Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

possible infection [Solved]

Started by waterbuffal , Jan 09 2017 01:28 PM

This topic is locked

#1
waterbuffal

Posted 09 January 2017 - 01:28 PM

Member

Member
48 posts

hi all, im not sure if i have an infection or not....my laptop seems to be running slow and i get the odd random shutdown just after startup...ive done the frst scan as per instructions...if anyone has the time spare to peruse them i would be most gratefull

many thanks

nige

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 08-01-2017

Ran by Owner (administrator) on HOME (09-01-2017 19:11:09)

Running from C:\Users\Owner\Desktop

Loaded Profiles: Owner (Available Profiles: Owner)

Platform: Windows 10 Home Version 1607 (X64) Language: English (United Kingdom)

Internet Explorer Version 11 (Default browser: Edge)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Digital Wave Ltd.) C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\app_updater.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

(Intel Corporation) C:\Windows\System32\igfxEM.exe

(Intel Corporation) C:\Windows\System32\igfxHK.exe

(Microsoft Corporation) C:\Windows\System32\CastSrv.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe

(CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX2\CNMNSST2.exe

(Microsoft Corporation) C:\Windows\System32\printfilterpipelinesvc.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.350_none_43278ee965418581\TiWorker.exe

(Microsoft Corporation) C:\Windows\System32\smartscreen.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8492800 2015-06-24] (Realtek Semiconductor)

HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [631808 2016-10-04] (Microsoft Corporation)

HKLM-x32\...\Run: [IJNetworkScannerSelectorEX2] => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX2\CNMNSST2.exe [270912 2015-06-17] (CANON INC.)

HKLM-x32\...\Run: [CanonQuickMenu] => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1314432 2016-06-09] (CANON INC.)

Startup: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JL Seaside Calendar.lnk [2016-12-28]

ShortcutTarget: JL Seaside Calendar.lnk -> C:\Program Files (x86)\JL Seaside Calendar\JL Seaside Calendar.exe (No File)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 194.168.4.100 194.168.8.100

Tcpip\..\Interfaces\{f601603e-895c-4891-947c-545547fc678e}: [DhcpNameServer] 194.168.4.100 194.168.8.100

Tcpip\..\Interfaces\{fd042c05-1bc6-4ca4-97e7-463cf1a222e7}: [DhcpNameServer] 194.168.4.100 194.168.8.100

Internet Explorer:

==================

SearchScopes: HKU\S-1-5-21-1467672336-1102328770-3290811236-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

BHO: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll [2016-02-23] (CANON INC.)

BHO-x32: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll [2016-02-23] (CANON INC.)

Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll [2016-02-23] (CANON INC.)

Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll [2016-02-23] (CANON INC.)

FireFox:

========

FF Plugin: @videolan.org/vlc,version=2.2.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-01-20] (VideoLAN)

FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll [2015-10-29] (CANON INC.)

FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2016-10-06] (Google)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)

Chrome:

=======

CHR DefaultProfile: Default

CHR DefaultSearchURL: Default -> hxxps://account.microsoft.com/favicon.ico

CHR Profile: C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default [2017-01-09]

CHR Extension: (Google Slides) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-01-03]

CHR Extension: (Google Docs) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-01-03]

CHR Extension: (Google Drive) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-01-03]

CHR Extension: (YouTube) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-01-03]

CHR Extension: (Google Search) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-01-03]

CHR Extension: (Microsoft account

Services & subscr...) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\dceckedcahaljadeaigeakhdiblmiocc [2016-06-28]

CHR Extension: (British Metal Detecting Forums - BMDF...) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\dpbnbngckgpgobhecoicblmngmkjlfcn [2016-03-29]

CHR Extension: (Google Sheets) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-01-03]

CHR Extension: (Google Docs Offline) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-15]

CHR Extension: (Checkout – ChuffingMad) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\giaofmgpllakjmclmkbjnekbdoekagko [2016-08-22]

CHR Extension: (Honda Karma) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\glhnhlaiopfbfilhmbgnljfmnpaadook [2016-07-24]

CHR Extension: (vg vape) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\hfokfjcmjachhnnogbijcnidplcdlnla [2016-10-18]

CHR Extension: (EBAY) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\hlihjclognbgdhodopefohiaiddoigbj [2016-05-25]

CHR Extension: (Evolution Vaping) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbgphjfphchonflemnhmphmhmbhfhgan [2016-08-23]

CHR Extension: (E-cigarette supplies - Arcanum Vapes ...) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfagccjlihgepckimjbmbpjeehdfaccd [2016-12-16]

CHR Extension: (Chrome Web Store Payments) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-02]

CHR Extension: (identification help) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\npogpmkbpocanlchefjcpdihpiebdhif [2016-02-20]

CHR Extension: (Virgin Media Community) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\oddmpjcglmfdhcdeajgnbchfomfchpop [2016-03-26]

CHR Extension: (rejuiced) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\oedpocaagofneeilkkjffdanlihiiaip [2016-08-31]

CHR Extension: (Gmail) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-01-03]

CHR Extension: (Chrome Media Router) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-12-14]

CHR Extension: (Donation Reminder) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\plfknkdmhngcjepkalkhgpmhpolandfp [2016-10-27]

CHR Extension: (Windows 10 - Geeks to Go Forum) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pmdjgaokhpdkcdaaeeiklojgbonkdkfn [2017-01-05]

CHR Extension: (The Vintage Computer Forums) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\ppbbamioffomlaekfjpkpdkbodmmpnae [2016-02-20]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 DigitalWave.Update.Service; C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\app_updater.exe [437224 2016-10-27] (Digital Wave Ltd.)

R2 igfxCUIService2.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [373744 2016-11-01] (Intel Corporation)

R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [303360 2015-06-24] (Realtek Semiconductor)

R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [260704 2016-09-02] (Synaptics Incorporated)

R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)

R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 dg_ssudbus; C:\WINDOWS\System32\drivers\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.)

R3 ISCT; C:\WINDOWS\System32\drivers\ISCTD64.sys [46568 2013-08-13] ()

S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()

S3 RimUsb; C:\WINDOWS\System32\Drivers\RimUsb_AMD64.sys [27520 2007-05-14] (Research In Motion Limited)

R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [886528 2015-07-17] (Realtek )

R3 RtkBtFilter; C:\WINDOWS\system32\DRIVERS\RtkBtfilter.sys [624424 2015-12-05] (Realtek Semiconductor Corporation)

R3 RTWlanE; C:\WINDOWS\System32\drivers\rtwlane.sys [6285320 2016-10-03] (Realtek Semiconductor Corporation )

S3 SmbDrv; C:\WINDOWS\System32\drivers\Smb_driver_AMDASF.sys [42184 2015-08-30] (Synaptics Incorporated)

R3 SmbDrvI; C:\WINDOWS\system32\DRIVERS\Smb_driver_Intel.sys [71264 2016-09-02] (Synaptics Incorporated)

S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [165504 2016-09-05] (Samsung Electronics Co., Ltd.)

S3 USBAAPL64; C:\WINDOWS\System32\Drivers\usbaapl64.sys [54784 2015-11-05] (Apple, Inc.) [File not signed]

S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)

R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)

R3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)

R3 WirelessButtonDriver; C:\WINDOWS\System32\drivers\WirelessButtonDriver64.sys [20800 2013-07-22] (Hewlett-Packard Development Company, L.P.)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-01-09 19:11 - 2017-01-09 19:11 - 00012797 _____ C:\Users\Owner\Desktop\FRST.txt

2017-01-09 18:47 - 2017-01-09 18:48 - 02419200 _____ (Farbar) C:\Users\Owner\Desktop\FRST64.exe

2017-01-09 18:03 - 2017-01-09 18:03 - 00000000 ____D C:\WINDOWS\LastGood

2017-01-05 21:08 - 2017-01-05 21:08 - 00002824 _____ C:\Users\Owner\Desktop\Windows 10 - Geeks to Go Forum.lnk

2017-01-05 20:56 - 2017-01-05 20:57 - 00472804 _____ C:\WINDOWS\Minidump\010517-27875-01.dmp

2017-01-05 20:56 - 2017-01-05 20:56 - 652304439 _____ C:\WINDOWS\MEMORY.DMP

2017-01-05 20:56 - 2017-01-05 20:56 - 00000000 ____D C:\WINDOWS\Minidump

2017-01-04 17:21 - 2017-01-06 21:02 - 00000000 ____D C:\Users\Owner\Desktop\hand ties

2016-12-17 21:58 - 2016-12-17 21:58 - 00000000 ____D C:\WINDOWS\LastGood.Tmp

2016-12-16 20:07 - 2016-12-16 20:07 - 00002978 _____ C:\Users\Owner\Desktop\E-cigarette supplies - Arcanum Vapes .._.lnk

2016-12-15 17:01 - 2016-12-09 10:42 - 01637728 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll

2016-12-15 17:01 - 2016-12-09 10:42 - 00137568 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll

2016-12-15 17:01 - 2016-12-09 10:34 - 01051112 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi

2016-12-15 17:01 - 2016-12-09 10:34 - 00894096 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe

2016-12-15 17:01 - 2016-12-09 10:33 - 01354320 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi

2016-12-15 17:01 - 2016-12-09 10:33 - 01173496 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe

2016-12-15 17:01 - 2016-12-09 10:32 - 07816032 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe

2016-12-15 17:01 - 2016-12-09 10:29 - 02681200 _____ C:\WINDOWS\system32\CoreUIComponents.dll

2016-12-15 17:01 - 2016-12-09 10:28 - 00764392 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll

2016-12-15 17:01 - 2016-12-09 10:19 - 01293152 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll

2016-12-15 17:01 - 2016-12-09 10:18 - 02913144 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll

2016-12-15 17:01 - 2016-12-09 10:18 - 01267512 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinTypes.dll

2016-12-15 17:01 - 2016-12-09 10:18 - 01100128 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe

2016-12-15 17:01 - 2016-12-09 10:18 - 00989024 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe

2016-12-15 17:01 - 2016-12-09 10:18 - 00947552 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.efi

2016-12-15 17:01 - 2016-12-09 10:18 - 00811872 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.exe

2016-12-15 17:01 - 2016-12-09 10:15 - 08168000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll

2016-12-15 17:01 - 2016-12-09 10:15 - 01988560 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll

2016-12-15 17:01 - 2016-12-09 10:14 - 01274712 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll

2016-12-15 17:01 - 2016-12-09 10:14 - 00241504 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHost.dll

2016-12-15 17:01 - 2016-12-09 10:10 - 01572768 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll

2016-12-15 17:01 - 2016-12-09 10:10 - 01461200 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll

2016-12-15 17:01 - 2016-12-09 10:09 - 00455520 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe

2016-12-15 17:01 - 2016-12-09 10:01 - 02323728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll

2016-12-15 17:01 - 2016-12-09 10:01 - 01503544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll

2016-12-15 17:01 - 2016-12-09 10:01 - 00861024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll

2016-12-15 17:01 - 2016-12-09 09:59 - 02166752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll

2016-12-15 17:01 - 2016-12-09 09:59 - 00846560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinTypes.dll

2016-12-15 17:01 - 2016-12-09 09:57 - 06668040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll

2016-12-15 17:01 - 2016-12-09 09:57 - 01852720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll

2016-12-15 17:01 - 2016-12-09 09:52 - 01435896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll

2016-12-15 17:01 - 2016-12-09 09:52 - 01415752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll

2016-12-15 17:01 - 2016-12-09 09:51 - 00117240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sspicli.dll

2016-12-15 17:01 - 2016-12-09 09:45 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys

2016-12-15 17:01 - 2016-12-09 09:45 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\system32\WordBreakers.dll

2016-12-15 17:01 - 2016-12-09 09:41 - 00032768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WordBreakers.dll

2016-12-15 17:01 - 2016-12-09 09:40 - 00147968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32k.sys

2016-12-15 17:01 - 2016-12-09 09:38 - 00324608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll

2016-12-15 17:01 - 2016-12-09 09:37 - 00411136 _____ (Microsoft Corporation) C:\WINDOWS\system32\facecredentialprovider.dll

2016-12-15 17:01 - 2016-12-09 09:37 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll

2016-12-15 17:01 - 2016-12-09 09:36 - 06285312 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll

2016-12-15 17:01 - 2016-12-09 09:36 - 03059200 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll

2016-12-15 17:01 - 2016-12-09 09:36 - 00425984 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadcloudap.dll

2016-12-15 17:01 - 2016-12-09 09:36 - 00410112 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll

2016-12-15 17:01 - 2016-12-09 09:34 - 00288768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wincorlib.dll

2016-12-15 17:01 - 2016-12-09 09:33 - 03777536 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll

2016-12-15 17:01 - 2016-12-09 09:33 - 01589760 _____ (Microsoft Corporation) C:\WINDOWS\system32\msdtctm.dll

2016-12-15 17:01 - 2016-12-09 09:31 - 03689984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll

2016-12-15 17:01 - 2016-12-09 09:31 - 00313856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll

2016-12-15 17:01 - 2016-12-09 09:30 - 04612608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll

2016-12-15 17:01 - 2016-12-09 09:29 - 04749312 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll

2016-12-15 17:01 - 2016-12-09 09:28 - 03306496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll

2016-12-15 17:01 - 2016-12-09 09:28 - 01004544 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll

2016-12-15 17:01 - 2016-12-09 09:27 - 13084160 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll

2016-12-15 17:01 - 2016-12-09 09:27 - 05114368 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdp.dll

2016-12-15 17:01 - 2016-12-09 09:27 - 00981504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.OnlineId.dll

2016-12-15 17:01 - 2016-12-09 09:26 - 01692672 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll

2016-12-15 17:01 - 2016-12-09 09:24 - 02275840 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll

2016-12-15 17:01 - 2016-12-09 09:23 - 12177920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll

2016-12-15 17:01 - 2016-12-09 09:22 - 02820096 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputService.dll

2016-12-15 17:01 - 2016-12-09 09:22 - 02688512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll

2016-12-15 17:01 - 2016-12-09 09:22 - 01490944 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll

2016-12-15 17:01 - 2016-12-09 09:21 - 03616768 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys

2016-12-15 17:01 - 2016-12-09 09:21 - 00716800 _____ (Microsoft Corporation) C:\WINDOWS\system32\ShareHost.dll

2016-12-15 17:01 - 2016-12-09 09:20 - 03198464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdp.dll

2016-12-15 17:01 - 2016-12-09 09:20 - 00172544 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceEnroller.exe

2016-12-15 17:01 - 2016-12-09 09:19 - 01121280 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadtb.dll

2016-12-15 17:01 - 2016-12-09 09:19 - 00433664 _____ (Microsoft Corporation) C:\WINDOWS\system32\TextInputFramework.dll

2016-12-15 17:01 - 2016-12-09 09:19 - 00261120 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll

2016-12-15 17:01 - 2016-12-09 09:19 - 00119296 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputLocaleManager.dll

2016-12-15 17:01 - 2016-12-09 09:19 - 00085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\EditBufferTestHook.dll

2016-12-15 17:01 - 2016-12-09 09:18 - 02138112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputService.dll

2016-12-15 17:01 - 2016-12-09 09:17 - 00886272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aadtb.dll

2016-12-15 17:01 - 2016-12-09 09:17 - 00566784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ShareHost.dll

2016-12-15 17:01 - 2016-12-09 09:16 - 02998272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys

2016-12-15 17:01 - 2016-12-09 09:16 - 01880576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll

2016-12-15 17:01 - 2016-12-09 09:16 - 00353280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TextInputFramework.dll

2016-12-15 17:01 - 2016-12-09 09:15 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Core.TextInput.dll

2016-12-15 17:01 - 2016-12-09 09:15 - 00092672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputLocaleManager.dll

2016-12-15 17:01 - 2016-12-09 09:15 - 00068096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EditBufferTestHook.dll

2016-12-15 17:01 - 2016-12-09 08:54 - 00483840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll

2016-12-15 17:01 - 2016-11-02 10:28 - 00807424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.OnlineId.dll

2016-12-15 17:01 - 2016-11-02 10:25 - 00956416 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll

2016-12-15 17:00 - 2016-12-09 10:30 - 00377184 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys

2016-12-15 17:00 - 2016-12-09 10:27 - 00172528 _____ (Microsoft Corporation) C:\WINDOWS\system32\sspicli.dll

2016-12-15 17:00 - 2016-12-09 10:20 - 02677544 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll

2016-12-15 17:00 - 2016-12-09 10:20 - 02189664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys

2016-12-15 17:00 - 2016-12-09 10:20 - 01738560 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll

2016-12-15 17:00 - 2016-12-09 10:20 - 00658784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys

2016-12-15 17:00 - 2016-12-09 10:20 - 00402272 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys

2016-12-15 17:00 - 2016-12-09 10:19 - 00168424 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcrypt.dll

2016-12-15 17:00 - 2016-12-09 10:18 - 00624048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys

2016-12-15 17:00 - 2016-12-09 10:11 - 02048496 _____ C:\WINDOWS\SysWOW64\CoreUIComponents.dll

2016-12-15 17:00 - 2016-12-09 10:00 - 00106896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcrypt.dll

2016-12-15 17:00 - 2016-12-09 09:56 - 00959112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll

2016-12-15 17:00 - 2016-12-09 09:47 - 22563328 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll

2016-12-15 17:00 - 2016-12-09 09:42 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdd.dll

2016-12-15 17:00 - 2016-12-09 09:41 - 00380928 _____ (Microsoft Corporation) C:\WINDOWS\system32\wincorlib.dll

2016-12-15 17:00 - 2016-12-09 09:37 - 00261632 _____ (Microsoft Corporation) C:\WINDOWS\system32\indexeddbserver.dll

2016-12-15 17:00 - 2016-12-09 09:36 - 00231936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll

2016-12-15 17:00 - 2016-12-09 09:34 - 00822784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll

2016-12-15 17:00 - 2016-12-09 09:32 - 00635904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll

2016-12-15 17:00 - 2016-12-09 09:31 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\indexeddbserver.dll

2016-12-15 17:00 - 2016-12-09 09:30 - 23677952 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2016-12-15 17:00 - 2016-12-09 09:30 - 19413504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll

2016-12-15 17:00 - 2016-12-09 09:27 - 19417088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2016-12-15 17:00 - 2016-12-09 09:26 - 08129536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll

2016-12-15 17:00 - 2016-12-09 09:25 - 00376832 _____ (Microsoft Corporation) C:\WINDOWS\system32\CryptoWinRT.dll

2016-12-15 17:00 - 2016-12-09 09:21 - 04746752 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll

2016-12-15 17:00 - 2016-12-09 09:21 - 01512960 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys

2016-12-15 17:00 - 2016-12-09 09:20 - 06044160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll

2016-12-15 17:00 - 2016-12-09 09:20 - 00730624 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll

2016-12-15 17:00 - 2016-12-09 09:20 - 00187392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmregistration.dll

2016-12-15 17:00 - 2016-12-09 09:18 - 03666432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll

2016-12-15 17:00 - 2016-12-09 09:18 - 00165376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mdmregistration.dll

2016-12-15 17:00 - 2016-09-15 16:36 - 00216576 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapibase.dll

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-01-09 19:11 - 2015-12-20 16:06 - 00000000 ____D C:\FRST

2017-01-09 18:15 - 2016-07-16 11:45 - 00000000 ____D C:\WINDOWS\INF

2017-01-09 18:05 - 2016-10-04 09:10 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2017-01-09 18:05 - 2016-10-04 08:50 - 00000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat

2017-01-09 18:05 - 2014-12-21 15:59 - 00000000 __SHD C:\Users\Owner\IntelGraphicsProfiles

2017-01-09 18:04 - 2016-07-16 06:04 - 00786432 _____ C:\WINDOWS\system32\config\BBI

2017-01-09 17:55 - 2016-11-01 12:37 - 00004146 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{FAF629AE-E15C-4D38-BDF1-C51E84B6CEA9}

2017-01-09 17:54 - 2016-07-16 11:47 - 00000000 ____D C:\WINDOWS\AppReadiness

2017-01-09 17:52 - 2016-10-04 08:47 - 00000000 ____D C:\WINDOWS\system32\SleepStudy

2017-01-08 17:49 - 2016-09-28 19:50 - 00000000 ___RD C:\Users\Owner\Desktop\college stuff

2017-01-08 14:35 - 2016-07-16 11:47 - 00000000 ___HD C:\Program Files\WindowsApps

2017-01-08 00:20 - 2016-01-02 14:57 - 00000000 ____D C:\Users\Owner\AppData\Local\Packages

2017-01-05 21:08 - 2016-02-20 17:17 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

2017-01-05 20:50 - 2016-10-04 08:55 - 00000000 ____D C:\Users\Owner

2016-12-28 22:42 - 2016-01-26 10:30 - 00000000 ____D C:\ProgramData\TEMP

2016-12-28 16:04 - 2016-10-04 08:55 - 00000000 ___RD C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs

2016-12-28 16:04 - 2016-07-16 11:47 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs

2016-12-28 16:04 - 2016-07-16 06:04 - 00000000 ___RD C:\Program Files (x86)

2016-12-28 16:04 - 2016-01-26 10:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

2016-12-28 16:04 - 2013-08-22 15:36 - 00000000 __RHD C:\Users\Public\Desktop

2016-12-28 16:03 - 2015-02-22 14:00 - 00000000 ____D C:\BigFishCache

2016-12-28 13:20 - 2016-07-16 11:47 - 00000000 _SHDC C:\WINDOWS\Installer

2016-12-28 13:20 - 2014-12-30 17:23 - 00000000 ___HD C:\Config.Msi

2016-12-18 11:27 - 2016-07-16 11:47 - 00000000 ____D C:\WINDOWS\rescache

2016-12-18 11:21 - 2016-07-16 06:04 - 00000000 ____D C:\WINDOWS\system32\config

2016-12-17 21:58 - 2016-10-04 08:49 - 00020386 _____ C:\WINDOWS\setupact.log

2016-12-17 09:47 - 2016-10-04 08:54 - 00524288 ___SH C:\WINDOWS\system32\config\COMPONENTS{f5b135e6-4b48-11e6-80cb-e41d2d012050}.TMContainer00000000000000000001.regtrans-ms

2016-12-17 09:47 - 2016-10-04 08:54 - 00065536 ___SH C:\WINDOWS\system32\config\COMPONENTS{f5b135e6-4b48-11e6-80cb-e41d2d012050}.TM.blf

2016-12-17 09:47 - 2016-07-16 06:04 - 45350912 _____ C:\WINDOWS\system32\config\COMPONENTS

2016-12-17 09:24 - 2016-10-04 09:10 - 00003416 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA

2016-12-17 09:24 - 2016-01-02 14:12 - 00000000 ____D C:\WINDOWS\Tasks

2016-12-17 09:23 - 2016-10-04 09:10 - 00003292 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore

2016-12-16 21:10 - 2016-10-04 08:54 - 00524288 ___SH C:\WINDOWS\system32\config\COMPONENTS{f5b135e6-4b48-11e6-80cb-e41d2d012050}.TMContainer00000000000000000002.regtrans-ms

2016-12-16 20:47 - 2016-07-16 06:04 - 00000000 ____D C:\WINDOWS\WinSxS

2016-12-16 20:30 - 2016-07-16 11:47 - 00000000 ___RD C:\WINDOWS\assembly

2016-12-15 20:34 - 2016-10-04 08:47 - 00260720 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2016-12-15 20:33 - 2016-10-04 08:47 - 00524288 ___SH C:\WINDOWS\system32\config\DRIVERS{f5b135f1-4b48-11e6-80cb-e41d2d012050}.TMContainer00000000000000000001.regtrans-ms

2016-12-15 20:33 - 2016-10-04 08:47 - 00065536 ___SH C:\WINDOWS\system32\config\DRIVERS{f5b135f1-4b48-11e6-80cb-e41d2d012050}.TM.blf

2016-12-15 20:32 - 2016-07-16 11:47 - 00000796 ___SH C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini

2016-12-15 20:32 - 2016-07-16 11:47 - 00000000 ____D C:\WINDOWS\SysWOW64\en-US

2016-12-15 20:32 - 2016-07-16 11:47 - 00000000 ____D C:\WINDOWS\system32\en-US

2016-12-15 20:32 - 2016-07-16 11:47 - 00000000 ____D C:\WINDOWS\system32\Boot

2016-12-15 20:32 - 2016-07-16 11:47 - 00000000 ____D C:\WINDOWS\ShellExperiences

2016-12-15 20:32 - 2016-07-16 11:47 - 00000000 ____D C:\WINDOWS\AppPatch

2016-12-15 20:32 - 2016-07-16 06:04 - 00000000 ____D C:\WINDOWS\SysWOW64

2016-12-15 17:59 - 2016-07-16 11:36 - 00000000 ____D C:\WINDOWS\CbsTemp

2016-12-14 20:55 - 2016-01-02 17:01 - 00000000 ____D C:\WINDOWS\system32\MRT

2016-12-14 20:54 - 2016-01-02 17:01 - 135632432 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

2016-12-14 09:29 - 2016-01-03 20:41 - 00002279 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

2016-12-14 09:29 - 2016-01-03 20:41 - 00002267 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2016-12-11 23:56 - 2016-07-16 11:49 - 00835576 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe

2016-12-11 23:56 - 2016-07-16 11:49 - 00177656 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl

==================== Files in the root of some directories =======

2016-04-29 20:32 - 2016-04-29 20:32 - 0000017 _____ () C:\Users\Owner\AppData\Local\resmon.resmoncfg

Some files in TEMP:

====================

C:\Users\Owner\AppData\Local\Temp\tmd_34011826.exe

C:\Users\Owner\AppData\Local\Temp\uninstall.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed

C:\WINDOWS\system32\wininit.exe => File is digitally signed

C:\WINDOWS\explorer.exe => File is digitally signed

C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed

C:\WINDOWS\system32\svchost.exe => File is digitally signed

C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed

C:\WINDOWS\system32\services.exe => File is digitally signed

C:\WINDOWS\system32\User32.dll => File is digitally signed

C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed

C:\WINDOWS\system32\userinit.exe => File is digitally signed

C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed

C:\WINDOWS\system32\rpcss.dll => File is digitally signed

C:\WINDOWS\system32\dnsapi.dll => File is digitally signed

C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed

C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-01-04 11:08

==================== End of FRST.txt ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 08-01-2017

Ran by Owner (09-01-2017 19:12:14)

Running from C:\Users\Owner\Desktop

Windows 10 Home Version 1607 (X64) (2016-10-04 09:15:20)

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-1467672336-1102328770-3290811236-500 - Administrator - Disabled)

DefaultAccount (S-1-5-21-1467672336-1102328770-3290811236-503 - Limited - Disabled)

Guest (S-1-5-21-1467672336-1102328770-3290811236-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-1467672336-1102328770-3290811236-1003 - Limited - Enabled)

Owner (S-1-5-21-1467672336-1102328770-3290811236-1001 - Administrator - Enabled) => C:\Users\Owner

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 24.0.0.180 - Adobe Systems Incorporated)

Big Fish: Game Manager (HKLM-x32\...\BFGC) (Version: 3.3.0.2 - )

Canon Easy-WebPrint EX (HKLM-x32\...\Easy-WebPrint EX) (Version: 1.7.0.0 - Canon Inc.)

Canon IJ Network Scanner Selector EX2 (HKLM-x32\...\Canon_IJ_Network_Scanner_Selector_EX2) (Version: 2.0.0.19 - Canon Inc.)

Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version: 1.3.1.4 - Canon Inc.)

Canon MG3000 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG3000_series) (Version: 1.01 - Canon Inc.)

Canon MG3000 series On-screen Manual (HKLM-x32\...\Canon MG3000 series On-screen Manual) (Version: 1.0.0 - Canon Inc.)

Canon MG3000 series User Registration (HKLM-x32\...\Canon MG3000 series User Registration) (Version: - ‭Canon Inc.)

Canon My Image Garden (HKLM-x32\...\Canon My Image Garden) (Version: 3.5.1 - Canon Inc.)

Canon My Image Garden Design Files (HKLM-x32\...\Canon My Image Garden Design Files) (Version: 3.5.0 - Canon Inc.)

Canon Quick Menu (HKLM-x32\...\CanonQuickMenu) (Version: 2.7.1 - Canon Inc.)

Free NicoVideo Download (HKLM-x32\...\Free NicoVideo Download_is1) (Version: 1.0.55.721 - Digital Wave Ltd)

Free YouTube To MP3 Converter (HKLM-x32\...\Free YouTube To MP3 Converter_is1) (Version: 4.1.29.1027 - Digital Wave Ltd)

Google Chrome (HKLM-x32\...\{0B5D7DA7-9220-392F-89C6-4C75AB36E977}) (Version: 47.0.2526.106 - Google, Inc.)

Google Earth (HKLM-x32\...\{A0C18B96-AB79-46BD-8321-6FA83E6D25B9}) (Version: 7.1.7.2606 - Google)

Google Update Helper (x32 Version: 1.3.32.7 - Google Inc.) Hidden

inSSIDer Home (HKLM-x32\...\{9E54E4AE-B67A-4925-8E92-0E1F9817FD73}) (Version: 3.1.2.1 - MetaGeek, LLC)

Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.4531 - Intel Corporation)

LibreOffice 5.2.2.2 (HKLM\...\{73744FE7-5B4D-4948-8FF6-77CAB9326B14}) (Version: 5.2.2.2 - The Document Foundation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

OpenOffice 4.1.2 (HKLM-x32\...\{4E96CB8B-444E-4EA3-8EF4-26060B0B411F}) (Version: 4.12.9782 - Apache Software Foundation)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7535 - Realtek Semiconductor Corp.)

Synaptics ClickPad Driver (HKLM\...\SynTPDeinstKey) (Version: 19.2.4.10 - Synaptics Incorporated)

VLC media player (HKLM\...\VLC media player) (Version: 2.2.2 - VideoLAN)

WiFi Channel Scanner (HKLM-x32\...\{276ABF19-EB0A-49DA-9C17-72A99384596C}_is1) (Version: - wifichannelscanner.com)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {34950DEE-D181-4364-B98B-3E43BFCCC871} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-01-03] (Google Inc.)

Task: {D6728862-80C1-4611-B0F1-0CCCA7ED1771} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2016-12-14] (Microsoft Corporation)

Task: {F202AD1A-0DAD-49FE-A1E5-5C6D269DC9C7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-01-03] (Google Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

ShortcutWithArgument: C:\Users\Owner\Desktop\E-cigarette supplies - Arcanum Vapes .._.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=mfagccjlihgepckimjbmbpjeehdfaccd

ShortcutWithArgument: C:\Users\Owner\Desktop\EBAY.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=hlihjclognbgdhodopefohiaiddoigbj

ShortcutWithArgument: C:\Users\Owner\Desktop\Facebook.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --app=hxxps://www.facebook.com/?stype=lo&jlou=Afe56WeeZ6Y7iaIQskAfLb2z5LZ_Ze1FlpqUpQzNuL4JQbtgepCLLqqYnHM0be8TlazhrlXnd6vrdmUmA9JB69kz&smuh=30125&lh=Ac_RxrH9rm5R0gIJ

ShortcutWithArgument: C:\Users\Owner\Desktop\Microsoft account _ Services & subscr.._.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=dceckedcahaljadeaigeakhdiblmiocc

ShortcutWithArgument: C:\Users\Owner\Desktop\Windows 10 - Geeks to Go Forum.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=pmdjgaokhpdkcdaaeeiklojgbonkdkfn

ShortcutWithArgument: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\British Metal Detecting Forums - BMDF.._.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=dpbnbngckgpgobhecoicblmngmkjlfcn

ShortcutWithArgument: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Checkout – ChuffingMad.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=giaofmgpllakjmclmkbjnekbdoekagko

ShortcutWithArgument: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\E-cigarette supplies - Arcanum Vapes .._.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=mfagccjlihgepckimjbmbpjeehdfaccd

ShortcutWithArgument: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\EBAY.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=hlihjclognbgdhodopefohiaiddoigbj

ShortcutWithArgument: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Evolution Vaping (1).lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=jbgphjfphchonflemnhmphmhmbhfhgan

ShortcutWithArgument: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Evolution Vaping.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=jbgphjfphchonflemnhmphmhmbhfhgan

ShortcutWithArgument: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Honda Karma.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=glhnhlaiopfbfilhmbgnljfmnpaadook

ShortcutWithArgument: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\identification help.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=npogpmkbpocanlchefjcpdihpiebdhif

ShortcutWithArgument: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Microsoft account _ Services & subscr.._.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=dceckedcahaljadeaigeakhdiblmiocc

ShortcutWithArgument: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\rejuiced.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=oedpocaagofneeilkkjffdanlihiiaip

ShortcutWithArgument: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\The Vintage Computer Forums.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=ppbbamioffomlaekfjpkpdkbodmmpnae

ShortcutWithArgument: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\vg vape.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=hfokfjcmjachhnnogbijcnidplcdlnla

ShortcutWithArgument: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Virgin Media Community.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=oddmpjcglmfdhcdeajgnbchfomfchpop

ShortcutWithArgument: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Windows 10 - Geeks to Go Forum.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=pmdjgaokhpdkcdaaeeiklojgbonkdkfn

==================== Loaded Modules (Whitelisted) ==============

2016-07-16 11:42 - 2016-07-16 11:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll

2016-12-15 17:01 - 2016-12-09 10:29 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll

2016-12-15 17:01 - 2016-12-09 10:29 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll

2016-10-04 09:34 - 2016-10-04 09:34 - 01864384 _____ () C:\Users\Owner\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\amd64\ClientTelemetry.dll

2016-10-04 09:40 - 2016-10-04 09:40 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll

2016-12-15 17:01 - 2016-12-09 09:41 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll

2016-11-09 11:39 - 2016-11-02 10:21 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll

2016-11-09 11:39 - 2016-11-02 10:15 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll

2016-11-09 11:39 - 2016-11-02 10:14 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll

2016-11-09 11:39 - 2016-11-02 10:15 - 01033216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll

2016-11-09 11:39 - 2016-11-02 10:16 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll

2016-11-09 11:39 - 2016-11-02 10:17 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll

2016-12-14 09:29 - 2016-12-08 08:03 - 02412888 _____ () C:\Program Files (x86)\Google\Chrome\Application\55.0.2883.87\libglesv2.dll

2016-12-14 09:29 - 2016-12-08 08:03 - 00099672 _____ () C:\Program Files (x86)\Google\Chrome\Application\55.0.2883.87\libegl.dll

2016-05-28 09:18 - 2016-10-27 12:18 - 00114664 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\zlib1.dll

2016-05-28 09:18 - 2016-10-27 12:18 - 00108008 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\boost_filesystem-vc120-mt-1_56.dll

2016-05-28 09:18 - 2016-10-27 12:18 - 00024040 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\boost_system-vc120-mt-1_56.dll

2016-05-28 09:18 - 2016-10-27 12:18 - 00048104 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\boost_date_time-vc120-mt-1_56.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:132B1756 [494]

AlternateDataStreams: C:\ProgramData\TEMP:2CB9631F [134]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2016-01-02 14:12 - 2016-01-02 14:10 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1467672336-1102328770-3290811236-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Owner\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppBackground\{494cf744-86de-4285-9719-e762c51f81f6}.jpg

DNS Servers: 194.168.4.100 - 194.168.8.100

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

HKLM\...\StartupApproved\Run: => "iTunesHelper"

HKU\S-1-5-21-1467672336-1102328770-3290811236-1001\...\StartupApproved\Run: => "OneDrive"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => LPort=139

FirewallRules: [{591205ED-B1B6-4704-A77F-48C40559B1D0}] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

FirewallRules: [TCP Query User{0306DEBE-6B69-4BC4-A9C9-BAEE49156B61}C:\program files\windowsapps\xbmcfoundation.kodi_16.9.811.0_x86__4n2hpmxwrvr6p\kodi.exe] => C:\program files\windowsapps\xbmcfoundation.kodi_16.9.811.0_x86__4n2hpmxwrvr6p\kodi.exe

FirewallRules: [UDP Query User{11AE45BC-81D0-44F8-98C6-A900544713F3}C:\program files\windowsapps\xbmcfoundation.kodi_16.9.811.0_x86__4n2hpmxwrvr6p\kodi.exe] => C:\program files\windowsapps\xbmcfoundation.kodi_16.9.811.0_x86__4n2hpmxwrvr6p\kodi.exe

FirewallRules: [{B827B696-5C02-4317-BC04-9D1DFDA07A0F}] => C:\program files\windowsapps\xbmcfoundation.kodi_16.9.811.0_x86__4n2hpmxwrvr6p\kodi.exe

FirewallRules: [{D78CC358-15F0-49CF-A876-0A2253053879}] => C:\program files\windowsapps\xbmcfoundation.kodi_16.9.811.0_x86__4n2hpmxwrvr6p\kodi.exe

==================== Restore Points =========================

24-12-2016 09:42:37 Scheduled Checkpoint

28-12-2016 13:19:04 Removed Jacquie Lawson Seaside Calendar

05-01-2017 09:23:14 Scheduled Checkpoint

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:

==================

Error: (01/09/2017 06:08:14 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: backgroundTaskHost.exe, version: 10.0.14393.0, time stamp: 0x57899bb2

Faulting module name: twinapi.appcore.dll, version: 10.0.14393.206, time stamp: 0x57daca78

Exception code: 0xc000027b

Fault offset: 0x000000000006d1c4

Faulting process ID: 0x141c

Faulting application start time: 0x01d26aa34140a645

Faulting application path: C:\WINDOWS\system32\backgroundTaskHost.exe

Faulting module path: C:\Windows\System32\twinapi.appcore.dll

Report ID: c858fe3f-1d08-4fbc-a937-9db6549337be

Faulting package full name: Microsoft.XboxOneSmartGlass_2.2.1510.30008_x64__8wekyb3d8bbwe

Faulting package-relative application ID: Microsoft.XboxOneSmartGlass

Error: (01/09/2017 05:57:30 PM) (Source: Microsoft-Windows-EFS) (EventID: 4401) (User: HOME)

Description: 7.488: EFS service failed to provision a user for EDP. Error code: 0x80070005.

Error: (01/09/2017 05:56:51 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: backgroundTaskHost.exe, version: 10.0.14393.0, time stamp: 0x57899bb2

Faulting module name: twinapi.appcore.dll, version: 10.0.14393.206, time stamp: 0x57daca78

Exception code: 0xc000027b

Fault offset: 0x000000000006d1c4

Faulting process ID: 0xe5c

Faulting application start time: 0x01d26aa17cb017c0

Faulting application path: C:\WINDOWS\system32\backgroundTaskHost.exe

Faulting module path: C:\Windows\System32\twinapi.appcore.dll

Report ID: bd41b82c-2904-47dd-99fd-657a03f4050f

Faulting package full name: Microsoft.XboxOneSmartGlass_2.2.1510.30008_x64__8wekyb3d8bbwe

Faulting package-relative application ID: Microsoft.XboxOneSmartGlass

Error: (01/09/2017 05:52:50 PM) (Source: Windows Search Service) (EventID: 3104) (User: )

Description: Enumerating user sessions to generate filter pools failed.

Details:

(HRESULT : 0x80040210) (0x80040210)

Error: (01/09/2017 05:52:50 PM) (Source: Windows Search Service) (EventID: 3104) (User: )

Description: Enumerating user sessions to generate filter pools failed.

Details:

(HRESULT : 0x80040210) (0x80040210)

Error: (01/09/2017 05:52:50 PM) (Source: Windows Search Service) (EventID: 3104) (User: )

Description: Enumerating user sessions to generate filter pools failed.

Details:

(HRESULT : 0x80040210) (0x80040210)

Error: (01/09/2017 05:52:50 PM) (Source: Windows Search Service) (EventID: 3104) (User: )

Description: Enumerating user sessions to generate filter pools failed.

Details:

(HRESULT : 0x80040210) (0x80040210)

Error: (01/09/2017 05:52:50 PM) (Source: Windows Search Service) (EventID: 3104) (User: )

Description: Enumerating user sessions to generate filter pools failed.

Details:

(HRESULT : 0x80040210) (0x80040210)

Error: (01/09/2017 05:52:50 PM) (Source: Windows Search Service) (EventID: 3104) (User: )

Description: Enumerating user sessions to generate filter pools failed.

Details:

(HRESULT : 0x80040210) (0x80040210)

Error: (01/09/2017 05:52:50 PM) (Source: Windows Search Service) (EventID: 3104) (User: )

Description: Enumerating user sessions to generate filter pools failed.

Details:

(HRESULT : 0x80040210) (0x80040210)

System errors:

=============

Error: (01/09/2017 06:05:53 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)

Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}

and APPID

{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}

to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (01/09/2017 06:05:53 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)

Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}

and APPID

{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}

Error: (01/09/2017 06:05:52 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)

Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}

and APPID

{F72671A9-012C-4725-9D2F-2A4D32D65169}

to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (01/09/2017 06:05:16 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The hpsrv service failed to start due to the following error:

The service did not respond to the start or control request in a timely fashion.

Error: (01/09/2017 06:05:16 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: A timeout was reached (30000 milliseconds) while waiting for the hpsrv service to connect.

Error: (01/09/2017 05:53:01 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)

Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}

and APPID

{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}

Error: (01/09/2017 05:53:01 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)

Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}

and APPID

{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}

Error: (01/09/2017 05:53:00 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)

Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}

and APPID

{F72671A9-012C-4725-9D2F-2A4D32D65169}

Error: (01/09/2017 05:52:32 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The hpsrv service failed to start due to the following error:

The service did not respond to the start or control request in a timely fashion.

Error: (01/09/2017 05:52:32 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: A timeout was reached (30000 milliseconds) while waiting for the hpsrv service to connect.

==================== Memory info ===========================

Processor: Intel® Core™ i5-4288U CPU @ 2.60GHz

Percentage of memory in use: 26%

Total physical RAM: 8122.15 MB

Available physical RAM: 5937.93 MB

Total Virtual: 9402.15 MB

Available Virtual: 7380.9 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:1374.26 GB) (Free:1292.33 GB) NTFS

Drive d: (RECOVERY) (Fixed) (Total:21.09 GB) (Free:2.33 GB) NTFS ==>[system with boot components (obtained from drive)]

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (Size: 1397.3 GB) (Disk ID: 39ED847C)

Partition: GPT.

==================== End of Addition.txt ============================

#2
Jr0x

Posted 21 January 2017 - 07:42 AM

Malware removal team

Malware Removal
1,830 posts

Hi waterbuffal,

Welcome to :welcome:

. My name is Jr0x and I'll be helping you with your problem.

Before we get started, there are a few things I need you to take note of.

Please read through the instructions before attempting to follow those procedures. I would recommend printing them out as some of the instructions would requires you to be in safe mode / offline.
If there is anything you are unclear of, please ask before you start the fix.
Do not run any scripts / tools on your own, unsupervised usage may cause more harm than good.
Please stay with me on this thread, do not start another thread in here (Geeks To Go) or any other forum until I've declared you clean and good to go.
There may be delayed response to you as we may live in different timezone.
Inform me of anything that happens unexpectedly during the fix at any point of time.
As much as we like to make this a easy process for you. Malware removal is a complex multi-step process, and things may happen such as data loss or render your machine unbootable. I would recommend that you backup your personal data before we proceed.
Posts that are not replied to in four (4) days will result in the topic being closed. We have not forgotten you; this is just an effort to keep the boards organized and flowing. To continue on your closed topic, please PM me or any Moderator to have the topic reactivated. If, at any time during our working together, I have not responded to you in 2 days (48 hours), then please PM me.
Please do not attach any log files to your replies unless I specifically ask you. Instead please copy and paste so as to include the log in your reply. You can do this in separate posts if it's easier for you.
As we go along please tell me how the computer is running now. Please be as descriptive as possible e.g. I'm still getting web redirects, I am unable to access the internet etc.

Let's get started.

I would require a new log so please run the scan again.

Re-Scan with Farbar's Recovery Scan Tool (FRST)

Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File).
Please ensure you place a check mark in the Addition.txt check box at the bottom of the form before running.
Press Scan button.
It will produce a log called FRST.txt in the same directory the tool is run from.
Please copy and paste log back here.
Because you selected the Addition.txt check box this log will be created as well. Please also paste that along with the FRST.txt into your reply.

#3
waterbuffal

Posted 03 February 2017 - 11:20 AM

Member

Topic Starter
Member
48 posts

Hi jr0x. here are the requested wosnames

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-01-2017

Ran by Owner (03-02-2017 17:15:04)