a program called turbine seems to have taken over my computer my son was trying to download a hacked copy of a game and now a program seems to have taken over my computer I have run adwcleaner and thought i had the problem fixed but i keep getting messages on my computer telling me turbines has stopped working I can not turn on windows defender it it telling me my group policy is preventing it from being turned on I am not real computer smart so i i am going to need someone with patience to help me with this I tried running a windows tool to reset my computer to factory settings but it will not allow me to do this any help is greatly appreciated.
possible malware program called turbine has taken over my computer
Started by
lapoole
, Sep 03 2017 03:38 PM
turbine need help
#2
Posted 03 September 2017 - 06:50 PM
RKinner
-
- Expert
-
- 24,625 posts
Malware Expert
- Get FRST from http://www.bleepingc...very-scan-tool/You need to download the appropriate tool for your PC. If you don't know if you have a 32 or 64 bit system get them both. Only one will work and that's the right one.
- Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
- Check the Addition.txt box
- Press Scan button.
- It will produce a log called FRST.txt in the same directory the tool is run from.
- Please copy and paste log back here.
- It will generate another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.
#3
Posted 04 September 2017 - 07:51 AM
lapoole
- Topic Starter
-
- Member
-
- 5 posts
New Member
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 20-08-2017
Ran by mom (administrator) on LAPTOP-6VA2O89J (04-09-2017 09:22:09)
Running from C:\Users\mom\Downloads
Loaded Profiles: mom (Available Profiles: mom)
Platform: Windows 10 Home Version 1607 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Edge)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(TOSHIBA CORPORATION) C:\Windows\Temp\mssieulsrv.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Intel Security, Inc.) C:\Program Files\Common Files\Intel Security\PEF\CORE\PEFService.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
() C:\Program Files\AVAST Software\SecureLine\VpnSvc.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe
() C:\Program Files (x86)\PxpAtYqel0NV Updater\PxpAtYqel0NV Updater.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\VSCore_15_5\mcapexe.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\CSP\2.2.412.0\McCSPServiceHost.exe
() C:\Program Files (x86)\BrowserSafer\BrowserSafer.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(InstallerTech Co.) C:\Program Files (x86)\BrowserSafer\BrowserSaferMngr.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Spotify Ltd) C:\Users\mom\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(NetSupport Ltd) C:\Users\mom\AppData\Roaming\Frame\mvscp.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
() C:\Program Files (x86)\hmmmm\shakur.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(aa Company) C:\Users\mom\AppData\Roaming\Service\msvcp.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\HP\HP System Event\HPMSGSVC.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Overwolf LTD) C:\Program Files (x86)\Overwolf\Overwolf.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\platform\McUICnt.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Overwolf LTD) C:\Program Files (x86)\Common Files\Overwolf\0.106.227.0\OverwolfHelper.exe
(Overwolf LTD) C:\Program Files (x86)\Common Files\Overwolf\0.106.227.0\OverwolfHelper64.exe
(Overwolf LTD) C:\Program Files (x86)\Overwolf\0.106.227.0\OverwolfBrowser.exe
(HP Inc.) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
() C:\Users\mom\AppData\Local\imefdbl\imefdbl.exe
() C:\Users\mom\AppData\Local\imefdbl\wmiuesp.exe
() C:\Users\mom\AppData\Local\imefdbl\wmiuesp.exe
(Speculate) C:\Users\mom\AppData\Local\speculate.exe
() C:\ProgramData\Microsoft\Windows\NetworkCacheManager\ntcache.exe
() C:\Users\mom\AppData\Local\imefdbl\wmiuesp.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Users\mom\AppData\Local\imefdbl\wmiuesp.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Users\mom\AppData\Local\imefdbl\wmiuesp.exe
(Speculate) C:\Program Files (x86)\Adlon\speculate.exe
==================== Registry (Whitelisted) ====================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8520448 2015-08-03] (Realtek Semiconductor)
HKLM\...\Run: [DeliveryAndStatusCheck] => C:\Program Files\HP\HP ePrint\HP.DeliveryAndStatus.Desktop.App.exe [301832 2015-11-10] (HP)
HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [631808 2017-04-27] (Microsoft Corporation)
HKLM-x32\...\Run: [HPMessageService] => C:\Program Files (x86)\HP\HP System Event\HPMSGSVC.exe [653576 2015-06-29] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [PowerDVD14Agent] => C:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14Agent.exe [795336 2015-10-29] (CyberLink Corp.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-12-12] (Oracle Corporation)
HKLM-x32\...\Run: [${ISAPPNAME}] => "C:\Program Files (x86)\InstantSupp\InstantSupport.exe" -startup
HKLM-x32\...\Run: [BrowserSafer] => C:\Program Files (x86)\BrowserSafer\BrowserSaferMngr.exe [2881536 2017-07-04] (InstallerTech Co.)
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-3921682297-77452978-1352297690-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3071776 2017-08-28] (Valve Corporation)
HKU\S-1-5-21-3921682297-77452978-1352297690-1001\...\Run: [Spotify Web Helper] => C:\Users\mom\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1562224 2017-07-03] (Spotify Ltd)
HKU\S-1-5-21-3921682297-77452978-1352297690-1001\...\Run: [Spotify] => C:\Users\mom\AppData\Roaming\Spotify\Spotify.exe [7047792 2017-07-03] (Spotify Ltd)
HKU\S-1-5-21-3921682297-77452978-1352297690-1001\...\Run: [Discord] => C:\Users\mom\AppData\Local\Discord\app-0.0.298\Discord.exe [57477112 2017-08-08] (Discord Inc.)
HKU\S-1-5-21-3921682297-77452978-1352297690-1001\...\Run: [Overwolf] => C:\Program Files (x86)\Overwolf\OverwolfLauncher.exe [1052488 2017-08-23] ()
HKU\S-1-5-21-3921682297-77452978-1352297690-1001\...\Run: [Read] => C:\Users\mom\AppData\Roaming\Frame\mvscp.exe [30128 2008-10-14] (NetSupport Ltd)
HKU\S-1-5-21-3921682297-77452978-1352297690-1001\...\Run: [Service] => C:\Users\mom\AppData\Roaming\Service\start.js [263 2016-11-08] ()
HKU\S-1-5-21-3921682297-77452978-1352297690-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27815896 2017-07-28] (Skype Technologies S.A.)
HKU\S-1-5-21-3921682297-77452978-1352297690-1001\...\Run: [part64] => rundll32.exe "C:\Users\mom\AppData\Local\part64.dll",part64 <==== ATTENTION
HKU\S-1-5-21-3921682297-77452978-1352297690-1001\...\Run: [shakur] => C:\Program Files (x86)\hmmmm\shakur.exe [68993 2017-09-03] ()
HKU\S-1-5-21-3921682297-77452978-1352297690-1001\...\Run: [consoling] => C:\Program Files (x86)\Zigzagging\speculate.exe [11776 2017-09-03] (Speculate)
HKU\S-1-5-21-3921682297-77452978-1352297690-1001\...\Run: [WinResSync] => C:\WINDOWS\system32\regsvr32.exe /s "C:\Users\mom\AppData\Roaming\Microsoft\Protect\f3c369-e7a369-c5e20004-3badb1-27a0.rs" <==== ATTENTION
HKU\S-1-5-21-3921682297-77452978-1352297690-1001\...\RunOnce: [WinResSync] => C:\WINDOWS\system32\regsvr32.exe /s "C:\Users\mom\AppData\Roaming\Microsoft\Protect\f3c369-e7a369-c5e20004-3badb1-27a0.rs" <==== ATTENTION
HKU\S-1-5-21-3921682297-77452978-1352297690-1001\...\MountPoints2: {b3fb4480-27f8-11e7-b932-ec8eb558f368} - "F:\windows\AutoRun.exe"
HKU\S-1-5-18\...\RunOnce: [WinResSync] => C:\WINDOWS\system32\regsvr32.exe /s "C:\Users\mom\AppData\Roaming\Microsoft\Protect\db98ab9b-b046-4efc-a0d2-af566fad7d06.rs" <==== ATTENTION
Startup: C:\Users\mom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Gameroom.lnk [2017-09-03]
ShortcutTarget: Facebook Gameroom.lnk -> C:\Users\mom\AppData\Local\Facebook\Games\FacebookGameroom.exe (Facebook)
Startup: C:\Users\mom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\renewables.lnk [2017-09-03]
ShortcutTarget: renewables.lnk -> C:\Program Files (x86)\Zigzagging\speculate.exe (Speculate)
Startup: C:\Users\mom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Twitch.lnk [2017-08-17]
ShortcutTarget: Twitch.lnk -> C:\Users\mom\AppData\Roaming\Twitch\Bin\Twitch.exe (Twitch Interactive, Inc.)
GroupPolicy: Restriction - Chrome <==== ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyEnable: [.DEFAULT] => Proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:13101
ProxyEnable: [S-1-5-21-3921682297-77452978-1352297690-1001] => Proxy is enabled.
ProxyServer: [S-1-5-21-3921682297-77452978-1352297690-1001] => http=127.0.0.1:13101
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{814677af-e2ee-4865-8a73-21093d23e836}: [DhcpNameServer] 40.23.1.12
Tcpip\..\Interfaces\{b7295bf9-2962-4af1-a886-f82a21e0c6eb}: [NameServer] 82.163.142.8,95.211.158.136
Tcpip\..\Interfaces\{b7295bf9-2962-4af1-a886-f82a21e0c6eb}: [DhcpNameServer] 192.168.1.254
ManualProxies: 1http=127.0.0.1:13101
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_pthmed_17_21¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3Dwinyahoo%26cd%3D2XzuyEtN2Y1L1Qzu0E0Czz0E0ByDyDzz0FtAyCzzzyyDtAtCtN0D0Tzu0StCzyyBtAtN1L2XzutAtFtBzytFtAtFyDtDtN1L1Czu1ByCtN1L1G1B1V1N2Y1L1Qzu2StAtBtCtCtAtBtC0BtGyE0ByCzytGzyzz0E0AtGtDyD0C0EtG0FyDtCtCtDyB0FtA0C0FyDyB2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0Ezz0CtAyDtByB0DtGyDyDtAyBtGyE0B0EzytGzzyBtByBtG0D0BtCtCyC0CyC0F0DyD0DyC2QtN0A0LzuyE%26cr%3D1624204772%26a%3Dwbf_pthmed_17_21%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_pthmed_17_21¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3Dwinyahoo%26cd%3D2XzuyEtN2Y1L1Qzu0E0Czz0E0ByDyDzz0FtAyCzzzyyDtAtCtN0D0Tzu0StCzyyBtAtN1L2XzutAtFtBzytFtAtFyDtDtN1L1Czu1ByCtN1L1G1B1V1N2Y1L1Qzu2StAtBtCtCtAtBtC0BtGyE0ByCzytGzyzz0E0AtGtDyD0C0EtG0FyDtCtCtDyB0FtA0C0FyDyB2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0Ezz0CtAyDtByB0DtGyDyDtAyBtGyE0B0EzytGzzyBtByBtG0D0BtCtCyC0CyC0F0DyD0DyC2QtN0A0LzuyE%26cr%3D1624204772%26a%3Dwbf_pthmed_17_21%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://hp15-comm.msn.com/?pc=HRTE
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp15-comm.msn.com/?pc=HRTE
HKU\S-1-5-21-3921682297-77452978-1352297690-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp15-comm.msn.com/?pc=HRTE
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_pthmed_17_21¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwinyahoo%26cd%3D2XzuyEtN2Y1L1Qzu0E0Czz0E0ByDyDzz0FtAyCzzzyyDtAtCtN0D0Tzu0StCzyyBtAtN1L2XzutAtFtBzytFtAtFyDtDtN1L1Czu1ByCtN1L1G1B1V1N2Y1L1Qzu2StAtBtCtCtAtBtC0BtGyE0ByCzytGzyzz0E0AtGtDyD0C0EtG0FyDtCtCtDyB0FtA0C0FyDyB2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0Ezz0CtAyDtByB0DtGyDyDtAyBtGyE0B0EzytGzzyBtByBtG0D0BtCtCyC0CyC0F0DyD0DyC2QtN0A0LzuyE%26cr%3D1624204772%26a%3Dwbf_pthmed_17_21%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_pthmed_17_21¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwinyahoo%26cd%3D2XzuyEtN2Y1L1Qzu0E0Czz0E0ByDyDzz0FtAyCzzzyyDtAtCtN0D0Tzu0StCzyyBtAtN1L2XzutAtFtBzytFtAtFyDtDtN1L1Czu1ByCtN1L1G1B1V1N2Y1L1Qzu2StAtBtCtCtAtBtC0BtGyE0ByCzytGzyzz0E0AtGtDyD0C0EtG0FyDtCtCtDyB0FtA0C0FyDyB2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0Ezz0CtAyDtByB0DtGyDyDtAyBtGyE0B0EzytGzzyBtByBtG0D0BtCtCyC0CyC0F0DyD0DyC2QtN0A0LzuyE%26cr%3D1624204772%26a%3Dwbf_pthmed_17_21%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_pthmed_17_21¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwinyahoo%26cd%3D2XzuyEtN2Y1L1Qzu0E0Czz0E0ByDyDzz0FtAyCzzzyyDtAtCtN0D0Tzu0StCzyyBtAtN1L2XzutAtFtBzytFtAtFyDtDtN1L1Czu1ByCtN1L1G1B1V1N2Y1L1Qzu2StAtBtCtCtAtBtC0BtGyE0ByCzytGzyzz0E0AtGtDyD0C0EtG0FyDtCtCtDyB0FtA0C0FyDyB2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0Ezz0CtAyDtByB0DtGyDyDtAyBtGyE0B0EzytGzzyBtByBtG0D0BtCtCyC0CyC0F0DyD0DyC2QtN0A0LzuyE%26cr%3D1624204772%26a%3Dwbf_pthmed_17_21%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_pthmed_17_21¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwinyahoo%26cd%3D2XzuyEtN2Y1L1Qzu0E0Czz0E0ByDyDzz0FtAyCzzzyyDtAtCtN0D0Tzu0StCzyyBtAtN1L2XzutAtFtBzytFtAtFyDtDtN1L1Czu1ByCtN1L1G1B1V1N2Y1L1Qzu2StAtBtCtCtAtBtC0BtGyE0ByCzytGzyzz0E0AtGtDyD0C0EtG0FyDtCtCtDyB0FtA0C0FyDyB2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0Ezz0CtAyDtByB0DtGyDyDtAyBtGyE0B0EzytGzzyBtByBtG0D0BtCtCyC0CyC0F0DyD0DyC2QtN0A0LzuyE%26cr%3D1624204772%26a%3Dwbf_pthmed_17_21%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms}
SearchScopes: HKLM-x32 -> {45BB97A2-30EE-4FC1-9FA7-9CBD957AD8A3} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3921682297-77452978-1352297690-1001 -> DefaultScope {1711FC25-F05A-40CE-B859-A0C1CF01FD18} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=omr&hsimp=yhs-001&type=86311067¶m1=y6bdVFVIsvuYsgEClQfz8HyFH9tZCHsOZFHNP%2BYwJC1atm8eB7qfwFneYnkiNliisMUTA6U7CX9SMEKVkDH1dhIB3yKLuEe7b3NUbzQ39QW%2BE0yMQFLYgrj2pq9EMy6GiNrpZ6RmYWCrcS7sfVTmVSxACM7MtyYyBFwwQdMzTWXEvnrrdY%2Be9ATUyhepO60iX5JD2R68jqEyHushj1QI39y1kl6lNh5XEAHdmcn0WekAnlzMm95OeJPM5Vg3zHPLhrtoS6%2BvMnMpmPalVpgkzA%3D%3D&p={searchTerms}
SearchScopes: HKU\S-1-5-21-3921682297-77452978-1352297690-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_pthmed_17_21¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwinyahoo%26cd%3D2XzuyEtN2Y1L1Qzu0E0Czz0E0ByDyDzz0FtAyCzzzyyDtAtCtN0D0Tzu0StCzyyBtAtN1L2XzutAtFtBzytFtAtFyDtDtN1L1Czu1ByCtN1L1G1B1V1N2Y1L1Qzu2StAtBtCtCtAtBtC0BtGyE0ByCzytGzyzz0E0AtGtDyD0C0EtG0FyDtCtCtDyB0FtA0C0FyDyB2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0Ezz0CtAyDtByB0DtGyDyDtAyBtGyE0B0EzytGzzyBtByBtG0D0BtCtCyC0CyC0F0DyD0DyC2QtN0A0LzuyE%26cr%3D1624204772%26a%3Dwbf_pthmed_17_21%26os_ver%3D10.0%26os%3DWindows%2B10%2BHome&p={searchTerms}
SearchScopes: HKU\S-1-5-21-3921682297-77452978-1352297690-1001 -> {1711FC25-F05A-40CE-B859-A0C1CF01FD18} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=omr&hsimp=yhs-001&type=86311067¶m1=y6bdVFVIsvuYsgEClQfz8HyFH9tZCHsOZFHNP%2BYwJC1atm8eB7qfwFneYnkiNliisMUTA6U7CX9SMEKVkDH1dhIB3yKLuEe7b3NUbzQ39QW%2BE0yMQFLYgrj2pq9EMy6GiNrpZ6RmYWCrcS7sfVTmVSxACM7MtyYyBFwwQdMzTWXEvnrrdY%2Be9ATUyhepO60iX5JD2R68jqEyHushj1QI39y1kl6lNh5XEAHdmcn0WekAnlzMm95OeJPM5Vg3zHPLhrtoS6%2BvMnMpmPalVpgkzA%3D%3D&p={searchTerms}
SearchScopes: HKU\S-1-5-21-3921682297-77452978-1352297690-1001 -> {39F104E0-9361-4682-A372-28C13B942F44} URL = hxxp://www.search-shield.com/Results.aspx?gd=SY1000136&ctid=&ISID=CBA2B230-19F7-4B1B-9D41-9C0E319E6DC4&SearchSource=58&UM=8&D=070817&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3921682297-77452978-1352297690-1001 -> {45BB97A2-30EE-4FC1-9FA7-9CBD957AD8A3} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2017-09-03] (Microsoft Corporation)
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_121\bin\ssv.dll [2017-01-18] (Oracle Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2017-09-03] (Microsoft Corporation)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-01-18] (Oracle Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2015-07-01] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2016-07-21] (HP Inc.)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-09-03] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-09-03] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-09-03] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-09-03] (Microsoft Corporation)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\msc\McSnIePl64.dll [2016-11-18] (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\msc\McSnIePl.dll [2016-11-18] (McAfee, Inc.)
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
FireFox:
========
FF DefaultProfile: spb4qtg1.default
FF ProfilePath: C:\Users\mom\AppData\Roaming\Mozilla\Firefox\Profiles\spb4qtg1.default [2017-09-04]
FF SearchEngineOrder.1: Mozilla\Firefox\Profiles\spb4qtg1.default -> Search-shield powered by Bing
FF NewTab: Mozilla\Firefox\Profiles\spb4qtg1.default -> hxxp://www.search-shield.com/?gd=SY1000136&ctid=&ISID=CBA2B230-19F7-4B1B-9D41-9C0E319E6DC4&SearchSource=69&SSPV=EB_SSPV&Lay=1&UM=8&D=070817
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\spb4qtg1.default -> Search-shield powered by Bing
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\spb4qtg1.default -> Search-shield powered by Bing
FF Homepage: Mozilla\Firefox\Profiles\spb4qtg1.default -> hxxp://www.search-shield.com/?gd=SY1000136&ctid=&ISID=CBA2B230-19F7-4B1B-9D41-9C0E319E6DC4&SearchSource=55&UM=8&D=070817
FF Keyword.URL: Mozilla\Firefox\Profiles\spb4qtg1.default -> user_pref("keyword.URL", true);
FF Extension: (TLS 1.3 A/B Test Experiment) - C:\Users\mom\AppData\Roaming\Mozilla\Firefox\Profiles\spb4qtg1.default\features\{bad95e45-1496-4374-9679-b3d6b827f5c4}\[email protected] [2017-05-27]
FF SearchPlugin: C:\Users\mom\AppData\Roaming\Mozilla\Firefox\Profiles\spb4qtg1.default\searchplugins\Search-shield powered by Bing.xml [2017-07-08]
FF HKLM-x32\...\Thunderbird\Extensions: [[email protected]] - C:\Program Files\McAfee\MSK
FF Extension: (McAfee Anti-Spam Thunderbird Extension) - C:\Program Files\McAfee\MSK [2017-02-01] [not signed]
FF Plugin: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-01-18] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-01-18] (Oracle Corporation)
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL [2016-11-18] ()
FF Plugin: @unity3d.com/UnityPlayer64,version=1.0 -> C:\Program Files\Unity\WebPlayer64\loader-x64\npUnity3D64.dll [2015-06-08] (Unity Technologies ApS)
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1217157.dll [2015-02-05] (Adobe Systems, Inc.)
FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL [2016-11-18] ()
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2017-09-03] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [No File]
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [No File]
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2015-12-22] ()
FF Plugin HKU\S-1-5-21-3921682297-77452978-1352297690-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\mom\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2017-03-08] (Unity Technologies ApS)
StartMenuInternet: FIREFOX.EXE - firefox.exe
Chrome:
=======
CHR HomePage: Default -> homepage.ssoextension.com/
CHR NewTab: Default -> Active:"chrome-extension://jemmajldmcejplolocchkeegiaglelnj/newtab/newtab.html"
CHR Profile: C:\Users\mom\AppData\Local\Google\Chrome\User Data\Default [2017-09-04]
CHR Extension: (Google Slides) - C:\Users\mom\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-12-10]
CHR Extension: (Google Docs) - C:\Users\mom\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-12-10]
CHR Extension: (Google Drive) - C:\Users\mom\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-12-10]
CHR Extension: (YouTube) - C:\Users\mom\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-12-10]
CHR Extension: (Google Sheets) - C:\Users\mom\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-12-10]
CHR Extension: (Google Docs Offline) - C:\Users\mom\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-12-10]
CHR Extension: (Screen Addict) - C:\Users\mom\AppData\Local\Google\Chrome\User Data\Default\Extensions\jemmajldmcejplolocchkeegiaglelnj [2017-09-03]
CHR Extension: (Super Animes - Pokemon) - C:\Users\mom\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkanfekjmffmlpcpghgodmjdfbdpmhpp [2017-07-07]
CHR Extension: (Chrome Web Store Payments) - C:\Users\mom\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-08-21]
CHR Extension: (Gmail) - C:\Users\mom\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-12-10]
CHR Extension: (Chrome Media Router) - C:\Users\mom\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-08-07]
CHR HKLM\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-3921682297-77452978-1352297690-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [ngbhaomngilelhnemljngfjfjmbbcbhp] - hxxps://chrome.google.com/webstore/detail/ngbhaomngilelhnemljngfjfjmbbcbhp
CHR HKU\S-1-5-21-3921682297-77452978-1352297690-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gkcffmoikcgfhagefelmhiakelnjihik] - hxxps://chrome.google.com/webstore/detail/gkcffmoikcgfhagefelmhiakelnjihik
CHR HKLM-x32\...\Chrome\Extension: [iinglghmhcgdgjjlafobajghjamdchik] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
"ntcache" => service was unlocked. <==== ATTENTION
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [1530888 2017-07-29] ()
R2 BrowserSafer; C:\Program Files (x86)\BrowserSafer\BrowserSafer.exe [3742208 2017-07-04] () [File not signed]
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [4424384 2017-08-28] (Microsoft Corporation)
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-12-10] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-12-10] (Dropbox, Inc.)
S3 EasyAntiCheat; C:\WINDOWS\SysWOW64\EasyAntiCheat.exe [383016 2017-06-29] (EasyAntiCheat Ltd)
S2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [349728 2015-12-22] (WildTangent)
S2 HiPatchService; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9728 2017-05-11] (Hi-Rez Studios) [File not signed]
R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [603752 2016-10-14] (McAfee, Inc.)
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [321896 2017-07-06] (HP Inc.)
S2 HPWMISVC; c:\Program Files (x86)\HP\HP System Event\HPWMISVC.exe [602888 2015-06-29] (Hewlett-Packard Development Company, L.P.)
S2 igfxCUIService1.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [337888 2016-05-04] (Intel Corporation)
R2 McAPExe; C:\Program Files\Common Files\McAfee\VSCore_15_5\McAPExe.exe [963176 2016-10-07] (McAfee, Inc.)
S3 McAWFwk; C:\Program Files\Common Files\McAfee\ActWiz\McAWFwk.exe [379896 2015-07-03] (McAfee, Inc.)
R2 mcbootdelaystartsvc; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [603752 2016-10-14] (McAfee, Inc.)
R2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\2.2.412.0\\McCSPServiceHost.exe [1935464 2017-02-06] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [603752 2016-10-14] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [603752 2016-10-14] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [1307752 2016-10-20] (McAfee, Inc.)
S4 McOobeSv2; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [603752 2016-10-14] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [603752 2016-10-14] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [603752 2016-10-14] (McAfee, Inc.)
R3 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [242704 2016-09-08] (McAfee, Inc.)
R2 mfemms; C:\Program Files\Common Files\McAfee\SystemCore\\mfemms.exe [384016 2016-09-08] (McAfee, Inc.)
R3 mfevtp; C:\windows\system32\mfevtps.exe [331280 2016-09-08] (McAfee, Inc.)
R2 ModuleCoreService; C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe [1473128 2016-10-07] (McAfee, Inc.)
S3 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [603752 2016-10-14] (McAfee, Inc.)
R2 ntcache; C:\ProgramData\Microsoft\Windows\NetworkCacheManager\ntcache.exe [7089664 2017-07-08] () [File not signed] <==== ATTENTION
S3 OverwolfUpdater; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [1450824 2017-08-23] (Overwolf LTD)
R2 PEFService; C:\Program Files\Common Files\Intel Security\PEF\CORE\PEFService.exe [1041512 2016-09-08] (Intel Security, Inc.)
R2 PnkBstrA; C:\WINDOWS\SysWOW64\PnkBstrA.exe [76152 2017-03-17] ()
R2 PxpAtYqel0NV Updater; C:\Program Files (x86)\PxpAtYqel0NV Updater\PxpAtYqel0NV Updater.exe [313344 2017-09-03] () [File not signed]
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [389896 2014-04-14] ()
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [306944 2015-08-03] (Realtek Semiconductor)
R2 SecureLine; C:\Program Files\AVAST Software\SecureLine\VpnSvc.exe [445240 2015-04-29] ()
S2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [266848 2016-12-27] (Synaptics Incorporated)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [10803440 2017-07-26] (TeamViewer GmbH)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347320 2017-04-27] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103712 2017-08-01] (Microsoft Corporation)
S2 0061491499356124mcinstcleanup; C:\WINDOWS\TEMP\006149~1.EXE -cleanup -nolog [X]
S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]
S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R1 b4524bfc10a7012f6709259faec82471; C:\WINDOWS\system32\drivers\b4524bfc10a7012f6709259faec82471.sys [78744 2017-08-31] (MTQ0HV) <==== ATTENTION
R3 cfwids; C:\WINDOWS\System32\drivers\cfwids.sys [88120 2016-09-09] (McAfee, Inc.)
R3 clwvd6; C:\WINDOWS\system32\DRIVERS\clwvd6.sys [41400 2015-08-31] (CyberLink Corporation)
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131984 2017-05-18] (Samsung Electronics Co., Ltd.)
S3 HipShieldK; C:\WINDOWS\System32\drivers\HipShieldK.sys [216704 2016-08-02] (McAfee, Inc.)
R3 mfeaack; C:\WINDOWS\System32\drivers\mfeaack.sys [477752 2016-09-09] (McAfee, Inc.)
R3 mfeavfk; C:\WINDOWS\System32\drivers\mfeavfk.sys [364088 2016-09-09] (McAfee, Inc.)
S0 mfeelamk; C:\WINDOWS\System32\drivers\mfeelamk.sys [85656 2016-09-09] (McAfee, Inc.)
R3 mfefirek; C:\WINDOWS\System32\drivers\mfefirek.sys [512056 2016-09-09] (McAfee, Inc.)
R0 mfehidk; C:\WINDOWS\System32\drivers\mfehidk.sys [884792 2016-09-09] (McAfee, Inc.)
R3 mfencbdc; C:\WINDOWS\System32\DRIVERS\mfencbdc.sys [527496 2016-09-09] (McAfee, Inc.)
S3 mfencrk; C:\WINDOWS\System32\DRIVERS\mfencrk.sys [109336 2016-09-09] (McAfee, Inc.)
R3 mfeplk; C:\WINDOWS\System32\drivers\mfeplk.sys [110136 2016-09-09] (McAfee, Inc.)
R0 mfewfpk; C:\WINDOWS\System32\drivers\mfewfpk.sys [252984 2016-09-09] (McAfee, Inc.)
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
R3 RSP2STOR; C:\WINDOWS\system32\DRIVERS\RtsP2Stor.sys [301784 2015-07-09] (Realtek Semiconductor Corp.)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [886528 2015-07-13] (Realtek )
S3 RTSUER; C:\WINDOWS\system32\Drivers\RtsUer.sys [402136 2015-07-09] (Realsil Semiconductor Corporation)
R3 RTWlanE; C:\WINDOWS\System32\drivers\rtwlane.sys [6804480 2017-05-03] (Realtek Semiconductor Corporation )
S3 SmbDrv; C:\WINDOWS\System32\drivers\Smb_driver_AMDASF.sys [33448 2015-07-07] (Synaptics Incorporated)
R3 SmbDrvI; C:\WINDOWS\system32\DRIVERS\Smb_driver_Intel.sys [33960 2015-07-07] (Synaptics Incorporated)
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [166288 2017-05-18] (Samsung Electronics Co., Ltd.)
R3 TXEIx64; C:\WINDOWS\System32\drivers\TXEIx64.sys [88592 2014-01-16] (Intel Corporation)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
R3 WirelessButtonDriver64; C:\WINDOWS\System32\drivers\WirelessButtonDriver64.sys [30544 2015-08-13] (HP)
S3 xhunter1; C:\WINDOWS\xhunter1.sys [37344 2017-05-09] (Wellbia.com Co., Ltd.)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-09-04 09:22 - 2017-09-04 09:27 - 000033688 _____ C:\Users\mom\Downloads\FRST.txt
2017-09-04 09:21 - 2017-09-04 09:22 - 000000000 ____D C:\FRST
2017-09-04 09:20 - 2017-09-04 09:21 - 002395648 _____ (Farbar) C:\Users\mom\Downloads\FRST64.exe
2017-09-04 06:08 - 2017-09-04 07:08 - 000000000 ____D C:\WINDOWS\system32\vmtzkzj
2017-09-04 04:27 - 2017-09-04 04:27 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2017-09-04 00:08 - 2017-09-04 03:08 - 000000000 ____D C:\WINDOWS\system32\wudokem
2017-09-03 22:11 - 2017-09-03 22:11 - 000000000 ____D C:\$WINDOWS.~BT
2017-09-03 22:10 - 2017-09-03 22:12 - 000000000 ___HD C:\$SysReset
2017-09-03 19:18 - 2017-09-03 19:18 - 000000000 ____D C:\Program Files\185e0ce85976036e67521ab2d09338d7
2017-09-03 18:55 - 2017-09-03 18:56 - 000528612 _____ C:\WINDOWS\Minidump\090317-34578-01.dmp
2017-09-03 18:51 - 2017-09-03 18:51 - 000000000 _____ C:\WINDOWS\Minidump\090317-47250-01.dmp
2017-09-03 18:48 - 2017-09-03 18:49 - 000617684 _____ C:\WINDOWS\Minidump\090317-34500-01.dmp
2017-09-03 18:07 - 2017-09-03 18:07 - 000364108 _____ C:\WINDOWS\Minidump\090317-36750-01.dmp
2017-09-03 18:05 - 2017-09-03 18:05 - 000113488 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vsonqtwa.sys
2017-09-03 17:45 - 2017-09-03 17:46 - 008182736 _____ (Malwarebytes) C:\Users\mom\Downloads\AdwCleaner.exe
2017-09-03 16:33 - 2017-09-03 17:22 - 000000000 ____D C:\ESD
2017-09-03 16:32 - 2017-09-03 16:32 - 000000000 ___HD C:\$Windows.~WS
2017-09-03 16:30 - 2017-09-03 16:30 - 000376528 _____ (Microsoft Corporation) C:\Users\mom\Downloads\RefreshWindowsTool.exe
2017-09-03 03:46 - 2017-09-03 18:55 - 560262455 _____ C:\WINDOWS\MEMORY.DMP
2017-09-03 03:46 - 2017-09-03 03:48 - 000657820 _____ C:\WINDOWS\Minidump\090317-43609-01.dmp
2017-09-03 01:28 - 2017-09-04 09:10 - 000000000 ____D C:\Users\mom\AppData\Local\ctfhpkp
2017-09-03 01:28 - 2017-09-04 04:58 - 000000000 ____D C:\Users\mom\AppData\Local\imefdbl
2017-09-03 01:22 - 2017-09-03 18:55 - 000081696 _____ (Windows ® Win 7 DDK provider) C:\WINDOWS\system32\Drivers\msidntfs.sys
2017-09-03 01:22 - 2017-09-03 01:22 - 000000000 ____D C:\WINDOWS\SysWOW64\ctfxxvk
2017-09-03 01:22 - 2017-09-03 01:22 - 000000000 ____D C:\WINDOWS\system32\ctfxxvk
2017-09-03 01:22 - 2017-09-03 01:22 - 000000000 ____D C:\Users\mom\AppData\Roaming\et
2017-09-03 00:50 - 2017-09-03 00:52 - 000031449 _____ C:\WINDOWS\9ca4400e2532bd67e338b376e8d4f769.ps1
2017-09-03 00:50 - 2017-09-03 00:52 - 000003476 _____ C:\WINDOWS\System32\Tasks\9ca4400e2532bd67e338b376e8d4f769
2017-09-03 00:50 - 2017-09-03 00:50 - 000011776 _____ (Speculate) C:\WINDOWS\olympiad.exe
2017-09-03 00:50 - 2017-09-03 00:50 - 000011776 _____ (Speculate) C:\Users\mom\AppData\Local\speculate.exe
2017-09-03 00:50 - 2017-09-03 00:50 - 000003870 _____ C:\WINDOWS\System32\Tasks\k88929429
2017-09-03 00:50 - 2017-09-03 00:50 - 000003858 _____ C:\WINDOWS\System32\Tasks\56696979
2017-09-03 00:50 - 2017-09-03 00:50 - 000003850 _____ C:\WINDOWS\System32\Tasks\88929429
2017-09-03 00:50 - 2017-09-03 00:50 - 000003838 _____ C:\WINDOWS\System32\Tasks\7530278
2017-09-03 00:50 - 2017-09-03 00:50 - 000003742 _____ C:\WINDOWS\System32\Tasks\bak88929429k88929429
2017-09-03 00:50 - 2017-09-03 00:50 - 000003728 _____ C:\WINDOWS\System32\Tasks\ba5669697956696979
2017-09-03 00:50 - 2017-09-03 00:50 - 000003718 _____ C:\WINDOWS\System32\Tasks\ba8892942988929429
2017-09-03 00:50 - 2017-09-03 00:50 - 000003706 _____ C:\WINDOWS\System32\Tasks\ba75302787530278
2017-09-03 00:50 - 2017-09-03 00:50 - 000000020 _____ C:\WINDOWS\b56696979
2017-09-03 00:50 - 2017-09-03 00:50 - 000000000 ___HD C:\Program Files (x86)\hmmmm
2017-09-03 00:50 - 2017-09-03 00:50 - 000000000 ___HD C:\Program Files (x86)\Adlon
2017-09-03 00:50 - 2017-09-03 00:50 - 000000000 ____D C:\Program Files (x86)\Zigzagging
2017-09-03 00:50 - 2017-09-03 00:50 - 000000000 ____D C:\Program Files (x86)\melancholia
2017-09-03 00:49 - 2017-09-03 00:52 - 000003300 _____ C:\WINDOWS\System32\Tasks\185e0ce85976036e67521ab2d09338d7
2017-09-03 00:48 - 2017-09-03 00:48 - 000021598 _____ C:\WINDOWS\System32\Tasks\PxpAtYqel0NV
2017-09-03 00:48 - 2017-09-03 00:48 - 000000000 ____D C:\Program Files (x86)\PxpAtYqel0NV Updater
2017-09-03 00:48 - 2017-09-03 00:48 - 000000000 ____D C:\Program Files (x86)\PxpAtYqel0NV
2017-09-03 00:47 - 2017-09-03 00:47 - 000140800 _____ C:\Users\mom\AppData\Local\installer.dat
2017-09-03 00:46 - 2017-09-03 00:46 - 000014848 _____ C:\Users\mom\AppData\Local\part64.dll
2017-08-31 15:29 - 2017-08-31 15:29 - 000796160 _____ C:\WINDOWS\9c441f53f3a2b44c69c9b706bfde1328.exe
2017-08-31 15:29 - 2017-08-31 15:29 - 000078744 _____ (MTQ0HV) C:\WINDOWS\system32\Drivers\b4524bfc10a7012f6709259faec82471.sys
2017-08-31 15:29 - 2017-08-31 15:29 - 000037159 _____ C:\WINDOWS\uninstaller.dat
2017-08-30 15:58 - 2017-08-30 15:58 - 000000222 _____ C:\Users\mom\Desktop\Brawlhalla.url
2017-08-29 11:49 - 2017-08-04 01:31 - 001564512 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2017-08-29 11:49 - 2017-08-04 01:31 - 001214816 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2017-08-29 11:49 - 2017-08-04 01:31 - 000629088 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2017-08-29 11:49 - 2017-08-04 01:31 - 000544096 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2017-08-29 11:49 - 2017-08-04 01:31 - 000335712 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcntel.dll
2017-08-29 11:49 - 2017-08-04 01:31 - 000334176 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2017-08-29 11:49 - 2017-08-04 01:31 - 000233824 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2017-08-29 11:49 - 2017-08-04 01:31 - 000136032 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2017-08-29 11:49 - 2017-08-04 01:31 - 000096608 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2017-08-29 11:49 - 2017-08-04 01:31 - 000034656 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCensus.exe
2017-08-29 11:49 - 2017-08-04 00:26 - 000192864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aepic.dll
2017-08-28 06:38 - 2017-08-28 06:38 - 000000000 ____D C:\Users\mom\AppData\Roaming\app_hConfig
2017-08-24 21:41 - 2017-08-24 21:41 - 000000221 _____ C:\Users\mom\Desktop\Call of Duty Modern Warfare 3 - Multiplayer.url
2017-08-23 10:59 - 2017-08-23 10:59 - 000000000 ____D C:\Users\mom\AppData\Roaming\RussianFishingLLC
2017-08-22 17:25 - 2017-08-22 17:25 - 000000222 _____ C:\Users\mom\Desktop\This War of Mine.url
2017-08-21 23:07 - 2017-08-26 20:17 - 000000241 _____ C:\Users\mom\Documents\ClownfishVoiceChanger.ini
2017-08-21 23:07 - 2017-08-21 23:07 - 000000000 ____D C:\Users\mom\Documents\ClownfishSoundTemp
2017-08-21 23:06 - 2017-08-21 23:06 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ClownfishVoiceChanger
2017-08-21 23:06 - 2017-08-21 23:06 - 000000000 ____D C:\Program Files (x86)\ClownfishVoiceChanger
2017-08-19 22:39 - 2017-08-19 22:39 - 000000222 _____ C:\Users\mom\Desktop\Fishing Planet.url
2017-08-17 21:29 - 2017-09-04 04:27 - 000000000 ____D C:\Users\mom\AppData\Roaming\Twitch
2017-08-17 21:29 - 2017-08-17 21:29 - 000000977 _____ C:\Users\mom\Desktop\Twitch.lnk
2017-08-17 21:29 - 2017-08-17 21:29 - 000000963 _____ C:\Users\mom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Twitch.lnk
2017-08-17 21:28 - 2017-08-17 21:29 - 124418192 _____ C:\Users\mom\Downloads\TwitchSetup_[usher-55336540].exe
2017-08-17 06:00 - 2017-08-17 06:00 - 000001119 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 12.lnk
2017-08-17 06:00 - 2017-08-17 06:00 - 000001107 _____ C:\Users\Public\Desktop\TeamViewer 12.lnk
2017-08-17 06:00 - 2017-08-17 06:00 - 000000000 ____D C:\Users\mom\AppData\Roaming\TeamViewer
2017-08-17 05:59 - 2017-08-17 06:07 - 000000000 ____D C:\Program Files (x86)\TeamViewer
2017-08-17 05:30 - 2017-08-17 05:30 - 000001024 _____ C:\Users\mom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\osu!.lnk
2017-08-17 05:29 - 2017-08-19 04:26 - 000000000 ____D C:\Users\mom\AppData\Local\osu!
2017-08-13 14:05 - 2017-08-13 14:05 - 000000000 ____D C:\Users\mom\AppData\Local\Discord
2017-08-12 14:13 - 2017-08-12 14:13 - 000000222 _____ C:\Users\mom\Desktop\Worms W.M.D.url
2017-08-10 14:41 - 2017-08-10 14:41 - 000001282 _____ C:\Users\Public\Desktop\OBS Studio.lnk
2017-08-09 01:22 - 2017-08-01 13:20 - 002264344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2017-08-09 01:22 - 2017-08-01 13:20 - 000781144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWAHost.exe
2017-08-09 01:22 - 2017-08-01 13:16 - 006665952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2017-08-09 01:22 - 2017-08-01 13:10 - 000306800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.MediaControl.dll
2017-08-09 01:22 - 2017-08-01 13:07 - 005686784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2017-08-09 01:22 - 2017-08-01 12:51 - 000306688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieproxy.dll
2017-08-09 01:22 - 2017-08-01 12:51 - 000145920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWWIN.EXE
2017-08-09 01:22 - 2017-08-01 12:48 - 000297472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchProtocolHost.exe
2017-08-09 01:22 - 2017-08-01 12:47 - 000846336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WebcamUi.dll
2017-08-09 01:22 - 2017-08-01 12:47 - 000396288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werui.dll
2017-08-09 01:22 - 2017-08-01 12:45 - 001985536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certmgr.dll
2017-08-09 01:22 - 2017-08-01 12:39 - 001255936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AzureSettingSyncProvider.dll
2017-08-09 01:22 - 2017-08-01 12:38 - 000458752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlidprov.dll
2017-08-09 01:22 - 2017-08-01 12:37 - 003520512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xpsrchvw.exe
2017-08-09 01:22 - 2017-08-01 12:37 - 002641920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll
2017-08-09 01:22 - 2017-08-01 12:37 - 000647168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comuid.dll
2017-08-09 01:22 - 2017-08-01 12:36 - 007468544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2017-08-09 01:22 - 2017-08-01 12:34 - 001170944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Speech.dll
2017-08-09 01:22 - 2017-08-01 12:34 - 000709120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CPFilters.dll
2017-08-09 01:22 - 2017-08-01 12:32 - 002682880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netshell.dll
2017-08-09 01:22 - 2017-08-01 12:32 - 002648576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CertEnroll.dll
2017-08-09 01:22 - 2017-08-01 12:31 - 001988096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssrch.dll
2017-08-09 01:22 - 2017-08-01 12:31 - 000773120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchIndexer.exe
2017-08-09 01:22 - 2017-08-01 12:31 - 000598528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Web.dll
2017-08-09 01:22 - 2017-08-01 12:30 - 002997248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2017-08-09 01:22 - 2017-08-01 12:30 - 002482688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2017-08-09 01:22 - 2017-08-01 12:30 - 001556992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll
2017-08-09 01:22 - 2017-08-01 12:30 - 001013248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Web.Http.dll
2017-08-09 01:22 - 2017-08-01 10:15 - 001311744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msjet40.dll
2017-08-09 01:22 - 2017-08-01 10:15 - 000866816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mswdat10.dll
2017-08-09 01:22 - 2017-08-01 10:15 - 000641536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mswstr10.dll
2017-08-09 01:22 - 2017-08-01 10:15 - 000616448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrepl40.dll
2017-08-09 01:22 - 2017-08-01 10:15 - 000518144 _____ C:\WINDOWS\SysWOW64\msjetoledb40.dll
2017-08-09 01:22 - 2017-08-01 10:15 - 000475648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxbde40.dll
2017-08-09 01:22 - 2017-08-01 10:15 - 000375808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mspbde40.dll
2017-08-09 01:22 - 2017-08-01 10:15 - 000343552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrd3x40.dll
2017-08-09 01:22 - 2017-08-01 10:15 - 000339968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msexcl40.dll
2017-08-09 01:22 - 2017-08-01 10:15 - 000310272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrd2x40.dll
2017-08-09 01:22 - 2017-08-01 10:15 - 000290816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msjtes40.dll
2017-08-09 01:22 - 2017-08-01 10:15 - 000272896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstext40.dll
2017-08-09 01:22 - 2017-08-01 10:15 - 000240640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msltus40.dll
2017-08-09 01:22 - 2017-08-01 10:15 - 000144896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msjint40.dll
2017-08-09 01:22 - 2017-08-01 10:15 - 000083968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msjter40.dll
2017-08-09 01:22 - 2017-07-12 01:32 - 000068096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\frprov.dll
2017-08-09 01:22 - 2017-07-12 01:31 - 000130560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fdeploy.dll
2017-08-09 01:22 - 2017-07-12 01:13 - 000855040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\autofmt.exe
2017-08-09 01:22 - 2017-07-12 01:12 - 002750464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mispace.dll
2017-08-09 01:22 - 2017-07-12 01:10 - 000878592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\autoconv.exe
2017-08-09 01:21 - 2017-08-01 13:20 - 001431232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll
2017-08-09 01:21 - 2017-08-01 13:19 - 001980776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll
2017-08-09 01:21 - 2017-08-01 13:19 - 000577976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2017-08-09 01:21 - 2017-08-01 13:19 - 000339896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll
2017-08-09 01:21 - 2017-08-01 13:19 - 000266080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe
2017-08-09 01:21 - 2017-08-01 13:19 - 000120416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe
2017-08-09 01:21 - 2017-08-01 13:18 - 000139104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe
2017-08-09 01:21 - 2017-08-01 13:16 - 004023552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2017-08-09 01:21 - 2017-08-01 13:16 - 001845512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2017-08-09 01:21 - 2017-08-01 13:15 - 020967840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2017-08-09 01:21 - 2017-08-01 13:15 - 001360464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetsrc.dll
2017-08-09 01:21 - 2017-08-01 13:15 - 001277856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll
2017-08-09 01:21 - 2017-08-01 13:15 - 000981888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetcore.dll
2017-08-09 01:21 - 2017-08-01 12:59 - 000035328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tokenbinding.dll
2017-08-09 01:21 - 2017-08-01 12:58 - 000040960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBrokerUI.dll
2017-08-09 01:21 - 2017-08-01 12:56 - 000177664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Web.Diagnostics.dll
2017-08-09 01:21 - 2017-08-01 12:56 - 000123904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.HostName.dll
2017-08-09 01:21 - 2017-08-01 12:55 - 000087040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.ServiceDiscovery.Dnssd.dll
2017-08-09 01:21 - 2017-08-01 12:54 - 000180224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe
2017-08-09 01:21 - 2017-08-01 12:53 - 000557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StoreAgent.dll
2017-08-09 01:21 - 2017-08-01 12:52 - 000533504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FXSCOMEX.dll
2017-08-09 01:21 - 2017-08-01 12:52 - 000117760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AuthBroker.dll
2017-08-09 01:21 - 2017-08-01 12:51 - 000426496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Wallet.dll
2017-08-09 01:21 - 2017-08-01 12:51 - 000388608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2017-08-09 01:21 - 2017-08-01 12:51 - 000223232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgentUserBroker.exe
2017-08-09 01:21 - 2017-08-01 12:50 - 000431616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\efswrt.dll
2017-08-09 01:21 - 2017-08-01 12:50 - 000260096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Phoneutil.dll
2017-08-09 01:21 - 2017-08-01 12:49 - 004615168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2017-08-09 01:21 - 2017-08-01 12:48 - 000267776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncryptprov.dll
2017-08-09 01:21 - 2017-08-01 12:47 - 000787968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sbe.dll
2017-08-09 01:21 - 2017-08-01 12:47 - 000661504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WpcWebFilter.dll
2017-08-09 01:21 - 2017-08-01 12:47 - 000525824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintDialogs.dll
2017-08-09 01:21 - 2017-08-01 12:47 - 000368128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiobj.dll
2017-08-09 01:21 - 2017-08-01 12:45 - 002333184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmSvc.dll
2017-08-09 01:21 - 2017-08-01 12:42 - 018364928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2017-08-09 01:21 - 2017-08-01 12:40 - 019415040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2017-08-09 01:21 - 2017-08-01 12:40 - 012187136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2017-08-09 01:21 - 2017-08-01 12:39 - 007626240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2017-08-09 01:21 - 2017-08-01 12:37 - 012349440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2017-08-09 01:21 - 2017-08-01 12:37 - 000468992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.InkControls.dll
2017-08-09 01:21 - 2017-08-01 12:35 - 000675840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.dll
2017-08-09 01:21 - 2017-08-01 12:34 - 000886272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aadtb.dll
2017-08-09 01:21 - 2017-08-01 12:33 - 006031872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2017-08-09 01:21 - 2017-08-01 12:33 - 000589312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Sensors.dll
2017-08-09 01:21 - 2017-08-01 12:31 - 003664896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2017-08-09 01:21 - 2017-08-01 12:31 - 000690688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2017-08-09 01:21 - 2017-08-01 12:31 - 000542208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.Connectivity.dll
2017-08-09 01:21 - 2017-08-01 12:30 - 001886720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll
2017-08-09 01:21 - 2017-08-01 12:30 - 000751104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.BackgroundTransfer.dll
2017-08-09 01:21 - 2017-08-01 12:30 - 000711168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Search.dll
2017-08-09 01:21 - 2017-08-01 12:29 - 003106304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstsc.exe
2017-08-09 01:21 - 2017-08-01 12:28 - 000783360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TSWorkspace.dll
2017-08-09 01:21 - 2017-07-12 02:15 - 000496872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dnsapi.dll
2017-08-09 01:21 - 2017-07-12 02:12 - 001706488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2017-08-09 01:21 - 2017-07-12 02:12 - 001573280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2017-08-09 01:21 - 2017-07-12 01:55 - 000607072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupEngine.dll
2017-08-09 01:21 - 2017-07-12 01:55 - 000111968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupApi.dll
2017-08-09 01:21 - 2017-07-12 01:52 - 004312760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2017-08-09 01:21 - 2017-07-12 01:35 - 000008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dabapi.dll
2017-08-09 01:21 - 2017-07-12 01:32 - 000227328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\container.dll
2017-08-09 01:21 - 2017-07-12 01:31 - 000022016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\perfnet.dll
2017-08-09 01:21 - 2017-07-12 01:30 - 000034816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshhttp.dll
2017-08-09 01:21 - 2017-07-12 01:29 - 000025600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\httpapi.dll
2017-08-09 01:21 - 2017-07-12 01:25 - 000364544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupShim.dll
2017-08-09 01:21 - 2017-07-12 01:23 - 000671232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netlogon.dll
2017-08-09 01:21 - 2017-07-12 01:23 - 000076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\updatepolicy.dll
2017-08-09 01:21 - 2017-07-12 01:21 - 000711680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2017-08-09 01:21 - 2017-07-12 01:19 - 006474752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mspaint.exe
2017-08-09 01:21 - 2017-07-12 01:18 - 000525312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LogonController.dll
2017-08-09 01:21 - 2017-07-12 01:15 - 000029184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iscsium.dll
2017-08-09 01:21 - 2017-07-12 01:14 - 000536064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\untfs.dll
2017-08-09 01:21 - 2017-07-12 01:11 - 002154496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\storagewmi.dll
2017-08-09 01:21 - 2017-07-12 01:10 - 000546304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\uReFS.dll
2017-08-09 01:21 - 2017-07-12 01:09 - 000641024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MCRecvSrc.dll
2017-08-09 01:21 - 2017-07-12 01:07 - 001572352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2017-08-09 01:21 - 2017-07-12 01:05 - 000565248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rasapi32.dll
2017-08-09 01:20 - 2017-08-01 13:20 - 000116576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudExperienceHostCommon.dll
2017-08-09 01:20 - 2017-08-01 12:54 - 000505856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcastdvr.exe
2017-08-09 01:20 - 2017-08-01 12:54 - 000184320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserMgrProxy.dll
2017-08-09 01:20 - 2017-08-01 12:51 - 000483840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.AllJoyn.dll
2017-08-09 01:20 - 2017-08-01 12:50 - 000284672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\apprepsync.dll
2017-08-09 01:20 - 2017-08-01 12:50 - 000125952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\apprepapi.dll
2017-08-09 01:20 - 2017-08-01 12:41 - 000248832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dlnashext.dll
2017-08-09 01:20 - 2017-08-01 12:31 - 000566784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ShareHost.dll
2017-08-09 01:20 - 2017-07-12 01:29 - 000328192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\daxexec.dll
2017-08-09 01:20 - 2017-07-12 01:15 - 000893440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\autochk.exe
2017-08-09 01:20 - 2017-03-04 02:05 - 000134144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ErrorDetails.dll
2017-08-09 00:59 - 2017-08-01 14:53 - 000123904 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll
2017-08-09 00:59 - 2017-08-01 14:46 - 000349184 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchProtocolHost.exe
2017-08-09 00:59 - 2017-08-01 14:33 - 000230400 _____ (Microsoft Corporation) C:\WINDOWS\system32\windowslivelogin.dll
2017-08-09 00:59 - 2017-08-01 14:32 - 003401216 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll
2017-08-09 00:59 - 2017-08-01 14:30 - 001643008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Speech.dll
2017-08-09 00:59 - 2017-08-01 14:27 - 002538496 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssrch.dll
2017-08-09 00:59 - 2017-08-01 14:27 - 000903680 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchIndexer.exe
2017-08-09 00:59 - 2017-07-12 02:17 - 000081760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\stornvme.sys
2017-08-09 00:59 - 2017-07-12 01:24 - 000124928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\scmdisk0101.sys
2017-08-09 00:59 - 2017-03-04 02:14 - 000588288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidprov.dll
2017-08-09 00:58 - 2017-08-01 15:18 - 008169536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2017-08-09 00:57 - 2017-08-01 15:27 - 000118112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tdx.sys
2017-08-09 00:57 - 2017-08-01 15:21 - 000857440 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWAHost.exe
2017-08-09 00:57 - 2017-08-01 15:13 - 002532192 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2017-08-09 00:57 - 2017-08-01 14:52 - 000237568 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Web.Diagnostics.dll
2017-08-09 00:57 - 2017-08-01 14:48 - 000211968 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe
2017-08-09 00:57 - 2017-08-01 14:47 - 000748544 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll
2017-08-09 00:57 - 2017-08-01 14:46 - 000315904 _____ (Microsoft Corporation) C:\WINDOWS\system32\Phoneutil.dll
2017-08-09 00:57 - 2017-08-01 14:46 - 000260608 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgentUserBroker.exe
2017-08-09 00:57 - 2017-08-01 14:46 - 000147456 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsrv.dll
2017-08-09 00:57 - 2017-08-01 14:45 - 000561664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Wallet.dll
2017-08-09 00:57 - 2017-08-01 14:44 - 000642048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.InkControls.dll
2017-08-09 00:57 - 2017-08-01 14:43 - 000963584 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebcamUi.dll
2017-08-09 00:57 - 2017-08-01 14:42 - 000775168 _____ (Microsoft Corporation) C:\WINDOWS\system32\GamePanel.exe
2017-08-09 00:57 - 2017-08-01 14:40 - 002716672 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmSvc.dll
2017-08-09 00:57 - 2017-08-01 14:39 - 009129984 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2017-08-09 00:57 - 2017-08-01 14:32 - 004596224 _____ (Microsoft Corporation) C:\WINDOWS\system32\xpsrchvw.exe
2017-08-09 00:57 - 2017-08-01 14:30 - 002916864 _____ (Microsoft Corporation) C:\WINDOWS\system32\CertEnroll.dll
2017-08-09 00:57 - 2017-08-01 14:27 - 008076288 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2017-08-09 00:57 - 2017-08-01 14:27 - 002695680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll
2017-08-09 00:57 - 2017-08-01 14:27 - 001984000 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2017-08-09 00:57 - 2017-08-01 14:27 - 000774656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Web.dll
2017-08-09 00:57 - 2017-08-01 14:26 - 001513472 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2017-08-09 00:57 - 2017-08-01 14:25 - 001726976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll
2017-08-09 00:57 - 2017-08-01 14:24 - 003299840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstsc.exe
2017-08-09 00:57 - 2017-08-01 14:24 - 000998912 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWorkspace.dll
2017-08-09 00:57 - 2017-08-01 14:23 - 003615744 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2017-08-09 00:57 - 2017-07-12 01:23 - 000238592 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
2017-08-09 00:57 - 2017-07-12 01:23 - 000216576 _____ (Microsoft Corporation) C:\WINDOWS\system32\RdpRelayTransport.dll
2017-08-09 00:57 - 2017-07-12 01:23 - 000098304 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe
2017-08-09 00:57 - 2017-07-12 01:17 - 000552960 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
2017-08-09 00:57 - 2017-07-12 01:17 - 000252416 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll
2017-08-09 00:57 - 2017-07-12 01:12 - 000091648 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatepolicy.dll
2017-08-09 00:57 - 2017-07-12 01:09 - 003291136 _____ (Microsoft Corporation) C:\WINDOWS\system32\mispace.dll
2017-08-09 00:57 - 2017-07-12 01:06 - 000549376 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll
2017-08-09 00:57 - 2017-07-12 01:02 - 000869888 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2017-08-09 00:57 - 2017-07-12 00:59 - 002318336 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2017-08-09 00:57 - 2017-07-12 00:58 - 000392192 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll
2017-08-09 00:57 - 2017-07-11 22:49 - 000448629 _____ C:\WINDOWS\system32\ApnDatabase.xml
2017-08-09 00:57 - 2017-03-04 02:07 - 000909312 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Search.dll
2017-08-09 00:57 - 2017-03-04 02:05 - 001328640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Web.Http.dll
2017-08-09 00:56 - 2017-08-01 15:22 - 001860288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll
2017-08-09 00:56 - 2017-08-01 15:22 - 000360040 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlows.exe
2017-08-09 00:56 - 2017-08-01 15:18 - 000092512 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2017-08-09 00:56 - 2017-08-01 15:17 - 022220856 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2017-08-09 00:56 - 2017-08-01 15:17 - 001600632 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2017-08-09 00:56 - 2017-08-01 14:57 - 000372736 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXTaskFactory.dll
2017-08-09 00:56 - 2017-08-01 14:54 - 000042496 _____ (Microsoft Corporation) C:\WINDOWS\system32\tokenbinding.dll
2017-08-09 00:56 - 2017-08-01 14:48 - 000289792 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeveloperOptionsSettingsHandlers.dll
2017-08-09 00:56 - 2017-08-01 14:47 - 000049664 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBrokerUI.dll
2017-08-09 00:56 - 2017-08-01 14:46 - 000590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\efswrt.dll
2017-08-09 00:56 - 2017-08-01 14:46 - 000078336 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsqmcons.exe
2017-08-09 00:56 - 2017-08-01 14:45 - 000805888 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2017-08-09 00:56 - 2017-08-01 14:45 - 000472064 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2017-08-09 00:56 - 2017-08-01 14:45 - 000425984 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadcloudap.dll
2017-08-09 00:56 - 2017-08-01 14:43 - 000966144 _____ (Microsoft Corporation) C:\WINDOWS\system32\sbe.dll
2017-08-09 00:56 - 2017-08-01 14:42 - 006288384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2017-08-09 00:56 - 2017-08-01 14:40 - 000800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll
2017-08-09 00:56 - 2017-08-01 14:35 - 001908224 _____ (Microsoft Corporation) C:\WINDOWS\system32\AzureSettingSyncProvider.dll
2017-08-09 00:56 - 2017-08-01 14:33 - 004749824 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2017-08-09 00:56 - 2017-08-01 14:32 - 008114688 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2017-08-09 00:56 - 2017-08-01 14:30 - 000305152 _____ (Microsoft Corporation) C:\WINDOWS\system32\srvsvc.dll
2017-08-09 00:56 - 2017-08-01 14:29 - 004743680 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2017-08-09 00:56 - 2017-08-01 14:29 - 002852864 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsThresholdAdminFlowUI.dll
2017-08-09 00:56 - 2017-08-01 14:29 - 000874496 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2017-08-09 00:56 - 2017-08-01 14:27 - 004149248 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2017-08-09 00:56 - 2017-08-01 14:27 - 000765440 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Sensors.dll
2017-08-09 00:56 - 2017-08-01 14:24 - 001121280 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadtb.dll
2017-08-09 00:56 - 2017-07-12 02:00 - 000223072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2017-08-09 00:56 - 2017-07-12 01:16 - 000142848 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvcext.dll
2017-08-09 00:56 - 2017-07-12 01:13 - 001478656 _____ (Microsoft Corporation) C:\WINDOWS\system32\RecoveryDrive.exe
2017-08-09 00:56 - 2017-07-12 01:08 - 002861056 _____ (Microsoft Corporation) C:\WINDOWS\system32\storagewmi.dll
2017-08-09 00:56 - 2017-07-12 01:03 - 000826880 _____ (Microsoft Corporation) C:\WINDOWS\system32\netlogon.dll
2017-08-09 00:56 - 2016-08-02 04:13 - 001081856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2017-08-09 00:55 - 2017-08-01 15:31 - 007780192 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2017-08-09 00:55 - 2017-08-01 15:20 - 002446704 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll
2017-08-09 00:55 - 2017-08-01 15:18 - 004260064 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2017-08-09 00:55 - 2017-08-01 15:18 - 001983408 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2017-08-09 00:55 - 2017-08-01 15:18 - 001702392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll
2017-08-09 00:55 - 2017-08-01 15:17 - 001072248 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetcore.dll
2017-08-09 00:55 - 2017-08-01 15:17 - 000244816 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2017-08-09 00:55 - 2017-08-01 15:13 - 000387872 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpps.dll
2017-08-09 00:55 - 2017-08-01 14:51 - 000113664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.ServiceDiscovery.Dnssd.dll
2017-08-09 00:55 - 2017-08-01 14:47 - 000223744 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.HostName.dll
2017-08-09 00:55 - 2017-08-01 14:45 - 000456192 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiobj.dll
2017-08-09 00:55 - 2017-08-01 14:40 - 000945664 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebFilter.dll
2017-08-09 00:55 - 2017-08-01 14:39 - 000323072 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncryptprov.dll
2017-08-09 00:55 - 2017-08-01 14:38 - 013441536 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
2017-08-09 00:55 - 2017-08-01 14:30 - 000913920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.dll
2017-08-09 00:55 - 2017-08-01 14:26 - 000701952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.Connectivity.dll
2017-08-09 00:55 - 2017-08-01 14:24 - 000924672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.BackgroundTransfer.dll
2017-08-09 00:55 - 2017-07-12 02:14 - 001886896 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2017-08-09 00:55 - 2017-07-12 02:13 - 002253664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2017-08-09 00:55 - 2017-07-12 02:09 - 001181024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys
2017-08-09 00:55 - 2017-07-12 02:01 - 000156000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wfplwfs.sys
2017-08-09 00:55 - 2017-07-12 02:00 - 000160608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pacer.sys
2017-08-09 00:55 - 2017-07-12 01:59 - 000857952 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupEngine.dll
2017-08-09 00:55 - 2017-07-12 01:59 - 000148832 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupApi.dll
2017-08-09 00:55 - 2017-07-12 01:24 - 000025088 _____ (Microsoft Corporation) C:\WINDOWS\system32\perfnet.dll
2017-08-09 00:55 - 2017-07-12 01:21 - 000042496 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshhttp.dll
2017-08-09 00:55 - 2017-07-12 01:19 - 000488960 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupShim.dll
2017-08-09 00:55 - 2017-07-12 01:06 - 000937984 _____ (Microsoft Corporation) C:\WINDOWS\system32\MCRecvSrc.dll
2017-08-09 00:55 - 2017-07-12 01:01 - 000266752 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupSvc.dll
2017-08-09 00:55 - 2017-07-12 01:00 - 002370048 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll
2017-08-09 00:55 - 2017-07-12 00:59 - 006664192 _____ (Microsoft Corporation) C:\WINDOWS\system32\mspaint.exe
2017-08-09 00:55 - 2017-07-12 00:58 - 001130496 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
2017-08-09 00:55 - 2017-07-12 00:56 - 001826816 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2017-08-09 00:54 - 2017-08-01 15:32 - 000133984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecdd.sys
2017-08-09 00:54 - 2017-08-01 15:25 - 000168800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2017-08-09 00:54 - 2017-08-01 15:21 - 002759712 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2017-08-09 00:54 - 2017-08-01 15:21 - 000624048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2017-08-09 00:54 - 2017-08-01 14:52 - 022569472 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2017-08-09 00:54 - 2017-08-01 14:48 - 000223744 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2017-08-09 00:54 - 2017-08-01 14:47 - 000691200 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieproxy.dll
2017-08-09 00:54 - 2017-08-01 14:43 - 000945664 _____ (Microsoft Corporation) C:\WINDOWS\system32\iphlpsvc.dll
2017-08-09 00:54 - 2017-08-01 14:37 - 013091328 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2017-08-09 00:54 - 2017-08-01 14:36 - 023677440 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2017-08-09 00:54 - 2017-08-01 14:28 - 002895360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2017-08-09 00:54 - 2017-08-01 14:28 - 001490432 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2017-08-09 00:54 - 2017-07-12 02:15 - 002213760 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2017-08-09 00:54 - 2017-07-12 02:02 - 002186592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2017-08-09 00:54 - 2017-07-12 02:02 - 000402776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2017-08-09 00:54 - 2017-07-12 00:59 - 000632320 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasapi32.dll
2017-08-09 00:54 - 2017-07-12 00:57 - 000735744 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll
2017-08-09 00:54 - 2016-09-07 01:24 - 000057400 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsass.exe
2017-08-09 00:53 - 2017-08-01 15:21 - 000295264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe
2017-08-09 00:53 - 2017-08-01 15:21 - 000124072 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe
2017-08-09 00:53 - 2017-08-01 15:20 - 000684344 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2017-08-09 00:53 - 2017-08-01 15:20 - 000383776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll
2017-08-09 00:53 - 2017-08-01 15:20 - 000144736 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe
2017-08-09 00:53 - 2017-08-01 15:13 - 001102176 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\http.sys
2017-08-09 00:53 - 2017-08-01 15:01 - 007218176 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2017-08-09 00:53 - 2017-08-01 14:46 - 000094720 _____ (Microsoft Corporation) C:\WINDOWS\system32\wercplsupport.dll
2017-08-09 00:53 - 2017-08-01 14:45 - 000451072 _____ (Microsoft Corporation) C:\WINDOWS\system32\werui.dll
2017-08-09 00:53 - 2017-08-01 14:45 - 000171008 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWWIN.EXE
2017-08-09 00:53 - 2017-08-01 14:44 - 001010176 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2017-08-09 00:53 - 2017-08-01 14:43 - 000156672 _____ (Microsoft Corporation) C:\WINDOWS\system32\wersvc.dll
2017-08-09 00:53 - 2017-08-01 14:39 - 001281536 _____ (Microsoft Corporation) C:\WINDOWS\system32\werconcpl.dll
2017-08-09 00:53 - 2017-08-01 14:39 - 000353280 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.immersiveshell.serviceprovider.dll
2017-08-09 00:53 - 2017-08-01 14:34 - 001837056 _____ (Microsoft Corporation) C:\WINDOWS\system32\workfolderssvc.dll
2017-08-09 00:53 - 2017-07-12 02:16 - 000646688 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsapi.dll
2017-08-09 00:53 - 2017-07-12 01:55 - 004674872 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2017-08-09 00:53 - 2017-07-12 01:24 - 000013824 _____ (Microsoft Corporation) C:\WINDOWS\system32\dabapi.dll
2017-08-09 00:53 - 2017-07-12 01:23 - 000084480 _____ (Microsoft Corporation) C:\WINDOWS\system32\frprov.dll
2017-08-09 00:53 - 2017-07-12 01:21 - 000110080 _____ (Microsoft Corporation) C:\WINDOWS\system32\dab.dll
2017-08-09 00:53 - 2017-07-12 01:20 - 000031232 _____ (Microsoft Corporation) C:\WINDOWS\system32\httpapi.dll
2017-08-09 00:53 - 2017-07-12 01:19 - 000156160 _____ (Microsoft Corporation) C:\WINDOWS\system32\fdeploy.dll
2017-08-09 00:53 - 2017-07-12 01:16 - 000431616 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpAXHolder.dll
2017-08-09 00:53 - 2017-07-12 01:15 - 000265216 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsrslvr.dll
2017-08-09 00:53 - 2017-07-12 01:12 - 000035328 _____ (Microsoft Corporation) C:\WINDOWS\system32\iscsium.dll
2017-08-09 00:53 - 2017-07-12 01:11 - 000576512 _____ (Microsoft Corporation) C:\WINDOWS\system32\untfs.dll
2017-08-09 00:53 - 2017-07-12 01:07 - 000629248 _____ (Microsoft Corporation) C:\WINDOWS\system32\uReFS.dll
2017-08-09 00:53 - 2017-07-12 00:58 - 001231872 _____ (Microsoft Corporation) C:\WINDOWS\system32\dosvc.dll
2017-08-09 00:53 - 2017-03-04 02:16 - 000187904 _____ (Microsoft Corporation) C:\WINDOWS\system32\dialclient.dll
2017-08-09 00:52 - 2017-08-01 15:29 - 000376672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys
2017-08-09 00:52 - 2017-08-01 15:21 - 000026976 _____ (Microsoft Corporation) C:\WINDOWS\system32\browser_broker.exe
2017-08-09 00:52 - 2017-08-01 15:17 - 000241504 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHost.dll
2017-08-09 00:52 - 2017-08-01 14:50 - 000099328 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll
2017-08-09 00:52 - 2017-08-01 14:41 - 002222080 _____ (Microsoft Corporation) C:\WINDOWS\system32\certmgr.dll
2017-08-09 00:52 - 2017-08-01 14:38 - 001589760 _____ (Microsoft Corporation) C:\WINDOWS\system32\msdtctm.dll
2017-08-09 00:52 - 2017-08-01 14:32 - 000821248 _____ (Microsoft Corporation) C:\WINDOWS\system32\comuid.dll
2017-08-09 00:52 - 2017-08-01 14:23 - 000886784 _____ (Microsoft Corporation) C:\WINDOWS\system32\CPFilters.dll
2017-08-09 00:52 - 2017-07-12 01:25 - 000066560 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wcnfs.sys
2017-08-09 00:52 - 2017-07-12 01:23 - 000328192 _____ (Microsoft Corporation) C:\WINDOWS\system32\container.dll
2017-08-09 00:52 - 2017-07-12 01:22 - 000033280 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcimage.dll
2017-08-09 00:52 - 2017-07-12 01:21 - 000329728 _____ (Microsoft Corporation) C:\WINDOWS\system32\wc_storage.dll
2017-08-09 00:52 - 2017-07-12 01:07 - 000954880 _____ (Microsoft Corporation) C:\WINDOWS\system32\autoconv.exe
2017-08-09 00:51 - 2017-08-01 15:21 - 000146784 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHostCommon.dll
2017-08-09 00:51 - 2017-08-01 15:20 - 000079712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmbkmcl.sys
2017-08-09 00:51 - 2017-08-01 14:52 - 000080896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmbkmclr.sys
2017-08-09 00:51 - 2017-08-01 14:47 - 000651264 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.AllJoyn.dll
2017-08-09 00:51 - 2017-08-01 14:47 - 000268800 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserMgrProxy.dll
2017-08-09 00:51 - 2017-08-01 14:46 - 000379904 _____ (Microsoft Corporation) C:\WINDOWS\system32\apprepsync.dll
2017-08-09 00:51 - 2017-08-01 14:46 - 000176128 _____ (Microsoft Corporation) C:\WINDOWS\system32\apprepapi.dll
2017-08-09 00:51 - 2017-08-01 14:36 - 000295424 _____ (Microsoft Corporation) C:\WINDOWS\system32\dlnashext.dll
2017-08-09 00:51 - 2017-08-01 14:33 - 000167936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ErrorDetails.dll
2017-08-09 00:51 - 2017-08-01 14:27 - 000716800 _____ (Microsoft Corporation) C:\WINDOWS\system32\ShareHost.dll
2017-08-09 00:51 - 2017-07-12 02:15 - 000101216 _____ (Microsoft Corporation) C:\WINDOWS\system32\apisetschema.dll
2017-08-09 00:51 - 2017-07-12 01:59 - 001100128 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2017-08-09 00:51 - 2017-07-12 01:59 - 000989024 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2017-08-09 00:51 - 2017-07-12 01:59 - 000947040 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.efi
2017-08-09 00:51 - 2017-07-12 01:56 - 000277856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msiscsi.sys
2017-08-09 00:51 - 2017-07-12 01:19 - 000463872 _____ (Microsoft Corporation) C:\WINDOWS\system32\daxexec.dll
2017-08-09 00:51 - 2017-07-12 01:12 - 000970240 _____ (Microsoft Corporation) C:\WINDOWS\system32\autochk.exe
2017-08-09 00:51 - 2017-07-12 01:10 - 000927232 _____ (Microsoft Corporation) C:\WINDOWS\system32\autofmt.exe
2017-08-09 00:51 - 2017-07-12 01:06 - 000956416 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2017-08-09 00:51 - 2017-07-12 01:03 - 001692160 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2017-08-09 00:51 - 2017-07-12 01:01 - 002279424 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2017-08-09 00:51 - 2017-03-04 02:57 - 000372432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.MediaControl.dll
2017-08-09 00:50 - 2017-08-01 15:20 - 000557408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys
2017-08-09 00:50 - 2017-07-12 02:01 - 000715104 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2017-08-09 00:50 - 2017-07-12 02:00 - 000095584 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdstor.sys
2017-08-08 19:36 - 2017-08-13 14:05 - 000000000 ____D C:\Users\mom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Discord Inc
2017-08-05 22:03 - 2017-08-05 22:03 - 000000220 _____ C:\Program Files (x86)\DOOM II [bleep] on Earth.url
2017-08-05 07:31 - 2017-08-05 07:31 - 000000000 ____D C:\Users\mom\AppData\Local\zdoom
2017-08-05 04:05 - 2017-08-05 04:05 - 000000000 ____D C:\Users\mom\AppData\Local\RedTrigger
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-09-04 09:28 - 2016-12-10 13:59 - 000000000 ____D C:\Users\mom\AppData\Roaming\Skype
2017-09-04 04:29 - 2016-12-18 08:55 - 000000000 ____D C:\Users\mom
2017-09-04 04:27 - 2016-12-10 14:56 - 000000000 ____D C:\Program Files (x86)\Steam
2017-09-04 04:25 - 2017-01-27 04:56 - 000000000 ____D C:\Users\mom\AppData\Local\Overwolf
2017-09-04 03:24 - 2016-12-18 08:46 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2017-09-03 22:44 - 2016-07-16 07:47 - 000000000 ____D C:\WINDOWS\System
2017-09-03 21:47 - 2016-12-26 14:11 - 000000000 ____D C:\Users\mom\AppData\Roaming\.minecraft
2017-09-03 21:47 - 2016-12-24 04:08 - 000001318 _____ C:\Users\mom\Desktop\nativelog.txt
2017-09-03 21:33 - 2017-07-30 12:11 - 000003240 _____ C:\WINDOWS\System32\Tasks\HPCeeScheduleFormom
2017-09-03 21:33 - 2017-07-30 12:11 - 000000356 _____ C:\WINDOWS\Tasks\HPCeeScheduleFormom.job
2017-09-03 18:56 - 2017-07-08 05:38 - 000000000 ____D C:\ProgramData\boost_interprocess
2017-09-03 18:56 - 2016-12-10 13:54 - 000000000 __SHD C:\Users\mom\IntelGraphicsProfiles
2017-09-03 18:55 - 2017-06-03 00:51 - 000000000 ____D C:\WINDOWS\Minidump
2017-09-03 18:55 - 2016-12-18 09:14 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-09-03 18:55 - 2016-12-10 17:17 - 000000000 ____D C:\Program Files (x86)\Hi-Rez Studios
2017-09-03 18:50 - 2016-07-16 02:04 - 015990784 _____ C:\WINDOWS\system32\config\HARDWARE
2017-09-03 18:05 - 2016-07-16 02:04 - 000786432 _____ C:\WINDOWS\system32\config\BBI
2017-09-03 18:04 - 2017-05-01 08:11 - 000000000 ____D C:\AdwCleaner
2017-09-03 17:20 - 2017-08-01 13:13 - 000000000 ____D C:\WINDOWS\Panther
2017-09-03 17:20 - 2016-12-18 09:22 - 000012017 _____ C:\WINDOWS\diagwrn.xml
2017-09-03 17:20 - 2016-12-18 09:22 - 000010129 _____ C:\WINDOWS\diagerr.xml
2017-09-03 15:18 - 2017-03-18 00:33 - 000000000 ____D C:\Users\mom\BrawlhallaReplays
2017-09-03 14:29 - 2017-04-10 05:45 - 000001244 _____ C:\Users\mom\Desktop\Facebook Gameroom.lnk
2017-09-03 14:29 - 2017-04-10 05:45 - 000000000 ____D C:\Users\mom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Facebook
2017-09-03 10:18 - 2016-08-11 17:20 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
2017-09-03 10:04 - 2016-07-16 02:04 - 000032768 _____ C:\WINDOWS\system32\config\ELAM
2017-09-03 09:06 - 2016-07-16 07:47 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2017-09-03 03:49 - 2016-07-16 07:45 - 000000000 ____D C:\WINDOWS\INF
2017-09-03 03:13 - 2017-03-04 06:18 - 000004160 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{FA151F94-DA1F-45C1-BAB5-07D8A2A398F1}
2017-09-03 01:02 - 2016-12-10 14:01 - 000002315 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-09-03 01:02 - 2016-12-10 14:01 - 000002297 _____ C:\Users\mom\Desktop\Google Chrome.lnk
2017-09-03 00:50 - 2016-12-10 14:00 - 000000000 ____D C:\Program Files (x86)\Google
2017-09-01 21:37 - 2016-07-16 07:47 - 000000000 ____D C:\WINDOWS\AppReadiness
2017-08-31 19:16 - 2016-07-16 07:47 - 000000000 ___HD C:\Program Files\WindowsApps
2017-08-30 13:46 - 2017-01-24 22:16 - 000183112 _____ C:\WINDOWS\SysWOW64\PnkBstrB.exe
2017-08-30 08:41 - 2016-12-10 15:48 - 000000000 ____D C:\Users\mom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Roblox
2017-08-30 08:40 - 2016-12-10 15:48 - 000001249 _____ C:\Users\mom\Desktop\Roblox Studio.lnk
2017-08-29 20:34 - 2017-01-24 22:16 - 000183112 _____ C:\WINDOWS\SysWOW64\PnkBstrB.ex0
2017-08-29 11:51 - 2016-07-16 07:36 - 000000000 ____D C:\WINDOWS\CbsTemp
2017-08-28 17:00 - 2017-01-27 04:59 - 000000000 ____D C:\Program Files (x86)\Overwolf
2017-08-28 00:22 - 2017-03-16 01:34 - 000000000 ____D C:\Users\mom\AppData\Roaming\obs-studio
2017-08-25 08:31 - 2017-07-08 06:39 - 000000000 ____D C:\Users\mom\AppData\Local\KevinTrainer_CoD8
2017-08-24 22:20 - 2016-12-18 09:14 - 000004252 _____ C:\WINDOWS\System32\Tasks\avast! SL Update
2017-08-22 12:37 - 2017-01-28 06:14 - 000000000 ____D C:\Users\mom\AppData\Local\Ubisoft Game Launcher
2017-08-22 12:01 - 2017-01-01 06:28 - 000000000 ____D C:\Users\mom\AppData\Local\Spotify
2017-08-22 11:49 - 2017-01-01 06:26 - 000000000 ____D C:\Users\mom\AppData\Roaming\Spotify
2017-08-20 08:37 - 2017-05-18 18:30 - 000000000 ____D C:\Users\mom\Documents\My Games
2017-08-20 04:43 - 2017-07-05 23:55 - 000000000 ____D C:\Users\mom\AppData\Roaming\LiquidSky
2017-08-19 06:39 - 2016-12-18 08:54 - 001620896 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-08-19 06:31 - 2016-12-18 08:45 - 000349168 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2017-08-18 12:36 - 2017-02-21 21:04 - 000544424 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2017-08-17 02:49 - 2016-07-16 07:47 - 000000000 ____D C:\WINDOWS\rescache
2017-08-17 00:50 - 2016-12-10 14:46 - 000000000 ____D C:\ProgramData\Skype
2017-08-16 17:30 - 2017-07-29 13:34 - 000000000 ____D C:\Users\mom\AppData\Local\Pokemon Showdown
2017-08-16 17:29 - 2017-07-29 13:34 - 000002136 _____ C:\Users\mom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pokemon Showdown.lnk
2017-08-13 14:05 - 2017-01-17 22:54 - 000002230 _____ C:\Users\mom\Desktop\Discord.lnk
2017-08-13 14:05 - 2017-01-17 22:48 - 000000000 ____D C:\Users\mom\AppData\Local\SquirrelTemp
2017-08-13 11:04 - 2017-07-05 15:26 - 000000000 ____D C:\Users\mom\Documents\Bandicam
2017-08-10 21:29 - 2017-05-16 09:39 - 000000000 ____D C:\Users\mom\Documents\SavedGames
2017-08-10 11:56 - 2016-12-10 13:54 - 000000000 ____D C:\Users\mom\AppData\Local\Packages
2017-08-10 05:59 - 2015-11-02 14:02 - 000000000 __RHD C:\Users\Public\AccountPictures
2017-08-10 05:21 - 2016-07-16 07:47 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2017-08-10 05:21 - 2016-07-16 07:47 - 000000000 ___RD C:\Program Files\Windows Defender
2017-08-10 05:21 - 2016-07-16 07:47 - 000000000 ____D C:\WINDOWS\SysWOW64\inetsrv
2017-08-10 05:21 - 2016-07-16 07:47 - 000000000 ____D C:\WINDOWS\system32\oobe
2017-08-10 05:21 - 2016-07-16 07:47 - 000000000 ____D C:\WINDOWS\system32\inetsrv
2017-08-10 05:21 - 2016-07-16 07:47 - 000000000 ____D C:\WINDOWS\ShellExperiences
2017-08-10 05:21 - 2016-07-16 07:47 - 000000000 ____D C:\WINDOWS\Provisioning
2017-08-10 05:21 - 2016-07-16 07:47 - 000000000 ____D C:\WINDOWS\bcastdvr
2017-08-10 05:21 - 2016-07-16 07:47 - 000000000 ____D C:\Program Files\Windows Photo Viewer
2017-08-10 05:21 - 2016-07-16 07:47 - 000000000 ____D C:\Program Files\Common Files\System
2017-08-10 05:21 - 2016-07-16 07:47 - 000000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2017-08-10 05:21 - 2016-07-16 07:47 - 000000000 ____D C:\Program Files (x86)\Windows Defender
2017-08-09 05:22 - 2017-01-17 22:49 - 000000000 ____D C:\Users\mom\AppData\Roaming\discord
2017-08-09 04:47 - 2016-07-16 07:47 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2017-08-09 00:17 - 2016-12-10 19:06 - 000000000 ____D C:\WINDOWS\system32\MRT
2017-08-09 00:03 - 2016-12-10 19:06 - 140394280 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2017-08-05 21:59 - 2016-12-21 12:30 - 000000000 ____D C:\Games
2017-08-05 04:05 - 2017-05-05 01:15 - 000000000 ____D C:\Users\mom\AppData\Local\UnrealEngine
2017-08-05 02:12 - 2017-04-08 00:21 - 000000000 ____D C:\Users\mom\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2017-08-05 01:41 - 2017-01-24 06:55 - 000000000 ____D C:\Users\mom\Documents\GTA San Andreas User Files
==================== Files in the root of some directories =======
2017-08-05 22:03 - 2017-08-05 22:03 - 000000220 _____ () C:\Program Files (x86)\DOOM II [bleep] on Earth.url
2017-03-05 10:26 - 2017-03-05 10:26 - 000000136 _____ () C:\Users\mom\AppData\Roaming\2.cmd
2017-03-05 10:26 - 2017-03-05 10:26 - 000000451 _____ () C:\Users\mom\AppData\Roaming\all.cmd
2017-03-05 10:26 - 2017-03-05 10:26 - 004111279 _____ () C:\Users\mom\AppData\Roaming\archive.7z
2017-03-05 10:26 - 2017-03-05 10:26 - 000587776 _____ (Igor Pavlov) C:\Users\mom\AppData\Roaming\front.exe
2017-03-05 10:26 - 2017-03-05 10:26 - 000006744 _____ () C:\Users\mom\AppData\Roaming\img.jpg
2017-05-24 01:17 - 2017-05-26 03:37 - 000000097 _____ () C:\Users\mom\AppData\Roaming\LauncherSettings_live.cfg
2016-12-28 07:19 - 2017-05-16 09:44 - 000003134 _____ () C:\Users\mom\AppData\Roaming\SpeedRunnersLog.txt
2017-05-24 22:25 - 2017-05-24 22:25 - 000010423 _____ () C:\Users\mom\AppData\Roaming\TheHunterSettings_live.bin
2017-05-23 23:36 - 2017-05-24 00:21 - 000000042 _____ () C:\Users\mom\AppData\Roaming\TheHunterSettings_steam_live.cfg
2017-06-07 02:19 - 2017-06-07 02:19 - 000001167 _____ () C:\Users\mom\AppData\Roaming\trace_FilterInstaller.1.txt
2017-06-07 02:19 - 2017-06-07 02:43 - 000000905 _____ () C:\Users\mom\AppData\Roaming\trace_FilterInstaller.txt
2017-06-07 02:19 - 2017-06-07 02:43 - 000000000 _____ () C:\Users\mom\AppData\Roaming\trace_FilterInstaller.txt-CRT.txt
2017-06-03 00:55 - 2017-06-03 00:55 - 000000045 _____ () C:\Users\mom\AppData\Roaming\WB.CFG
2017-09-03 00:47 - 2017-09-03 00:47 - 000140800 _____ () C:\Users\mom\AppData\Local\installer.dat
2017-09-03 00:46 - 2017-09-03 00:46 - 000014848 _____ () C:\Users\mom\AppData\Local\part64.dll
2017-09-03 00:50 - 2017-09-03 00:50 - 000011776 _____ (Speculate) C:\Users\mom\AppData\Local\speculate.exe
2016-12-11 13:57 - 2016-12-11 13:57 - 000000016 _____ () C:\ProgramData\mntemp
Files to move or delete:
====================
C:\Users\Public\some.js
Some files in TEMP:
====================
2017-07-30 23:32 - 2017-08-07 00:30 - 000204800 _____ (Sony DADC Austria AG) C:\Users\mom\AppData\Local\Temp\drm_dyndata_7380014.dll
2017-08-01 10:39 - 2017-08-01 10:39 - 000019968 ____N (Red Hat®, Inc.) C:\Users\mom\AppData\Local\Temp\jansi-64-4323991368908407137.dll
2017-08-01 18:43 - 2017-08-01 18:43 - 000019968 _____ (Red Hat®, Inc.) C:\Users\mom\AppData\Local\Temp\jansi-64-6343900713225938357.dll
2017-07-20 13:31 - 2017-07-20 13:32 - 000739904 _____ (Oracle Corporation) C:\Users\mom\AppData\Local\Temp\jre-8u141-windows-au.exe
2017-09-03 16:32 - 2017-09-03 16:32 - 018309328 _____ (Microsoft Corporation) C:\Users\mom\AppData\Local\Temp\MediaCreationTool.exe
2017-07-18 09:57 - 2017-08-07 11:12 - 058782680 _____ (Skype Technologies S.A.) C:\Users\mom\AppData\Local\Temp\SkypeSetup.exe
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2017-08-26 09:18
==================== End of FRST.txt ============================Additional scan result of Farbar Recovery Scan Tool (x64) Version: 20-08-2017
Ran by mom (04-09-2017 09:31:31)
Running from C:\Users\mom\Downloads
Windows 10 Home Version 1607 (X64) (2016-12-18 13:24:24)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-3921682297-77452978-1352297690-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-3921682297-77452978-1352297690-503 - Limited - Disabled)
Guest (S-1-5-21-3921682297-77452978-1352297690-501 - Limited - Disabled)
mom (S-1-5-21-3921682297-77452978-1352297690-1001 - Administrator - Enabled) => C:\Users\mom
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: McAfee Anti-Virus and Anti-Spyware (Disabled - Up to date) {B10D5953-051E-97F6-F53B-3839EFD98259}
AS: McAfee Anti-Virus and Anti-Spyware (Disabled - Up to date) {0A6CB8B7-2324-9878-CF8B-034B945EC8E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: McAfee Firewall (Disabled) {8936D876-4F71-96AE-DE64-910C110AC522}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
12 Labours of Hercules III: Girl Power (HKLM-x32\...\WTA-af843c56-29dc-4404-a559-b76e877c0f31) (Version: 3.0.2.118 - WildTangent) Hidden
Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.7.157 - Adobe Systems, Inc.)
Avast SecureLine (HKLM\...\{2CD3C92F-EDC5-4B02-9B0A-9C1D37C58EF5}_is1) (Version: 1.0.239.2 - AVAST Software)
Azkend 2: The World Beneath (HKLM-x32\...\WTA-4c721fb1-809f-41fd-bbd0-fe6af6ac09a4) (Version: 2.2.0.98 - WildTangent) Hidden
Bandicam (HKLM-x32\...\Bandicam) (Version: 3.4.0.1227 - Bandicam.com)
Bandicam MPEG-1 Decoder (HKLM-x32\...\BandiMPEG1) (Version: - Bandicam.com)
Barn Yarn Collector's Edition (HKLM-x32\...\WTA-19fbf0ac-6320-4b01-b609-019b3cd30eee) (Version: 3.0.2.48 - WildTangent) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Brawlhalla (HKLM\...\Steam App 291550) (Version: - Blue Mammoth Games)
Call of Duty: Modern Warfare 3 - Multiplayer (HKLM\...\Steam App 42690) (Version: - Infinity Ward)
Castle Crashers (HKLM\...\Steam App 204360) (Version: - The Behemoth)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{AF312B06-5C5C-468E-89B3-BE6DE2645722}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{0A4EF0E6-A912-4CDE-A7F3-6E56E7C13A2F}) (Version: 1.1.6 - Cisco Systems, Inc.)
Clownfish Voice Changer (HKLM\...\ClownfishVoiceChanger) (Version: - )
Counter-Strike: Global Offensive (HKLM\...\Steam App 730) (Version: - Valve)
Coyote The Outlander (HKLM-x32\...\WTA-4db8f9f3-c2dd-438f-a11b-7b310cfbbf78) (Version: 3.0.2.59 - WildTangent) Hidden
Creativerse (HKLM\...\Steam App 280790) (Version: - Playful Corporation)
CyberLink PhotoDirector (HKLM\...\{5A454EC5-217A-42a5-8CE1-2DDEC4E70E01}) (Version: 5.0.6.7006 - CyberLink Corp.) Hidden
CyberLink PhotoDirector (HKLM-x32\...\InstallShield_{5A454EC5-217A-42a5-8CE1-2DDEC4E70E01}) (Version: 5.0.6.7006 - CyberLink Corp.)
CyberLink Power Media Player 14 (HKLM-x32\...\{32C8E300-BDB4-4398-92C2-E9B7D8A233DB}) (Version: 14.0.2.5829 - CyberLink Corp.)
CyberLink PowerDirector 12 (HKLM\...\{E1646825-D391-42A0-93AA-27FA810DA093}) (Version: 12.0.5.4601 - CyberLink Corp.) Hidden
CyberLink PowerDirector 12 (HKLM-x32\...\InstallShield_{E1646825-D391-42A0-93AA-27FA810DA093}) (Version: 12.0.5.4601 - CyberLink Corp.)
CyberLink YouCam (HKLM-x32\...\{A9CEDD6E-4792-493e-BB35-D86D2E188A5A}) (Version: 6.0.2.4627 - CyberLink Corp.)
Delicious: Emily's Wonder Wedding Premium Edition (HKLM-x32\...\WTA-a89a5f16-3915-41f8-b897-054025967fb3) (Version: 3.0.2.59 - WildTangent) Hidden
DisableMSDefender (HKLM\...\{74FE39A0-FB76-47CD-84BA-91E2BBB17EF2}) (Version: 1.0.0 - Hewlett-Packard Company) Hidden
Discord (HKU\S-1-5-21-3921682297-77452978-1352297690-1001\...\Discord) (Version: 0.0.298 - Discord Inc.)
Dropbox 25 GB (HKLM-x32\...\{0867A88D-764F-366E-9E21-130DA8B472C3}) (Version: 3.1.18.0 - Dropbox, Inc.)
Dropbox Update Helper (HKLM-x32\...\{099218A5-A723-43DC-8DB5-6173656A1E94}) (Version: 1.3.59.1 - Dropbox, Inc.) Hidden
Dungeon Defenders (HKLM\...\Steam App 65800) (Version: - Trendy Entertainment)
Duty Calls (HKLM-x32\...\{0AEB967F-1D12-43C8-A59C-D93DA8EE4A4E}) (Version: 1.00.0000 - Duty Calls)
Energy Star (HKLM\...\{5CB22648-35F8-41BC-9C35-1E41FE6E12A5}) (Version: 1.1.1 - HP Inc.)
Entwined: The Perfect Murder (HKLM-x32\...\WTA-aa9257c0-22be-4bd8-95b2-22b5184e3bb1) (Version: 3.0.2.59 - WildTangent) Hidden
Euro Fishing (HKLM\...\Steam App 314520) (Version: - Dovetail Games)
Evernote v. 5.8.13 (HKLM-x32\...\{A229420E-204B-11E5-B844-0050569584E9}) (Version: 5.8.13.8152 - Evernote Corp.)
Facebook Gameroom 1.8.6429.23271 (HKLM-x32\...\{D71E0CAE-F4B3-499E-B515-396B02139A39}) (Version: 1.8.6429.23271 - Facebook)
Family Vacation 2: Road Trip (HKLM-x32\...\WTA-4e58ff55-0d9c-42f7-a5a2-da89480c74d4) (Version: 3.0.2.59 - WildTangent) Hidden
Fishing Planet (HKLM\...\Steam App 380600) (Version: - Fishing Planet LLC)
Garry's Mod (HKLM\...\Steam App 4000) (Version: - Facepunch Studios)
Golf It! (HKLM\...\Steam App 571740) (Version: - Perfuse Entertainment)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 60.0.3112.113 - Google Inc.)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.5 - Google Inc.) Hidden
HiPatch (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF000}) (Version: 5.0.8.3 - Hi-Rez Studios)
Hi-Rez Studios Authenticate and Update Service (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}) (Version: 3.0.0.0 - Hi-Rez Studios)
Home Makeover (HKLM-x32\...\WTA-7cd6319b-dc76-4482-9cea-aa4ca654aca0) (Version: 3.0.2.59 - WildTangent) Hidden
HP Documentation (HKLM\...\HP_Documentation) (Version: - HP)
HP ePrint SW (HKLM-x32\...\{88970959-baf7-4864-a39a-69a58e8ae5cf}) (Version: 5.0.18701 - HP)
HP Registration Service (HKLM\...\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.8305.5282 - Hewlett-Packard)
HP Support Assistant (HKLM-x32\...\{79C54A05-F146-4EA0-8A70-D4EFE6181E52}) (Version: 8.4.19.3 - Hewlett-Packard Company)
HP Support Solutions Framework (HKLM-x32\...\{55065080-504F-43BB-BE00-36B80D7D39A5}) (Version: 12.7.27.15 - Hewlett-Packard Company)
HP System Event Utility (HKLM-x32\...\{8B4EE87E-6D40-4C91-B5E8-0DC77DC412F1}) (Version: 1.4.1 - Hewlett-Packard Company)
HP Welcome (HKLM\...\HPWelcome) (Version: 1.0 - HP Inc.)
HP Wireless Button Driver (HKLM-x32\...\{DD21DBC9-2A74-44DA-A543-B1F4AF3ABFCA}) (Version: 1.1.8.1 - HP)
IGT Slots: Paradise Garden (HKLM-x32\...\WTA-2ab5b5fc-bfc4-45bb-a01d-3422817c377b) (Version: 3.0.2.59 - WildTangent) Hidden
Imperial Island: Birth of an Empire (HKLM-x32\...\WTA-e9607a88-34a6-4589-b4e3-4bf32c11c32b) (Version: 3.0.2.59 - WildTangent) Hidden
Intel® Chipset Device Software (HKLM-x32\...\{c6cff78a-cccb-49d5-be68-ae0ec5f0d48a}) (Version: 10.1.1.8 - Intel® Corporation) Hidden
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.4358 - Intel Corporation)
Intel® Trusted Execution Engine (HKLM\...\{176E2755-0A17-42C6-88E2-192AB2131278}) (Version: 1.0.0.1064 - Intel Corporation)
Java 8 Update 121 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180121F0}) (Version: 8.0.1210.13 - Oracle Corporation)
Jewel Match Snowscapes (HKLM-x32\...\WTA-fc52798f-8a13-4c31-bc2b-863913df044b) (Version: 3.0.2.118 - WildTangent) Hidden
Killing Floor (HKLM\...\Steam App 1250) (Version: - Tripwire Interactive)
Living Legends: Frozen Beauty Collector's Edition (HKLM-x32\...\WTA-f8f93492-8886-4c1c-9a28-d5a8d35e053e) (Version: 3.0.2.59 - WildTangent) Hidden
Lost Lands: Dark Overlord Collector's Edition (HKLM-x32\...\WTA-21147be1-2d2c-4303-b60c-88d27aab2ad9) (Version: 3.0.2.59 - WildTangent) Hidden
Lost Souls: Timeless Fables Collector's Edition (HKLM-x32\...\WTA-9739e89c-dbb1-40a6-9257-80d70e6d886d) (Version: 3.0.2.59 - WildTangent) Hidden
Magic Heroes: Save Our Park (HKLM-x32\...\WTA-7f3e380c-5bff-4fbb-87e6-31ccdb089c3d) (Version: 3.0.2.59 - WildTangent) Hidden
Manor Memoirs Collector's Edition (HKLM-x32\...\WTA-6557e029-c6bf-4985-ab68-9e5be67d6aaf) (Version: 3.0.2.59 - WildTangent) Hidden
McAfee LiveSafe (HKLM-x32\...\MSC) (Version: 15.0.2063 - McAfee, Inc.)
MEGAsync (HKLM-x32\...\MEGAsync) (Version: - Mega Limited)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{42AA4CA8-DCD8-4308-BCAB-0B6D75856A9D}) (Version: 3.5.95.0 - Microsoft Corporation)
Microsoft Office 365 - en-us (HKLM\...\O365HomePremRetail - en-us) (Version: 16.0.8326.2096 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-3921682297-77452978-1352297690-1001\...\OneDriveSetup.exe) (Version: 17.3.6943.0625 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 (HKLM-x32\...\{d992c12e-cab2-426f-bde3-fb8c53950b0d}) (Version: 14.0.24215.1 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
Minecraft (HKLM-x32\...\{1C16BCA3-EBC1-49F6-8623-8FBFB9CCC872}) (Version: 1.0.3.0 - Mojang)
My Bottle Can Flip version 1.0 (HKLM-x32\...\{7E974C1B-4E97-477D-8EC4-8E09FF3207E8}_is1) (Version: 1.0 - MegaIndie)
Mystery Expedition: Prisoners of Ice (HKLM-x32\...\WTA-8a0be099-f75c-479d-9308-92a618f49ead) (Version: 3.0.2.59 - WildTangent) Hidden
Need for Speed: Undercover (HKLM\...\Steam App 17430) (Version: - EA Black Box)
NVIDIA PhysX (HKLM-x32\...\{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}) (Version: 9.12.1031 - NVIDIA Corporation)
OBS Studio (HKLM-x32\...\OBS Studio) (Version: 20.0.0 - OBS Project)
Office 16 Click-to-Run Extensibility Component (HKLM-x32\...\{90160000-008C-0000-0000-0000000FF1CE}) (Version: 16.0.8326.2096 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Extensibility Component 64-bit Registration (HKLM\...\{90160000-00DD-0000-1000-0000000FF1CE}) (Version: 16.0.8326.2096 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (HKLM\...\{90160000-008F-0000-1000-0000000FF1CE}) (Version: 16.0.8326.2096 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (HKLM-x32\...\{90160000-008C-0409-0000-0000000FF1CE}) (Version: 16.0.8326.2096 - Microsoft Corporation) Hidden
OpenAL (HKLM-x32\...\OpenAL) (Version: - )
osu! (HKLM-x32\...\{a03a7bfc-d246-4fc6-a23f-81017f0f36fb}) (Version: latest - ppy Pty Ltd)
Over 9000 Zombies! (HKLM\...\Steam App 273500) (Version: - Loren Lemcke)
Overwolf (HKLM-x32\...\Overwolf) (Version: 0.106.227.0 - Overwolf Ltd.)
PaintTool SAI Ver.1 (HKLM-x32\...\PaintToolSAI) (Version: - )
Plagiarii (HKLM-x32\...\WTA-99ad9408-2785-448a-b19c-ab91aa8ed3b4) (Version: 3.0.2.59 - WildTangent) Hidden
PokeMMO (HKLM\...\PokeMMO_is1) (Version: - PokeMMO)
Pokemon Showdown (HKLM-x32\...\Pokemon Showdown) (Version: - "Pokemon Showdown")
Polar Bowler 1st Frame (HKLM-x32\...\WTA-0a61fb30-3ed7-43b3-a37b-cf7d9ccf4d97) (Version: 3.0.2.59 - WildTangent) Hidden
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.994 - Even Balance, Inc.)
PxpAtYqel0NV Updater version 1.2.0.4 (HKLM-x32\...\PxpAtYqel0NV Updater_is1) (Version: 1.2.0.4 - )
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.370.87 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.1.505.2015 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7571 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\...\{A5107464-AA9B-4177-8129-5FF2F42DD322}) (Version: 1.0.0.59 - REALTEK Semiconductor Corp.)
Roblox Player for mom (HKU\S-1-5-21-3921682297-77452978-1352297690-1001\...\{373B1718-8CC5-4567-8EE2-9033AD08A680}) (Version: - Roblox Corporation)
RTP 1.32 Add-On for RM2k (HKLM-x32\...\RTP 1.32 Add-On for RM2k) (Version: - )
Runefall (HKLM-x32\...\WTA-36acdae8-82d7-435e-957b-321b3c562fef) (Version: 3.0.2.126 - WildTangent) Hidden
Rush Hour! Gas Station (HKLM-x32\...\WTA-fc3ab3df-510a-4a5a-b764-5d43bbc43bbc) (Version: 3.0.2.59 - WildTangent) Hidden
Russian Fishing 4 (HKU\S-1-5-21-3921682297-77452978-1352297690-1001\...\ru.rus-fishsoft.rf4_launcher) (Version: 4.0.7774 - Russian Fishing Spb LLC)
Sky High Farm (HKLM-x32\...\WTA-53efd6fe-f23c-4fad-9109-f6a9770b057d) (Version: 3.0.2.59 - WildTangent) Hidden
Skype™ 7.39 (HKLM-x32\...\{3B7E914A-93D5-4A29-92BB-AF8C3F66C431}) (Version: 7.39.102 - Skype Technologies S.A.)
Spotify (HKU\S-1-5-21-3921682297-77452978-1352297690-1001\...\Spotify) (Version: 1.0.57.474.gca9c9538 - Spotify AB)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
swMSM (HKLM-x32\...\{612C34C7-5E90-47D8-9B5C-0F717DD82726}) (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 19.3.11.45 - Synaptics Incorporated)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.1.0 - TeamSpeak Systems GmbH)
TeamViewer 12 (HKLM-x32\...\TeamViewer) (Version: 12.0.81460 - TeamViewer)
Terraria (HKLM\...\Steam App 105600) (Version: - Re-Logic)
This War of Mine (HKLM\...\Steam App 282070) (Version: - 11 bit studios)
Tom Clancy's Rainbow Six Siege (HKLM\...\Steam App 359550) (Version: - Ubisoft Montreal)
Town of Salem (HKLM\...\Steam App 334230) (Version: - BlankMediaGames)
Twitch (HKU\S-1-5-21-3921682297-77452978-1352297690-1001\...\{DEE70742-F4E9-44CA-B2B9-EE95DCF37295}) (Version: 7.0.0.0 - Twitch Interactive, Inc.)
Unity Web Player (HKU\S-1-5-21-3921682297-77452978-1352297690-1001\...\UnityWebPlayer) (Version: 5.3.8f1 - Unity Technologies ApS)
Unity Web Player (x64) (All users) (HKLM\...\UnityWebPlayer) (Version: 4.6.6f2 - Unity Technologies ApS)
Unreal Development Kit: 2015-01 (HKLM\...\UDK-ef420f7f-8dba-480d-9a3a-08d4ec74753c) (Version: - Epic Games, Inc.)
Update Installer for WildTangent Games App (HKLM-x32\...\{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App) (Version: - WildTangent) Hidden
Uplay (HKLM-x32\...\Uplay) (Version: 27.0 - Ubisoft)
WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
WildTangent Games App for HP (HKLM-x32\...\{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-hp) (Version: 4.0.11.16 - WildTangent) Hidden
Windows 10 Update and Privacy Settings (HKLM\...\{4DFCD818-036A-4229-A67D-CF17DC461D92}) (Version: 1.0.14.0 - Microsoft Corporation)
WinRAR 5.40 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH)
Wizard101 (HKU\S-1-5-21-3921682297-77452978-1352297690-1001\...\{A9E27FF5-6294-46A8-B8FD-77B1DECA3021}) (Version: 1.0.0 - KingsIsle Entertainment, Inc.)
World of Tanks (HKU\S-1-5-21-3921682297-77452978-1352297690-1001\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C812na}_is1) (Version: - Wargaming.net)
Worms W.M.D (HKLM\...\Steam App 327030) (Version: - Team17 Digital Ltd)
XField Paintball 3 (HKLM\...\Steam App 377510) (Version: - XField Paintball SAS)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-3921682297-77452978-1352297690-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)
ShellIconOverlayIdentifiers: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\mom\AppData\Local\MEGAsync\ShellExtX64.dll [2016-10-31] ()
ShellIconOverlayIdentifiers: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\mom\AppData\Local\MEGAsync\ShellExtX64.dll [2016-10-31] ()
ShellIconOverlayIdentifiers: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\mom\AppData\Local\MEGAsync\ShellExtX64.dll [2016-10-31] ()
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File
ShellIconOverlayIdentifiers-x32: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\mom\AppData\Local\MEGAsync\ShellExtX64.dll [2016-10-31] ()
ShellIconOverlayIdentifiers-x32: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\mom\AppData\Local\MEGAsync\ShellExtX64.dll [2016-10-31] ()
ShellIconOverlayIdentifiers-x32: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\mom\AppData\Local\MEGAsync\ShellExtX64.dll [2016-10-31] ()
ContextMenuHandlers1-x32: [AIMPClassic] -> {1F77B17B-F531-44DB-ACA4-76ABB5010A28} => C:\PROGRA~2\AIMPCL~1\System\AIMP_S~1.DLL -> No File
ContextMenuHandlers1-x32: [McCtxMenuFrmWrk] -> {CCA9EFD3-29ED-430A-BA6D-E6BBFF0A60C2} => c:\Program Files\mcafee\msc\McCtxMenuFrmWrk.dll [2016-11-18] (McAfee, Inc.)
ContextMenuHandlers1-x32: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => C:\Users\mom\AppData\Local\MEGAsync\ShellExtX64.dll [2016-10-31] ()
ContextMenuHandlers1-x32: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext64.dll [2016-08-15] (Alexander Roshal)
ContextMenuHandlers1-x32-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext.dll [2016-08-15] (Alexander Roshal)
ContextMenuHandlers3: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => C:\Users\mom\AppData\Local\MEGAsync\ShellExtX64.dll [2016-10-31] ()
ContextMenuHandlers4-x32: [AIMPClassic] -> {1F77B17B-F531-44DB-ACA4-76ABB5010A28} => C:\PROGRA~2\AIMPCL~1\System\AIMP_S~1.DLL -> No File
ContextMenuHandlers4-x32: [MEGA (Context menu)] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => C:\Users\mom\AppData\Local\MEGAsync\ShellExtX64.dll [2016-10-31] ()
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\system32\igfxDTCM.dll [2016-05-04] (Intel Corporation)
ContextMenuHandlers6: [McCtxMenuFrmWrk] -> {CCA9EFD3-29ED-430A-BA6D-E6BBFF0A60C2} => c:\Program Files\mcafee\msc\McCtxMenuFrmWrk.dll [2016-11-18] (McAfee, Inc.)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext64.dll [2016-08-15] (Alexander Roshal)
ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files (x86)\WinRAR\rarext.dll [2016-08-15] (Alexander Roshal)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {07ED76FE-B90B-487B-892E-0BDE7F809A38} - System32\Tasks\ba75302787530278 => C:\Users\mom\AppData\Local\speculate.exe [2017-09-03] (Speculate)
Task: {11081114-A45D-4130-ACAC-6A2E7A8CE639} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-12-10] (Dropbox, Inc.)
Task: {13B27094-89DA-4CA1-8F1C-8C8647F95DC5} - System32\Tasks\DropboxOEM => C:\Program Files (x86)\Dropbox\DropboxOEM\DropboxOEM.exe [2016-09-21] ()
Task: {16A9ACE0-F33E-4744-AC76-6264429A7F0F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Product Configurator => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\ProductConfig.exe [2017-08-01] (HP Inc.)
Task: {1FB130B5-2F5D-4F66-BFAA-C08AC77AEF15} - System32\Tasks\Avast SecureLine => C:\Program Files\AVAST Software\SecureLine\SecureLine.exe [2015-04-29] (AVAST Software)
Task: {260D1E7F-91B3-4A6C-B7D1-4BFBEBC095D6} - System32\Tasks\9ca4400e2532bd67e338b376e8d4f769 => powershell.exe -NoProfile -NoLogo -NonInteractive -ExecutionPolicy Bypass -File "C:\WINDOWS\9ca4400e2532bd67e338b376e8d4f769.ps1" <==== ATTENTION
Task: {2DD84336-5706-4C0E-AF41-2CC8DB2B9FDE} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2016-12-07] (HP Inc.)
Task: {3021F08E-B50D-4693-9429-F2A224AF473C} - System32\Tasks\McAfee Remediation (Prepare) => C:\Program Files\Common Files\AV\McAfee VirusScan\upgrade.exe [2017-04-12] (McAfee, Inc.)
Task: {36F02509-696F-4FD4-BD45-664668FEBCD0} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis Install => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2017-04-07] (HP Inc.)
Task: {3C2204EE-A46D-477F-8D25-005CA694D689} - System32\Tasks\McAfee\McAfee Idle Detection Task
Task: {3F29C1BC-217D-48C6-8BDD-DD87FD1708AE} - System32\Tasks\{300B219F-7C12-4C04-B0A5-F7703FB916B5} => "c:\program files (x86)\google\chrome\application\chrome.exe" hxxps://ui.skype.com/ui/0/7.35.0.103/en/abandoninstall?page=tsProgressBar
Task: {4279E75B-2B9D-4907-9FD7-205614083544} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSFReport.exe [2017-06-22] (HP Inc.)
Task: {49C8FA0A-18A0-4C05-A080-4250AD58249F} - System32\Tasks\{7EE9BBB6-60AC-4F89-AB05-B4F2D3A693BA} => "c:\program files (x86)\google\chrome\application\chrome.exe" hxxps://ui.skype.com/ui/0/7.35.0.103/en/abandoninstall?page=tsProgressBar
Task: {5596A67D-0899-4FB2-8822-D3EEE9E2D81C} - System32\Tasks\7530278 => C:\Users\mom\AppData\Local\speculate.exe [2017-09-03] (Speculate) <==== ATTENTION
Task: {61C84994-B68E-44AD-A44A-7BCABC3CDB1C} - System32\Tasks\Opera scheduled Autoupdate 1498031680 => C:\Users\mom\AppData\Local\Programs\Opera\launcher.exe [2017-06-06] (Opera Software)
Task: {684486AC-A470-4E3B-A7F2-62DB2119A44A} - System32\Tasks\Overwolf Updater Task => C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [2017-08-23] (Overwolf LTD)
Task: {6AEE5BAB-00BD-4173-BEB8-C0506BCD6542} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {6E2A89A6-F991-4D6F-89BA-93492338E9CA} - System32\Tasks\ba5669697956696979 => C:\Program Files (x86)\Zigzagging\speculate.exe [2017-09-03] (Speculate)
Task: {7A913910-A219-45F8-AA36-975658842E48} - System32\Tasks\{AFE9D51E-1967-4631-A9C8-EE642994E92F} => C:\WINDOWS\system32\pcalua.exe -a C:\Users\mom\Desktop\Setup.exe -d C:\Users\mom\Desktop
Task: {8979BE63-B2EA-42AB-BD18-282B202CF1C7} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2017-08-14] (HP Inc.)
Task: {8A7461C1-435F-4ABA-AD58-DB6CA31A9926} - System32\Tasks\ba8892942988929429 => C:\Program Files (x86)\Adlon\speculate.exe [2017-09-03] (Speculate)
Task: {8AE76056-5EE2-4E07-A3E3-8C4C5CC042DC} - System32\Tasks\HPCeeScheduleFormom => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2015-06-16] (Hewlett-Packard)
Task: {901DE0EF-EBC5-44E4-BCC2-52E6ED25BF2D} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\Program Files\Windows Defender\\MpCmdRun.exe [2017-08-01] (Microsoft Corporation) <==== ATTENTION
Task: {92C1A9F8-7ACD-49EC-B72A-9C8601B9951F} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2017-08-28] (Microsoft Corporation)
Task: {968074C9-47C7-4023-8DC2-916D84C6ABF0} - System32\Tasks\{E229C30A-46CE-494D-9B04-6E016B037716} => "c:\program files (x86)\google\chrome\application\chrome.exe" hxxps://ui.skype.com/ui/0/7.35.0.103/en/abandoninstall?page=tsProgressBar
Task: {9779E170-74A7-4254-B9A9-DA8967907D7A} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\Program Files\Windows Defender\\MpCmdRun.exe [2017-08-01] (Microsoft Corporation) <==== ATTENTION
Task: {9A88BBC9-364B-4C34-8FD2-A969D1BAE64F} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2017-08-28] (Microsoft Corporation)
Task: {9B8C8F28-A377-4307-A714-5EA77C63FDEA} - System32\Tasks\McAfee\McAfee Auto Maintenance Task Agent
Task: {9D0BA260-A8BA-4232-970A-063E470311D0} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2017-08-14] (HP Inc.)
Task: {AA306DF6-A5DF-4EF1-9ED3-D8C284B4069F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2017-04-07] (HP Inc.)
Task: {AC8E72D6-AE56-4D1A-91F7-00EAC3445159} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\Program Files\Windows Defender\\MpCmdRun.exe [2017-08-01] (Microsoft Corporation) <==== ATTENTION
Task: {B08024CC-726C-40F1-87D2-ABC92A2E123D} - System32\Tasks\{120AF290-0F4C-41FB-BB1A-949FA2D0E966} => "c:\program files (x86)\google\chrome\application\chrome.exe" hxxps://ui.skype.com/ui/0/7.35.0.103/en/abandoninstall?page=tsProgressBar
Task: {B223973B-1BCF-4F64-93C9-5023EB7C3321} - System32\Tasks\McAfeeLogon => C:\Program Files\Common Files\McAfee\platform\McUICnt.exe [2016-10-11] (McAfee, Inc.)
Task: {B23DE921-57E6-4216-B665-BB0764EE0958} - System32\Tasks\k88929429 => C:\Program Files (x86)\melancholia\melancholia.exe [2017-09-03] (turbines)
Task: {B60320B2-AAC4-4ECF-93D1-3FF453F22A25} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerLogon => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [2017-09-03] ()
Task: {B7147CDD-7951-403B-8E42-AFB76345FAA8} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\Program Files\Windows Defender\\MpCmdRun.exe [2017-08-01] (Microsoft Corporation) <==== ATTENTION
Task: {B7147F29-6DEE-4068-A8F0-7DD8F1E94489} - System32\Tasks\avast! SL Update => C:\Program Files\AVAST Software\SecureLine\SLUpdate.exe [2015-04-29] (AVAST Software)
Task: {BC3ECFBE-BF27-4800-8E2B-84B7E2C3B5B1} - System32\Tasks\bak88929429k88929429 => C:\Program Files (x86)\melancholia\melancholia.exe [2017-09-03] (turbines)
Task: {BD4A6652-2D3B-4553-8CC7-7CEF31861D13} - System32\Tasks\88929429 => C:\Program Files (x86)\Adlon\speculate.exe [2017-09-03] (Speculate) <==== ATTENTION
Task: {C3C6B806-4563-4925-828C-2D811C7CBFAF} - System32\Tasks\Hewlett-Packard\HP Active Health\HP Active Health Scan (HPSA) => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2016-11-07] (HP Inc.)
Task: {C6043405-6A8D-440C-A165-8125AEFF8059} - System32\Tasks\{F38FB3EB-DF95-4E40-8036-015EEE9C3AD4} => C:\WINDOWS\system32\pcalua.exe -a "C:\Program Files (x86)\AIMP Classic\UnInstall.exe"
Task: {CBA1EBF9-41D0-4CEA-973C-ED98426907F2} - System32\Tasks\{618854B9-D404-4BA1-97D1-2D4BD3A21644} => "c:\program files (x86)\google\chrome\application\chrome.exe" hxxps://ui.skype.com/ui/0/7.35.0.103/en/abandoninstall?page=tsProgressBar
Task: {CD52B783-AEF6-4CA2-8CAF-AFBD2FEC534B} - System32\Tasks\PxpAtYqel0NV => pxpatyqel0nv.exe
Task: {CECCDC6F-5157-4BBF-B2A1-BCDF7FCCF367} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2017-04-07] (HP Inc.)
Task: {D3FD06CF-BA60-4B36-A36F-1088A32C702F} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerRegistration => C:\Program Files (x86)\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [2017-09-03] ()
Task: {DA6220C4-D79D-4392-BCFF-382BB8D787DB} - System32\Tasks\185e0ce85976036e67521ab2d09338d7 => sc start 185e0ce85976036e67521ab2d09338d7 <==== ATTENTION
Task: {DFE867F2-40CF-439B-814B-045B23417068} - System32\Tasks\56696979 => C:\Program Files (x86)\Zigzagging\speculate.exe [2017-09-03] (Speculate) <==== ATTENTION
Task: {E8FBB9F5-6682-46FB-B592-2F3290AEEDB9} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-12-10] (Dropbox, Inc.)
Task: {EE6BFCAB-6BE4-4EF0-A280-2BD8A325047F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\HPCeeScheduleFormom.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
==================== Shortcuts & WMI ========================
(The entries could be listed to be restored or removed.)
Shortcut: C:\Users\mom\AppData\Roaming\Microsoft\Windows\Start Menu\Русская Рыбалка 4.lnk -> C:\Games\RF4\RF4Launcher.exe (Russian Fishing Spb LLC) <==== Cyrillic
ShortcutWithArgument: C:\Users\mom\Desktop\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --disable-quic
ShortcutWithArgument: C:\Users\mom\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --disable-quic
ShortcutWithArgument: C:\Users\mom\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --disable-quic
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --disable-quic
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Priceline.com.lnk -> C:\Program Files (x86)\Hewlett-Packard\Shared\WizLink.exe () -> hxxp://www.priceline.com/?refid=PLHBC6240OPQ&refclickid=square
ShortcutWithArgument: C:\Users\Public\Desktop\VUDU - Streaming Movies.lnk -> C:\Program Files (x86)\Hewlett-Packard\Shared\WizLink.exe () -> hxxp://www.vudu.com/
==================== Loaded Modules (Whitelisted) ==============
2017-01-24 22:16 - 2017-03-17 03:42 - 000076152 _____ () C:\WINDOWS\SysWOW64\PnkBstrA.exe
2016-08-18 22:33 - 2014-04-14 21:59 - 000389896 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2016-08-18 22:19 - 2015-04-29 20:04 - 000445240 _____ () C:\Program Files\AVAST Software\SecureLine\VpnSvc.exe
2017-09-03 00:48 - 2017-09-03 04:10 - 000313344 _____ () C:\Program Files (x86)\PxpAtYqel0NV Updater\PxpAtYqel0NV Updater.exe
2017-07-04 04:27 - 2017-07-04 04:27 - 000190208 _____ () C:\Program Files (x86)\ClownfishVoiceChanger\ClownfshAPO64.dll
2017-07-04 11:49 - 2017-07-04 11:49 - 003742208 _____ () C:\Program Files (x86)\BrowserSafer\BrowserSafer.exe
2016-07-16 07:42 - 2016-07-16 07:42 - 000231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2017-07-11 19:36 - 2017-06-21 03:48 - 002681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-10-31 15:45 - 2016-10-31 15:45 - 000592384 _____ () C:\Users\mom\AppData\Local\MEGAsync\ShellExtX64.dll
2017-08-19 05:31 - 2017-09-03 08:32 - 008929480 _____ () C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\1033\GrooveIntlResource.dll
2016-12-18 11:28 - 2016-12-18 11:28 - 000134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2017-03-20 10:15 - 2017-03-04 02:31 - 000474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2017-03-20 10:13 - 2017-03-04 02:12 - 009760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-03-20 10:13 - 2017-03-04 02:05 - 001401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-03-20 10:13 - 2017-03-04 02:05 - 000757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2017-08-09 00:52 - 2017-03-04 02:05 - 001033216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2017-08-09 00:52 - 2017-08-01 14:26 - 002424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2017-08-09 00:52 - 2017-08-01 14:31 - 004853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2017-09-03 00:50 - 2017-09-03 00:50 - 000068993 _____ () C:\Program Files (x86)\hmmmm\shakur.exe
2017-03-07 20:25 - 2016-11-07 18:18 - 002235392 ___SH () C:\Users\mom\AppData\Roaming\Service\cuda_tromp.dll
2017-03-07 20:25 - 2016-11-07 18:18 - 002235392 ___SH () C:\Users\mom\AppData\Roaming\Service\cuda_tromp_75.dll
2017-03-07 20:25 - 2016-11-07 18:18 - 000045056 ___SH () C:\Users\mom\AppData\Roaming\Service\cpu_tromp_SSE2.dll
2017-08-20 15:57 - 2017-08-20 15:57 - 000885760 _____ () C:\Users\mom\AppData\Local\imefdbl\imefdbl.exe
2017-08-20 12:38 - 2017-08-20 12:38 - 001087488 _____ () C:\Users\mom\AppData\Local\imefdbl\wmiuesp.exe
2017-07-08 03:56 - 2017-07-08 03:56 - 007089664 _____ () C:\ProgramData\Microsoft\Windows\NetworkCacheManager\ntcache.exe
2017-08-28 17:22 - 2017-08-23 04:48 - 003824472 _____ () C:\Program Files (x86)\Google\Chrome\Application\60.0.3112.113\libglesv2.dll
2017-08-28 17:22 - 2017-08-23 04:48 - 000100184 _____ () C:\Program Files (x86)\Google\Chrome\Application\60.0.3112.113\libegl.dll
2016-12-10 15:02 - 2017-08-04 17:19 - 000678176 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2016-12-10 15:02 - 2016-08-31 21:02 - 004969248 _____ () C:\Program Files (x86)\Steam\v8.dll
2016-12-10 15:02 - 2017-08-28 16:05 - 002505504 _____ () C:\Program Files (x86)\Steam\video.dll
2016-12-10 15:02 - 2016-08-31 21:02 - 001563936 _____ () C:\Program Files (x86)\Steam\icui18n.dll
2016-12-10 15:02 - 2016-08-31 21:02 - 001195296 _____ () C:\Program Files (x86)\Steam\icuuc.dll
2016-12-10 15:02 - 2016-01-27 03:49 - 002549760 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll
2016-12-10 15:02 - 2016-01-27 03:49 - 000491008 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll
2016-12-10 15:02 - 2016-01-27 03:49 - 000332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll
2016-12-10 15:02 - 2016-01-27 03:49 - 000442880 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll
2016-12-10 15:02 - 2016-01-27 03:49 - 000485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll
2016-12-10 15:02 - 2017-08-28 16:05 - 000885024 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2016-12-10 15:02 - 2016-07-04 18:17 - 000266560 _____ () C:\Program Files (x86)\Steam\openvr_api.dll
2017-01-01 06:28 - 2017-07-03 17:49 - 000189040 _____ () C:\Users\mom\AppData\Roaming\Spotify\SpotifyWinRT.dll
2017-07-24 15:57 - 2017-07-24 15:57 - 001991640 ____R () C:\Program Files (x86)\Skype\Phone\skypert.dll
2017-09-03 00:46 - 2017-09-03 00:46 - 000014848 _____ () C:\Users\mom\AppData\Local\part64.dll
2017-08-23 09:53 - 2017-08-23 09:53 - 069770056 _____ () C:\Program Files (x86)\Overwolf\0.106.227.0\libcef.DLL
2016-12-13 08:11 - 2017-07-17 18:50 - 073115424 _____ () C:\Program Files (x86)\Steam\bin\cef\cef.win7\libcef.dll
2017-06-08 08:20 - 2017-05-16 21:54 - 000678176 _____ () C:\Program Files (x86)\Steam\bin\cef\cef.win7\SDL2.dll
2016-12-10 15:02 - 2015-09-24 19:52 - 000119208 _____ () C:\Program Files (x86)\Steam\winh264.dll
2017-08-02 21:40 - 2017-08-02 21:40 - 053460480 _____ () C:\Users\mom\AppData\Local\imefdbl\libcef.dll
2016-05-31 11:43 - 2016-05-31 11:43 - 001976832 _____ () C:\Users\mom\AppData\Local\imefdbl\libglesv2.dll
2016-05-31 11:44 - 2016-05-31 11:44 - 000075264 _____ () C:\Users\mom\AppData\Local\imefdbl\libegl.dll
2016-06-15 17:15 - 2016-06-15 17:15 - 017599640 _____ () C:\Users\mom\AppData\Local\imefdbl\pepflashplayer.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcapexe => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McNaiAnn => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeaack => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeaack.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeavfk => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeavfk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfemms => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeplk => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeplk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfetdi2k => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfetdi2k.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Service"
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2015-10-30 03:24 - 2017-09-03 00:50 - 000002482 _____ C:\WINDOWS\system32\Drivers\etc\hosts
0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomaly
0.0.0.0 tracking.opencandy.com.s3.amazonaws.com
0.0.0.0 media.opencandy.com
0.0.0.0 cdn.opencandy.com
0.0.0.0 tracking.opencandy.com
0.0.0.0 api.opencandy.com
0.0.0.0 api.recommendedsw.com
0.0.0.0 installer.betterinstaller.com
0.0.0.0 installer.filebulldog.com
0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net
0.0.0.0 inno.bisrv.com
0.0.0.0 nsis.bisrv.com
0.0.0.0 cdn.file2desktop.com
0.0.0.0 cdn.goateastcach.us
0.0.0.0 cdn.guttastatdk.us
0.0.0.0 cdn.inskinmedia.com
0.0.0.0 cdn.insta.oibundles2.com
0.0.0.0 cdn.insta.playbryte.com
0.0.0.0 cdn.llogetfastcach.us
0.0.0.0 cdn.montiera.com
0.0.0.0 cdn.msdwnld.com
0.0.0.0 cdn.mypcbackup.com
0.0.0.0 cdn.ppdownload.com
0.0.0.0 cdn.riceateastcach.us
0.0.0.0 cdn.shyapotato.us
0.0.0.0 cdn.solimba.com
0.0.0.0 cdn.tuto4pc.com
0.0.0.0 cdn.appround.biz
0.0.0.0 cdn.bigspeedpro.com
0.0.0.0 cdn.bispd.com
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-3921682297-77452978-1352297690-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\mom\Pictures\Saved Pictures\images.jpg
DNS Servers: 82.163.142.8 - 95.211.158.136
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
HKLM\...\StartupApproved\Run: => "WindowsDefender"
HKU\S-1-5-21-3921682297-77452978-1352297690-1001\...\StartupApproved\StartupFolder: => "Facebook Gameroom.lnk"
HKU\S-1-5-21-3921682297-77452978-1352297690-1001\...\StartupApproved\Run: => "Discord"
HKU\S-1-5-21-3921682297-77452978-1352297690-1001\...\StartupApproved\Run: => "Spotify"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{547064D7-92EA-4759-97AF-84BDB88BB666}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{51032A4E-D1CE-4115-AF31-7C9B7D73AC06}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
FirewallRules: [{53940C7A-3F1F-472A-BE48-399732A96336}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Town of Salem\TownOfSalem.exe
FirewallRules: [{D2B4B60A-8C2D-4CD5-86F1-56E34E3A205B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Town of Salem\TownOfSalem.exe
FirewallRules: [{E194677E-A38A-47C0-B28B-D3DF5703B1DB}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{3AF98EB7-8F67-441D-8179-2BF5727624BA}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{2BE53CA3-F20C-42BA-911C-1E410F6B894B}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{93C76F2B-B256-491B-8FF8-418D725E63C1}] => (Allow) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe
FirewallRules: [{424024A4-7F07-4B0C-97AB-C5FEEAA66D7F}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD14\Movie\PowerDVD Cinema\PowerDVDCinema.exe
FirewallRules: [{C552F3FA-4F6C-4229-AF04-43546B0E82AD}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD14\Movie\PowerDVDMovie.exe
FirewallRules: [{C3BB42E0-E46F-46D4-8B68-05A9B3047E4C}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14Agent.exe
FirewallRules: [{5A85D476-F4B1-4707-9465-C681CECC3C16}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD14\Kernel\DMS\CLMSServerPDVD14.exe
FirewallRules: [{0530795A-6C21-4D76-8F57-022DB3067118}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD.exe
FirewallRules: [{1A396488-FE07-4BE3-8CF9-32EA7CAEA004}] => (Allow) c:\Program Files\CyberLink\PowerDirector12\PDR10.EXE
FirewallRules: [{081B3A00-3052-489A-BFD5-A21956BFE541}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{0741E060-9544-4C12-ACBB-9AAF2D950FF8}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{F1499DB4-AB6D-47CF-B0A1-0B19F72C2288}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{A0A32C5D-6B2A-46C1-91EB-47EB83FAE99F}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{A58EC57B-C94D-4D8D-89D7-DB5795562E6D}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\KillingFloor\System\KillingFloor.exe
FirewallRules: [{6C87440D-B0F9-4FA8-BF41-767796D52794}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\KillingFloor\System\KillingFloor.exe
FirewallRules: [{BE08579B-56FD-4ABA-912E-A36C27780C7C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Over 9000 Zombies!\Over9000Zombies.exe
FirewallRules: [{684B6A26-33F6-42EA-B24A-904064F38E05}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Over 9000 Zombies!\Over9000Zombies.exe
FirewallRules: [{E75F4805-209C-41B6-AA9F-B0B86FBFFD9C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Double Action\bin\hammer.exe
FirewallRules: [{D958EC81-5DC0-4273-BF84-7524505E044A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Double Action\bin\hammer.exe
FirewallRules: [{18CDA92C-1A54-4857-933A-77826B65CEA0}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Dirty Bomb\Binaries\Win32\ShooterGame-Win32-Shipping.exe
FirewallRules: [{B0557CFB-8F6E-4070-8D06-853EF4D43999}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Dirty Bomb\Binaries\Win32\ShooterGame-Win32-Shipping.exe
FirewallRules: [TCP Query User{D1CA0C90-F8AA-43FB-870E-BE6174F19ABE}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [UDP Query User{ADF41C62-CAF2-4A8E-A4F3-E08C77206264}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [TCP Query User{26674DA1-F26A-4582-AF1C-A58B77FE68BD}C:\users\mom\appdata\roaming\spotify\spotify.exe] => (Block) C:\users\mom\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{D571B350-E0D9-41ED-8929-F4E29E41508E}C:\users\mom\appdata\roaming\spotify\spotify.exe] => (Block) C:\users\mom\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{3FDE4383-548B-4B93-A988-253A64CB1835}C:\program files (x86)\steam\steamapps\common\war thunder\win64\aces.exe] => (Block) C:\program files (x86)\steam\steamapps\common\war thunder\win64\aces.exe
FirewallRules: [UDP Query User{345E3B96-AE35-49E8-B160-DD123FDCD96C}C:\program files (x86)\steam\steamapps\common\war thunder\win64\aces.exe] => (Block) C:\program files (x86)\steam\steamapps\common\war thunder\win64\aces.exe
FirewallRules: [TCP Query User{42F1DB5A-75BC-4A4F-8C89-536BF304786D}C:\games\world_of_tanks\wotlauncher.exe] => (Block) C:\games\world_of_tanks\wotlauncher.exe
FirewallRules: [UDP Query User{27246059-E7EB-4202-AB17-4BD85B154CEE}C:\games\world_of_tanks\wotlauncher.exe] => (Block) C:\games\world_of_tanks\wotlauncher.exe
FirewallRules: [TCP Query User{EA0017BF-763C-449A-B913-39810AAE2246}C:\program files (x86)\steam\steamapps\common\grand theft auto iv\gtaiv\gtaiv.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\grand theft auto iv\gtaiv\gtaiv.exe
FirewallRules: [UDP Query User{ACC208C1-FB6F-4F28-B637-D45C211794C6}C:\program files (x86)\steam\steamapps\common\grand theft auto iv\gtaiv\gtaiv.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\grand theft auto iv\gtaiv\gtaiv.exe
FirewallRules: [TCP Query User{6B9E7553-64AB-4E98-BB59-E66DA3DFE4C7}C:\users\mom\appdata\roaming\frame\mvscp.exe] => (Block) C:\users\mom\appdata\roaming\frame\mvscp.exe
FirewallRules: [UDP Query User{FE315887-4613-4A04-9DB5-597B2310FBB8}C:\users\mom\appdata\roaming\frame\mvscp.exe] => (Block) C:\users\mom\appdata\roaming\frame\mvscp.exe
FirewallRules: [{7AA2E905-48F2-42BC-AC1D-660AA2E88D04}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\America's Army\AAPG\Binaries\Win32\AAGame.exe
FirewallRules: [{C5BB44E7-55D0-4EE5-A7FE-032399B11F0C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\America's Army\AAPG\Binaries\Win32\AAGame.exe
FirewallRules: [{29CF03FC-5095-488B-AC8E-44AE60F09D51}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\America's Army\AAPG\Binaries\Win32\AALauncher32.exe
FirewallRules: [{CBB7B94D-206D-4D8A-A592-72A499E888A0}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\America's Army\AAPG\Binaries\Win32\AALauncher32.exe
FirewallRules: [{25A390C8-C484-4451-81A5-E095C212A3BF}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{C6E23C75-C798-4019-915A-445CAC9052BC}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{4C8D255E-7EFD-4A93-9AD6-ABA1CBBD6296}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{C2923AE0-28F3-4AC3-9603-3D5D0DE42B59}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [TCP Query User{9372DD15-78B1-46C7-A48F-30352FE9E84B}C:\program files (x86)\duty calls\binaries\win32\dutycalls.exe] => (Allow) C:\program files (x86)\duty calls\binaries\win32\dutycalls.exe
FirewallRules: [UDP Query User{3CA8C10E-EB6D-4BE7-A017-ED5FEBA88E5B}C:\program files (x86)\duty calls\binaries\win32\dutycalls.exe] => (Allow) C:\program files (x86)\duty calls\binaries\win32\dutycalls.exe
FirewallRules: [{95B32DDE-AD23-42E5-B052-A6F3ACA90C6B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Tom Clancy's Rainbow Six Siege\rainbowsix.exe
FirewallRules: [{B7AAD609-E048-4B34-817C-153B3DAD2F71}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Tom Clancy's Rainbow Six Siege\rainbowsix.exe
FirewallRules: [{98A50711-1AF8-4985-87B2-461C583A3915}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Tom Clancy's Rainbow Six Siege\RainbowSixGame.exe
FirewallRules: [{0989163B-90A1-4147-B37D-7095B55AE2DE}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Tom Clancy's Rainbow Six Siege\RainbowSixGame.exe
FirewallRules: [TCP Query User{EDC2A109-132F-4CE6-9468-9D64D05FEEBC}C:\program files\java\jre1.8.0_121\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_121\bin\javaw.exe
FirewallRules: [UDP Query User{962CD584-FCDF-47D2-AFC9-C8EDA319B473}C:\program files\java\jre1.8.0_121\bin\javaw.exe] => (Allow) C:\program files\java\jre1.8.0_121\bin\javaw.exe
FirewallRules: [{F63D329E-D050-425D-9D62-DB2E0910355F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\TOXIKK\Binaries\ToxikkLauncher.exe
FirewallRules: [{708C6FE6-BC80-44AD-81A8-55D2CC41C369}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\TOXIKK\Binaries\ToxikkLauncher.exe
FirewallRules: [TCP Query User{D6300088-4F39-42A3-AE58-2E2B38014E75}C:\program files (x86)\steam\steamapps\common\smite\binaries\win32\smite.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\smite\binaries\win32\smite.exe
FirewallRules: [UDP Query User{DB2A9D36-7C77-41C9-943A-B618C9F245C2}C:\program files (x86)\steam\steamapps\common\smite\binaries\win32\smite.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\smite\binaries\win32\smite.exe
FirewallRules: [{BFEAA304-4ED0-41E0-A930-462572288C22}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Golf It!\GolfIt.exe
FirewallRules: [{F9CEA139-F4A1-4A7A-B84C-A9423D89F9B9}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Golf It!\GolfIt.exe
FirewallRules: [TCP Query User{DA76CA3A-A664-4820-9748-DE1A7DF680E8}C:\program files (x86)\steam\steamapps\common\golf it!\golfit\binaries\win64\golfit-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\golf it!\golfit\binaries\win64\golfit-win64-shipping.exe
FirewallRules: [UDP Query User{71551192-A97E-4FAF-AF89-3471FAEFA997}C:\program files (x86)\steam\steamapps\common\golf it!\golfit\binaries\win64\golfit-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\golf it!\golfit\binaries\win64\golfit-win64-shipping.exe
FirewallRules: [TCP Query User{3E3BE5D9-1FA2-4078-9804-B74EAE8C62B0}C:\program files (x86)\steam\steamapps\common\world of fishing\worldoffishing.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\world of fishing\worldoffishing.exe
FirewallRules: [UDP Query User{695D445B-853F-4CC6-8F04-A21F640F34E1}C:\program files (x86)\steam\steamapps\common\world of fishing\worldoffishing.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\world of fishing\worldoffishing.exe
FirewallRules: [{9632B5F9-96EF-4EC9-9CF8-4FA47343649F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\firstassault\Shipping\GAME.exe
FirewallRules: [{F280EA22-F3B4-4C42-9C80-0192B5A117FD}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\firstassault\Shipping\GAME.exe
FirewallRules: [{7DDE03CA-07C4-4B6F-8496-FBB541541CF4}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\GarrysMod\hl2.exe
FirewallRules: [{114B7E84-FACD-4899-B75A-50C469E1C590}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\GarrysMod\hl2.exe
FirewallRules: [{1D9F4B61-C2DF-441C-A76C-7E97FD568B2C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Fishing\WindowsNoEditor\FishingGame\Binaries\Win64\FishingGame-Win64-Shipping.exe
FirewallRules: [{61BF0D2C-E977-4D3D-8EEA-812617697A7B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Fishing\WindowsNoEditor\FishingGame\Binaries\Win64\FishingGame-Win64-Shipping.exe
FirewallRules: [{52B8CE4E-7B84-4E79-B03B-2538EA3EF93F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Terraria\Terraria.exe
FirewallRules: [{511FF95D-2EF9-44DA-AEFE-A0F82E3B706E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Terraria\Terraria.exe
FirewallRules: [TCP Query User{109AE36A-B5FB-4224-A418-E1B8BF441C8C}C:\program files (x86)\steam\steamapps\common\terraria\terrariaserver.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\terraria\terrariaserver.exe
FirewallRules: [UDP Query User{87D5FC5C-67DB-4138-979E-8FEC532602AE}C:\program files (x86)\steam\steamapps\common\terraria\terrariaserver.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\terraria\terrariaserver.exe
FirewallRules: [{6E35AD25-4A58-4AED-A4AB-F576ECCFC3D8}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\theHunter\launcher\launcher.exe
FirewallRules: [{D3625E7E-78FA-4DDF-B274-409A0DB1942F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\theHunter\launcher\launcher.exe
FirewallRules: [TCP Query User{147442E0-BFD8-49A7-BEB8-1B33E7C51CB0}C:\program files (x86)\steam\steamapps\common\thehunter\game\thehunter.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\thehunter\game\thehunter.exe
FirewallRules: [UDP Query User{FC58FE07-341D-42E9-8264-52FD3A626700}C:\program files (x86)\steam\steamapps\common\thehunter\game\thehunter.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\thehunter\game\thehunter.exe
FirewallRules: [{B3EA39BC-5B52-44AD-A168-8B62B4866BE7}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\XField Paintball 3\XFP3.exe
FirewallRules: [{98100DB8-5AE2-4919-B830-DB19D81FBB49}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\XField Paintball 3\XFP3.exe
FirewallRules: [{D0365FAD-4326-4B3A-8F9D-7A29A048A7F8}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{C4EDB5C0-9D11-4301-AA9D-BFDBD7724B41}C:\program files (x86)\steam\steamapps\common\war thunder\launcher.exe] => (Block) C:\program files (x86)\steam\steamapps\common\war thunder\launcher.exe
FirewallRules: [UDP Query User{5CDA402C-8321-403A-B7FC-DC7D352935FF}C:\program files (x86)\steam\steamapps\common\war thunder\launcher.exe] => (Block) C:\program files (x86)\steam\steamapps\common\war thunder\launcher.exe
FirewallRules: [{2764C3A8-F252-4DF6-AA51-F3EBB9A631D6}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Need for Speed Undercover\nfs.exe
FirewallRules: [{D2E2A509-E438-4AD9-9E98-01097A73075E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Need for Speed Undercover\nfs.exe
FirewallRules: [{B1194039-2B3D-4B3A-9C5A-168CC868A3E8}] => (Allow) C:\Users\mom\AppData\Local\Programs\Opera\45.0.2552.892\opera.exe
FirewallRules: [TCP Query User{52195F37-CB19-476F-AAD0-3577A264B23D}C:\games\rf4\rf4launcher.exe] => (Allow) C:\games\rf4\rf4launcher.exe
FirewallRules: [UDP Query User{F8B1A3C9-CB4D-4A4A-ACB0-9C1E1EEDE055}C:\games\rf4\rf4launcher.exe] => (Allow) C:\games\rf4\rf4launcher.exe
FirewallRules: [{933A704B-B4D9-4239-B1B0-BA3F5C0252EA}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\CastleCrashers\castle.exe
FirewallRules: [{8365EF0F-5396-4B49-B76D-BA51BB810B5F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\CastleCrashers\castle.exe
FirewallRules: [{FCE7AB4B-49C8-48F1-97CC-85BE7466115C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Dungeon Defenders\Binaries\Win32\DungeonDefenders.exe
FirewallRules: [{714B7470-E76F-417A-802A-BD478AC90A4F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Dungeon Defenders\Binaries\Win32\DungeonDefenders.exe
FirewallRules: [{07987EB2-C904-48ED-8B81-2971B64E8352}] => (Allow) C:\Users\mom\Downloads\LiquidSkyClient0.2.9.exe
FirewallRules: [{B22DC094-4B85-4270-9D3F-F7CE5FED0421}] => (Allow) C:\Users\mom\Downloads\LiquidSkyClient0.2.9.exe
FirewallRules: [{25131065-EF7C-4BC0-81E8-C9EF1F3478E4}] => (Allow) C:\Users\mom\AppData\Roaming\LiquidSky\LiquidSkyClient.exe
FirewallRules: [{742D5D66-64F5-413D-A3E6-2584422ACF42}] => (Allow) C:\Users\mom\AppData\Roaming\LiquidSky\LiquidSkyClient.exe
FirewallRules: [{E8810D41-4C30-416A-87B4-1293464F0802}] => (Allow) C:\Users\mom\AppData\Roaming\LiquidSky\lib\LiquidSky.exe
FirewallRules: [{F6B9361C-AD94-474A-9701-D417735B9F6F}] => (Allow) C:\Users\mom\AppData\Roaming\LiquidSky\lib\LiquidSky.exe
FirewallRules: [{EE09FA2A-454A-4B4F-922B-BEC39B68FDA3}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Creativerse\Creativerse.exe
FirewallRules: [{2FF59D1E-0A45-49F9-BA92-A8F508FA19F0}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Creativerse\Creativerse.exe
FirewallRules: [TCP Query User{E55D6EF6-E599-4B2C-9999-98EFB64FE238}C:\program files (x86)\steam\steamapps\common\red trigger\engine\binaries\win64\ue4game-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\red trigger\engine\binaries\win64\ue4game-win64-shipping.exe
FirewallRules: [UDP Query User{3095BD77-1DC4-48DD-AC53-373D919D1BC3}C:\program files (x86)\steam\steamapps\common\red trigger\engine\binaries\win64\ue4game-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\red trigger\engine\binaries\win64\ue4game-win64-shipping.exe
FirewallRules: [{48C2AA98-12D5-4707-9EB1-4EE6702C5B76}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\WormsWMD\Worms W.M.D.exe
FirewallRules: [{DAD695AC-BAEA-425F-A7AD-1AF45F6A623B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\WormsWMD\Worms W.M.D.exe
FirewallRules: [{AD0FEA9E-24EC-4551-98F4-97EB0F260823}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{2BBC59FB-808C-43A3-9F68-F89F5E06CC39}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{C624F848-013E-492D-B679-C831B8039AE6}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{AAE8987E-A8BC-4C8D-8A5B-B900BAA3C223}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{12A04F5B-E283-4A1A-89A1-46A73005B6F8}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [{8074E729-6E5F-44BB-BE1C-31308CD2372A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Fishing Planet\FishingPlanet.exe
FirewallRules: [{7F696BEA-BEFC-48EA-A87B-445AEC204A43}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Fishing Planet\FishingPlanet.exe
FirewallRules: [{0B85957B-6EC8-4978-85E0-5455A601CC16}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\This War of Mine\This War of Mine.exe
FirewallRules: [{35A09204-1893-4720-87BB-9917FDECF870}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\This War of Mine\This War of Mine.exe
FirewallRules: [{F28EC1AC-0B55-41AE-95DF-ACEA36F3D770}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\This War of Mine\Storyteller.exe
FirewallRules: [{80892CB4-B6A4-4CD8-912E-3242F7126EC6}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\This War of Mine\Storyteller.exe
FirewallRules: [{969A2B5A-8257-44C1-810A-B29B3C2A4F05}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Black Squad\binaries\win32\BlackSquadGame.exe
FirewallRules: [{0A01E436-A918-4E83-ADE9-4DC42CF1F7F5}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Black Squad\binaries\win32\BlackSquadGame.exe
FirewallRules: [{F1E85EA2-6820-4571-9F4B-ABC112DDB525}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Call of Duty Modern Warfare 3\iw5mp.exe
FirewallRules: [{C7BC351F-FFDD-476C-BA48-723F2BEAEA26}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Call of Duty Modern Warfare 3\iw5mp.exe
FirewallRules: [{E9A18352-750B-4A44-BC1B-3F80946BEB56}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{D065FEFF-E5C0-491C-B264-01F62A359BC8}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{84305DB1-02A3-457E-BCC5-2B9C86E48B62}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{6E20A641-5CD2-464F-8512-3BD13D8FD7DD}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Brawlhalla\Brawlhalla.exe
FirewallRules: [{D2561BB6-5E53-4218-9DB0-E25BB9DD8A48}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Brawlhalla\Brawlhalla.exe
FirewallRules: [{70795CB4-33E7-45AD-AC61-1A708420553F}] => (Allow) C:\WINDOWS\system32\rundll32.exe
FirewallRules: [{4ECAED40-6F85-4EF6-9D7B-4BE1CFC17E5C}] => (Allow) C:\Program Files (x86)\Zigzagging\speculate.exe
FirewallRules: [{E4BE913B-6CF1-4688-B7CA-5628E219D3A6}] => (Allow) C:\Program Files (x86)\Adlon\speculate.exe
==================== Restore Points =========================
26-08-2017 01:23:36 Scheduled Checkpoint
29-08-2017 11:50:00 Windows Update
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (09/04/2017 09:30:05 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: pxpatyqel0nv.exe, version: 1.2.1.3, time stamp: 0x59ab7eda
Faulting module name: KERNELBASE.dll, version: 10.0.14393.1532, time stamp: 0x5965ac8c
Exception code: 0xe0434352
Fault offset: 0x0000000000033c58
Faulting process id: 0x5644
Faulting application start time: 0x01d32581e9a6f88d
Faulting application path: C:\Program Files (x86)\PxpAtYqel0NV\pxpatyqel0nv.exe
Faulting module path: C:\WINDOWS\System32\KERNELBASE.dll
Report Id: 020c63dc-744e-41b3-ba5e-e67f563e4492
Faulting package full name:
Faulting package-relative application ID:
Error: (09/04/2017 09:30:04 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: pxpatyqel0nv.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.IO.IOException
at MS.Internal.AppModel.ResourcePart.GetStreamCore(System.IO.FileMode, System.IO.FileAccess)
at System.IO.Packaging.PackagePart.GetStream(System.IO.FileMode, System.IO.FileAccess)
at System.IO.Packaging.PackWebResponse+CachedResponse.GetResponseStream()
at System.IO.Packaging.PackWebResponse.get_ContentType()
at System.Windows.Media.Imaging.BitmapDecoder.SetupDecoderFromUriOrStream(System.Uri, System.IO.Stream, System.Windows.Media.Imaging.BitmapCacheOption, System.Guid ByRef, Boolean ByRef, System.IO.Stream ByRef, System.IO.UnmanagedMemoryStream ByRef, Microsoft.Win32.SafeHandles.SafeFileHandle ByRef)
at System.Windows.Media.Imaging.BitmapDecoder.CreateFromUriOrStream(System.Uri, System.Uri, System.IO.Stream, System.Windows.Media.Imaging.BitmapCreateOptions, System.Windows.Media.Imaging.BitmapCacheOption, System.Net.Cache.RequestCachePolicy, Boolean)
at System.Windows.Media.Imaging.BitmapFrame.CreateFromUriOrStream(System.Uri, System.Uri, System.IO.Stream, System.Windows.Media.Imaging.BitmapCreateOptions, System.Windows.Media.Imaging.BitmapCacheOption, System.Net.Cache.RequestCachePolicy)
at System.Windows.Media.ImageSourceConverter.ConvertFrom(System.ComponentModel.ITypeDescriptorContext, System.Globalization.CultureInfo, System.Object)
at MS.Internal.Xaml.Runtime.ClrObjectRuntime.CreateObjectWithTypeConverter(MS.Internal.Xaml.ServiceProviderContext, System.Xaml.Schema.XamlValueConverter`1<System.ComponentModel.TypeConverter>, System.Object)
at System.Xaml.XamlObjectWriter.Logic_CreateFromValue(MS.Internal.Xaml.Context.ObjectWriterContext, System.Xaml.Schema.XamlValueConverter`1<System.ComponentModel.TypeConverter>, System.Object, System.Xaml.XamlMember, System.String, MS.Internal.Xaml.Runtime.IAddLineInfo)
Exception Info: System.Windows.Markup.XamlParseException
at System.Windows.Markup.XamlReader.RewrapException(System.Exception, System.Xaml.IXamlLineInfo, System.Uri)
at System.Windows.Markup.WpfXamlLoader.Load(System.Xaml.XamlReader, System.Xaml.IXamlObjectWriterFactory, Boolean, System.Object, System.Xaml.XamlObjectWriterSettings, System.Uri)
at System.Windows.ResourceDictionary.CreateObject(System.Windows.Baml2006.KeyRecord)
at System.Windows.ResourceDictionary.OnGettingValue(System.Object, System.Object ByRef, Boolean ByRef)
at System.Windows.ResourceDictionary.OnGettingValuePrivate(System.Object, System.Object ByRef, Boolean ByRef)
at System.Windows.ResourceDictionary.GetValueWithoutLock(System.Object, Boolean ByRef)
at System.Windows.ResourceDictionary.GetValue(System.Object, Boolean ByRef)
at System.Windows.ResourceDictionary.GetValueWithoutLock(System.Object, Boolean ByRef)
at System.Windows.ResourceDictionary.GetValue(System.Object, Boolean ByRef)
at System.Windows.ResourceDictionary.get_Item(System.Object)
at loopback.App.OnStartup(System.Windows.StartupEventArgs)
at System.Windows.Application.<.ctor>b__1_0(System.Object)
at System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
at System.Windows.Threading.ExceptionWrapper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
at System.Windows.Threading.DispatcherOperation.InvokeImpl()
at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
at MS.Internal.CulturePreservingExecutionContext.Run(MS.Internal.CulturePreservingExecutionContext, System.Threading.ContextCallback, System.Object)
at System.Windows.Threading.DispatcherOperation.Invoke()
at System.Windows.Threading.Dispatcher.ProcessQueue()
at System.Windows.Threading.Dispatcher.WndProcHook(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
at MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
at MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
at System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
at System.Windows.Threading.ExceptionWrapper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
at System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
at MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
at MS.Win32.UnsafeNativeMethods.DispatchMessage(System.Windows.Interop.MSG ByRef)
at System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame)
at System.Windows.Application.RunDispatcher(System.Object)
at System.Windows.Application.RunInternal(System.Windows.Window)
at loopback.App.Main()
at loopback.EntryPoint.Main()
Error: (09/04/2017 09:00:20 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: pxpatyqel0nv.exe, version: 1.2.1.3, time stamp: 0x59ab7eda
Faulting module name: KERNELBASE.dll, version: 10.0.14393.1532, time stamp: 0x5965ac8c
Exception code: 0xe0434352
Fault offset: 0x0000000000033c58
Faulting process id: 0x60a4
Faulting application start time: 0x01d3257dbb621b70
Faulting application path: C:\Program Files (x86)\PxpAtYqel0NV\pxpatyqel0nv.exe
Faulting module path: C:\WINDOWS\System32\KERNELBASE.dll
Report Id: 86de7116-3fd9-4f8e-b304-6942691b4a96
Faulting package full name:
Faulting package-relative application ID:
Error: (09/04/2017 09:00:16 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: pxpatyqel0nv.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.IO.IOException
at MS.Internal.AppModel.ResourcePart.GetStreamCore(System.IO.FileMode, System.IO.FileAccess)
at System.IO.Packaging.PackagePart.GetStream(System.IO.FileMode, System.IO.FileAccess)
at System.IO.Packaging.PackWebResponse+CachedResponse.GetResponseStream()
at System.IO.Packaging.PackWebResponse.get_ContentType()
at System.Windows.Media.Imaging.BitmapDecoder.SetupDecoderFromUriOrStream(System.Uri, System.IO.Stream, System.Windows.Media.Imaging.BitmapCacheOption, System.Guid ByRef, Boolean ByRef, System.IO.Stream ByRef, System.IO.UnmanagedMemoryStream ByRef, Microsoft.Win32.SafeHandles.SafeFileHandle ByRef)
at System.Windows.Media.Imaging.BitmapDecoder.CreateFromUriOrStream(System.Uri, System.Uri, System.IO.Stream, System.Windows.Media.Imaging.BitmapCreateOptions, System.Windows.Media.Imaging.BitmapCacheOption, System.Net.Cache.RequestCachePolicy, Boolean)
at System.Windows.Media.Imaging.BitmapFrame.CreateFromUriOrStream(System.Uri, System.Uri, System.IO.Stream, System.Windows.Media.Imaging.BitmapCreateOptions, System.Windows.Media.Imaging.BitmapCacheOption, System.Net.Cache.RequestCachePolicy)
at System.Windows.Media.ImageSourceConverter.ConvertFrom(System.ComponentModel.ITypeDescriptorContext, System.Globalization.CultureInfo, System.Object)
at MS.Internal.Xaml.Runtime.ClrObjectRuntime.CreateObjectWithTypeConverter(MS.Internal.Xaml.ServiceProviderContext, System.Xaml.Schema.XamlValueConverter`1<System.ComponentModel.TypeConverter>, System.Object)
at System.Xaml.XamlObjectWriter.Logic_CreateFromValue(MS.Internal.Xaml.Context.ObjectWriterContext, System.Xaml.Schema.XamlValueConverter`1<System.ComponentModel.TypeConverter>, System.Object, System.Xaml.XamlMember, System.String, MS.Internal.Xaml.Runtime.IAddLineInfo)
Exception Info: System.Windows.Markup.XamlParseException
at System.Windows.Markup.XamlReader.RewrapException(System.Exception, System.Xaml.IXamlLineInfo, System.Uri)
at System.Windows.Markup.WpfXamlLoader.Load(System.Xaml.XamlReader, System.Xaml.IXamlObjectWriterFactory, Boolean, System.Object, System.Xaml.XamlObjectWriterSettings, System.Uri)
at System.Windows.ResourceDictionary.CreateObject(System.Windows.Baml2006.KeyRecord)
at System.Windows.ResourceDictionary.OnGettingValue(System.Object, System.Object ByRef, Boolean ByRef)
at System.Windows.ResourceDictionary.OnGettingValuePrivate(System.Object, System.Object ByRef, Boolean ByRef)
at System.Windows.ResourceDictionary.GetValueWithoutLock(System.Object, Boolean ByRef)
at System.Windows.ResourceDictionary.GetValue(System.Object, Boolean ByRef)
at System.Windows.ResourceDictionary.GetValueWithoutLock(System.Object, Boolean ByRef)
at System.Windows.ResourceDictionary.GetValue(System.Object, Boolean ByRef)
at System.Windows.ResourceDictionary.get_Item(System.Object)
at loopback.App.OnStartup(System.Windows.StartupEventArgs)
at System.Windows.Application.<.ctor>b__1_0(System.Object)
at System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
at System.Windows.Threading.ExceptionWrapper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
at System.Windows.Threading.DispatcherOperation.InvokeImpl()
at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
at MS.Internal.CulturePreservingExecutionContext.Run(MS.Internal.CulturePreservingExecutionContext, System.Threading.ContextCallback, System.Object)
at System.Windows.Threading.DispatcherOperation.Invoke()
at System.Windows.Threading.Dispatcher.ProcessQueue()
at System.Windows.Threading.Dispatcher.WndProcHook(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
at MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
at MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
at System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
at System.Windows.Threading.ExceptionWrapper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
at System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
at MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
at MS.Win32.UnsafeNativeMethods.DispatchMessage(System.Windows.Interop.MSG ByRef)
at System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame)
at System.Windows.Application.RunDispatcher(System.Object)
at System.Windows.Application.RunInternal(System.Windows.Window)
at loopback.App.Main()
at loopback.EntryPoint.Main()
Error: (09/04/2017 08:30:23 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: pxpatyqel0nv.exe, version: 1.2.1.3, time stamp: 0x59ab7eda
Faulting module name: KERNELBASE.dll, version: 10.0.14393.1532, time stamp: 0x5965ac8c
Exception code: 0xe0434352
Fault offset: 0x0000000000033c58
Faulting process id: 0x5d5c
Faulting application start time: 0x01d325798be7fd55
Faulting application path: C:\Program Files (x86)\PxpAtYqel0NV\pxpatyqel0nv.exe
Faulting module path: C:\WINDOWS\System32\KERNELBASE.dll
Report Id: b25f19cc-31df-49db-b348-a86689408f53
Faulting package full name:
Faulting package-relative application ID:
Error: (09/04/2017 08:30:19 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: pxpatyqel0nv.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.IO.IOException
at MS.Internal.AppModel.ResourcePart.GetStreamCore(System.IO.FileMode, System.IO.FileAccess)
at System.IO.Packaging.PackagePart.GetStream(System.IO.FileMode, System.IO.FileAccess)
at System.IO.Packaging.PackWebResponse+CachedResponse.GetResponseStream()
at System.IO.Packaging.PackWebResponse.get_ContentType()
at System.Windows.Media.Imaging.BitmapDecoder.SetupDecoderFromUriOrStream(System.Uri, System.IO.Stream, System.Windows.Media.Imaging.BitmapCacheOption, System.Guid ByRef, Boolean ByRef, System.IO.Stream ByRef, System.IO.UnmanagedMemoryStream ByRef, Microsoft.Win32.SafeHandles.SafeFileHandle ByRef)
at System.Windows.Media.Imaging.BitmapDecoder.CreateFromUriOrStream(System.Uri, System.Uri, System.IO.Stream, System.Windows.Media.Imaging.BitmapCreateOptions, System.Windows.Media.Imaging.BitmapCacheOption, System.Net.Cache.RequestCachePolicy, Boolean)
at System.Windows.Media.Imaging.BitmapFrame.CreateFromUriOrStream(System.Uri, System.Uri, System.IO.Stream, System.Windows.Media.Imaging.BitmapCreateOptions, System.Windows.Media.Imaging.BitmapCacheOption, System.Net.Cache.RequestCachePolicy)
at System.Windows.Media.ImageSourceConverter.ConvertFrom(System.ComponentModel.ITypeDescriptorContext, System.Globalization.CultureInfo, System.Object)
at MS.Internal.Xaml.Runtime.ClrObjectRuntime.CreateObjectWithTypeConverter(MS.Internal.Xaml.ServiceProviderContext, System.Xaml.Schema.XamlValueConverter`1<System.ComponentModel.TypeConverter>, System.Object)
at System.Xaml.XamlObjectWriter.Logic_CreateFromValue(MS.Internal.Xaml.Context.ObjectWriterContext, System.Xaml.Schema.XamlValueConverter`1<System.ComponentModel.TypeConverter>, System.Object, System.Xaml.XamlMember, System.String, MS.Internal.Xaml.Runtime.IAddLineInfo)
Exception Info: System.Windows.Markup.XamlParseException
at System.Windows.Markup.XamlReader.RewrapException(System.Exception, System.Xaml.IXamlLineInfo, System.Uri)
at System.Windows.Markup.WpfXamlLoader.Load(System.Xaml.XamlReader, System.Xaml.IXamlObjectWriterFactory, Boolean, System.Object, System.Xaml.XamlObjectWriterSettings, System.Uri)
at System.Windows.ResourceDictionary.CreateObject(System.Windows.Baml2006.KeyRecord)
at System.Windows.ResourceDictionary.OnGettingValue(System.Object, System.Object ByRef, Boolean ByRef)
at System.Windows.ResourceDictionary.OnGettingValuePrivate(System.Object, System.Object ByRef, Boolean ByRef)
at System.Windows.ResourceDictionary.GetValueWithoutLock(System.Object, Boolean ByRef)
at System.Windows.ResourceDictionary.GetValue(System.Object, Boolean ByRef)
at System.Windows.ResourceDictionary.GetValueWithoutLock(System.Object, Boolean ByRef)
at System.Windows.ResourceDictionary.GetValue(System.Object, Boolean ByRef)
at System.Windows.ResourceDictionary.get_Item(System.Object)
at loopback.App.OnStartup(System.Windows.StartupEventArgs)
at System.Windows.Application.<.ctor>b__1_0(System.Object)
at System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
at System.Windows.Threading.ExceptionWrapper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
at System.Windows.Threading.DispatcherOperation.InvokeImpl()
at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
at MS.Internal.CulturePreservingExecutionContext.Run(MS.Internal.CulturePreservingExecutionContext, System.Threading.ContextCallback, System.Object)
at System.Windows.Threading.DispatcherOperation.Invoke()
at System.Windows.Threading.Dispatcher.ProcessQueue()
at System.Windows.Threading.Dispatcher.WndProcHook(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
at MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
at MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
at System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
at System.Windows.Threading.ExceptionWrapper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
at System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
at MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
at MS.Win32.UnsafeNativeMethods.DispatchMessage(System.Windows.Interop.MSG ByRef)
at System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame)
at System.Windows.Application.RunDispatcher(System.Object)
at System.Windows.Application.RunInternal(System.Windows.Window)
at loopback.App.Main()
at loopback.EntryPoint.Main()
Error: (09/04/2017 08:00:24 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: pxpatyqel0nv.exe, version: 1.2.1.3, time stamp: 0x59ab7eda
Faulting module name: KERNELBASE.dll, version: 10.0.14393.1532, time stamp: 0x5965ac8c
Exception code: 0xe0434352
Fault offset: 0x0000000000033c58
Faulting process id: 0x5250
Faulting application start time: 0x01d325755a8c2f78
Faulting application path: C:\Program Files (x86)\PxpAtYqel0NV\pxpatyqel0nv.exe
Faulting module path: C:\WINDOWS\System32\KERNELBASE.dll
Report Id: c584b550-36b5-4313-a659-e765d3a1ce19
Faulting package full name:
Faulting package-relative application ID:
Error: (09/04/2017 08:00:19 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: pxpatyqel0nv.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.IO.IOException
at MS.Internal.AppModel.ResourcePart.GetStreamCore(System.IO.FileMode, System.IO.FileAccess)
at System.IO.Packaging.PackagePart.GetStream(System.IO.FileMode, System.IO.FileAccess)
at System.IO.Packaging.PackWebResponse+CachedResponse.GetResponseStream()
at System.IO.Packaging.PackWebResponse.get_ContentType()
at System.Windows.Media.Imaging.BitmapDecoder.SetupDecoderFromUriOrStream(System.Uri, System.IO.Stream, System.Windows.Media.Imaging.BitmapCacheOption, System.Guid ByRef, Boolean ByRef, System.IO.Stream ByRef, System.IO.UnmanagedMemoryStream ByRef, Microsoft.Win32.SafeHandles.SafeFileHandle ByRef)
at System.Windows.Media.Imaging.BitmapDecoder.CreateFromUriOrStream(System.Uri, System.Uri, System.IO.Stream, System.Windows.Media.Imaging.BitmapCreateOptions, System.Windows.Media.Imaging.BitmapCacheOption, System.Net.Cache.RequestCachePolicy, Boolean)
at System.Windows.Media.Imaging.BitmapFrame.CreateFromUriOrStream(System.Uri, System.Uri, System.IO.Stream, System.Windows.Media.Imaging.BitmapCreateOptions, System.Windows.Media.Imaging.BitmapCacheOption, System.Net.Cache.RequestCachePolicy)
at System.Windows.Media.ImageSourceConverter.ConvertFrom(System.ComponentModel.ITypeDescriptorContext, System.Globalization.CultureInfo, System.Object)
at MS.Internal.Xaml.Runtime.ClrObjectRuntime.CreateObjectWithTypeConverter(MS.Internal.Xaml.ServiceProviderContext, System.Xaml.Schema.XamlValueConverter`1<System.ComponentModel.TypeConverter>, System.Object)
at System.Xaml.XamlObjectWriter.Logic_CreateFromValue(MS.Internal.Xaml.Context.ObjectWriterContext, System.Xaml.Schema.XamlValueConverter`1<System.ComponentModel.TypeConverter>, System.Object, System.Xaml.XamlMember, System.String, MS.Internal.Xaml.Runtime.IAddLineInfo)
Exception Info: System.Windows.Markup.XamlParseException
at System.Windows.Markup.XamlReader.RewrapException(System.Exception, System.Xaml.IXamlLineInfo, System.Uri)
at System.Windows.Markup.WpfXamlLoader.Load(System.Xaml.XamlReader, System.Xaml.IXamlObjectWriterFactory, Boolean, System.Object, System.Xaml.XamlObjectWriterSettings, System.Uri)
at System.Windows.ResourceDictionary.CreateObject(System.Windows.Baml2006.KeyRecord)
at System.Windows.ResourceDictionary.OnGettingValue(System.Object, System.Object ByRef, Boolean ByRef)
at System.Windows.ResourceDictionary.OnGettingValuePrivate(System.Object, System.Object ByRef, Boolean ByRef)
at System.Windows.ResourceDictionary.GetValueWithoutLock(System.Object, Boolean ByRef)
at System.Windows.ResourceDictionary.GetValue(System.Object, Boolean ByRef)
at System.Windows.ResourceDictionary.GetValueWithoutLock(System.Object, Boolean ByRef)
at System.Windows.ResourceDictionary.GetValue(System.Object, Boolean ByRef)
at System.Windows.ResourceDictionary.get_Item(System.Object)
at loopback.App.OnStartup(System.Windows.StartupEventArgs)
at System.Windows.Application.<.ctor>b__1_0(System.Object)
at System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
at System.Windows.Threading.ExceptionWrapper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
at System.Windows.Threading.DispatcherOperation.InvokeImpl()
at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
at MS.Internal.CulturePreservingExecutionContext.Run(MS.Internal.CulturePreservingExecutionContext, System.Threading.ContextCallback, System.Object)
at System.Windows.Threading.DispatcherOperation.Invoke()
at System.Windows.Threading.Dispatcher.ProcessQueue()
at System.Windows.Threading.Dispatcher.WndProcHook(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
at MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
at MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
at System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
at System.Windows.Threading.ExceptionWrapper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
at System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
at MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
at MS.Win32.UnsafeNativeMethods.DispatchMessage(System.Windows.Interop.MSG ByRef)
at System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame)
at System.Windows.Application.RunDispatcher(System.Object)
at System.Windows.Application.RunInternal(System.Windows.Window)
at loopback.App.Main()
at loopback.EntryPoint.Main()
Error: (09/04/2017 07:30:26 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: pxpatyqel0nv.exe, version: 1.2.1.3, time stamp: 0x59ab7eda
Faulting module name: KERNELBASE.dll, version: 10.0.14393.1532, time stamp: 0x5965ac8c
Exception code: 0xe0434352
Fault offset: 0x0000000000033c58
Faulting process id: 0x4808
Faulting application start time: 0x01d325712b70d44e
Faulting application path: C:\Program Files (x86)\PxpAtYqel0NV\pxpatyqel0nv.exe
Faulting module path: C:\WINDOWS\System32\KERNELBASE.dll
Report Id: 2c374026-8ff1-4aed-9b48-719b524ccbde
Faulting package full name:
Faulting package-relative application ID:
Error: (09/04/2017 07:30:23 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: pxpatyqel0nv.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.IO.IOException
at MS.Internal.AppModel.ResourcePart.GetStreamCore(System.IO.FileMode, System.IO.FileAccess)
at System.IO.Packaging.PackagePart.GetStream(System.IO.FileMode, System.IO.FileAccess)
at System.IO.Packaging.PackWebResponse+CachedResponse.GetResponseStream()
at System.IO.Packaging.PackWebResponse.get_ContentType()
at System.Windows.Media.Imaging.BitmapDecoder.SetupDecoderFromUriOrStream(System.Uri, System.IO.Stream, System.Windows.Media.Imaging.BitmapCacheOption, System.Guid ByRef, Boolean ByRef, System.IO.Stream ByRef, System.IO.UnmanagedMemoryStream ByRef, Microsoft.Win32.SafeHandles.SafeFileHandle ByRef)
at System.Windows.Media.Imaging.BitmapDecoder.CreateFromUriOrStream(System.Uri, System.Uri, System.IO.Stream, System.Windows.Media.Imaging.BitmapCreateOptions, System.Windows.Media.Imaging.BitmapCacheOption, System.Net.Cache.RequestCachePolicy, Boolean)
at System.Windows.Media.Imaging.BitmapFrame.CreateFromUriOrStream(System.Uri, System.Uri, System.IO.Stream, System.Windows.Media.Imaging.BitmapCreateOptions, System.Windows.Media.Imaging.BitmapCacheOption, System.Net.Cache.RequestCachePolicy)
at System.Windows.Media.ImageSourceConverter.ConvertFrom(System.ComponentModel.ITypeDescriptorContext, System.Globalization.CultureInfo, System.Object)
at MS.Internal.Xaml.Runtime.ClrObjectRuntime.CreateObjectWithTypeConverter(MS.Internal.Xaml.ServiceProviderContext, System.Xaml.Schema.XamlValueConverter`1<System.ComponentModel.TypeConverter>, System.Object)
at System.Xaml.XamlObjectWriter.Logic_CreateFromValue(MS.Internal.Xaml.Context.ObjectWriterContext, System.Xaml.Schema.XamlValueConverter`1<System.ComponentModel.TypeConverter>, System.Object, System.Xaml.XamlMember, System.String, MS.Internal.Xaml.Runtime.IAddLineInfo)
Exception Info: System.Windows.Markup.XamlParseException
at System.Windows.Markup.XamlReader.RewrapException(System.Exception, System.Xaml.IXamlLineInfo, System.Uri)
at System.Windows.Markup.WpfXamlLoader.Load(System.Xaml.XamlReader, System.Xaml.IXamlObjectWriterFactory, Boolean, System.Object, System.Xaml.XamlObjectWriterSettings, System.Uri)
at System.Windows.ResourceDictionary.CreateObject(System.Windows.Baml2006.KeyRecord)
at System.Windows.ResourceDictionary.OnGettingValue(System.Object, System.Object ByRef, Boolean ByRef)
at System.Windows.ResourceDictionary.OnGettingValuePrivate(System.Object, System.Object ByRef, Boolean ByRef)
at System.Windows.ResourceDictionary.GetValueWithoutLock(System.Object, Boolean ByRef)
at System.Windows.ResourceDictionary.GetValue(System.Object, Boolean ByRef)
at System.Windows.ResourceDictionary.GetValueWithoutLock(System.Object, Boolean ByRef)
at System.Windows.ResourceDictionary.GetValue(System.Object, Boolean ByRef)
at System.Windows.ResourceDictionary.get_Item(System.Object)
at loopback.App.OnStartup(System.Windows.StartupEventArgs)
at System.Windows.Application.<.ctor>b__1_0(System.Object)
at System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
at System.Windows.Threading.ExceptionWrapper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
at System.Windows.Threading.DispatcherOperation.InvokeImpl()
at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
at MS.Internal.CulturePreservingExecutionContext.Run(MS.Internal.CulturePreservingExecutionContext, System.Threading.ContextCallback, System.Object)
at System.Windows.Threading.DispatcherOperation.Invoke()
at System.Windows.Threading.Dispatcher.ProcessQueue()
at System.Windows.Threading.Dispatcher.WndProcHook(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
at MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
at MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
at System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
at System.Windows.Threading.ExceptionWrapper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
at System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
at MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
at MS.Win32.UnsafeNativeMethods.DispatchMessage(System.Windows.Interop.MSG ByRef)
at System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame)
at System.Windows.Application.RunDispatcher(System.Object)
at System.Windows.Application.RunInternal(System.Windows.Window)
at loopback.App.Main()
at loopback.EntryPoint.Main()
System errors:
=============
Error: (09/04/2017 07:22:29 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Network Cache Manager service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 100 milliseconds: Restart the service.
Error: (09/04/2017 04:24:36 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
and APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (09/04/2017 04:23:25 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (09/04/2017 04:22:27 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Network Cache Manager service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 100 milliseconds: Restart the service.
Error: (09/04/2017 03:13:40 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Interactive Services Detection service terminated with the following error:
Incorrect function.
Error: (09/04/2017 01:22:25 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Network Cache Manager service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 100 milliseconds: Restart the service.
Error: (09/04/2017 01:20:54 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (09/03/2017 10:22:22 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Network Cache Manager service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 100 milliseconds: Restart the service.
Error: (09/03/2017 10:02:38 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (09/03/2017 07:24:09 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The HP Support Solutions Framework Service service terminated unexpectedly. It has done this 1 time(s).
CodeIntegrity:
===================================
Date: 2017-09-03 19:18:37.992
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files (x86)\Overwolf\0.106.227.0\x64\OWExplorer.dll that did not meet the Store signing level requirements.
Date: 2017-09-03 19:18:31.636
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume3\Program Files (x86)\Overwolf\0.106.227.0\x64\OWExplorer.dll that did not meet the Store signing level requirements.
Date: 2017-09-03 19:09:29.408
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8414.5925.0_x64__8wekyb3d8bbwe\Office16\OfficeHubTaskHost.exe) attempted to load \Device\HarddiskVolume3\Program Files (x86)\Overwolf\0.106.227.0\x64\OWExplorer.dll that did not meet the Store signing level requirements.
Date: 2017-09-03 19:09:29.373
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8414.5925.0_x64__8wekyb3d8bbwe\Office16\OfficeHubTaskHost.exe) attempted to load \Device\HarddiskVolume3\Program Files (x86)\Overwolf\0.106.227.0\x64\OWExplorer.dll that did not meet the Store signing level requirements.
Date: 2017-09-03 19:09:29.354
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8414.5925.0_x64__8wekyb3d8bbwe\Office16\OfficeHubTaskHost.exe) attempted to load \Device\HarddiskVolume3\Program Files (x86)\Overwolf\0.106.227.0\x64\OWExplorer.dll that did not meet the Store signing level requirements.
Date: 2017-09-03 19:09:29.335
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8414.5925.0_x64__8wekyb3d8bbwe\Office16\OfficeHubTaskHost.exe) attempted to load \Device\HarddiskVolume3\Program Files (x86)\Overwolf\0.106.227.0\x64\OWExplorer.dll that did not meet the Store signing level requirements.
Date: 2017-09-03 19:09:29.314
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8414.5925.0_x64__8wekyb3d8bbwe\Office16\OfficeHubTaskHost.exe) attempted to load \Device\HarddiskVolume3\Program Files (x86)\Overwolf\0.106.227.0\x64\OWExplorer.dll that did not meet the Store signing level requirements.
Date: 2017-09-03 19:09:29.285
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8414.5925.0_x64__8wekyb3d8bbwe\Office16\OfficeHubTaskHost.exe) attempted to load \Device\HarddiskVolume3\Program Files (x86)\Overwolf\0.106.227.0\x64\OWExplorer.dll that did not meet the Store signing level requirements.
Date: 2017-09-03 19:09:29.266
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8414.5925.0_x64__8wekyb3d8bbwe\Office16\OfficeHubTaskHost.exe) attempted to load \Device\HarddiskVolume3\Program Files (x86)\Overwolf\0.106.227.0\x64\OWExplorer.dll that did not meet the Store signing level requirements.
Date: 2017-09-03 19:09:29.247
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8414.5925.0_x64__8wekyb3d8bbwe\Office16\OfficeHubTaskHost.exe) attempted to load \Device\HarddiskVolume3\Program Files (x86)\Overwolf\0.106.227.0\x64\OWExplorer.dll that did not meet the Store signing level requirements.
==================== Memory info ===========================
Processor: Intel® Pentium® CPU N3540 @ 2.16GHz
Percentage of memory in use: 67%
Total physical RAM: 3985.95 MB
Available physical RAM: 1290.47 MB
Total Virtual: 7164.84 MB
Available Virtual: 3293.02 MB
==================== Drives ================================
Drive c: (Windows) (Fixed) (Total:446.62 GB) (Free:103.27 GB) NTFS
Drive d: (RECOVERY) (Fixed) (Total:18.05 GB) (Free:2.12 GB) NTFS ==>[system with boot components (obtained from drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 52937533)
Partition: GPT.
==================== End of Addition.txt ============================
#4
Posted 04 September 2017 - 09:28 AM
RKinner
-
- Expert
-
- 24,625 posts
Malware Expert
Download the attached fixlist.txt to the same location as FRST
[attachment=85967:fixlist.txt]
Run FRST and press Fix
A fix log will be generated please post that
Run FRST again as before. Make sure Addition.txt is checked and hit Scan. Post both logs.
Similar Topics
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users
As Featured On:
Sign In
Create Account
