[ttbcs]

Each day when I start my computer I get ads showing up in the bottom corner of my screen. Once I close them they do not come back. I would appresciate your help in seeing if anything looks out of order.

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 24.02.2018

Ran by Richard (administrator) on RICHARD-PC (27-02-2018 16:53:58)

Running from C:\Users\Richard\Desktop

Loaded Profiles: Richard (Available Profiles: Richard)

Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

 

==================== Processes (Whitelisted) =================

 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

 

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe

(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Dell, Inc.) C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe

(SoftThinks SAS) C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Atheros) C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

() C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe

(SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe

() C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe

(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe

() C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

() C:\Program Files (x86)\Nero\SyncUP\NeroLauncher.exe

() C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe

(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe

(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleCrashHandler.exe

(CenturyLink Inc) C:\Program Files (x86)\CenturyLink\Desktop\CenturyLinkTouchPointAgent.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleCrashHandler64.exe

(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicator.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Symantec Corporation) C:\Program Files (x86)\Norton AntiVirus\Engine\22.12.0.104\nortonsecurity.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe

(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Symantec Corporation) C:\Program Files (x86)\Norton AntiVirus\Engine\22.12.0.104\nortonsecurity.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PrivacyIconClient.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

 

==================== Registry (Whitelisted) ===========================

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

 

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6463080 2012-01-16] (Realtek Semiconductor)

HKLM\...\Run: [Stage Remote] => C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe [2022976 2011-06-27] ()

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [497648 2010-07-28] (Adobe Systems Incorporated)

HKLM\...\Run: [DellStage] => C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe [2190704 2011-11-03] ()

HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [297272 2017-12-11] (Apple Inc.)

HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe [133400 2011-12-16] (Intel Corporation)

HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-16] (Intel Corporation)

HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)

HKLM-x32\...\Run: [Dell DataSafe Online] => C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe [1117528 2010-08-25] (Dell, Inc.)

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40336 2015-09-24] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [NeroLauncher] => C:\Program Files (x86)\Nero\SyncUP\NeroLauncher.exe [67496 2012-08-21] ()

HKLM-x32\...\Run: [AccuWeatherWidget] => C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe [957440 2011-11-03] ()

HKLM-x32\...\Run: [hpqSRMon] => C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard)

HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [CenturyLinkTouchPointAgent] => C:\Program Files (x86)\CenturyLink\Desktop\CenturyLinkTouchPointAgent.exe [48616 2015-06-18] (CenturyLink Inc)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-4042283449-2508691380-3062179275-1000\...\Run: [HP Officejet Pro 8600 (NET)] => C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)

HKU\S-1-5-21-4042283449-2508691380-3062179275-1000\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [1421736 2017-03-28] (Garmin Ltd. or its subsidiaries)

HKU\S-1-5-18\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [1421736 2017-03-28] (Garmin Ltd. or its subsidiaries)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk [2013-06-06]

ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)

 

==================== Internet (Whitelisted) ====================

 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

 

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 205.171.3.26

Tcpip\..\Interfaces\{62F4F8D3-111A-42DB-98B6-006B46F92835}: [DhcpNameServer] 192.168.0.1 205.171.203.226

Tcpip\..\Interfaces\{8C020BFE-B6EF-4F4C-9A56-725419827047}: [DhcpNameServer] 192.168.0.1 205.171.3.26

 

Internet Explorer:

==================

HKU\S-1-5-21-4042283449-2508691380-3062179275-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yahoo.com/?ilc=1

HKU\S-1-5-21-4042283449-2508691380-3062179275-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/USCON/1

URLSearchHook: HKU\S-1-5-21-4042283449-2508691380-3062179275-1000 - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

SearchScopes: HKLM -> DefaultScope {E5E3C20B-752E-4644-BC5D-F4F1F82DBC1E} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDR&src=IE-SearchBox

SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM -> {E5E3C20B-752E-4644-BC5D-F4F1F82DBC1E} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDR&src=IE-SearchBox

SearchScopes: HKLM-x32 -> DefaultScope {E5E3C20B-752E-4644-BC5D-F4F1F82DBC1E} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDR&src=IE-SearchBox

SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM-x32 -> {E5E3C20B-752E-4644-BC5D-F4F1F82DBC1E} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDR&src=IE-SearchBox

SearchScopes: HKU\S-1-5-21-4042283449-2508691380-3062179275-1000 -> DefaultScope {E5E3C20B-752E-4644-BC5D-F4F1F82DBC1E} URL = 

SearchScopes: HKU\S-1-5-21-4042283449-2508691380-3062179275-1000 -> {E5E3C20B-752E-4644-BC5D-F4F1F82DBC1E} URL = 

BHO: Norton Identity Safety -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton AntiVirus\Engine\22.12.0.104\coIEPlg.dll [2018-01-24] (Symantec Corporation)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)

BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-29] (Google Inc.)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)

BHO-x32: &Yahoo! Toolbar Helper -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll [2008-07-28] (Yahoo! Inc.)

BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-05-21] (Hewlett-Packard Co.)

BHO-x32: Norton Identity Safety -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton AntiVirus\Engine32\22.12.0.104\coIEPlg.dll [2018-01-24] (Symantec Corporation)

BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton AntiVirus\Engine\21.7.0.11\IPS\IPSBHO.DLL => No File

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)

BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-29] (Google Inc.)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)

BHO-x32: SingleInstance Class -> {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} -> C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll [2008-07-28] (Yahoo! Inc)

BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-05-21] (Hewlett-Packard Co.)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-29] (Google Inc.)

Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton AntiVirus\Engine\22.12.0.104\coIEPlg.dll [2018-01-24] (Symantec Corporation)

Toolbar: HKLM-x32 - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll [2008-07-28] (Yahoo! Inc.)

Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton AntiVirus\Engine32\22.12.0.104\coIEPlg.dll [2018-01-24] (Symantec Corporation)

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-29] (Google Inc.)

Handler-x32: cozi - {5356518D-FE9C-4E08-9C1F-1E872ECD367F} - c:\Program Files (x86)\Cozi Express\CoziProtocolHandler.dll [2011-05-05] (Cozi Group, Inc.)

 

FireFox:

========

FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF Extension: (HP Smart Web Printing) - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-06-06] [Legacy] [not signed]

FF HKLM-x32\...\Thunderbird\Extensions: [[email protected]] - C:\Program Files\McAfee\MSK => not found

FF HKU\S-1-5-21-4042283449-2508691380-3062179275-1000\...\Firefox\Extensions: [[email protected]] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF Plugin: @microsoft.com/GENUINE -> disabled [No File]

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-09] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-09] (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-16] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-16] (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2015-09-24] (Adobe Systems Inc.)

 

Chrome: 

=======

CHR DefaultProfile: Default

CHR HomePage: Default -> hxxp://www.yahoo.com/?ilc=1

CHR NewTab: Default ->  Not-active:"chrome-extension://obnljkamlkedffammjddflhjepplhnoj/stubby.html", Not-active:"chrome-extension://cmnghalbbgfaacplgindnehcnodlfpoc/newtab.html"

CHR Profile: C:\Users\Richard\AppData\Local\Google\Chrome\User Data\Default [2018-02-27]

CHR Extension: (Docs) - C:\Users\Richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-13]

CHR Extension: (Google Drive) - C:\Users\Richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-23]

CHR Extension: (YouTube) - C:\Users\Richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-14]

CHR Extension: (Norton Security Toolbar) - C:\Users\Richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjabmdjcfcfdmffimndhafhblfmpjdpe [2017-10-04]

CHR Extension: (Yahoo Partner) - C:\Users\Richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmnghalbbgfaacplgindnehcnodlfpoc [2017-03-23]

CHR Extension: (Google Search) - C:\Users\Richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-30]

CHR Extension: (Google Docs Offline) - C:\Users\Richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-16]

CHR Extension: (AdBlock) - C:\Users\Richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2018-02-27]

CHR Extension: (Norton Identity Safe) - C:\Users\Richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\iikflkcanblccfahdhdonehdalibjnif [2015-08-13]

CHR Extension: (Chrome Web Store Payments) - C:\Users\Richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-08-21]

CHR Extension: (HowToSuite) - C:\Users\Richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\obnljkamlkedffammjddflhjepplhnoj [2018-02-13]

CHR Extension: (Gmail) - C:\Users\Richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-29]

CHR Extension: (Chrome Media Router) - C:\Users\Richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-12-12]

CHR HKLM\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton AntiVirus\Engine\22.12.0.104\Exts\Chrome.crx <not found>

CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx

CHR HKLM-x32\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton AntiVirus\Engine\22.12.0.104\Exts\Chrome.crx <not found>

CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx

 

==================== Services (Whitelisted) ====================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2017-11-27] (Apple Inc.)

S3 Garmin Device Interaction Service; C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe [1099280 2017-03-28] (Garmin Ltd. or its subsidiaries)

R3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [248832 2009-05-21] (Hewlett-Packard Co.) [File not signed]

R2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-05-21] (Hewlett-Packard Co.) [File not signed]

R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1039360 2010-10-22] (Hewlett-Packard Co.) [File not signed]

R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]

R2 NortonSecurity; C:\Program Files (x86)\Norton AntiVirus\Engine\22.12.0.104\NortonSecurity.exe [328712 2018-01-25] (Symantec Corporation)

R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]

S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)

R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe [73728 2011-11-29] (Atheros) [File not signed]

 

===================== Drivers (Whitelisted) ======================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

R1 BHDrvx64; C:\Program Files (x86)\Norton AntiVirus\NortonData\22.5.2.15\Definitions\BASHDefs\20180226.001\BHDrvx64.sys [1879632 2018-02-10] (Symantec Corporation)

R1 ccSet_NGC; C:\Windows\system32\drivers\NGCx64\160C000.068\ccSetx64.sys [187544 2018-01-24] (Symantec Corporation)

R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [507984 2018-01-03] (Symantec Corporation)

R1 IDSVia64; C:\Program Files (x86)\Norton AntiVirus\NortonData\22.5.2.15\Definitions\IPSDefs\20180227.001\IDSvia64.sys [1056920 2017-10-13] (Symantec Corporation)

R3 SRTSP; C:\Windows\System32\Drivers\NGCx64\160C000.068\SRTSP64.SYS [817816 2018-01-24] (Symantec Corporation)

R1 SRTSPX; C:\Windows\system32\drivers\NGCx64\160C000.068\SRTSPX64.SYS [49304 2018-01-24] (Symantec Corporation)

R0 SymEFASI; C:\Windows\System32\drivers\NGCx64\160C000.068\SYMEFASI64.SYS [1942168 2018-01-24] (Symantec Corporation)

R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [102552 2018-02-26] (Symantec Corporation)

R1 SymIRON; C:\Windows\system32\drivers\NGCx64\160C000.068\Ironx64.SYS [307864 2018-01-24] (Symantec Corporation)

R1 SymNetS; C:\Windows\System32\Drivers\NGCx64\160C000.068\SYMNETS.SYS [566936 2018-01-24] (Symantec Corporation)

S3 NAVENG; \??\C:\Program Files (x86)\Norton AntiVirus\NortonData\22.5.2.15\Definitions\SDSDefs\20160713.008\ENG64.SYS [X]

S3 NAVEX15; \??\C:\Program Files (x86)\Norton AntiVirus\NortonData\22.5.2.15\Definitions\SDSDefs\20160713.008\EX64.SYS [X]

 

==================== NetSvcs (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

 

==================== One Month Created files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2018-02-27 16:53 - 2018-02-27 16:55 - 000021989 _____ C:\Users\Richard\Desktop\FRST.txt

2018-02-27 16:53 - 2018-02-27 16:53 - 000000000 ____D C:\FRST

2018-02-27 16:51 - 2018-02-27 16:51 - 002403328 _____ (Farbar) C:\Users\Richard\Desktop\FRST64.exe

2018-02-26 18:01 - 2018-02-26 18:01 - 000000000 ____D C:\Windows\System32\Tasks\Remediation

2018-02-26 17:44 - 2018-02-26 17:44 - 000000000 ____D C:\Windows\System32\Tasks\Norton AntiVirus

2018-02-26 17:37 - 2018-02-26 17:37 - 000003222 _____ C:\Windows\System32\Tasks\Norton WSC Integration

2018-02-26 17:37 - 2018-02-26 17:37 - 000002311 _____ C:\Users\Public\Desktop\Norton Security.lnk

2018-02-26 17:37 - 2018-02-26 17:37 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton AntiVirus Online

2018-02-26 16:52 - 2018-02-26 16:52 - 000000000 ____D C:\Windows\system32\Drivers\NGCx64

2018-02-13 14:41 - 2018-02-10 11:52 - 000395928 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2018-02-13 14:41 - 2018-02-10 11:03 - 000347296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2018-02-13 14:41 - 2018-02-10 00:44 - 025740288 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2018-02-13 14:41 - 2018-02-09 23:30 - 002724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2018-02-13 14:41 - 2018-02-09 23:29 - 000004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2018-02-13 14:41 - 2018-02-09 23:19 - 002900480 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2018-02-13 14:41 - 2018-02-09 23:17 - 000417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec

2018-02-13 14:41 - 2018-02-09 23:17 - 000066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2018-02-13 14:41 - 2018-02-09 23:17 - 000048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2018-02-13 14:41 - 2018-02-09 23:16 - 000577536 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2018-02-13 14:41 - 2018-02-09 23:16 - 000088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2018-02-13 14:41 - 2018-02-09 23:10 - 000054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2018-02-13 14:41 - 2018-02-09 23:10 - 000034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2018-02-13 14:41 - 2018-02-09 23:09 - 005782016 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2018-02-13 14:41 - 2018-02-09 23:07 - 000615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2018-02-13 14:41 - 2018-02-09 23:06 - 000816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2018-02-13 14:41 - 2018-02-09 23:06 - 000814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2018-02-13 14:41 - 2018-02-09 23:06 - 000144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2018-02-13 14:41 - 2018-02-09 23:06 - 000116224 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2018-02-13 14:41 - 2018-02-09 23:01 - 000969216 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2018-02-13 14:41 - 2018-02-09 22:58 - 000489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2018-02-13 14:41 - 2018-02-09 22:52 - 000087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx

2018-02-13 14:41 - 2018-02-09 22:52 - 000077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2018-02-13 14:41 - 2018-02-09 22:51 - 000107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll

2018-02-13 14:41 - 2018-02-09 22:49 - 000199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2018-02-13 14:41 - 2018-02-09 22:48 - 000092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2018-02-13 14:41 - 2018-02-09 22:46 - 000315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2018-02-13 14:41 - 2018-02-09 22:45 - 000152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll

2018-02-13 14:41 - 2018-02-09 22:36 - 015283712 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2018-02-13 14:41 - 2018-02-09 22:36 - 000262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll

2018-02-13 14:41 - 2018-02-09 22:34 - 000807936 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2018-02-13 14:41 - 2018-02-09 22:34 - 000726528 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2018-02-13 14:41 - 2018-02-09 22:33 - 001359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2018-02-13 14:41 - 2018-02-09 22:32 - 002134528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2018-02-13 14:41 - 2018-02-09 22:27 - 003241472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2018-02-13 14:41 - 2018-02-09 22:20 - 020274176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2018-02-13 14:41 - 2018-02-09 22:14 - 001546240 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2018-02-13 14:41 - 2018-02-09 22:08 - 002724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2018-02-13 14:41 - 2018-02-09 22:02 - 000800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2018-02-13 14:41 - 2018-02-09 21:57 - 000499712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2018-02-13 14:41 - 2018-02-09 21:57 - 000341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec

2018-02-13 14:41 - 2018-02-09 21:57 - 000062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2018-02-13 14:41 - 2018-02-09 21:57 - 000047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2018-02-13 14:41 - 2018-02-09 21:56 - 000064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2018-02-13 14:41 - 2018-02-09 21:54 - 002294272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2018-02-13 14:41 - 2018-02-09 21:52 - 000047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2018-02-13 14:41 - 2018-02-09 21:51 - 000030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2018-02-13 14:41 - 2018-02-09 21:50 - 000476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2018-02-13 14:41 - 2018-02-09 21:49 - 000662528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2018-02-13 14:41 - 2018-02-09 21:49 - 000620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2018-02-13 14:41 - 2018-02-09 21:49 - 000115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2018-02-13 14:41 - 2018-02-09 21:42 - 000416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2018-02-13 14:41 - 2018-02-09 21:39 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2018-02-13 14:41 - 2018-02-09 21:38 - 000091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll

2018-02-13 14:41 - 2018-02-09 21:38 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx

2018-02-13 14:41 - 2018-02-09 21:36 - 000168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2018-02-13 14:41 - 2018-02-09 21:35 - 004498944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2018-02-13 14:41 - 2018-02-09 21:35 - 000279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2018-02-13 14:41 - 2018-02-09 21:35 - 000076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2018-02-13 14:41 - 2018-02-09 21:34 - 000130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll

2018-02-13 14:41 - 2018-02-09 21:33 - 013680640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2018-02-13 14:41 - 2018-02-09 21:29 - 000230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll

2018-02-13 14:41 - 2018-02-09 21:27 - 002058752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2018-02-13 14:41 - 2018-02-09 21:27 - 000694784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2018-02-13 14:41 - 2018-02-09 21:26 - 001155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2018-02-13 14:41 - 2018-02-09 21:14 - 002767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2018-02-13 14:41 - 2018-02-09 21:10 - 001314304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2018-02-13 14:41 - 2018-02-09 21:08 - 000710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2018-02-13 14:41 - 2018-01-12 08:46 - 000631680 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi

2018-02-13 14:41 - 2018-01-12 08:44 - 005581544 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2018-02-13 14:41 - 2018-01-12 08:44 - 001894120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2018-02-13 14:41 - 2018-01-12 08:44 - 000708328 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi

2018-02-13 14:41 - 2018-01-12 08:44 - 000377064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys

2018-02-13 14:41 - 2018-01-12 08:44 - 000371432 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys

2018-02-13 14:41 - 2018-01-12 08:44 - 000287976 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS

2018-02-13 14:41 - 2018-01-12 08:44 - 000262376 _____ (Microsoft Corporation) C:\Windows\system32\hal.dll

2018-02-13 14:41 - 2018-01-12 08:44 - 000154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys

2018-02-13 14:41 - 2018-01-12 08:44 - 000095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys

2018-02-13 14:41 - 2018-01-12 08:40 - 001460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 001212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 001163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000731648 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000484864 _____ (Microsoft Corporation) C:\Windows\system32\StructuredQuery.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000361984 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:40 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:33 - 001665384 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2018-02-13 14:41 - 2018-01-12 08:29 - 004014312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2018-02-13 14:41 - 2018-01-12 08:29 - 003959016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2018-02-13 14:41 - 2018-01-12 08:27 - 004834816 _____ (Microsoft Corporation) C:\Windows\system32\xpsrchvw.exe

2018-02-13 14:41 - 2018-01-12 08:27 - 001314112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 001114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000554496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000363520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\StructuredQuery.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:26 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 08:16 - 003405824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xpsrchvw.exe

2018-02-13 14:41 - 2018-01-12 08:16 - 000076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys

2018-02-13 14:41 - 2018-01-12 08:16 - 000030208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidusb.sys

2018-02-13 14:41 - 2018-01-12 08:15 - 000032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys

2018-02-13 14:41 - 2018-01-12 08:11 - 000148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe

2018-02-13 14:41 - 2018-01-12 08:11 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys

2018-02-13 14:41 - 2018-01-12 08:11 - 000017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe

2018-02-13 14:41 - 2018-01-12 08:10 - 000064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe

2018-02-13 14:41 - 2018-01-12 08:07 - 000338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe

2018-02-13 14:41 - 2018-01-12 08:06 - 000296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe

2018-02-13 14:41 - 2018-01-12 08:03 - 000159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys

2018-02-13 14:41 - 2018-01-12 08:02 - 000291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys

2018-02-13 14:41 - 2018-01-12 08:02 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys

2018-02-13 14:41 - 2018-01-12 08:02 - 000050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe

2018-02-13 14:41 - 2018-01-12 08:01 - 000112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe

2018-02-13 14:41 - 2018-01-12 08:01 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe

2018-02-13 14:41 - 2018-01-12 07:57 - 000036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll

2018-02-13 14:41 - 2018-01-12 07:57 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe

2018-02-13 14:41 - 2018-01-12 07:57 - 000014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2018-02-13 14:41 - 2018-01-12 07:57 - 000007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe

2018-02-13 14:41 - 2018-01-12 07:57 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

2018-02-13 14:41 - 2018-01-12 07:56 - 000006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 07:56 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 07:56 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll

2018-02-13 14:41 - 2018-01-12 07:56 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll

2018-02-13 14:41 - 2018-01-11 08:41 - 001133568 _____ (Microsoft Corporation) C:\Windows\system32\cdosys.dll

2018-02-13 14:41 - 2018-01-11 08:22 - 000805376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cdosys.dll

2018-02-13 14:41 - 2018-01-11 08:09 - 003224064 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2018-02-13 14:41 - 2018-01-05 08:31 - 000151552 _____ (Microsoft Corporation) C:\Windows\system32\t2embed.dll

2018-02-13 14:41 - 2018-01-05 08:31 - 000041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll

2018-02-13 14:41 - 2018-01-05 08:30 - 000100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll

2018-02-13 14:41 - 2018-01-05 08:30 - 000046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll

2018-02-13 14:41 - 2018-01-05 08:30 - 000014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll

2018-02-13 14:41 - 2018-01-05 08:25 - 000383720 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll

2018-02-13 14:41 - 2018-01-05 08:14 - 000309480 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll

2018-02-13 14:41 - 2018-01-05 08:11 - 000111104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\t2embed.dll

2018-02-13 14:41 - 2018-01-05 08:11 - 000071168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll

2018-02-13 14:41 - 2018-01-05 08:11 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll

2018-02-13 14:41 - 2018-01-05 08:11 - 000010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll

2018-02-13 14:41 - 2018-01-05 07:50 - 000034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll

2018-02-13 14:41 - 2017-12-05 09:36 - 001484288 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll

2018-02-13 14:41 - 2017-12-05 09:36 - 000229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll

2018-02-13 14:41 - 2017-12-05 09:36 - 000218112 _____ (Microsoft Corporation) C:\Windows\system32\WinSCard.dll

2018-02-13 14:41 - 2017-12-05 09:36 - 000190976 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll

2018-02-13 14:41 - 2017-12-05 09:36 - 000141824 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll

2018-02-13 14:41 - 2017-12-05 09:36 - 000092160 _____ (Microsoft Corporation) C:\Windows\system32\TabSvc.dll

2018-02-13 14:41 - 2017-12-05 09:08 - 001176576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll

2018-02-13 14:41 - 2017-12-05 09:08 - 000179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll

2018-02-13 14:41 - 2017-12-05 09:08 - 000145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll

2018-02-13 14:41 - 2017-12-05 09:08 - 000135168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WinSCard.dll

2018-02-13 14:41 - 2017-12-05 09:08 - 000106496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll

2018-02-13 14:41 - 2017-12-05 08:04 - 000404992 _____ (Microsoft Corporation) C:\Windows\system32\wisptis.exe

2018-02-13 14:38 - 2018-01-21 15:50 - 000136424 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe

2018-02-13 14:38 - 2018-01-21 15:40 - 000654336 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2018-02-13 14:38 - 2018-01-19 06:05 - 001994752 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe

2018-02-13 14:38 - 2018-01-19 06:05 - 001569280 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll

2018-02-13 14:38 - 2018-01-19 06:05 - 000749568 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2018-02-13 14:38 - 2018-01-19 06:05 - 000604672 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll

2018-02-13 14:38 - 2018-01-19 06:05 - 000450048 _____ (Microsoft Corporation) C:\Windows\system32\centel.dll

2018-02-13 14:38 - 2018-01-19 06:05 - 000378880 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll

2018-02-13 14:38 - 2018-01-19 06:05 - 000262144 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll

2018-02-13 14:38 - 2018-01-19 06:05 - 000236544 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll

2018-02-07 08:33 - 2018-02-07 08:33 - 000002130 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth Pro.lnk

2018-02-07 08:33 - 2018-02-07 08:33 - 000002092 _____ C:\Users\Public\Desktop\Google Earth Pro.lnk

 

==================== One Month Modified files and folders ========

 

(If an entry is included in the fixlist, the file/folder will be moved.)

 

2018-02-27 16:45 - 2012-06-18 22:39 - 000000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup

2018-02-27 16:44 - 2012-06-18 22:58 - 000000000 ____D C:\Users\Default\AppData\Local\SoftThinks

2018-02-27 16:44 - 2012-06-18 22:58 - 000000000 ____D C:\Users\Default User\AppData\Local\SoftThinks

2018-02-27 16:44 - 2009-07-13 21:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT

2018-02-27 15:53 - 2013-07-17 12:22 - 000002226 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

2018-02-27 15:53 - 2013-07-17 12:22 - 000002185 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2018-02-26 18:01 - 2015-06-29 16:10 - 000000000 ____D C:\ProgramData\Norton

2018-02-26 18:00 - 2015-07-21 02:23 - 000000000 ____D C:\Program Files\Common Files\AV

2018-02-26 17:53 - 2012-06-27 19:08 - 000000000 ____D C:\Users\Richard\AppData\Local\Nero

2018-02-26 17:45 - 2009-07-13 20:45 - 000028352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2018-02-26 17:45 - 2009-07-13 20:45 - 000028352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2018-02-26 16:52 - 2015-06-29 16:11 - 000102552 _____ (Symantec Corporation) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS

2018-02-26 16:52 - 2015-06-29 16:11 - 000008471 _____ C:\Windows\system32\Drivers\SYMEVENT64x86.CAT

2018-02-22 19:57 - 2009-07-13 19:20 - 000000000 ____D C:\Windows\rescache

2018-02-14 03:53 - 2009-07-13 21:13 - 000782470 _____ C:\Windows\system32\PerfStringBackup.INI

2018-02-14 03:53 - 2009-07-13 19:20 - 000000000 ____D C:\Windows\inf

2018-02-14 03:49 - 2009-07-13 20:45 - 000416176 _____ C:\Windows\system32\FNTCACHE.DAT

2018-02-14 03:46 - 2014-12-13 03:26 - 000000000 ____D C:\Windows\system32\appraiser

2018-02-14 03:30 - 2013-08-14 02:01 - 000000000 ____D C:\Windows\system32\MRT

2018-02-14 03:22 - 2017-10-13 02:08 - 130067560 ____C (Microsoft Corporation) C:\Windows\system32\MRT-KB890830.exe

2018-02-14 03:22 - 2012-06-21 16:58 - 130067560 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe

2018-02-14 03:04 - 2011-02-10 08:10 - 000774592 _____ C:\Windows\SysWOW64\PerfStringBackup.INI

2018-02-07 08:34 - 2012-06-18 22:22 - 000803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2018-02-07 08:34 - 2012-06-18 22:22 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2018-02-07 08:34 - 2012-06-18 22:22 - 000004312 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2018-02-07 08:34 - 2012-06-18 22:22 - 000000000 ____D C:\Windows\SysWOW64\Macromed

2018-02-07 08:34 - 2012-06-18 22:22 - 000000000 ____D C:\Windows\system32\Macromed

2018-02-07 08:33 - 2015-06-29 16:18 - 000000000 ____D C:\Program Files\Google

2018-02-05 18:57 - 2013-07-17 12:21 - 000000000 ____D C:\Program Files (x86)\Google

 

==================== Bamital & volsnap ======================

 

(There is no automatic fix for files that do not pass verification.)

 

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\dnsapi.dll => File is digitally signed

C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

 

LastRegBack: 2018-02-27 08:14

 

==================== End of FRST.txt ============================

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24.02.2018

Ran by Richard (27-02-2018 16:55:57)

Running from C:\Users\Richard\Desktop

Windows 7 Home Premium Service Pack 1 (X64) (2012-06-21 20:33:34)

Boot Mode: Normal

==========================================================

 

 

==================== Accounts: =============================

 

Administrator (S-1-5-21-4042283449-2508691380-3062179275-500 - Administrator - Disabled)

Guest (S-1-5-21-4042283449-2508691380-3062179275-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-4042283449-2508691380-3062179275-1002 - Limited - Enabled)

Richard (S-1-5-21-4042283449-2508691380-3062179275-1000 - Administrator - Enabled) => C:\Users\Richard

 

==================== Security Center ========================

 

(If an entry is included in the fixlist, it will be removed.)

 

AV: Norton AntiVirus Online (Enabled - Up to date) {E3FDBD9F-8140-1400-F32B-8B58923F7C4D}

AS: Norton AntiVirus Online (Enabled - Up to date) {589C5C7B-A77A-1B8E-C99B-B02AE9B836F0}

AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FW: Norton AntiVirus Online (Disabled) {DBC63CBA-CB2F-1558-D874-226D6CEC3B36}

 

==================== Installed Programs ======================

 

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 

64 Bit HP CIO Components Installer (HKLM\...\{FF21C3E6-97FD-474F-9518-8DCBE94C2854}) (Version: 7.2.8 - Hewlett-Packard) Hidden

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.6.0.19120 - Adobe Systems Incorporated)

Adobe Community Help (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.2.1.650 - Adobe Systems Incorporated)

Adobe Flash Player 28 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 28.0.0.161 - Adobe Systems Incorporated)

Adobe Photoshop Elements 9 (HKLM-x32\...\Adobe Photoshop Elements 9) (Version: 9.0 - Adobe Systems Incorporated)

Adobe Premiere Elements 9 (HKLM-x32\...\PremElem90) (Version: 9.0 - Adobe Systems Incorporated)

Adobe Reader X (10.1.16) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.16 - Adobe Systems Incorporated)

ANT Drivers Installer x64 (HKLM\...\{7664AF65-7B0D-4171-9F0F-50455278B428}) (Version: 2.3.4 - Garmin Ltd or its subsidiaries) Hidden

Apple Application Support (32-bit) (HKLM-x32\...\{BC7C46A4-D7A7-48EC-A98C-32A7762B5EFA}) (Version: 6.2.1 - Apple Inc.)

Apple Application Support (64-bit) (HKLM\...\{F0C4B709-8BF4-4A72-B527-12E7BF5482F8}) (Version: 6.2.1 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{BD6778C5-6FA5-492A-ADD6-E706339C2A7B}) (Version: 11.0.2.4 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{C1BBFD2A-BCDD-45B3-8C0B-66BD434970A8}) (Version: 2.4.8.1 - Apple Inc.)

Blio (HKLM-x32\...\{400182B4-CA55-46A9-9D88-F8413DCFB36D}) (Version: 2.3.7140 - K-NFB Reading Technology, Inc.)

Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)

BufferChm (HKLM-x32\...\{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}) (Version: 130.0.331.000 - Hewlett-Packard) Hidden

C309a (HKLM-x32\...\{888F0154-4AAA-4719-BFAE-01C3066B8408}) (Version: 130.0.425.000 - Hewlett-Packard) Hidden

CCleaner (HKLM\...\CCleaner) (Version: 5.30 - Piriform)

CenturyLink Installer (HKLM-x32\...\{C96FF998-45BD-411E-9253-B7F2660FE280}) (Version: 1.0 - CenturyLink, Inc.)

Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)

Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)

Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)

Consumer In-Home Service Agreement (HKLM-x32\...\{F47C37A4-7189-430A-B81D-739FF8A7A554}) (Version: 2.0.0 - Dell Inc.)

Cozi (HKLM-x32\...\{EA1F3D6C-A6F5-4CDC-B0D3-9C56C06B4D29}) (Version: 1.0.6505.38692 - Cozi Group, Inc.)

D3DX10 (HKLM-x32\...\{E09C4DB7-630C-4F06-A631-8EA7239923AF}) (Version: 15.4.2368.0902 - Microsoft) Hidden

Dell DataSafe Local Backup - Support Software (HKLM-x32\...\{A9668246-FB70-4103-A1E3-66C9BC2EFB49}) (Version: 9.4.67 - Dell Inc.)

Dell DataSafe Local Backup (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 9.4.67 - Dell Inc.)

Dell DataSafe Online (HKLM-x32\...\{7EC66A95-AC2D-4127-940B-0445A526AB2F}) (Version: 2.1.19634 - Dell)

Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)

Dell Getting Started Guide (HKLM-x32\...\{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}) (Version: 1.00.0000 - Dell Inc.)

Dell MusicStage (HKLM-x32\...\{3BD7DD08-991B-4A2F-A165-614ED14EAADD}) (Version: 1.6.225.0 - Fingertapps)

Dell PhotoStage (HKLM-x32\...\{E4335E82-17B3-460F-9E70-39D9BC269DB3}) (Version: 1.5.0.130 - ArcSoft)

Dell Stage (HKLM-x32\...\{0F99CA59-7CB4-4167-A43A-4B1D5E584281}) (Version: 1.6.301.0 - Fingertapps)

Dell Stage Remote (HKLM-x32\...\{AF4D3C63-009B-4A17-B02E-D395065DD3F0}) (Version: 2.0.0.43 - ArcSoft)

Dell Support Center (HKLM\...\PC-Doctor for Windows) (Version: 3.2.6032.125 - PC-Doctor, Inc.)

Dell VideoStage  (HKLM-x32\...\{DCE0E79A-B9AC-41AC-98C1-7EF0538BCA7F}) (Version: 1.3.0.2214 - CyberLink Corp.) Hidden

Dell VideoStage  (HKLM-x32\...\InstallShield_{DCE0E79A-B9AC-41AC-98C1-7EF0538BCA7F}) (Version: 1.3.0.2214 - CyberLink Corp.)

Dell Wireless Driver Installation (HKLM-x32\...\{451517F1-7E41-400B-AA36-FB7E2563526D}) (Version: 9.0 - Dell)

Destinations (HKLM-x32\...\{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}) (Version: 130.0.0.0 - Hewlett-Packard) Hidden

DeviceDiscovery (HKLM-x32\...\{21A2F5EE-1DC5-488A-BE7E-E526F8C61488}) (Version: 130.0.372.000 - Hewlett-Packard) Hidden

DocProc (HKLM-x32\...\{9B362566-EC1B-4700-BB9C-EC661BDE2175}) (Version: 13.0.0.0 - Hewlett-Packard) Hidden

Elements 9 Organizer (HKLM-x32\...\{433EACD8-4747-4A6A-826A-FFA9F39B0D40}) (Version: 9.0 - Adobe Systems Incorporated) Hidden

Elements STI Installer (HKLM-x32\...\{25175695-4B20-4298-9F34-C2C57CD277B3}) (Version: 1.0 - Adobe Systems Incorporated) Hidden

Elements STI Installer (HKLM-x32\...\{E2AE009D-37E5-4724-A6B8-0ED6A6BA4F68}) (Version: 1.0 - Adobe Systems Incorporated) Hidden

Elevated Installer (HKLM-x32\...\{1052502B-4C91-43F9-B160-AE39ED57C9F0}) (Version: 5.3.1.0 - Garmin Ltd or its subsidiaries) Hidden

Fax (HKLM-x32\...\{BBF08789-06CB-4D2F-9330-CD617AFDE528}) (Version: 130.0.372.000 - Hewlett-Packard) Hidden

Garmin Express (HKLM-x32\...\{BCC7CA85-E57F-452D-BB44-15A1CE018BD0}) (Version: 5.3.1.0 - Garmin Ltd or its subsidiaries) Hidden

Garmin Express (HKLM-x32\...\{bd8bd200-9a60-4969-b267-6b565f36e3da}) (Version: 5.3.1.0 - Garmin Ltd or its subsidiaries)

Garmin Express Tray (HKLM-x32\...\{DA9C865D-6762-4931-8588-0B13B7A0796B}) (Version: 5.3.1.0 - Garmin Ltd or its subsidiaries) Hidden

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 64.0.3282.186 - Google Inc.)

Google Earth Pro (HKLM\...\{D9EF644E-2FAE-493B-8180-5617CC774C4F}) (Version: 7.3.1.4507 - Google)

Google Toolbar for Internet Explorer (HKLM-x32\...\{18455581-E099-4BA8-BC6B-F34B2F06600C}) (Version: 1.0.0 - Google Inc.) Hidden

Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.8231.2252 - Google Inc.)

Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.7 - Google Inc.) Hidden

Google Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.25.11 - Google Inc.) Hidden

GPBaseService2 (HKLM-x32\...\{63FF21C9-A810-464F-B60A-3111747B1A6D}) (Version: 130.0.371.000 - Hewlett-Packard) Hidden

HP Customer Participation Program 13.0 (HKLM\...\HPExtendedCapabilities) (Version: 13.0 - HP)

HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP)

HP Officejet Pro 8600 Basic Device Software (HKLM\...\{791A06E2-340F-43B0-8FAB-62D151339362}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)

HP Officejet Pro 8600 Help (HKLM-x32\...\{46235FF7-2CBE-4A84-BEDA-87348D1F7850}) (Version: 28.0.0 - Hewlett Packard)

HP Officejet Pro 8600 Product Improvement Study (HKLM\...\{2BF5E9CC-C55D-4B0F-ACAF-FFE77F333CD8}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)

HP Photosmart C309a All-In-One Driver Software 13.0 Rel .5 (HKLM\...\{A9B54408-EF50-4821-B8A2-F597A657112A}) (Version: 13.0 - HP)

HP Photosmart Essential 3.5 (HKLM\...\HP Photosmart Essential) (Version: 3.5 - HP)

HP Smart Web Printing 4.5 (HKLM\...\HP Smart Web Printing) (Version: 4.5 - HP)

HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)

HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)

HPDiagnosticCoreDll (HKLM-x32\...\{9262B08F-E183-4FED-A2BD-23FF1A84EB79}) (Version: 1.0.15.0 - Hewlett Packard)

HPPhotoGadget (HKLM-x32\...\{CAE4213F-F797-439D-BD9E-79B71D115BE3}) (Version: 130.0.282.000 - Hewlett-Packard) Hidden

HPPhotoSmartDiscLabel_PaperLabel (HKLM-x32\...\{D9D8F2CF-FE2D-4644-9762-01F916FE90A9}) (Version: 2.04.0000 - Hewlett-Packard) Hidden

HPPhotoSmartDiscLabel_PrintOnDisc (HKLM-x32\...\{20EFC9AA-BBC1-4DFD-81FF-99654F71CBF8}) (Version: 2.04.0000 - Hewlett-Packard) Hidden

HPPhotoSmartDiscLabelContent1 (HKLM-x32\...\{681B698F-C997-42C3-B184-B489C6CA24C9}) (Version: 2.04.0000 - Hewlett-Packard) Hidden

hpphotosmartdisclabelplugin (HKLM-x32\...\{B28635AB-1DF3-4F07-BFEA-975D911B549B}) (Version: 2.04.0000 - Hewlett-Packard) Hidden

HPPhotosmartEssential (HKLM-x32\...\{D79113E7-274C-470B-BD46-01B10219DF6A}) (Version: 2.04.0000 - Hewlett-Packard) Hidden

HPProductAssistant (HKLM-x32\...\{C43326F5-F135-4551-8270-7F7ABA0462E1}) (Version: 130.0.371.000 - Hewlett-Packard) Hidden

HPSSupply (HKLM-x32\...\{6B2FFB21-AC88-45C3-9A7D-4BB3E744EC91}) (Version: 130.0.371.000 - Hewlett-Packard) Hidden

I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)

Intel® Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)

Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.0.1351 - Intel Corporation)

Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2598 - Intel Corporation)

Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.0.0.1032 - Intel Corporation)

Intel® USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.3.214 - Intel Corporation)

Intel® Trusted Connect Service Client (HKLM\...\{6199B534-A1B6-46ED-873B-97B0ECF8F81E}) (Version: 1.23.216.0 - Intel Corporation)

iTunes (HKLM\...\{D7D4465C-B3B6-4BC1-B336-2803FB57BFAF}) (Version: 12.7.2.60 - Apple Inc.)

Junk Mail filter update (HKLM-x32\...\{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}) (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

MarketResearch (HKLM-x32\...\{175F0111-2968-4935-8F70-33108C6A4DE3}) (Version: 130.0.374.000 - Hewlett-Packard) Hidden

Mesh Runtime (HKLM-x32\...\{8C6D6116-B724-4810-8F2D-D047E6B7D68E}) (Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.7 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.7.02053 - Microsoft Corporation)

Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{820B6609-4C97-3A2B-B644-573B06A0F0CC}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

Network64 (HKLM\...\{05EFBF37-0E52-4579-875C-7EEF0DFB4FCB}) (Version: 130.0.572.000 - Hewlett-Packard) Hidden

Network64 (HKLM\...\{6BFAB6C1-6D46-46DB-A538-A269907C9F2F}) (Version: 140.0.221.000 - Hewlett-Packard) Hidden

Norton AntiVirus Online (HKLM-x32\...\NGC) (Version: 22.12.0.104 - Symantec Corporation)

OCR Software by I.R.I.S. 13.0 (HKLM\...\HPOCR) (Version: 13.0 - HP)

PlayReady PC Runtime x86 (HKLM-x32\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)

PS_AIO_05_C309_Software_Min (HKLM-x32\...\{A088AF9D-0B94-4C33-B327-E5B494CE810B}) (Version: 130.0.425.000 - Hewlett-Packard) Hidden

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6554 - Realtek Semiconductor Corp.)

Scan (HKLM-x32\...\{0F367CA3-3B2F-43F9-A44A-25A8EE69E45D}) (Version: 13.0.0.0 - Hewlett-Packard) Hidden

Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)

Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)

Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 13.0 - HP)

Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)

SmartSound Quicktracks for Premiere Elements 9.0 (HKLM-x32\...\{6748E773-5DA0-4D19-8AA5-273B4133A09B}) (Version: 3.12.3090 - SmartSound Software Inc) Hidden

SmartSound Quicktracks for Premiere Elements 9.0 (HKLM-x32\...\InstallShield_{6748E773-5DA0-4D19-8AA5-273B4133A09B}) (Version: 3.12.3090 - SmartSound Software Inc)

SmartWebPrinting (HKLM-x32\...\{68A10D12-0D0F-4212-BDE6-D87FAD32A8FA}) (Version: 130.0.373.000 - Hewlett-Packard) Hidden

SolutionCenter (HKLM-x32\...\{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}) (Version: 130.0.373.000 - Hewlett-Packard) Hidden

Status (HKLM-x32\...\{AE8705FB-E13C-40A9-8A2D-68D6733FBFC2}) (Version: 130.0.373.000 - Hewlett-Packard) Hidden

SyncUP (HKLM-x32\...\{40F06490-8C14-43AA-99D3-EEEFDBAC3CFC}) (Version: 1.12.12400.17.102 - Nero AG) Hidden

SyncUP (HKLM-x32\...\{D92C9CCE-E5F0-4125-977A-0590F3225B74}) (Version: 10.2.16100 - Nero AG)

Toolbox (HKLM-x32\...\{6BBA26E9-AB03-4FE7-831A-3535584CA002}) (Version: 130.0.648.000 - Hewlett-Packard) Hidden

TrayApp (HKLM-x32\...\{DC0A5F99-FD66-433F-9D3A-05DCBA64BE42}) (Version: 130.0.376.000 - Hewlett-Packard) Hidden

UnloadSupport (HKLM-x32\...\{4E7C28C7-D5DA-4E9F-A1CA-60490B54AE35}) (Version: 11.0.0 - Hewlett-Packard) Hidden

WebReg (HKLM-x32\...\{43CDF946-F5D9-4292-B006-BA0D92013021}) (Version: 130.0.132.017 - Hewlett-Packard) Hidden

Windows Driver Package - Dynastream Innovations, Inc. ANT LibUSB Drivers (04/11/2012 1.2.40.201) (HKLM\...\F9D2A789F9CFF8CEC36B544F53877C80F1F73C46) (Version: 04/11/2012 1.2.40.201 - Dynastream Innovations, Inc.)

Windows Driver Package - Silicon Labs Software (DSI_SiUSBXp_3_1) USB  (02/06/2007 3.1) (HKLM\...\D1506E0025B5A3F9EB8270FE81C1EEDD9388B8A2) (Version: 02/06/2007 3.1 - Silicon Labs Software)

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)

Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)

Yahoo! Toolbar (HKLM-x32\...\Yahoo! Companion) (Version:  - )

Zinio Reader 4 (HKLM-x32\...\{7FB00B6B-6843-97EC-EED6-78BD6D35370A}) (Version: 4.2.4164 - Zinio LLC) Hidden

Zinio Reader 4 (HKLM-x32\...\ZinioReader4) (Version: 4.2.4164 - Zinio LLC)

 

==================== Custom CLSID (Whitelisted): ==========================

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

ShellIconOverlayIdentifiers: [  OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton AntiVirus\Engine\22.12.0.104\buShell.dll [2018-01-24] (Symantec Corporation)

ShellIconOverlayIdentifiers: [  OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton AntiVirus\Engine\22.12.0.104\buShell.dll [2018-01-24] (Symantec Corporation)

ShellIconOverlayIdentifiers: [  OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton AntiVirus\Engine\22.12.0.104\buShell.dll [2018-01-24] (Symantec Corporation)

ShellIconOverlayIdentifiers-x32: [  OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton AntiVirus\Engine\22.12.0.104\buShell.dll [2018-01-24] (Symantec Corporation)

ShellIconOverlayIdentifiers-x32: [  OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton AntiVirus\Engine\22.12.0.104\buShell.dll [2018-01-24] (Symantec Corporation)

ShellIconOverlayIdentifiers-x32: [  OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton AntiVirus\Engine\22.12.0.104\buShell.dll [2018-01-24] (Symantec Corporation)

ContextMenuHandlers1: [BUContextMenu] -> {F7CAA2A1-67A2-44BB-B20F-202FD8EB1DAB} => C:\Program Files (x86)\Norton AntiVirus\Engine\22.12.0.104\buShell.dll [2018-01-24] (Symantec Corporation)

ContextMenuHandlers1: [Symantec.Norton.Antivirus.IEContextMenu] -> {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} => C:\Program Files (x86)\Norton AntiVirus\Engine\22.12.0.104\NavShExt.dll [2018-01-24] (Symantec Corporation)

ContextMenuHandlers2: [Symantec.Norton.Antivirus.IEContextMenu] -> {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} => C:\Program Files (x86)\Norton AntiVirus\Engine\22.12.0.104\NavShExt.dll [2018-01-24] (Symantec Corporation)

ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => C:\Windows\system32\igfxpph.dll [2012-03-19] (Intel Corporation)

ContextMenuHandlers6: [BUContextMenu] -> {F7CAA2A1-67A2-44BB-B20F-202FD8EB1DAB} => C:\Program Files (x86)\Norton AntiVirus\Engine\22.12.0.104\buShell.dll [2018-01-24] (Symantec Corporation)

ContextMenuHandlers6: [Symantec.Norton.Antivirus.IEContextMenu] -> {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} => C:\Program Files (x86)\Norton AntiVirus\Engine\22.12.0.104\NavShExt.dll [2018-01-24] (Symantec Corporation)

 

==================== Scheduled Tasks (Whitelisted) =============

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

Task: {1ECCBA62-00AE-4DD2-8A1B-6EF85B0FB6C8} - System32\Tasks\Norton AntiVirus\Norton AntiVirus Online Error Processor => C:\Program Files (x86)\Norton AntiVirus\Engine\22.12.0.104\SymErr.exe [2018-01-24] (Symantec Corporation)

Task: {2793FB39-C12D-400A-A028-9A4F04BE9991} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2017-05-19] (Piriform Ltd)

Task: {30EE3B00-2F40-4321-8E23-A25F93799D54} - System32\Tasks\GarminUpdaterTask => C:\Program Files (x86)\Garmin\Express SelfUpdater\ExpressSelfUpdater.exe [2017-03-28] ()

Task: {3EA04655-B9D3-478E-882B-86CC66D54473} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)

Task: {4F3E65DB-F943-4D42-A85B-FA0927422DF4} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2018-02-07] (Adobe Systems Incorporated)

Task: {525B3E4A-139B-4B0B-88FE-E8652767802A} - System32\Tasks\Remediation\AntimalwareMigrationTask => C:\Program Files\Common Files\AV\Norton AntiVirus Online\Upgrade.exe [2018-01-24] (Symantec Corporation)

Task: {61CF72F5-0B35-4A30-815E-51E193666FC6} - System32\Tasks\Norton AntiVirus\Norton AntiVirus Online Error Analyzer => C:\Program Files (x86)\Norton AntiVirus\Engine\22.12.0.104\SymErr.exe [2018-01-24] (Symantec Corporation)

Task: {65EAF379-95DE-4416-93E8-78412CAF21D0} - System32\Tasks\ScanToPCActivationApp.exe_{7B8A68D3-8C2A-4025-823E-E033BC1FED86} => C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe [2012-10-17] (Hewlett-Packard Co.)

Task: {680A2686-BE79-4A2F-B387-2452710D3135} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)

Task: {91F06147-1755-4377-A7D5-FE487C71CB57} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-12-13] (Adobe Systems Incorporated)

Task: {9A77A52F-2C55-4726-9946-E7A98C42F207} - System32\Tasks\HP Officejet Pro 8600.exe_{109A0352-11E4-4CC2-8329-B944602A5136} => C:\Program Files\HP\HP Officejet Pro 8600\Bin\HP Officejet Pro 8600.exe [2012-10-17] (Hewlett-Packard Co.)

Task: {C6364BBF-911C-4984-BA11-AAE951886273} - System32\Tasks\HPCustParticipation HP Officejet Pro 8600 => C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)

Task: {EF9A9E41-581F-4B7A-8508-3BB9CF7DE458} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton AntiVirus\Engine\22.12.0.104\WSCStub.exe [2018-02-12] (Symantec Corporation)

 

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

 

 

==================== Shortcuts & WMI ========================

 

(The entries could be listed to be restored or removed.)

 

 

ShortcutWithArgument: C:\Users\Richard\Desktop\centurylink.net.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.centurylink.net

 

==================== Loaded Modules (Whitelisted) ==============

 

2017-12-08 01:48 - 2017-12-08 01:48 - 001356088 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll

2017-12-08 01:48 - 2017-12-08 01:48 - 000088888 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll

2011-06-27 16:26 - 2011-06-27 16:26 - 002022976 _____ () C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe

2012-06-18 22:39 - 2012-01-26 18:49 - 002751808 ____N () C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE

2012-06-18 23:47 - 2011-12-15 14:34 - 000094208 _____ () C:\Windows\System32\IccLibDll_x64.dll

2017-12-11 11:05 - 2017-12-11 11:05 - 001356088 _____ () C:\Program Files\iTunes\libxml2.dll

2017-12-11 11:05 - 2017-12-11 11:05 - 000088888 _____ () C:\Program Files\iTunes\zlib1.dll

2011-06-29 05:52 - 2011-06-29 05:52 - 000474176 _____ () C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe

2012-08-21 13:20 - 2012-08-21 13:20 - 000067496 _____ () C:\Program Files (x86)\Nero\SyncUP\NeroLauncher.exe

2011-11-03 13:16 - 2011-11-03 13:16 - 000957440 _____ () C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe

2018-02-27 15:53 - 2018-02-21 19:57 - 004433752 _____ () C:\Program Files (x86)\Google\Chrome\Application\64.0.3282.186\libglesv2.dll

2018-02-27 15:53 - 2018-02-21 19:57 - 000099672 _____ () C:\Program Files (x86)\Google\Chrome\Application\64.0.3282.186\libegl.dll

2010-03-16 17:28 - 2010-03-16 17:28 - 001926144 _____ () C:\Program Files (x86)\Dell\Stage Remote\QtCore4.dll

2010-03-22 12:52 - 2010-03-22 12:52 - 006776832 _____ () C:\Program Files (x86)\Dell\Stage Remote\QtGui4.dll

2010-03-16 17:28 - 2010-03-16 17:28 - 000635904 _____ () C:\Program Files (x86)\Dell\Stage Remote\QtNetwork4.dll

2010-03-16 17:28 - 2010-03-16 17:28 - 000326144 _____ () C:\Program Files (x86)\Dell\Stage Remote\QtXml4.dll

2011-06-24 20:20 - 2011-06-24 20:20 - 000565968 _____ () C:\Program Files (x86)\Dell\Stage Remote\sqlite3.dll

2011-06-27 16:25 - 2011-06-27 16:25 - 000058944 _____ () C:\Program Files (x86)\Dell\Stage Remote\DataService.dll

2011-06-24 20:21 - 2011-06-24 20:21 - 000322624 _____ () C:\Program Files (x86)\Dell\Stage Remote\en-US\UI\ManagerUI.dll

2010-03-11 16:52 - 2010-03-11 16:52 - 000028160 _____ () C:\Program Files (x86)\Dell\Stage Remote\plugins\imageformats\qgif4.dll

2010-03-05 12:07 - 2010-03-05 12:07 - 000031744 _____ () C:\Program Files (x86)\Dell\Stage Remote\plugins\imageformats\qico4.dll

2010-03-05 12:07 - 2010-03-05 12:07 - 000125952 _____ () C:\Program Files (x86)\Dell\Stage Remote\plugins\imageformats\qjpeg4.dll

2010-03-11 16:52 - 2010-03-11 16:52 - 000225280 _____ () C:\Program Files (x86)\Dell\Stage Remote\plugins\imageformats\qmng4.dll

2011-11-03 13:11 - 2011-11-03 13:11 - 008151040 _____ () C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\QtGui4.dll

2011-11-03 13:11 - 2011-11-03 13:11 - 002278400 _____ () C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\QtCore4.dll

2018-01-10 03:48 - 2018-01-10 03:48 - 000172032 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\6673ce6dac4d89de35948e2f0390d97b\IsdiInterop.ni.dll

2012-06-18 22:37 - 2011-11-29 17:00 - 000059392 _____ () C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IsdiInterop.dll

2012-06-18 22:35 - 2011-12-16 10:39 - 001198872 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\ACE.dll

 

==================== Alternate Data Streams (Whitelisted) =========

 

(If an entry is included in the fixlist, only the ADS will be removed.)

 

 

==================== Safe Mode (Whitelisted) ===================

 

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

 

 

==================== Association (Whitelisted) ===============

 

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

 

 

==================== Internet Explorer trusted/restricted ===============

 

(If an entry is included in the fixlist, it will be removed from the registry.)

 

 

==================== Hosts content: ===============================

 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

 

2009-07-13 18:34 - 2009-06-10 13:00 - 000000824 ____N C:\Windows\system32\Drivers\etc\hosts

 

 

==================== Other Areas ============================

 

(Currently there is no automatic fix for this section.)

 

HKU\S-1-5-21-4042283449-2508691380-3062179275-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Richard\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

DNS Servers: 192.168.0.1 - 205.171.3.26

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall is enabled.

 

==================== MSCONFIG/TASK MANAGER disabled items ==

 

 

==================== FirewallRules (Whitelisted) ===============

 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

 

FirewallRules: [{7C3E2DD4-9FC1-4F4A-A8B8-E02FE12E8FA1}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe

FirewallRules: [{33DDFB5F-A0CE-4E48-8054-01C883BB0C1B}] => (Allow) c:\Program Files (x86)\Dell\VideoStage\VideoStage.exe

FirewallRules: [{3EAE3C46-7F17-4153-A5EA-0EEFB829DEE7}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

FirewallRules: [{2B93244C-E4A4-4533-9D06-053E3354EADB}] => (Allow) LPort=2869

FirewallRules: [{B175BFE7-8E73-4427-9226-B3AF79C3547D}] => (Allow) LPort=1900

FirewallRules: [{C921FC3E-F47C-427F-9876-1E66B54DD650}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe

FirewallRules: [{E9357DC9-4E7D-401D-AA7E-A91849395717}] => (Allow) C:\Program Files (x86)\Windows Live\Mesh\MOE.exe

FirewallRules: [{5A6E4798-ACCE-4EE5-986F-95431A1F7567}] => (Allow) C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe

FirewallRules: [{381881AB-6BE0-489F-B4D0-1FE0CC6FF1DA}] => (Allow) C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe

FirewallRules: [{16C93424-88F3-4FA1-9915-C2DD3A7D2C46}] => (Allow) LPort=9700

FirewallRules: [{BC473A11-FB29-4CFB-90ED-8BAE23970F90}] => (Allow) LPort=9701

FirewallRules: [{C821F3DF-FFEF-43FB-BC93-9196A7A2184B}] => (Allow) LPort=9702

FirewallRules: [{C94B8C36-8EFD-4ED0-A018-24CAAAEC0EA2}] => (Allow) LPort=9700

FirewallRules: [TCP Query User{081C565D-2F69-4D52-A6A9-73D50514105A}C:\program files (x86)\dell\stage remote\stageremoteservice.exe] => (Block) C:\program files (x86)\dell\stage remote\stageremoteservice.exe

FirewallRules: [UDP Query User{17E6F9F7-5734-4075-8E9F-B6742E12A02F}C:\program files (x86)\dell\stage remote\stageremoteservice.exe] => (Block) C:\program files (x86)\dell\stage remote\stageremoteservice.exe

FirewallRules: [{5707FD0C-7707-4319-B586-05C93CA3BC9B}] => (Allow) C:\Program Files (x86)\Dell\Stage Remote\InstallerHelp.exe

FirewallRules: [{C217F569-27C2-4B7A-94A2-FB01D677F22B}] => (Allow) C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe

FirewallRules: [{E7FF8CBA-D018-4551-90B3-6C8C1F05BCAB}] => (Allow) C:\Program Files (x86)\Dell\Stage Remote\DMR.exe

FirewallRules: [{2F3CBAF0-685F-432E-91B7-A5302543C9E8}] => (Allow) C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe

FirewallRules: [{F4B5CC48-D3B6-4DA1-A4CB-08FED1ECCCBE}] => (Allow) C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe

FirewallRules: [{8B981471-60FF-4669-9014-8400D6290B26}] => (Allow) C:\Program Files (x86)\Dell\Stage Remote\DMR.exe

FirewallRules: [{64CE15BE-1ED2-4D8B-BA43-4F22E381793A}] => (Allow) C:\Program Files (x86)\Dell\Stage Remote\InstallerHelp.exe

FirewallRules: [{969BD321-5A3E-42B5-8CAA-1B4A974D67DC}] => (Allow) C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe

FirewallRules: [{05A549DF-561A-4D37-8728-7560311F98BE}] => (Allow) C:\Program Files (x86)\Dell\Stage Remote\Controller.exe

FirewallRules: [{43000089-EC03-40F7-9C01-708C47900C10}] => (Allow) C:\Program Files (x86)\Dell\Stage Remote\Controller.exe

FirewallRules: [{7BC2430D-6F9E-4CEC-A58C-5ED17DF18FFC}] => (Allow) C:\Program Files\dell stage\dell stage\accuweather\accuweather.exe

FirewallRules: [{12C44D19-81D8-4E0F-8ED4-0A88E6216EFC}] => (Allow) C:\Program Files\dell stage\musicstage\musicstageengine.exe

FirewallRules: [{A75E9E86-D742-4E57-929F-83B2ACDFDC08}] => (Allow) C:\Program Files\dell stage\dell stage\stage_primary.exe

FirewallRules: [{7DAB67CD-8F2F-453E-B40D-FE38646BC76A}] => (Allow) C:\Program Files (x86)\Common Files\Nero\BDCore\Nero Blu-ray Player\Blu-rayPlayer.exe

FirewallRules: [{0283723B-7C73-4525-B670-494289CBB3D3}] => (Allow) C:\Program Files (x86)\Common Files\Nero\BDCore\Nero Blu-ray Player\Blu-rayPlayer.exe

FirewallRules: [{D9C6096F-BF84-44D1-BE99-0285BC9ABDC2}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe

FirewallRules: [{BFC7EFF1-FF14-4820-A4BD-0CFE4702B02C}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe

FirewallRules: [{9025C44F-9109-404F-BC5E-3EE8A73623A8}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpofxm08.exe

FirewallRules: [{78AE5826-714C-4A66-BAD0-DF8AF78011E0}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hposfx08.exe

FirewallRules: [{56467133-AA8D-4C14-9F0D-7CD5BFD2B531}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hposid01.exe

FirewallRules: [{F90CD270-37EB-42ED-8D4D-133C1B2C1976}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqkygrp.exe

FirewallRules: [{63FE66E0-616A-43DA-BF0A-725C4A313CDC}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpfccopy.exe

FirewallRules: [{522A43C2-0A12-4E64-AE8B-300FC04D0F50}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpzwiz01.exe

FirewallRules: [{9C8909BB-A165-42E8-8517-B04B0268CF7A}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpoews01.exe

FirewallRules: [{3DABE031-8A37-4EA6-B3F9-6ECC68104C4E}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpiscnapp.exe

FirewallRules: [{2CFEC979-9F48-4A61-A419-1EC4E24D5CBB}] => (Allow) C:\Program Files (x86)\common files\hp\digital imaging\bin\hpqphotocrm.exe

FirewallRules: [{2D64CCD0-C756-4515-8AF1-FD42077A8292}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqsudi.exe

FirewallRules: [{FFD59FC4-FC3F-4017-A209-48518082D63A}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqpsapp.exe

FirewallRules: [{FA946F57-FC79-4B6A-A7C1-B29DA7AC9243}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpofxs08.exe

FirewallRules: [{25F68B23-5E57-45CB-AEFB-A645C671D129}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqfxt08.exe

FirewallRules: [{44ABF404-8F22-44C3-8CAC-C68F76A3981B}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqpse.exe

FirewallRules: [{C5A69A37-E927-4EB7-BFBB-734A7FA69B38}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgplgtupl.exe

FirewallRules: [{032E9EA9-438C-4FCF-8FB1-4AD2834D5941}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe

FirewallRules: [{C15A0557-8667-4DCF-B1A0-72E3DE123C80}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqusgm.exe

FirewallRules: [{33F832A8-9632-4C2B-B070-47578100215D}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqusgh.exe

FirewallRules: [{4E52F664-CBEA-445F-BE78-5AD83D5DE24B}] => (Allow) C:\Program Files (x86)\HP\hp software update\hpwucli.exe

FirewallRules: [{F0547B71-336D-4984-AA05-5971F6BE0FB4}] => (Allow) C:\Program Files (x86)\HP\digital imaging\smart web printing\smartwebprintexe.exe

FirewallRules: [{3E56B09D-BC4B-4A0D-BF64-A22D3B244F34}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\bin\FaxApplications.exe

FirewallRules: [{350D00A4-69A5-4F48-B75D-F0C64B19E401}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\bin\DigitalWizards.exe

FirewallRules: [{CDEEB8CA-3BD6-4B01-AA74-6D2467286E1B}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\bin\SendAFax.exe

FirewallRules: [{C505A804-6A25-4A26-9BDA-ECE78D4DEE04}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\Bin\DeviceSetup.exe

FirewallRules: [{E9E8E14F-71D7-4234-81FB-76411ADAA22E}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicator.exe

FirewallRules: [{B3F86881-F2E6-4D0B-ABF9-001D448A11F0}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicatorCom.exe

FirewallRules: [{08E28297-1014-4654-B27D-6FA06E8494CD}] => (Allow) C:\Users\Richard\AppData\Local\Temp\7zS1BAB\HPDiagnosticCoreUI.exe

FirewallRules: [{57BB03E8-7299-4F82-AAF3-64A92038DFFB}] => (Allow) C:\Users\Richard\AppData\Local\Temp\7zS1BAB\HPDiagnosticCoreUI.exe

FirewallRules: [{3B4F97A9-8EDE-44D3-BA71-DC8ECE281D6F}] => (Allow) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe

FirewallRules: [{F3988387-400F-4A51-9D05-310C4DB9CC14}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{3A48A8B2-D2E6-454D-8381-6A82BB298D23}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{75AEB5DB-6C1B-4750-8615-55410E5E89E9}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{803B7CA0-6D43-4C7A-8C8D-CE3AFDB8CB03}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{63CB210C-C3F0-4603-AC2E-C83413A9AD0B}] => (Allow) C:\Program Files\iTunes\iTunes.exe

FirewallRules: [{72A8ADFD-641C-4B78-A4A7-E4083B250EAB}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

 

==================== Restore Points =========================

 

16-01-2018 17:21:54 Installed iTunes

19-01-2018 03:00:49 Windows Update

05-02-2018 18:40:43 Scheduled Checkpoint

14-02-2018 03:01:04 Scheduled Checkpoint

14-02-2018 03:01:18 Windows Update

22-02-2018 19:56:08 Scheduled Checkpoint

 

==================== Faulty Device Manager Devices =============

 

Name: Dell Wireless 1506 802.11b/g/n (2.4GHz)

Description: Dell Wireless 1506 802.11b/g/n (2.4GHz)

Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}

Manufacturer: Atheros Communications Inc.

Service: athr

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

 

Name: Officejet Pro 8600

Description: Officejet Pro 8600

Class Guid: 

Manufacturer: 

Service: 

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

 

Name: Officejet Pro 8600

Description: Officejet Pro 8600

Class Guid: 

Manufacturer: 

Service: 

Problem: : The drivers for this device are not installed. (Code 28)

Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

 

Name: Officejet Pro 8600

Description: Officejet Pro 8600

Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}

Manufacturer: HP

Service: 

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

 

 

==================== Event log errors: =========================

 

Application errors:

==================

Error: (02/27/2018 04:51:17 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: CompatTelRunner.exe, version: 10.0.17060.1019, time stamp: 0x0206ae46

Faulting module name: ntdll.dll, version: 6.1.7601.24024, time stamp: 0x5a58e571

Exception code: 0xc0000374

Fault offset: 0x00000000000bf6b2

Faulting process id: 0xc50

Faulting application start time: 0x01d3b02ddf0e8ca0

Faulting application path: C:\Windows\system32\CompatTelRunner.exe

Faulting module path: C:\Windows\SYSTEM32\ntdll.dll

Report Id: 7b58c47b-1c21-11e8-ba51-d4bed9e3619c

 

Error: (02/27/2018 04:45:45 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

 

Error: (02/27/2018 03:55:35 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )

Description: A problem prevented Customer Experience Improvement Program data from being sent to Microsoft, (Error 80004005).

 

Error: (02/27/2018 08:25:03 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: esu.exe, version: 1.0.0.0, time stamp: 0x58dac8d5

Faulting module name: KERNELBASE.dll, version: 6.1.7601.24024, time stamp: 0x5a58e25a

Exception code: 0xe0434352

Fault offset: 0x0000c54f

Faulting process id: 0x16c8

Faulting application start time: 0x01d3afe78059de09

Faulting application path: C:\Program Files (x86)\Garmin\Express SelfUpdater\esu.exe

Faulting module path: C:\Windows\syswow64\KERNELBASE.dll

Report Id: c3070d3d-1bda-11e8-bdc2-d4bed9e3619c

 

Error: (02/27/2018 08:25:02 AM) (Source: .NET Runtime) (EventID: 1026) (User: )

Description: Application: esu.exe

Framework Version: v4.0.30319

Description: The process was terminated due to an unhandled exception.

Exception Info: System.IO.FileNotFoundException

   at Garmin.Omt.Service.Shared.Overrides+<UpdateDatacenterOverridesAsync>d__61.MoveNext()

   at System.Runtime.CompilerServices.AsyncTaskMethodBuilder.Start[[Garmin.Omt.Service.Shared.Overrides+<UpdateDatacenterOverridesAsync>d__61, ExpressSelfUpdater, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]](<UpdateDatacenterOverridesAsync>d__61 ByRef)

   at Garmin.Omt.Service.Shared.Overrides.UpdateDatacenterOverridesAsync(Boolean)

   at Garmin.Omt.Service.Shared.Overrides..cctor()

 

Exception Info: System.TypeInitializationException

   at Garmin.Omt.Service.Shared.Overrides.get_OmtBaseUrl()

   at Garmin.Omt.Express.SelfUpdater.Program.RealMain()

   at Garmin.Omt.Express.SelfUpdater.Program.Main(System.String[])

 

Error: (02/26/2018 05:37:47 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

 

Error: (02/26/2018 04:50:52 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: esu.exe, version: 1.0.0.0, time stamp: 0x58dac8d5

Faulting module name: KERNELBASE.dll, version: 6.1.7601.24024, time stamp: 0x5a58e25a

Exception code: 0xe0434352

Fault offset: 0x0000c54f

Faulting process id: 0xb34

Faulting application start time: 0x01d3af64e8bd035a

Faulting application path: C:\Program Files (x86)\Garmin\Express SelfUpdater\esu.exe

Faulting module path: C:\Windows\syswow64\KERNELBASE.dll

Report Id: 41fc6e5f-1b58-11e8-abc5-d4bed9e3619c

 

Error: (02/26/2018 04:50:50 PM) (Source: .NET Runtime) (EventID: 1026) (User: )

Description: Application: esu.exe

Framework Version: v4.0.30319

Description: The process was terminated due to an unhandled exception.

Exception Info: System.IO.FileNotFoundException

   at Garmin.Omt.Service.Shared.Overrides+<UpdateDatacenterOverridesAsync>d__61.MoveNext()

   at System.Runtime.CompilerServices.AsyncTaskMethodBuilder.Start[[Garmin.Omt.Service.Shared.Overrides+<UpdateDatacenterOverridesAsync>d__61, ExpressSelfUpdater, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null]](<UpdateDatacenterOverridesAsync>d__61 ByRef)

   at Garmin.Omt.Service.Shared.Overrides.UpdateDatacenterOverridesAsync(Boolean)

   at Garmin.Omt.Service.Shared.Overrides..cctor()

 

Exception Info: System.TypeInitializationException

   at Garmin.Omt.Service.Shared.Overrides.get_OmtBaseUrl()

   at Garmin.Omt.Express.SelfUpdater.Program.RealMain()

   at Garmin.Omt.Express.SelfUpdater.Program.Main(System.String[])

 

 

System errors:

=============

Error: (02/26/2018 05:36:47 PM) (Source: EventLog) (EventID: 6008) (User: )

Description: The previous system shutdown at 4:58:28 PM on ‎2/‎26/‎2018 was unexpected.

 

Error: (02/20/2018 09:21:37 AM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the NAV service.

 

Error: (02/09/2018 02:18:05 PM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.

 

Error: (02/08/2018 06:52:38 PM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the lmhosts service.

 

Error: (02/06/2018 07:54:09 AM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the lmhosts service.

 

Error: (01/26/2018 03:46:31 PM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the lmhosts service.

 

Error: (01/23/2018 03:50:55 PM) (Source: Service Control Manager) (EventID: 7011) (User: )

Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.

 

Error: (01/16/2018 05:25:56 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)

Description: The following fatal alert was generated: 70. The internal error state is 105.

 

 

==================== Memory info =========================== 

 

Processor: Intel® Pentium® CPU G630 @ 2.70GHz

Percentage of memory in use: 53%

Total physical RAM: 3974.17 MB

Available physical RAM: 1850.26 MB

Total Virtual: 7946.5 MB

Available Virtual: 5337.34 MB

 

==================== Drives ================================

 

Drive c: (OS) (Fixed) (Total:447.47 GB) (Free:362.24 GB) NTFS

 

\\?\Volume{e34e4644-b9e6-11e1-90ac-806e6f6e6963}\ (RECOVERY) (Fixed) (Total:18.25 GB) (Free:8.01 GB) NTFS

 

==================== MBR & Partition Table ==================

 

========================================================

Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 465.8 GB) (Disk ID: 6BE3FAC0)

Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)

Partition 2: (Active) - (Size=18.2 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=447.5 GB) - (Type=07 NTFS)

 

==================== End of Addition.txt ============================

 

[Advertisements]

I noticed the pop ups were in chrome. There were entries in the notifications settings to allow several pornads. I selected to block them. I'm not sure how they got listed in a trusted site area

[ttbcs]

I noticed the pop ups were in chrome. There were entries in the notifications settings to allow several pornads. I selected to block them. I'm not sure how they got listed in a trusted site area

[ttbcs]

Just looking for someone to review to see if I have a malware problem. It’s been a month since asking for assistance.

[pystryker]

Hello and welcome to Geeks to Go! My nickname is Pystryker , and I will be helping you with your issue today.


Before we get started, I have a few things I need to go over with you

Very Important!

• Please do not install any new software during the cleaning process other than the tools I provide for you.  This can hinder the cleaning process.
• Please read through my instructions carefully and completely before executing them.
• Please make sure that all the programs I ask you to download are downloaded to and run from your Desktop.
• Please do not run any tools other than the ones I ask you to, when I ask you to.  Some of these tools can be very dangerous if used improperly.  Also, if you use a tool that I have not requested you use, it can cause false positives, thereby delaying the complete cleaning of your machine.
• Please remember, the fixes are for your machine and your machine ONLY!

This is a complicated process.  It requires several steps, patience, and careful following of my instructions in the order they are given to diagnose your problems to get your machine back in working order.

Please make sure you reply within 3 days to my responses, if there is no reply within 3 days, the topic will be closed and you will need to request the topic be reopened.

Special Note:  We at GTG are against piracy in any form.  This includes, but is not limited to music, movies, software, and any intellectual properties.  If you have any pirated material on your machine, you will be asked to remove it as it is a violation of the rules you agreed to when you created your account here.  
Failure to do so will result in the termination of any and all assistance.


Now, let's get started, shall we?

Hello


I saw your log and picked it up.  Replying to your own post is what removed it from the "Unreplied Topics" que and that's why no one saw it.  My apologies for the delay.

I've looked over your logs and see no sign of malware, however, let's run some tools, then get some fresh data to look at, just to be sure.


Step 1:  AdwCleaner

Download ADWcleaner by clicking here.  Please save it to your Desktop

• Double click (Vista and 7 Users)right click the adwcleaner.exe file and click Run as Adminstrator and accept the UAC prompt to run AdwCleaner
• Once AdwCleaner's control panel is open and it says "Waiting for Action", click on Options at the top of the control panel.
• Please Uncheck  the following options:
  • Reset Proxy Settings
  • Reset Winsock Settings
• Please Check the following options:
  • Reset TCP/IP Settings
  • Reset Firewall Settings
  • Reset IPSec Settings
  • Reset BITS Queue
  • Reset Internet Explorer Policies
  • Reset Chrome Policies
• Close any open windows or browsers.
• Pause your Anti-Virus program if it is running.
• Once it starts, click on the Scan button.  
• Let the scan complete itself.  This may take a few minutes.
• Once the scan has finished,  it will say  "Pending, uncheck elements you don't want to remove.", don't worry about unchecking anything and then click the Cleaning button.  When finished, it will ask to reboot.  Please reboot.
• When the machine has rebooted, a log will be produced.  Please copy/paste that in your next reply.  Here's how:
  • Click the Logfile button and the log will open.  Copy and Paste the contents of the log file into your next reply.
  This report is also saved at C:\[R0].txt

Step 2:  Farbar's Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• Place a check in the box marked Addition.txt
• Press Scan button.
• It will produce a log called FRST.txt in the same directory the tool is run from.
• Please copy and paste log back here.
• The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

Things I need to see in your next post

AdwCleaner Log

FRST.txt Log

Addition.txt Log

[ttbcs]

Thank you for your help. It'll take me a few more days to have time to get to this. I ask that you be patient with me - this is important to me but I am swamped with work right now.

[pystryker]

Thank you for your help. It'll take me a few more days to have time to get to this. I ask that you be patient with me - this is important to me but I am swamped with work right now.

Hello

No worries, we do this on the schedule that works best for you.

[pystryker]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.