC53}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe

FirewallRules: [{EFA01FB7-8243-4245-ADB5-7FE7F33998F2}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe

FirewallRules: [{F30504E2-BE12-4F3B-95DA-0F7D4FE5F2AC}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD10.EXE

FirewallRules: [{207D0475-6BF3-40EA-9862-8E32654D230F}] => (Allow) LPort=1900

FirewallRules: [{AC0D6EE0-6FC2-46CF-BEAF-A191E1A2E3F0}] => (Allow) LPort=2869

FirewallRules: [{E30FE1C6-4F1B-4F7A-A4D4-089F96A80D3C}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

FirewallRules: [{8F5DDC58-2676-4417-B464-95322A725746}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPPSdr\HPDiagnosticCoreUI.exe

FirewallRules: [{E319B3E4-3D28-4E45-BA9E-280DFEDC3CC3}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPPSdr\HPDiagnosticCoreUI.exe

FirewallRules: [{0185647B-5988-4E09-B795-527472985DA5}] => (Allow) C:\Program Files\HP\HP Photosmart 7520 series\bin\FaxApplications.exe

FirewallRules: [{A38AA25C-3DEA-44B7-8B49-DB78FD0F896D}] => (Allow) C:\Program Files\HP\HP Photosmart 7520 series\bin\DigitalWizards.exe

FirewallRules: [{735EE0CE-18FF-44AA-BBFA-DD53EF784F89}] => (Allow) C:\Program Files\HP\HP Photosmart 7520 series\bin\SendAFax.exe

FirewallRules: [{7CFBC3A5-9F97-451A-9504-4555A09BA673}] => (Allow) C:\Program Files\HP\HP Photosmart 7520 series\Bin\DeviceSetup.exe

FirewallRules: [{FB34743D-9686-417A-A0E3-9CDFF73D635B}] => (Allow) C:\Program Files\HP\HP Photosmart 7520 series\Bin\HPNetworkCommunicator.exe

FirewallRules: [{724EC088-4615-40ED-BFFD-57011D752351}] => (Allow) C:\Program Files\HP\HP Photosmart 7520 series\Bin\HPNetworkCommunicatorCom.exe

FirewallRules: [TCP Query User{115E8FD6-F66A-4FF3-B080-D3EC77AE2D3A}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe

FirewallRules: [UDP Query User{F10DE823-5A0A-449B-AEEA-6C913A1C5C8D}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe

FirewallRules: [{1D0A832E-5ECC-418F-93D3-A36516CCC831}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{8C213AC0-E0CF-4C81-9CBE-F7E0FB3B6BFE}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{8EFEA0C3-4DB0-4515-9024-2624F3C03417}] => (Allow) C:\Program Files (x86)\Time Warner Cable\TWC WiFi\TWC WiFi.exe

FirewallRules: [{0ACAFE89-E611-427E-86DD-D080AD62681E}] => (Allow) C:\Program Files (x86)\Time Warner Cable\TWC WiFi\TWC WiFi.exe

FirewallRules: [{3B8D801E-58C6-4939-8D42-497E3D26149A}] => (Allow) C:\Program Files (x86)\Time Warner Cable\TWC WiFi\TWC WiFi.exe

FirewallRules: [{DDADEF8D-9D2E-4E40-A0F2-89BC71907066}] => (Allow) C:\Program Files (x86)\Time Warner Cable\TWC WiFi\TWC WiFi.exe

FirewallRules: [{F7489497-33EF-4AD8-BC61-97D91CC852E2}] => (Allow) C:\Program Files (x86)\Time Warner Cable\TWC WiFi\TWC WiFi.exe

FirewallRules: [{14AE65F5-0588-4467-A898-DA29635E5C5A}] => (Allow) C:\Program Files\iTunes\iTunes.exe

FirewallRules: [{10015D64-A049-46BF-A1C1-D712F84C3BA1}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Restore Points =========================

10-07-2016 13:16:51 Windows Update

05-08-2016 22:52:22 Windows Update

05-08-2016 22:54:52 Windows Update

01-09-2016 16:09:25 Windows Update

01-09-2016 16:10:44 Windows Update

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:

==================

Error: (09/14/2016 02:17:03 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Lee-Laptop)

Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2147023170 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (09/14/2016 02:16:21 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: SearchUI.exe, version: 10.0.10586.494, time stamp: 0x5775e69a

Faulting module name: Windows.UI.Xaml.dll, version: 10.0.10586.494, time stamp: 0x5775e900

Exception code: 0xc000027b

Fault offset: 0x00000000006fd01b

Faulting process id: 0xeb0

Faulting application start time: 0x01d20eb41049c6bb

Faulting application path: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe

Faulting module path: C:\Windows\System32\Windows.UI.Xaml.dll

Report Id: 6e3382b6-3d8c-411e-be48-00820fc32f08

Faulting package full name: Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy

Faulting package-relative application ID: CortanaUI

Error: (09/14/2016 02:13:57 PM) (Source: ATIeRecord) (EventID: 16396) (User: )

Description: ATI EEU PnP start/stop failed

Error: (09/01/2016 05:08:14 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: Lee-Laptop)

Description: Activation of app Microsoft.BingWeather_8wekyb3d8bbwe!App failed with error: -2144927148 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (09/01/2016 04:11:36 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

Details:

AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

System Error:

Access is denied.

Error: (09/01/2016 04:09:46 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )

Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

Details:

AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

System Error:

Access is denied.

Error: (09/01/2016 03:57:16 PM) (Source: HP Active Health) (EventID: 91) (User: )

Description: Unhandled Exception. Application will terminate immediately.

System.ArgumentNullException: Value cannot be null.

at System.Threading.Monitor.Enter(Object obj)

at HP.ActiveHealth.Commons.Security.HashStore.Validate(String filePath)

at HP.ActiveHealth.Core.Program..ctor(String[] args, Boolean mustCheckSignature, Boolean validateIni)

at HP.ActiveHealth.Core.ActiveHealthMain.Main(String[] args)

Error: (08/22/2016 07:44:04 PM) (Source: ATIeRecord) (EventID: 16396) (User: )

Description: ATI EEU PnP start/stop failed

Error: (08/22/2016 07:43:58 PM) (Source: ATIeRecord) (EventID: 16396) (User: )

Description: ATI EEU PnP start/stop failed

Error: (08/22/2016 06:42:00 PM) (Source: HP Active Health) (EventID: 91) (User: )

Description: Unhandled Exception. Application will terminate immediately.

System.ArgumentNullException: Value cannot be null.

at System.Threading.Monitor.Enter(Object obj)

at HP.ActiveHealth.Commons.Security.HashStore.Validate(String filePath)

at HP.ActiveHealth.Core.Program..ctor(String[] args, Boolean mustCheckSignature, Boolean validateIni)

at HP.ActiveHealth.Core.ActiveHealthMain.Main(String[] args)

System errors:

=============

Error: (09/14/2016 02:21:07 PM) (Source: Service Control Manager) (EventID: 7022) (User: )

Description: The Downloaded Maps Manager service hung on starting.

Error: (09/14/2016 02:19:03 PM) (Source: Service Control Manager) (EventID: 7022) (User: )

Description: The HP Support Solutions Framework Service service hung on starting.

Error: (09/14/2016 02:14:43 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The Apple Mobile Device Service service failed to start due to the following error:

The service did not respond to the start or control request in a timely fashion.

Error: (09/14/2016 02:14:43 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: A timeout was reached (30000 milliseconds) while waiting for the Apple Mobile Device Service service to connect.

Error: (09/14/2016 02:14:08 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The APXACC service failed to start due to the following error:

A device attached to the system is not functioning.

Error: (09/14/2016 02:14:08 PM) (Source: APXACC) (EventID: 1003) (User: )

Description: The NDIS6 LWF initialization has failed. (0xC0000001)

Error: (09/14/2016 02:13:56 PM) (Source: EventLog) (EventID: 6008) (User: )

Description: The previous system shutdown at 6:54:37 PM on ‎9/‎1/‎2016 was unexpected.

Error: (09/01/2016 04:12:26 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)

Description: Installation Failure: Windows failed to install the following update with error 0x80070490: Hewlett-Packard - Imaging, Other hardware - Null Fax - HP Photosmart 7520 series.

Error: (09/01/2016 04:10:49 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)

Description: Installation Failure: Windows failed to install the following update with error 0x8024200b: Hewlett-Packard - Imaging, Other hardware - Null Print - HP Photosmart 7520 series.

Error: (08/22/2016 07:43:58 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The User Data Access_44025 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.

CodeIntegrity:

===================================

Date: 2016-09-14 14:31:23.920

Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Bonjour\mdnsNSP.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2016-09-14 14:31:23.885

Date: 2016-09-14 14:31:23.560

Date: 2016-09-14 14:31:23.522

Date: 2016-09-14 14:31:23.487

Date: 2016-09-14 14:31:23.451

Date: 2016-09-14 14:31:22.944

Date: 2016-09-14 14:31:22.905

Date: 2016-09-01 16:05:29.718

Date: 2016-09-01 16:05:29.678

==================== Memory info ===========================

Processor: AMD A8-4500M APU with Radeon™ HD Graphics

Percentage of memory in use: 50%

Total physical RAM: 7650.26 MB

Available physical RAM: 3802.13 MB

Total Virtual: 8866.26 MB

Available Virtual: 5734.87 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:904.25 GB) (Free:823.53 GB) NTFS ==>[system with boot components (obtained from drive)]

Drive d: (RECOVERY) (Fixed) (Total:25.31 GB) (Free:2.97 GB) NTFS ==>[system with boot components (obtained from drive)]

Drive e: (WILLY_WONKA) (CDROM) (Total:7.01 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (Size: 931.5 GB) (Disk ID: 1EFAD293)

Partition: GPT.

==================== End of Addition.txt ============================

#2
zep516

Posted 20 September 2016 - 07:45 AM

Trusted Helper

Malware Removal
8,090 posts

Hi! My name is zep516 and Welcome to Geekstogo!
I'll do the best I can to resolve your computer issue
Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, don't continue Stop and ask! Never be afraid to ask questions!

As you already know:

The install.wim file on the D: drive is part of the Windows image that will be used by your system if you decide to do a Factory Reset on it. Therefore, it's safe to leave it be and not pay it any attention.

Items: containerfile:D:\preload\install.wim
file:D:\preload\install.wim->(Image50805)\Program Files (x86)\HP Games\FATE The Cursed King\Fate-WT.exe->(EXEEmb)->(EXEEmb)

File name:
fate-wt.exe

Publisher:
WildTangent, Inc. (signed by WildTangent Inc)

Description:
FATE

Status:
Clean (as of last analysis)

Analysis date:
9/15/2016 11:31:54 PM UTC

So it is confirmed that this is a false postive by Defender.

Lets take a look at other things here that may be causing your issues.

I'll look over your log reports and get back to you.

#3
zep516

Posted 20 September 2016 - 11:51 AM

Trusted Helper

Malware Removal
8,090 posts

Download the enclosed =>

FIXLIST.txt 5.05KB 168 downloads Save it in the location FRST64 is. Run FRST and click on the Fix button. Wait until finished. The tool will make a log in the location FRST is, (Fixlog.txt). Please post it to your reply.

Next
Please download AdwCleaner by Xplode onto your Desktop.

Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click the Scan button and wait for the process to complete.
Click the logfile button and the log will open in Notepad.
Click on the Clean button follow the prompts.
A log file will automatically open after the scan has finished and the PC has rebooted.
Please post the content of that log file with your next answer.
The report will be saved in the C:\AdwCleaner folder.

Next

Please download Junkware Removal Tool to your Desktop.
Please close your security software to avoid potential conflicts. See Here how to disable you security protection (Anti Virus)
Run the tool by double-clicking it. If you are using Windows Vista or 7, right-mouse click it and select Run as administrator.
The tool will open and start scanning your system.
Please be patient as this can take a while to complete, depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your Desktop and will automatically open.
Please post the contents of JRT.txt into your reply.

Next
Please download Malwarebytes Anti-Malware to your desktop.
Double-click mbam-setup-version.exe and follow the prompts to install the program.
Launch Malwarebytes Anti-Malware
Then click Finish.
If an update is found, you will be prompted to download and install the latest version.
Once the program has loaded, select Scan now. Or select the Threat Scan from the Scan menu.
When the scan is complete , make sure that that all Threats are selected, and click Remove Selected.
Reboot your computer if prompted.

Posting the Malwarebytes log.
After the restart once you are back at your desktop, open MBAM once more.
Click on the History tab > Application Logs.
Double click on the Scan Log which shows the Date and time of the scan just performed.
Click 'Export'.
Click 'Text file (*.txt)'
In the Save File dialog box which appears, click on Desktop.
In the File name: box type a name for your scan log.
A message box named 'File Saved' should appear stating "Your file has been successfully exported".
Click Ok
post that saved log to your next reply.

In your next reply post;
The AdwCleaner [C1].txt Log
The JRT.txt Log
Malwarebyteslog
Fixlog.txt

#4
sportscaster88

Posted 20 September 2016 - 05:06 PM

Member

Topic Starter
Member
12 posts

Hey zep516, thank you so much for the help! Here's what you asked for:

FIXLOG.TXT

Fix result of Farbar Recovery Scan Tool (x64) Version: 20-09-2016

Ran by Lee W. Mowen (20-09-2016 18:06:35) Run:1

Running from C:\Users\Lee W. Mowen\Desktop

Loaded Profiles: Lee W. Mowen (Available Profiles: LeeW & Lee W. Mowen)

Boot Mode: Normal

==============================================

fixlist content:

*****************

CloseProcesses:

CreateRestorePoint: