Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Malicious link from Upwork site [Solved]

Started by skysuz , Oct 25 2016 10:22 PM

This topic is locked

#1
skysuz

Posted 25 October 2016 - 10:22 PM

Member

Member
13 posts

I noticed someone else has this problem. I opened and excel link and I had already enabled macros, so I received a note from Upwork saying that I could be infected. I ran a virus scan and thought I was OK until I woke up to my screen on and someone remotely accessing my computer at 3am. I bought a better security software and now it is constantly blocking the attempts and it says the link is a pushtone dot net slash getinfo dot php application TeamViewer Remote Control Application. I can't seem to get rid of it. This is the detailed report from my antivirus:

26.10.2016 07.20.34 Dangerous URL blocked http: //pushatone. net/getinfo. php Object: http:// pushatone. net/getinfo. php Object type: URL Reason: KSN Application: TeamViewer Remote Control Application Time: 10/26/2016 7:20 AM

and it goes on... (I put the spaces in the link)

I've copied and pasted the results from the farbar tool scan

Thanks so much for your help!

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 17-10-2016

Ran by Suzanne (administrator) on SUZANNE-PC (25-10-2016 20:53:30)

Running from C:\Users\Suzanne\Desktop

Loaded Profiles: Suzanne (Available Profiles: Suzanne & LogMeInRemoteUser & Guest)

Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

() C:\Windows\System32\nvwmi64.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe

(Wave Systems Corp.) C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(UPEK Inc.) C:\Program Files\Common Files\SPBA\upeksvr.exe

() C:\Windows\System32\nvwmi64.exe

(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 17.0.0\avp.exe

(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler64.exe

(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe

() C:\Program Files\NVIDIA Corporation\nView\nviewMain64.exe

() C:\Program Files\NVIDIA Corporation\nView\nviewMain.exe

(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe

(TeamViewer GmbH) C:\Users\Suzanne\AppData\Roaming\MicrocoftUrdateNT\update_w32.exe

(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe

(Akamai Technologies, Inc.) C:\Users\Suzanne\AppData\Local\Akamai\netsession_win.exe

(Box, Inc.) C:\Users\Suzanne\AppData\Local\Box\Box Edit\Box Edit.exe

(Akamai Technologies, Inc.) C:\Users\Suzanne\AppData\Local\Akamai\netsession_win.exe

(Box, Inc.) C:\Users\Suzanne\AppData\Local\Box\Box Local Com Server\Box Local Com Service.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe

(Google Inc.) C:\Users\Suzanne\AppData\Local\Google\Chrome\Application\chrome.exe

(Dell Inc.) C:\Program Files\Dell\Dell System Manager\DCPSysMgr.exe

(Google Inc.) C:\Users\Suzanne\AppData\Local\Google\Chrome\Application\chrome.exe

() C:\Program Files (x86)\honestech\honestech TVR 2.5\scheduleTV.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE

(Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe

(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe

() C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe

(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

(Hewlett-Packard Company) C:\Program Files (x86)\HP\ToolboxFX\bin\HPTLBXFX.exe

(Google Inc.) C:\Users\Suzanne\AppData\Local\Google\Chrome\Application\chrome.exe

(Wondershare) C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe

(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe

(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe

(Bitdefender) C:\Program Files\Bitdefender Agent\ProductAgentService.exe

(Rosetta Stone Ltd.) C:\Program Files (x86)\RosettaStoneLtdServices\RosettaStoneDaemon.exe

(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 17.0.0\avpui.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-10-2016

Ran by Suzanne (25-10-2016 20:56:04)

Running from C:\Users\Suzanne\Desktop

Windows 7 Professional Service Pack 1 (X64) (2011-03-18 21:08:59)

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-151233617-2686695857-2843107125-500 - Administrator - Disabled)

Guest (S-1-5-21-151233617-2686695857-2843107125-501 - Limited - Disabled) => C:\Users\Guest

HomeGroupUser$ (S-1-5-21-151233617-2686695857-2843107125-1002 - Limited - Enabled)

LogMeInRemoteUser (S-1-5-21-151233617-2686695857-2843107125-1003 - Administrator - Enabled) => C:\Users\LogMeInRemoteUser

Suzanne (S-1-5-21-151233617-2686695857-2843107125-1001 - Administrator - Enabled) => C:\Users\Suzanne

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Kaspersky Total Security (Enabled - Up to date) {86367591-4BE4-AE08-2FD9-7FCB8259CD98}

AS: Kaspersky Total Security (Enabled - Up to date) {3D579475-6DDE-A186-1569-44B9F9DE8725}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FW: Kaspersky Total Security (Enabled) {BE0DF4B4-018B-AF50-0486-D6FE7C8A8AE3}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

64 Bit HP CIO Components Installer (Version: 7.2.4 - Hewlett-Packard) Hidden

64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden

7-Zip 16.04 (HKLM-x32\...\7-Zip) (Version: 16.04 - Igor Pavlov)

Ablebits.com Merge Cells Wizard for Microsoft Excel (HKLM-x32\...\{9B4821E3-3284-4D9C-ACC1-558A0AE064F9}) (Version: 5.0.30 - Add-in Express Ltd)

Add or Remove Adobe Creative Suite 3 Design Premium (HKLM-x32\...\Adobe_498b43b77cac072081a5692bfc52804) (Version: 1.0 - Adobe Systems Incorporated)

Adobe Acrobat 8.1.5 - CPSID_49013 (HKLM-x32\...\Adobe Acrobat 8 Professional_815) (Version: - Adobe Systems Incorporated)

Adobe Acrobat 8.1.5 Professional (HKLM-x32\...\Adobe Acrobat 8 Professional) (Version: 8.1.5 - )

Adobe Color Common Settings (HKLM-x32\...\Adobe_6c8e2cb4fd241c55406016127a6ab2e) (Version: 1.0.1 - Adobe Systems Incorporated)

Adobe ExtendScript Toolkit 2 (HKLM-x32\...\Adobe_3e054d2218e7aa282c2369d939e58ff) (Version: 2.0.2 - Adobe Systems Incorporated)

Adobe Flash Player 9 Plugin (HKLM-x32\...\{88D422DB-E9C7-4E16-9D80-2999F4FD6AD9}) (Version: 9.0.45.0 - Adobe Systems, Inc.)

AHV content for Acrobat and Flash (x32 Version: 1 - Adobe Systems Incorporated) Hidden

Akamai NetSession Interface (HKU\S-1-5-21-151233617-2686695857-2843107125-1001\...\Akamai) (Version: - Akamai Technologies, Inc)

Apple Application Support (32-bit) (HKLM-x32\...\{29DB9165-5FC1-48F0-9188-26123F526848}) (Version: 5.0.1 - Apple Inc.)

Apple Application Support (64-bit) (HKLM\...\{5905C8CF-1C88-4478-A48E-4E458AD1BC7E}) (Version: 5.0.1 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{D4D86CB2-2370-4691-8272-3869EDED6C64}) (Version: 10.0.0.18 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)

ArcGIS 10.4 for Desktop (HKLM-x32\...\ArcGIS 10.4 for Desktop) (Version: 10.4.5524 - Environmental Systems Research Institute, Inc.)

ArcGIS 10.4 for Desktop (x32 Version: 10.4.5524 - Environmental Systems Research Institute, Inc.) Hidden

ArcGIS ArcReader 10 (HKLM-x32\...\ArcGIS ArcReader 10) (Version: 10.0.2414 - Environmental Systems Research Institute, Inc.)

ArcGIS Earth (HKLM\...\ArcGIS Earth) (Version: 1.0.1214 - Environmental Systems Research Institute, Inc.)

ArcGIS Earth (Version: 1.0.1214 - Environmental Systems Research Institute, Inc.) Hidden

ArcGIS License Manager 10 (HKLM-x32\...\ArcGIS License Manager 10) (Version: 10.0.2414 - Environmental Systems Research Institute, Inc.)

ArcGIS Pro (HKLM\...\ArcGISPro) (Version: 1.3.5861 - Environmental Systems Research Institute, Inc.)

ArcGIS Pro (Version: 1.3.5861 - Environmental Systems Research Institute, Inc.) Hidden

Bing Bar (HKLM-x32\...\{FF6DD716-7B10-4269-9F19-FFB07AC4CD95}) (Version: 7.3.124.0 - Microsoft Corporation)

Bing Desktop (HKLM-x32\...\{7D095455-D971-4D4C-9EFD-9AF6A6584F3A}) (Version: 1.3.470.0 - Microsoft Corporation)

Bing Rewards Client Installer (x32 Version: 16.0.345.0 - Microsoft Corporation) Hidden

BioAPI Framework (Version: 1.0.2 - Dell Inc.) Hidden

Bitdefender Agent (HKLM\...\Bitdefender Agent) (Version: 20.0.18.1035 - Bitdefender)

Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)

Box Tools (HKLM-x32\...\{56647361-687B-452B-8999-6179125FFD63}) (Version: 3.2.10.1533 - Box)

Broadcom NetXtreme-I Netlink Driver and Management Installer (HKLM\...\{982E1601-0DFC-4FD3-A427-AC6570697858}) (Version: 14.0.3.2 - Broadcom Corporation)

Citrix Online Launcher (HKLM-x32\...\{09DA5EE2-7E46-4DC4-96F9-BFEE50D40659}) (Version: 1.0.408 - Citrix)

Creative Audio Control Panel (HKLM-x32\...\AudioCS) (Version: 3.00 - Creative Technology Limited)

Creative Software AutoUpdate (HKLM-x32\...\Creative Software AutoUpdate) (Version: 1.40 - Creative Technology Limited)

Creative Sound Blaster Properties x64 Edition (HKLM-x32\...\Creative Sound Blaster Properties x64 Edition) (Version: 1.02 - Creative Technology Limited)

Custom (Version: 12.34.56.789 - Wave Systems Corp.) Hidden

CyberLink PowerDVD 9.5 (HKLM-x32\...\InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}) (Version: 9.5.1.3225 - CyberLink Corp.)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

Dell Data Protection | Access (HKLM-x32\...\{A7D91856-258D-4C87-8041-B170851CE432}) (Version: 2.0.00000.085 - Dell Inc.)

Dell Data Protection | Access (Version: 01.01.00.085 - Wave Systems Corp) Hidden

Dell Data Protection | Access | Drivers (HKLM-x32\...\{4E4E65EE-C456-45AC-B5AD-C62C3A325BD0}) (Version: 1.00.011 - Dell Inc.)

Dell Data Protection | Access | Middleware (HKLM-x32\...\{841CBDD5-4BB5-403E-AEE3-2FADC3890BE8}) (Version: 1.00.005 - Dell Inc.)

Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)

Dell System Manager (HKLM\...\{0DB0EA38-E806-44ED-A892-489F2E305080}) (Version: 1.5.00000 - Dell Inc.)

DellAccess (Version: 01.01.00.053 - Wave Systems Corp.) Hidden

DirectX 9 Runtime (x32 Version: 1.00.0000 - Sonic Solutions) Hidden

EMBASSY Security Center (Version: 04.03.00.067 - Wave Systems Corp.) Hidden

Esri CityEngine 2016.0 (HKLM\...\Esri CityEngine 2016.0) (Version: 16.0.100 - Environmental Systems Research Institute, Inc.)

Esri CityEngine 2016.0 (Version: 16.0.100 - Environmental Systems Research Institute, Inc.) Hidden

FME Desktop 2016.1.2.1 (Build 16674 - win64) (HKLM\...\{C6197A42-6BFE-1014-B1BC-EE2AC0F79D75}) (Version: 7.22.16674 - Safe Software Inc.)

Fushicai VIDEO DVR (HKLM-x32\...\{989BAFE8-E777-43D7-9749-9810E0E9FF48}) (Version: 2013.5.6 - Fushicai)

Gemalto (Version: 01.64.01.0010 - Wave Systems Corp) Hidden

Google Chrome (HKU\S-1-5-21-151233617-2686695857-2843107125-1001\...\Google Chrome) (Version: 54.0.2840.71 - Google Inc.)

Google Drive (HKLM-x32\...\{459CE109-4E46-4340-92BC-054642BC3BC2}) (Version: 1.31.2873.2758 - Google, Inc.)

Google Earth (HKLM-x32\...\{A0C18B96-AB79-46BD-8321-6FA83E6D25B9}) (Version: 7.1.7.2606 - Google)

Google Earth Pro (HKLM-x32\...\{1C63D1F0-DE50-11E2-BB78-B8AC6F98CCE3}) (Version: 7.1.1.1871 - Google)

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.31.5 - Google Inc.) Hidden

honestechTVR2.5 (HKLM-x32\...\{ABADD11D-1B48-4F23-BEBA-6B22CE8F5E58}) (Version: 2.5 - honestech)

honestechTVR2.5 (x32 Version: 2.5 - honestech) Hidden

HP FWUpdateEDO3 (HKLM-x32\...\{A82D0C46-EBDF-4B27-A731-D06EF2056E81}) (Version: 1.0.0.0 - Hewlett-Packard Company)

HP LaserJet Professional CP1520 Series (HKLM-x32\...\{5C069542-CA13-4f1b-B90C-28C6430F4992}) (Version: - Hewlett-Packard)

HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)

HPLaserJetHelp_LearnCenter (HKLM-x32\...\{E15C68A1-9CA5-44AC-A7F7-6C0673F196A8}) (Version: 1.02.0000 - Hewlett-Packard)

HPLJUT (x32 Version: 1.00.0012 - HP) Hidden

hppCP1520LaserJetService (x32 Version: 001.008.00477 - Hewlett-Packard) Hidden

hppLaserJetService (x32 Version: 002.015.00599 - Hewlett-Packard) Hidden

hppTLBXFXCP1520 (x32 Version: 001.012.00948 - Hewlett-Packard) Hidden

hpzTLBXFX (x32 Version: 006.015.01163 - Hewlett-Packard) Hidden

iCloud (HKLM\...\{CE29BC77-C5AE-49D8-A8C0-FDAF6ACF74DF}) (Version: 6.0.1.41 - Apple Inc.)

Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - Intel Corporation)

iSEEK AnswerWorks English Runtime (HKLM-x32\...\{18A8E78B-9EF2-496E-B310-BCD8E4C1DAB3}) (Version: 010.000.0101 - Vantage Linguistics)

iTunes (HKLM\...\{9946A4F7-E0FD-4A33-82D1-06CBFFBBB9F9}) (Version: 12.5.1.21 - Apple Inc.)

Java 8 Update 112 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180112F0}) (Version: 8.0.1120.15 - Oracle Corporation)

Java™ 6 Update 23 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416023FF}) (Version: 6.0.230 - Oracle)

JavaFX 2.1.0 (HKLM-x32\...\{1111706F-666A-4037-7777-210328764D10}) (Version: 2.1.0 - Oracle Corporation)

Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

Kaspersky Secure Connection (HKLM-x32\...\InstallWIX_{1CF84962-50F8-48CA-9082-B70F3A02C686}) (Version: 17.0.0.611 - Kaspersky Lab)

Kaspersky Secure Connection (x32 Version: 17.0.0.611 - Kaspersky Lab) Hidden

Kaspersky Total Security (HKLM-x32\...\InstallWIX_{E27B1D7B-3B34-43A2-9FC0-9828D5DF46E2}) (Version: 17.0.0.611 - Kaspersky Lab)

Kaspersky Total Security (x32 Version: 17.0.0.611 - Kaspersky Lab) Hidden

Logitech Harmony Remote Software 7 (HKLM-x32\...\{5C6F884D-680C-448B-B4C9-22296EE1B206}) (Version: 7.7.0.0 - Logitech)

LogMeIn (HKLM-x32\...\{D3AE96EE-2876-4B3F-847C-D3A4AD689E43}) (Version: 4.1.1578 - LogMeIn, Inc.)

LogMeIn Client (HKLM-x32\...\{D2300C4F-CC9B-4D00-BC53-B4C806A6C7AB}) (Version: 1.3.1675 - LogMeIn, Inc.)

Microsoft .NET Framework 4.6.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.6.01055 - Microsoft Corporation)

Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office Professional 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)

Microsoft Office Professional 2016 - en-us (HKLM\...\ProfessionalRetail - en-us) (Version: 16.0.7369.2038 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50901.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft SQL Server 2008 Native Client (HKLM\...\{BBDE8A3D-64A2-43A6-95F3-C27B87DF7AC1}) (Version: 10.1.2531.0 - Microsoft Corporation)

Microsoft System CLR Types for SQL Server 2012 (x64) (HKLM\...\{F1949145-EB64-4DE7-9D81-E6D27937146C}) (Version: 11.0.2100.60 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable - KB2467175 (HKLM-x32\...\{a0fe116e-9a8a-466f-aee0-625cb7c207e3}) (Version: 8.0.51011 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\...\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (HKLM\...\{EE936C7A-EA40-31D5-9B65-8E3E089C3828}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)

Movavi Video Editor 11 (HKLM-x32\...\Movavi Video Editor 11) (Version: 11.2.0 - Movavi)

Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

MyHarmony (HKU\S-1-5-21-151233617-2686695857-2843107125-1001\...\036a0e4fc6a247ec) (Version: 1.0.1.257 - Logitech)

NTRU TCG Software Stack (Version: 2.1.34 - Security Innovation) Hidden

NVIDIA 3D Vision Driver 358.91 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 358.91 - NVIDIA Corporation)

NVIDIA Display Control Panel (HKLM\...\NVIDIA Display Control Panel) (Version: 6.14.12.5929 - NVIDIA Corporation)

NVIDIA Graphics Driver 358.91 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 358.91 - NVIDIA Corporation)

NVIDIA HD Audio Driver 1.3.34.4 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.34.4 - NVIDIA Corporation)

NVIDIA nView 146.78 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView) (Version: 146.78 - NVIDIA Corporation)

NVIDIA WMI 2.24.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVWMI) (Version: 2.24.0 - NVIDIA Corporation)

Office 16 Click-to-Run Extensibility Component (x32 Version: 16.0.7369.2038 - Microsoft Corporation) Hidden

Office 16 Click-to-Run Extensibility Component 64-bit Registration (Version: 16.0.7369.2038 - Microsoft Corporation) Hidden

Office 16 Click-to-Run Licensing Component (Version: 16.0.7369.2038 - Microsoft Corporation) Hidden

Office 16 Click-to-Run Localization Component (x32 Version: 16.0.7369.2038 - Microsoft Corporation) Hidden

OpenAL (HKLM-x32\...\OpenAL) (Version: - )

PC-CCID (Version: 2.0.0 - Gemalto) Hidden

PDF Settings (x32 Version: 1.0 - Adobe Systems Incorporated) Hidden

PhotoShowExpress (x32 Version: 2.0.063 - Sonic Solutions) Hidden

Preboot Manager (Version: 03.03.00.049 - Wave Systems Corp.) Hidden

Private Information Manager (Version: 07.01.00.007 - Wave Systems Corp.) Hidden

Python 2.5 numpy-1.0.3 (HKLM-x32\...\numpy-py2.5) (Version: - )

Python 2.5 numpy-1.0.3 (HKLM-x32\...\Python 2.5 numpy-1.0.3) (Version: - )

Python 2.5.1 (HKLM-x32\...\Python 2.5.1) (Version: - )

QGIS 2.16 2.16.2 Nødebo (HKLM\...\QGIS 2.16) (Version: - QGIS Development Team)

Quicken 2012 (HKLM-x32\...\{0A1E0BDA-5E8F-436d-8BE5-7E97C5CB899D}) (Version: 21.1.7.18 - Intuit)

Quicken 2015 (HKLM-x32\...\{00C2D443-43D9-4550-ABEA-318288E23E57}) (Version: 24.1.11.1 - Intuit)

QuickTime 7 (HKLM-x32\...\{FF59BD75-466A-4D5A-AD23-AAD87C5FD44C}) (Version: 7.79.80.95 - Apple Inc.)

RBVirtualFolder64Inst (Version: 1.00.0000 - Roxio, Inc.) Hidden

Remote Control USB Driver (HKLM-x32\...\{8471021C-F529-43DE-84DF-3612E10F58C4}) (Version: 2.3.2.317 - )

Rosetta Stone Language Training (HKLM-x32\...\{00384623-4937-4D7D-BDD9-23513D1C50AB}) (Version: 5.0.37.0 - Rosetta Stone, Ltd)

Rosetta Stone Ltd Services (HKLM-x32\...\{3165E4A6-D5DE-46B0-8597-D55E2B826B84}) (Version: 3.2.21 - Rosetta Stone Ltd.)

Roxio Creator Starter (HKLM-x32\...\{6F0BBEFE-BE1C-419B-BA1F-D36C9E7915BC}) (Version: 12.1.77.0 - Roxio)

Roxio File Backup (Version: 1.3.2 - Roxio) Hidden

Sentinel System Driver(64-bit) 7.2.2 (HKLM\...\{97407E09-4EA8-49F0-A513-2C1776A6DEC0}) (Version: 7.2.2 - SafeNet, Inc.)

Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)

Skype™ 7.28 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.28.101 - Skype Technologies S.A.)

Sonic CinePlayer Decoder Pack (x32 Version: 4.3.0 - Sonic Solutions) Hidden

SPBA 5.9 (Version: 5.9.4.6686 - UPEK Inc.) Hidden

Trusted Drive Manager (Version: 4.0.0.512 - Wave Systems Corp.) Hidden

Upek Touchchip Fingerprint Reader (Version: 1.2.004 - Dell Inc.) Hidden

Wave Infrastructure Installer (Version: 07.66.40.0008 - Wave Systems Corp) Hidden

Wave Support Software Installer (Version: 05.13.00.014 - Wave Systems Corp) Hidden

Windows Driver Package - Dell Inc. PBADRV System (09/11/2009 1.0.1.6) (HKLM\...\9512AA21B791B05A54E27065C45BBC417AB282DF) (Version: 09/11/2009 1.0.1.6 - Dell Inc.)

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)

WinPcap 4.1.3 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2980 - Riverbed Technology, Inc.)

WinZip 16.5 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240D3}) (Version: 16.5.10095 - WinZip Computing, S.L. )

Yahoo! Software Update (HKLM-x32\...\Yahoo! Software Update) (Version: - )

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-151233617-2686695857-2843107125-1001_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\Suzanne\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll => No File

CustomCLSID: HKU\S-1-5-21-151233617-2686695857-2843107125-1001_Classes\CLSID\{1423F872-3F7F-4E57-B621-8B1A9D49B448}\InprocServer32 -> C:\Users\Suzanne\AppData\Local\Google\Update\1.3.27.5\psuser_64.dll => No File

CustomCLSID: HKU\S-1-5-21-151233617-2686695857-2843107125-1001_Classes\CLSID\{162C6FB5-44D3-435B-903D-E613FA093FB5}\InprocServer32 -> C:\Users\Suzanne\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\amd64\FileCoAuthLib64.dll => No Fil (the data entry has 1 more characters).

CustomCLSID: HKU\S-1-5-21-151233617-2686695857-2843107125-1001_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Suzanne\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll => No File

CustomCLSID: HKU\S-1-5-21-151233617-2686695857-2843107125-1001_Classes\CLSID\{590C4387-5EBD-4D46-8A84-CD0BA2EF2856}\InprocServer32 -> C:\Users\Suzanne\AppData\Local\Google\Update\1.3.30.3\psuser_64.dll => No File

CustomCLSID: HKU\S-1-5-21-151233617-2686695857-2843107125-1001_Classes\CLSID\{59B55F04-DE14-4BB8-92FF-C4A22EF2E5F4}\InprocServer32 -> C:\Users\Suzanne\AppData\Local\Google\Update\1.3.31.5\psuser_64.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-151233617-2686695857-2843107125-1001_Classes\CLSID\{5C8C2A98-6133-4EBA-BBCC-34D9EA01FC2E}\InprocServer32 -> C:\Users\Suzanne\AppData\Local\Google\Update\1.3.28.1\psuser_64.dll => No File

CustomCLSID: HKU\S-1-5-21-151233617-2686695857-2843107125-1001_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\Suzanne\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\FileCoAuth.exe => No File

CustomCLSID: HKU\S-1-5-21-151233617-2686695857-2843107125-1001_Classes\CLSID\{78550997-5DEF-4A8A-BAF9-D5774E87AC98}\InprocServer32 -> C:\Users\Suzanne\AppData\Local\Google\Update\1.3.28.13\psuser_64.dll => No File

CustomCLSID: HKU\S-1-5-21-151233617-2686695857-2843107125-1001_Classes\CLSID\{793EE463-1304-471C-ADF1-68C2FFB01247}\InprocServer32 -> C:\Users\Suzanne\AppData\Local\Google\Update\1.3.29.5\psuser_64.dll => No File

CustomCLSID: HKU\S-1-5-21-151233617-2686695857-2843107125-1001_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Suzanne\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll => No File

CustomCLSID: HKU\S-1-5-21-151233617-2686695857-2843107125-1001_Classes\CLSID\{BF9DDDDB-4A44-41F7-94C7-4DB032B73B9F}\InprocServer32 -> C:\Users\Suzanne\AppData\Roaming\Add-in Express\Merge Cells Wizard for Microsoft Excel\adxloader64.dll ()

CustomCLSID: HKU\S-1-5-21-151233617-2686695857-2843107125-1001_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\Suzanne\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll => No File

CustomCLSID: HKU\S-1-5-21-151233617-2686695857-2843107125-1001_Classes\CLSID\{CC182BE1-84CE-4A57-B85C-FD4BBDF78CB2}\InprocServer32 -> C:\Users\Suzanne\AppData\Local\Google\Update\1.3.29.1\psuser_64.dll => No File

CustomCLSID: HKU\S-1-5-21-151233617-2686695857-2843107125-1001_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\Suzanne\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll => No File

CustomCLSID: HKU\S-1-5-21-151233617-2686695857-2843107125-1001_Classes\CLSID\{D1EDC4F5-7F4D-4B12-906A-614ECF66DDAF}\InprocServer32 -> C:\Users\Suzanne\AppData\Local\Google\Update\1.3.28.15\psuser_64.dll => No File

CustomCLSID: HKU\S-1-5-21-151233617-2686695857-2843107125-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Suzanne\AppData\Local\Google\Update\1.3.31.5\psuser_64.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-151233617-2686695857-2843107125-1001_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Suzanne\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll => No File

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0DC59238-B059-4EFF-9CF9-9A8CA49C9C53} - System32\Tasks\{0413D07A-8D30-4D5A-BE61-486976FB485F} => C:\Program Files (x86)\iTunes\iTunes.exe

Task: {15D894C6-8C07-4502-817B-3633CBC2F6A0} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: {16E7A5FB-0D27-4FFC-935D-CB64441A4BD1} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-151233617-2686695857-2843107125-1001Core1cf23885969d023 => C:\Users\Suzanne\AppData\Local\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)

Task: {19E720E5-12AA-4EE3-9C27-83BF10CA2419} - System32\Tasks\{A4BA670A-111C-4595-88DE-44B1BC131F3C} => C:\Program Files (x86)\iTunes\iTunes.exe

Task: {296820CE-CF2E-4BF6-A702-4363873404AB} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-151233617-2686695857-2843107125-1001Core => C:\Users\Suzanne\AppData\Local\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)

Task: {3B786855-FB5F-4C15-B445-7A740D115058} - System32\Tasks\{04FF8751-D100-4F82-BE83-D96DAFA59B39} => C:\Program Files (x86)\iTunes\iTunes.exe

Task: {48239E39-A010-47DA-A4BA-F13478A0CAE6} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-151233617-2686695857-2843107125-1001UA => C:\Users\Suzanne\AppData\Local\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)

Task: {5E91E53F-0505-4306-BB33-68DC3BE70C38} - System32\Tasks\HPLJCustParticipation => C:\Program Files (x86)\HP\HPLJUT\HPLJUTSCH.exe [2010-09-22] (Hewlett Packard)

Task: {65729D44-5252-401D-B2CF-BAF410DE527B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-27] (Google Inc.)

Task: {66732F40-8D0E-4B61-A60C-AEBCC6F3114C} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)

Task: {67A9D11B-7985-4EDA-96C7-C301BF4BA209} - System32\Tasks\Kaspersky_Upgrade_Launcher_{278ADC42-419D-4547-A6CA-5B74BE0AD901} => C:\Program Files\Common Files\AV\Kaspersky Lab\upgrade_launcher.exe [2016-08-23] (AO Kaspersky Lab)

Task: {6B1929ED-F652-45B4-91AF-2B689541E8D6} - System32\Tasks\RegClean Pro_UPDATES => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe <==== ATTENTION

Task: {708F24B9-28BC-47E9-B04A-16B31A1C6744} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-151233617-2686695857-2843107125-1001UA1cf23886a25815c => C:\Users\Suzanne\AppData\Local\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)

Task: {87B96AB0-7AB8-4E37-A083-9C8B6952E13E} - System32\Tasks\{4D5AC19A-5FF4-4A2F-A1AF-3E5DD0BAAB0C} => D:\autorun.exe

Task: {964025AA-7830-4AC4-B364-E67585C17F61} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-10-08] (Microsoft Corporation)

Task: {A9C69709-F628-4E15-AA80-357F047BB55C} - System32\Tasks\G2MUpdateTask-S-1-5-21-151233617-2686695857-2843107125-1001 => C:\Program Files (x86)\Citrix\GoToMeeting\5742\g2mupdate.exe

Task: {B24AE1E3-4FF1-4DF0-8E8A-FFEAF516B368} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-10-08] (Microsoft Corporation)

Task: {B2AEA276-409F-468F-9DE6-98B2696BD095} - System32\Tasks\RegClean Pro_DEFAULT => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe <==== ATTENTION

Task: {B7B9DB6D-6070-4B33-B81A-4A015F6AD654} - System32\Tasks\Bitdefender Agent WatchDog_65D6944A0EF74FDAB96E31112AD39864 => C:\Program Files\Bitdefender Agent\WatchDog.exe [2016-09-13] (Bitdefender)

Task: {B85041F5-4507-4DF4-B32F-2120AD6A00B5} - System32\Tasks\{89B37D2F-F8B6-4666-BC35-FCBF4333D964} => D:\autorun.exe

Task: {CEABA74D-1DA7-4D11-8436-1C4F8EC1EA84} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-151233617-2686695857-2843107125-1001UA1d0013a3ffd0f14 => C:\Users\Suzanne\AppData\Local\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)

Task: {CFB72B10-B94B-4668-8030-98F6B2092CD2} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-27] (Google Inc.)

Task: {D957B3D7-A0E7-47BE-A2B1-44A42E4C19DF} - System32\Tasks\Apple Diagnostics => C:\Program Files (x86)\Common Files\Apple\Internet Services\EReporter.exe [2016-09-09] (Apple Inc.)

Task: {DC286D2F-C572-45D8-9115-DB9BC8B91E53} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-151233617-2686695857-2843107125-1001Core1d0013a3e4c6110 => C:\Users\Suzanne\AppData\Local\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)

Task: {E69A5AB1-5E51-4F59-AA96-C7F1360BDE91} - System32\Tasks\DigitalSite => C:\Users\Suzanne\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

Task: {F3F98508-023D-412B-A62A-F3C4D70BB29E} - System32\Tasks\G2MUploadTask-S-1-5-21-151233617-2686695857-2843107125-1001 => C:\Program Files (x86)\Citrix\GoToMeeting\5742\g2mupload.exe

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\DigitalSite.job => C:\Users\Suzanne\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-151233617-2686695857-2843107125-1001Core.job => C:\Users\Suzanne\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-151233617-2686695857-2843107125-1001Core1cf23885969d023.job => C:\Users\Suzanne\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-151233617-2686695857-2843107125-1001Core1d0013a3e4c6110.job => C:\Users\Suzanne\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-151233617-2686695857-2843107125-1001UA.job => C:\Users\Suzanne\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-151233617-2686695857-2843107125-1001UA1cf23886a25815c.job => C:\Users\Suzanne\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-151233617-2686695857-2843107125-1001UA1d0013a3ffd0f14.job => C:\Users\Suzanne\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\RegClean Pro_DEFAULT.job => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe <==== ATTENTION

Task: C:\Windows\Tasks\RegClean Pro_UPDATES.job => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe <==== ATTENTION

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

ShortcutWithArgument: C:\Users\Suzanne\AppData\Local\Google\Chrome\User Data\Default\Web Applications\pinterest.com\http_80\Pinterest _ Goodies.lnk -> C:\Users\Suzanne\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) -> --app=hxxp://pinterest.com/about/goodies/

==================== Loaded Modules (Whitelisted) ==============

2016-01-28 10:39 - 2015-11-10 02:32 - 03088712 _____ () C:\Windows\system32\nvwmi64.exe

2016-01-28 10:38 - 2015-11-05 08:13 - 00116528 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll

2016-09-01 18:12 - 2016-09-01 18:12 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll

2016-09-01 18:12 - 2016-09-01 18:12 - 01353528 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll

2016-09-06 13:21 - 2016-10-08 00:52 - 08923840 _____ () C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\1033\GrooveIntlResource.dll

2016-01-28 10:39 - 2015-11-10 02:26 - 01941304 _____ () C:\Program Files\NVIDIA Corporation\nView\nViewH64.dll

2010-11-10 20:53 - 2010-11-10 20:53 - 00817136 _____ () C:\Program Files\Roxio\Roxio Burn\RBVirtualFolder64.dll

2013-06-13 17:07 - 2013-03-25 10:57 - 00727952 _____ () C:\Windows\SysWOW64\WSCM64.dll

2016-01-28 10:39 - 2015-11-10 02:26 - 01315128 _____ () C:\Program Files\NVIDIA Corporation\nView\nViewMain64.exe

2016-01-28 10:39 - 2015-11-10 02:26 - 01187656 _____ () C:\Program Files\NVIDIA Corporation\nView\nViewMain.exe

2016-01-28 20:32 - 2009-11-03 10:19 - 00409088 _____ () C:\Program Files (x86)\honestech\honestech TVR 2.5\scheduleTV.exe

2010-11-17 08:35 - 2010-11-17 08:35 - 00514544 ____N () C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe

2016-06-28 00:19 - 2016-06-28 00:19 - 00865232 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 17.0.0\kpcengine.2.3.dll

2016-01-28 10:39 - 2015-11-10 02:26 - 01582408 _____ () C:\Program Files\NVIDIA Corporation\nView\nViewH.dll

2016-10-04 09:55 - 2016-01-01 02:00 - 00100352 ___SH () C:\Users\Suzanne\AppData\Roaming\MicrocoftUrdateNT\MSIMG32.dll

2016-09-01 18:13 - 2016-09-01 18:13 - 01041720 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

2016-09-01 18:13 - 2016-09-01 18:13 - 00080184 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

2016-09-01 18:12 - 2016-09-01 18:12 - 00189752 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxslt.dll

2016-01-28 20:32 - 2008-04-27 19:06 - 00053248 _____ () C:\Program Files (x86)\honestech\honestech TVR 2.5\ReadRemoteKey.dll

2010-11-24 20:44 - 2010-11-24 20:44 - 00375280 _____ () c:\program files (x86)\common files\roxio shared\dllshared\SQLite352.dll

2010-10-25 14:36 - 2010-10-25 14:36 - 00119864 _____ () C:\Program Files (x86)\HP\ToolboxFX\bin\nativeutils.dll

2016-10-25 08:16 - 2016-10-20 01:47 - 01819240 _____ () C:\Users\Suzanne\AppData\Local\Google\Chrome\Application\54.0.2840.71\libglesv2.dll

2016-10-25 08:16 - 2016-10-20 01:47 - 00093288 _____ () C:\Users\Suzanne\AppData\Local\Google\Chrome\Application\54.0.2840.71\libegl.dll

2016-10-25 20:22 - 2016-10-25 20:22 - 00098816 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\win32api.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 00110080 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\pywintypes27.dll

2016-10-25 20:22 - 2016-10-25 20:22 - 00364544 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\pythoncom27.dll

2016-10-25 20:22 - 2016-10-25 20:22 - 00320512 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\win32com.shell.shell.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 00776704 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\_hashlib.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 01176576 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\wx._core_.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 00806400 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\wx._gdi_.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 00816128 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\wx._windows_.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 01067008 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\wx._controls_.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 00733184 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\wx._misc_.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 00682496 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\pysqlite2._sqlite.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 00088064 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\_ctypes.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 00119808 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\win32file.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 00108544 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\win32security.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 00007168 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\hashobjs_ext.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 00017920 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\thumbnails_ext.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 00088064 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\usb_ext.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 00012800 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\common.time34.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 00018432 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\win32event.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 00167936 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\win32gui.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 00046080 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\_socket.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 01208320 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\_ssl.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 00128512 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\_elementtree.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 00127488 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\pyexpat.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 00038912 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\win32inet.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 00036864 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\_psutil_windows.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 00525208 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\windows._lib_cacheinvalidation.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 00011264 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\win32crypt.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 00077312 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\wx._html2.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 00027136 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\_multiprocessing.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 00020480 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\_yappi.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 00035840 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\win32process.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 00686080 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\unicodedata.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 00078848 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\wx._animate.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 00123392 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\wx._wizard.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 00024064 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\win32pipe.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 00010240 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\select.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 00025600 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\win32pdh.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 00017408 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\win32profile.pyd

2016-10-25 20:22 - 2016-10-25 20:22 - 00022528 ____R () C:\Users\Suzanne\AppData\Local\Temp\_MEI24722\win32ts.pyd

2016-10-04 09:55 - 2016-01-01 02:00 - 00100352 ___SH () c:\users\suzanne\appdata\roaming\microcofturdatent\msimg32.dll

2016-10-25 14:20 - 2016-10-24 11:03 - 17771200 _____ () C:\Users\Suzanne\AppData\Local\Google\Chrome\User Data\PepperFlash\23.0.0.205\pepflashplayer.dll

2016-09-06 13:15 - 2016-10-18 11:32 - 03593408 _____ () C:\Program Files (x86)\Microsoft Office\root\Office16\gfx.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Windows\SysWOW64\ractrlkeyhook.dll:BDU [22]

AlternateDataStreams: C:\Windows\SysWOW64\TABCTL32.htm:BDU [22]

AlternateDataStreams: C:\Users\Suzanne\Downloads\ArcGISPro_5023_149395.exe:BDU [0]

AlternateDataStreams: C:\Users\Suzanne\Downloads\ArcGIS_Desktop_104_149411.exe:BDU [0]

AlternateDataStreams: C:\Users\Suzanne\Downloads\ArcGIS_Earth_x64_Setup_1.0.exe:BDU [0]

AlternateDataStreams: C:\Users\Suzanne\Downloads\BoxEditInstaller.exe:BDU [0]

AlternateDataStreams: C:\Users\Suzanne\Downloads\ChromeSetup.exe:BDU [0]

AlternateDataStreams: C:\Users\Suzanne\Downloads\CityEngine_2016_0_150261.exe:BDU [0]

AlternateDataStreams: C:\Users\Suzanne\Downloads\Driver207win (1).exe:BDU [0]

AlternateDataStreams: C:\Users\Suzanne\Downloads\Driver207win.exe:BDU [0]

AlternateDataStreams: C:\Users\Suzanne\Downloads\easycapture_setup_1.2.0.exe:BDU [0]

AlternateDataStreams: C:\Users\Suzanne\Downloads\PatchFinder.exe:BDU [0]

AlternateDataStreams: C:\Users\Suzanne\Downloads\Setup.X86.en-US_ProfessionalRetail_bd258168-37e4-471a-92f1-93d2ff205f62_TX_PR_.exe:BDU [0]

AlternateDataStreams: C:\Users\Suzanne\Downloads\wlsetup-web.exe:BDU [0]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 19:34 - 2016-10-24 14:41 - 00003072 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-151233617-2686695857-2843107125-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Suzanne\Pictures\gumby.jpg

DNS Servers: 192.168.10.1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)

Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe

FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe

FirewallRules: [{41422E44-3406-4A93-B450-2D312C87D6E1}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD9\PowerDVD Cinema\PowerDVDCinema.exe

FirewallRules: [{D4A758E9-3C0D-44E8-ADB2-854FC98DFE5D}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD9\PowerDVD9.EXE

FirewallRules: [{3157DD3A-319D-4D65-B6AB-93ADB4D0C653}] => (Allow) LPort=3703

FirewallRules: [{441D9186-92A4-4803-BA11-81797D55FA23}] => (Allow) LPort=3704

FirewallRules: [{DEB659CD-54F8-41A1-80B9-58AA05256D7E}] => (Allow) LPort=50900

FirewallRules: [{91D4E84B-47C9-40A2-AD72-5E88730A454E}] => (Allow) LPort=50901

FirewallRules: [{88989606-90A7-4BB1-BD7C-1CE9214F2628}] => (Allow) C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe

FirewallRules: [{EF737E9D-43CF-4486-8F8D-DA1CD805EBB2}] => (Allow) C:\Program Files (x86)\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe

FirewallRules: [TCP Query User{3657E126-8208-4A49-AF8E-8C2F67290776}C:\program files (x86)\internet explorer\iexplore.exe] => (Allow) C:\program files (x86)\internet explorer\iexplore.exe

FirewallRules: [UDP Query User{A8990542-A0F9-4F21-A280-9B40215B48F5}C:\program files (x86)\internet explorer\iexplore.exe] => (Allow) C:\program files (x86)\internet explorer\iexplore.exe

FirewallRules: [TCP Query User{35C514E1-2A7C-414C-9DBF-3CFD2041C813}C:\program files (x86)\google\google earth\client\googleearth.exe] => (Allow) C:\program files (x86)\google\google earth\client\googleearth.exe

FirewallRules: [UDP Query User{8D9A34C2-1F86-4732-9B17-16CDEF0FA141}C:\program files (x86)\google\google earth\client\googleearth.exe] => (Allow) C:\program files (x86)\google\google earth\client\googleearth.exe

FirewallRules: [{744D57AA-4761-4FD7-AC38-DB3F978D2CD5}] => (Allow) C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe

FirewallRules: [{2CE9DC3A-C8E0-4E2B-ABEA-63A5EA4C8B6E}] => (Allow) C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe

FirewallRules: [TCP Query User{BA4A4083-E4AE-4689-8489-6853D6966CA5}C:\program files (x86)\orbitdownloader\orbitnet.exe] => (Allow) C:\program files (x86)\orbitdownloader\orbitnet.exe

FirewallRules: [UDP Query User{8A3E9F7D-57F0-4896-92D0-9AD22349AD68}C:\program files (x86)\orbitdownloader\orbitnet.exe] => (Allow) C:\program files (x86)\orbitdownloader\orbitnet.exe

FirewallRules: [TCP Query User{FB2964C2-23C2-45D0-AD6C-63A6609EF4C6}C:\program files (x86)\arcgis\desktop10.0\bin\arcmap.exe] => (Allow) C:\program files (x86)\arcgis\desktop10.0\bin\arcmap.exe

FirewallRules: [UDP Query User{FB3D0B7A-D1E0-4659-A4CD-B16994194ABE}C:\program files (x86)\arcgis\desktop10.0\bin\arcmap.exe] => (Allow) C:\program files (x86)\arcgis\desktop10.0\bin\arcmap.exe

FirewallRules: [TCP Query User{F150EBA6-1731-46CF-84A8-C7CAE1819E92}C:\program files (x86)\orbitdownloader\orbitnet.exe] => (Allow) C:\program files (x86)\orbitdownloader\orbitnet.exe

FirewallRules: [UDP Query User{1BE6857F-5A65-4110-955F-0879D273B82F}C:\program files (x86)\orbitdownloader\orbitnet.exe] => (Allow) C:\program files (x86)\orbitdownloader\orbitnet.exe

FirewallRules: [{84C9C5E3-7B7F-4CCE-BB5C-56554272AACC}] => (Allow) %ProgramFiles% (x86)\iTunes\iTunes.exe

FirewallRules: [TCP Query User{ABFFB7A9-9081-4825-A3F0-E7F43010878B}C:\users\suzanne\appdata\local\google\chrome\application\chrome.exe] => (Allow) C:\users\suzanne\appdata\local\google\chrome\application\chrome.exe

FirewallRules: [UDP Query User{8B3ED360-E7F8-4AD0-AF68-9A97502C9E20}C:\users\suzanne\appdata\local\google\chrome\application\chrome.exe] => (Allow) C:\users\suzanne\appdata\local\google\chrome\application\chrome.exe

FirewallRules: [TCP Query User{CED04AFF-E697-456D-9774-CFE97754AEED}C:\users\suzanne\appdata\local\temp\lmi1467.tmp\logmein client.exe] => (Allow) C:\users\suzanne\appdata\local\temp\lmi1467.tmp\logmein client.exe

FirewallRules: [UDP Query User{5595BF07-86BD-492A-B9BF-CD836622E16C}C:\users\suzanne\appdata\local\temp\lmi1467.tmp\logmein client.exe] => (Allow) C:\users\suzanne\appdata\local\temp\lmi1467.tmp\logmein client.exe

FirewallRules: [TCP Query User{99EA1E7D-E49D-4A49-AEBB-E07858ECDF90}C:\users\suzanne\appdata\local\logmein client\logmein client.exe] => (Allow) C:\users\suzanne\appdata\local\logmein client\logmein client.exe

FirewallRules: [UDP Query User{4C89C0BD-E6C6-436C-B0DF-97C7E2082B7E}C:\users\suzanne\appdata\local\logmein client\logmein client.exe] => (Allow) C:\users\suzanne\appdata\local\logmein client\logmein client.exe

FirewallRules: [TCP Query User{B5C8AFCC-5C87-4757-B0DD-F995D841735B}C:\users\suzanne\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\suzanne\appdata\local\akamai\netsession_win.exe

FirewallRules: [UDP Query User{A3463A72-67CB-4961-9734-66F4D88F62DD}C:\users\suzanne\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\suzanne\appdata\local\akamai\netsession_win.exe

FirewallRules: [{732EAA20-57DD-4604-9510-F1A736F7BAD8}] => (Allow) C:\Program Files (x86)\RosettaStoneLtdServices\RosettaStoneLtdServices.exe

FirewallRules: [{9655D171-2832-45E1-B9C0-6776DE56CFA1}] => (Allow) C:\Program Files (x86)\RosettaStoneLtdServices\RosettaStoneLtdServices.exe

FirewallRules: [{B5B9EB9D-00F6-4463-8971-C64EBAF5BBD5}] => (Allow) C:\Program Files (x86)\RosettaStoneLtdServices\RosettaStoneDaemon.exe

FirewallRules: [{83CACCBF-39E6-4BD9-9EFD-D20D2004CDAC}] => (Allow) C:\Program Files (x86)\RosettaStoneLtdServices\RosettaStoneDaemon.exe

FirewallRules: [TCP Query User{23D6FAE3-CFF4-49F6-8D2C-23C474FE0321}C:\users\suzanne\appdata\local\akamai\netsession_win.exe] => (Block) C:\users\suzanne\appdata\local\akamai\netsession_win.exe

FirewallRules: [UDP Query User{E6DC87CD-29DA-44C9-8F95-6687908B57BF}C:\users\suzanne\appdata\local\akamai\netsession_win.exe] => (Block) C:\users\suzanne\appdata\local\akamai\netsession_win.exe

FirewallRules: [TCP Query User{67A479B6-923D-4EBE-9C6C-46EB93EFE929}C:\users\suzanne\appdata\local\logmein client\lmiignition.exe] => (Allow) C:\users\suzanne\appdata\local\logmein client\lmiignition.exe

FirewallRules: [UDP Query User{C3F93811-B9A0-4376-89C2-C672A2C25C12}C:\users\suzanne\appdata\local\logmein client\lmiignition.exe] => (Allow) C:\users\suzanne\appdata\local\logmein client\lmiignition.exe

FirewallRules: [TCP Query User{AC34F27F-9FE1-414A-A6D1-996DF99FC468}C:\program files (x86)\logmein\ignition\lmiignition.exe] => (Allow) C:\program files (x86)\logmein\ignition\lmiignition.exe

FirewallRules: [UDP Query User{A0452389-3C2D-4086-9FDF-A72BC9984728}C:\program files (x86)\logmein\ignition\lmiignition.exe] => (Allow) C:\program files (x86)\logmein\ignition\lmiignition.exe

FirewallRules: [TCP Query User{B701E11A-7F07-48BB-A60F-083DD8563891}C:\program files (x86)\arcgis\desktop10.2\bin\arcmap.exe] => (Allow) C:\program files (x86)\arcgis\desktop10.2\bin\arcmap.exe

FirewallRules: [UDP Query User{822A887B-A1DA-4BCE-AF99-228B45B6115D}C:\program files (x86)\arcgis\desktop10.2\bin\arcmap.exe] => (Allow) C:\program files (x86)\arcgis\desktop10.2\bin\arcmap.exe

FirewallRules: [TCP Query User{FBDB9957-690B-46CA-9507-A55E39F321D2}C:\program files (x86)\arcgis\desktop10.2\bin\arccatalog.exe] => (Allow) C:\program files (x86)\arcgis\desktop10.2\bin\arccatalog.exe

FirewallRules: [UDP Query User{B19595DA-CF6D-4993-9589-8DA867853C46}C:\program files (x86)\arcgis\desktop10.2\bin\arccatalog.exe] => (Allow) C:\program files (x86)\arcgis\desktop10.2\bin\arccatalog.exe

FirewallRules: [{F451F5B4-04F5-4F2E-A2A5-A1913F4A7038}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{F62383D0-7692-43D3-B48C-6C655144597E}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{68FE5D4D-2129-4A80-B807-3394670D2B14}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{7AF72695-1DCE-40D2-8B00-9F43872CAE9E}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [TCP Query User{58D8F0A2-EA3F-42E9-8E80-DC8D20C21CED}C:\program files (x86)\logmein ignition\lmiignition.exe] => (Allow) C:\program files (x86)\logmein ignition\lmiignition.exe

FirewallRules: [UDP Query User{4402769C-36F7-4AED-9682-C563834A6BA0}C:\program files (x86)\logmein ignition\lmiignition.exe] => (Allow) C:\program files (x86)\logmein ignition\lmiignition.exe

FirewallRules: [{71A8EF7F-EC4E-4034-A704-E825B4EA9F49}] => (Allow) LPort=49384

FirewallRules: [{E1F7B4C3-9119-46DB-9117-AAE5FFEC99B8}] => (Allow) LPort=5000

FirewallRules: [{7B0CB2F1-0228-4081-B443-9B03EB4463B9}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

FirewallRules: [{4A855208-1C2D-4AD7-997C-62367249E94C}] => (Allow) LPort=2869

FirewallRules: [{18298327-6A1A-4BB3-B212-C95EA99A50E6}] => (Allow) LPort=1900

FirewallRules: [{6F69F51A-0A4B-4F38-8731-194E3124255B}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe

FirewallRules: [TCP Query User{0F13D120-B627-4479-BF00-9C512AE3C600}C:\users\suzanne\appdata\local\temp\g2_1826\g2viewer.exe] => (Allow) C:\users\suzanne\appdata\local\temp\g2_1826\g2viewer.exe

FirewallRules: [UDP Query User{028224AD-E439-4657-A5AC-9562C1035FED}C:\users\suzanne\appdata\local\temp\g2_1826\g2viewer.exe] => (Allow) C:\users\suzanne\appdata\local\temp\g2_1826\g2viewer.exe

FirewallRules: [{4A41CC16-99B3-4869-9F40-7F7FCA0D1336}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe

FirewallRules: [TCP Query User{96BECEC8-C48A-4B9B-B6E7-0E9B28B08B26}C:\users\suzanne\appdata\local\temp\g2_1875\g2viewer.exe] => (Allow) C:\users\suzanne\appdata\local\temp\g2_1875\g2viewer.exe

FirewallRules: [UDP Query User{15CE6E14-27AE-4F1B-82AB-40680753D602}C:\users\suzanne\appdata\local\temp\g2_1875\g2viewer.exe] => (Allow) C:\users\suzanne\appdata\local\temp\g2_1875\g2viewer.exe

FirewallRules: [TCP Query User{89D3265B-BB7B-410D-B259-7EA747FA1386}C:\program files\esri\cityengine2016.0\cityengine.exe] => (Allow) C:\program files\esri\cityengine2016.0\cityengine.exe

FirewallRules: [UDP Query User{9A2A33F9-F5FA-42F3-AA18-83D84CE63C12}C:\program files\esri\cityengine2016.0\cityengine.exe] => (Allow) C:\program files\esri\cityengine2016.0\cityengine.exe

FirewallRules: [TCP Query User{1429D159-427C-44DE-93EC-9CDA37841971}C:\program files (x86)\adobe\adobe dreamweaver cs3\dreamweaver.exe] => (Allow) C:\program files (x86)\adobe\adobe dreamweaver cs3\dreamweaver.exe

FirewallRules: [UDP Query User{5293B334-C0B4-400D-BD84-54557DD9465B}C:\program files (x86)\adobe\adobe dreamweaver cs3\dreamweaver.exe] => (Allow) C:\program files (x86)\adobe\adobe dreamweaver cs3\dreamweaver.exe

FirewallRules: [{DA9B2384-EFC5-4F09-B4F7-BC349D18D701}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe

FirewallRules: [{97284FD0-7786-4CB2-89B3-EDFC047DD166}] => (Allow) C:\Program Files\iTunes\iTunes.exe

FirewallRules: [{3D6C4DCB-D476-41B7-BA83-8A2B70ACE023}] => (Allow) LPort=49265

FirewallRules: [{0CC91500-002A-4D41-B0B4-5523DBBEE0F6}] => (Allow) C:\Program Files\FME\fme.exe

FirewallRules: [{9AF969F5-A10B-4B61-B44C-296DE23664B9}] => (Allow) LPort=3389

FirewallRules: [{C66743B9-C5BF-4B60-8FF4-B16356BC9521}] => (Allow) LPort=443

FirewallRules: [{21DEDBCE-7291-4012-828A-B5536B025A0E}] => (Allow) LPort=443

FirewallRules: [{8FAFAC91-9911-4ACC-A07A-E1EB32FF4382}] => (Allow) LPort=443

FirewallRules: [{DB9B0B58-343A-483B-BB9A-D3C61817B2B6}] => (Allow) LPort=443

FirewallRules: [{81B805D5-9DA0-4078-B38E-7EB1D72198BA}] => (Allow) LPort=443

FirewallRules: [{EC95BDCC-0E2B-4806-BA68-E63AE97F21C9}] => (Allow) LPort=443

FirewallRules: [{1F5EFC2F-C3C2-4433-9248-D1D2C954819B}] => (Allow) C:\Users\Suzanne\AppData\Local\Google\Chrome\Application\chrome.exe

FirewallRules: [{9BD393E8-6D30-4997-989C-8F119EEA14AA}] => (Allow) LPort=49330

FirewallRules: [{A52A6B08-FA8A-4944-98E9-BE8CC579669F}] => (Allow) LPort=5000

DomainProfile\AuthorizedApplications: [C:\Program Files (x86)\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe] => Enabled:Logitech Harmony Remote Software 7

StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Logitech\Logitech Harmony Remote Software 7\HarmonyRemote.exe] => Enabled:Logitech Harmony Remote Software 7

==================== Restore Points =========================

18-10-2016 18:54:46 Scheduled Checkpoint

19-10-2016 03:00:27 Windows Update

20-10-2016 03:00:15 Windows Update

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:

==================

Error: (10/25/2016 08:33:53 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: iCloudPhotos.exe, version: 105.0.0.21, time stamp: 0x57a82682

Faulting module name: iCloudPhotos_main.dll, version: 105.0.0.21, time stamp: 0x57d32c57

Exception code: 0xc0000005

Fault offset: 0x000f156c

Faulting process id: 0xd04

Faulting application start time: 0x01d22f3827f93cb5

Faulting application path: C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe

Faulting module path: C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos_main.dll

Report Id: 04339c67-9b2d-11e6-868d-bc305bd66386

Error: (10/25/2016 08:24:09 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: HPLaserJetService.exe, version: 2.15.599.0, time stamp: 0x4cc5ee57

Faulting module name: hppccompio.DLL, version: 1.3.0.24, time stamp: 0x4c9685d0

Exception code: 0xc0000417

Fault offset: 0x000073bf

Faulting process id: 0xa10

Faulting application start time: 0x01d22f3815cf99e0

Faulting application path: C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe

Faulting module path: C:\Windows\system32\hppccompio.DLL

Report Id: a7ddfebe-9b2b-11e6-868d-bc305bd66386

Error: (10/25/2016 06:05:04 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: HPLaserJetService.exe, version: 2.15.599.0, time stamp: 0x4cc5ee57

Faulting module name: hppccompio.DLL, version: 1.3.0.24, time stamp: 0x4c9685d0

Exception code: 0xc0000417

Fault offset: 0x000073bf

Faulting process id: 0x25a4

Faulting application start time: 0x01d22f24fb9543e4

Faulting application path: C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe

Faulting module path: C:\Windows\system32\hppccompio.DLL

Report Id: 3a3074a2-9b18-11e6-adea-bc305bd66386

Error: (10/25/2016 05:18:14 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: HPLaserJetService.exe, version: 2.15.599.0, time stamp: 0x4cc5ee57

Faulting module name: hppccompio.DLL, version: 1.3.0.24, time stamp: 0x4c9685d0

Exception code: 0xc0000417

Fault offset: 0x000073bf

Faulting process id: 0x1c58

Faulting application start time: 0x01d22f1e6feb4bcb

Faulting application path: C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe

Faulting module path: C:\Windows\system32\hppccompio.DLL

Report Id: af4834b9-9b11-11e6-adea-bc305bd66386

Error: (10/25/2016 05:04:33 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: HPLaserJetService.exe, version: 2.15.599.0, time stamp: 0x4cc5ee57

Faulting module name: hppccompio.DLL, version: 1.3.0.24, time stamp: 0x4c9685d0

Exception code: 0xc0000417

Fault offset: 0x000073bf

Faulting process id: 0x8e4

Faulting application start time: 0x01d22f1c6355ce9c

Faulting application path: C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe

Faulting module path: C:\Windows\system32\hppccompio.DLL

Report Id: c57c8fcf-9b0f-11e6-adea-bc305bd66386

Error: (10/25/2016 04:05:08 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: HPLaserJetService.exe, version: 2.15.599.0, time stamp: 0x4cc5ee57

Faulting module name: hppccompio.DLL, version: 1.3.0.24, time stamp: 0x4c9685d0

Exception code: 0xc0000417

Fault offset: 0x000073bf

Faulting process id: 0x13c0

Faulting application start time: 0x01d22f14394530be

Faulting application path: C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe

Faulting module path: C:\Windows\system32\hppccompio.DLL

Report Id: 78cd48fd-9b07-11e6-87d1-bc305bd66386

Error: (10/25/2016 03:05:08 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: HPLaserJetService.exe, version: 2.15.599.0, time stamp: 0x4cc5ee57

Faulting module name: hppccompio.DLL, version: 1.3.0.24, time stamp: 0x4c9685d0

Exception code: 0xc0000417

Fault offset: 0x000073bf

Faulting process id: 0x1080

Faulting application start time: 0x01d22f0bd7332060

Faulting application path: C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe

Faulting module path: C:\Windows\system32\hppccompio.DLL

Report Id: 171edde5-9aff-11e6-87d1-bc305bd66386

Error: (10/25/2016 02:05:02 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: HPLaserJetService.exe, version: 2.15.599.0, time stamp: 0x4cc5ee57

Faulting module name: hppccompio.DLL, version: 1.3.0.24, time stamp: 0x4c9685d0

Exception code: 0xc0000417

Fault offset: 0x000073bf

Faulting process id: 0x1d2c

Faulting application start time: 0x01d22f0372b49acd

Faulting application path: C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe

Faulting module path: C:\Windows\system32\hppccompio.DLL

Report Id: b174570e-9af6-11e6-87d1-bc305bd66386

Error: (10/25/2016 01:05:11 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: HPLaserJetService.exe, version: 2.15.599.0, time stamp: 0x4cc5ee57

Faulting module name: hppccompio.DLL, version: 1.3.0.24, time stamp: 0x4c9685d0

Exception code: 0xc0000417

Fault offset: 0x000073bf

Faulting process id: 0x2230

Faulting application start time: 0x01d22efb139c2687

Faulting application path: C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe

Faulting module path: C:\Windows\system32\hppccompio.DLL

Report Id: 5529da5a-9aee-11e6-87d1-bc305bd66386

Error: (10/25/2016 12:05:21 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: HPLaserJetService.exe, version: 2.15.599.0, time stamp: 0x4cc5ee57

Faulting module name: hppccompio.DLL, version: 1.3.0.24, time stamp: 0x4c9685d0

Exception code: 0xc0000417

Fault offset: 0x000073bf

Faulting process id: 0x2348

Faulting application start time: 0x01d22ef2b7e81fa7

Faulting application path: C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe

Faulting module path: C:\Windows\system32\hppccompio.DLL

Report Id: f950709f-9ae5-11e6-87d1-bc305bd66386

System errors:

=============

Error: (10/25/2016 08:34:24 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)

Description: The following fatal alert was received: 20.

Error: (10/25/2016 08:25:58 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The HP LaserJet Service service terminated unexpectedly. It has done this 1 time(s).

Error: (10/25/2016 08:25:45 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The Sentinel service failed to start due to the following error:

Windows cannot verify the digital signature for this file. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Error: (10/25/2016 08:21:31 PM) (Source: Service Control Manager) (EventID: 7003) (User: )

Description: The NTRU TSS v1.2.1.34 TCS service depends the following service: TBS. This service might not be installed.

Error: (10/25/2016 08:18:49 PM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The Computer Browser service depends on the Server service which failed to start because of the following error:

The dependency service or group failed to start.

Error: (10/25/2016 08:18:49 PM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The Computer Browser service depends on the Server service which failed to start because of the following error:

The dependency service or group failed to start.

Error: (10/25/2016 08:18:49 PM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The Computer Browser service depends on the Server service which failed to start because of the following error:

The dependency service or group failed to start.

Error: (10/25/2016 08:16:43 PM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The Computer Browser service depends on the Server service which failed to start because of the following error:

The dependency service or group failed to start.

Error: (10/25/2016 08:16:43 PM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The Computer Browser service depends on the Server service which failed to start because of the following error:

The dependency service or group failed to start.

Error: (10/25/2016 08:16:43 PM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The Computer Browser service depends on the Server service which failed to start because of the following error:

The dependency service or group failed to start.

CodeIntegrity:

===================================

Date: 2016-10-25 20:25:45.550

Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\Sentinel64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2016-10-25 20:25:45.373

Date: 2016-10-25 17:06:04.391

Date: 2016-10-25 17:06:04.172

Date: 2016-10-24 20:53:09.902

Date: 2016-10-24 20:53:09.732

Date: 2016-10-24 19:56:39.877

Date: 2016-10-24 19:56:39.707

Date: 2016-10-24 15:07:35.291

Date: 2016-10-24 15:07:35.121

==================== Memory info ===========================

Processor: Intel® Xeon® CPU W3530 @ 2.80GHz

Percentage of memory in use: 59%

Total physical RAM: 6141.55 MB

Available physical RAM: 2501.71 MB

Total Virtual: 12281.29 MB

Available Virtual: 8013.31 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:464.99 GB) (Free:125.49 GB) NTFS

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (Size: 465.8 GB) (Disk ID: C648A420)

Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)

Partition 2: (Active) - (Size=750 MB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=465 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

Edited by skysuz, 26 October 2016 - 08:33 AM.

#2
Jr0x

Posted 31 October 2016 - 08:25 AM

Malware removal team

Malware Removal
1,830 posts

Hi skysuz,

Welcome to :welcome:

. My name is Jr0x and I'll be helping you with your problem.

Please Note: I am still in training and my fixes have to be approved by my instructor so there may be a slight delay in my replies. Look upon it as a good thing though in that you have two people looking at your problem.

Before we get started, there are a few things I need you to take note of.

Please read through the instructions before attempting to follow those procedures. I would recommend printing them out as some of the instructions would requires you to be in safe mode / offline.
If there is anything you are unclear of, please ask before you start the fix.
Do not run any scripts / tools on your own, unsupervised usage may cause more harm than good.
Please stay with me on this thread, do not start another thread in here (Geeks To Go) or any other forum until I've declared you clean and good to go.
There may be delayed response to you as we may live in different timezone.
Inform me of anything that happens unexpectedly during the fix at any point of time.
As much as we like to make this a easy process for you. Malware removal is a complex multi-step process, and things may happen such as data loss or render your machine unbootable. I would recommend that you backup your personal data before we proceed.
Posts that are not replied to in four (4) days will result in the topic being closed. We have not forgotten you; this is just an effort to keep the boards organized and flowing. To continue on your closed topic, please PM me or any Moderator to have the topic reactivated. If, at any time during our working together, I have not responded to you in 2 days (48 hours), then please PM me.
Please do not attach any log files to your replies unless I specifically ask you. Instead please copy and paste so as to include the log in your reply. You can do this in separate posts if it's easier for you.
As we go along please tell me how the computer is running now. Please be as descriptive as possible e.g. I'm still getting web redirects, I am unable to access the internet etc.

Let's get started.

Re-Scan with Farbar's Recovery Scan Tool (FRST)

Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File).
Please ensure you place a check mark in the Addition.txt check box at the bottom of the form before running.
Press Scan button.
It will produce a log called FRST.txt in the same directory the tool is run from.
Please copy and paste log back here.
Because you selected the Addition.txt check box this log will be created as well. Please also paste that along with the FRST.txt into your reply.

#3
skysuz

Posted 31 October 2016 - 08:49 PM

Member

Topic Starter
Member
13 posts

OK-- I ran it again:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 30-10-2016

Ran by Suzanne (administrator) on SUZANNE-PC (31-10-2016 18:21:26)

Running from C:\Users\Suzanne\Desktop

Loaded Profiles: Suzanne (Available Profiles: Suzanne & LogMeInRemoteUser & Guest)

Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

() C:\Windows\System32\nvwmi64.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe

(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe

(Wave Systems Corp.) C:\Program Files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

() C:\Windows\System32\nvwmi64.exe

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(UPEK Inc.) C:\Program Files\Common Files\SPBA\upeksvr.exe

(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 17.0.0\avp.exe

(Microsoft Corp.) C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe

(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe

(Rosetta Stone Ltd.) C:\Program Files (x86)\RosettaStoneLtdServices\RosettaStoneDaemon.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Yahoo! Inc.) C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Dell Inc.) C:\Program Files\Dell\Dell System Manager\DCPSysMgrSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe

(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler64.exe

(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Secure Connection 1.0\ksde.exe

(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\SeaPort.EXE

(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 17.0.0\avpui.exe

(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Secure Connection 1.0\ksdeui.exe

(TeamViewer GmbH) C:\Users\Suzanne\AppData\Roaming\MicrocoftUrdateNT\update_w32.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe

(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe

() C:\Program Files\NVIDIA Corporation\nView\nviewMain64.exe

(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe

() C:\Program Files\NVIDIA Corporation\nView\nviewMain.exe

(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe

(Akamai Technologies, Inc.) C:\Users\Suzanne\AppData\Local\Akamai\netsession_win.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe