[Ardent]

A friend recently received an email from me that I did not send. The name was mine in the header but the actual email was something that didn't belong to me. Since then I received an email from  the same person with a generic message and a link to a web address. The address was blocked by my AV program. When I sent the reply back to her asking for affirmation that she sent it, it came back undeliverable and this information.

I am trying to determine if I am infected or if someone got my name and sent it in the header so it would be recognized by my friend? I am not sure what is going on.

554 HVU:B1

• There is at least one URL or domain in your mail headers/hostname that is generating substantial complaints from AOL members and is blocked on our end. To fix the problem, please open a support request.

[Advertisements]

Hi! My name is zep516 and Welcome to Geekstogo!
I'll do the best I can to resolve your computer issue
Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, don't continue Stop and ask! Never be afraid to ask questions!

First of all change your E-Mail password if you have nor done so.

Next
Lets take a look at the computer for possible infection

Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will produce a log called FRST.txt in the same directory the tool is run from.
• Please copy and paste log back here.
• The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

[zep516]

Hi! My name is zep516 and Welcome to Geekstogo!
I'll do the best I can to resolve your computer issue
Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, don't continue Stop and ask! Never be afraid to ask questions!

First of all change your E-Mail password if you have nor done so.

Next
Lets take a look at the computer for possible infection

Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will produce a log called FRST.txt in the same directory the tool is run from.
• Please copy and paste log back here.
• The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

[Ardent]

Thanks for your help, here are the results of the scans.

 

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 26-04-2017
Ran by NewPC (26-04-2017 13:29:49)
Running from C:\Users\NewPC\Desktop\Downloads
Windows 7 Home Premium Service Pack 1 (X64) (2014-07-31 19:49:55)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-559702275-2648494096-679061964-500 - Administrator - Disabled)
Guest (S-1-5-21-559702275-2648494096-679061964-501 - Limited - Enabled)
HomeGroupUser$ (S-1-5-21-559702275-2648494096-679061964-1002 - Limited - Enabled)
NewPC (S-1-5-21-559702275-2648494096-679061964-1000 - Administrator - Enabled) => C:\Users\NewPC

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Bitdefender Antivirus (Enabled - Up to date) {3FB17364-4FCC-0FA7-6BBF-973897395371}
AS: Bitdefender Antispyware (Enabled - Up to date) {84D09280-69F6-0029-510F-AC4AECBE19CC}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

. . . (Version: 2.1.28.3 - Intel) Hidden
. . . (x32 Version: 2.6.1.4 - Intel) Hidden
µTorrent (HKU\S-1-5-21-559702275-2648494096-679061964-1000\...\uTorrent) (Version: 3.5.0.43580 - BitTorrent Inc.)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Accidental Damage Services Agreement (HKLM-x32\...\{EF85FEF4-EB92-4075-A6D2-5F519BB30A2C}) (Version: 2.0.0 - Dell Inc.)
AdFender (HKLM-x32\...\AdFender) (Version: 1.83 - AdFender, Inc.)
Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 17.009.20044 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 18.0.0.144 - Adobe Systems Incorporated)
Adobe Community Help (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.5.23 - Adobe Systems Incorporated.)
Adobe Digital Editions 4.5 (HKLM-x32\...\Adobe Digital Editions 4.5) (Version: 4.5.0 - Adobe Systems Incorporated)
Adobe Flash Player 18 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 18.0.0.232 - Adobe Systems Incorporated)
Adobe Flash Player 25 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 25.0.0.148 - Adobe Systems Incorporated)
Adobe Flash Player 25 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 25.0.0.148 - Adobe Systems Incorporated)
Adobe Photoshop Elements 9 (HKLM-x32\...\Adobe Photoshop Elements 9) (Version: 9.0 - Adobe Systems Incorporated)
Adobe Photoshop.com Inspiration Browser (HKLM-x32\...\PhotoshopdotcomInspirationBrowser.4C35C4D325D350FE0114230CBADCA2DDD0AC8D25.1) (Version: 3.07 - Adobe Systems Incorporated)
Adobe Premiere Elements 9 (HKLM-x32\...\PremElem90) (Version: 9.0 - Adobe Systems Incorporated)
Adobe Premiere Elements 9 Content (HKLM-x32\...\Adobe Premiere Elements 9 Content) (Version: 9.0 - Adobe Systems Incorporated)
AirPort (HKLM-x32\...\{AA68AAAE-41F0-40B5-8896-5947F5FD6889}) (Version: 5.6.1.2 - Apple Inc.)
Amazon Drive (HKU\S-1-5-21-559702275-2648494096-679061964-1000\...\Amazon Drive) (Version: 4.0.10 - Amazon.com, Inc.)
Amazon Kindle (HKU\S-1-5-21-559702275-2648494096-679061964-1000\...\Amazon Kindle) (Version: 1.15.0.43061 - Amazon)
Apple Application Support (32-bit) (HKLM-x32\...\{05E07D23-91E9-4E70-A4CC-EF505088F967}) (Version: 5.4.1 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{741291DA-2B34-4D44-8FB6-58EDE21261D8}) (Version: 5.4.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{DB18F1C0-846F-46F5-A074-5B97C8AF5C8E}) (Version: 10.3.1.2 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{52D87F32-70E4-4348-8148-C0B9F35B1314}) (Version: 2.3.0.177 - Apple Inc.)
Banctec Service Agreement (HKLM-x32\...\{42D68A86-DB1C-4256-B8C9-5D0D92919AF5}) (Version: 2.0.0 - Dell Inc.)
Bitdefender Agent (HKLM\...\Bitdefender Agent) (Version: 21.0.18.898 - Bitdefender)
Bitdefender Antivirus Plus 2017 (HKLM\...\Bitdefender) (Version: 21.0.18.898 - Bitdefender)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
calibre (HKLM-x32\...\{7303645B-7FEE-4435-887C-20F58362A18F}) (Version: 2.73.0 - Kovid Goyal)
CameraHelperMsi (x32 Version: 13.51.815.0 - Logitech) Hidden
Canon Easy-PhotoPrint EX (HKLM-x32\...\Easy-PhotoPrint EX) (Version: 4.5.0 - Canon Inc.)
Canon IJ Network Scan Utility (HKLM-x32\...\Canon_IJ_Network_Scan_UTILITY) (Version:  - )
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version:  - )
Canon MP Navigator EX 2.1 (HKLM-x32\...\MP Navigator EX 2.1) (Version:  - )
Canon MX860 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX860_series) (Version:  - )
Canon MX860 series User Registration (HKLM-x32\...\Canon MX860 series User Registration) (Version:  - )
Canon Utilities My Printer (HKLM-x32\...\CanonMyPrinter) (Version:  - )
Canon Utilities Solution Menu (HKLM-x32\...\CanonSolutionMenu) (Version:  - )
CCleaner (HKLM\...\CCleaner) (Version: 5.07 - Piriform)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Combined Community Codec Pack 64bit 2015-10-18 (HKLM\...\Combined Community Codec Pack 64bit_is1) (Version: 2015.10.19.0 - CCCP Project)
Complete Care Business Service Agreement (HKLM-x32\...\{0ECFCB07-9BFE-4970-ACA1-D568D982760B}) (Version: 2.0.0 - Dell Inc.)
Consumer In-Home Service Agreement (HKLM-x32\...\{F47C37A4-7189-430A-B81D-739FF8A7A554}) (Version: 2.0.0 - Dell Inc.)
CopyTrans Control Center Uninstall Only (HKU\S-1-5-21-559702275-2648494096-679061964-1000\...\CopyTrans Suite) (Version: 4.013 - WindSolutions)
Dell Data Vault (Version: 4.2.2.0 - Dell Inc.) Hidden
Dell Digital Delivery (HKLM-x32\...\{D850CB7E-72BC-4510-BA4F-48932BFAB295}) (Version: 2.9.901.0 - Dell Products, LP)
Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)
Dell Home Systems Service Agreement (HKLM-x32\...\{AB2FDE4F-6BED-4E9E-B676-3DCCEBB1FBFE}) (Version: 2.0.0 - Dell Inc.)
Dell SupportAssist (HKLM\...\PC-Doctor for Windows) (Version: 1.3.6855.212 - Dell)
Dell SupportAssistAgent (HKLM-x32\...\{1AE53ECE-2255-4191-998B-07741E5EFCDA}) (Version: 1.4.1.8 - Dell)
Dell Update (HKLM-x32\...\{DB82968B-57A4-4397-81A5-ECAB21B5DFCD}) (Version: 1.7.1015.0 - Dell Inc.)
Dell WLAN and Bluetooth Client Installation (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Dell Inc.)
Dropbox (HKU\S-1-5-21-559702275-2648494096-679061964-1000\...\Dropbox) (Version: 24.4.16 - Dropbox, Inc.)
DVD Flick 1.3.0.7 (HKLM-x32\...\DVD Flick_is1) (Version: 1.3.0.7 - Dennis Meuwissen)
Elements 9 Organizer (x32 Version: 9.0 - Adobe Systems Incorporated) Hidden
erLT (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
FastStone Image Viewer 5.1 (HKLM-x32\...\FastStone Image Viewer) (Version: 5.1 - FastStone Soft)
Freemake Audio Converter version 1.1.8 (HKLM-x32\...\Freemake Audio Converter_is1) (Version: 1.1.8 - Ellora Assets Corporation)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 57.0.2987.133 - Google Inc.)
Google Drive (HKLM-x32\...\{A1238426-ECDF-4639-BE2F-8D12A97AE23C}) (Version: 2.34.5075.1619 - Google, Inc.)
Google Talk Plugin (HKLM-x32\...\{F9B579C2-D854-300A-BE62-A09EB9D722E4}) (Version: 5.41.3.0 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.33.3 - Google Inc.) Hidden
HandBrake 0.10.2 (HKLM-x32\...\HandBrake) (Version: 0.10.2 - )
iCloud (HKLM\...\{4BB313CE-D3D1-424C-8823-15CF85B00B05}) (Version: 6.1.0.30 - Apple Inc.)
Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.23.1766 - Intel Corporation)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.14.4414 - Intel Corporation)
Intel® Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.7.3.1001 - Intel Corporation)
Intel® Driver Update Utility (HKLM-x32\...\{fe2eebd3-ee15-4538-bb19-b627e3f2a911}) (Version: 2.6.1.4 - Intel)
iTunes (HKLM\...\{164600BE-9CEC-44E6-9B38-2B12D5FE2342}) (Version: 12.6.0.100 - Apple Inc.)
Logitech Webcam Software (HKLM-x32\...\{D40EB009-0499-459c-A8AF-C9C110766215}) (Version: 2.51 - Logitech Inc.)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Mouse and Keyboard Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.3.188.0 - Microsoft Corporation)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 53.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 53.0 (x86 en-US)) (Version: 53.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 53.0.0.6312 - Mozilla)
MP3 Parser DirectShow Filter (remove only) (HKLM-x32\...\mp3parse) (Version:  - )
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser and SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
MusicBee 2.3 (HKLM-x32\...\MusicBee) (Version: 2.3 - Steven Mayall)
OverDrive for Windows (HKLM-x32\...\{FF27E73D-C30A-4F32-B2D7-22069F01DDB9}) (Version: 3.6.0 - OverDrive, Inc.)
Premium Service Agreement (HKLM-x32\...\{C33AA6D6-F5EC-48F3-AFDC-8141345D473A}) (Version: 2.0.0 - Dell Inc.)
Private Internet Access Support Files (HKLM-x32\...\{7D72DAFF-DCB2-437B-BC22-4B2ABF21462B}) (Version: 1.0.0.0 - Private Internet Access)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.1.330 - Qualcomm Atheros Communications)
QualxServ Service Agreement (HKLM-x32\...\{903679E8-44C8-4C07-9600-05C92654FC50}) (Version: 2.0.0 - Dell Inc.)
QuickBooks (x32 Version: 20.0.4017.807 - Intuit Inc.) Hidden
QuickBooks Simple Start 2010 (HKLM-x32\...\{0700E22B-A420-40A5-BD20-04BF618CA0F9}) (Version: 20.0.4017.807 - Intuit Inc.)
QuickTime 7 (HKLM-x32\...\{FF59BD75-466A-4D5A-AD23-AAD87C5FD44C}) (Version: 7.79.80.95 - Apple Inc.)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.30164 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7004 - Realtek Semiconductor Corp.)
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.15041.2 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.15041.2 - Samsung Electronics Co., Ltd.) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{91140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{A3364707-2F53-4C83-8F68-C9877A9080C7}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version:  - Microsoft) Hidden
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
SmartSound Quicktracks for Premiere Elements 9.0 (HKLM-x32\...\InstallShield_{6748E773-5DA0-4D19-8AA5-273B4133A09B}) (Version: 3.12.3090 - SmartSound Software Inc)
SmartSound Quicktracks for Premiere Elements 9.0 (x32 Version: 3.12.3090 - SmartSound Software Inc) Hidden
The Print Shop 2.0 Deluxe (HKLM-x32\...\{53E4CE64-629E-4590-AB43-1D8C85A6E621}) (Version: 2.00.0000 - Encore)
VLC media player (HKLM\...\VLC media player) (Version: 2.2.1 - VideoLAN)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.4 - VideoLAN)
WD Drive Utilities (HKLM-x32\...\{eab1fb93-61fb-48de-b815-b4e9b68d2ef1}) (Version: 1.3.2.2 - Western Digital Technologies, Inc.)
WD Drive Utilities (x32 Version: 1.3.2.2 - Western Digital Technologies, Inc.) Hidden
WD Quick View (HKLM-x32\...\{F4F2EF32-EAFE-4F87-B7DC-E19C9F8E76FC}) (Version: 2.4.16.16 - Western Digital Technologies, Inc.)
WD SmartWare (HKLM\...\{515B34CA-1229-4EDA-AE7C-53CBA68B8A7A}) (Version: 2.4.16.16 - Western Digital Technologies, Inc.)
WD SmartWare Installer (HKLM-x32\...\{4555885d-a64c-4234-9aac-72a8a6b5590b}) (Version: 2.4.16.16 - Western Digital Technologies, Inc.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-559702275-2648494096-679061964-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\NewPC\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-559702275-2648494096-679061964-1000_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-559702275-2648494096-679061964-1000_Classes\CLSID\{8C46158B-D978-483C-A312-16EE5013BE04}\InprocServer32 -> C:\Users\NewPC\AppData\Local\Google\Update\1.3.33.3\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-559702275-2648494096-679061964-1000_Classes\CLSID\{CB492AF1-2CEF-4E58-BE47-471C77D0C8BA}\InprocServer32 -> C:\Users\NewPC\AppData\Local\Google\Update\1.3.32.7\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-559702275-2648494096-679061964-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\NewPC\AppData\Local\Google\Update\1.3.33.3\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-559702275-2648494096-679061964-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\NewPC\AppData\Roaming\Dropbox\bin\DropboxExt64.16.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-559702275-2648494096-679061964-1000_Classes\CLSID\{F6BF8414-962C-40FE-90F1-B80A7E72DB9A}\InprocServer32 -> C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\fwcfg.dll => No File <==== ATTENTION
CustomCLSID: HKU\S-1-5-21-559702275-2648494096-679061964-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\NewPC\AppData\Roaming\Dropbox\bin\DropboxExt64.16.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-559702275-2648494096-679061964-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\NewPC\AppData\Roaming\Dropbox\bin\DropboxExt64.16.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-559702275-2648494096-679061964-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\NewPC\AppData\Roaming\Dropbox\bin\DropboxExt64.16.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-559702275-2648494096-679061964-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\NewPC\AppData\Roaming\Dropbox\bin\DropboxExt64.16.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-559702275-2648494096-679061964-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\NewPC\AppData\Roaming\Dropbox\bin\DropboxExt64.16.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-559702275-2648494096-679061964-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\NewPC\AppData\Roaming\Dropbox\bin\DropboxExt64.16.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-559702275-2648494096-679061964-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\NewPC\AppData\Roaming\Dropbox\bin\DropboxExt64.16.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-559702275-2648494096-679061964-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\NewPC\AppData\Roaming\Dropbox\bin\DropboxExt64.16.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-559702275-2648494096-679061964-1000_Classes\CLSID\{FB314EE1-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\NewPC\AppData\Roaming\Dropbox\bin\DropboxExt64.16.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-559702275-2648494096-679061964-1000_Classes\CLSID\{FB314EE2-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\NewPC\AppData\Roaming\Dropbox\bin\DropboxExt64.16.0.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-559702275-2648494096-679061964-1000_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\NewPC\AppData\Roaming\Dropbox\bin\DropboxExt64.16.0.dll (Dropbox, Inc.)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {04C81B94-6154-4BFB-81A3-6E726E4B7F8B} - System32\Tasks\USER_ESRV_SVC_WILLAMETTE => Wscript.exe //B //NoLogo "C:\Program Files\Intel\SUR\WILLAMETTE\ESRV\task.vbs"
Task: {0E345E7D-209F-445E-B004-51EA9437BF23} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)
Task: {114F90D1-B1B9-4941-9130-678925892472} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2017-02-02] (Adobe Systems Incorporated)
Task: {1872A2EB-9AC0-4276-83B9-EA962FAFCF35} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\Dell\SupportAssist\sessionchecker.exe [2017-04-18] (PC-Doctor, Inc.)
Task: {1ED9269F-E1BD-41E5-9C15-3C994D1FCD01} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe
Task: {2470023A-E77F-4961-AFD4-1425215E4D85} - System32\Tasks\PCDDataUploadTask => uaclauncher.exe
Task: {270C1915-920A-4944-8DF7-45E83A957728} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {2AC135AA-96DA-4DFE-85EF-20AA7C618D97} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)
Task: {3713CE0B-B04C-45BE-9756-44C94838BFEB} - System32\Tasks\Intel\Intel Telemetry 2 => C:\Program Files\Intel\Telemetry 2.0\lrio.exe [2016-03-17] (Intel Corporation)
Task: {3F16E1F0-E6FA-459D-8DBF-CAE29486B5FD} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2017-02-14] (Apple Inc.)
Task: {41E8B189-8073-478A-BC28-43A0F40CCE07} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {4250F003-3D85-4653-AF2A-88A43A545F7A} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {5448D36E-1A78-45FA-9B5B-3906945A908F} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-559702275-2648494096-679061964-1000UA => C:\Users\NewPC\AppData\Local\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)
Task: {6925C2B2-0734-4DA6-BB10-5DBB049A496F} - System32\Tasks\Western Digital\SmartWare\____Volume_452c1045_1683_11e4_8bf4_806e6f6e6963______Volume_9e49adad_18ea_11e4_83c2_9cad978816e4__ => C:\Program Files (x86)\Western Digital\WD SmartWare\BackupTask.exe [2016-04-19] (Western Digital Technologies, Inc.)
Task: {6987F28D-1B6C-4B70-988A-D1EBE4F7D26B} - System32\Tasks\Private Internet Access Startup => C:\Program Files\pia_manager\pia_manager.exe [2017-04-10] ()
Task: {6A5C664F-30E5-4D8F-95F4-1D89A6A8368A} - System32\Tasks\Bitdefender Agent WatchDog_65D6944A0EF74FDAB96E31112AD39864 => C:\Program Files\Bitdefender Agent\WatchDog.exe [2017-02-02] (Bitdefender)
Task: {6FD85F44-AF0D-4388-829E-809E24ED620A} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\Dell\SupportAssist\uaclauncher.exe [2017-04-18] (PC-Doctor, Inc.)
Task: {74A35990-E5C1-4D26-BB9D-52A386264C41} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2014-03-19] (Microsoft)
Task: {7F7C5CF0-F247-4027-A843-8BAABD8492F9} - System32\Tasks\Bitdefender Update Product Data_A17FD818A96743FAB28AC221BEB4B2C8 => C:\Program Files\Bitdefender\Bitdefender 2015\bdproductdata.exe
Task: {9578CBAB-0292-4DEF-8D27-5EA6F801B8D5} - System32\Tasks\{352C76E8-C36C-417F-B94D-AF1E72123118} => pcalua.exe -a D:\setup.exe -d D:\
Task: {B0656762-6869-497B-BD32-F024C3A40CD9} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-559702275-2648494096-679061964-1000Core => C:\Users\NewPC\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2016-11-04] (Dropbox, Inc.)
Task: {C16CE67C-BB1C-45CB-8C58-C0C3BDE58B86} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-559702275-2648494096-679061964-1000UA => C:\Users\NewPC\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2016-11-04] (Dropbox, Inc.)
Task: {C45922C1-18CF-4CF5-98BB-82CD9A8502BA} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {C5654B1E-380B-45C4-A08D-019E037894B3} - System32\Tasks\{CB20AA66-AF43-4D4B-8C56-47E7E20F2F31} => pcalua.exe -a D:\setup.exe -d D:\
Task: {C825B3E7-8840-4E5A-B741-B552071052F6} - System32\Tasks\Dell SupportAssistAgent AutoUpdate => C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssist.exe [2017-04-13] (Dell Inc.)
Task: {D07D9A1A-A50A-4BE6-B281-C4AC324CDB6F} - System32\Tasks\{28E346E9-AB62-4C1F-8CA7-B7947F5DFBA4} => Firefox.exe hxxp://ui.skype.com/ui/0/6.22.81.104/en/eula?source=lightinstaller
Task: {D122202A-6A7B-41F6-8798-8625FEA7674D} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-06-01] (Piriform Ltd)
Task: {D58C36FF-4FF0-425C-9A8E-948CCEB0EC18} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-04-24] (Adobe Systems Incorporated)
Task: {F78DA9BF-C7DD-4F36-AAD9-6111C539AF58} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-559702275-2648494096-679061964-1000Core => C:\Users\NewPC\AppData\Local\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)
Task: {F90667CC-E7E4-4189-AADD-850634BDAD34} - System32\Tasks\{1259EC68-CB3B-4A3B-9C20-4CA6F4436425} => C:\Program Files (x86)\iTunes\iTunes.exe

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-559702275-2648494096-679061964-1000Core.job => C:\Users\NewPC\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-559702275-2648494096-679061964-1000UA.job => C:\Users\NewPC\AppData\Local\Dropbox\Update\DropboxUpdate.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2017-04-24 06:19 - 2017-04-24 06:19 - 00111832 _____ () C:\Program Files\Bitdefender\Bitdefender 2017\bdmetrics.dll
2017-02-07 06:59 - 2017-02-07 06:59 - 01008448 _____ () C:\Program Files\Bitdefender\Bitdefender 2017\otengines_02451_003\ashttpbr.mdl
2017-02-07 06:59 - 2017-02-07 06:59 - 00541952 _____ () C:\Program Files\Bitdefender\Bitdefender 2017\otengines_02451_003\ashttpdsp.mdl
2017-02-07 06:59 - 2017-02-07 06:59 - 03243920 _____ () C:\Program Files\Bitdefender\Bitdefender 2017\otengines_02451_003\ashttpph.mdl
2017-02-07 06:59 - 2017-02-07 06:59 - 01544568 _____ () C:\Program Files\Bitdefender\Bitdefender 2017\otengines_02451_003\ashttprbl.mdl
2010-10-20 13:23 - 2010-10-20 13:23 - 08801632 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2013-09-04 22:17 - 2013-09-04 22:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2017-03-16 16:08 - 2017-03-16 16:08 - 01354040 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2016-09-01 18:12 - 2016-09-01 18:12 - 00092472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2014-08-27 21:11 - 2014-08-27 21:11 - 00086016 _____ () C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\Modules\Map\MAP.dll
2016-06-08 18:04 - 2016-06-08 18:04 - 00117400 _____ () C:\Program Files (x86)\Intel Driver Update Utility\SUR\SurSvc.exe
2016-06-08 18:04 - 2016-06-08 18:04 - 00256152 _____ () C:\Program Files (x86)\Intel Driver Update Utility\SUR\analyzer.dll
2017-04-24 06:15 - 2017-04-24 06:15 - 00023328 _____ () C:\Program Files\Bitdefender\Bitdefender 2017\lang\en-US\bdsystray.txtui
2017-03-22 18:14 - 2017-03-22 18:14 - 01354040 _____ () C:\Program Files\iTunes\libxml2.dll
2017-03-22 18:14 - 2017-03-22 18:14 - 00092472 _____ () C:\Program Files\iTunes\zlib1.dll
2015-12-12 14:48 - 2016-11-16 14:52 - 00075776 _____ () C:\Program Files (x86)\Common Files\Freemake Shared\ProductUpdater\ProductUpdater.exe
2014-07-28 09:26 - 2013-12-09 15:27 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\ACE.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\NewPC\Amazon Drive:com.amazon.drive.sync [87]
AlternateDataStreams: C:\Users\NewPC\Amazon Drive:com.amazon.drive.sync.root [42]
AlternateDataStreams: C:\Users\NewPC\Downloads\DellSystemDetect.exe:BDU [0]
AlternateDataStreams: C:\Users\NewPC\Downloads\dvdflick_setup_1.3.0.7.exe:BDU [0]
AlternateDataStreams: C:\Users\NewPC\Downloads\flashplayer17au_fa_install.exe:BDU [0]
AlternateDataStreams: C:\Users\NewPC\Downloads\Install_CopyTransControlCenter.exe:BDU [0]
AlternateDataStreams: C:\Users\NewPC\Downloads\IPx64_1033_8.01.249.0.exe:BDU [0]
AlternateDataStreams: C:\Users\NewPC\Downloads\IPx64_1033_8.20.468.0.exe:BDU [0]
AlternateDataStreams: C:\Users\NewPC\Downloads\mbam-setup-2.1.4.1018.exe:BDU [0]
AlternateDataStreams: C:\Users\NewPC\Downloads\PeerBlock-Setup_v1.2_r693.exe:BDU [0]
AlternateDataStreams: C:\Users\NewPC\Downloads\reflectdl.exe:BDU [0]
AlternateDataStreams: C:\Users\NewPC\Downloads\uTorrent.exe:BDU [0]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-559702275-2648494096-679061964-1000\...\dell.com -> dell.com
IE trusted site: HKU\S-1-5-21-559702275-2648494096-679061964-1000\...\localhost -> localhost
IE trusted site: HKU\S-1-5-21-559702275-2648494096-679061964-1000\...\webcompanion.com -> hxxp://webcompanion.com

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 19:34 - 2017-04-26 13:26 - 00000002 ____A C:\Windows\system32\Drivers\etc\hosts



==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-559702275-2648494096-679061964-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\NewPC\AppData\Roaming\FastStone\FSIV\FSViewerWallPaper.bmp
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

MSCONFIG\Services: AdobeARMservice => 2
MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
MSCONFIG\Services: AtherosSvc => 2
MSCONFIG\Services: bthserv => 3
MSCONFIG\Services: Freemake Improver => 2
MSCONFIG\Services: SkypeUpdate => 2
MSCONFIG\Services: ZAtheros Wlan Agent => 2
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk => C:\Windows\pss\QuickBooks Update Agent.lnk.CommonStartup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: AdobeAAMUpdater-1.0 => "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
MSCONFIG\startupreg: ApplePhotoStreams => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
MSCONFIG\startupreg: BCSSync => "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
MSCONFIG\startupreg: DellSystemDetect =>
MSCONFIG\startupreg: DriveUtilitiesHelper => C:\Program Files (x86)\Western Digital\WD Utilities\WDDriveUtilitiesHelper.exe
MSCONFIG\startupreg: Dropbox Update => "C:\Users\NewPC\AppData\Local\Dropbox\Update\DropboxUpdate.exe" /c
MSCONFIG\startupreg: Google Update => "C:\Users\NewPC\AppData\Local\Google\Update\GoogleUpdate.exe" /c
MSCONFIG\startupreg: GoogleDriveSync => "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart
MSCONFIG\startupreg: iCloudDrive => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe
MSCONFIG\startupreg: iCloudPhotos => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudPhotos.exe
MSCONFIG\startupreg: iCloudServices => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
MSCONFIG\startupreg: IJNetworkScanUtility => C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE
MSCONFIG\startupreg: Intuit SyncManager => C:\Program Files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe  startup
MSCONFIG\startupreg: LWS => C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe -hide
MSCONFIG\startupreg: OfficeSyncProcess => "C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE"
MSCONFIG\startupreg: ProductUpdater => C:\Program Files (x86)\Common Files\Freemake Shared\ProductUpdater\ProductUpdater.exe
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: RtHDVBg => "C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" /MAXX4
MSCONFIG\startupreg: RtHDVBg_PushButton => "C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe" /IM
MSCONFIG\startupreg: Search Protection =>
MSCONFIG\startupreg: WD Quick View => C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{9A24FF27-1B2A-4A5E-A677-F8EBB48E56AB}] => (Allow) C:\Users\NewPC\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{8C2E54A7-7F46-418D-9AF4-D3DB253AEF04}] => (Allow) C:\Users\NewPC\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{53077D84-57D3-4865-A231-A8A842D87DED}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{EB0610AD-483A-4A96-A454-C62592DAE908}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{B5A6E14F-3E98-4AA4-955E-48D5920932D5}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{7411003B-08E7-4EC3-BDD8-1323E41554FC}] => (Allow) C:\Users\NewPC\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{0E15BB45-E230-44BB-AB94-4A03560D9DE3}] => (Allow) C:\Users\NewPC\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [TCP Query User{240CF752-0BB0-45ED-B982-14B13E2F5F3D}C:\users\newpc\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\newpc\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{8E90A3C3-5BFA-48C2-B622-427B52001E79}C:\users\newpc\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\newpc\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [TCP Query User{6790F156-BF64-4B43-BA25-96DDF39B0837}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{9B1DCF55-BBA7-424C-846C-79697186DD28}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [TCP Query User{E39568D2-F6E2-4362-A3FF-44D939EAEA7C}C:\users\newpc\appdata\roaming\utorrent\updates\3.4.3_40760.exe] => (Allow) C:\users\newpc\appdata\roaming\utorrent\updates\3.4.3_40760.exe
FirewallRules: [UDP Query User{9F757955-1EB6-4D07-BF66-067E4C312052}C:\users\newpc\appdata\roaming\utorrent\updates\3.4.3_40760.exe] => (Allow) C:\users\newpc\appdata\roaming\utorrent\updates\3.4.3_40760.exe
FirewallRules: [TCP Query User{785951AF-426C-41EE-B30F-CF958E358583}C:\program files (x86)\airport\aputil.exe] => (Allow) C:\program files (x86)\airport\aputil.exe
FirewallRules: [UDP Query User{B292C2ED-7A84-4315-927D-AF7A749B02CA}C:\program files (x86)\airport\aputil.exe] => (Allow) C:\program files (x86)\airport\aputil.exe
FirewallRules: [{3691AB5D-8C0A-4464-B107-F1FB0898C509}] => (Allow) C:\Program Files (x86)\AirPort\APAgent.exe
FirewallRules: [{49D07F19-0D78-45DB-B95F-4FA34410ECF3}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{4AF92E87-7FAF-4ABC-BBB6-9BF450C285B3}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{07060BAB-1D3A-4704-B06E-B47A3DC1922F}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{E31F2C24-AE48-4086-A74B-0AC30A50A7B9}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{CD1E7BE2-3C81-49AD-B754-D2B1E34C1594}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{9493CC1A-3A2A-4047-BC2A-C00C7608AEA4}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{9A0E4CD3-1EA1-4EBE-BE72-61DB027C895E}] => (Allow) C:\Program Files (x86)\Western Digital\WD Utilities\WDDriveUtilities.exe
FirewallRules: [{F01D7FDF-3929-4A45-9A1F-55EAAFCDA4C6}] => (Allow) C:\Program Files (x86)\Western Digital\WD Utilities\WDDriveUtilities.exe
FirewallRules: [{B03A5CF3-7F9D-44D5-B511-6BAA96D5609A}] => (Allow) C:\Program Files (x86)\Western Digital\WD Utilities\WDDriveUtilities.exe
FirewallRules: [{7FCBEC07-0A61-4B0E-97CD-1CEC4531C96A}] => (Allow) C:\Program Files (x86)\Western Digital\WD Utilities\WDDriveUtilities.exe
FirewallRules: [TCP Query User{F88371FF-205B-4CCF-A490-98CA9A54AB3D}C:\program files (x86)\airport\aputil.exe] => (Allow) C:\program files (x86)\airport\aputil.exe
FirewallRules: [UDP Query User{7CE90CE8-1480-49BC-B57E-A5B2494F5BDD}C:\program files (x86)\airport\aputil.exe] => (Allow) C:\program files (x86)\airport\aputil.exe
FirewallRules: [{6E5FE969-20CC-4B2B-86FC-56183D446BAB}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{973A14BD-7CF1-4C18-A71D-D6F9C960672B}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Restore Points =========================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (04/26/2017 09:33:11 AM) (Source: Dell System Detect) (EventID: 0) (User: )
Description: <Exception><Type>System.Xml.XmlException</Type><Message><![CDATA[The '/' character, hexadecimal value 0x2F, cannot be included in a name.]]></Message><Source><![CDATA[System.Xml]]></Source><StackTrace><![CDATA[   at System.Xml.XmlDocument.CheckName(String name)
   at System.Xml.XmlDocument.CreateElement(String prefix, String localName, String namespaceURI)
   at eSupport.Common.Client.Core.LastUpdatedHelper.SetLastUpdatedValue(String type, String value)]]></StackTrace><SysInfo STag="GLC3Z12" SMBIOSMajVer="2" SMBIOSMinVer="7" SMBIOSBIOSVer="A04" SMBIOSPresent="True" Rel_Date="20140403000000.000000+000" DSDVersion="" Vendor="Dell Inc." PName="Inspiron 3647" Ident_Num="NEWPC-PC" TimeZone="(UTC-08:00) Pacific Time (US & Canada)" OSName="Microsoft Windows 7 Home Premium"/><Method>UpdateLastUpdatedConfig</Method><HostIP>192.168.1.105</HostIP></Exception>

Error: (04/26/2017 09:33:10 AM) (Source: Dell System Detect) (EventID: 0) (User: )
Description: <Exception><Type>System.Xml.XmlException</Type><Message><![CDATA[The '/' character, hexadecimal value 0x2F, cannot be included in a name.]]></Message><Source><![CDATA[System.Xml]]></Source><StackTrace><![CDATA[   at System.Xml.XmlDocument.CheckName(String name)
   at System.Xml.XmlDocument.CreateElement(String prefix, String localName, String namespaceURI)
   at eSupport.Common.Client.Core.LastUpdatedHelper.SetLastUpdatedValue(String type, String value)]]></StackTrace><SysInfo STag="GLC3Z12" SMBIOSMajVer="2" SMBIOSMinVer="7" SMBIOSBIOSVer="A04" SMBIOSPresent="True" Rel_Date="20140403000000.000000+000" DSDVersion="" Vendor="Dell Inc." PName="Inspiron 3647" Ident_Num="NEWPC-PC" TimeZone="(UTC-08:00) Pacific Time (US & Canada)" OSName="Microsoft Windows 7 Home Premium"/><Method>UpdateLastUpdatedConfig</Method><HostIP>192.168.1.105</HostIP></Exception>

Error: (04/26/2017 09:32:23 AM) (Source: MsiInstaller) (EventID: 11706) (User: NewPC-PC)
Description: Product: Dell Data Vault -- Error 1706. An installation package for the product Dell Data Vault cannot be found. Try the installation again using a valid copy of the installation package 'DDV.msi'.

Error: (04/26/2017 06:00:41 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (04/25/2017 09:44:35 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 15569

Error: (04/25/2017 09:44:35 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 15569

Error: (04/25/2017 09:44:35 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (04/25/2017 09:33:20 AM) (Source: Dell System Detect) (EventID: 0) (User: )
Description: <Exception><Type>System.Xml.XmlException</Type><Message><![CDATA[The '/' character, hexadecimal value 0x2F, cannot be included in a name.]]></Message><Source><![CDATA[System.Xml]]></Source><StackTrace><![CDATA[   at System.Xml.XmlDocument.CheckName(String name)
   at System.Xml.XmlDocument.CreateElement(String prefix, String localName, String namespaceURI)
   at eSupport.Common.Client.Core.LastUpdatedHelper.SetLastUpdatedValue(String type, String value)]]></StackTrace><SysInfo STag="GLC3Z12" SMBIOSMajVer="2" SMBIOSMinVer="7" SMBIOSBIOSVer="A04" SMBIOSPresent="True" Rel_Date="20140403000000.000000+000" DSDVersion="" Vendor="Dell Inc." PName="Inspiron 3647" Ident_Num="NEWPC-PC" TimeZone="(UTC-08:00) Pacific Time (US & Canada)" OSName="Microsoft Windows 7 Home Premium"/><Method>UpdateLastUpdatedConfig</Method><HostIP>192.168.1.105</HostIP></Exception>

Error: (04/25/2017 09:33:19 AM) (Source: Dell System Detect) (EventID: 0) (User: )
Description: <Exception><Type>System.Xml.XmlException</Type><Message><![CDATA[The '/' character, hexadecimal value 0x2F, cannot be included in a name.]]></Message><Source><![CDATA[System.Xml]]></Source><StackTrace><![CDATA[   at System.Xml.XmlDocument.CheckName(String name)
   at System.Xml.XmlDocument.CreateElement(String prefix, String localName, String namespaceURI)
   at eSupport.Common.Client.Core.LastUpdatedHelper.SetLastUpdatedValue(String type, String value)]]></StackTrace><SysInfo STag="GLC3Z12" SMBIOSMajVer="2" SMBIOSMinVer="7" SMBIOSBIOSVer="A04" SMBIOSPresent="True" Rel_Date="20140403000000.000000+000" DSDVersion="" Vendor="Dell Inc." PName="Inspiron 3647" Ident_Num="NEWPC-PC" TimeZone="(UTC-08:00) Pacific Time (US & Canada)" OSName="Microsoft Windows 7 Home Premium"/><Method>UpdateLastUpdatedConfig</Method><HostIP>192.168.1.105</HostIP></Exception>

Error: (04/25/2017 09:32:13 AM) (Source: MsiInstaller) (EventID: 11706) (User: NewPC-PC)
Description: Product: Dell Data Vault -- Error 1706. An installation package for the product Dell Data Vault cannot be found. Try the installation again using a valid copy of the installation package 'DDV.msi'.


System errors:
=============
Error: (04/26/2017 07:28:23 AM) (Source: volsnap) (EventID: 36) (User: )
Description: The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.

Error: (04/26/2017 06:01:02 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}
 and APPID
{344ED43D-D086-4961-86A6-1106F4ACAD9B}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

Error: (04/25/2017 06:05:12 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}
 and APPID
{344ED43D-D086-4961-86A6-1106F4ACAD9B}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

Error: (04/24/2017 05:59:12 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Intel® Management and Security Application Local Management Service service terminated unexpectedly.  It has done this 1 time(s).

Error: (04/24/2017 05:57:29 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}
 and APPID
{344ED43D-D086-4961-86A6-1106F4ACAD9B}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

Error: (04/24/2017 05:55:46 AM) (Source: Service Control Manager) (EventID: 7016) (User: )
Description: The Bitdefender Virus Shield service has reported an invalid current state 0.

Error: (04/23/2017 09:28:06 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: The server {995C996E-D918-4A8C-A302-45719A6F4EA7} did not register with DCOM within the required timeout.

Error: (04/23/2017 12:36:13 PM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk1\DR1.

Error: (04/23/2017 12:36:13 PM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk1\DR1.

Error: (04/23/2017 12:36:11 PM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk1\DR1.


==================== Memory info ===========================

Processor: Intel® Core™ i3-4130 CPU @ 3.40GHz
Percentage of memory in use: 39%
Total physical RAM: 4012.95 MB
Available physical RAM: 2439.17 MB
Total Virtual: 8024.08 MB
Available Virtual: 5584.86 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:911.69 GB) (Free:289.08 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 931.5 GB) (Disk ID: 18B96803)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Active) - (Size=19.8 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=911.7 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 26-04-2017
Ran by NewPC (administrator) on NEWPC-PC (26-04-2017 13:27:42)
Running from C:\Users\NewPC\Desktop\Downloads
Loaded Profiles: NewPC (Available Profiles: NewPC)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2017\vsserv.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Bitdefender) C:\Program Files\Bitdefender Agent\ProductAgentService.exe
(Qualcomm®Atheros®) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Intuit) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
() C:\Program Files (x86)\Intel Driver Update Utility\SUR\SurSvc.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2017\bdagent.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2017\updatesrv.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe
(Apple Inc.) C:\Program Files (x86)\AirPort\APAgent.exe
() C:\Program Files (x86)\Common Files\Freemake Shared\ProductUpdater\ProductUpdater.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
(Dell Inc.) C:\Program Files (x86)\Dell Update\DellUpService.exe
(Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Dell Inc.) C:\Program Files (x86)\Dell Update\DellUpTray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Dell Inc.) C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7194840 2013-07-26] (Realtek Semiconductor)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [286056 2013-07-30] (Intel Corporation)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2114376 2009-07-06] (CANON INC.)
HKLM\...\Run: [CanonSolutionMenu] => C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [722256 2008-12-11] (CANON INC.)
HKLM\...\Run: [Bdagent] => C:\Program Files\Bitdefender\Bitdefender 2017\bdagent.exe [322312 2017-04-24] (Bitdefender)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [303928 2017-03-22] (Apple Inc.)
HKLM-x32\...\Run: [AirPort Base Station Agent] => C:\Program Files (x86)\AirPort\APAgent.exe [771360 2009-11-11] (Apple Inc.)
HKLM-x32\...\Run: [ProductUpdater] => C:\Program Files (x86)\Common Files\Freemake Shared\ProductUpdater\ProductUpdater.exe [75776 2016-11-16] ()
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe [134784 2014-08-27] (Qualcomm®Atheros®)
HKU\S-1-5-21-559702275-2648494096-679061964-1000\...\Run: [Google Update] => C:\Users\NewPC\AppData\Local\Google\Update\1.3.33.3\GoogleUpdateCore.exe [599632 2017-04-11] (Google Inc.)
HKU\S-1-5-21-559702275-2648494096-679061964-1000\...\Run: [OfficeSyncProcess] => C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE [911032 2015-03-18] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [  GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google)
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\NewPC\AppData\Roaming\Dropbox\bin\DropboxExt64.16.0.dll [2017-04-17] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\NewPC\AppData\Roaming\Dropbox\bin\DropboxExt64.16.0.dll [2017-04-17] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\NewPC\AppData\Roaming\Dropbox\bin\DropboxExt64.16.0.dll [2017-04-17] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\NewPC\AppData\Roaming\Dropbox\bin\DropboxExt64.16.0.dll [2017-04-17] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\NewPC\AppData\Roaming\Dropbox\bin\DropboxExt64.16.0.dll [2017-04-17] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\NewPC\AppData\Roaming\Dropbox\bin\DropboxExt64.16.0.dll [2017-04-17] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\NewPC\AppData\Roaming\Dropbox\bin\DropboxExt64.16.0.dll [2017-04-17] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\NewPC\AppData\Roaming\Dropbox\bin\DropboxExt64.16.0.dll [2017-04-17] (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{08015353-7F49-402A-BD25-02D7D8698525}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{17D56B22-C9E1-486C-9E91-03582F899C81}: [DhcpNameServer] 172.20.10.1
Tcpip\..\Interfaces\{2ACFCD5B-58FB-4E8F-ACBB-908781891E7F}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-559702275-2648494096-679061964-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_fremkfs_16_25&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0Fzz0B0CtCtBzz0BtD0ByDyByEzzyB0DtN0D0Tzu0StCyCtAtBtN1L2XzutAtFtBtBtFtAtFzztN1L1Czu1BtAtN1L1G1B1V1N2Y1L1Qzu2StBtB0Bzy0FtB0EtAtGyCtBzz0BtG0E0E0F0BtGtCtBzz0BtGyEzy0D0FyB0D0C0F0FtCyD0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtC0E0B0DtDtCzytGyD0EtAyDtGyEtBzytCtGzz0ByDyEtG0Azy0FyCyB0ByDtBzzzztBtD2QtN0A0LzutB%26cr%3D211167893%26a%3Dwbf_fremkfs_16_25%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium&p={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_fremkfs_16_25&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0Fzz0B0CtCtBzz0BtD0ByDyByEzzyB0DtN0D0Tzu0StCyCtAtBtN1L2XzutAtFtBtBtFtAtFzztN1L1Czu1BtAtN1L1G1B1V1N2Y1L1Qzu2StBtB0Bzy0FtB0EtAtGyCtBzz0BtG0E0E0F0BtGtCtBzz0BtGyEzy0D0FyB0D0C0F0FtCyD0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtC0E0B0DtDtCzytGyD0EtAyDtGyEtBzytCtGzz0ByDyEtG0Azy0FyCyB0ByDtBzzzztBtD2QtN0A0LzutB%26cr%3D211167893%26a%3Dwbf_fremkfs_16_25%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium&p={searchTerms}
SearchScopes: HKLM -> {85A60A59-D3D8-468F-B598-FB4393789EF4} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wcg_fremkfs_17_04&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0Fzz0B0CtCtBzz0BtD0ByDyByEzzyB0DtN0D0Tzu0StCzzyDtBtN1L2XzutAtFtByCtFtBtFyDtCtN1L1Czu1BzytN1L1G1B1V1N2Y1L1Qzu2SyCyD0E0EyD0D0CtAtGtB0CyC0DtGtBzy0AtDtGtCtDtDzytGtBzzyB0FyEzytD0BzzzzyB0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtC0E0B0DtDtCzytGyD0EtAyDtGyEtBzytCtGzz0ByDyEtG0Azy0FyCyB0ByDtBzzzztBtD2QtN0A0LzutBtN1B2Z1V1T1S1NzutCtCyBzzyB%26cr%3D1694857026%26a%3Dwcg_fremkfs_17_04%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium&p={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_fremkfs_16_25&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0Fzz0B0CtCtBzz0BtD0ByDyByEzzyB0DtN0D0Tzu0StCyCtAtBtN1L2XzutAtFtBtBtFtAtFzztN1L1Czu1BtAtN1L1G1B1V1N2Y1L1Qzu2StBtB0Bzy0FtB0EtAtGyCtBzz0BtG0E0E0F0BtGtCtBzz0BtGyEzy0D0FyB0D0C0F0FtCyD0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtC0E0B0DtDtCzytGyD0EtAyDtGyEtBzytCtGzz0ByDyEtG0Azy0FyCyB0ByDtBzzzztBtD2QtN0A0LzutB%26cr%3D211167893%26a%3Dwbf_fremkfs_16_25%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium&p={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_fremkfs_16_25&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0Fzz0B0CtCtBzz0BtD0ByDyByEzzyB0DtN0D0Tzu0StCyCtAtBtN1L2XzutAtFtBtBtFtAtFzztN1L1Czu1BtAtN1L1G1B1V1N2Y1L1Qzu2StBtB0Bzy0FtB0EtAtGyCtBzz0BtG0E0E0F0BtGtCtBzz0BtGyEzy0D0FyB0D0C0F0FtCyD0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtC0E0B0DtDtCzytGyD0EtAyDtGyEtBzytCtGzz0ByDyEtG0Azy0FyCyB0ByDtBzzzztBtD2QtN0A0LzutB%26cr%3D211167893%26a%3Dwbf_fremkfs_16_25%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium&p={searchTerms}
SearchScopes: HKLM-x32 -> {85A60A59-D3D8-468F-B598-FB4393789EF4} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wcg_fremkfs_17_04&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0Fzz0B0CtCtBzz0BtD0ByDyByEzzyB0DtN0D0Tzu0StCzzyDtBtN1L2XzutAtFtByCtFtBtFyDtCtN1L1Czu1BzytN1L1G1B1V1N2Y1L1Qzu2SyCyD0E0EyD0D0CtAtGtB0CyC0DtGtBzy0AtDtGtCtDtDzytGtBzzyB0FyEzytD0BzzzzyB0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtC0E0B0DtDtCzytGyD0EtAyDtGyEtBzytCtGzz0ByDyEtG0Azy0FyCyB0ByDtBzzzztBtD2QtN0A0LzutBtN1B2Z1V1T1S1NzutCtCyBzzyB%26cr%3D1694857026%26a%3Dwcg_fremkfs_17_04%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium&p={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-559702275-2648494096-679061964-1000 -> DefaultScope {85A60A59-D3D8-468F-B598-FB4393789EF4} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wcg_fremkfs_17_04&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0Fzz0B0CtCtBzz0BtD0ByDyByEzzyB0DtN0D0Tzu0StCzzyDtBtN1L2XzutAtFtByCtFtBtFyDtCtN1L1Czu1BzytN1L1G1B1V1N2Y1L1Qzu2SyCyD0E0EyD0D0CtAtGtB0CyC0DtGtBzy0AtDtGtCtDtDzytGtBzzyB0FyEzytD0BzzzzyB0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtC0E0B0DtDtCzytGyD0EtAyDtGyEtBzytCtGzz0ByDyEtG0Azy0FyCyB0ByDtBzzzztBtD2QtN0A0LzutBtN1B2Z1V1T1S1NzutCtCyBzzyB%26cr%3D1694857026%26a%3Dwcg_fremkfs_17_04%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium&p={searchTerms}
SearchScopes: HKU\S-1-5-21-559702275-2648494096-679061964-1000 -> {06C834A2-C694-4B70-AF95-A708D55E0B68} URL =
SearchScopes: HKU\S-1-5-21-559702275-2648494096-679061964-1000 -> {2f23ab71-4ac6-41f2-a955-ea576e553146} URL = hxxps://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-559702275-2648494096-679061964-1000 -> {85A60A59-D3D8-468F-B598-FB4393789EF4} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wcg_fremkfs_17_04&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0Fzz0B0CtCtBzz0BtD0ByDyByEzzyB0DtN0D0Tzu0StCzzyDtBtN1L2XzutAtFtByCtFtBtFyDtCtN1L1Czu1BzytN1L1G1B1V1N2Y1L1Qzu2SyCyD0E0EyD0D0CtAtGtB0CyC0DtGtBzy0AtDtGtCtDtDzytGtBzzyB0FyEzytD0BzzzzyB0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtC0E0B0DtDtCzytGyD0EtAyDtGyEtBzytCtGzz0ByDyEtG0Azy0FyCyB0ByDtBzzzztBtD2QtN0A0LzutBtN1B2Z1V1T1S1NzutCtCyBzzyB%26cr%3D1694857026%26a%3Dwcg_fremkfs_17_04%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium&p={searchTerms}
SearchScopes: HKU\S-1-5-21-559702275-2648494096-679061964-1000 -> {AA664F3E-D7BD-4B79-A872-13E7A9465BFF} URL =
BHO: Bitdefender Wallet  -> {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} -> C:\Program Files\Bitdefender\Bitdefender 2017\pmbxie.dll [2017-04-24] (Bitdefender)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-18] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Bitdefender Wallet -> {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} -> C:\Program Files\Bitdefender\Bitdefender 2017\Antispam32\pmbxie.dll [2017-04-24] (Bitdefender)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-18] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
Toolbar: HKLM - Bitdefender Wallet  - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender 2017\pmbxie.dll [2017-04-24] (Bitdefender)
Toolbar: HKLM-x32 - Bitdefender Wallet - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender 2017\Antispam32\pmbxie.dll [2017-04-24] (Bitdefender)
Handler-x32: intu-help-qb3 - {c5e479ea-0a65-4b05-8c6c-2fc8cc682eb4} - C:\Program Files (x86)\Intuit\QuickBooks 2010\HelpAsyncPluggableProtocol.dll [2013-02-01] (Intuit, Inc.)
Handler-x32: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - C:\Windows\system32\mscoree.dll [2010-11-20] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\NewPC\AppData\Roaming\Mozilla\Firefox\Profiles\zejab4qm.default-1483663109593 [2017-04-26]
FF Homepage: Mozilla\Firefox\Profiles\zejab4qm.default-1483663109593 -> hxxp://www.ighome.com/?t=639536
FF Extension: (uBlock Origin) - C:\Users\NewPC\AppData\Roaming\Mozilla\Firefox\Profiles\zejab4qm.default-1483663109593\Extensions\[email protected] [2017-04-16]
FF Extension: (StumbleUpon) - C:\Users\NewPC\AppData\Roaming\Mozilla\Firefox\Profiles\zejab4qm.default-1483663109593\Extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}.xpi [2017-01-05]
FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Program Files\Bitdefender\Bitdefender 2017\antispam32\bdwteff
FF Extension: (Bitdefender Wallet) - C:\Program Files\Bitdefender\Bitdefender 2017\antispam32\bdwteff [2017-04-25]
FF HKLM\...\Thunderbird\Extensions: [[email protected]] - C:\Program Files\Bitdefender\Bitdefender 2017\bdtbext
FF Extension: (Bitdefender Antispam Toolbar) - C:\Program Files\Bitdefender\Bitdefender 2017\bdtbext [2016-09-19] [not signed]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files\Bitdefender\Bitdefender 2017\antispam32\bdwteff
FF HKLM-x32\...\Thunderbird\Extensions: [[email protected]] - C:\Program Files\McAfee\MSK => not found
FF HKLM-x32\...\Thunderbird\Extensions: [[email protected]] - C:\Program Files\Bitdefender\Bitdefender 2017\bdtbext
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_25_0_0_148.dll [2017-04-16] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-16] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_25_0_0_148.dll [2017-04-16] ()
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL [2014-07-28] (CANON INC.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-12-09] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-12-09] (Intel Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.3\npGoogleUpdate3.dll [2017-04-12] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.3\npGoogleUpdate3.dll [2017-04-12] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-04-04] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-559702275-2648494096-679061964-1000: @talk.google.com/GoogleTalkPlugin -> C:\Users\NewPC\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google)
FF Plugin HKU\S-1-5-21-559702275-2648494096-679061964-1000: @talk.google.com/O1DPlugin -> C:\Users\NewPC\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-12-08] (Google)
FF Plugin HKU\S-1-5-21-559702275-2648494096-679061964-1000: @tools.google.com/Google Update;version=3 -> C:\Users\NewPC\AppData\Local\Google\Update\1.3.33.3\npGoogleUpdate3.dll [2017-04-11] (Google Inc.)
FF Plugin HKU\S-1-5-21-559702275-2648494096-679061964-1000: @tools.google.com/Google Update;version=9 -> C:\Users\NewPC\AppData\Local\Google\Update\1.3.33.3\npGoogleUpdate3.dll [2017-04-11] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\NewPC\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\NewPC\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-12-08] (Google)

Chrome:
=======
CHR HomePage: Default -> hxxp://www.netvibes.com/
CHR StartupUrls: Default -> "hxxp://www.netvibes.com/"
CHR Profile: C:\Users\NewPC\AppData\Local\Google\Chrome\User Data\Default [2017-04-12]
CHR Extension: (Google Slides) - C:\Users\NewPC\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-02-19]
CHR Extension: (Google Docs) - C:\Users\NewPC\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-02-19]
CHR Extension: (Pintrips) - C:\Users\NewPC\AppData\Local\Google\Chrome\User Data\Default\Extensions\aoihjpmcodndpakldmhbcfjjcagpkhpb [2017-02-19]
CHR Extension: (Google Drive) - C:\Users\NewPC\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-02-19]
CHR Extension: (YouTube) - C:\Users\NewPC\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-02-19]
CHR Extension: () - C:\Users\NewPC\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2017-04-12]
CHR Extension: (Adblock Plus) - C:\Users\NewPC\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2017-03-27]
CHR Extension: (Bitdefender Wallet) - C:\Users\NewPC\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhhejlifdlcgcmogbggeomfodgklfaem [2017-02-19]
CHR Extension: (Google Sheets) - C:\Users\NewPC\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-02-19]
CHR Extension: (Bitdefender Wallet) - C:\Users\NewPC\AppData\Local\Google\Chrome\User Data\Default\Extensions\gannpgaobkkhmpomoijebaigcapoeebl [2017-03-10]
CHR Extension: (Google Docs Offline) - C:\Users\NewPC\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-03-10]
CHR Extension: (Disconnect) - C:\Users\NewPC\AppData\Local\Google\Chrome\User Data\Default\Extensions\jeoacafpbcihiomhlakheieifhpjdfeo [2017-02-19]
CHR Extension: (StumbleUpon) - C:\Users\NewPC\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcahibnffhnnjcedflmchmokndkjnhpg [2017-02-19]
CHR Extension: (Chrome Web Store Payments) - C:\Users\NewPC\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-10]
CHR Extension: (Gmail) - C:\Users\NewPC\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-02-19]
CHR Extension: (Chrome Media Router) - C:\Users\NewPC\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-02-19]
CHR HKLM-x32\...\Chrome\Extension: [dhhejlifdlcgcmogbggeomfodgklfaem] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gannpgaobkkhmpomoijebaigcapoeebl] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2017-03-17] (Apple Inc.)
S4 AtherosSvc; C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe [322176 2014-08-27] (Windows ® Win 7 DDK provider) [File not signed]
S2 DellDataVault; C:\Program Files\Dell\DellDataVault\DellDataVault.exe [2557136 2015-02-26] (Dell Inc.)
R2 DellUpdate; C:\Program Files (x86)\Dell Update\DellUpService.exe [237272 2015-08-27] (Dell Inc.)
S3 ESRV_SVC_WILLAMETTE; C:\Program Files\Intel\SUR\WILLAMETTE\ESRV\esrv_svc.exe [416408 2016-06-08] ()
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [14696 2013-07-30] (Intel Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [344184 2016-05-12] (Intel Corporation)
R2 Intel® Capability Licensing Service Interface; c:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel® Corporation) [File not signed]
S3 Intel® Capability Licensing Service TCP IP Interface; c:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel® Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [169432 2013-12-09] (Intel Corporation)
R2 ProductAgentService; C:\Program Files\Bitdefender Agent\ProductAgentService.exe [1230824 2017-02-22] (Bitdefender)
R2 QBCFMonitorService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe [45056 2013-02-01] (Intuit) [File not signed]
S3 QBFCService; C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe [61440 2009-07-23] (Intuit Inc.) [File not signed]
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [246488 2013-06-18] (Realtek Semiconductor)
R2 SupportAssistAgent; C:\Program Files (x86)\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe [32728 2017-04-13] (Dell Inc.)
R2 SystemUsageReportSvc_WILLAMETTE; C:\Program Files (x86)\Intel Driver Update Utility\SUR\SurSvc.exe [117400 2016-06-08] ()
R2 UPDATESRV; C:\Program Files\Bitdefender\Bitdefender 2017\updatesrv.exe [218416 2017-04-24] (Bitdefender)
S3 USER_ESRV_SVC_WILLAMETTE; C:\Program Files\Intel\SUR\WILLAMETTE\ESRV\esrv_svc.exe [416408 2016-06-08] ()
R2 VSSERV; C:\Program Files\Bitdefender\Bitdefender 2017\vsserv.exe [1424224 2017-04-24] (Bitdefender)
R2 WDBackup; C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe [1049464 2016-04-19] (Western Digital Technologies, Inc.)
R2 WDDriveService; C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe [314744 2016-04-19] (Western Digital Technologies, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2014-07-28] (Microsoft Corporation)
S4 ZAtheros Wlan Agent; C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe [81536 2014-05-13] (Atheros) [File not signed]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [1605376 2016-10-27] (BitDefender)
R3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [878072 2016-10-27] (BitDefender)
R1 bdfwfpf; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [119696 2016-06-15] (BitDefender LLC)
S4 BDVEDISK; C:\Windows\System32\DRIVERS\bdvedisk.sys [87912 2015-12-04] (BitDefender)
R3 BTATH_LWFLT; C:\Windows\System32\DRIVERS\btath_lwflt.sys [77464 2014-08-27] (Qualcomm Atheros)
S3 DDDriver; C:\Windows\System32\drivers\DDDriver64Dcsa.sys [23760 2015-01-30] (Dell Computer Corporation)
S3 DellProf; C:\Windows\System32\drivers\DellProf.sys [23312 2015-01-30] (Dell Computer Corporation)
R0 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [182944 2016-11-17] (BitDefender LLC)
R0 iaStorF; C:\Windows\System32\drivers\iaStorF.sys [28008 2013-07-24] (Intel Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [100312 2013-12-09] (Intel Corporation)
S3 semav6msr64; C:\Windows\system32\drivers\semav6msr64.sys [21984 2015-06-04] ()
S3 WDC_SAM; C:\Windows\System32\DRIVERS\wdcsam64_prewin8.sys [23200 2016-01-14] (Western Digital Technologies)
S3 b06bdrv; \SystemRoot\system32\drivers\bxvbda.sys [X]
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-04-26 13:27 - 2017-04-26 13:27 - 00000000 ____D C:\FRST
2017-04-26 06:06 - 2017-04-26 06:06 - 00000000 ___RD C:\Users\NewPC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2017-04-24 09:31 - 2017-04-24 09:31 - 00000000 ____D C:\ProgramData\PC-Doctor for Windows
2017-04-24 09:30 - 2017-04-24 09:30 - 00000000 ____D C:\Program Files\Dell Support Center
2017-04-22 17:03 - 2017-04-22 17:03 - 00000000 ____D C:\ProgramData\SupportAssistAgent
2017-04-20 15:37 - 2017-04-23 12:25 - 00001260 _____ C:\Users\NewPC\Desktop\coolplayer.ini
2017-04-20 15:37 - 2017-04-23 12:25 - 00000053 _____ C:\Users\NewPC\Desktop\default.m3u
2017-04-20 11:50 - 2017-04-20 11:50 - 00000000 ____D C:\Users\NewPC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2017-04-13 08:42 - 2017-04-22 23:47 - 00000000 ____D C:\Users\NewPC\AppData\LocalLow\uTorrent
2017-04-12 13:05 - 2017-04-12 13:06 - 00000000 ____D C:\Users\NewPC\Desktop\Misc Folders
2017-04-12 06:11 - 2017-03-27 11:13 - 00394448 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2017-04-12 06:11 - 2017-03-27 10:28 - 00346320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2017-04-12 06:11 - 2017-03-25 12:39 - 20284416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2017-04-12 06:11 - 2017-03-25 12:07 - 04604416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2017-04-12 06:11 - 2017-03-25 12:06 - 13654016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2017-04-12 06:11 - 2017-03-25 11:55 - 02767360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2017-04-12 06:11 - 2017-03-25 11:52 - 02289152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2017-04-12 06:11 - 2017-03-25 11:51 - 01313280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2017-04-12 06:11 - 2017-03-25 11:48 - 00499200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2017-04-12 06:11 - 2017-03-25 11:47 - 02055680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2017-04-12 06:11 - 2017-03-25 11:47 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2017-04-12 06:11 - 2017-03-25 11:47 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2017-04-12 06:11 - 2017-03-25 11:46 - 00693248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2017-04-12 06:11 - 2017-03-25 11:46 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2017-04-12 06:11 - 2017-03-25 11:46 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2017-04-12 06:11 - 2017-03-25 11:46 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2017-04-12 06:11 - 2017-03-25 11:46 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2017-04-12 06:11 - 2017-03-25 11:46 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2017-04-12 06:11 - 2017-03-25 11:46 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2017-04-12 06:11 - 2017-03-25 11:46 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2017-04-12 06:11 - 2017-03-25 11:45 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2017-04-12 06:11 - 2017-03-25 11:45 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2017-04-12 06:11 - 2017-03-25 11:45 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2017-04-12 06:11 - 2017-03-25 11:45 - 00091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2017-04-12 06:11 - 2017-03-25 11:45 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2017-04-12 06:11 - 2017-03-25 11:45 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2017-04-12 06:11 - 2017-03-25 11:45 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2017-04-12 06:11 - 2017-03-25 11:44 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2017-04-12 06:11 - 2017-03-25 11:44 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2017-04-12 06:11 - 2017-03-25 11:35 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2017-04-12 06:11 - 2017-03-25 11:35 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2017-04-12 06:11 - 2017-03-25 11:16 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2017-04-12 06:11 - 2017-03-25 11:14 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2017-04-12 06:11 - 2017-03-25 11:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2017-04-12 06:11 - 2017-03-25 11:13 - 00576512 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2017-04-12 06:11 - 2017-03-25 11:13 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2017-04-12 06:11 - 2017-03-25 11:10 - 02898432 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2017-04-12 06:11 - 2017-03-25 11:04 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2017-04-12 06:11 - 2017-03-25 11:02 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2017-04-12 06:11 - 2017-03-25 10:57 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2017-04-12 06:11 - 2017-03-25 10:56 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2017-04-12 06:11 - 2017-03-25 10:56 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2017-04-12 06:11 - 2017-03-25 10:56 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2017-04-12 06:11 - 2017-03-25 10:56 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2017-04-12 06:11 - 2017-03-25 10:52 - 25746944 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2017-04-12 06:11 - 2017-03-25 10:45 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2017-04-12 06:11 - 2017-03-25 10:41 - 06045696 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2017-04-12 06:11 - 2017-03-25 10:41 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2017-04-12 06:11 - 2017-03-25 10:30 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-04-12 06:11 - 2017-03-25 10:29 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2017-04-12 06:11 - 2017-03-25 10:24 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2017-04-12 06:11 - 2017-03-25 10:23 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2017-04-12 06:11 - 2017-03-25 10:20 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2017-04-12 06:11 - 2017-03-25 10:19 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2017-04-12 06:11 - 2017-03-25 10:17 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2017-04-12 06:11 - 2017-03-25 10:06 - 00476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2017-04-12 06:11 - 2017-03-25 10:04 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2017-04-12 06:11 - 2017-03-25 10:00 - 00725504 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2017-04-12 06:11 - 2017-03-25 09:59 - 00806912 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2017-04-12 06:11 - 2017-03-25 09:57 - 02131456 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2017-04-12 06:11 - 2017-03-25 09:57 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2017-04-12 06:11 - 2017-03-25 09:28 - 15259136 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2017-04-12 06:11 - 2017-03-25 09:27 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2017-04-12 06:11 - 2017-03-25 09:24 - 03241472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2017-04-12 06:11 - 2017-03-25 09:10 - 01546240 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2017-04-12 06:11 - 2017-03-25 09:01 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2017-04-12 06:11 - 2017-03-24 15:50 - 00405504 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2017-04-12 06:11 - 2017-03-24 15:42 - 00313344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2017-04-12 06:11 - 2017-03-22 08:32 - 03165184 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2017-04-12 06:11 - 2017-03-22 08:32 - 00192512 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2017-04-12 06:11 - 2017-03-22 08:32 - 00098816 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2017-04-12 06:11 - 2017-03-22 08:30 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2017-04-12 06:11 - 2017-03-22 08:24 - 00174080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2017-04-12 06:11 - 2017-03-22 08:17 - 02651136 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2017-04-12 06:11 - 2017-03-22 08:15 - 00709120 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2017-04-12 06:11 - 2017-03-22 08:15 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2017-04-12 06:11 - 2017-03-22 08:15 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2017-04-12 06:11 - 2017-03-22 08:15 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2017-04-12 06:11 - 2017-03-22 08:15 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2017-04-12 06:11 - 2017-03-22 08:15 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2017-04-12 06:11 - 2017-03-22 08:05 - 00573440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2017-04-12 06:11 - 2017-03-22 08:05 - 00093696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2017-04-12 06:11 - 2017-03-22 08:05 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2017-04-12 06:11 - 2017-03-22 08:05 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2017-04-12 06:11 - 2017-03-14 08:34 - 00986344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2017-04-12 06:11 - 2017-03-14 08:34 - 00265448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2017-04-12 06:11 - 2017-03-14 08:30 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2017-04-12 06:11 - 2017-03-10 09:35 - 00382696 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2017-04-12 06:11 - 2017-03-10 09:31 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2017-04-12 06:11 - 2017-03-10 09:31 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2017-04-12 06:11 - 2017-03-10 09:31 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2017-04-12 06:11 - 2017-03-10 09:31 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2017-04-12 06:11 - 2017-03-10 09:27 - 00308456 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2017-04-12 06:11 - 2017-03-10 09:20 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2017-04-12 06:11 - 2017-03-10 09:19 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2017-04-12 06:11 - 2017-03-10 09:19 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2017-04-12 06:11 - 2017-03-10 09:00 - 03219968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2017-04-12 06:11 - 2017-03-10 08:53 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2017-04-12 06:11 - 2017-03-08 13:20 - 01133568 _____ (Microsoft Corporation) C:\Windows\system32\cdosys.dll
2017-04-12 06:11 - 2017-03-08 13:10 - 00805376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cdosys.dll
2017-04-12 06:11 - 2017-03-07 21:37 - 00631176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2017-04-12 06:11 - 2017-03-07 21:36 - 05548264 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2017-04-12 06:11 - 2017-03-07 21:36 - 00706792 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2017-04-12 06:11 - 2017-03-07 21:36 - 00154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2017-04-12 06:11 - 2017-03-07 21:36 - 00095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2017-04-12 06:11 - 2017-03-07 21:34 - 01732864 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 02064384 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 01212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00730624 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:33 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:26 - 04000488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2017-04-12 06:11 - 2017-03-07 21:26 - 03945192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2017-04-12 06:11 - 2017-03-07 21:24 - 01314112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2017-04-12 06:11 - 2017-03-07 21:22 - 01416192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2017-04-12 06:11 - 2017-03-07 21:22 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2017-04-12 06:11 - 2017-03-07 21:22 - 00666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2017-04-12 06:11 - 2017-03-07 21:22 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2017-04-12 06:11 - 2017-03-07 21:22 - 00275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2017-04-12 06:11 - 2017-03-07 21:22 - 00261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2017-04-12 06:11 - 2017-03-07 21:22 - 00254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2017-04-12 06:11 - 2017-03-07 21:22 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2017-04-12 06:11 - 2017-03-07 21:22 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2017-04-12 06:11 - 2017-03-07 21:22 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2017-04-12 06:11 - 2017-03-07 21:22 - 00141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2017-04-12 06:11 - 2017-03-07 21:22 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2017-04-12 06:11 - 2017-03-07 21:22 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2017-04-12 06:11 - 2017-03-07 21:22 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2017-04-12 06:11 - 2017-03-07 21:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2017-04-12 06:11 - 2017-03-07 21:22 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2017-04-12 06:11 - 2017-03-07 21:22 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2017-04-12 06:11 - 2017-03-07 21:22 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2017-04-12 06:11 - 2017-03-07 21:22 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2017-04-12 06:11 - 2017-03-07 21:21 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2017-04-12 06:11 - 2017-03-07 21:21 - 00644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2017-04-12 06:11 - 2017-03-07 21:21 - 00342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2017-04-12 06:11 - 2017-03-07 21:21 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2017-04-12 06:11 - 2017-03-07 21:21 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2017-04-12 06:11 - 2017-03-07 21:21 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:21 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:21 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:21 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:21 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:21 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:21 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:21 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:21 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:21 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:21 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:21 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:21 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:21 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:21 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:21 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:21 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:21 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:21 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:21 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:21 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:21 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:21 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:21 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 21:03 - 00148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2017-04-12 06:11 - 2017-03-07 21:03 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2017-04-12 06:11 - 2017-03-07 21:03 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2017-04-12 06:11 - 2017-03-07 21:03 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2017-04-12 06:11 - 2017-03-07 21:00 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2017-04-12 06:11 - 2017-03-07 20:59 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2017-04-12 06:11 - 2017-03-07 20:57 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2017-04-12 06:11 - 2017-03-07 20:56 - 00291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2017-04-12 06:11 - 2017-03-07 20:56 - 00159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2017-04-12 06:11 - 2017-03-07 20:56 - 00129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2017-04-12 06:11 - 2017-03-07 20:55 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2017-04-12 06:11 - 2017-03-07 20:55 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2017-04-12 06:11 - 2017-03-07 20:54 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2017-04-12 06:11 - 2017-03-07 20:54 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2017-04-12 06:11 - 2017-03-07 20:54 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2017-04-12 06:11 - 2017-03-07 20:54 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2017-04-12 06:11 - 2017-03-07 20:53 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2017-04-12 06:11 - 2017-03-07 20:53 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 20:53 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 20:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 20:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2017-04-12 06:11 - 2017-03-07 09:30 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\asycfilt.dll
2017-04-12 06:11 - 2017-03-07 09:17 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\asycfilt.dll
2017-04-12 06:11 - 2017-03-07 07:05 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2017-04-12 06:11 - 2017-03-03 18:27 - 01574912 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2017-04-12 06:11 - 2017-03-03 18:27 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\mfmjpegdec.dll
2017-04-12 06:11 - 2017-03-03 18:14 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2017-04-12 06:11 - 2017-03-03 18:14 - 00077312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmjpegdec.dll
2017-04-12 06:11 - 2017-02-14 09:33 - 00757248 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2017-04-12 06:11 - 2017-02-14 09:19 - 00497664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2017-04-12 06:11 - 2017-02-11 09:33 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2017-04-12 06:11 - 2017-02-11 09:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2017-04-12 06:11 - 2017-02-09 09:32 - 00769536 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll
2017-04-12 06:11 - 2017-02-09 09:32 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\samlib.dll
2017-04-12 06:11 - 2017-02-09 09:14 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\samlib.dll
2017-04-12 06:11 - 2017-01-18 08:36 - 00994760 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2017-04-12 06:11 - 2017-01-18 08:36 - 00063840 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:36 - 00020832 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:36 - 00019808 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:36 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:36 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:36 - 00016224 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:36 - 00015712 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:36 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:36 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2017-04-12 06:11 - 2017-01-18 08:36 - 00013664 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:36 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:36 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:36 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:36 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:36 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:36 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:36 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2017-04-12 06:11 - 2017-01-18 08:36 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2017-04-12 06:11 - 2017-01-18 08:36 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:36 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:36 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:36 - 00011608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
2017-04-12 06:11 - 2017-01-18 08:35 - 00922432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ucrtbase.dll
2017-04-12 06:11 - 2017-01-18 08:35 - 00066400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-private-l1-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:35 - 00022368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-math-l1-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:35 - 00019808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:35 - 00017760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-string-l1-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:35 - 00017760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:35 - 00016224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:35 - 00015712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:35 - 00014176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-time-l1-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:35 - 00014176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll
2017-04-12 06:11 - 2017-01-18 08:35 - 00013664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:35 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:35 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:35 - 00012640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:35 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:35 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:35 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:35 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll
2017-04-12 06:11 - 2017-01-18 08:35 - 00012128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll
2017-04-12 06:11 - 2017-01-18 08:35 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l2-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:35 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:35 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll
2017-04-12 06:11 - 2017-01-18 08:35 - 00011616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll
2017-04-12 06:11 - 2016-03-23 15:40 - 03181568 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2017-04-12 06:11 - 2016-03-23 15:40 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2017-04-10 12:15 - 2017-04-10 13:26 - 00000000 ____D C:\Users\NewPC\AppData\Roaming\Audacity
2017-04-10 07:22 - 2017-04-10 07:22 - 00000000 ____D C:\Users\NewPC\AppData\Local\Private Internet Access
2017-04-10 07:22 - 2017-04-10 07:22 - 00000000 ____D C:\Users\NewPC\AppData\Local\Crashpad
2017-04-05 18:06 - 2017-04-05 18:11 - 00000000 ____D C:\Users\NewPC\suspense
2017-03-29 13:54 - 2017-03-29 13:54 - 00001755 _____ C:\Users\Public\Desktop\iTunes.lnk
2017-03-29 13:54 - 2017-03-29 13:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2017-03-29 13:53 - 2017-03-29 13:53 - 00000000 ____D C:\Program Files\iPod
2017-03-29 13:51 - 2017-03-29 13:51 - 00000000 ____D C:\Windows\System32\Tasks\Apple
2017-03-29 13:51 - 2017-03-29 13:51 - 00000000 ____D C:\Program Files (x86)\Apple Software Update

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-04-26 13:26 - 2016-09-20 16:06 - 00000000 ____D C:\Program Files\Bitdefender Agent
2017-04-26 13:26 - 2015-06-16 09:22 - 00000918 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-559702275-2648494096-679061964-1000UA.job
2017-04-26 09:29 - 2016-07-21 12:52 - 00003484 _____ C:\Windows\System32\Tasks\PCDEventLauncherTask
2017-04-26 06:35 - 2016-11-16 07:16 - 00000000 ____D C:\Users\NewPC\AppData\LocalLow\Mozilla
2017-04-26 06:10 - 2009-07-13 21:45 - 00021296 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-04-26 06:10 - 2009-07-13 21:45 - 00021296 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-04-26 06:01 - 2014-08-01 15:05 - 03713024 ___SH C:\Users\NewPC\Desktop\Thumbs.db
2017-04-26 06:01 - 2014-08-01 05:58 - 00000000 __SHD C:\Users\NewPC\IntelGraphicsProfiles
2017-04-26 06:00 - 2016-10-31 14:02 - 00008192 _____ C:\Windows\SysWOW64\WDPABKP.dat
2017-04-26 05:59 - 2016-11-15 15:13 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-04-26 05:59 - 2014-07-31 12:55 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-04-26 05:59 - 2009-07-13 22:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-04-25 22:06 - 2014-07-31 16:12 - 01089480 _____ C:\bdlog.txt
2017-04-25 19:48 - 2015-06-16 09:22 - 00000866 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-559702275-2648494096-679061964-1000Core.job
2017-04-25 13:54 - 2009-07-13 22:13 - 00783606 _____ C:\Windows\system32\PerfStringBackup.INI
2017-04-25 13:54 - 2009-07-13 20:20 - 00000000 ____D C:\Windows\inf
2017-04-25 06:40 - 2014-11-11 12:18 - 00000000 ___RD C:\Users\NewPC\Google Drive
2017-04-25 06:36 - 2014-07-28 09:36 - 00000000 ____D C:\ProgramData\PCDr
2017-04-24 09:31 - 2014-07-28 09:34 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell
2017-04-24 09:29 - 2014-08-02 14:02 - 00000000 ____D C:\Users\NewPC\AppData\Roaming\PCDr
2017-04-24 05:59 - 2014-07-28 09:23 - 00802904 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-04-24 05:59 - 2014-07-28 09:23 - 00144472 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-04-24 05:59 - 2014-07-28 09:23 - 00004312 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2017-04-24 05:59 - 2014-07-28 09:23 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2017-04-24 05:59 - 2014-07-28 09:23 - 00000000 ____D C:\Windows\system32\Macromed
2017-04-23 07:09 - 2014-08-01 06:09 - 00000000 ____D C:\Users\NewPC\AppData\Roaming\uTorrent
2017-04-22 23:46 - 2014-07-31 13:28 - 00000000 ____D C:\Users\NewPC\AppData\Local\CrashDumps
2017-04-20 11:50 - 2015-02-20 09:32 - 00000000 ____D C:\Users\NewPC\AppData\Roaming\Dropbox
2017-04-19 16:41 - 2015-02-20 08:53 - 00000000 ____D C:\Users\NewPC\AppData\Roaming\vlc
2017-04-19 09:07 - 2014-07-31 13:40 - 00000000 ___RD C:\Users\NewPC\Desktop\NewBibnarires
2017-04-18 14:30 - 2016-04-13 13:08 - 00000000 ____D C:\Users\NewPC\AppData\Local\Canon Easy-PhotoPrint EX
2017-04-18 09:45 - 2009-07-13 22:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2017-04-16 08:11 - 2014-08-05 08:05 - 00000000 ____D C:\Users\NewPC\AppData\Local\Adobe
2017-04-15 05:56 - 2009-07-13 21:45 - 01066192 _____ C:\Windows\system32\FNTCACHE.DAT
2017-04-13 07:50 - 2009-07-13 20:20 - 00000000 ____D C:\Windows\rescache
2017-04-12 16:02 - 2015-07-21 08:12 - 00004476 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2017-04-12 16:01 - 2015-11-04 16:06 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2017-04-12 13:17 - 2014-08-01 05:12 - 00000000 ____D C:\Windows\system32\MRT
2017-04-12 13:10 - 2014-08-01 05:12 - 148601744 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-04-12 13:07 - 2011-02-10 09:10 - 00775728 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2017-04-12 12:57 - 2016-04-30 07:51 - 00000000 ____D C:\Users\NewPC\AppData\Roaming\Amazon Cloud Drive
2017-04-12 12:55 - 2016-12-05 10:28 - 00001145 _____ C:\Users\NewPC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon Drive.lnk
2017-04-12 12:55 - 2016-12-05 10:28 - 00001133 _____ C:\Users\NewPC\Desktop\Amazon Drive.lnk
2017-04-12 12:55 - 2016-12-05 10:27 - 00000000 ____D C:\Users\NewPC\AppData\Local\Amazon Drive
2017-04-12 05:58 - 2014-11-11 12:16 - 00003330 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2017-04-12 05:58 - 2014-11-11 12:16 - 00003202 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2017-04-11 17:21 - 2014-09-20 18:05 - 00003504 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-559702275-2648494096-679061964-1000UA
2017-04-11 17:21 - 2014-09-20 18:05 - 00003232 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-559702275-2648494096-679061964-1000Core
2017-04-10 13:15 - 2016-12-18 11:34 - 00000000 ____D C:\Users\NewPC\Desktop\converted Files
2017-04-10 08:28 - 2015-09-27 08:15 - 00000000 ____D C:\Users\NewPC\Desktop\QB
2017-04-10 07:30 - 2014-08-08 11:03 - 00000000 ____D C:\ProgramData\Freemake
2017-04-10 07:29 - 2014-08-08 11:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freemake
2017-04-10 07:21 - 2016-03-08 17:26 - 00003158 _____ C:\Windows\System32\Tasks\Private Internet Access Startup
2017-04-10 07:21 - 2016-03-08 17:26 - 00000000 ____D C:\Program Files\pia_manager
2017-04-05 18:06 - 2014-07-31 12:50 - 00000000 ____D C:\Users\NewPC
2017-04-05 17:23 - 2017-02-19 16:12 - 00002197 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-03-31 07:26 - 2014-09-13 13:30 - 00000000 ____D C:\Users\NewPC\AppData\Roaming\HandBrake
2017-03-29 13:54 - 2015-12-23 14:47 - 00000000 ____D C:\Program Files\iTunes
2017-03-29 13:53 - 2014-10-10 16:29 - 00000000 ____D C:\Program Files\Common Files\Apple
2017-03-29 13:51 - 2014-10-10 16:29 - 00002519 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk

==================== Files in the root of some directories =======

2015-07-03 10:39 - 2015-07-03 10:39 - 0003584 _____ () C:\Users\NewPC\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2016-05-05 13:08 - 2016-05-05 13:08 - 0000000 _____ () C:\Users\NewPC\AppData\Local\{61358BC1-A5BC-4B60-8544-E5E6CCE0DE23}
2015-09-14 16:44 - 2015-09-14 16:44 - 0390626 _____ () C:\ProgramData\1442273602.bdinstall.bin
2015-10-05 14:03 - 2015-10-05 14:03 - 0024802 _____ () C:\ProgramData\1444079005.bdinstall.bin
2015-11-25 13:29 - 2015-11-25 13:29 - 0393432 _____ () C:\ProgramData\1448483223.bdinstall.bin
2015-12-07 18:14 - 2015-12-07 18:14 - 0025118 _____ () C:\ProgramData\1449537240.bdinstall.bin
2016-02-20 17:27 - 2016-02-20 17:27 - 0025118 _____ () C:\ProgramData\1456014377.bdinstall.bin
2016-03-22 07:55 - 2016-03-22 07:55 - 0025901 _____ () C:\ProgramData\1458658537.bdinstall.bin
2016-03-31 17:13 - 2016-03-31 17:13 - 0025973 _____ () C:\ProgramData\1459469595.bdinstall.bin
2016-04-08 06:14 - 2016-04-08 06:14 - 0025473 _____ () C:\ProgramData\1460121241.bdinstall.bin
2016-04-17 06:24 - 2016-04-17 06:24 - 0025473 _____ () C:\ProgramData\1460899459.bdinstall.bin
2016-05-06 06:10 - 2016-05-06 06:10 - 0025473 _____ () C:\ProgramData\1462540237.bdinstall.bin
2016-06-14 05:31 - 2016-06-14 05:31 - 0025973 _____ () C:\ProgramData\1465907452.bdinstall.bin
2016-06-14 05:31 - 2016-06-14 05:31 - 0025973 _____ () C:\ProgramData\1465907484.bdinstall.bin
2016-06-14 05:32 - 2016-06-14 05:32 - 0026774 _____ () C:\ProgramData\1465907515.bdinstall.bin
2016-08-07 06:14 - 2016-08-07 06:14 - 0026208 _____ () C:\ProgramData\1470575652.bdinstall.bin
2016-09-20 06:00 - 2016-09-20 06:00 - 0026832 _____ () C:\ProgramData\agent.1474376430.bdinstall.bin
2016-09-20 16:06 - 2016-09-20 16:06 - 0046185 _____ () C:\ProgramData\agent.1474412764.bdinstall.bin
2016-11-01 19:02 - 2016-11-01 19:02 - 0028751 _____ () C:\ProgramData\agent.1478052148.bdinstall.bin
2017-03-09 06:55 - 2017-03-09 06:55 - 0029964 _____ () C:\ProgramData\agent.update.1489067702.bdinstall.bin
2016-09-20 16:12 - 2016-09-20 16:12 - 0359382 _____ () C:\ProgramData\cl.1474412833.bdinstall.bin
2016-09-20 16:13 - 2016-09-20 16:13 - 0054892 _____ () C:\ProgramData\dm.1474413175.bdinstall.bin
2016-09-20 16:16 - 2016-09-20 16:16 - 0035320 _____ () C:\ProgramData\dm.1474413362.bdinstall.bin
2014-07-28 09:28 - 2014-07-28 09:28 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some files in TEMP:
====================
2017-02-19 12:32 - 2017-02-19 12:32 - 8649240 _____ (Adobe Systems Incorporated) C:\Users\NewPC\AppData\Local\Temp\ade.exe
2017-02-23 17:45 - 2017-04-12 12:54 - 0875192 _____ (Amazon) C:\Users\NewPC\AppData\Local\Temp\AmazonDriveSetup.exe
2017-02-23 17:46 - 2017-04-12 12:54 - 44501016 _____ () C:\Users\NewPC\AppData\Local\Temp\AmazonDriveSetupQ.exe
2017-02-23 17:56 - 2017-02-23 17:56 - 1860376 _____ (Ellora Assets Corporation                                   ) C:\Users\NewPC\AppData\Local\Temp\AudioConverter.exe
2017-01-26 17:54 - 2017-01-26 17:55 - 19002008 _____ (Ellora Assets Corporation                                   ) C:\Users\NewPC\AppData\Local\Temp\FreemakeAudioConverterFull.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-04-23 00:33

==================== End of FRST.txt ============================

[zep516]

P2P Warning

--------------------
Going over your logs I noticed that you have µTorrent installed. It is pretty much certain that if you continue to use P2P programs, you will get infected again.

1.Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs.
2. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites.
3. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users.
4.The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.

I would recommend that you uninstall µTorrent, however that choice is up to you. If you choose to remove the program, you can do so via Start > Control Panel > Add/Remove Programs.

If you are still leaning toward using this program, please take a look at this information about Ransomware which can be delivered via P2P file transfers. The newest variation of Ransomware can make it impossible to recover the files this malicious software encrypts. In other words, you will probably lose most if not all of your valuable information, including pictures. In addition it has recently been reported that P2P downloads may be tracked resulting in your IP address being monitored by copyright authorities. .
If you wish to keep it, please do not use it until we are completely done and your machine is determined to be clean and updated.

Next just a few things to clean up. No Malware

Download the enclosed => file.  fixlist.txt   9.2KB   212 downloads Save it in the location FRST64 is C:\Users\NewPC\Desktop\Downloads Run FRST and click on the Fix button. Wait until finished.
The tool will make a log in the location FRST is, C:\Users\NewPC\Desktop\Downloads (Fixlog.txt). Please post it to your reply.

[Ardent]

Thanks for your help. I have deleted utorrent as per your suggestion. I appreciate your advice.  One thing that has bothered me through . i have changed my pw on my email accounts as a precaution when ever i have had any suspicious emails or potential hacking in the past. I was able to change my gmail pw but still have not been able to change my Yahoo password . It seem pretty straight forward and I can get instructions easily but when I get to the location where you make the change it doesn't give me that option .  Not sure if this has anything to do with the issue or not?

Here is the results

Fix result of Farbar Recovery Scan Tool (x64) Version: 27-04-2017
Ran by NewPC (29-04-2017 07:08:11) Run:1
Running from C:\Users\NewPC\Desktop\Downloads
Loaded Profiles: NewPC (Available Profiles: NewPC)
Boot Mode: Normal
==============================================

fixlist content:
*****************
CloseProcesses:
CreateRestorePoint:
CustomCLSID: HKU\S-1-5-21-559702275-2648494096-679061964-1000_Classes\CLSID\{CB492AF1-2CEF-4E58-BE47-471C77D0C8BA}\InprocServer32 -> C:\Users\NewPC\AppData\Local\Google\Update\1.3.32.7\psuser_64.dll => No File
CustomCLSID: HKU\S-1-5-21-559702275-2648494096-679061964-1000_Classes\CLSID\{F6BF8414-962C-40FE-90F1-B80A7E72DB9A}\InprocServer32 -> C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\fwcfg.dll => No File <==== ATTENTION
Task: {0E345E7D-209F-445E-B004-51EA9437BF23} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-559702275-2648494096-679061964-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_fremkfs_16_25&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0Fzz0B0CtCtBzz0BtD0ByDyByEzzyB0DtN0D0Tzu0StCyCtAtBtN1L2XzutAtFtBtBtFtAtFzztN1L1Czu1BtAtN1L1G1B1V1N2Y1L1Qzu2StBtB0Bzy0FtB0EtAtGyCtBzz0BtG0E0E0F0BtGtCtBzz0BtGyEzy0D0FyB0D0C0F0FtCyD0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtC0E0B0DtDtCzytGyD0EtAyDtGyEtBzytCtGzz0ByDyEtG0Azy0FyCyB0ByDtBzzzztBtD2QtN0A0LzutB%26cr%3D211167893%26a%3Dwbf_fremkfs_16_25%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium&p={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_fremkfs_16_25&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0Fzz0B0CtCtBzz0BtD0ByDyByEzzyB0DtN0D0Tzu0StCyCtAtBtN1L2XzutAtFtBtBtFtAtFzztN1L1Czu1BtAtN1L1G1B1V1N2Y1L1Qzu2StBtB0Bzy0FtB0EtAtGyCtBzz0BtG0E0E0F0BtGtCtBzz0BtGyEzy0D0FyB0D0C0F0FtCyD0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtC0E0B0DtDtCzytGyD0EtAyDtGyEtBzytCtGzz0ByDyEtG0Azy0FyCyB0ByDtBzzzztBtD2QtN0A0LzutB%26cr%3D211167893%26a%3Dwbf_fremkfs_16_25%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium&p={searchTerms}
SearchScopes: HKLM -> {85A60A59-D3D8-468F-B598-FB4393789EF4} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wcg_fremkfs_17_04&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0Fzz0B0CtCtBzz0BtD0ByDyByEzzyB0DtN0D0Tzu0StCzzyDtBtN1L2XzutAtFtByCtFtBtFyDtCtN1L1Czu1BzytN1L1G1B1V1N2Y1L1Qzu2SyCyD0E0EyD0D0CtAtGtB0CyC0DtGtBzy0AtDtGtCtDtDzytGtBzzyB0FyEzytD0BzzzzyB0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtC0E0B0DtDtCzytGyD0EtAyDtGyEtBzytCtGzz0ByDyEtG0Azy0FyCyB0ByDtBzzzztBtD2QtN0A0LzutBtN1B2Z1V1T1S1NzutCtCyBzzyB%26cr%3D1694857026%26a%3Dwcg_fremkfs_17_04%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium&p={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_fremkfs_16_25&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0Fzz0B0CtCtBzz0BtD0ByDyByEzzyB0DtN0D0Tzu0StCyCtAtBtN1L2XzutAtFtBtBtFtAtFzztN1L1Czu1BtAtN1L1G1B1V1N2Y1L1Qzu2StBtB0Bzy0FtB0EtAtGyCtBzz0BtG0E0E0F0BtGtCtBzz0BtGyEzy0D0FyB0D0C0F0FtCyD0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtC0E0B0DtDtCzytGyD0EtAyDtGyEtBzytCtGzz0ByDyEtG0Azy0FyCyB0ByDtBzzzztBtD2QtN0A0LzutB%26cr%3D211167893%26a%3Dwbf_fremkfs_16_25%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium&p={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_fremkfs_16_25&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0Fzz0B0CtCtBzz0BtD0ByDyByEzzyB0DtN0D0Tzu0StCyCtAtBtN1L2XzutAtFtBtBtFtAtFzztN1L1Czu1BtAtN1L1G1B1V1N2Y1L1Qzu2StBtB0Bzy0FtB0EtAtGyCtBzz0BtG0E0E0F0BtGtCtBzz0BtGyEzy0D0FyB0D0C0F0FtCyD0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtC0E0B0DtDtCzytGyD0EtAyDtGyEtBzytCtGzz0ByDyEtG0Azy0FyCyB0ByDtBzzzztBtD2QtN0A0LzutB%26cr%3D211167893%26a%3Dwbf_fremkfs_16_25%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium&p={searchTerms}
SearchScopes: HKLM-x32 -> {85A60A59-D3D8-468F-B598-FB4393789EF4} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wcg_fremkfs_17_04&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0Fzz0B0CtCtBzz0BtD0ByDyByEzzyB0DtN0D0Tzu0StCzzyDtBtN1L2XzutAtFtByCtFtBtFyDtCtN1L1Czu1BzytN1L1G1B1V1N2Y1L1Qzu2SyCyD0E0EyD0D0CtAtGtB0CyC0DtGtBzy0AtDtGtCtDtDzytGtBzzyB0FyEzytD0BzzzzyB0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtC0E0B0DtDtCzytGyD0EtAyDtGyEtBzytCtGzz0ByDyEtG0Azy0FyCyB0ByDtBzzzztBtD2QtN0A0LzutBtN1B2Z1V1T1S1NzutCtCyBzzyB%26cr%3D1694857026%26a%3Dwcg_fremkfs_17_04%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium&p={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-559702275-2648494096-679061964-1000 -> DefaultScope {85A60A59-D3D8-468F-B598-FB4393789EF4} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wcg_fremkfs_17_04&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0Fzz0B0CtCtBzz0BtD0ByDyByEzzyB0DtN0D0Tzu0StCzzyDtBtN1L2XzutAtFtByCtFtBtFyDtCtN1L1Czu1BzytN1L1G1B1V1N2Y1L1Qzu2SyCyD0E0EyD0D0CtAtGtB0CyC0DtGtBzy0AtDtGtCtDtDzytGtBzzyB0FyEzytD0BzzzzyB0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtC0E0B0DtDtCzytGyD0EtAyDtGyEtBzytCtGzz0ByDyEtG0Azy0FyCyB0ByDtBzzzztBtD2QtN0A0LzutBtN1B2Z1V1T1S1NzutCtCyBzzyB%26cr%3D1694857026%26a%3Dwcg_fremkfs_17_04%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium&p={searchTerms}
SearchScopes: HKU\S-1-5-21-559702275-2648494096-679061964-1000 -> {06C834A2-C694-4B70-AF95-A708D55E0B68} URL =
SearchScopes: HKU\S-1-5-21-559702275-2648494096-679061964-1000 -> {2f23ab71-4ac6-41f2-a955-ea576e553146} URL = hxxps://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-559702275-2648494096-679061964-1000 -> {85A60A59-D3D8-468F-B598-FB4393789EF4} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wcg_fremkfs_17_04&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0Fzz0B0CtCtBzz0BtD0ByDyByEzzyB0DtN0D0Tzu0StCzzyDtBtN1L2XzutAtFtByCtFtBtFyDtCtN1L1Czu1BzytN1L1G1B1V1N2Y1L1Qzu2SyCyD0E0EyD0D0CtAtGtB0CyC0DtGtBzy0AtDtGtCtDtDzytGtBzzyB0FyEzytD0BzzzzyB0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtC0E0B0DtDtCzytGyD0EtAyDtGyEtBzytCtGzz0ByDyEtG0Azy0FyCyB0ByDtBzzzztBtD2QtN0A0LzutBtN1B2Z1V1T1S1NzutCtCyBzzyB%26cr%3D1694857026%26a%3Dwcg_fremkfs_17_04%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium&p={searchTerms}
SearchScopes: HKU\S-1-5-21-559702275-2648494096-679061964-1000 -> {AA664F3E-D7BD-4B79-A872-13E7A9465BFF} URL =
S3 b06bdrv; \SystemRoot\system32\drivers\bxvbda.sys [X]
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]
2015-09-14 16:44 - 2015-09-14 16:44 - 0390626 _____ () C:\ProgramData\1442273602.bdinstall.bin
2015-10-05 14:03 - 2015-10-05 14:03 - 0024802 _____ () C:\ProgramData\1444079005.bdinstall.bin
2015-11-25 13:29 - 2015-11-25 13:29 - 0393432 _____ () C:\ProgramData\1448483223.bdinstall.bin
2015-12-07 18:14 - 2015-12-07 18:14 - 0025118 _____ () C:\ProgramData\1449537240.bdinstall.bin
2016-02-20 17:27 - 2016-02-20 17:27 - 0025118 _____ () C:\ProgramData\1456014377.bdinstall.bin
2016-03-22 07:55 - 2016-03-22 07:55 - 0025901 _____ () C:\ProgramData\1458658537.bdinstall.bin
2016-03-31 17:13 - 2016-03-31 17:13 - 0025973 _____ () C:\ProgramData\1459469595.bdinstall.bin
2016-04-08 06:14 - 2016-04-08 06:14 - 0025473 _____ () C:\ProgramData\1460121241.bdinstall.bin
2016-04-17 06:24 - 2016-04-17 06:24 - 0025473 _____ () C:\ProgramData\1460899459.bdinstall.bin
2016-05-06 06:10 - 2016-05-06 06:10 - 0025473 _____ () C:\ProgramData\1462540237.bdinstall.bin
2016-06-14 05:31 - 2016-06-14 05:31 - 0025973 _____ () C:\ProgramData\1465907452.bdinstall.bin
2016-06-14 05:31 - 2016-06-14 05:31 - 0025973 _____ () C:\ProgramData\1465907484.bdinstall.bin
2016-06-14 05:32 - 2016-06-14 05:32 - 0026774 _____ () C:\ProgramData\1465907515.bdinstall.bin
2016-08-07 06:14 - 2016-08-07 06:14 - 0026208 _____ () C:\ProgramData\1470575652.bdinstall.bin
2016-09-20 06:00 - 2016-09-20 06:00 - 0026832 _____ () C:\ProgramData\agent.1474376430.bdinstall.bin
2016-09-20 16:06 - 2016-09-20 16:06 - 0046185 _____ () C:\ProgramData\agent.1474412764.bdinstall.bin
2016-11-01 19:02 - 2016-11-01 19:02 - 0028751 _____ () C:\ProgramData\agent.1478052148.bdinstall.bin
2017-03-09 06:55 - 2017-03-09 06:55 - 0029964 _____ () C:\ProgramData\agent.update.1489067702.bdinstall.bin
2016-09-20 16:12 - 2016-09-20 16:12 - 0359382 _____ () C:\ProgramData\cl.1474412833.bdinstall.bin
2016-09-20 16:13 - 2016-09-20 16:13 - 0054892 _____ () C:\ProgramData\dm.1474413175.bdinstall.bin
2016-09-20 16:16 - 2016-09-20 16:16 - 0035320 _____ () C:\ProgramData\dm.1474413362.bdinstall.bin
CMD: bitsadmin /reset /allusers
CMD: netsh winsock reset catalog
CMD: ipconfig /flushdns
RemoveProxy:
hosts:
Emptytemp:
*****************

Processes closed successfully.
Restore point was successfully created.
HKU\S-1-5-21-559702275-2648494096-679061964-1000_Classes\CLSID\{CB492AF1-2CEF-4E58-BE47-471C77D0C8BA} => key removed successfully
HKU\S-1-5-21-559702275-2648494096-679061964-1000_Classes\CLSID\{F6BF8414-962C-40FE-90F1-B80A7E72DB9A} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{0E345E7D-209F-445E-B004-51EA9437BF23} => key removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0E345E7D-209F-445E-B004-51EA9437BF23} => key removed successfully
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore => moved successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineCore => key removed successfully
HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully
HKU\S-1-5-21-559702275-2648494096-679061964-1000\Software\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key removed successfully
HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{85A60A59-D3D8-468F-B598-FB4393789EF4} => key removed successfully
HKCR\CLSID\{85A60A59-D3D8-468F-B598-FB4393789EF4} => key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key removed successfully
HKCR\Wow6432Node\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{85A60A59-D3D8-468F-B598-FB4393789EF4} => key removed successfully
HKCR\Wow6432Node\CLSID\{85A60A59-D3D8-468F-B598-FB4393789EF4} => key not found.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully
HKU\S-1-5-21-559702275-2648494096-679061964-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully
HKU\S-1-5-21-559702275-2648494096-679061964-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{06C834A2-C694-4B70-AF95-A708D55E0B68} => key removed successfully
HKCR\CLSID\{06C834A2-C694-4B70-AF95-A708D55E0B68} => key not found.
HKU\S-1-5-21-559702275-2648494096-679061964-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2f23ab71-4ac6-41f2-a955-ea576e553146} => key removed successfully
HKCR\CLSID\{2f23ab71-4ac6-41f2-a955-ea576e553146} => key not found.
HKU\S-1-5-21-559702275-2648494096-679061964-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{85A60A59-D3D8-468F-B598-FB4393789EF4} => key removed successfully
HKCR\CLSID\{85A60A59-D3D8-468F-B598-FB4393789EF4} => key not found.
HKU\S-1-5-21-559702275-2648494096-679061964-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AA664F3E-D7BD-4B79-A872-13E7A9465BFF} => key removed successfully
HKCR\CLSID\{AA664F3E-D7BD-4B79-A872-13E7A9465BFF} => key not found.
HKLM\System\CurrentControlSet\Services\b06bdrv => key removed successfully
b06bdrv => service removed successfully
HKLM\System\CurrentControlSet\Services\MBAMSwissArmy => key removed successfully
MBAMSwissArmy => service removed successfully
C:\ProgramData\1442273602.bdinstall.bin => moved successfully
C:\ProgramData\1444079005.bdinstall.bin => moved successfully
C:\ProgramData\1448483223.bdinstall.bin => moved successfully
C:\ProgramData\1449537240.bdinstall.bin => moved successfully
C:\ProgramData\1456014377.bdinstall.bin => moved successfully
C:\ProgramData\1458658537.bdinstall.bin => moved successfully
C:\ProgramData\1459469595.bdinstall.bin => moved successfully
C:\ProgramData\1460121241.bdinstall.bin => moved successfully
C:\ProgramData\1460899459.bdinstall.bin => moved successfully
C:\ProgramData\1462540237.bdinstall.bin => moved successfully
C:\ProgramData\1465907452.bdinstall.bin => moved successfully
C:\ProgramData\1465907484.bdinstall.bin => moved successfully
C:\ProgramData\1465907515.bdinstall.bin => moved successfully
C:\ProgramData\1470575652.bdinstall.bin => moved successfully
C:\ProgramData\agent.1474376430.bdinstall.bin => moved successfully
C:\ProgramData\agent.1474412764.bdinstall.bin => moved successfully
C:\ProgramData\agent.1478052148.bdinstall.bin => moved successfully
C:\ProgramData\agent.update.1489067702.bdinstall.bin => moved successfully
C:\ProgramData\cl.1474412833.bdinstall.bin => moved successfully
C:\ProgramData\dm.1474413175.bdinstall.bin => moved successfully
C:\ProgramData\dm.1474413362.bdinstall.bin => moved successfully

========= bitsadmin /reset /allusers =========


BITSADMIN version 3.0 [ 7.5.7601 ]
BITS administration utility.
© Copyright 2000-2006 Microsoft Corp.

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

Unable to cancel {94863AC6-0CB1-4067-82B0-82B5C98A7977}.
Unable to cancel {72EABE6F-D95B-451F-B624-D6C4A9A0D0F8}.
{D4C68829-272D-4F14-9964-102005A89266} canceled.
1 out of 3 jobs canceled.

========= End of CMD: =========


========= netsh winsock reset catalog =========


Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.


========= End of CMD: =========


========= ipconfig /flushdns =========


Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========


========= RemoveProxy: =========

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully
HKU\S-1-5-21-559702275-2648494096-679061964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\S-1-5-21-559702275-2648494096-679061964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully


========= End of RemoveProxy: =========

C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.

=========== EmptyTemp: ==========

BITS transfer queue => 8388608 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 20916806 B
Java, Flash, Steam htmlcache => 35568 B
Windows/system/drivers => 39659908 B
Edge => 0 B
Chrome => 157647326 B
Firefox => 427373740 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Users => 0 B
Default => 0 B
Public => 0 B
ProgramData => 0 B
systemprofile => 16802 B
systemprofile32 => 165410 B
LocalService => 0 B
NetworkService => 0 B
NewPC => 771144639 B

RecycleBin => 861810603 B
EmptyTemp: => 2.1 GB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 07:09:39 ====

[zep516]

Hello,

I think you may need to contact yahoo about the password situation. Lets run 1 more adware scan to double check things.

Your logs actually look good just some left over items.

Next

Download AdwCleaner from here. Save the file to the desktop.
NOTE: If you are using IE 8 or above you may get a warning that stops the program from downloading. Just click on the warning and allow the download to complete.
Close all open windows and browsers.

• XP users: Double click the AdwCleaner icon to start the program.
• Vista/7/8 users: Right click the AdwCleaner icon on the desktop, click Run as administrator and accept the UAC prompt to run AdwCleaner.
  You will see the following console:

• Click the Scan button and wait for the scan to finish.
• After the Scan has finished the window may or may not show what it found and above, in the progress bar, you will see: Pending. Please uncheck elements you don't want to remove.
• Click the Clean button.
• Everything checked will be moved to Quarantine.
• When the program has finished cleaning a report appears.Once done it will ask to reboot, allow this

• On reboot a log will be produced please copy / paste that in your next reply. This report is also saved to C:\AdwCleaner\AdwCleaner[C0].txt

[Ardent]

# AdwCleaner v6.046 - Logfile created 29/04/2017 at 15:43:35
# Updated on 24/04/2017 by Malwarebytes
# Database : 2017-04-29.1 [Server]
# Operating System : Windows 7 Home Premium Service Pack 1 (X64)
# Username : NewPC - NEWPC-PC
# Running from : C:\Users\NewPC\Desktop\Downloads\adwcleaner_6.046.exe
# Mode: Clean
# Support : https://www.malwarebytes.com/support



***** [ Services ] *****



***** [ Folders ] *****

[-] Folder deleted: C:\Users\NewPC\AppData\Roaming\RPEng
[-] Folder deleted: C:\Users\NewPC\AppData\Roaming\Mozilla\Firefox\Profiles\zejab4qm.default-1483663109593\StumbleUpon
[-] Folder deleted: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hotspot
[-] Folder deleted: C:\Program Files (x86)\Common Files\freemake shared
[-] Folder deleted: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\LavasoftTcpService


***** [ Files ] *****

[-] File deleted: C:\Windows\SysNative\LavasoftTcpService64.dll
[-] File deleted: C:\Windows\SysNative\LavasoftTcpServiceOff.ini
[-] File deleted: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HowToRemove.html.lnk
[-] File deleted: C:\Windows\SysWOW64\lavasofttcpservice.dll
[-] File deleted: C:\Windows\SysWOW64\LavasoftTcpServiceOff.ini


***** [ DLL ] *****



***** [ WMI ] *****



***** [ Shortcuts ] *****



***** [ Scheduled Tasks ] *****



***** [ Registry ] *****

[-] Key deleted: HKLM\SOFTWARE\Classes\LavasoftTcpServiceLib.DataContainer
[-] Key deleted: HKLM\SOFTWARE\Classes\LavasoftTcpServiceLib.DataContainer.1
[-] Key deleted: HKLM\SOFTWARE\Classes\LavasoftTcpServiceLib.DataController
[-] Key deleted: HKLM\SOFTWARE\Classes\LavasoftTcpServiceLib.DataController.1
[-] Key deleted: HKLM\SOFTWARE\Classes\LavasoftTcpServiceLib.DataTable
[-] Key deleted: HKLM\SOFTWARE\Classes\LavasoftTcpServiceLib.DataTable.1
[-] Key deleted: HKLM\SOFTWARE\Classes\LavasoftTcpServiceLib.DataTableFields
[-] Key deleted: HKLM\SOFTWARE\Classes\LavasoftTcpServiceLib.DataTableFields.1
[-] Key deleted: HKLM\SOFTWARE\Classes\LavasoftTcpServiceLib.DataTableHolder
[-] Key deleted: HKLM\SOFTWARE\Classes\LavasoftTcpServiceLib.DataTableHolder.1
[-] Key deleted: HKLM\SOFTWARE\Classes\LavasoftTcpServiceLib.LSPLogic
[-] Key deleted: HKLM\SOFTWARE\Classes\LavasoftTcpServiceLib.LSPLogic.1
[-] Key deleted: HKLM\SOFTWARE\Classes\LavasoftTcpServiceLib.ReadOnlyManager
[-] Key deleted: HKLM\SOFTWARE\Classes\LavasoftTcpServiceLib.ReadOnlyManager.1
[-] Key deleted: HKLM\SOFTWARE\Classes\LavasoftTcpServiceLib.WFPController
[-] Key deleted: HKLM\SOFTWARE\Classes\LavasoftTcpServiceLib.WFPController.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\LavasoftTcpServiceLib.DataContainer
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\LavasoftTcpServiceLib.DataContainer.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\LavasoftTcpServiceLib.DataController
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\LavasoftTcpServiceLib.DataController.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\LavasoftTcpServiceLib.DataTable
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\LavasoftTcpServiceLib.DataTable.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\LavasoftTcpServiceLib.DataTableFields
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\LavasoftTcpServiceLib.DataTableFields.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\LavasoftTcpServiceLib.DataTableHolder
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\LavasoftTcpServiceLib.DataTableHolder.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\LavasoftTcpServiceLib.LSPLogic
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\LavasoftTcpServiceLib.LSPLogic.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\LavasoftTcpServiceLib.ReadOnlyManager
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\LavasoftTcpServiceLib.ReadOnlyManager.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\LavasoftTcpServiceLib.WFPController
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\LavasoftTcpServiceLib.WFPController.1
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\{2CE0F1DC-C504-4B7B-A385-D94A2531DFFB}
[-] Key deleted: HKU\S-1-5-21-559702275-2648494096-679061964-1000\Software\PRODUCTSETUP
[-] Key deleted: HKU\S-1-5-21-559702275-2648494096-679061964-1000\Software\csastats
[-] Key deleted: HKU\S-1-5-21-559702275-2648494096-679061964-1000\Software\AppDataLow\Software\adawarebp
[#] Key deleted on reboot: HKCU\Software\PRODUCTSETUP
[#] Key deleted on reboot: HKCU\Software\csastats
[#] Key deleted on reboot: HKCU\Software\AppDataLow\Software\adawarebp
[-] Key deleted: HKLM\SOFTWARE\Lavasoft\Web Companion
[#] Key deleted on reboot: [x64] HKCU\Software\PRODUCTSETUP
[#] Key deleted on reboot: [x64] HKCU\Software\csastats
[#] Key deleted on reboot: [x64] HKCU\Software\AppDataLow\Software\adawarebp
[-] Key deleted: [x64] HKLM\SOFTWARE\Microsoft\Shared Tools\MsConfig\StartupReg\Search Protection
[-] Value deleted: HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION [WeatherBug.exe]
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\webcompanion.com
[-] Key deleted: HKLM\SYSTEM\CurrentControlSet\Control\Power\User\PowerSchemes\e24b7131-d039-43cb-9e6f-ad4be601ec1f
[-] Key deleted: HKLM\SYSTEM\CurrentControlSet\Control\Power\User\PowerSchemes\04262113-2a31-48e1-b4bb-3b42174bea0f
[-] Key deleted: HKLM\SYSTEM\ControlSet002\Control\Power\User\PowerSchemes\e24b7131-d039-43cb-9e6f-ad4be601ec1f
[-] Key deleted: HKLM\SYSTEM\ControlSet002\Control\Power\User\PowerSchemes\04262113-2a31-48e1-b4bb-3b42174bea0f
[#] Key deleted on reboot: HKLM\SYSTEM\ControlSet001\Control\Power\User\PowerSchemes\e24b7131-d039-43cb-9e6f-ad4be601ec1f
[#] Key deleted on reboot: HKLM\SYSTEM\ControlSet001\Control\Power\User\PowerSchemes\04262113-2a31-48e1-b4bb-3b42174bea0f
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\LavasoftTcpService.exe


***** [ Web browsers ] *****

[-] [C:\Users\NewPC\AppData\Local\Chromium\User Data\Default\Web data] [Search Provider] Deleted: yahoo! powered
[-] [C:\Users\NewPC\AppData\Local\Chromium\User Data\Default] [startup_urls] Deleted: hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_fremkfs_16_25&param1=1&param2=f%3D7%26b%3Dchmm%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0Fzz0B0CtCtBzz0BtD0ByDyByEzzyB0DtN0D0Tzu0StCyCtAtBtN1L2XzutAtFtBtBtFtAtFzztN1L1Czu1BtAtN1L1G1B1V1N2Y1L1Qzu2StBtB0Bzy0FtB0EtAtGyCtBzz0BtG0E0E0F0BtGtCtBzz0BtGyEzy0D0FyB0D0C0F0FtCyD0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtC0E0B0DtDtCzytGyD0EtAyDtGyEtBzytCtGzz0ByDyEtG0Azy0FyCyB0ByDtBzzzztBtD2QtN0A0LzutB%26cr%3D211167893%26a%3Dwbf_fremkfs_16_25%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium&uref=chmm
[-] [C:\Users\NewPC\AppData\Local\Chromium\User Data\Default] [homepage] Deleted: hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_fremkfs_16_25&param1=1&param2=f%3D1%26b%3Dchmm%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1Qzu0Fzz0B0CtCtBzz0BtD0ByDyByEzzyB0DtN0D0Tzu0StCyCtAtBtN1L2XzutAtFtBtBtFtAtFzztN1L1Czu1BtAtN1L1G1B1V1N2Y1L1Qzu2StBtB0Bzy0FtB0EtAtGyCtBzz0BtG0E0E0F0BtGtCtBzz0BtGyEzy0D0FyB0D0C0F0FtCyD0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtC0E0B0DtDtCzytGyD0EtAyDtGyEtBzytCtGzz0ByDyEtG0Azy0FyCyB0ByDtBzzzztBtD2QtN0A0LzutB%26cr%3D211167893%26a%3Dwbf_fremkfs_16_25%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium&uref=chmm
[-] [C:\Users\NewPC\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: ask.com
[-] [C:\Users\NewPC\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: aol.com
[-] [C:\Users\NewPC\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: search.yahoo.com


*************************

:: "Tracing" keys deleted
:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C1].txt - [948 Bytes] - [07/02/2016 13:12:08]
C:\AdwCleaner\AdwCleaner[C3].txt - [1326 Bytes] - [11/11/2015 07:43:01]
C:\AdwCleaner\AdwCleaner[C4].txt - [892 Bytes] - [11/11/2015 08:10:34]
C:\AdwCleaner\AdwCleaner[C5].txt - [889 Bytes] - [11/11/2015 12:15:25]
C:\AdwCleaner\AdwCleaner[C6].txt - [8155 Bytes] - [29/04/2017 15:43:35]
C:\AdwCleaner\AdwCleaner[R0].txt - [1235 Bytes] - [19/04/2015 07:54:13]
C:\AdwCleaner\AdwCleaner[R1].txt - [941 Bytes] - [19/04/2015 08:04:18]
C:\AdwCleaner\AdwCleaner[R2].txt - [999 Bytes] - [21/04/2015 17:28:28]
C:\AdwCleaner\AdwCleaner[R3].txt - [1783 Bytes] - [06/08/2015 11:10:22]
C:\AdwCleaner\AdwCleaner[S0].txt - [1251 Bytes] - [19/04/2015 07:55:37]
C:\AdwCleaner\AdwCleaner[S1].txt - [2710 Bytes] - [06/08/2015 11:11:20]
C:\AdwCleaner\AdwCleaner[S2].txt - [1932 Bytes] - [25/02/2016 17:50:22]
C:\AdwCleaner\AdwCleaner[S5].txt - [1204 Bytes] - [11/11/2015 07:41:45]
C:\AdwCleaner\AdwCleaner[S6].txt - [794 Bytes] - [11/11/2015 08:09:20]
C:\AdwCleaner\AdwCleaner[S7].txt - [791 Bytes] - [11/11/2015 12:14:30]
C:\AdwCleaner\AdwCleaner[S8].txt - [7758 Bytes] - [29/04/2017 15:42:30]

########## EOF - C:\AdwCleaner\AdwCleaner[C6].txt - [9027 Bytes] ##########
 

[zep516]

Hello,

That's a bit more then I expected and it's all junk nothing to do with the E-Mail issue, but junk none the less. I think it will be best to follow this up with a Malwarebytes scan. You should keep this program and anytime something doesn't feel right scan with it.

So when time permits.

Next

• Please download Malwarebytes Anti-Malware to your desktop.
• Double-click mbam-setup-version.exe and follow the prompts to install the program.
• Launch Malwarebytes Anti-Malware
• Then click Finish.
• If an update is found, you will be prompted to download and install the latest version.
• Once the program has loaded, select Scan now. Or select the Threat Scan from the Scan menu.
• When the scan is complete , make sure that that all Threats are selected, and click Remove Selected.
• Reboot your computer if prompted.

Posting the Malwarebytes log.

• After the restart once you are back at your desktop, open MBAM once more.
• Click on the History tab > Application Logs.
• Double click on the Scan Log which shows the Date and time of the scan just performed.
• Click 'Export'.
• Click 'Text file (*.txt)'
• In the Save File dialog box which appears, click on Desktop.
• In the File name: box type a name for your scan log.
• A message box named 'File Saved' should appear stating "Your file has been successfully exported".
• Click Ok
• post that saved log to your next reply.

[Ardent]

I deleted all these after quarantining and rebooting

 

 

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 4/30/17
Scan Time: 6:52 AM
Logfile: Malware.txt
Administrator: Yes

-Software Information-
Version: 3.0.6.1469
Components Version: 1.0.103
Update Package Version: 1.0.1839
License: Trial

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: NewPC-PC\NewPC

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 364549
Time Elapsed: 12 min, 10 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 3
PUP.Optional.WinYahoo, HKU\S-1-5-21-559702275-2648494096-679061964-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\BFREPORT, Quarantined, [88], [262014],1.0.1839
PUP.Optional.ByteFence, HKLM\SOFTWARE\MICROSOFT\TRACING\ByteFence_RASAPI32, Quarantined, [608], [389038],1.0.1839
PUP.Optional.ByteFence, HKLM\SOFTWARE\MICROSOFT\TRACING\ByteFence_RASMANCS, Quarantined, [608], [389038],1.0.1839

Registry Value: 1
PUP.Optional.WinYahoo, HKU\S-1-5-21-559702275-2648494096-679061964-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\BFREPORT|FILENAME, Quarantined, [88], [262014],1.0.1839

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 3
Trojan.Clicker.FMS, C:\PROGRAMDATA\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}, Quarantined, [11509], [174741],1.0.1839
PUP.Optional.WinYahoo, C:\Users\NewPC\AppData\Local\{16D7208B-327F-4C33-5FE7-69DB7B8F9543}\HowToRemove, Quarantined, [88], [246924],1.0.1839
PUP.Optional.WinYahoo, C:\USERS\NEWPC\APPDATA\LOCAL\{16D7208B-327F-4C33-5FE7-69DB7B8F9543}, Quarantined, [88], [246924],1.0.1839

File: 23
Trojan.Clicker.FMS, C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\8afc49b02429a, Quarantined, [11509], [174741],1.0.1839
PUP.Optional.WinYahoo, C:\USERS\NEWPC\APPDATA\LOCAL\{16D7208B-327F-4C33-5FE7-69DB7B8F9543}\NARO, Quarantined, [88], [246924],1.0.1839
PUP.Optional.WinYahoo, C:\Users\NewPC\AppData\Local\{16D7208B-327F-4C33-5FE7-69DB7B8F9543}\HowToRemove\chromium-min.jpg, Quarantined, [88], [246924],1.0.1839
PUP.Optional.WinYahoo, C:\Users\NewPC\AppData\Local\{16D7208B-327F-4C33-5FE7-69DB7B8F9543}\HowToRemove\control panel-min-min.JPG, Quarantined, [88], [246924],1.0.1839
PUP.Optional.WinYahoo, C:\Users\NewPC\AppData\Local\{16D7208B-327F-4C33-5FE7-69DB7B8F9543}\HowToRemove\down.png, Quarantined, [88], [246924],1.0.1839
PUP.Optional.WinYahoo, C:\Users\NewPC\AppData\Local\{16D7208B-327F-4C33-5FE7-69DB7B8F9543}\HowToRemove\ff menu.JPG, Quarantined, [88], [246924],1.0.1839
PUP.Optional.WinYahoo, C:\Users\NewPC\AppData\Local\{16D7208B-327F-4C33-5FE7-69DB7B8F9543}\HowToRemove\ff search engine-min.png, Quarantined, [88], [246924],1.0.1839
PUP.Optional.WinYahoo, C:\Users\NewPC\AppData\Local\{16D7208B-327F-4C33-5FE7-69DB7B8F9543}\HowToRemove\HowToRemove.html, Quarantined, [88], [246924],1.0.1839
PUP.Optional.WinYahoo, C:\Users\NewPC\AppData\Local\{16D7208B-327F-4C33-5FE7-69DB7B8F9543}\HowToRemove\hp-min ff.png, Quarantined, [88], [246924],1.0.1839
PUP.Optional.WinYahoo, C:\Users\NewPC\AppData\Local\{16D7208B-327F-4C33-5FE7-69DB7B8F9543}\HowToRemove\hp-min ie.png, Quarantined, [88], [246924],1.0.1839
PUP.Optional.WinYahoo, C:\Users\NewPC\AppData\Local\{16D7208B-327F-4C33-5FE7-69DB7B8F9543}\HowToRemove\search engine.gif, Quarantined, [88], [246924],1.0.1839
PUP.Optional.WinYahoo, C:\Users\NewPC\AppData\Local\{16D7208B-327F-4C33-5FE7-69DB7B8F9543}\HowToRemove\setup pages.gif, Quarantined, [88], [246924],1.0.1839
PUP.Optional.WinYahoo, C:\Users\NewPC\AppData\Local\{16D7208B-327F-4C33-5FE7-69DB7B8F9543}\HowToRemove\sp-min.png, Quarantined, [88], [246924],1.0.1839
PUP.Optional.WinYahoo, C:\Users\NewPC\AppData\Local\{16D7208B-327F-4C33-5FE7-69DB7B8F9543}\HowToRemove\start-min.jpg, Quarantined, [88], [246924],1.0.1839
PUP.Optional.WinYahoo, C:\Users\NewPC\AppData\Local\{16D7208B-327F-4C33-5FE7-69DB7B8F9543}\HowToRemove\up.png, Quarantined, [88], [246924],1.0.1839
PUP.Optional.WinYahoo, C:\Users\NewPC\AppData\Local\{16D7208B-327F-4C33-5FE7-69DB7B8F9543}\bapi.dat, Quarantined, [88], [246924],1.0.1839
PUP.Optional.WinYahoo, C:\Users\NewPC\AppData\Local\{16D7208B-327F-4C33-5FE7-69DB7B8F9543}\codi, Quarantined, [88], [246924],1.0.1839
PUP.Optional.WinYahoo, C:\Users\NewPC\AppData\Local\{16D7208B-327F-4C33-5FE7-69DB7B8F9543}\info.dat, Quarantined, [88], [246924],1.0.1839
PUP.Optional.WinYahoo, C:\Users\NewPC\AppData\Local\{16D7208B-327F-4C33-5FE7-69DB7B8F9543}\install.log, Quarantined, [88], [246924],1.0.1839
PUP.Optional.WinYahoo, C:\Users\NewPC\AppData\Local\{16D7208B-327F-4C33-5FE7-69DB7B8F9543}\malo, Quarantined, [88], [246924],1.0.1839
PUP.Optional.WinYahoo, C:\Users\NewPC\AppData\Local\{16D7208B-327F-4C33-5FE7-69DB7B8F9543}\sisi, Quarantined, [88], [246924],1.0.1839
PUP.Optional.WinYahoo, C:\Users\NewPC\AppData\Local\{16D7208B-327F-4C33-5FE7-69DB7B8F9543}\Sqlite3.dll, Quarantined, [88], [246924],1.0.1839
PUP.Optional.WinYahoo, C:\Users\NewPC\AppData\Local\{16D7208B-327F-4C33-5FE7-69DB7B8F9543}\uninst.dat, Quarantined, [88], [246924],1.0.1839

Physical Sector: 0
(No malicious items detected)


(end)

[zep516]

Looks good and I think we we ok here.

Are there any remaining issues ?

[Ardent]

At this time I am not aware of any. I appreciate all the help!

[zep516]

We need to remove the tools we used and then close the topic.

The following procedures will implement some cleanup procedures to remove these tools. It will also reset your System Restore by flushing out previous restore points and create a new restore point. It will also remove all the backups our tools may have made.
Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).

Why we need to remove some of our tools:
Some of the tools we have used to clean your computer were made by fellow malware fighters and are very powerful and if used incorrectly or at the wronge time can make the computer an expensive paper weight. They are updated all the time and some of them more than once a day so by the time you are ready to use them again they will already be outdated.


Download DelFix by Xplode and save it to your desktop.

• Run the tool by right click on the icon and Run as administrator option.
• Make sure that these ones are checked:
  • Remove disinfection tools
  • Purge system restore
  • Reset system settings
• Push Run.
• The program will run for a few seconds and display a notepad report.
  Paste it for my review.

[Ardent]

Thanks, done

[zep516]

Hello,

You're very welcome !

You usually get infected because your security settings are too low.

Here are a number of recommendations that will help tighten them, and which will contribute to making you a less likely victim:

Safe Computing Practices please read Here


Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

Thanks
Joe