[mara_frank]

Hi,

I encountered the same problem as described in this threat:

 

http://www.geekstogo...unches-firefox/

 

"the cursor over the text with the mouse had the cursor randomly changing to a hand (implying a web link). She accidently clicked (trying to place the cursor within the text) while the cursor was a hand, and firefox was launched which was quickly closed. Then it happened again, this time the link appeared to be going to Avira, our antivirus software, but again was quickly closed."  

"It seems that the invisible link (when it shows up) appears to be near the middle [top left] of the screen - in the perimeter areas the cursor acts normally. "

 

"Ran full virus scan with Avira antivirus using up-to-date definitions - no dections."

 

The only difference is that my random hijacked field appears in the left upper part of the screen. And the cursor does not always change to a pan (hand) but the hidden link field is still active.

It seems to be attached to the screen not a software- the same hidden field is present on the desktop/ web browser/ Excel/...

 

I would appreciate any help!

 

I ran Farber Recovery Scan Tool as recommended in the linked forum threat:

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 23-04-2017 01

Ran by Maria (administrator) on MARIA-PC (24-04-2017 11:57:49)

Running from C:\Users\Maria\Downloads

Loaded Profiles: Maria & UpdatusUser (Available Profiles: Maria & UpdatusUser)

Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: FF)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

 

==================== Processes (Whitelisted) =================

 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Validity Sensors, Inc.) C:\Windows\System32\valWBFPolicyService.exe

(Validity Sensors, Inc.) C:\Windows\System32\vcsFPService.exe

(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\sched.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe

(Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avguard.exe

(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe

(Digital Wave Ltd.) C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\app_updater.exe

(Intel Corporation) C:\Windows\System32\DptfParticipantProcessorService.exe

(Intel Corporation) C:\Windows\System32\DptfPolicyConfigTDPService.exe

(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe

(Microsoft Corporation) C:\Program Files\Microsoft Kinect Drivers\Service\KinectManagementService.exe

(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.SpeedupService.exe

(VIA Technologies, Inc.) C:\Windows\System32\ViakaraokeSrv.exe

(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe

(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe

(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.UI.Systray.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe

(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(STMicroelectronics) C:\Program Files (x86)\ST Microelectronics\ST_ACCEL\FFP_Manager.exe

(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe

(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe

(Akamai Technologies, Inc.) C:\Users\Maria\AppData\Local\Akamai\netsession_win.exe

(Microsoft Corporation) C:\Windows\System32\StikyNot.exe

(Spotify Ltd) C:\Users\Maria\AppData\Roaming\Spotify\SpotifyWebHelper.exe

(Citrix Online, a division of Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\GoToMeeting\4911\g2mstart.exe

(Akamai Technologies, Inc.) C:\Users\Maria\AppData\Local\Akamai\netsession_win.exe

(Spotify Ltd) C:\Users\Maria\AppData\Roaming\Spotify\Spotify.exe

(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe

(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe

(Plantronics, Inc.) C:\Program Files (x86)\Plantronics\PlantronicsURE\PlantronicsURE.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avgnt.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe

(Citrix Online, a division of Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\GoToMeeting\4911\g2mcomm.exe

(Blue Jeans) C:\Users\Maria\AppData\Local\Blue Jeans\App\BlueJeans.exe

(Spotify Ltd) C:\Users\Maria\AppData\Roaming\Spotify\Spotify.exe

(Citrix Online, a division of Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\GoToMeeting\4911\g2mlauncher.exe

(Spotify Ltd) C:\Users\Maria\AppData\Roaming\Spotify\Spotify.exe

(Spotify Ltd) C:\Users\Maria\AppData\Roaming\Spotify\Spotify.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avshadow.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe

(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe

(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe

() C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\CCXProcess.exe

(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe

(Node.js) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\libs\node.exe

(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe

(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\CCLibrary.exe

(Node.js) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\libs\node.exe

(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe

(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\btplayerctrl.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe

(Intel® Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe

(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\ipmgui.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

 

==================== Registry (Whitelisted) ====================

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

 

HKLM\...\Run: [BLEServicesCtrl] => C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe [184112 2012-05-31] (Intel Corporation)

HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp

HKLM\...\Run: [ASUS HDD Protection Tray Application] => C:\Program Files (x86)\ST Microelectronics\ST_ACCEL\FFP_Manager.exe [61080 2012-10-08] (STMicroelectronics)

HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\btvstack.exe [1023616 2012-05-30] (Atheros Commnucations)

HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\athbttray.exe [801920 2012-05-30] (Atheros Commnucations)

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508128 2016-07-01] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [ATKOSD2] => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [328504 2013-01-11] (ASUSTek Computer Inc.)

HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [205184 2012-10-17] (ASUSTek Computer Inc.)

HKLM-x32\...\Run: [HControlUser] => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)

HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648 2012-05-21] (Intel Corporation)

HKLM-x32\...\Run: [PlantronicsURE.exe] => C:\Program Files (x86)\Plantronics\PlantronicsURE\PlantronicsURE.exe [625040 2014-07-07] (Plantronics, Inc.)

HKLM-x32\...\Run: [AdobeCS4ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe [611712 2008-08-14] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [63432 2017-03-09] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\Antivirus\avgnt.exe [909744 2017-03-24] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [Avira System Speedup User Starter] => C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Core.Common.Starter.exe [67168 2017-04-07] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2404952 2017-03-27] (Adobe Systems Incorporated)

Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-3449447305-1594401728-24528855-1000\...\Run: [Akamai NetSession Interface] => C:\Users\Maria\AppData\Local\Akamai\netsession_win.exe [4490200 2017-01-03] (Akamai Technologies, Inc.)

HKU\S-1-5-21-3449447305-1594401728-24528855-1000\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-13] (Microsoft Corporation)

HKU\S-1-5-21-3449447305-1594401728-24528855-1000\...\Run: [Google Update] => C:\Users\Maria\AppData\Local\Google\Update\1.3.33.3\GoogleUpdateCore.exe [599632 2017-04-11] (Google Inc.)

HKU\S-1-5-21-3449447305-1594401728-24528855-1000\...\Run: [Spotify Web Helper] => C:\Users\Maria\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1446000 2017-04-13] (Spotify Ltd)

HKU\S-1-5-21-3449447305-1594401728-24528855-1000\...\Run: [GoToMeeting] => C:\Program Files (x86)\Citrix\GoToMeeting\4911\g2mstart.exe [41536 2016-05-11] (Citrix Online, a division of Citrix Systems, Inc.)

HKU\S-1-5-21-3449447305-1594401728-24528855-1000\...\Run: [Spotify] => C:\Users\Maria\AppData\Roaming\Spotify\Spotify.exe [7064176 2017-04-13] (Spotify Ltd)

HKU\S-1-5-21-3449447305-1594401728-24528855-1000\...\MountPoints2: {328cb4d3-ed99-11e3-bf20-c8f7336cb735} - E:\unlock.exe autoplay=true

HKU\S-1-5-21-3449447305-1594401728-24528855-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Maria\AppData\Local\Akamai\netsession_win.exe [4490200 2017-01-03] (Akamai Technologies, Inc.)

HKU\S-1-5-21-3449447305-1594401728-24528855-1001\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-13] (Microsoft Corporation)

HKU\S-1-5-21-3449447305-1594401728-24528855-1001\...\Run: [Google Update] => C:\Users\Maria\AppData\Local\Google\Update\GoogleUpdate.exe [144200 2015-05-26] (Google Inc.)

HKU\S-1-5-21-3449447305-1594401728-24528855-1001\...\Run: [Spotify Web Helper] => C:\Users\Maria\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1446000 2017-04-13] (Spotify Ltd)

HKU\S-1-5-21-3449447305-1594401728-24528855-1001\...\Run: [Box Edit] => C:\Users\UpdatusUser\AppData\Local\Box\Box Edit\Box Edit.exe

HKU\S-1-5-21-3449447305-1594401728-24528855-1001\...\Run: [Box Local Com Server] => C:\Users\UpdatusUser\AppData\Local\Box\Box Local Com Server\Box Local Com Service.exe

HKU\S-1-5-21-3449447305-1594401728-24528855-1001\...\MountPoints2: {328cb4d3-ed99-11e3-bf20-c8f7336cb735} - E:\unlock.exe autoplay=true

ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-10-25] ()

ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-10-25] ()

ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-10-25] ()

Startup: C:\Users\Maria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bluejeans-helper.vbs [2017-04-04] ()

BootExecute: autocheck autochk * bootdelete

 

==================== Internet (Whitelisted) ====================

 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

 

Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76

Tcpip\..\Interfaces\{0F98EC13-080A-4D74-A9F7-0164C08474B9}: [NameServer] 208.69.150.250,208.69.150.252

Tcpip\..\Interfaces\{0F98EC13-080A-4D74-A9F7-0164C08474B9}: [DhcpNameServer] 171.67.1.234 171.64.1.234

Tcpip\..\Interfaces\{58FEB348-E779-422A-A8A5-CD016B64DA35}: [DhcpNameServer] 75.75.75.75 75.75.76.76

 

Internet Explorer:

==================

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.v9.com/web/?type=ds&ts=1412543140&from=cor&uid=SanDiskXSSDXU100X256GB_124644400619&i=psd&t=349f0fa6d&q={searchTerms}

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.v9.com/web/?type=ds&ts=1412543140&from=cor&uid=SanDiskXSSDXU100X256GB_124644400619&i=psd&t=349f0fa6d&q={searchTerms}

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.v9.com/web/?type=ds&ts=1412543140&from=cor&uid=SanDiskXSSDXU100X256GB_124644400619&i=psd&t=349f0fa6d&q={searchTerms}

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.v9.com/web/?type=ds&ts=1412543140&from=cor&uid=SanDiskXSSDXU100X256GB_124644400619&i=psd&t=349f0fa6d&q={searchTerms}

HKU\S-1-5-21-3449447305-1594401728-24528855-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://astromenda.com/?f=1&a=ast_ir_14_35_ff&cd=2XzuyEtN2Y1L1Qzu0Czz0FyBtAtAyC0C0ByBtAyDtAyB0DtBtN0D0Tzu0SzyyBtBtN1L2XzutAtFtBtFtCtFtCtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StC0ByD0C0FtB0EtBtGyE0AyE0BtGtD0BtAyEtGzztD0AyBtGyDyCtCyCzyzzzztDyEtBtAyC2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szy0F0EtAyC0EtC0BtG0BtAtByDtGyEyDyEtCtGzz0AzztCtG0B0AzztAtAtA0AzyyCtCzzyC2Q&cr=699028479&ir=

HKU\S-1-5-21-3449447305-1594401728-24528855-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp

HKU\S-1-5-21-3449447305-1594401728-24528855-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://astromenda.com/?f=1&a=ast_ir_14_35_ff&cd=2XzuyEtN2Y1L1Qzu0Czz0FyBtAtAyC0C0ByBtAyDtAyB0DtBtN0D0Tzu0SzyyBtBtN1L2XzutAtFtBtFtCtFtCtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StC0ByD0C0FtB0EtBtGyE0AyE0BtGtD0BtAyEtGzztD0AyBtGyDyCtCyCzyzzzztDyEtBtAyC2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szy0F0EtAyC0EtC0BtG0BtAtByDtGyEyDyEtCtGzz0AzztCtG0B0AzztAtAtA0AzyyCtCzzyC2Q&cr=699028479&ir=

HKU\S-1-5-21-3449447305-1594401728-24528855-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp

SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = hxxp://www.default-search.net/search?sid=492&aid=311&itype=n&ver=13892&tm=491&src=ds&p={searchTerms}

SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = hxxp://www.default-search.net/search?sid=492&aid=311&itype=n&ver=13892&tm=491&src=ds&p={searchTerms}

SearchScopes: HKU\S-1-5-21-3449447305-1594401728-24528855-1000 -> DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = 

SearchScopes: HKU\S-1-5-21-3449447305-1594401728-24528855-1000 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = hxxp://www.default-search.net/search?sid=492&aid=311&itype=n&ver=13892&tm=491&src=ds&p={searchTerms}

SearchScopes: HKU\S-1-5-21-3449447305-1594401728-24528855-1001 -> DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = 

SearchScopes: HKU\S-1-5-21-3449447305-1594401728-24528855-1001 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = hxxp://www.default-search.net/search?sid=492&aid=311&itype=n&ver=13892&tm=491&src=ds&p={searchTerms}

BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2017-03-05] (Microsoft Corporation)

BHO: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\windows\system32\mscoree.dll [2010-11-20] (Microsoft Corporation)

BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-04-14] (Oracle Corporation)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\URLREDIR.DLL [2017-03-05] (Microsoft Corporation)

BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2017-03-05] (Microsoft Corporation)

BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-14] (Oracle Corporation)

BHO: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll [2016-03-23] (DVDVideoSoft Ltd.)

BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2017-03-05] (Microsoft Corporation)

BHO-x32: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\windows\system32\mscoree.dll [2010-11-20] (Microsoft Corporation)

BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-04-14] (Oracle Corporation)

BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll [2012-05-30] (Atheros Commnucations)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\URLREDIR.DLL [2017-03-05] (Microsoft Corporation)

BHO-x32: AviraBrowserSafety.BrowserSafety -> {c3c77255-42c0-499f-b664-6e981a0b1647} -> C:\windows\system32\mscoree.dll [2010-11-20] (Microsoft Corporation)

BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL [2017-03-05] (Microsoft Corporation)

BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-14] (Oracle Corporation)

BHO-x32: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll [2016-03-23] (DVDVideoSoft Ltd.)

Handler-x32: abs - {E00957BD-D0E1-4eb9-A025-7743FDC8B27B} - C:\windows\system32\mscoree.dll [2010-11-20] (Microsoft Corporation)

Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-03-05] (Microsoft Corporation)

Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-03-05] (Microsoft Corporation)

Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-03-05] (Microsoft Corporation)

Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-03-05] (Microsoft Corporation)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\SKYPE4~1.DLL [2016-09-23] (Skype Technologies)

 

FireFox:

========

FF ProfilePath: C:\Users\Maria\AppData\Roaming\Mozilla\Firefox\Profiles\hsop94mb.default [2017-04-24]

FF user.js: detected! => C:\Users\Maria\AppData\Roaming\Mozilla\Firefox\Profiles\hsop94mb.default\user.js [2015-05-04]

FF DefaultSearchEngine: Mozilla\Firefox\Profiles\hsop94mb.default -> Google

FF DefaultSearchEngine.US: Mozilla\Firefox\Profiles\hsop94mb.default -> Google

FF SearchEngineOrder.1: Mozilla\Firefox\Profiles\hsop94mb.default -> default-search.net

FF Homepage: Mozilla\Firefox\Profiles\hsop94mb.default -> hxxps://www.google.com/?gws_rd=ssl

FF Extension: (Avira Browser Safety) - C:\Users\Maria\AppData\Roaming\Mozilla\Firefox\Profiles\hsop94mb.default\Extensions\[email protected] [2017-04-10]

FF Extension: (Spanish (Spain) Dictionary) - C:\Users\Maria\AppData\Roaming\Mozilla\Firefox\Profiles\hsop94mb.default\Extensions\[email protected] [2017-01-29]

FF Extension: (HTML5 Notifications) - C:\Users\Maria\AppData\Roaming\Mozilla\Firefox\Profiles\hsop94mb.default\Extensions\[email protected] [2015-11-17] [not signed]

FF Extension: (DVDVideoSoft YouTube MP3 and Video Download) - C:\Users\Maria\AppData\Roaming\Mozilla\Firefox\Profiles\hsop94mb.default\Extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}.xpi [2016-03-23] [not signed]

FF Extension: (Disable Prefetch) - C:\Users\Maria\AppData\Roaming\Mozilla\Firefox\Profiles\hsop94mb.default\features\{3a37342b-8f23-445e-8110-92b937a3fdd6}\[email protected] [2017-04-10]

FF SearchPlugin: C:\Users\Maria\AppData\Roaming\Mozilla\Firefox\Profiles\hsop94mb.default\searchplugins\leo-eng-deu-v20.xml [2015-08-22]

FF SearchPlugin: C:\Users\Maria\AppData\Roaming\Mozilla\Firefox\Profiles\hsop94mb.default\searchplugins\youtube-video-search.xml [2014-09-30]

FF Extension: (Site Deployment Checker) - C:\Program Files (x86)\Mozilla Firefox\browser\features\[email protected] [2017-04-15] [not signed]

FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox

FF Extension: (Citavi Picker) - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2014-08-19] [not signed]

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\default-search.xml [2014-10-05]

FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_25_0_0_148.dll [2017-04-11] ()

FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-14] (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-14] (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE -> disabled [No File]

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50906.0\npctrl.dll [2017-03-09] ( Microsoft Corporation)

FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2017-03-27] (Adobe Systems)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_25_0_0_148.dll [2017-04-11] ()

FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-14] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-14] (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]

FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2017-03-05] (Microsoft Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50906.0\npctrl.dll [2017-03-09] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2017-03-05] (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.3\npGoogleUpdate3.dll [2017-04-06] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.3\npGoogleUpdate3.dll [2017-04-06] (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-04] (VideoLAN)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-04-04] (Adobe Systems Inc.)

FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2017-03-27] (Adobe Systems)

FF Plugin-x32: PDF Architect 2 -> C:\Program Files (x86)\PDF Architect 2\np-previewer.dll [2014-04-30] (pdfforge GmbH)

FF Plugin HKU\S-1-5-21-3449447305-1594401728-24528855-1000: @citrixonline.com/appdetectorplugin -> C:\Users\Maria\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2014-06-12] (Citrix Online)

FF Plugin HKU\S-1-5-21-3449447305-1594401728-24528855-1000: @talk.google.com/GoogleTalkPlugin -> C:\Users\Maria\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google)

FF Plugin HKU\S-1-5-21-3449447305-1594401728-24528855-1000: @talk.google.com/O1DPlugin -> C:\Users\Maria\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-12-08] (Google)

FF Plugin HKU\S-1-5-21-3449447305-1594401728-24528855-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Maria\AppData\Local\Google\Update\1.3.33.3\npGoogleUpdate3.dll [2017-04-11] (Google Inc.)

FF Plugin HKU\S-1-5-21-3449447305-1594401728-24528855-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Maria\AppData\Local\Google\Update\1.3.33.3\npGoogleUpdate3.dll [2017-04-11] (Google Inc.)

FF Plugin HKU\S-1-5-21-3449447305-1594401728-24528855-1000: box.com/BoxEdit -> C:\Users\Maria\AppData\Local\Box\Box Edit\npBoxEdit.dll [No File]

FF Plugin ProgramFiles/Appdata: C:\Users\Maria\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google)

FF Plugin ProgramFiles/Appdata: C:\Users\Maria\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-12-08] (Google)

 

Chrome: 

=======

CHR DefaultProfile: Default

CHR HomePage: Default -> hxxps://www.google.com/

CHR StartupUrls: Default -> "hxxps://www.google.com/"

CHR Profile: C:\Users\Maria\AppData\Local\Google\Chrome\User Data\Default [2017-04-24]

CHR Extension: (Google Docs) - C:\Users\Maria\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-03-13]

CHR Extension: (Google Drive) - C:\Users\Maria\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-01]

CHR Extension: (YouTube) - C:\Users\Maria\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-07]

CHR Extension: (Google Search) - C:\Users\Maria\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-15]

CHR Extension: (Avira Browser Safety) - C:\Users\Maria\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2016-09-29]

CHR Extension: (GoToMeeting Pro Screensharing) - C:\Users\Maria\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcgikpombjkodabhbdalkcdhmllafipp [2016-11-17]

CHR Extension: (Google Docs Offline) - C:\Users\Maria\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-15]

CHR Extension: (Chrome Web Store Payments) - C:\Users\Maria\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-10]

CHR Extension: (Blue Jeans Meeting) - C:\Users\Maria\AppData\Local\Google\Chrome\User Data\Default\Extensions\nodamnmigpadbnfioofpbacngdlcidgn [2017-04-04]

CHR Extension: (Citavi Picker) - C:\Users\Maria\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohgndokldibnndfnjnagojmheejlengn [2017-03-10]

CHR Extension: (Gmail) - C:\Users\Maria\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-05-26]

CHR Extension: (Chrome Media Router) - C:\Users\Maria\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-03-31]

CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx

CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx

CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn] - C:\Program Files (x86)\Citavi 4\Pickers\Chrome\ChromePicker.crx [2014-02-07]

 

==================== Services (Whitelisted) ====================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

R2 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [771672 2017-03-14] (Adobe Systems Incorporated)

R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2227312 2017-02-27] (Adobe Systems, Incorporated)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\Antivirus\avmailc7.exe [1115552 2017-03-24] (Avira Operations GmbH & Co. KG)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\Antivirus\sched.exe [487432 2017-03-24] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\Antivirus\avguard.exe [487432 2017-03-24] (Avira Operations GmbH & Co. KG)

S2 AntiVirWebService; C:\Program Files (x86)\Avira\Antivirus\avwebg7.exe [1519136 2017-03-24] (Avira Operations GmbH & Co. KG)

R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [119424 2012-05-30] (Atheros Commnucations) [File not signed]

R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [349560 2017-03-09] (Avira Operations GmbH & Co. KG)

R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [3737792 2017-03-26] (Microsoft Corporation)

R2 DigitalWave.Update.Service; C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\app_updater.exe [388968 2016-03-23] (Digital Wave Ltd.)

R2 DptfParticipantProcessorService; C:\windows\system32\DptfParticipantProcessorService.exe [117704 2013-09-28] (Intel Corporation)

R2 DptfPolicyConfigTDPService; C:\windows\system32\DptfPolicyConfigTDPService.exe [116680 2013-09-28] (Intel Corporation)

R2 KinectManagement; C:\Program Files\Microsoft Kinect Drivers\Service\KinectManagementService.exe [98816 2012-09-18] (Microsoft Corporation) [File not signed]

S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-05-08] ()

S3 ose; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [198192 2017-03-25] (Microsoft Corporation) [File not signed]

S3 PDF Architect 2; C:\Program Files (x86)\PDF Architect 2\ws.exe [1716264 2014-04-30] (pdfforge GmbH)

S3 pdfforge CrashHandler; C:\Program Files (x86)\PDF Architect 2\crash-handler-ws.exe [861736 2014-04-30] (pdfforge GmbH)

R2 SpeedupService; C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.SpeedupService.exe [74800 2017-04-07] (Avira Operations GmbH & Co. KG)

R2 valWBFPolicyService; C:\windows\system32\valWBFPolicyService.exe [35328 2013-10-11] (Validity Sensors, Inc.)

R2 VIAKaraokeService; C:\windows\system32\viakaraokesrv.exe [27768 2012-10-22] (VIA Technologies, Inc.)

S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)

R2 ZAtheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [327296 2012-05-30] (Atheros) [File not signed]

R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3385584 2013-05-08] (Intel® Corporation)

 

===================== Drivers (Whitelisted) ======================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

S3 Apowersoft_AudioDevice; C:\windows\System32\drivers\Apowersoft_AudioDevice.sys [31920 2014-04-09] (Wondershare)

R3 ATP; C:\windows\System32\DRIVERS\AsusTP.sys [65784 2013-04-16] (ASUS Corporation)

R2 avgntflt; C:\windows\System32\DRIVERS\avgntflt.sys [176968 2017-03-24] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\windows\System32\DRIVERS\avipbb.sys [148104 2017-03-24] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\windows\System32\DRIVERS\avkmgr.sys [35328 2017-03-24] (Avira Operations GmbH & Co. KG)

R2 avnetflt; C:\windows\System32\DRIVERS\avnetflt.sys [78600 2017-03-24] (Avira Operations GmbH & Co. KG)

R3 btmaudio; C:\windows\System32\drivers\btmaud.sys [80896 2012-05-21] (Motorola Solutions, Inc.)

S3 btmaux; C:\windows\System32\DRIVERS\btmaux.sys [111104 2012-05-21] (Motorola Solutions, Inc.)

R3 btmhsf; C:\windows\System32\DRIVERS\btmhsf.sys [849408 2012-06-09] (Motorola Solutions, Inc.)

S3 CH341ENUM_A64; C:\windows\System32\DRIVERS\CH34EA64.sys [30208 2010-12-22] (Windows ® Server 2003 DDK provider)

S3 CH341ENUM_A64; C:\Windows\SysWOW64\DRIVERS\CH34EA64.sys [30208 2010-12-22] (Windows ® Server 2003 DDK provider)

S3 CH341SER_A64; C:\windows\System32\Drivers\CH341S64.SYS [58368 2010-12-22] (www.winchiphead.com)

S3 CH341SER_A64; C:\Windows\SysWOW64\Drivers\CH341S64.SYS [58368 2010-12-22] (www.winchiphead.com)

R3 DptfDevDram; C:\windows\System32\DRIVERS\DptfDevDram.sys [145640 2013-09-28] (Intel Corporation)

R3 DptfDevFan; C:\windows\System32\DRIVERS\DptfDevFan.sys [50640 2013-09-28] (Intel Corporation)

R3 DptfDevGen; C:\windows\System32\DRIVERS\DptfDevGen.sys [78504 2013-09-28] (Intel Corporation)

R3 DptfDevPch; C:\windows\System32\DRIVERS\DptfDevPch.sys [116752 2013-09-28] (Intel Corporation)

R3 DptfDevProc; C:\windows\System32\DRIVERS\DptfDevProc.sys [289744 2013-09-28] (Intel Corporation)

R3 DptfManager; C:\windows\System32\DRIVERS\DptfManager.sys [494296 2013-09-28] (Intel Corporation)

S3 hitmanpro37; C:\windows\system32\drivers\hitmanpro37.sys [32152 2014-07-30] ()

R3 ISCT; C:\windows\System32\DRIVERS\ISCTD.sys [44744 2014-02-02] ()

R3 kbfiltr; C:\windows\System32\DRIVERS\kbfiltr.sys [17280 2012-08-05] ( )

S3 KinectCamera; C:\windows\System32\Drivers\kinectcamera.sys [192512 2012-09-20] (Microsoft Corporation)

R3 MEIx64; C:\windows\System32\DRIVERS\TeeDriverx64.sys [118272 2014-03-20] (Intel Corporation)

R3 ST_ACCEL; C:\windows\System32\DRIVERS\ST_ACCEL.sys [67184 2012-05-21] (STMicroelectronics)

S3 USBAAPL64; C:\windows\System32\Drivers\usbaapl64.sys [54784 2015-06-17] (Apple, Inc.) [File not signed]

 

==================== NetSvcs (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

 

==================== One Month Created files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2017-04-24 11:57 - 2017-04-24 11:58 - 00037473 _____ C:\Users\Maria\Downloads\FRST.txt

2017-04-24 11:57 - 2017-04-24 11:57 - 00000000 ____D C:\FRST

2017-04-24 11:55 - 2017-04-24 11:55 - 02426368 _____ (Farbar) C:\Users\Maria\Downloads\FRST64.exe

2017-04-21 23:31 - 2017-04-21 23:31 - 00040525 _____ C:\Users\Maria\Desktop\Consent (2).pdf

2017-04-21 13:48 - 2017-04-21 13:48 - 00040468 _____ C:\Users\Maria\Desktop\Consent (1).pdf

2017-04-21 13:44 - 2017-04-21 13:44 - 00040468 _____ C:\Users\Maria\Desktop\Consent.pdf

2017-04-18 09:26 - 2017-04-24 11:24 - 01597440 _____ C:\Users\Maria\Desktop\businesscards.indd

2017-04-18 09:06 - 2017-04-18 09:06 - 01663318 _____ C:\Users\Maria\Desktop\Gemini_Layouts.pdf

2017-04-17 15:04 - 2017-04-17 15:04 - 00003502 _____ C:\windows\System32\Tasks\AdobeAAMUpdater-1.0-Maria-PC-Maria

2017-04-17 15:04 - 2017-04-17 15:04 - 00000000 ____D C:\ProgramData\regid.1986-12.com.adobe

2017-04-17 15:03 - 2017-04-17 15:03 - 00002467 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Illustrator CC 2017.lnk

2017-04-17 15:03 - 2017-04-17 15:03 - 00000040 ____H C:\4DE7F732DFEF

2017-04-17 15:03 - 2017-04-17 15:03 - 00000033 _____ C:\Users\Maria\AppData\Roaming\AdobeWLCMCache.dat

2017-04-17 15:00 - 2017-04-24 11:25 - 00000000 ___RD C:\Users\Maria\Creative Cloud Files

2017-04-17 15:00 - 2017-04-24 11:25 - 00000000 ____D C:\ProgramData\boost_interprocess

2017-04-17 14:58 - 2017-04-17 14:58 - 00001231 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Creative Cloud.lnk

2017-04-17 14:58 - 2017-04-17 14:58 - 00001219 _____ C:\Users\Public\Desktop\Adobe Creative Cloud.lnk

2017-04-17 14:55 - 2017-04-17 14:55 - 00814168 _____ (Adobe Systems Incorporated) C:\Users\Maria\Downloads\CreativeCloudSet-Up.exe

2017-04-16 21:49 - 2017-04-16 21:49 - 00174224 _____ C:\Users\Maria\Desktop\Sutro Healthc Inc. - 2014 Equity Incentive Plan - Stock Option Agreement (Incentive and Nonstatutory Stock Options).pdf

2017-04-16 21:49 - 2017-04-16 21:49 - 00144068 _____ C:\Users\Maria\Desktop\Sutro Health2c Inc. - Employee Confidential Information and Inventions Assignment Agreement - California.pdf

2017-04-16 21:36 - 2017-04-24 11:25 - 00000000 ____D C:\Users\Public\Speedup Sessions

2017-04-16 21:36 - 2017-04-16 21:36 - 00003658 _____ C:\windows\System32\Tasks\AviraSystemSpeedupUpdate

2017-04-15 19:49 - 2017-04-15 19:49 - 00026961 _____ C:\Users\Maria\Desktop\OfferLetter.docx (1).pdf

2017-04-12 11:47 - 2017-04-12 11:52 - 00000000 ____D C:\ProgramData\Stanford

2017-04-12 11:47 - 2017-04-12 11:50 - 00000000 ____D C:\Users\Maria\AppData\Roaming\Stanford

2017-04-12 11:46 - 2017-04-12 11:46 - 19668352 _____ (Stanford University) C:\Users\Maria\Downloads\StanfordCompliance.exe

2017-04-11 10:11 - 2017-03-27 11:13 - 00394448 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll

2017-04-11 10:11 - 2017-03-27 10:28 - 00346320 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll

2017-04-11 10:11 - 2017-03-25 12:39 - 20284416 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll

2017-04-11 10:11 - 2017-03-25 12:07 - 04604416 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll

2017-04-11 10:11 - 2017-03-25 12:06 - 13654016 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll

2017-04-11 10:11 - 2017-03-25 11:55 - 02767360 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll

2017-04-11 10:11 - 2017-03-25 11:52 - 02289152 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll

2017-04-11 10:11 - 2017-03-25 11:51 - 01313280 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll

2017-04-11 10:11 - 2017-03-25 11:48 - 00499200 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll

2017-04-11 10:11 - 2017-03-25 11:47 - 02055680 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl

2017-04-11 10:11 - 2017-03-25 11:47 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll

2017-04-11 10:11 - 2017-03-25 11:47 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll

2017-04-11 10:11 - 2017-03-25 11:46 - 00693248 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll

2017-04-11 10:11 - 2017-03-25 11:46 - 00663552 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll

2017-04-11 10:11 - 2017-03-25 11:46 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll

2017-04-11 10:11 - 2017-03-25 11:46 - 00230400 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll

2017-04-11 10:11 - 2017-03-25 11:46 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll

2017-04-11 10:11 - 2017-03-25 11:46 - 00130048 _____ (Microsoft Corporation) C:\windows\SysWOW64\occache.dll

2017-04-11 10:11 - 2017-03-25 11:46 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll

2017-04-11 10:11 - 2017-03-25 11:46 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll

2017-04-11 10:11 - 2017-03-25 11:45 - 00416256 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll

2017-04-11 10:11 - 2017-03-25 11:45 - 00279040 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll

2017-04-11 10:11 - 2017-03-25 11:45 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe

2017-04-11 10:11 - 2017-03-25 11:45 - 00091136 _____ (Microsoft Corporation) C:\windows\SysWOW64\inseng.dll

2017-04-11 10:11 - 2017-03-25 11:45 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll

2017-04-11 10:11 - 2017-03-25 11:45 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll

2017-04-11 10:11 - 2017-03-25 11:45 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll

2017-04-11 10:11 - 2017-03-25 11:44 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb

2017-04-11 10:11 - 2017-03-25 11:44 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll

2017-04-11 10:11 - 2017-03-25 11:35 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb

2017-04-11 10:11 - 2017-03-25 11:35 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll

2017-04-11 10:11 - 2017-03-25 11:16 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll

2017-04-11 10:11 - 2017-03-25 11:14 - 00417792 _____ (Microsoft Corporation) C:\windows\system32\html.iec

2017-04-11 10:11 - 2017-03-25 11:14 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll

2017-04-11 10:11 - 2017-03-25 11:13 - 00576512 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll

2017-04-11 10:11 - 2017-03-25 11:13 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll

2017-04-11 10:11 - 2017-03-25 11:10 - 02898432 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2017-04-11 10:11 - 2017-03-25 11:04 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll

2017-04-11 10:11 - 2017-03-25 11:02 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll

2017-04-11 10:11 - 2017-03-25 10:57 - 00615936 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll

2017-04-11 10:11 - 2017-03-25 10:56 - 00817664 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll

2017-04-11 10:11 - 2017-03-25 10:56 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll

2017-04-11 10:11 - 2017-03-25 10:56 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe

2017-04-11 10:11 - 2017-03-25 10:56 - 00114688 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe

2017-04-11 10:11 - 2017-03-25 10:52 - 25746944 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2017-04-11 10:11 - 2017-03-25 10:45 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe

2017-04-11 10:11 - 2017-03-25 10:41 - 06045696 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2017-04-11 10:11 - 2017-03-25 10:41 - 00489984 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll

2017-04-11 10:11 - 2017-03-25 10:30 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll

2017-04-11 10:11 - 2017-03-25 10:29 - 00107520 _____ (Microsoft Corporation) C:\windows\system32\inseng.dll

2017-04-11 10:11 - 2017-03-25 10:24 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll

2017-04-11 10:11 - 2017-03-25 10:23 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll

2017-04-11 10:11 - 2017-03-25 10:20 - 00315392 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll

2017-04-11 10:11 - 2017-03-25 10:19 - 00341504 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec

2017-04-11 10:11 - 2017-03-25 10:17 - 00152064 _____ (Microsoft Corporation) C:\windows\system32\occache.dll

2017-04-11 10:11 - 2017-03-25 10:06 - 00476160 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll

2017-04-11 10:11 - 2017-03-25 10:04 - 00262144 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll

2017-04-11 10:11 - 2017-03-25 10:00 - 00725504 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2017-04-11 10:11 - 2017-03-25 09:59 - 00806912 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2017-04-11 10:11 - 2017-03-25 09:57 - 02131456 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl

2017-04-11 10:11 - 2017-03-25 09:57 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll

2017-04-11 10:11 - 2017-03-25 09:28 - 15259136 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2017-04-11 10:11 - 2017-03-25 09:27 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll

2017-04-11 10:11 - 2017-03-25 09:24 - 03241472 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2017-04-11 10:11 - 2017-03-25 09:10 - 01546240 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2017-04-11 10:11 - 2017-03-25 09:01 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll

2017-04-11 10:11 - 2017-03-24 15:50 - 00405504 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll

2017-04-11 10:11 - 2017-03-24 15:42 - 00313344 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll

2017-04-11 10:11 - 2017-03-22 08:32 - 03165184 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll

2017-04-11 10:11 - 2017-03-22 08:32 - 00192512 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll

2017-04-11 10:11 - 2017-03-22 08:32 - 00098816 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll

2017-04-11 10:11 - 2017-03-22 08:30 - 00091136 _____ (Microsoft Corporation) C:\windows\system32\WinSetupUI.dll

2017-04-11 10:11 - 2017-03-22 08:24 - 00174080 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll

2017-04-11 10:11 - 2017-03-22 08:17 - 02651136 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll

2017-04-11 10:11 - 2017-03-22 08:15 - 00709120 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll

2017-04-11 10:11 - 2017-03-22 08:15 - 00140288 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe

2017-04-11 10:11 - 2017-03-22 08:15 - 00037888 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll

2017-04-11 10:11 - 2017-03-22 08:15 - 00037888 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe

2017-04-11 10:11 - 2017-03-22 08:15 - 00036864 _____ (Microsoft Corporation) C:\windows\system32\wups.dll

2017-04-11 10:11 - 2017-03-22 08:15 - 00012288 _____ (Microsoft Corporation) C:\windows\system32\wu.upgrade.ps.dll

2017-04-11 10:11 - 2017-03-22 08:05 - 00573440 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll

2017-04-11 10:11 - 2017-03-22 08:05 - 00093696 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll

2017-04-11 10:11 - 2017-03-22 08:05 - 00035328 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe

2017-04-11 10:11 - 2017-03-22 08:05 - 00030208 _____ (Microsoft Corporation) C:\windows\SysWOW64\wups.dll

2017-04-11 10:11 - 2017-03-14 08:34 - 00986344 _____ (Microsoft Corporation) C:\windows\system32\Drivers\dxgkrnl.sys

2017-04-11 10:11 - 2017-03-14 08:34 - 00265448 _____ (Microsoft Corporation) C:\windows\system32\Drivers\dxgmms1.sys

2017-04-11 10:11 - 2017-03-14 08:30 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\cdd.dll

2017-04-11 10:11 - 2017-03-10 09:35 - 00382696 _____ (Adobe Systems Incorporated) C:\windows\system32\atmfd.dll

2017-04-11 10:11 - 2017-03-10 09:31 - 00100864 _____ (Microsoft Corporation) C:\windows\system32\fontsub.dll

2017-04-11 10:11 - 2017-03-10 09:31 - 00046080 _____ (Adobe Systems) C:\windows\system32\atmlib.dll

2017-04-11 10:11 - 2017-03-10 09:31 - 00041472 _____ (Microsoft Corporation) C:\windows\system32\lpk.dll

2017-04-11 10:11 - 2017-03-10 09:31 - 00014336 _____ (Microsoft Corporation) C:\windows\system32\dciman32.dll

2017-04-11 10:11 - 2017-03-10 09:27 - 00308456 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\atmfd.dll

2017-04-11 10:11 - 2017-03-10 09:20 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\lpk.dll

2017-04-11 10:11 - 2017-03-10 09:19 - 00070656 _____ (Microsoft Corporation) C:\windows\SysWOW64\fontsub.dll

2017-04-11 10:11 - 2017-03-10 09:19 - 00010240 _____ (Microsoft Corporation) C:\windows\SysWOW64\dciman32.dll

2017-04-11 10:11 - 2017-03-10 09:00 - 03219968 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys

2017-04-11 10:11 - 2017-03-10 08:53 - 00034304 _____ (Adobe Systems) C:\windows\SysWOW64\atmlib.dll

2017-04-11 10:11 - 2017-03-08 13:20 - 01133568 _____ (Microsoft Corporation) C:\windows\system32\cdosys.dll

2017-04-11 10:11 - 2017-03-08 13:10 - 00805376 _____ (Microsoft Corporation) C:\windows\SysWOW64\cdosys.dll

2017-04-11 10:11 - 2017-03-07 21:37 - 00631176 _____ (Microsoft Corporation) C:\windows\system32\winresume.efi

2017-04-11 10:11 - 2017-03-07 21:36 - 05548264 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe

2017-04-11 10:11 - 2017-03-07 21:36 - 00706792 _____ (Microsoft Corporation) C:\windows\system32\winload.efi

2017-04-11 10:11 - 2017-03-07 21:36 - 00154856 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys

2017-04-11 10:11 - 2017-03-07 21:36 - 00095464 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys

2017-04-11 10:11 - 2017-03-07 21:34 - 01732864 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 02064384 _____ (Microsoft Corporation) C:\windows\system32\ole32.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 01460736 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 01212928 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 01163264 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00880640 _____ (Microsoft Corporation) C:\windows\system32\advapi32.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00730624 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00690688 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00463872 _____ (Microsoft Corporation) C:\windows\system32\certcli.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00419840 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00362496 _____ (Microsoft Corporation) C:\windows\system32\wow64win.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00345600 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00312320 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00215552 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00210432 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00190464 _____ (Microsoft Corporation) C:\windows\system32\rpchttp.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00123904 _____ (Microsoft Corporation) C:\windows\system32\bcrypt.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00063488 _____ (Microsoft Corporation) C:\windows\system32\setbcdlocale.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00059904 _____ (Microsoft Corporation) C:\windows\system32\appidapi.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00044032 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\cryptbase.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00034816 _____ (Microsoft Corporation) C:\windows\system32\appidsvc.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00028672 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00016384 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:33 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:26 - 04000488 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe

2017-04-11 10:11 - 2017-03-07 21:26 - 03945192 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe

2017-04-11 10:11 - 2017-03-07 21:24 - 01314112 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll

2017-04-11 10:11 - 2017-03-07 21:22 - 01416192 _____ (Microsoft Corporation) C:\windows\SysWOW64\ole32.dll

2017-04-11 10:11 - 2017-03-07 21:22 - 01114112 _____ (Microsoft Corporation) C:\windows\SysWOW64\kernel32.dll

2017-04-11 10:11 - 2017-03-07 21:22 - 00666112 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll

2017-04-11 10:11 - 2017-03-07 21:22 - 00553472 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll

2017-04-11 10:11 - 2017-03-07 21:22 - 00275456 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll

2017-04-11 10:11 - 2017-03-07 21:22 - 00261120 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll

2017-04-11 10:11 - 2017-03-07 21:22 - 00254464 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll

2017-04-11 10:11 - 2017-03-07 21:22 - 00223232 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll

2017-04-11 10:11 - 2017-03-07 21:22 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll

2017-04-11 10:11 - 2017-03-07 21:22 - 00146432 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll

2017-04-11 10:11 - 2017-03-07 21:22 - 00141312 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpchttp.dll

2017-04-11 10:11 - 2017-03-07 21:22 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll

2017-04-11 10:11 - 2017-03-07 21:22 - 00082944 _____ (Microsoft Corporation) C:\windows\SysWOW64\bcrypt.dll

2017-04-11 10:11 - 2017-03-07 21:22 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll

2017-04-11 10:11 - 2017-03-07 21:22 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\msobjs.dll

2017-04-11 10:11 - 2017-03-07 21:22 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll

2017-04-11 10:11 - 2017-03-07 21:22 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll

2017-04-11 10:11 - 2017-03-07 21:22 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll

2017-04-11 10:11 - 2017-03-07 21:22 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll

2017-04-11 10:11 - 2017-03-07 21:21 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll

2017-04-11 10:11 - 2017-03-07 21:21 - 00644096 _____ (Microsoft Corporation) C:\windows\SysWOW64\advapi32.dll

2017-04-11 10:11 - 2017-03-07 21:21 - 00342528 _____ (Microsoft Corporation) C:\windows\SysWOW64\certcli.dll

2017-04-11 10:11 - 2017-03-07 21:21 - 00050688 _____ (Microsoft Corporation) C:\windows\SysWOW64\appidapi.dll

2017-04-11 10:11 - 2017-03-07 21:21 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll

2017-04-11 10:11 - 2017-03-07 21:21 - 00005120 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:21 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:21 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:21 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:21 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:21 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:21 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:21 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:21 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:21 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:21 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:21 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:21 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:21 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:21 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:21 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:21 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:21 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:21 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:21 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:21 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:21 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:21 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:21 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 21:03 - 00148480 _____ (Microsoft Corporation) C:\windows\system32\appidpolicyconverter.exe

2017-04-11 10:11 - 2017-03-07 21:03 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe

2017-04-11 10:11 - 2017-03-07 21:03 - 00062464 _____ (Microsoft Corporation) C:\windows\system32\Drivers\appid.sys

2017-04-11 10:11 - 2017-03-07 21:03 - 00017920 _____ (Microsoft Corporation) C:\windows\system32\appidcertstorecheck.exe

2017-04-11 10:11 - 2017-03-07 21:00 - 00338432 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe

2017-04-11 10:11 - 2017-03-07 20:59 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe

2017-04-11 10:11 - 2017-03-07 20:57 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\auditpol.exe

2017-04-11 10:11 - 2017-03-07 20:56 - 00291328 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb10.sys

2017-04-11 10:11 - 2017-03-07 20:56 - 00159744 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb.sys

2017-04-11 10:11 - 2017-03-07 20:56 - 00129536 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb20.sys

2017-04-11 10:11 - 2017-03-07 20:55 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe

2017-04-11 10:11 - 2017-03-07 20:55 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe

2017-04-11 10:11 - 2017-03-07 20:54 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe

2017-04-11 10:11 - 2017-03-07 20:54 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll

2017-04-11 10:11 - 2017-03-07 20:54 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe

2017-04-11 10:11 - 2017-03-07 20:54 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe

2017-04-11 10:11 - 2017-03-07 20:53 - 00036352 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptbase.dll

2017-04-11 10:11 - 2017-03-07 20:53 - 00006144 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 20:53 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 20:53 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 20:53 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll

2017-04-11 10:11 - 2017-03-07 09:30 - 00085504 _____ (Microsoft Corporation) C:\windows\system32\asycfilt.dll

2017-04-11 10:11 - 2017-03-07 09:17 - 00067584 _____ (Microsoft Corporation) C:\windows\SysWOW64\asycfilt.dll

2017-04-11 10:11 - 2017-03-03 18:27 - 01574912 _____ (Microsoft Corporation) C:\windows\system32\quartz.dll

2017-04-11 10:11 - 2017-03-03 18:27 - 00093696 _____ (Microsoft Corporation) C:\windows\system32\mfmjpegdec.dll

2017-04-11 10:11 - 2017-03-03 18:14 - 01329664 _____ (Microsoft Corporation) C:\windows\SysWOW64\quartz.dll

2017-04-11 10:11 - 2017-03-03 18:14 - 00077312 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfmjpegdec.dll

2017-04-11 10:11 - 2017-02-14 09:33 - 00757248 _____ (Microsoft Corporation) C:\windows\system32\win32spl.dll

2017-04-11 10:11 - 2017-02-14 09:19 - 00497664 _____ (Microsoft Corporation) C:\windows\SysWOW64\win32spl.dll

2017-04-11 10:11 - 2017-02-11 09:33 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll

2017-04-11 10:11 - 2017-02-11 09:16 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll

2017-04-11 10:11 - 2017-02-09 09:32 - 00769536 _____ (Microsoft Corporation) C:\windows\system32\samsrv.dll

2017-04-11 10:11 - 2017-02-09 09:32 - 00106496 _____ (Microsoft Corporation) C:\windows\system32\samlib.dll

2017-04-11 10:11 - 2017-02-09 09:14 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\samlib.dll

2017-04-11 10:11 - 2017-01-18 08:36 - 00994760 _____ (Microsoft Corporation) C:\windows\system32\ucrtbase.dll

2017-04-11 10:11 - 2017-01-18 08:36 - 00063840 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-private-l1-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:36 - 00020832 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-math-l1-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:36 - 00019808 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:36 - 00017760 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-string-l1-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:36 - 00017760 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-stdio-l1-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:36 - 00016224 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-runtime-l1-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:36 - 00015712 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-convert-l1-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:36 - 00014176 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-time-l1-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:36 - 00014176 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-2-0.dll

2017-04-11 10:11 - 2017-01-18 08:36 - 00013664 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:36 - 00012640 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-process-l1-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:36 - 00012640 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-heap-l1-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:36 - 00012640 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-conio-l1-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:36 - 00012128 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-utility-l1-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:36 - 00012128 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-locale-l1-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:36 - 00012128 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-crt-environment-l1-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:36 - 00012128 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-2-0.dll

2017-04-11 10:11 - 2017-01-18 08:36 - 00012128 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-1.dll

2017-04-11 10:11 - 2017-01-18 08:36 - 00011616 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l2-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:36 - 00011616 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-core-timezone-l1-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:36 - 00011616 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l2-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:36 - 00011608 _____ (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-2-0.dll

2017-04-11 10:11 - 2017-01-18 08:35 - 00922432 _____ (Microsoft Corporation) C:\windows\SysWOW64\ucrtbase.dll

2017-04-11 10:11 - 2017-01-18 08:35 - 00066400 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-private-l1-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:35 - 00022368 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-math-l1-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:35 - 00019808 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:35 - 00017760 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-string-l1-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:35 - 00017760 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:35 - 00016224 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:35 - 00015712 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:35 - 00014176 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-time-l1-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:35 - 00014176 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll

2017-04-11 10:11 - 2017-01-18 08:35 - 00013664 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:35 - 00012640 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:35 - 00012640 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:35 - 00012640 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:35 - 00012128 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:35 - 00012128 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:35 - 00012128 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:35 - 00012128 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll

2017-04-11 10:11 - 2017-01-18 08:35 - 00012128 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll

2017-04-11 10:11 - 2017-01-18 08:35 - 00011616 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-xstate-l2-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:35 - 00011616 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:35 - 00011616 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll

2017-04-11 10:11 - 2017-01-18 08:35 - 00011616 _____ (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll

2017-04-04 14:58 - 2017-04-04 14:58 - 00002083 _____ C:\Users\Maria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Blue Jeans.lnk

2017-04-04 14:57 - 2017-04-04 14:57 - 00240336 _____ C:\Users\Maria\Downloads\Blue Jeans Launcher (1).exe

2017-04-04 14:38 - 2017-04-04 14:58 - 00000000 ____D C:\Users\Maria\AppData\Local\Blue Jeans

2017-04-04 14:37 - 2017-04-04 14:37 - 00240336 _____ C:\Users\Maria\Downloads\Blue Jeans Launcher.exe

2017-04-03 12:35 - 2017-04-03 12:35 - 00000000 ____D C:\Users\Maria\AppData\Roaming\Atheros

2017-03-31 14:58 - 2017-03-31 14:58 - 00025518 _____ C:\Users\Maria\Documents\cc_20170331_145840.reg

2017-03-31 14:57 - 2017-03-31 14:57 - 00000000 ____D C:\Users\Maria\AppData\Local\Box Sync

2017-03-31 14:46 - 2017-03-31 14:46 - 00001041 _____ C:\Users\UpdatusUser\Desktop\WinDirStat.lnk

2017-03-31 14:46 - 2017-03-31 14:46 - 00001041 _____ C:\Users\Maria\Desktop\WinDirStat.lnk

2017-03-31 14:46 - 2017-03-31 14:46 - 00000000 ____D C:\Users\Maria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinDirStat

2017-03-31 14:46 - 2017-03-31 14:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinDirStat

2017-03-31 14:46 - 2017-03-31 14:46 - 00000000 ____D C:\Program Files (x86)\WinDirStat

2017-03-31 12:44 - 2017-03-31 12:44 - 00075048 _____ C:\Users\Maria\Documents\cc_20170331_124433.reg

2017-03-31 12:24 - 2017-03-31 12:24 - 00127679 _____ C:\Users\Maria\Desktop\NDA2017.pdf

2017-03-30 07:42 - 2017-04-11 10:14 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk

2017-03-30 07:42 - 2017-03-30 07:42 - 00002057 _____ C:\Users\Public\Desktop\Acrobat Reader DC.lnk

 

==================== One Month Modified files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2017-04-24 11:38 - 2014-06-12 02:48 - 00000538 _____ C:\windows\Tasks\G2MUpdateTask-S-1-5-21-3449447305-1594401728-24528855-1000.job

2017-04-24 11:33 - 2009-07-13 21:45 - 00034528 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2017-04-24 11:33 - 2009-07-13 21:45 - 00034528 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2017-04-24 11:32 - 2009-07-13 22:13 - 00886892 _____ C:\windows\system32\PerfStringBackup.INI

2017-04-24 11:32 - 2009-07-13 20:20 - 00000000 ____D C:\windows\inf

2017-04-24 11:25 - 2014-06-23 20:35 - 00000000 ____D C:\Users\Maria\AppData\Local\Adobe

2017-04-24 11:25 - 2014-06-06 12:09 - 00000000 ____D C:\Users\Maria\AppData\Roaming\Spotify

2017-04-24 11:25 - 2014-06-06 12:09 - 00000000 ____D C:\Users\Maria\AppData\Local\Spotify

2017-04-24 11:25 - 2014-06-06 09:42 - 00000000 ____D C:\Users\Maria

2017-04-24 11:25 - 2009-07-13 22:08 - 00000006 ____H C:\windows\Tasks\SA.DAT

2017-04-24 11:24 - 2017-03-22 14:37 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2017-04-24 11:24 - 2014-08-06 20:33 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2017-04-24 11:21 - 2016-12-04 16:12 - 00000000 ____D C:\Users\Maria\AppData\LocalLow\Mozilla

2017-04-24 11:21 - 2014-07-11 08:13 - 00000000 ____D C:\Users\Maria\AppData\Local\CrashDumps

2017-04-24 11:02 - 2015-06-22 08:59 - 00000634 _____ C:\windows\Tasks\G2MUploadTask-S-1-5-21-3449447305-1594401728-24528855-1000.job

2017-04-21 22:38 - 2015-06-22 08:59 - 00003664 _____ C:\windows\System32\Tasks\G2MUploadTask-S-1-5-21-3449447305-1594401728-24528855-1000

2017-04-21 22:38 - 2014-06-12 02:48 - 00003568 _____ C:\windows\System32\Tasks\G2MUpdateTask-S-1-5-21-3449447305-1594401728-24528855-1000

2017-04-17 15:30 - 2014-06-06 10:24 - 00000000 ____D C:\Users\Maria\AppData\Roaming\Adobe

2017-04-17 15:03 - 2014-06-15 23:55 - 00000000 ____D C:\Program Files\Common Files\Adobe

2017-04-17 15:01 - 2014-10-20 19:06 - 00000000 ____D C:\Program Files\Adobe

2017-04-17 15:00 - 2014-06-15 23:56 - 00000000 ____D C:\ProgramData\Adobe

2017-04-17 14:58 - 2014-06-06 09:57 - 00000000 ____D C:\ProgramData\Package Cache

2017-04-17 14:56 - 2014-06-15 23:56 - 00000000 ____D C:\Program Files (x86)\Adobe

2017-04-17 12:02 - 2014-06-13 05:02 - 00000000 ____D C:\Users\Maria\AppData\Local\ElevatedDiagnostics

2017-04-16 21:36 - 2016-12-18 11:51 - 00001153 _____ C:\Users\Public\Desktop\Avira System Speedup.lnk

2017-04-16 21:36 - 2016-01-22 17:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

2017-04-16 21:36 - 2016-01-22 17:40 - 00000000 ____D C:\Program Files (x86)\Avira

2017-04-14 19:20 - 2016-04-29 13:04 - 00000000 ____D C:\windows\rescache

2017-04-12 22:34 - 2015-09-22 22:03 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2017-04-12 22:34 - 2015-09-22 22:03 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2017-04-12 22:34 - 2009-07-13 21:45 - 03138456 _____ C:\windows\system32\FNTCACHE.DAT

2017-04-12 16:33 - 2014-07-10 15:12 - 00023531 _____ C:\Users\Maria\Documents\.Rhistory

2017-04-12 16:33 - 2014-06-12 05:32 - 00000000 ____D C:\Users\Maria\AppData\Local\RStudio-Desktop

2017-04-12 10:01 - 2015-09-22 22:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight

2017-04-12 10:00 - 2014-07-30 19:14 - 00000000 ____D C:\windows\system32\MRT

2017-04-12 09:58 - 2014-07-30 19:14 - 148601744 ____C (Microsoft Corporation) C:\windows\system32\MRT.exe

2017-04-12 09:56 - 2014-06-06 10:38 - 00890644 _____ C:\windows\SysWOW64\PerfStringBackup.INI

2017-04-11 10:14 - 2014-12-27 04:48 - 00004476 _____ C:\windows\System32\Tasks\Adobe Acrobat Update Task

2017-04-11 10:12 - 2015-05-26 10:01 - 00003716 _____ C:\windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3449447305-1594401728-24528855-1000UA

2017-04-11 10:12 - 2015-05-26 10:01 - 00003444 _____ C:\windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3449447305-1594401728-24528855-1000Core

2017-04-11 10:11 - 2014-08-17 19:18 - 00802904 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2017-04-11 10:11 - 2014-08-17 19:18 - 00144472 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

2017-04-11 10:11 - 2014-08-17 19:18 - 00004312 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater

2017-04-11 10:11 - 2014-08-17 19:18 - 00000000 ____D C:\windows\system32\Macromed

2017-04-11 10:11 - 2014-06-15 23:54 - 00000000 ____D C:\windows\SysWOW64\Macromed

2017-04-07 09:54 - 2016-10-10 14:28 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft

2017-04-07 09:53 - 2014-06-06 12:18 - 00000000 ____D C:\Program Files (x86)\Microsoft Office

2017-04-06 13:58 - 2014-06-06 10:01 - 00003330 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA

2017-04-06 13:58 - 2014-06-06 10:01 - 00003202 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore

2017-03-31 14:52 - 2015-09-30 16:25 - 00000000 ____D C:\Users\Maria\AppData\Local\heroku

2017-03-31 12:43 - 2015-02-12 00:10 - 00000000 ____D C:\windows\Minidump

2017-03-31 12:40 - 2014-06-06 10:00 - 00000000 ____D C:\Users\Maria\AppData\Local\Deployment

2017-03-31 12:39 - 2014-10-07 13:02 - 00000000 ____D C:\Users\Maria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GitHub, Inc

2017-03-31 12:39 - 2014-06-06 12:08 - 00000000 ____D C:\Python27

2017-03-31 12:38 - 2016-12-20 04:41 - 00000000 ____D C:\Program Files\OnlineFotoservice

2017-03-31 12:38 - 2015-02-02 19:13 - 00000000 ____D C:\ProgramData\regid.1995-09.com.example

2017-03-31 12:35 - 2015-01-12 12:27 - 00000000 ____D C:\Users\Maria\Desktop\school

2017-03-31 08:59 - 2014-06-06 10:01 - 00002207 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

 

==================== Files in the root of some directories =======

 

2017-04-17 15:03 - 2017-04-17 15:03 - 0000033 _____ () C:\Users\Maria\AppData\Roaming\AdobeWLCMCache.dat

2014-10-05 14:39 - 2014-10-05 14:47 - 0000103 _____ () C:\Users\Maria\AppData\Roaming\Camdata.ini

2014-10-05 14:39 - 2014-10-05 14:47 - 0000408 _____ () C:\Users\Maria\AppData\Roaming\CamLayout.ini

2014-10-05 14:39 - 2014-10-05 14:47 - 0000408 _____ () C:\Users\Maria\AppData\Roaming\CamShapes.ini

2014-10-05 14:02 - 2014-10-05 14:48 - 0004535 _____ () C:\Users\Maria\AppData\Roaming\CamStudio.cfg

2014-06-06 10:05 - 2014-06-06 10:21 - 0000030 _____ () C:\Users\Maria\AppData\Roaming\fixcfg.ini

2014-07-18 09:29 - 2014-07-18 09:29 - 0000096 _____ () C:\Users\Maria\AppData\Roaming\settings.xml

2014-10-05 13:54 - 2014-10-05 14:42 - 0000096 _____ () C:\Users\Maria\AppData\Roaming\version2.xml

2014-08-29 14:27 - 2015-01-04 21:53 - 0000162 _____ () C:\Users\Maria\AppData\Roaming\WB.CFG

2014-12-01 17:27 - 2014-12-21 05:27 - 0000010 _____ () C:\Users\Maria\AppData\Local\DSI.DAT

2014-09-29 10:35 - 2014-09-29 11:46 - 0000600 _____ () C:\Users\Maria\AppData\Local\PUTTY.RND

2015-12-24 22:13 - 2015-12-24 22:13 - 0000000 _____ () C:\Users\Maria\AppData\Local\{BAD9CC8A-C857-49F1-93F4-08F420549761}

2016-07-30 09:27 - 2016-07-30 09:27 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

 

==================== Bamital & volsnap ======================

 

(There is no automatic fix for files that do not pass verification.)

 

C:\windows\system32\winlogon.exe => File is digitally signed

C:\windows\system32\wininit.exe => File is digitally signed

C:\windows\SysWOW64\wininit.exe => File is digitally signed

C:\windows\explorer.exe => File is digitally signed

C:\windows\SysWOW64\explorer.exe => File is digitally signed

C:\windows\system32\svchost.exe => File is digitally signed

C:\windows\SysWOW64\svchost.exe => File is digitally signed

C:\windows\system32\services.exe => File is digitally signed

C:\windows\system32\User32.dll => File is digitally signed

C:\windows\SysWOW64\User32.dll => File is digitally signed

C:\windows\system32\userinit.exe => File is digitally signed

C:\windows\SysWOW64\userinit.exe => File is digitally signed

C:\windows\system32\rpcss.dll => File is digitally signed

C:\windows\system32\dnsapi.dll => File is digitally signed

C:\windows\SysWOW64\dnsapi.dll => File is digitally signed

C:\windows\system32\Drivers\volsnap.sys => File is digitally signed

 

LastRegBack: 2017-04-14 19:13

 

==================== End of FRST.txt ============================

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23-04-2017 01

Ran by Maria (24-04-2017 11:58:22)

Running from C:\Users\Maria\Downloads

Windows 7 Professional Service Pack 1 (X64) (2014-06-06 16:42:48)

Boot Mode: Normal

==========================================================

 

 

==================== Accounts: =============================

 

Administrator (S-1-5-21-3449447305-1594401728-24528855-500 - Administrator - Disabled)

Guest (S-1-5-21-3449447305-1594401728-24528855-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-3449447305-1594401728-24528855-1005 - Limited - Enabled)

Maria (S-1-5-21-3449447305-1594401728-24528855-1000 - Administrator - Enabled) => C:\Users\Maria

UpdatusUser (S-1-5-21-3449447305-1594401728-24528855-1001 - Limited - Enabled) => C:\Users\UpdatusUser

 

==================== Security Center ========================

 

(If an entry is included in the fixlist, it will be removed.)

 

AV: Avira Antivirus (Enabled - Up to date) {B3F630BD-538D-1B4A-14FA-14B63235278F}

AS: Avira Antivirus (Enabled - Up to date) {0897D159-75B7-14C4-2E4A-2FC449B26D32}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 

==================== Installed Programs ======================

 

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 

7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)

Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 17.009.20044 - Adobe Systems Incorporated)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.1.0.5790 - Adobe Systems Inc.)

Adobe Anchor Service x64 CS4 (Version: 2.0 - Adobe Systems Incorporated) Hidden

Adobe CMaps x64 CS4 (Version: 2.0 - Adobe Systems Incorporated) Hidden

Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 4.0.1.188 - Adobe Systems Incorporated)

Adobe Creative Suite 4 Master Collection (HKLM-x32\...\Adobe_697a06b96d8bcbe2d77b88e7d5448d0) (Version: 4.0 - Adobe Systems Incorporated)

Adobe CSI CS4 x64 (Version: 1 - Adobe Systems Incorporated) Hidden

Adobe Drive CS4 x64 (Version: 1 - Adobe Systems Incorporated) Hidden

Adobe Flash Player 25 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 25.0.0.148 - Adobe Systems Incorporated)

Adobe Fonts All x64 (Version: 2.0 - Adobe Systems Incorporated) Hidden

Adobe Illustrator CC 2017 (HKLM-x32\...\ILST_21_1_0) (Version: 21.1.0 - Adobe Systems Incorporated)

Adobe InDesign CS4 Icon Handler x64 (Version: 6.0 - Adobe Systems Incorporated) Hidden

Adobe Linguistics CS4 x64 (Version: 4.0.0 - Adobe Systems Incorporated) Hidden

Adobe Media Player (HKLM-x32\...\com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.1 - Adobe Systems Incorporated)

Adobe PDF Library Files x64 CS4 (Version: 9.0 - Adobe Systems Incorporated) Hidden

Adobe Photoshop CS4 (64 Bit) (Version: 11.0 - Adobe Systems Incorporated) Hidden

Adobe Type Support x64 CS4 (Version: 9.0 - Adobe Systems Incorporated) Hidden

Adobe WinSoft Linguistics Plugin x64 (Version: 1.1 - Adobe Systems Incorporated) Hidden

Akamai NetSession Interface (HKU\S-1-5-21-3449447305-1594401728-24528855-1000\...\Akamai) (Version:  - Akamai Technologies, Inc)

Akamai NetSession Interface (HKU\S-1-5-21-3449447305-1594401728-24528855-1001\...\Akamai) (Version:  - Akamai Technologies, Inc)

Amazon Redshift ODBC Driver 64-bit (HKLM\...\{788C401A-726B-4CE7-8BC2-89FD7967A6ED}) (Version: 1.2.1 - Amazon)

ASUS FingerPrint (HKLM-x32\...\{420350FC-88BE-49B1-9AF1-6DC11A4F0EEF}) (Version: 1.1.13 - ASUS)

ASUS Smart Gesture (HKLM-x32\...\{4D3286A6-F6AB-498A-82A4-E4F040529F3D}) (Version: 2.1.3 - ASUS)

Atheros Bluetooth Suite (64) (HKLM\...\{230D1595-57DA-4933-8C4E-375797EBB7E1}) (Version: 7.4.0.140 - Atheros)

ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0028 - ASUS)

Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.25.172 - Avira Operations GmbH & Co. KG)

Avira Browser Safety (HKLM-x32\...\{9E10EA90-5E97-43B7-A246-FC7B4F5E9493}) (Version: 1.4.5.509 - Avira Operations GmbH & Co KG)

Avira Connect (HKLM-x32\...\{0b46d918-af4f-4612-8076-5c0ae67cb2aa}) (Version: 1.2.81.41506 - Avira Operations GmbH & Co. KG)

Avira Connect (x32 Version: 1.2.81.41506 - Avira Operations GmbH & Co. KG) Hidden

Avira System Speedup (HKLM-x32\...\Avira System Speedup_is1) (Version: 3.5.0.5091 - Avira Operations GmbH & Co. KG)

Blue Jeans (HKLM-x32\...\{64179DA2-9193-4D42-A92D-2301E7DF34B3}) (Version: 1.26.76 - Blue Jeans)

Box Sync (x32 Version: 4.0.7100.0 - Box Inc.) Hidden

Calisto DFU Driver (x64) (HKLM\...\{1C20E609-768A-4FDC-AC75-2CE466D81506}) (Version: 2.4.49092.0 - Plantronics, Inc.)

CCleaner (HKLM\...\CCleaner) (Version: 4.15 - Piriform)

Citavi 4 (HKLM-x32\...\{CC0A85B2-734A-45B3-B678-05F6A6499AC7}) (Version: 4.3.0.15 - Swiss Academic Software)

Citrix Online Launcher (HKLM-x32\...\{E5F6D26D-E180-4547-A865-565EAB61000C}) (Version: 1.0.362 - Citrix)

Connect (x32 Version: 1.0.0.1 - Adobe Systems Incorporated) Hidden

DB Browser for SQLite (HKLM-x32\...\SqliteBrowser3) (Version: 3.5.1 - oldsch00l)

EngagementPrototype1 (HKU\S-1-5-21-3449447305-1594401728-24528855-1001\...\b6b49031e3c634b0) (Version: 1.0.0.3 - EngagementPrototype1)

f4 2012 (HKLM-x32\...\f42012) (Version:  - audiotranskription.de)

GitHub (HKU\S-1-5-21-3449447305-1594401728-24528855-1001\...\5f7eb300e2ea4ebf) (Version: 2.4.1.2 - GitHub, Inc.)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 57.0.2987.133 - Google Inc.)

Google Talk Plugin (HKLM-x32\...\{F9B579C2-D854-300A-BE62-A09EB9D722E4}) (Version: 5.41.3.0 - Google)

Google Update Helper (x32 Version: 1.3.33.3 - Google Inc.) Hidden

GoToMeeting 7.20.0.5174 (HKU\S-1-5-21-3449447305-1594401728-24528855-1001\...\GoToMeeting) (Version: 7.20.0.5174 - CitrixOnline)

GoToMeeting 8.4.0.6871 (HKU\S-1-5-21-3449447305-1594401728-24528855-1000\...\GoToMeeting) (Version: 8.4.0.6871 - CitrixOnline)

Intel® Chipset Device Software (x32 Version: 10.0.17 - Intel® Corporation) Hidden

Intel® Dynamic Platform and Thermal Framework (HKLM-x32\...\FFD10ECE-F715-4a86-9BD8-F6F47DA5DA1C) (Version: 7.1.0.2105 - Intel Corporation)

Intel® Network Connections Drivers (HKLM\...\PROSet) (Version: 16.8 - Intel)

Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2884 - Intel Corporation)

Intel® PROSet/Wireless Software for Bluetooth® Technology (HKLM\...\{A10B1524-63B5-40F2-B272-D841CF671C16}) (Version: 2.2.0.0266 - Intel Corporation)

Intel® SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)

Intel® USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.5.235 - Intel Corporation)

Intel® PROSet/Wireless Software (HKLM-x32\...\{ae509f68-6982-4506-befc-f2218d72cd5e}) (Version: 15.8.0 - Intel Corporation)

Java 8 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418045F0}) (Version: 8.0.450 - Oracle Corporation)

Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)

Kinect for Windows Drivers v1.6 (HKLM\...\{EA6CF33B-F335-4C3D-A9AE-453BA0DA5269}) (Version: 1.6.0.505 - Microsoft Corporation)

Kinect for Windows Runtime v1.6 (HKLM\...\{940466C3-6E5F-4871-BB0E-5024078F2EAF}) (Version: 1.6.0.505 - Microsoft Corporation)

Kinect for Windows SDK v1.6 (HKLM\...\{9000A397-D13F-45D7-9EED-894B27E4B321}) (Version: 1.6.0.505 - Microsoft Corporation)

Kinect for Windows Speech Recognition Language Pack (en-US) (HKLM-x32\...\{8AAA44BB-487E-4D01-AF76-484ACB90DBFE}) (Version: 11.0.7400.336 - Microsoft Corporation)

kuler (x32 Version: 2.0 - Adobe Systems Incorporated) Hidden

LIWC2015 version 1.3.1 (HKLM-x32\...\LIWC2015_is1) (Version: 1.3.1 - Pennebaker Conglomerates, Inc.)

Meditation Journal (HKU\S-1-5-21-3449447305-1594401728-24528855-1001\...\4181992304.download.neurosky.com) (Version:  - download.neurosky.com)

Microsoft .NET Framework 4.6.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.6.01055 - Microsoft Corporation)

Microsoft ASP.NET MVC 2 (HKLM-x32\...\{DD8FF2F3-0D97-4CF3-AF78-FA0E1B242244}) (Version: 2.0.60926.0 - Microsoft Corporation)

Microsoft Office 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 16.0.7870.2031 - Microsoft Corporation)

Microsoft Office 365 ProPlus - en-us (HKLM\...\O365ProPlusRetail - en-us) (Version: 16.0.7870.2031 - Microsoft Corporation)

Microsoft Office Korrekturhilfen 2013 - Deutsch (HKLM-x32\...\{90150000-001F-0407-0000-0000000FF1CE}) (Version: 15.0.4569.1506 - Microsoft Corporation)

Microsoft OneDrive (HKU\S-1-5-21-3449447305-1594401728-24528855-1000\...\OneDriveSetup.exe) (Version: 17.3.6390.0509 - Microsoft Corporation)

Microsoft OneDrive (HKU\S-1-5-21-3449447305-1594401728-24528855-1001\...\OneDriveSetup.exe) (Version: 17.3.5951.0827 - Microsoft Corporation)

Microsoft Server Speech Platform Runtime (x64) (HKLM\...\{3B433087-E62E-4BF5-97F9-4AF6E1C2409C}) (Version: 11.0.7400.345 - Microsoft Corporation)

Microsoft Server Speech Platform Runtime (x86) (HKLM-x32\...\{22CB8ED7-DF57-4864-BD04-F63B9CE4B494}) (Version: 11.0.7400.345 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50906.0 - Microsoft Corporation)

Microsoft SQL Server 2008 R2 Native Client (HKLM\...\{2180B33F-3225-423E-BBC1-7798CFD3CD1F}) (Version: 10.50.1600.1 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)

Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23918 (HKLM-x32\...\{dab68466-3a7d-41a8-a5cf-415e3ff8ef71}) (Version: 14.0.23918.0 - Microsoft Corporation)

Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23918 (HKLM-x32\...\{2e085fd2-a3e4-4b39-8e10-6b8d35f55244}) (Version: 14.0.23918.0 - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)

Mozilla Firefox 44.0.2 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 44.0.2 (x86 en-US)) (Version: 44.0.2 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 52.0.2.6291 - Mozilla)

MySQL Connector/ODBC 5.3 (HKLM\...\{A1991404-2634-47E1-BC45-8F3B5014B1D1}) (Version: 5.3.4 - Oracle Corporation)

NeuroSkyDataViewerCollector (HKU\S-1-5-21-3449447305-1594401728-24528855-1001\...\8b66112bd89b750e) (Version: 1.0.0.10 - NeuroSkyDataViewerCollector)

NVIDIA Graphics Driver 307.07 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 307.07 - NVIDIA Corporation)

NVIDIA PhysX System Software 9.12.0613 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.12.0613 - NVIDIA Corporation)

NVIDIA Update 1.10.8 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.10.8 - NVIDIA Corporation)

Office 16 Click-to-Run Extensibility Component (x32 Version: 16.0.7870.2024 - Microsoft Corporation) Hidden

Office 16 Click-to-Run Extensibility Component 64-bit Registration (Version: 16.0.7830.1018 - Microsoft Corporation) Hidden

Office 16 Click-to-Run Licensing Component (Version: 16.0.7870.2024 - Microsoft Corporation) Hidden

Office 16 Click-to-Run Localization Component (x32 Version: 16.0.7668.2066 - Microsoft Corporation) Hidden

PDF Architect 2 (HKLM-x32\...\PDF Architect 2) (Version: 2.0.24.16092 - pdfforge GmbH)

PDF Architect 2 View Module (HKLM-x32\...\{46889070-D447-4936-A5D3-246DB972FA2E}) (Version: 2.0.6.16537 - pdfforge GmbH)

PDF Settings CS4 (x32 Version: 9.0 - Adobe Systems Incorporated) Hidden

PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.3 - pdfforge)

Photoshop Camera Raw (x32 Version: 5.0 - Adobe Systems Incorporated) Hidden

Photoshop Camera Raw_x64 (Version: 5.0 - Adobe Systems Incorporated) Hidden

Plantronics Spokes Software (HKLM-x32\...\{BC44D085-6920-4772-B069-9757E767ED79}) (Version: 2.8.52117.3 - Plantronics, Inc.)

Platform (x32 Version: 1.39 - VIA Technologies, Inc.) Hidden

psqlODBC_x64 (HKLM\...\{C0249921-2C35-47C1-83D8-8EABC438A96F}) (Version: 09.03.0400 - PostgreSQL Global Development Group)

Qt 5.2.0 (HKU\S-1-5-21-3449447305-1594401728-24528855-1000\...\Qt 5.2.0) (Version: 5.2.0 - Digia Plc)

Qt 5.2.0 (HKU\S-1-5-21-3449447305-1594401728-24528855-1001\...\Qt 5.2.0) (Version: 5.2.0 - Digia Plc)

Qualcomm Atheros WiFi Driver Installation (HKLM-x32\...\{7D916FA5-DAE9-4A25-B089-655C70EAF607}) (Version: 3.1 - Qualcomm Atheros)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7213 - Realtek Semiconductor Corp.)

Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7601.28117 - Realtek Semiconductor Corp.)

RStudio (HKLM-x32\...\RStudio) (Version: 0.98.1062 - RStudio)

Silicon Laboratories CP210x USB to UART Bridge (Driver Removal) (HKLM-x32\...\SLABCOMM&10C4&EA60) (Version:  - Silicon Laboratories)

Skype™ 7.30 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.30.105 - Skype Technologies S.A.)

SlimDX Redistributable (August 2009) (HKLM-x32\...\{94C1A41C-2A2D-4AF0-858E-924288245621}) (Version: 2.0.8.42 - SlimDX Group)

SMRecorder 1.3.2 (HKLM-x32\...\SMRecorder) (Version: 1.3.2 - SMRecorder)

Spotify (HKU\S-1-5-21-3449447305-1594401728-24528855-1000\...\Spotify) (Version: 1.0.53.758.gde3fc4b2 - Spotify AB)

Spotify (HKU\S-1-5-21-3449447305-1594401728-24528855-1001\...\Spotify) (Version: 1.0.33.106.g60b5d1f0 - Spotify AB)

ST Microelectronics 3 Axis Digital Accelerometer Solution (HKLM-x32\...\{9C24F411-9CA7-4A8A-91F3-F08A4A38EB31}) (Version: 4.07.0031 - ST Microelectronics)

Suite Shared Configuration CS4 (x32 Version: 1.0 - Adobe Systems Incorporated) Hidden

Tableau 9.3 (9300.16.0315.0125) (HKLM-x32\...\{b5a1f8bc-c643-4a28-bdf2-7893f7aaa123}) (Version: 9.3.516 - Tableau Software)

Tableau 9.3 (9300.16.0315.0125) (Version: 9.3.516 - Tableau Software) Hidden

Validity Sensors PBA DDK (HKLM\...\{948BD48F-09DB-4F12-9DAE-0279E5AD93A1}) (Version: 4.1.329.0 - Validity Sensors, Inc.)

Validity WBF DDK (HKLM\...\{1F91C200-8F0F-4009-A75E-DB6CE151BD4E}) (Version: 4.4.234.0 - Validity Sensors, Inc.)

VanDyke Software SecureCRT and SecureFX 7.2 (HKLM\...\{8A288443-B782-4034-8155-4AE4D3EC7AC1}) (Version: 7.2.5 - VanDyke Software, Inc.)

VIA Platform Device Manager (HKLM-x32\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.39 - VIA Technologies, Inc.)

VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)

WinDirStat 1.1.2 (HKU\S-1-5-21-3449447305-1594401728-24528855-1000\...\WinDirStat) (Version:  - )

Windows Driver Package - ASUS (ATP) Mouse  (01/10/2013 1.0.0.170) (HKLM\...\4A9DE1E9EBC800B7F01739D4DE7363EF6751BDF5) (Version: 01/10/2013 1.0.0.170 - ASUS)

Windows Driver Package - Intel (ISCT) System  (10/31/2013 1.0.11) (HKLM\...\1CF6D9B730DBBCB27827E7FDC43872DD07292FCB) (Version: 10/31/2013 1.0.11 - Intel)

Windows Driver Package - Intel (MEIx64) System  (03/13/2014 10.0.0.1204) (HKLM\...\4C4490E439E681929925768307BC0BACF6D17ADF) (Version: 03/13/2014 10.0.0.1204 - Intel)

Windows Driver Package - Plantronics, Inc. (usbser.ntamd64) Ports  (04/21/2009 5.1) (HKLM\...\07AFE62D73C8799E9E5689F86FB9F48389717BA3) (Version: 04/21/2009 5.1 - Plantronics, Inc.)

WSE_Astromenda (HKLM-x32\...\WSE_Astromenda) (Version:  - WSE_Astromenda) <==== ATTENTION

 

==================== Custom CLSID (Whitelisted): ==========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

CustomCLSID: HKU\S-1-5-21-3449447305-1594401728-24528855-1000_Classes\CLSID\{162C6FB5-44D3-435B-903D-E613FA093FB5}\InprocServer32 -> C:\Users\Maria\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64\FileCoAuthLib64.dll ()

CustomCLSID: HKU\S-1-5-21-3449447305-1594401728-24528855-1000_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Program Files (x86)\Citrix\GoToMeeting\4911\G2MOutlookAddin64.dll (Citrix Online, a division of Citrix Systems, Inc.)

CustomCLSID: HKU\S-1-5-21-3449447305-1594401728-24528855-1000_Classes\CLSID\{8C46158B-D978-483C-A312-16EE5013BE04}\InprocServer32 -> C:\Users\Maria\AppData\Local\Google\Update\1.3.33.3\psuser_64.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-3449447305-1594401728-24528855-1000_Classes\CLSID\{ca586c80-7c84-4b88-8537-726724df6929}\InprocServer32 -> C:\Program Files (x86)\Git\git-cheetah\git_shell_ext64.dll ()

CustomCLSID: HKU\S-1-5-21-3449447305-1594401728-24528855-1000_Classes\CLSID\{CB492AF1-2CEF-4E58-BE47-471C77D0C8BA}\InprocServer32 -> C:\Users\Maria\AppData\Local\Google\Update\1.3.32.7\psuser_64.dll => No File

CustomCLSID: HKU\S-1-5-21-3449447305-1594401728-24528855-1000_Classes\CLSID\{e8c77137-e224-5791-b6e9-ff0305797a13}\InprocServer32 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)

CustomCLSID: HKU\S-1-5-21-3449447305-1594401728-24528855-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Maria\AppData\Local\Google\Update\1.3.33.3\psuser_64.dll (Google Inc.)

 

==================== Scheduled Tasks (Whitelisted) =============

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

Task: {1077B051-9B34-4E0B-AEE2-1FCCCA921830} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2017-03-26] (Microsoft Corporation)

Task: {13A2BFFA-4060-40DA-9422-45D8439882B4} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2017-03-26] (Microsoft Corporation)

Task: {141D1D9C-A346-4874-BB58-C0F2D9405034} - System32\Tasks\ATKOSD2 => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [2013-01-11] (ASUSTek Computer Inc.)

Task: {28957A45-7B05-47E7-907A-3D7E0B2DA5D2} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-04-11] (Adobe Systems Incorporated)

Task: {2BA66FC4-9AFF-4A21-8C1C-6117AC8B6F06} - System32\Tasks\Avira\System Speedup\TestScheduler => C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.Core.Common.Starter.exe [2017-04-07] (Avira Operations GmbH & Co. KG)

Task: {2FD25A60-EDFD-4BC0-B548-F7903313FA69} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2017-02-02] (Adobe Systems Incorporated)

Task: {34AB4646-1391-4C2F-BC30-3FF3237198D2} - System32\Tasks\AviraSystemSpeedupUpdate => C:\ProgramData\Avira\SystemSpeedup\Update\avira_speedup_setup_update.exe [2017-04-16] (Avira Operations GmbH & Co. KG                              )

Task: {41D4D6DA-454E-4714-A463-CF60CA1D20FD} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-06-24] (Piriform Ltd)

Task: {454AADD2-E5E4-47D0-9F76-B4DBDD853CBF} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [2017-03-26] (Microsoft Corporation)

Task: {61D215AE-03A6-46F6-8CBF-634E7FAD886A} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2017-03-26] (Microsoft Corporation)

Task: {65EA2422-1064-463D-B9F4-3DE797F88E6D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-31] (Google Inc.)

Task: {6A5B3E57-48BF-49B4-9F32-FB20425D028F} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3449447305-1594401728-24528855-1000Core => C:\Users\Maria\AppData\Local\Google\Update\GoogleUpdate.exe [2015-05-26] (Google Inc.)

Task: {6E0141FD-A339-45C5-86C8-02EC52940CA4} - System32\Tasks\Avira\System Speedup\SpeedupSysTray => C:\Program Files (x86)\Avira\System Speedup\Avira.SystemSpeedup.UI.Systray.exe [2017-04-07] (Avira Operations GmbH & Co. KG)

Task: {758210CA-2E9B-49A4-8406-C0B2F9EBE771} - System32\Tasks\G2MUpdateTask-S-1-5-21-3449447305-1594401728-24528855-1000 => C:\Program Files (x86)\Citrix\GoToMeeting\6871\g2mupdate.exe [2017-04-21] (Citrix Online, a division of Citrix Systems, Inc.)

Task: {75A0239F-F4CA-4FAF-B07F-CE8981E17BAB} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3449447305-1594401728-24528855-1000UA => C:\Users\Maria\AppData\Local\Google\Update\GoogleUpdate.exe [2015-05-26] (Google Inc.)

Task: {7EF0C2D3-A1AA-4AEC-AAE1-0A72385E6049} - System32\Tasks\AdobeAAMUpdater-1.0-Maria-PC-Maria => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2016-07-01] (Adobe Systems Incorporated)

Task: {938BA116-270A-4622-95D2-B5389B5AAB30} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-31] (Google Inc.)

Task: {A07760FF-1992-45CF-91F9-9B282ACE76A7} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe [2017-03-26] (Microsoft Corporation)

Task: {AB0C5838-8CE7-4C07-A178-B81B3C0429FF} - System32\Tasks\ASUS Touchpad Launcher (x64) => C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLauncher.exe [2013-04-16] (AsusTek)

Task: {C2C980CF-C7F1-4D06-90EC-557AB7B6F30B} - System32\Tasks\G2MUploadTask-S-1-5-21-3449447305-1594401728-24528855-1000 => C:\Program Files (x86)\Citrix\GoToMeeting\6871\g2mupload.exe [2017-04-21] (Citrix Online, a division of Citrix Systems, Inc.)

Task: {E0D3D612-C1F5-424C-BDEB-5C1C1AD546C9} - \WSE_Astromenda -> No File <==== ATTENTION

Task: {E270D223-40B9-4098-9405-2C27CFD9D303} - System32\Tasks\Avira Browser Safety Updater Task => C:\Program Files (x86)\Avira\Browser Safety\AviraBrowserSafetyUpdater.exe [2015-03-11] (Avira Operations GmbH & Co. KG)

 

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

 

Task: C:\windows\Tasks\Driver Easy Scheduled Scan.job => C:\Program Files\Easeware\DriverEasy\DriverEasy.exe

Task: C:\windows\Tasks\G2MUpdateTask-S-1-5-21-3449447305-1594401728-24528855-1000.job => C:\Program Files (x86)\Citrix\GoToMeeting\6871\g2mupdate.exe

Task: C:\windows\Tasks\G2MUploadTask-S-1-5-21-3449447305-1594401728-24528855-1000.job => C:\Program Files (x86)\Citrix\GoToMeeting\6871\g2mupload.exe

Task: C:\windows\Tasks\WSE_Astromenda.job => C:\Users\Maria\AppData\Roaming\WSE_Astromenda\UpdateProc\UpdateTask.exe <==== ATTENTION

 

==================== Shortcuts =============================

 

(The entries could be listed to be restored or removed.)

 

Shortcut: C:\Users\Maria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ruby 1.9.3-p448\Interactive Ruby.lnk -> C:\Program Files (x86)\Heroku\ruby-1.9.3\bin\irb.bat ()

 

ShortcutWithArgument: C:\Users\Maria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ruby 1.9.3-p448\Start Command Prompt with Ruby.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation) -> /E:ON /K C:\Program Files (x86)\Heroku\ruby-1.9.3\bin\setrbvars.bat

ShortcutWithArgument: C:\Users\Maria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Qt 5.2.0\5.2.0\MinGW 4.8 (32-bit)\Qt 5.2.0 for Desktop (MinGW 4.8 32 bit).lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation) -> /A /Q /K C:\Qt\Qt5.2.0\5.2.0\mingw48_32\bin\qtenv2.bat

 

==================== Loaded Modules (Whitelisted) ==============

 

2014-06-06 09:51 - 2012-10-03 09:54 - 00086888 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll

2016-10-25 09:57 - 2016-10-25 09:57 - 00491184 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll

2016-10-10 14:36 - 2016-10-10 14:36 - 00959168 _____ () C:\Users\Maria\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64\ClientTelemetry.dll

2016-10-10 14:30 - 2017-02-26 12:32 - 08930496 _____ () C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\1033\GrooveIntlResource.dll

2014-06-06 09:47 - 2012-11-21 16:58 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll

2014-06-06 09:55 - 2012-10-08 14:20 - 00250008 _____ () C:\Program Files (x86)\ST Microelectronics\ST_ACCEL\FFP_DT.dll

2016-10-25 09:57 - 2016-10-25 09:57 - 31723696 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe

2016-03-24 13:53 - 2016-03-23 14:06 - 00110952 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\zlib1.dll

2016-03-24 13:53 - 2016-03-23 14:06 - 00253800 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\collector.dll

2016-03-24 13:53 - 2016-03-23 14:06 - 00295272 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\stat.dll

2016-03-24 13:53 - 2016-03-23 14:06 - 00104296 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\boost_filesystem-vc120-mt-1_56.dll

2016-03-24 13:53 - 2016-03-23 14:06 - 00020328 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\boost_system-vc120-mt-1_56.dll

2016-03-24 13:53 - 2016-03-23 14:06 - 00044392 _____ () C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\boost_date_time-vc120-mt-1_56.dll

2015-03-13 08:55 - 2017-04-13 11:33 - 67725936 _____ () C:\Users\Maria\AppData\Roaming\Spotify\libcef.dll

2016-02-12 20:04 - 2016-02-12 20:04 - 00136704 _____ () C:\windows\assembly\NativeImages_v2.0.50727_32\Plantronics.Config.#\61fbb3a509fe02354eba6788d99e7c28\Plantronics.Config.XmlSerializers.ni.dll

2016-05-15 03:43 - 2016-05-15 03:43 - 00304128 _____ () C:\windows\assembly\NativeImages_v2.0.50727_32\Plantronics.UC.Rest\1043200fa4ef868a24355632c546dde7\Plantronics.UC.Rest.ni.dll

2016-05-15 03:44 - 2016-05-15 03:44 - 00030720 _____ () C:\windows\assembly\NativeImages_v2.0.50727_32\Plantronics.UC.Rest#\34b785df6bb689cf3e90f88d6741cf8a\Plantronics.UC.Rest.JsonpExtension.ni.dll

2017-03-14 08:31 - 2017-03-14 08:31 - 52051544 _____ () C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\CEF\libcef.dll

2015-03-13 08:55 - 2017-04-13 11:33 - 01929840 _____ () C:\Users\Maria\AppData\Roaming\Spotify\libglesv2.dll

2015-03-13 08:55 - 2017-04-13 11:33 - 00087152 _____ () C:\Users\Maria\AppData\Roaming\Spotify\libegl.dll

2017-01-25 20:07 - 2017-01-25 20:07 - 00118272 _____ () \\?\C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\js\node_modules\fs-ext\build\Release\fs-ext.node

2017-01-25 20:07 - 2017-01-25 20:07 - 00214528 _____ () \\?\C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\js\node_modules\node-vulcanjs\build\Release\VulcanJS.node

2017-01-25 20:06 - 2017-01-25 20:06 - 00117248 _____ () \\?\C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\js\node_modules\ref\build\Release\binding.node

2017-01-25 20:07 - 2017-01-25 20:07 - 00125952 _____ () \\?\C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\js\node_modules\ffi\build\Release\ffi_bindings.node

2017-03-14 08:35 - 2017-03-14 08:35 - 00110680 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\js\node_modules\node-ProxyResolver\build\Release\ProxyResolverWin7.dll

2017-01-25 20:07 - 2017-01-25 20:07 - 00086528 _____ () \\?\C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\js\node_modules\idle-gc\build\Release\idle-gc.node

2017-02-23 18:13 - 2017-02-23 18:13 - 00118272 _____ () \\?\C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\js\node_modules\fs-ext\build\Release\fs-ext.node

2017-02-23 18:13 - 2017-02-23 18:13 - 00117760 _____ () \\?\C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\js\node_modules\ref\build\Release\binding.node

2017-02-23 18:13 - 2017-02-23 18:13 - 00125440 _____ () \\?\C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\js\node_modules\ffi\build\Release\ffi_bindings.node

2017-02-23 18:13 - 2017-02-23 18:13 - 00214528 _____ () \\?\C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\js\node_modules\node-vulcanjs\build\Release\VulcanJS.node

2017-03-14 08:29 - 2017-03-14 08:29 - 00110680 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\js\node_modules\node-ProxyResolver\build\Release\ProxyResolverWin7.dll

2017-02-23 18:13 - 2017-02-23 18:13 - 00098816 _____ () \\?\C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\js\node_modules\bufferutil\build\Release\bufferutil.node

2017-02-23 18:13 - 2017-02-23 18:13 - 00086528 _____ () \\?\C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\js\node_modules\idle-gc\build\Release\idle-gc.node

2016-10-10 14:36 - 2016-10-10 14:36 - 00679624 _____ () C:\Users\Maria\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\ClientTelemetry.dll

2016-10-10 14:29 - 2017-02-26 10:58 - 08929984 _____ () C:\Program Files (x86)\Microsoft Office\root\Office16\1033\GrooveIntlResource.dll

2017-03-31 08:59 - 2017-03-28 19:04 - 02187096 _____ () C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\libglesv2.dll

2017-03-31 08:59 - 2017-03-28 19:04 - 00086360 _____ () C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\libegl.dll

2017-04-11 10:08 - 2017-03-31 11:49 - 17778776 _____ () C:\Users\Maria\AppData\Local\Google\Chrome\User Data\PepperFlash\25.0.0.148\pepflashplayer.dll

 

==================== Alternate Data Streams (Whitelisted) =========

 

(If an entry is included in the fixlist, only the ADS will be removed.)

 

 

==================== Safe Mode (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

 

 

==================== Association (Whitelisted) ===============

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

 

 

==================== Internet Explorer trusted/restricted ===============

 

(If an entry is included in the fixlist, it will be removed from the registry.)

 

IE trusted site: HKU\S-1-5-21-3449447305-1594401728-24528855-1001\...\3dicc.com -> hxxp://3dicc.com

IE trusted site: HKU\S-1-5-21-3449447305-1594401728-24528855-1001\...\3dicc.com -> hxxps://3dicc.com

 

==================== Hosts content: ===============================

 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

 

2009-07-13 19:34 - 2015-01-15 11:53 - 00000856 ____A C:\windows\system32\Drivers\etc\hosts

 

127.0.0.1 activate.adobe.com

 

==================== Other Areas ============================

 

(Currently there is no automatic fix for this section.)

 

HKU\S-1-5-21-3449447305-1594401728-24528855-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Maria\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

DNS Servers: 75.75.75.75 - 75.75.76.76

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)

Windows Firewall is enabled.

 

==================== MSCONFIG/TASK MANAGER disabled items ==

 

MSCONFIG\Services: SkypeUpdate => 2

MSCONFIG\startupreg: AdobeBridge => 

MSCONFIG\startupreg: Box Edit => C:\Users\Maria\AppData\Local\Box\Box Edit\Box Edit.exe

MSCONFIG\startupreg: BoxSync => "C:\Program Files\Box\Box Sync\BoxSync.exe" -m

MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun

MSCONFIG\startupreg: GoToMeeting => "C:\Program Files (x86)\Citrix\GoToMeeting\4911\g2mstart.exe" "/Trigger RunAtLogon"

MSCONFIG\startupreg: HDAudDeck => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r

MSCONFIG\startupreg: PlantronicsBatteryStatus.exe => C:\Program Files (x86)\Plantronics\PlantronicsURE\PlantronicsBatteryStatus.exe

MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun

MSCONFIG\startupreg: Spotify => "C:\Users\Maria\AppData\Roaming\Spotify\Spotify.exe" -autostart -minimized

MSCONFIG\startupreg: Spotify Web Helper => "C:\Users\Maria\AppData\Roaming\Spotify\SpotifyWebHelper.exe"

MSCONFIG\startupreg: VIAAUD => C:\Program Files (x86)\VIA\VIAudioi\VDeck\viaaud.exe

 

==================== FirewallRules (Whitelisted) ===============

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe

FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe

FirewallRules: [{84ABDB71-670D-4E53-A19A-A579C0F1AF22}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

FirewallRules: [{93F5617C-D15D-4C11-9392-33A2E222F162}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

FirewallRules: [{5596D673-9F9C-4E8B-90D4-04F62405659C}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe

FirewallRules: [{A270584D-7861-4461-93DA-3EF24D7C7514}] => (Allow) C:\Users\Maria\AppData\Roaming\Spotify\spotify.exe

FirewallRules: [{E7797192-CE7F-49B3-AC18-1E52A0E8EEBB}] => (Allow) C:\Users\Maria\AppData\Roaming\Spotify\spotify.exe

FirewallRules: [{76FB620D-E2EB-4C80-AAA7-02E7BDB307B4}] => (Allow) C:\Users\Maria\AppData\Roaming\Spotify\spotify.exe

FirewallRules: [{FBFD08F0-C621-4C5C-BAC9-1DA269CC04F4}] => (Allow) C:\Users\Maria\AppData\Roaming\Spotify\spotify.exe

FirewallRules: [TCP Query User{C9C093E5-FF05-4DB7-8519-8091BB511C09}C:\users\maria\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\maria\appdata\local\akamai\netsession_win.exe

FirewallRules: [UDP Query User{A2F56B85-DB4A-48B9-AFC9-1DB7581BA72B}C:\users\maria\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\maria\appdata\local\akamai\netsession_win.exe

FirewallRules: [TCP Query User{4FBAFE3C-EEAE-4709-ABEE-203DFF310318}C:\users\maria\appdata\local\akamai\netsession_win.exe] => (Block) C:\users\maria\appdata\local\akamai\netsession_win.exe

FirewallRules: [UDP Query User{CC02A0D6-873C-472C-BC5F-5CBC9E165466}C:\users\maria\appdata\local\akamai\netsession_win.exe] => (Block) C:\users\maria\appdata\local\akamai\netsession_win.exe

FirewallRules: [{AB760A76-6ABB-4E36-8838-580CB7C181AD}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe

FirewallRules: [TCP Query User{12D65BA0-ABFD-4629-B100-DFB0E3734329}C:\program files (x86)\xming\xming.exe] => (Allow) C:\program files (x86)\xming\xming.exe

FirewallRules: [UDP Query User{1EAD724C-9C75-4027-B875-F8A66B012852}C:\program files (x86)\xming\xming.exe] => (Allow) C:\program files (x86)\xming\xming.exe

FirewallRules: [{3D5E2098-12FB-4882-9AF0-3422EF9C8AF7}] => (Allow) LPort=5353

FirewallRules: [{2D02190D-07A0-454F-9D4C-5D581A83C561}] => (Allow) C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe

FirewallRules: [{940B609E-7C1F-402F-B3F5-7A0AB2152F57}] => (Allow) C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe

FirewallRules: [TCP Query User{D7A2D7E4-D094-46D5-9BA5-9188A74C3844}C:\cygwin64\bin\xwin.exe] => (Allow) C:\cygwin64\bin\xwin.exe

FirewallRules: [UDP Query User{33AA1C65-2549-41F7-B635-565D2EE3BE4B}C:\cygwin64\bin\xwin.exe] => (Allow) C:\cygwin64\bin\xwin.exe

FirewallRules: [{90A9B584-53E3-40F4-9C00-2AB150A33F36}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{4B9054F1-7B34-489B-A24E-ED4E553E902E}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{03885BD3-50D9-4BCC-82CB-8AD59987D22D}] => (Allow) C:\Users\Maria\AppData\Local\Microsoft\OneDrive\OneDrive.exe

FirewallRules: [{BC335F0A-01C5-4BB0-B69E-4CD83ED281B6}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{B2F070EC-DD1E-40DE-A563-26DFB2C8CC34}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{3022A7CD-7C57-4063-A872-7D2416916092}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe

FirewallRules: [{2C148F3B-D70B-40AA-AF45-2AA43F956227}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe

FirewallRules: [{88A0C05B-B837-4C81-B738-646CDC6D9FFD}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe

FirewallRules: [{35A41D0A-308A-48BD-880C-25CAE8E1AB27}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe

FirewallRules: [{776A173A-D2AB-4C9D-9157-9CFAFEBB694F}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe

FirewallRules: [{55E38DFA-37A5-4A70-8E27-660E3CCB98C6}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

FirewallRules: [TCP Query User{157D5405-C9AE-4468-ABC2-E1D16AD3EF73}C:\users\maria\appdata\local\blue jeans\app\bluejeans.exe] => (Allow) C:\users\maria\appdata\local\blue jeans\app\bluejeans.exe

FirewallRules: [UDP Query User{47FF5C24-B063-401B-89AD-C672BDCE9B19}C:\users\maria\appdata\local\blue jeans\app\bluejeans.exe] => (Allow) C:\users\maria\appdata\local\blue jeans\app\bluejeans.exe

FirewallRules: [TCP Query User{0CEEBA18-6473-4087-ACBB-B2B23E216113}C:\users\maria\appdata\local\blue jeans\app\bluejeans.exe] => (Allow) C:\users\maria\appdata\local\blue jeans\app\bluejeans.exe

FirewallRules: [UDP Query User{6400363D-3082-473F-B6F1-F1F2D048A9CF}C:\users\maria\appdata\local\blue jeans\app\bluejeans.exe] => (Allow) C:\users\maria\appdata\local\blue jeans\app\bluejeans.exe

FirewallRules: [{6CE83FA7-A188-4581-8D37-7388E519F121}] => (Allow) LPort=49171

FirewallRules: [{F9565294-781F-4D86-AABA-6645BA605296}] => (Allow) LPort=5000

 

==================== Restore Points =========================

 

17-04-2017 14:58:04 Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23918

23-04-2017 13:16:25 Windows Update

 

==================== Faulty Device Manager Devices =============

 

Name: Bluetooth Server

Description: Bluetooth Server

Class Guid: {34446e8e-37b4-4b16-9da6-bea2db33465a}

Manufacturer: Intel Corporation

Service: btmaux

Problem: : This device cannot start. (Code10)

Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.

On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

 

 

==================== Event log errors: =========================

 

Application errors:

==================

Error: (04/24/2017 11:25:16 AM) (Source: PerfNet) (EventID: 2005) (User: )

Description: Unable to read performance data for the Server service. The first four bytes (DWORD) of the Data section contains the status code, the second four bytes contains the IOSB.Status and the next four bytes contains the IOSB.Information.

 

Error: (04/24/2017 11:25:04 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

 

Error: (04/24/2017 11:08:23 AM) (Source: SideBySide) (EventID: 33) (User: )

Description: Activation context generation failed for "C:\Program Files (x86)\Adobe\Adobe Premiere Pro CS4\MPEGHDVExport.exe".

Dependent Assembly Plug-ins&#x5c;Common&#x5c;TSStrider,type="win32",version="1.0.0.0" could not be found.

Please use sxstrace.exe for detailed diagnosis.

 

Error: (04/24/2017 11:06:01 AM) (Source: SideBySide) (EventID: 63) (User: )

Description: Activation context generation failed for "C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll".Error in manifest or policy file "C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" on line 3.

The value "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" of attribute "version" in element "assemblyIdentity" is invalid.

 

Error: (04/24/2017 11:05:22 AM) (Source: SideBySide) (EventID: 35) (User: )

Description: Activation context generation failed for "C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe.Manifest".Error in manifest or policy file "C:\Program Files (x86)\Microsoft Office\root\Office16\UccApi.DLL" on line 1.

Component identity found in manifest does not match the identity of the component requested.

Reference is UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0".

Definition is UccApi,processorArchitecture="x86",type="win32",version="16.0.0.0".

Please use sxstrace.exe for detailed diagnosis.

 

Error: (04/23/2017 01:21:59 PM) (Source: SideBySide) (EventID: 33) (User: )

Description: Activation context generation failed for "C:\Program Files (x86)\Adobe\Adobe Premiere Pro CS4\MPEGHDVExport.exe".

Dependent Assembly Plug-ins&#x5c;Common&#x5c;TSStrider,type="win32",version="1.0.0.0" could not be found.

Please use sxstrace.exe for detailed diagnosis.

 

Error: (04/23/2017 01:19:41 PM) (Source: SideBySide) (EventID: 63) (User: )

Description: Activation context generation failed for "C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll".Error in manifest or policy file "C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" on line 3.

The value "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" of attribute "version" in element "assemblyIdentity" is invalid.

 

Error: (04/23/2017 01:19:07 PM) (Source: SideBySide) (EventID: 35) (User: )

Description: Activation context generation failed for "C:\Program Files (x86)\Microsoft Office\root\Office16\lync.exe.Manifest".Error in manifest or policy file "C:\Program Files (x86)\Microsoft Office\root\Office16\UccApi.DLL" on line 1.

Component identity found in manifest does not match the identity of the component requested.

Reference is UccApi,processorArchitecture="AMD64",type="win32",version="16.0.0.0".

Definition is UccApi,processorArchitecture="x86",type="win32",version="16.0.0.0".

Please use sxstrace.exe for detailed diagnosis.

 

Error: (04/22/2017 04:52:55 PM) (Source: SideBySide) (EventID: 33) (User: )

Description: Activation context generation failed for "C:\Program Files (x86)\Adobe\Adobe Premiere Pro CS4\MPEGHDVExport.exe".

Dependent Assembly Plug-ins&#x5c;Common&#x5c;TSStrider,type="win32",version="1.0.0.0" could not be found.

Please use sxstrace.exe for detailed diagnosis.

 

Error: (04/22/2017 04:50:56 PM) (Source: SideBySide) (EventID: 63) (User: )

Description: Activation context generation failed for "C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll".Error in manifest or policy file "C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" on line 3.

The value "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" of attribute "version" in element "assemblyIdentity" is invalid.

 

 

System errors:

=============

Error: (04/24/2017 11:25:29 AM) (Source: Service Control Manager) (EventID: 7026) (User: )

Description: The following boot-start or system-start driver(s) failed to load: 

cdrom

 

Error: (04/24/2017 11:24:10 AM) (Source: DCOM) (EventID: 10010) (User: )

Description: The server {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} did not register with DCOM within the required timeout.

 

Error: (04/21/2017 10:38:23 PM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Wlansvc service.

 

Error: (04/21/2017 10:45:04 AM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Wlansvc service.

 

Error: (04/15/2017 01:00:36 PM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Netman service.

 

Error: (04/13/2017 11:33:09 AM) (Source: Service Control Manager) (EventID: 7026) (User: )

Description: The following boot-start or system-start driver(s) failed to load: 

cdrom

 

Error: (04/13/2017 11:32:37 AM) (Source: EventLog) (EventID: 6008) (User: )

Description: The previous system shutdown at 10:49:12 PM on ‎4/‎12/‎2017 was unexpected.

 

Error: (04/12/2017 10:35:28 PM) (Source: Service Control Manager) (EventID: 7026) (User: )

Description: The following boot-start or system-start driver(s) failed to load: 

cdrom

 

Error: (04/12/2017 10:33:02 PM) (Source: DCOM) (EventID: 10010) (User: )

Description: The server {1A1F4206-0688-4E7F-BE03-D82EC69DF9A5} did not register with DCOM within the required timeout.

 

Error: (04/12/2017 10:32:55 PM) (Source: DCOM) (EventID: 10010) (User: )

Description: The server {FE9617F6-E606-42AA-BECC-0E9CDA246D63} did not register with DCOM within the required timeout.

 

 

CodeIntegrity:

===================================

  Date: 2015-02-13 08:01:33.361

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-02-13 08:01:33.302

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\KLELAMX64\klelam.sys because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-02-13 07:55:49.466

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\ELAMBKUP\klelam.sys because the set of per-page image hashes could not be found on the system.

 

  Date: 2015-02-13 07:55:49.412

  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\KLELAMX64\klelam.sys because the set of per-page image hashes could not be found on the system.

 

 

==================== Memory info =========================== 

 

Processor: Intel® Core™ i7-3517U CPU @ 1.90GHz

Percentage of memory in use: 78%

Total physical RAM: 3964.68 MB

Available physical RAM: 863.84 MB

Total Virtual: 7927.54 MB

Available Virtual: 4124.21 MB

 

==================== Drives ================================

 

Drive c: () (Fixed) (Total:100 GB) (Free:18.88 GB) NTFS ==>[drive with boot components (obtained from BCD)]

Drive d: () (Fixed) (Total:138.47 GB) (Free:132.16 GB) NTFS

 

==================== MBR & Partition Table ==================

 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 238.5 GB) (Disk ID: 2775B73B)

Partition 1: (Active) - (Size=100 GB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=138.5 GB) - (Type=07 NTFS)

 

==================== End of Addition.txt ============================

 

[Advertisements]

Hi! My name is zep516 and Welcome to Geekstogo!
I'll do the best I can to resolve your computer issue
Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, don't continue Stop and ask! Never be afraid to ask questions!

Programs to uninstall
Java 8 Update 45
Java 8 Update 45
WSE_Astromenda

Next
Download the enclosed => file.  fixlist.txt   5.55KB   142 downloads Save it in the location FRST64 is C:\Users\Maria\Downloads Run FRST and click on the Fix button. Wait until finished.

The tool will make a log in the location FRST is, C:\Users\Maria\Downloads (Fixlog.txt). Please post it to your reply.

[zep516]

Hi! My name is zep516 and Welcome to Geekstogo!
I'll do the best I can to resolve your computer issue
Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, don't continue Stop and ask! Never be afraid to ask questions!

Programs to uninstall
Java 8 Update 45
Java 8 Update 45
WSE_Astromenda

Next
Download the enclosed => file.  fixlist.txt   5.55KB   142 downloads Save it in the location FRST64 is C:\Users\Maria\Downloads Run FRST and click on the Fix button. Wait until finished.

The tool will make a log in the location FRST is, C:\Users\Maria\Downloads (Fixlog.txt). Please post it to your reply.

[mara_frank]

Thank you so much for your help!

I am unsure about one step:

You asked to uninstall WSE_Astromenda, However, there is no program under this name, only a file under C:\\Widows\Tasks. So should I just delete this file?

[zep516]

No. Don't worry I have the file in the fix.

[mara_frank]

Fix result of Farbar Recovery Scan Tool (x64) Version: 23-04-2017 01

Ran by Maria (24-04-2017 16:58:51) Run:1

Running from C:\Users\Maria\Downloads

Loaded Profiles: Maria & UpdatusUser (Available Profiles: Maria & UpdatusUser)

Boot Mode: Normal

==============================================

 

fixlist content:

*****************

CloseProcesses:

CreateRestorePoint:

HKU\S-1-5-21-3449447305-1594401728-24528855-1000\...\MountPoints2: {328cb4d3-ed99-11e3-bf20-c8f7336cb735} - E:\unlock.exe autoplay=true

BootExecute: autocheck autochk * bootdelete

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.v9.com/web/?type=ds&ts=1412543140&from=cor&uid=SanDiskXSSDXU100X256GB_124644400619&i=psd&t=349f0fa6d&q={searchTerms}

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.v9.com/web/?type=ds&ts=1412543140&from=cor&uid=SanDiskXSSDXU100X256GB_124644400619&i=psd&t=349f0fa6d&q={searchTerms}

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.v9.com/web/?type=ds&ts=1412543140&from=cor&uid=SanDiskXSSDXU100X256GB_124644400619&i=psd&t=349f0fa6d&q={searchTerms}

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.v9.com/web/?type=ds&ts=1412543140&from=cor&uid=SanDiskXSSDXU100X256GB_124644400619&i=psd&t=349f0fa6d&q={searchTerms}

HKU\S-1-5-21-3449447305-1594401728-24528855-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://astromenda.com/?f=1&a=ast_ir_14_35_ff&cd=2XzuyEtN2Y1L1Qzu0Czz0FyBtAtAyC0C0ByBtAyDtAyB0DtBtN0D0Tzu0SzyyBtBtN1L2XzutAtFtBtFtCtFtCtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StC0ByD0C0FtB0EtBtGyE0AyE0BtGtD0BtAyEtGzztD0AyBtGyDyCtCyCzyzzzztDyEtBtAyC2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szy0F0EtAyC0EtC0BtG0BtAtByDtGyEyDyEtCtGzz0AzztCtG0B0AzztAtAtA0AzyyCtCzzyC2Q&cr=699028479&ir=

HKU\S-1-5-21-3449447305-1594401728-24528855-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp

HKU\S-1-5-21-3449447305-1594401728-24528855-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://astromenda.com/?f=1&a=ast_ir_14_35_ff&cd=2XzuyEtN2Y1L1Qzu0Czz0FyBtAtAyC0C0ByBtAyDtAyB0DtBtN0D0Tzu0SzyyBtBtN1L2XzutAtFtBtFtCtFtCtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StC0ByD0C0FtB0EtBtGyE0AyE0BtGtD0BtAyEtGzztD0AyBtGyDyCtCyCzyzzzztDyEtBtAyC2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szy0F0EtAyC0EtC0BtG0BtAtByDtGyEyDyEtCtGzz0AzztCtG0B0AzztAtAtA0AzyyCtCzzyC2Q&cr=699028479&ir=

HKU\S-1-5-21-3449447305-1594401728-24528855-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp

SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = hxxp://www.default-search.net/search?sid=492&aid=311&itype=n&ver=13892&tm=491&src=ds&p={searchTerms}

SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = hxxp://www.default-search.net/search?sid=492&aid=311&itype=n&ver=13892&tm=491&src=ds&p={searchTerms}

SearchScopes: HKU\S-1-5-21-3449447305-1594401728-24528855-1000 -> DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = 

SearchScopes: HKU\S-1-5-21-3449447305-1594401728-24528855-1000 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = hxxp://www.default-search.net/search?sid=492&aid=311&itype=n&ver=13892&tm=491&src=ds&p={searchTerms}

SearchScopes: HKU\S-1-5-21-3449447305-1594401728-24528855-1001 -> DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = 

SearchScopes: HKU\S-1-5-21-3449447305-1594401728-24528855-1001 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = hxxp://www.default-search.net/search?sid=492&aid=311&itype=n&ver=13892&tm=491&src=ds&p={searchTerms}

FF SearchEngineOrder.1: Mozilla\Firefox\Profiles\hsop94mb.default -> default-search.net

FF Plugin HKU\S-1-5-21-3449447305-1594401728-24528855-1000: box.com/BoxEdit -> C:\Users\Maria\AppData\Local\Box\Box Edit\npBoxEdit.dll [No File]

2017-04-17 15:00 - 2017-04-24 11:25 - 00000000 ____D C:\ProgramData\boost_interprocess

CustomCLSID: HKU\S-1-5-21-3449447305-1594401728-24528855-1000_Classes\CLSID\{CB492AF1-2CEF-4E58-BE47-471C77D0C8BA}\InprocServer32 -> C:\Users\Maria\AppData\Local\Google\Update\1.3.32.7\psuser_64.dll => No File

Task: {938BA116-270A-4622-95D2-B5389B5AAB30} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-31] (Google Inc.)

Task: {E0D3D612-C1F5-424C-BDEB-5C1C1AD546C9} - \WSE_Astromenda -> No File <==== ATTENTION

Task: C:\windows\Tasks\WSE_Astromenda.job => C:\Users\Maria\AppData\Roaming\WSE_Astromenda\UpdateProc\UpdateTask.exe <==== ATTENTION

C:\Users\Maria\AppData\Roaming\WSE_Astromenda

ShortcutWithArgument: C:\Users\Maria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ruby 1.9.3-p448\Start Command Prompt with Ruby.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation) -> /E:ON /K C:\Program Files (x86)\Heroku\ruby-1.9.3\bin\setrbvars.bat

ShortcutWithArgument: C:\Users\Maria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Qt 5.2.0\5.2.0\MinGW 4.8 (32-bit)\Qt 5.2.0 for Desktop (MinGW 4.8 32 bit).lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation) -> /A /Q /K C:\Qt\Qt5.2.0\5.2.0\mingw48_32\bin\qtenv2.bat

 CMD: bitsadmin /reset /allusers

CMD: netsh winsock reset catalog

CMD: ipconfig /flushdns

RemoveProxy:

hosts:

Emptytemp:

*****************

 

Processes closed successfully.

Restore point was successfully created.

HKU\S-1-5-21-3449447305-1594401728-24528855-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{328cb4d3-ed99-11e3-bf20-c8f7336cb735} => key removed successfully

HKCR\CLSID\{328cb4d3-ed99-11e3-bf20-c8f7336cb735} => key not found. 

HKLM\System\CurrentControlSet\Control\Session Manager\\BootExecute => value restored successfully

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer => key removed successfully

HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully

HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => value restored successfully

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => value restored successfully

HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully

HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully

HKU\S-1-5-21-3449447305-1594401728-24528855-1000\Software\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully

HKU\S-1-5-21-3449447305-1594401728-24528855-1000\Software\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache => value removed successfully

HKU\S-1-5-21-3449447305-1594401728-24528855-1001\Software\Microsoft\Internet Explorer\Main\\Start Page => Error setting value.

[zep516]

Hello,

A few more scans to run,

Next

Download AdwCleaner from here. Save the file to the desktop.
NOTE: If you are using IE 8 or above you may get a warning that stops the program from downloading. Just click on the warning and allow the download to complete.
Close all open windows and browsers.

• XP users: Double click the AdwCleaner icon to start the program.
• Vista/7/8 users: Right click the AdwCleaner icon on the desktop, click Run as administrator and accept the UAC prompt to run AdwCleaner.
  You will see the following console:

• Click the Scan button and wait for the scan to finish.
• After the Scan has finished the window may or may not show what it found and above, in the progress bar, you will see: Pending. Please uncheck elements you don't want to remove.
• Click the Clean button.
• Everything checked will be moved to Quarantine.
• When the program has finished cleaning a report appears.Once done it will ask to reboot, allow this

• On reboot a log will be produced please copy / paste that in your next reply. This report is also saved to C:\AdwCleaner\AdwCleaner[C0].txt

Next

• Please download Junkware Removal Tool to your Desktop.
• Please close your security software to avoid potential conflicts. See Here how to disable you security protection (Anti Virus)
• Run the tool by double-clicking it. If you are using Windows Vista or 7, right-mouse click it and select Run as administrator.
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete, depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your Desktop and will automatically open.
• Please post the contents of JRT.txt into your reply.

[mara_frank]

# AdwCleaner v6.046 - Logfile created 24/04/2017 at 18:42:26

# Updated on 24/04/2017 by Malwarebytes

# Database : 2017-04-24.1 [Server]

# Operating System : Windows 7 Professional Service Pack 1 (X64)

# Username : Maria - MARIA-PC

# Running from : C:\Users\Maria\Downloads\adwcleaner_6.046.exe

# Mode: Clean

# Support : https://www.malwarebytes.com/support

 

 

 

***** [ Services ] *****

 

 

 

***** [ Folders ] *****

 

[-] Folder deleted: C:\Users\Maria\AppData\Local\Astromenda

 

 

***** [ Files ] *****

 

[-] File deleted: C:\Users\Maria\AppData\Roaming\Mozilla\Firefox\Profiles\hsop94mb.default\extensions\{b64d9b05-48e1-4ceb-bf58-e0643994e900}.xpi

[-] File deleted: C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\default-search.xml

[#] File deleted: C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\default-search.xml

[#] File deleted: C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\default-search.xml

 

 

***** [ DLL ] *****

 

 

 

***** [ WMI ] *****

 

 

 

***** [ Shortcuts ] *****

 

 

 

***** [ Scheduled Tasks ] *****

 

[-] Task deleted: WSE_Astromenda

[-] Task deleted: WSE_Astromenda

 

 

***** [ Registry ] *****

 

[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\{9CB2CD61-FFA0-406C-9D2D-8FDE6F4A4D8A}

[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}

[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{FCE1662E-06F1-413D-80CB-33D456D1CFCB}

[-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}

[-] Value deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}]

[-] Key deleted: HKU\S-1-5-21-3449447305-1594401728-24528855-1000\Software\BRS

[-] Key deleted: HKU\S-1-5-21-3449447305-1594401728-24528855-1000\Software\OB

[-] Key deleted: HKU\S-1-5-21-3449447305-1594401728-24528855-1000\Software\Squeaky

[-] Key deleted: HKU\S-1-5-21-3449447305-1594401728-24528855-1000\Software\SupHpUISoft

[-] Key deleted: HKU\S-1-5-21-3449447305-1594401728-24528855-1000\Software\WSE_Astromenda

[#] Key deleted on reboot: HKCU\Software\BRS

[#] Key deleted on reboot: HKCU\Software\OB

[#] Key deleted on reboot: HKCU\Software\Squeaky

[#] Key deleted on reboot: HKCU\Software\SupHpUISoft

[#] Key deleted on reboot: HKCU\Software\WSE_Astromenda

[-] Key deleted: HKLM\SOFTWARE\Clara

[-] Key deleted: HKLM\SOFTWARE\LookSafe

[-] Key deleted: HKLM\SOFTWARE\SmdmF

[-] Key deleted: HKLM\SOFTWARE\V9Software

[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WSE_Astromenda

[#] Key deleted on reboot: [x64] HKCU\Software\BRS

[#] Key deleted on reboot: [x64] HKCU\Software\OB

[#] Key deleted on reboot: [x64] HKCU\Software\Squeaky

[#] Key deleted on reboot: [x64] HKCU\Software\SupHpUISoft

[#] Key deleted on reboot: [x64] HKCU\Software\WSE_Astromenda

[-] Key deleted: HKU\S-1-5-21-3449447305-1594401728-24528855-1000\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2492}

[#] Key deleted on reboot: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2492}

[-] Key deleted: HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2492}

[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2492}

[-] Key deleted: [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2492}

 

 

***** [ Web browsers ] *****

 

[-] Firefox preferences cleaned: "browser.search.order.1" -  "default-search.net"

[-] [C:\Users\Maria\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: booedmolknjekdopkepjjeckmjkdpfgl

[-] [C:\Users\Maria\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: flpcjncodpafbgdpnkljologafpionhb

 

 

*************************

 

:: "Tracing" keys deleted

:: Winsock settings cleared

 

*************************

 

C:\AdwCleaner\AdwCleaner[C0].txt - [3955 Bytes] - [24/04/2017 18:42:26]

C:\AdwCleaner\AdwCleaner[S0].txt - [3959 Bytes] - [24/04/2017 18:33:51]

 

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [4101 Bytes] ##########

 

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Malwarebytes

Version: 8.1.3 (04.10.2017)

Operating System: Windows 7 Professional x64 

Ran by Maria (Administrator) on 24.04.2017 at 18:47:19,56

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

 

 

File System: 25 

 

Successfully deleted: C:\Users\Maria\AppData\Roaming\dg (Folder) 

Successfully deleted: C:\Users\Maria\AppData\Roaming\Mozilla\Firefox\Profiles\hsop94mb.default\searchplugins\youtube-video-search.xml (File) 

Successfully deleted: C:\Users\Maria\AppData\Roaming\Mozilla\Firefox\Profiles\hsop94mb.default\user.js (File) 

Successfully deleted: C:\Users\Maria\AppData\Roaming\new version available (Folder) 

Successfully deleted: C:\windows\system32\drivers\dgsafe.sys (File) 

Successfully deleted: C:\windows\system32\Tasks\AviraSystemSpeedupUpdate (Task)

Successfully deleted: C:\windows\Tasks\Driver Easy Scheduled Scan.job (Task) 

Successfully deleted: C:\Program Files (x86)\mydrivers (Folder) 

Successfully deleted: C:\Users\Maria\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M (Temporary Internet Files Folder) 

Successfully deleted: C:\Users\Maria\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1BJJ39UI (Temporary Internet Files Folder) 

Successfully deleted: C:\Users\Maria\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5 (Temporary Internet Files Folder) 

Successfully deleted: C:\Users\Maria\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\94NTTPN0 (Temporary Internet Files Folder) 

Successfully deleted: C:\Users\Maria\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AIA54OVI (Temporary Internet Files Folder) 

Successfully deleted: C:\Users\Maria\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZG8CKJ5 (Temporary Internet Files Folder) 

Successfully deleted: C:\Users\Maria\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H92JTYQE (Temporary Internet Files Folder) 

Successfully deleted: C:\Users\Maria\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LIXMVQOA (Temporary Internet Files Folder) 

Successfully deleted: C:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M (Temporary Internet Files Folder) 

Successfully deleted: C:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1BJJ39UI (Temporary Internet Files Folder) 

Successfully deleted: C:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5 (Temporary Internet Files Folder) 

Successfully deleted: C:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\94NTTPN0 (Temporary Internet Files Folder) 

Successfully deleted: C:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AIA54OVI (Temporary Internet Files Folder) 

Successfully deleted: C:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZG8CKJ5 (Temporary Internet Files Folder) 

Successfully deleted: C:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H92JTYQE (Temporary Internet Files Folder) 

Successfully deleted: C:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LIXMVQOA (Temporary Internet Files Folder) 

Successfully deleted: C:\windows\SysWOW64\RENEEF5.tmp (File) 

 

 

 

Registry: 5 

 

Successfully deleted: HKLM\SYSTEM\CurrentControlSet\services\dgpnpsev (Registry Key) 

Successfully deleted: HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} (Registry Key)

Successfully deleted: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} (Registry Key)

Successfully deleted: HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} (Registry Key)

Successfully deleted: HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} (Registry Key)

 

 

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 24.04.2017 at 18:49:07,16

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

[zep516]

Hello,

If you have time tonight do this

• Please download Malwarebytes Anti-Malware to your desktop.
• Double-click mbam-setup-version.exe and follow the prompts to install the program.
• Launch Malwarebytes Anti-Malware
• Then click Finish.
• If an update is found, you will be prompted to download and install the latest version.
• Once the program has loaded, select Scan now. Or select the Threat Scan from the Scan menu.
• When the scan is complete , make sure that that all Threats are selected, and click Remove Selected.
• Reboot your computer if prompted.
  
  
  Posting the Malwarebytes log.
• After the restart once you are back at your desktop, open MBAM once more.
• Click on the History tab > Application Logs.
• Double click on the Scan Log which shows the Date and time of the scan just performed.
• Click 'Export'.
• Click 'Text file (*.txt)'
• In the Save File dialog box which appears, click on Desktop.
• In the File name: box type a name for your scan log.
• A message box named 'File Saved' should appear stating "Your file has been successfully exported".
• Click Ok
• post that saved log to your next reply.
  
  

[mara_frank]

Malwarebytes

www.malwarebytes.com

 

-Log Details-

Scan Date: 4/24/17

Scan Time: 8:56 PM

Logfile: malware.txt

Administrator: Yes

 

-Software Information-

Version: 3.0.6.1469

Components Version: 1.0.103

Update Package Version: 1.0.1800

License: Trial

 

-System Information-

OS: Windows 7 Service Pack 1

CPU: x64

File System: NTFS

User: Maria-PC\Maria

 

-Scan Summary-

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 365861

Time Elapsed: 2 min, 32 sec

 

-Scan Options-

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

 

-Scan Details-

Process: 0

(No malicious items detected)

 

Module: 0

(No malicious items detected)

 

Registry Key: 1

PUP.Optional.DefaultSearch.ShrtCln, HKU\S-1-5-21-3449447305-1594401728-24528855-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2492}, Quarantined, [10528], [237679],1.0.1800

 

Registry Value: 7

PUP.Optional.DefaultSearch.ShrtCln, HKU\S-1-5-21-3449447305-1594401728-24528855-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2492}|URL, Quarantined, [10528], [237679],1.0.1800

PUP.Optional.Astromenda, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY|APPPATH, Quarantined, [1940], [235613],1.0.1800

PUP.Optional.DefaultSearch.ShrtCln, HKU\S-1-5-21-3449447305-1594401728-24528855-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2492}|DISPLAYNAME, Quarantined, [10528], [237679],1.0.1800

PUP.Optional.DefaultSearch.ShrtCln, HKU\S-1-5-21-3449447305-1594401728-24528855-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2492}|SUGGESTIONSURL_JSON, Quarantined, [10528], [237679],1.0.1800

PUP.Optional.Bandoo.AppFlsh, HKU\S-1-5-21-3449447305-1594401728-24528855-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2492}|FAVICONPATH, Quarantined, [9234], [253585],1.0.1800

PUP.Optional.Bandoo.AppFlsh, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS|APPINIT_DLLS, Quarantined, [9234], [-1],0.0.0

PUP.Optional.Bandoo.AppFlsh, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS|APPINIT_DLLS, Quarantined, [9234], [-1],0.0.0

 

Registry Data: 3

Trojan.DNSChanger, HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{0F98EC13-080A-4D74-A9F7-0164C08474B9}|NameServer, Replaced, [1728], [293670],1.0.1800

Trojan.DNSChanger, HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{0F98EC13-080A-4D74-A9F7-0164C08474B9}|NameServer, Replaced, [1728], [293686],1.0.1800

PUP.Optional.Astromenda, HKU\S-1-5-21-3449447305-1594401728-24528855-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|START PAGE, Replaced, [1940], [293033],1.0.1800

 

Data Stream: 0

(No malicious items detected)

 

Folder: 0

(No malicious items detected)

 

File: 1

PUP.Optional.InstallCore, C:\PROGRAM FILES (X86)\FREE VIDEO TO AUDIO CONVERTER 2014\FREEVIDEOTOAUDIOCONVERTER.EXE, Quarantined, [3], [334528],1.0.1800

 

Physical Sector: 0

(No malicious items detected)

 

 

(end)

[zep516]

Hello,

That looks good. What issues remain ? If you need to run the computer for a while and let me know about any problems still occurring .

Thanks
Joe

[mara_frank]

Thank you!!!!

I really appreciate your help throughout the day.

 

The issue for now seems to be resolved!

 

Have a great rest of your day or good night

[zep516]

Hello,

I think we are ok here now.

We need to remove the tools we used.

The following procedures will implement some cleanup procedures to remove these tools. It will also reset your System Restore by flushing out previous restore points and create a new restore point. It will also remove all the backups our tools may have made.
Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).

Why we need to remove some of our tools:
Some of the tools we have used to clean your computer were made by fellow malware fighters and are very powerful and if used incorrectly or at the wronge time can make the computer an expensive paper weight. They are updated all the time and some of them more than once a day so by the time you are ready to use them again they will already be outdated.


Download https://www.bleeping...ownload/delfix/ DelFix by Xplode and save it to your desktop.

• Run the tool by right click on the icon and Run as administrator option.
• Make sure that these ones are checked:
  • Remove disinfection tools
  • Purge system restore
  • Reset system settings
• Push Run.
• The program will run for a few seconds and display a notepad report.
  Paste it for my review.