Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Another PC I would like to check and fix for any security, malware, or

Started by ronniem1 , Dec 05 2015 10:22 AM
CleanPC FRST adwcleaner performance JRT

  • This topic is locked This topic is locked

#1
ronniem1
Posted 05 December 2015 - 10:22 AM

ronniem1

    Member

  • Member
  • PipPip
  • 15 posts

Hello again, 

 

      Thanks so much for all the help with the awesome tools and reviewing them for my first computer.  I do have a second computer that I would like to also check to any issues and also improve overall performance. 

 

If I can get directions as where you  would like for me to start and with which tool as I don't want to run anything out of order etc...  

 

Nothing appears to be wrong,  but since my first PC had some infections and it's networked I'd like to check this PC and my others as well.

 

 

Thanks,

Ronnie

 

12-5-2015 10-20-33 AM.png

 

Attached File  FRST.txt   87.28KB   345 downloads

 

Attached File  Addition.txt   46.76KB   419 downloads

 

 

Below is the FRST Scan logs.

 

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:05-12-2015
Ran by ronni (administrator) on DELL-PRECISION7 (05-12-2015 10:27:45)
Running from C:\Users\ronni\Desktop
Loaded Profiles: ronni (Available Profiles: ronni)
Platform: Windows 10 Pro Version 1511 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
() C:\Windows\System32\nvwmi64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome Remote Desktop\47.0.2526.18\remoting_host.exe
(Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
(Dell Inc.) C:\Program Files\Dell\Command Monitor\dataeng\bin\dsm_sa_eventmgr64.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe
(Dell Inc.) C:\Program Files\Dell\Command Monitor\dataeng\bin\dsm_sa_datamgr64.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS64.exe
(Symantec Corporation) C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\22.5.2.15\NIS.exe
(Dell Inc.) C:\Program Files\Dell\PPO\poaService.exe
(Dell Inc.) C:\Program Files\Dell\PPO\poaSmSrv.exe
(Dell Inc.) C:\Program Files\Dell\PPO\poaTaServ.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Microsoft Online Services\MSOIDSVC.EXE
(Symantec Corporation) C:\Program Files\Symantec.cloud\PlatformAgent\ccSvcHst.exe
() C:\Program Files\Synergy\synergyd.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe
(Symantec Corporation) C:\Program Files\Symantec.cloud\AntiVirus\AVAgent.exe
(Symantec Corporation) C:\Program Files\Symantec.cloud\PlatformAgent32\ccSvcHst.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome Remote Desktop\47.0.2526.18\remoting_host.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Microsoft Online Services\MSOIDSVCM.EXE
(Symantec Corporation) C:\Program Files\Symantec.cloud\AntiVirus\ssDVAgent.exe
() C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe
() C:\Windows\System32\nvwmi64.exe
(Symantec Corporation) C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\22.5.2.15\NIS.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(Symantec Corporation) C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\22.5.2.15\NIS.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe
(Microsoft Corporation) C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
() C:\Program Files\Synergy\synergyc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Symantec Corporation) C:\Program Files\Symantec.cloud\PlatformAgent\PAUI.exe
(Dell Inc.) C:\Program Files\Dell\PPO\DellPoaEvents.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Flux Software LLC) C:\Users\ronni\AppData\Local\FluxSoftware\Flux\flux.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe
(AgileBits) C:\Program Files (x86)\1Password 4\Agile1pAgent.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\acrotray.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Apple Inc.) C:\Program Files (x86)\AirPort\APAgent.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicator.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
() C:\Program Files\WindowsApps\Microsoft.Messaging_1.11.19004.0_x86__8wekyb3d8bbwe\SkypeHost.exe
() C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\CCXProcess.exe
(Joyent, Inc) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\libs\node.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\CCLibrary.exe
(Joyent, Inc) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\libs\node.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsStore_2015.23.23.0_x64__8wekyb3d8bbwe\WinStore.Mobile.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
(Acronis International GmbH) C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
() C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Infrastructure\mms_mini.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_15.1201.10020.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
() C:\Program Files\WindowsApps\Microsoft.People_10.0.3350.0_x64__8wekyb3d8bbwe\PeopleApp.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office16\MSOSYNC.EXE

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8513784 2015-10-31] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1411320 2015-10-31] (Realtek Semiconductor)
HKLM\...\Run: [SymantecPaui] => C:\Program Files\Symantec.cloud\PlatformAgent\PAUI.exe [3398512 2015-09-17] (Symantec Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508104 2015-10-30] (Adobe Systems Incorporated)
HKLM\...\Run: [DellPoaEvents] => C:\Program Files\Dell\PPO\DellPoaEvents.exe [6040264 2015-09-15] (Dell Inc.)
HKLM\...\Run: [VX3000] => C:\WINDOWS\vVX3000.exe
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-10-16] (Apple Inc.)
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [531808 2015-11-26] (Acronis)
HKLM-x32\...\Run: [Agile1pAgent] => C:\Program Files (x86)\1Password 4\Agile1pAgent.exe [4860688 2015-10-26] (AgileBits)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [36713096 2015-11-04] (Dropbox, Inc.)
HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2304688 2015-11-25] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Acrotray.exe [1856184 2015-09-30] (Adobe Systems Inc.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [LifeCam] => C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe [119152 2010-05-20] (Microsoft Corporation)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [AirPort Base Station Agent] => C:\Program Files (x86)\AirPort\APAgent.exe [771360 2009-11-11] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKLM-x32\...\Run: [WDAppManager] => C:\Program Files (x86)\Western Digital\WD App Manager\AppManagerLauncher.exe [14688 2015-05-29] (Western Digital Technologies, Inc.)
HKLM-x32\...\Run: [WD Quick View] => C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe [5564784 2015-09-11] (Western Digital Technologies, Inc.)
HKLM-x32\...\Run: [vmware-tray.exe] => C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe [104128 2015-10-18] (VMware, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596528 2015-11-09] (Oracle Corporation)
HKLM-x32\...\Run: [AcronisTibMounterMonitor] => C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [651560 2015-11-10] (Acronis International GmbH)
HKLM-x32\...\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [7211112 2015-11-26] ()
HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [50137728 2015-11-17] (Skype Technologies S.A.)
HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\Run: [f.lux] => C:\Users\ronni\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2013-10-23] (Flux Software LLC)
HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\Run: [AirServer64] => C:\Program Files\App Dynamic\AirServer\AirServer.exe [4593472 2015-10-27] (App Dynamic ehf)
HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\Run: [Droplr] => C:\Program Files\Droplr\Droplr.exe [445952 2015-10-12] (Droplr)
HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\Run: [HP Officejet Pro 8600 (NET)] => C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\Run: [Adobe Acrobat Synchronizer] => C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe [876216 2015-09-30] (Adobe Systems Incorporated)
HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\Run: [Zoom] => 0
HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\Run: [GoogleChromeAutoLaunch_223ED3D3CBA109DB2E19244C4385A7C9] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [741704 2015-11-24] (Google Inc.)
ShellIconOverlayIdentifiers: [  OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine64\22.5.2.15\buShell.dll [2015-07-13] (Symantec Corporation)
ShellIconOverlayIdentifiers: [  OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine64\22.5.2.15\buShell.dll [2015-07-13] (Symantec Corporation)
ShellIconOverlayIdentifiers: [  OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine64\22.5.2.15\buShell.dll [2015-07-13] (Symantec Corporation)
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2015-11-14] ()
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2015-11-14] ()
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2015-11-14] ()
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [AcronisSyncError] -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2015-11-11] (Acronis)
ShellIconOverlayIdentifiers: [AcronisSyncInProgress] -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2015-11-11] (Acronis)
ShellIconOverlayIdentifiers: [AcronisSyncOk] -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2015-11-11] (Acronis)
ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-11-04] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.28.dll [2015-11-04] (Dropbox, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Snagit 9.lnk [2015-10-23]
ShortcutTarget: Snagit 9.lnk -> C:\Program Files (x86)\TechSmith\Snagit 9\Snagit32.exe (TechSmith Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\YubiKey PIV Manager PIN-check.lnk [2015-11-23]
ShortcutTarget: YubiKey PIV Manager PIN-check.lnk -> C:\Program Files (x86)\Yubico\YubiKey PIV Manager\pivman.exe ()
Startup: C:\Users\ronni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive for Business.lnk [2015-11-25]
ShortcutTarget: OneDrive for Business.lnk -> C:\Program Files\Microsoft Office\Office16\GROOVE.EXE (Microsoft Corporation)
Startup: C:\Users\ronni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Password Safe.lnk [2015-11-25]
ShortcutTarget: Password Safe.lnk -> C:\Program Files (x86)\Password Safe\pwsafe.exe (SourceForge.net)
Startup: C:\Users\ronni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Slack.lnk [2015-11-30]
ShortcutTarget: Slack.lnk -> C:\Users\ronni\AppData\Local\slack\Update.exe (GitHub)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{8bbba290-653b-448d-86ef-2a3299113da0}: [NameServer] 192.168.1.1
Tcpip\..\Interfaces\{cf58447f-c5d7-42fe-a3c2-4ffbe886c7b3}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKU\S-1-5-21-2076635440-3871483252-621631334-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.gogle.com/
SearchScopes: HKU\S-1-5-21-2076635440-3871483252-621631334-1001 -> {F0580FD6-8DB3-449E-A106-65197763BAE7} URL = hxxps://search.yahoo.com/search?p={searchTerms}&fr=yset_ie_syc_oracle&type=orcl_default
BHO: SnagIt Toolbar Loader -> {00C6482D-C502-44C8-8409-FCE54AD9C208} -> C:\Program Files (x86)\TechSmith\Snagit 9\DLLx64\SnagitBHO64.dll [2009-10-15] (TechSmith Corporation)
BHO: 1Password -> {037C06D5-3893-49E8-9AC0-41F7524AFBF5} -> C:\Program Files (x86)\1Password 4\x64\Agile1pIE4.dll [2015-10-26] (AgileBits)
BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine64\22.5.2.15\coIEPlg.dll [2015-07-09] (Symantec Corporation)
BHO: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office16\GROOVEEX.DLL [2015-10-28] (Microsoft Corporation)
BHO: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
BHO-x32: SnagIt Toolbar Loader -> {00C6482D-C502-44C8-8409-FCE54AD9C208} -> C:\Program Files (x86)\TechSmith\Snagit 9\SnagitBHO.dll [2009-10-15] (TechSmith Corporation)
BHO-x32: 1Password -> {037C06D5-3893-49E8-9AC0-41F7524AFBF5} -> C:\Program Files (x86)\1Password 4\x86\Agile1pIE4.dll [2015-10-26] (AgileBits)
BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\22.5.2.15\coIEPlg.dll [2015-07-09] (Symantec Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\ssv.dll [2015-11-22] (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office16\GROOVEEX.DLL [2015-10-28] (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\jp2ssv.dll [2015-11-22] (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF from Selection -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine64\22.5.2.15\coIEPlg.dll [2015-07-09] (Symantec Corporation)
Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\x64\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\22.5.2.15\coIEPlg.dll [2015-07-09] (Symantec Corporation)
Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\DC\AcroIEFavStub.dll [2015-09-30] (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Snagit - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files (x86)\TechSmith\Snagit 9\SnagitIEAddin.dll [2009-10-15] (TechSmith Corporation)
Handler: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files\Microsoft Office\Office16\MSOSB.DLL [2015-10-27] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2015-10-27] (Microsoft Corporation)
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\Office16\MSOSB.DLL [2015-10-27] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2015-10-27] (Microsoft Corporation)

Edge:
======
Edge HomeButtonPage: HKU\S-1-5-21-2076635440-3871483252-621631334-1001 -> hxxp://www.google.com/

FireFox:
========
FF ProfilePath: C:\Users\ronni\AppData\Roaming\Mozilla\Firefox\Profiles\hx2n3gcw.default
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2015-11-25] (Adobe Systems)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-10-08] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\dtplugin\npDeployJava1.dll [2015-11-22] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\plugin2\npjp2.dll [2015-11-22] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-07-22] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-07-22] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-04] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-04] (Google Inc.)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Air\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2015-11-25] (Adobe Systems)
FF Plugin HKU\S-1-5-21-2076635440-3871483252-621631334-1001: @zoom.us/ZoomVideoPlugin -> C:\Users\ronni\AppData\Roaming\Zoom\bin\npzoomplugin.dll [2015-09-22] (Zoom Video Communications, Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_22.5.2.15\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_22.5.2.15\coFFPlgn [2015-12-01] [not signed]
FF HKLM-x32\...\Firefox\Extensions: [[email protected]] - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat DC - Create PDF - C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Browser\WCFirefoxExtn [2015-10-23] [not signed]

Chrome:
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxps://www.google.com/"
CHR DefaultSearchURL: Default -> hxxps://search.yahoo.com/search?p={searchTerms}&fr=yset_chr_syc_oracle&type=orcl_default
CHR DefaultSearchKeyword: Default -> Yahoo
CHR DefaultSuggestURL: Default -> hxxps://search.yahoo.com/sugg/ie?output=fxjson&command={searchTerms}&nResults=10
CHR Plugin: (Widevine Content Decryption Module) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.8.824\_platform_specific\win_x86\widevinecdmadapter.dll (Google Inc.)
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\47.0.2526.73\PepperFlash\pepflashplayer.dll ()
CHR Profile: C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (TechSmith Snagit (Extension)) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\annopcfmbiofommjmcmcfmhklhgbhkce [2015-12-04]
CHR Extension: (Google Docs) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-10-22]
CHR Extension: (1Password: Password Manager and Secure Wallet) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\aomjjhallfgjeglblehebfpbcfeobpgk [2015-10-22]
CHR Extension: (Google Drive) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-22]
CHR Extension: (YouTube) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-22]
CHR Extension: (No Name) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2015-12-04]
CHR Extension: (TrafficLight) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfnpidifppmenkapgihekkeednfoenal [2015-11-06]
CHR Extension: (Google Search) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27]
CHR Extension: (User-Agent Switcher for Chrome) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\djflhoibgkdhkhhcedjiklpkjnoahfmg [2015-10-22]
CHR Extension: (Dropbox for Gmail) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\dpdmhfocilnekecfjgimjdeckachfbec [2015-12-04]
CHR Extension: (Adobe Acrobat) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2015-11-20]
CHR Extension: (Gmail Offline) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejidjjhkpiempkbhmpbfngldlkglhimk [2015-10-22]
CHR Extension: (User-Agent Switcher) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\ffhkkpnppgnfaobgihpdblnhmmbodake [2015-10-22]
CHR Extension: (Google Analytics Opt-out Add-on (by Google)) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\fllaojicojecljbmefodhfapmkghcbnh [2015-10-22]
CHR Extension: (Chrome Remote Desktop) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbchcmhmhahfdphkhkmpfmihenigjmpp [2015-11-04]
CHR Extension: (Google Docs Offline) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-11-20]
CHR Extension: (Bitly
 Unleash the power of the link) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\iabeihobmhlgpkcgjiloemdbofjbdcic [2015-10-22]
CHR Extension: (Dropbox) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\ioekoebejdcmnlefjiknokhhafglcjdl [2015-10-22]
CHR Extension: (WhatFont) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\jabopobgcpjmedljpbcaablpmlmfcogm [2015-10-22]
CHR Extension: (Slack) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\jeogkiiogjbmhklcnbgkdcjoioegiknm [2015-10-22]
CHR Extension: (Google Mail Checker) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\mihcahmgecmbnbcchbopgniflfhgnkff [2015-10-22]
CHR Extension: (Ghostery) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlomiejdfkolichcflejclcbmpeaniij [2015-10-22]
CHR Extension: (Asana) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafkcmbfnknnkmbdbdhflbidiigecfln [2015-10-22]
CHR Extension: (Chrome Web Store Payments) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-10-22]
CHR Extension: (Trello) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\oflhioojkbelepjlnafgmgkkjhojphcg [2015-10-22]
CHR Extension: (Gmail) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-10-22]
CHR Profile: C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Profile 1
CHR Extension: (Google Slides) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-10-26]
CHR Extension: (Google Docs) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2015-10-26]
CHR Extension: (Google Drive) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-26]
CHR Extension: (YouTube) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-26]
CHR Extension: (Norton Security Toolbar) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\cjabmdjcfcfdmffimndhafhblfmpjdpe [2015-10-26]
CHR Extension: (Google Search) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-30]
CHR Extension: (Google Sheets) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-10-26]
CHR Extension: (Google Docs Offline) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-11-30]
CHR Extension: (Chrome Web Store Payments) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-10-26]
CHR Extension: (Gmail) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-10-26]
CHR HKLM\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\22.5.2.15\Exts\Chrome.crx [2015-10-22]
CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [aaffhmecfaelkngcbnfdkcckmillnoki] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\22.5.2.15\Exts\Chrome.crx [2015-10-22]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [683696 2015-11-16] (Adobe Systems Incorporated)
R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2016448 2015-11-25] (Adobe Systems, Incorporated)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-10-07] (Apple Inc.)
R2 chromoting; C:\Program Files (x86)\Google\Chrome Remote Desktop\47.0.2526.18\remoting_host.exe [69448 2015-10-14] (Google Inc.)
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [136048 2015-10-22] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [136048 2015-10-22] (Dropbox, Inc.)
R2 dcevt64; C:\Program Files\Dell\Command Monitor\dataeng\bin\dsm_sa_eventmgr64.exe [205640 2015-06-19] (Dell Inc.)
R2 dcstor64; C:\Program Files\Dell\Command Monitor\dataeng\bin\dsm_sa_datamgr64.exe [287560 2015-06-19] (Dell Inc.)
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [25800 2015-09-28] (Hewlett-Packard Company)
R2 mmsminisrv; C:\Program Files (x86)\Common Files\Acronis\Infrastructure\mms_mini.exe [4884064 2015-08-11] (Acronis)
R2 msoidsvc; C:\Program Files\Common Files\Microsoft Shared\Microsoft Online Services\MSOIDSVC.EXE [2079520 2012-05-17] (Microsoft Corp.)
R2 NIS; C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\22.5.2.15\NIS.exe [282016 2015-07-24] (Symantec Corporation)
R2 NVWMI; C:\WINDOWS\system32\nvwmi64.exe [3163976 2015-06-17] ()
R2 poaService; C:\Program Files\Dell\PPO\poaService.exe [1188696 2015-09-15] (Dell Inc.)
R2 PoaSMSrv; C:\Program Files\Dell\PPO\poaSmSrv.exe [313176 2015-09-15] (Dell Inc.)
R2 poaTaServ; C:\Program Files\Dell\PPO\poaTaServ.exe [1028952 2015-09-15] (Dell Inc.)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [308472 2015-10-31] (Realtek Semiconductor)
R2 SsPaAdm; C:\Program Files\Symantec.cloud\PlatformAgent\ccSvcHst.exe [191856 2015-09-17] (Symantec Corporation)
R2 ssPaSetMgr; C:\Program Files\Symantec.cloud\PlatformAgent32\ccSvcHst.exe [138272 2015-09-17] (Symantec Corporation)
R2 ssSpnAv; C:\Program Files\Symantec.cloud\AntiVirus\AVAgent.exe [448368 2015-08-28] (Symantec Corporation)
R2 Synergy; C:\Program Files\Synergy\synergyd.exe [311488 2015-11-19] ()
S3 ThunderboltService; C:\Program Files (x86)\Intel\Thunderbolt Software\tbtsvc.exe [1723048 2015-06-10] (Intel Corporation)
R2 VMwareHostd; C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe [12465856 2015-10-18] ()
R2 WDBackup; C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe [1042808 2015-09-11] (Western Digital Technologies, Inc.)
R2 WDDriveService; C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe [307064 2015-09-11] (Western Digital Technologies, Inc.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364464 2015-10-30] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-10-30] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 BHDrvx64; C:\Program Files\Symantec.cloud\EndpointProtectionAgent\NortonData\22.5.2.15\Definitions\BASHDefs\20151113.001\BHDrvx64.sys [1665608 2015-10-22] (Symantec Corporation)
R1 ccSet_Cloud; C:\WINDOWS\SysWOW64\Drivers\Symantec.cloud\ccSetx64.sys [167072 2015-09-17] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1605020.00F\ccSetx64.sys [173808 2015-07-10] (Symantec Corporation)
R3 dcdbas; C:\Windows\System32\drivers\dcdbas64.sys [48464 2015-06-19] (Dell Inc.)
S3 DDDriver; C:\Windows\system32\drivers\DDDriver64Dcsa.sys [23760 2015-01-30] (Dell Computer Corporation)
S3 DellProf; C:\Windows\system32\drivers\DellProf.sys [24240 2015-05-22] (Dell Computer Corporation)
R3 e1dexpress; C:\Windows\system32\DRIVERS\e1d65x64.sys [547840 2015-10-22] (Intel Corporation)
R3 e1rexpress; C:\Windows\system32\DRIVERS\e1r65x64.sys [486344 2015-07-06] (Intel Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [498512 2015-11-17] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [157520 2015-11-17] (Symantec Corporation)
R0 file_tracker; C:\Windows\System32\DRIVERS\file_tracker.sys [339808 2015-12-03] (Acronis International GmbH)
R1 IDSVia64; C:\Program Files\Symantec.cloud\EndpointProtectionAgent\NortonData\22.5.2.15\Definitions\IPSDefs\20151204.001\IDSvia64.sys [767224 2015-10-22] (Symantec Corporation)
R3 IntcAzAudAddService; C:\Windows\system32\drivers\RTDVHD64.sys [2558208 2015-10-31] (Realtek Semiconductor Corp.)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [129312 2014-11-10] (Intel Corporation)
R3 NAVENG; C:\Program Files\Symantec.cloud\EndpointProtectionAgent\NortonData\22.5.2.15\Definitions\VirusDefs\20151204.016\ENG64.SYS [138488 2015-11-01] (Symantec Corporation)
R3 NAVEX15; C:\Program Files\Symantec.cloud\EndpointProtectionAgent\NortonData\22.5.2.15\Definitions\VirusDefs\20151204.016\EX64.SYS [2148080 2015-11-01] (Symantec Corporation)
S3 nhi; C:\Windows\System32\drivers\twn81x.sys [62152 2014-09-04] (Intel Corporation)
R3 POADrvr; C:\Windows\system32\drivers\POADrvr.sys [23216 2015-09-15] (Dell Computer Corporation)
R3 SRTSP; C:\Windows\system32\drivers\NISx64\1605020.00F\SRTSP64.SYS [926448 2015-07-10] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1605020.00F\SRTSPX64.SYS [50936 2015-07-10] (Symantec Corporation)
R0 SymEFASI; C:\Windows\System32\drivers\NISx64\1605020.00F\SYMEFASI64.SYS [1620720 2015-07-10] (Symantec Corporation)
S0 SymELAM; C:\Windows\System32\drivers\NISx64\1605020.00F\SymELAM.sys [24192 2015-07-10] (Symantec Corporation)
R3 SymEvent; C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS [111344 2015-10-22] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1605020.00F\Ironx64.SYS [297720 2015-07-10] (Symantec Corporation)
R1 SymNetS; C:\Windows\system32\drivers\NISx64\1605020.00F\SYMNETS.SYS [576248 2015-07-10] (Symantec Corporation)
R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1049432 2015-12-03] (Acronis International GmbH)
R2 tib_mounter; C:\Windows\system32\DRIVERS\tib_mounter.sys [202592 2015-12-03] (Acronis International GmbH)
S3 tnd; C:\Windows\system32\DRIVERS\tnd.sys [581464 2015-12-03] (Acronis International GmbH)
R2 virtual_file; C:\Windows\System32\DRIVERS\virtual_file.sys [301408 2015-12-03] (Acronis International GmbH)
R0 vsock; C:\Windows\System32\drivers\vsock.sys [75512 2015-10-18] (VMware, Inc.)
R2 vstor2-mntapi20-shared; C:\Windows\SysWow64\drivers\vstor2-mntapi20-shared.sys [34520 2015-07-09] (VMware, Inc.)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-12-05 10:27 - 2015-12-05 10:28 - 00040651 _____ C:\Users\ronni\Desktop\FRST.txt
2015-12-05 09:31 - 2015-12-05 10:27 - 00000000 ____D C:\FRST
2015-12-05 09:30 - 2015-12-05 10:24 - 00000000 ____D C:\Users\ronni\Downloads\CleanPC-GoGeeks
2015-12-05 09:30 - 2015-12-05 09:30 - 02369024 _____ (Farbar) C:\Users\ronni\Desktop\FRST64.exe
2015-12-04 14:40 - 2015-12-04 16:27 - 04697808 _____ C:\Users\ronni\Desktop\Ronnies-QuestionTypes-MasterLockdownPerpetual.story
2015-12-04 12:31 - 2015-12-04 12:31 - 00002469 _____ C:\Users\Public\Desktop\Articulate Quizmaker.lnk
2015-12-04 12:31 - 2015-12-04 12:31 - 00002451 _____ C:\Users\Public\Desktop\Articulate Engage.lnk
2015-12-04 12:31 - 2015-12-04 12:31 - 00002445 _____ C:\Users\Public\Desktop\Articulate Presenter.lnk
2015-12-04 12:18 - 2015-12-04 12:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Articulate
2015-12-04 12:18 - 2015-12-04 12:18 - 00002411 _____ C:\Users\Public\Desktop\Articulate Storyline 3.lnk
2015-12-03 16:09 - 2015-12-04 12:28 - 00000000 ____D C:\Program Files (x86)\Articulate
2015-12-03 13:46 - 2015-12-03 13:51 - 00000000 ____D C:\Users\ronni\AppData\Roaming\Acronis
2015-12-03 13:44 - 2015-12-03 13:44 - 00581464 _____ (Acronis International GmbH) C:\WINDOWS\system32\Drivers\tnd.sys
2015-12-03 13:44 - 2015-12-03 13:44 - 00339808 _____ (Acronis International GmbH) C:\WINDOWS\system32\Drivers\file_tracker.sys
2015-12-03 13:44 - 2015-12-03 13:44 - 00301408 _____ (Acronis International GmbH) C:\WINDOWS\system32\Drivers\virtual_file.sys
2015-12-03 13:43 - 2015-12-03 13:43 - 01049432 _____ (Acronis International GmbH) C:\WINDOWS\system32\Drivers\tib.sys
2015-12-03 13:43 - 2015-12-03 13:43 - 00339288 _____ (Acronis International GmbH) C:\WINDOWS\system32\Drivers\snapman.sys
2015-12-03 13:43 - 2015-12-03 13:43 - 00202592 _____ (Acronis International GmbH) C:\WINDOWS\system32\Drivers\tib_mounter.sys
2015-12-03 13:43 - 2015-12-03 13:43 - 00160600 _____ (Acronis International GmbH) C:\WINDOWS\system32\Drivers\fltsrv.sys
2015-12-03 13:42 - 2015-12-03 13:42 - 00001288 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acronis True Image 2016.lnk
2015-12-03 13:42 - 2015-12-03 13:42 - 00001276 _____ C:\Users\Public\Desktop\Acronis True Image 2016.lnk
2015-12-03 13:42 - 2015-12-03 13:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acronis
2015-12-03 13:42 - 2015-12-03 13:42 - 00000000 ____D C:\Program Files (x86)\Acronis
2015-12-03 13:39 - 2015-12-03 14:27 - 00000000 ____D C:\ProgramData\Acronis
2015-12-03 11:10 - 2015-12-03 16:02 - 00000442 _____ C:\Users\ronni\Documents\Storyline.exe.config
2015-12-02 14:07 - 2015-12-02 14:07 - 00062158 _____ C:\Users\ronni\Downloads\dial_hoverState.story
2015-12-02 14:03 - 2015-12-02 14:03 - 01126555 _____ C:\Users\ronni\Downloads\mobile-player-props.story
2015-12-02 09:41 - 2015-12-02 09:32 - 00524591 _____ C:\Users\ronni\Downloads\Addt-QuizzingQuestions-HTML5-Rev1-automationcheck - SL2 Backup.story
2015-12-02 09:32 - 2015-12-02 09:41 - 00533162 _____ C:\Users\ronni\Downloads\Addt-QuizzingQuestions-HTML5-Rev1-automationcheck.story
2015-12-01 13:37 - 2015-12-01 13:37 - 00115116 _____ C:\Users\ronni\Downloads\slideTriggerBug.story
2015-12-01 13:34 - 2015-12-01 13:34 - 10755793 _____ C:\Users\ronni\Downloads\Natif_V5_v2 (1).story
2015-12-01 13:34 - 2015-12-01 13:34 - 10223034 _____ C:\Users\ronni\Downloads\CustomersExperience.story
2015-12-01 13:15 - 2015-12-01 12:30 - 00524591 _____ C:\Users\ronni\Downloads\Addt-QuizzingQuestions-HTML5-Rev1 - SL2 Backup.story
2015-12-01 12:30 - 2015-12-01 13:15 - 00533147 _____ C:\Users\ronni\Downloads\Addt-QuizzingQuestions-HTML5-Rev1.story
2015-12-01 09:05 - 2015-12-01 09:05 - 00000000 ____D C:\ProgramData\XHEO INC
2015-12-01 09:05 - 2015-12-01 09:05 - 00000000 ____D C:\ProgramData\Articulate
2015-11-30 12:53 - 2015-11-30 12:53 - 00001245 _____ C:\Users\ronni\Desktop\Articulate - Shortcut.lnk
2015-11-30 11:57 - 2015-11-30 11:57 - 00000523 _____ C:\Users\ronni\Desktop\Storyline.exe.config
2015-11-30 11:20 - 2015-11-30 11:20 - 00002261 _____ C:\Users\ronni\Desktop\Slack.lnk
2015-11-30 11:20 - 2015-11-30 11:20 - 00000000 ____D C:\Users\ronni\AppData\Local\slack
2015-11-30 11:13 - 2015-11-30 11:13 - 00000000 ____D C:\Users\ronni\AppData\Local\ElevatedDiagnostics
2015-11-30 09:24 - 2015-11-30 09:24 - 25018885 _____ C:\Users\ronni\Downloads\androidaudio-1.story
2015-11-29 21:11 - 2015-11-29 21:11 - 00000000 ____D C:\Users\ronni\AppData\Local\ActiveSync
2015-11-29 21:09 - 2015-11-29 21:09 - 00000020 ___SH C:\Users\ronni\ntuser.ini
2015-11-29 20:45 - 2015-11-29 20:45 - 24603136 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 22572632 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 22394880 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 21125408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 19339776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 18677760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 16984064 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 13376512 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 13017088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 12120064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 11545088 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 09918976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 07476576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2015-11-29 20:45 - 2015-11-29 20:45 - 03670832 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 03592704 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2015-11-29 20:45 - 2015-11-29 20:45 - 02918808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 02756096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2015-11-29 20:45 - 2015-11-29 20:45 - 02756096 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2015-11-29 20:45 - 2015-11-29 20:45 - 02587136 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 02544264 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 02444288 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.appcore.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 02179584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 02064384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 02001408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.appcore.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 01998848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActiveSyncProvider.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 01707008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActiveSyncProvider.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 01393664 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2015-11-29 20:45 - 2015-11-29 20:45 - 01268736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Resources.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 01268736 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 01212416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 01063424 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00969728 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00914944 _____ (Microsoft Corporation) C:\WINDOWS\system32\usermgr.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00911648 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcomp.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00870400 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00809312 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWAHost.exe
2015-11-29 20:45 - 2015-11-29 20:45 - 00803840 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00791552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00704352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWAHost.exe
2015-11-29 20:45 - 2015-11-29 20:45 - 00698208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wimgapi.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00675064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dcomp.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00674816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00647168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00630632 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2015-11-29 20:45 - 2015-11-29 20:45 - 00623616 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneProviders.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00586208 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00586080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wimgapi.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00578912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\afd.sys
2015-11-29 20:45 - 2015-11-29 20:45 - 00543232 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00540752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2015-11-29 20:45 - 2015-11-29 20:45 - 00536768 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00523616 _____ (Microsoft Corporation) C:\WINDOWS\system32\wimserv.exe
2015-11-29 20:45 - 2015-11-29 20:45 - 00517632 _____ (Microsoft Corporation) C:\WINDOWS\system32\winspool.drv
2015-11-29 20:45 - 2015-11-29 20:45 - 00516544 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00511320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mf.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00497664 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmkvsrcsnk.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00490496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00454056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00450560 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Bluetooth.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00414720 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvr.exe
2015-11-29 20:45 - 2015-11-29 20:45 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StoreAgent.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00408128 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00405048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00400896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winspool.drv
2015-11-29 20:45 - 2015-11-29 20:45 - 00382464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmkvsrcsnk.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00369912 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2015-11-29 20:45 - 2015-11-29 20:45 - 00366224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00365568 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00334736 _____ (Microsoft Corporation) C:\WINDOWS\system32\policymanager.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00334336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcastdvr.exe
2015-11-29 20:45 - 2015-11-29 20:45 - 00315904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.Bluetooth.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00303104 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00296488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\policymanager.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00292352 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00286720 _____ (Microsoft Corporation) C:\WINDOWS\system32\deviceaccess.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00286208 _____ (Microsoft Corporation) C:\WINDOWS\system32\provhandlers.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00275456 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00245848 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00231936 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCore.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00227840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\deviceaccess.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00204800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft-Windows-AppModelExecEvents.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe
2015-11-29 20:45 - 2015-11-29 20:45 - 00192000 _____ (Microsoft Corporation) C:\WINDOWS\system32\provisioningcsp.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00165376 _____ (Microsoft Corporation) C:\WINDOWS\system32\provdatastore.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00163328 _____ (Microsoft Corporation) C:\WINDOWS\system32\provops.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00162304 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringservice.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00161792 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCensus.exe
2015-11-29 20:45 - 2015-11-29 20:45 - 00160768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe
2015-11-29 20:45 - 2015-11-29 20:45 - 00122368 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCsp.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00118624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tdx.sys
2015-11-29 20:45 - 2015-11-29 20:45 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontsub.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00116728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfps.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00115200 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2015-11-29 20:45 - 2015-11-29 20:45 - 00110032 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00093696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontsub.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00092352 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00089600 _____ (Microsoft Corporation) C:\WINDOWS\system32\NFCProvisioningPlugin.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00088392 _____ (Microsoft Corporation) C:\WINDOWS\system32\remoteaudioendpoint.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\tzautoupdate.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00086528 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppCapture.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00078336 _____ (Microsoft Corporation) C:\WINDOWS\system32\BarcodeProvisioningPlugin.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00077312 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProvPluginEng.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanprotdim.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00073360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\remoteaudioendpoint.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00070656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppCapture.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00056320 _____ (Microsoft Corporation) C:\WINDOWS\system32\provtool.exe
2015-11-29 20:45 - 2015-11-29 20:45 - 00052736 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringclient.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00052736 _____ (Microsoft Corporation) C:\WINDOWS\system32\RemovableMediaProvisioningPlugin.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00045568 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00043520 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvr.proxy.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00037376 _____ (Microsoft Corporation) C:\WINDOWS\system32\LaunchWinApp.exe
2015-11-29 20:45 - 2015-11-29 20:45 - 00037376 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00035680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wimmount.sys
2015-11-29 20:45 - 2015-11-29 20:45 - 00035656 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfpmp.exe
2015-11-29 20:45 - 2015-11-29 20:45 - 00032040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfpmp.exe
2015-11-29 20:45 - 2015-11-29 20:45 - 00030720 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringconfigsp.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LaunchWinApp.exe
2015-11-29 20:45 - 2015-11-29 20:45 - 00028160 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Management.Provisioning.ProxyStub.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcastdvr.proxy.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00017408 _____ (Microsoft Corporation) C:\WINDOWS\system32\IcsEntitlementHost.exe
2015-11-29 20:45 - 2015-11-29 20:45 - 00014336 _____ (Microsoft Corporation) C:\WINDOWS\system32\dciman32.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00011776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dciman32.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00007680 _____ (Microsoft Corporation) C:\WINDOWS\system32\readingviewresources.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\lpk.dll
2015-11-29 20:45 - 2015-11-29 20:45 - 00003072 _____ (Microsoft Corporation) C:\WINDOWS\system32\lpk.dll
2015-11-29 20:43 - 2015-11-29 20:43 - 00008192 _____ C:\WINDOWS\system32\config\userdiff
2015-11-29 20:41 - 2015-11-29 20:41 - 00000000 ____D C:\Program Files\Reference Assemblies
2015-11-29 20:41 - 2015-11-29 20:41 - 00000000 ____D C:\Program Files\MSBuild
2015-11-29 20:41 - 2015-11-29 20:41 - 00000000 ____D C:\Program Files (x86)\Reference Assemblies
2015-11-29 20:41 - 2015-11-29 20:41 - 00000000 ____D C:\Program Files (x86)\MSBuild
2015-11-29 20:41 - 2015-10-23 19:47 - 00778936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationNative_v0300.dll
2015-11-29 20:41 - 2015-10-23 19:47 - 00103120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-11-29 20:41 - 2015-10-23 19:47 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe
2015-11-29 20:41 - 2015-10-23 19:46 - 01166520 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationNative_v0300.dll
2015-11-29 20:41 - 2015-10-23 19:46 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe
2015-11-29 20:41 - 2015-10-23 19:45 - 00124624 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2015-11-29 19:44 - 2015-11-29 19:44 - 00000000 _SHDL C:\Users\Default\My Documents
2015-11-29 19:44 - 2015-11-29 19:44 - 00000000 _SHDL C:\Users\Default\Documents\My Videos
2015-11-29 19:44 - 2015-11-29 19:44 - 00000000 _SHDL C:\Users\Default\Documents\My Pictures
2015-11-29 19:44 - 2015-11-29 19:44 - 00000000 _SHDL C:\Users\Default\Documents\My Music
2015-11-29 19:44 - 2015-11-29 19:44 - 00000000 _SHDL C:\Users\Default User\Documents\My Videos
2015-11-29 19:44 - 2015-11-29 19:44 - 00000000 _SHDL C:\Users\Default User\Documents\My Pictures
2015-11-29 19:44 - 2015-11-29 19:44 - 00000000 _SHDL C:\Users\Default User\Documents\My Music
2015-11-29 19:39 - 2015-11-29 19:39 - 00022744 _____ C:\WINDOWS\system32\emptyregdb.dat
2015-11-29 19:38 - 2015-12-01 17:43 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-11-29 19:16 - 2015-11-29 19:16 - 00001576 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-11-29 19:16 - 2015-11-29 19:16 - 00000000 ____D C:\Users\Default\AppData\Roaming\HPActiveHealth
2015-11-29 19:16 - 2015-11-29 19:16 - 00000000 ____D C:\Users\Default\AppData\Local\Microsoft Help
2015-11-29 19:16 - 2015-11-29 19:16 - 00000000 ____D C:\Users\Default User\AppData\Roaming\HPActiveHealth
2015-11-29 19:16 - 2015-11-29 19:16 - 00000000 ____D C:\Users\Default User\AppData\Local\Microsoft Help
2015-11-29 19:10 - 2015-11-29 19:18 - 00000000 ____D C:\WINDOWS\system32\config\bbimigrate
2015-11-29 19:07 - 2015-12-01 17:40 - 00000000 ____D C:\Users\ronni
2015-11-29 19:07 - 2015-11-29 19:07 - 00000000 _SHDL C:\Users\ronni\My Documents
2015-11-29 19:07 - 2015-11-29 19:07 - 00000000 _SHDL C:\Users\ronni\Documents\My Videos
2015-11-29 19:07 - 2015-11-29 19:07 - 00000000 _SHDL C:\Users\ronni\Documents\My Pictures
2015-11-29 19:07 - 2015-11-29 19:07 - 00000000 _SHDL C:\Users\ronni\Documents\My Music
2015-11-29 19:03 - 2015-11-29 19:11 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2015-11-29 19:03 - 2015-11-29 19:11 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2015-11-29 19:03 - 2015-11-29 19:10 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2015-11-29 19:03 - 2015-11-29 19:03 - 00561169 _____ C:\WINDOWS\system32\Drivers\rtwavesskdy.dat
2015-11-29 19:03 - 2015-11-29 19:03 - 00113697 _____ C:\WINDOWS\system32\Drivers\rtwavesvolpro.dat
2015-11-29 19:03 - 2015-11-29 19:03 - 00031095 _____ C:\WINDOWS\system32\Drivers\rtwavesEFX.dat
2015-11-29 19:03 - 2015-11-29 19:03 - 00010945 _____ C:\WINDOWS\system32\Drivers\rtwavesMFX.dat
2015-11-29 19:03 - 2015-11-29 19:03 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_WUDFUsbccidDriver_01_11_00.Wdf
2015-11-29 19:03 - 2015-11-29 19:03 - 00000000 ____D C:\Program Files (x86)\Realtek
2015-11-29 19:03 - 2015-07-22 19:10 - 06873928 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcpl.dll
2015-11-29 19:03 - 2015-07-22 19:10 - 03493008 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvsvc64.dll
2015-11-29 19:03 - 2015-07-22 19:10 - 02558608 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvsvcr.dll
2015-11-29 19:03 - 2015-07-22 19:10 - 01059984 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nv3dappshext.dll
2015-11-29 19:03 - 2015-07-22 19:10 - 00937800 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvvsvc.exe
2015-11-29 19:03 - 2015-07-22 19:10 - 00385168 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvmctray.dll
2015-11-29 19:03 - 2015-07-22 19:10 - 00074896 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nv3dappshextr.dll
2015-11-29 19:03 - 2015-07-22 19:10 - 00062608 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvshext.dll
2015-11-29 19:03 - 2015-07-21 22:29 - 05121613 _____ C:\WINDOWS\system32\nvcoproc.bin
2015-11-29 19:02 - 2015-11-29 19:02 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_Kernel_TeeDriverx64_01011.Wdf
2015-11-29 19:02 - 2015-11-29 19:02 - 00000000 ____D C:\WINDOWS\SysWOW64\RTCOM
2015-11-29 19:02 - 2015-11-29 19:02 - 00000000 ____D C:\Program Files\Realtek
2015-11-29 18:56 - 2015-10-30 01:17 - 02718208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2015-11-29 18:53 - 2015-12-01 17:42 - 00384816 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-11-29 18:26 - 2015-11-29 19:44 - 00009528 _____ C:\WINDOWS\diagwrn.xml
2015-11-29 18:26 - 2015-11-29 19:44 - 00009528 _____ C:\WINDOWS\diagerr.xml
2015-11-27 02:16 - 2015-11-27 02:16 - 01567560 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvhdagenco6420103.dll
2015-11-27 02:16 - 2015-11-27 02:16 - 00206152 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvhda64v.sys
2015-11-27 02:16 - 2015-11-27 02:16 - 00040264 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvhdap64.dll
2015-11-26 19:00 - 2015-11-30 10:20 - 00344284 _____ C:\Users\ronni\Desktop\RJM_debt-reduction-calculator-DEC '15.xlsx
2015-11-25 10:44 - 2015-11-25 10:44 - 00000000 ____D C:\Users\ronni\Documents\My Safes
2015-11-25 10:43 - 2015-12-01 17:55 - 00000000 ____D C:\Users\ronni\AppData\Local\PasswordSafe
2015-11-25 10:43 - 2015-11-29 19:18 - 00000000 ____D C:\Users\ronni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Password Safe
2015-11-25 10:43 - 2015-11-25 10:43 - 00001061 _____ C:\Users\ronni\Desktop\Password Safe.lnk
2015-11-25 10:43 - 2015-11-25 10:43 - 00000000 ____D C:\Program Files (x86)\Password Safe
2015-11-25 08:55 - 2015-11-27 00:15 - 00000000 ____D C:\Users\ronni\Desktop\Dropbox (Articulate)
2015-11-25 08:55 - 2015-11-25 08:55 - 00000000 ____D C:\Users\ronni\Desktop\Dropbox (Personal)
2015-11-25 08:42 - 2015-11-25 08:42 - 00000000 ____D C:\Users\ronni\Desktop\SL360 Projects
2015-11-25 08:25 - 2015-11-25 08:25 - 00000000 ____D C:\Users\ronni\Documents\Custom Office Templates
2015-11-25 08:22 - 2015-11-25 08:22 - 00000000 ____D C:\Users\ronni\Documents\Outlook Files
2015-11-25 07:58 - 2015-11-25 13:56 - 00000000 ____D C:\Users\ronni\Documents\OneDrive-Business-Articulate
2015-11-25 07:45 - 2015-11-29 19:18 - 00000000 ____D C:\Users\ronni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft Office 365
2015-11-25 07:13 - 2015-11-25 07:13 - 00000295 _____ C:\Users\ronni\Desktop\Serial Key for Studio.txt
2015-11-25 07:12 - 2015-11-25 07:12 - 00000120 _____ C:\Users\ronni\Desktop\test.url
2015-11-25 07:12 - 2015-11-25 07:12 - 00000120 _____ C:\Users\ronni\Desktop\Ronnie's Notebook.url
2015-11-25 07:11 - 2015-11-25 07:12 - 00000120 _____ C:\Users\ronni\Desktop\Storyline iOS9 Test Notes.url
2015-11-25 07:10 - 2015-11-25 07:10 - 00036593 _____ C:\Users\ronni\Desktop\HTML5 Feature Matrix-RJM-Nov 25 2015.xlsx
2015-11-25 06:53 - 2015-11-25 06:53 - 00000000 ____D C:\WINDOWS\{599D1F2E-B3A3-4AB8-8E1B-FC2AF6F00BB1}
2015-11-24 13:25 - 2015-11-24 13:25 - 00000000 ____D C:\Users\ronni\AppData\Roaming\Blueberry
2015-11-24 13:23 - 2015-11-24 13:23 - 00000000 ____D C:\Users\ronni\AppData\Local\Microsoft_Corporation
2015-11-24 11:55 - 2015-11-24 11:55 - 00231783 _____ C:\Users\ronni\Documents\Your Flight Receipt - RONALD JOSEPH MCGINNIS JR 31JAN16.pdf
2015-11-24 05:25 - 2015-11-24 05:25 - 00000000 ____D C:\Users\ronni\.pivman
2015-11-24 04:29 - 2015-11-24 04:29 - 00055456 _____ C:\Users\ronni\Downloads\Untitled2.story
2015-11-24 04:26 - 2015-11-24 04:26 - 00591717 _____ C:\Users\ronni\Downloads\Stopwatch_David-Charney.story
2015-11-24 04:10 - 2015-11-24 04:10 - 01832655 _____ C:\Users\ronni\Desktop\WSS.story
2015-11-24 04:10 - 2012-06-10 11:42 - 03420160 _____ C:\Users\ronni\Desktop\WSS - SL1 Backup.story
2015-11-24 04:04 - 2015-11-24 04:04 - 00000000 ____D C:\Users\ronni\Downloads\5. Studio13 Installer
2015-11-24 03:55 - 2015-11-24 03:55 - 01894458 _____ C:\Users\ronni\Downloads\WSS-Demo-SL360.story
2015-11-23 14:24 - 2015-11-25 11:32 - 00000613 _____ C:\Users\ronni\configuration_log.csv
2015-11-23 13:38 - 2015-11-23 13:38 - 00057643 _____ C:\Users\ronni\Downloads\Untitled1.story
2015-11-23 13:35 - 2015-11-23 13:35 - 05015714 _____ C:\Users\ronni\Downloads\Statesproject_cecil-rjm-rev3.story
2015-11-23 12:25 - 2015-11-23 14:00 - 00000297 _____ C:\Users\ronni\Documents\configuration_log.csv
2015-11-23 10:48 - 2015-11-29 19:09 - 00000000 ____D C:\Users\ronni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yubico
2015-11-23 10:48 - 2015-11-23 10:48 - 00000000 ____D C:\Program Files\Yubico
2015-11-23 07:40 - 2015-11-23 07:40 - 00002228 _____ C:\Users\ronni\Desktop\YubiKey Personalization Tool.lnk
2015-11-23 07:40 - 2015-11-23 07:40 - 00002077 _____ C:\Users\ronni\Desktop\Yubico Authenticator.lnk
2015-11-23 07:10 - 2015-11-23 07:10 - 00000000 ____D C:\Users\ronni\.neoman
2015-11-23 07:08 - 2015-11-29 19:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Yubico
2015-11-20 16:21 - 2015-11-20 16:21 - 00524591 _____ C:\Users\ronni\Desktop\Addt-QuizzingQuestions-HTML5-Rev1 (1).story
2015-11-20 13:03 - 2015-03-03 11:02 - 31017965 _____ C:\Users\ronni\Downloads\Module-4-Mental-Health-Promotion.story
2015-11-18 10:10 - 2015-11-18 10:10 - 10755793 _____ C:\Users\ronni\Downloads\Natif_V5_v2 - SL2 Backup.story
2015-11-18 10:10 - 2015-11-18 10:10 - 09605330 _____ C:\Users\ronni\Downloads\Natif_V5_v2.story
2015-11-17 12:47 - 2015-11-17 12:49 - 25018885 _____ C:\Users\ronni\Downloads\androidaudio.story
2015-11-16 11:05 - 2015-11-16 11:04 - 12720934 _____ C:\Users\ronni\Downloads\test_long - SL2 Backup.story
2015-11-16 11:04 - 2015-11-16 11:05 - 12722774 _____ C:\Users\ronni\Downloads\test_long.story
2015-11-16 10:53 - 2015-11-16 10:52 - 21940459 _____ C:\Users\ronni\Downloads\test2 - SL2 Backup.story
2015-11-16 10:52 - 2015-11-16 10:53 - 21945266 _____ C:\Users\ronni\Downloads\test2.story
2015-11-12 12:27 - 2015-11-24 05:42 - 00000000 ____D C:\Users\ronni\Downloads\1. Guru projects - sl360
2015-11-12 10:38 - 2015-11-12 10:38 - 00531490 _____ C:\Users\ronni\Desktop\Addt-QuizzingQuestions-HTML5-Rev1.story
2015-11-09 13:02 - 2015-11-29 19:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-11-06 07:14 - 2015-10-18 18:33 - 00066752 _____ (VMware, Inc.) C:\WINDOWS\system32\Drivers\vmx86.sys
2015-11-06 07:14 - 2015-10-18 17:53 - 00075512 _____ (VMware, Inc.) C:\WINDOWS\system32\Drivers\vsock.sys
2015-11-06 07:14 - 2015-10-18 17:53 - 00068288 _____ (VMware, Inc.) C:\WINDOWS\system32\vsocklib.dll
2015-11-06 07:14 - 2015-10-18 17:53 - 00064192 _____ (VMware, Inc.) C:\WINDOWS\SysWOW64\vsocklib.dll
2015-11-06 07:05 - 2015-11-29 19:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VMware
2015-11-06 07:05 - 2015-11-06 07:05 - 00001238 _____ C:\Users\Public\Desktop\VMware Workstation Pro.lnk
2015-11-06 07:05 - 2015-11-06 07:05 - 00000000 ____D C:\Program Files\Common Files\VMware
2015-11-06 07:05 - 2015-10-18 18:33 - 00934080 _____ (VMware, Inc.) C:\WINDOWS\system32\vnetlib64.dll
2015-11-06 07:05 - 2015-10-18 18:33 - 00391872 _____ (VMware, Inc.) C:\WINDOWS\SysWOW64\vmnat.exe
2015-11-06 07:05 - 2015-10-18 18:33 - 00358080 _____ (VMware, Inc.) C:\WINDOWS\SysWOW64\vmnetdhcp.exe
2015-11-06 07:05 - 2015-10-18 18:11 - 00026816 _____ (VMware, Inc.) C:\WINDOWS\system32\Drivers\vmnetuserif.sys
2015-11-06 07:05 - 2015-10-06 08:02 - 00057536 _____ (VMware, Inc.) C:\WINDOWS\system32\Drivers\hcmon.sys
2015-11-05 12:28 - 2015-11-24 12:43 - 00000166 _____ C:\Users\ronni\AppData\Roaming\licecap.ini

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-12-05 10:26 - 2015-10-22 19:16 - 00000000 ____D C:\ProgramData\Symantec.cloud
2015-12-05 10:23 - 2015-10-22 19:13 - 00000938 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-12-05 09:40 - 2015-10-23 16:30 - 00004166 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{5A3F96A8-B4CC-4E65-AEDA-C8E1BC7542DF}
2015-12-05 09:37 - 2015-10-22 19:32 - 00000938 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job
2015-12-05 09:31 - 2015-10-30 00:28 - 00000000 ____D C:\Windows
2015-12-05 09:19 - 2015-10-23 07:22 - 00000000 ____D C:\Users\ronni\AppData\Roaming\Skype
2015-12-05 09:19 - 2015-10-23 06:04 - 00000000 ____D C:\Users\ronni\AppData\Roaming\Slack
2015-12-05 07:08 - 2015-10-22 19:22 - 00000000 ____D C:\WINDOWS\System32\Tasks\Endpoint Protection.cloud
2015-12-05 03:23 - 2015-10-22 19:13 - 00000934 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-12-04 20:37 - 2015-10-22 19:32 - 00000934 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job
2015-12-04 18:59 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-12-04 18:02 - 2015-10-22 19:37 - 00000000 ____D C:\Users\ronni\AppData\Roaming\AgileBits
2015-12-04 14:50 - 2015-08-07 00:06 - 00000000 ___RD C:\Users\ronni\Dropbox (Personal)
2015-12-04 14:50 - 2015-08-07 00:06 - 00000000 ___RD C:\Users\ronni\Dropbox (Articulate)
2015-12-04 13:18 - 2015-10-23 14:37 - 00000000 ____D C:\Users\ronni\AppData\Local\Adobe
2015-12-04 12:55 - 2015-08-07 07:23 - 00000000 ___SD C:\Users\ronni\Documents\My Articulate Projects
2015-12-04 12:44 - 2015-10-26 10:11 - 00000000 ____D C:\Users\ronni\AppData\Local\Articulate
2015-12-04 12:37 - 2015-10-22 19:32 - 00000000 ____D C:\Users\ronni\AppData\Local\Dropbox
2015-12-04 12:27 - 2015-10-23 14:41 - 00000000 ____D C:\ProgramData\Package Cache
2015-12-04 11:28 - 2015-10-22 20:34 - 00000000 ____D C:\Users\ronni\AppData\Local\CrashDumps
2015-12-04 10:59 - 2015-10-26 10:25 - 00000000 ____D C:\Users\ronni\AppData\Roaming\FileZilla
2015-12-04 03:18 - 2015-10-22 19:13 - 00003996 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2015-12-04 03:18 - 2015-10-22 19:13 - 00003764 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2015-12-04 02:15 - 2015-10-22 21:12 - 00000000 ____D C:\WINDOWS\System32\Tasks\Dell
2015-12-03 18:41 - 2015-10-30 01:24 - 00000000 ___HD C:\Program Files\WindowsApps
2015-12-03 14:51 - 2015-10-30 01:11 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-12-03 09:42 - 2015-08-07 07:17 - 00000000 ___RD C:\Users\ronni\Downloads\3. SL360 Installers
2015-12-03 07:51 - 2015-10-24 22:37 - 00000000 ____D C:\Users\ronni\AppData\Roaming\VMware
2015-12-03 07:51 - 2015-10-24 22:37 - 00000000 ____D C:\Users\ronni\AppData\Local\VMware
2015-12-03 06:56 - 2015-10-23 21:36 - 00000000 ____D C:\ProgramData\VMware
2015-12-03 05:52 - 2015-10-26 09:42 - 00000000 ____D C:\Program Files\Droplr
2015-12-02 18:18 - 2015-10-28 17:13 - 00000000 ____D C:\Users\ronni\AppData\Roaming\HpUpdate
2015-12-02 13:20 - 2015-10-23 14:43 - 00000000 ___RD C:\Users\ronni\Creative Cloud Files
2015-12-02 10:53 - 2015-10-30 01:21 - 00000000 ____D C:\WINDOWS\INF
2015-12-02 09:22 - 2015-10-22 19:13 - 00002334 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-12-01 17:57 - 2015-10-23 14:42 - 00000000 ____D C:\ProgramData\boost_interprocess
2015-12-01 17:49 - 2015-10-22 18:02 - 00883432 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-12-01 17:44 - 2015-10-30 19:14 - 00008192 _____ C:\WINDOWS\SysWOW64\WDPABKP.dat
2015-12-01 17:43 - 2015-10-22 17:49 - 00000000 ____D C:\ProgramData\NVIDIA
2015-12-01 17:40 - 2015-10-30 00:28 - 00524288 ___SH C:\WINDOWS\system32\config\BBI
2015-12-01 17:39 - 2015-08-06 19:05 - 00000000 ___RD C:\Users\ronni\OneDrive
2015-12-01 12:19 - 2015-10-23 14:40 - 00000000 ____D C:\Program Files (x86)\Adobe
2015-12-01 09:00 - 2015-10-26 10:14 - 00000000 ____D C:\Users\ronni\AppData\Roaming\Articulate
2015-11-30 11:20 - 2015-10-23 06:04 - 00000000 ____D C:\Users\ronni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Slack Technologies
2015-11-30 11:20 - 2015-10-23 06:04 - 00000000 ____D C:\Users\ronni\AppData\Local\SquirrelTemp
2015-11-30 03:01 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\appcompat
2015-11-29 21:42 - 2015-10-22 18:39 - 00000000 ____D C:\Users\ronni\AppData\Local\Packages
2015-11-29 21:38 - 2015-10-22 18:43 - 00002336 _____ C:\Users\ronni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2015-11-29 21:35 - 2015-10-30 01:24 - 00000000 ___RD C:\WINDOWS\DevicesFlow
2015-11-29 21:27 - 2015-10-22 18:39 - 00000000 ____D C:\Users\ronni\AppData\Roaming\Adobe
2015-11-29 21:26 - 2015-10-23 14:41 - 00001228 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Creative Cloud.lnk
2015-11-29 21:26 - 2015-10-23 14:41 - 00001216 _____ C:\Users\Public\Desktop\Adobe Creative Cloud.lnk
2015-11-29 21:11 - 2015-10-30 01:24 - 00000000 ___RD C:\WINDOWS\PrintDialog
2015-11-29 21:11 - 2015-10-30 01:24 - 00000000 ___RD C:\WINDOWS\MiracastView
2015-11-29 21:10 - 2015-10-30 01:24 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2015-11-29 21:09 - 2015-08-06 19:02 - 00000000 __RHD C:\Users\Public\AccountPictures
2015-11-29 20:51 - 2015-10-30 01:24 - 00028672 _____ C:\WINDOWS\system32\config\BCD-Template
2015-11-29 20:45 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\system32\SystemResetPlatform
2015-11-29 20:45 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\system32\oobe
2015-11-29 20:45 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\system32\appraiser
2015-11-29 20:45 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\Provisioning
2015-11-29 20:45 - 2015-10-30 00:28 - 00000000 ____D C:\WINDOWS\SysWOW64\Dism
2015-11-29 20:45 - 2015-10-30 00:28 - 00000000 ____D C:\WINDOWS\system32\Dism
2015-11-29 19:44 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\rescache
2015-11-29 19:44 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\Registration
2015-11-29 19:41 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\system32\WinBioDatabase
2015-11-29 19:39 - 2015-10-28 18:42 - 00002800 _____ C:\WINDOWS\System32\Tasks\HPCeeScheduleForronni
2015-11-29 19:39 - 2015-10-23 07:18 - 00002268 _____ C:\WINDOWS\System32\Tasks\{C5D332FB-6D92-48CE-BFC9-5867A79EE00F}
2015-11-29 19:39 - 2015-10-22 19:32 - 00003452 _____ C:\WINDOWS\System32\Tasks\DropboxUpdateTaskMachineUA
2015-11-29 19:39 - 2015-10-22 19:19 - 00002656 _____ C:\WINDOWS\System32\Tasks\Norton WSC Integration
2015-11-29 19:38 - 2015-10-31 19:50 - 00002304 _____ C:\WINDOWS\System32\Tasks\RtHDVBg_PushButton
2015-11-29 19:38 - 2015-10-30 01:24 - 00000000 __RHD C:\Users\Public\Libraries
2015-11-29 19:38 - 2015-10-23 14:55 - 00002954 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2015-11-29 19:38 - 2015-10-22 19:32 - 00003228 _____ C:\WINDOWS\System32\Tasks\DropboxUpdateTaskMachineCore
2015-11-29 19:18 - 2015-11-04 09:38 - 00000000 ____D C:\Users\ronni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LICEcap
2015-11-29 19:18 - 2015-11-04 08:27 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Thunderbolt™ Software
2015-11-29 19:18 - 2015-11-01 14:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-11-29 19:18 - 2015-10-31 19:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell Audio
2015-11-29 19:18 - 2015-10-31 17:03 - 00000000 ____D C:\Users\ronni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Paprika Recipe Manager
2015-11-29 19:18 - 2015-10-30 03:07 - 00000000 ____D C:\WINDOWS\ShellNew
2015-11-29 19:18 - 2015-10-30 01:24 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2015-11-29 19:18 - 2015-10-30 00:28 - 00008192 ___SH C:\WINDOWS\system32\config\ELAM
2015-11-29 19:18 - 2015-10-29 21:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2015-11-29 19:18 - 2015-10-29 20:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
2015-11-29 19:18 - 2015-10-28 17:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2015-11-29 19:18 - 2015-10-28 00:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AirServer Universal (x64)
2015-11-29 19:18 - 2015-10-26 12:10 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2015-11-29 19:18 - 2015-10-26 12:01 - 00000000 ____D C:\Users\ronni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Zoom
2015-11-29 19:18 - 2015-10-26 09:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Droplr
2015-11-29 19:18 - 2015-10-26 07:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft LifeCam
2015-11-29 19:18 - 2015-10-25 11:57 - 00000000 ____D C:\Users\ronni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GitHub, Inc
2015-11-29 19:18 - 2015-10-23 22:57 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Snagit 9
2015-11-29 19:18 - 2015-10-23 21:53 - 00000000 ____D C:\Users\ronni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Flux
2015-11-29 19:18 - 2015-10-23 21:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-11-29 19:18 - 2015-10-23 14:55 - 00000000 ____D C:\ProgramData\regid.1986-12.com.adobe
2015-11-29 19:18 - 2015-10-23 07:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Postbox
2015-11-29 19:18 - 2015-10-22 20:13 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2016 Tools
2015-11-29 19:18 - 2015-10-22 19:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\1Password
2015-11-29 19:18 - 2015-10-22 19:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Symantec.cloud
2015-11-29 19:18 - 2015-10-22 19:15 - 00000000 ____D C:\Users\ronni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
2015-11-29 19:18 - 2015-10-22 19:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-11-29 19:18 - 2015-10-22 18:44 - 00000000 ____D C:\Users\ronni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Logitech
2015-11-29 19:16 - 2015-10-22 17:14 - 00000000 ____D C:\Users\Default.migrated
2015-11-29 19:12 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\system32\spool
2015-11-29 19:12 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\system32\NDF
2015-11-29 19:11 - 2015-11-04 08:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2015-11-29 19:11 - 2015-11-02 19:27 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Kits
2015-11-29 19:11 - 2015-11-01 00:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\L8 SmartLight
2015-11-29 19:11 - 2015-10-30 03:03 - 00000000 ____D C:\WINDOWS\OCR
2015-11-29 19:11 - 2015-10-30 01:24 - 00000000 ___RD C:\WINDOWS\PurchaseDialog
2015-11-29 19:11 - 2015-10-30 01:24 - 00000000 ___HD C:\WINDOWS\ELAMBKUP
2015-11-29 19:11 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\PolicyDefinitions
2015-11-29 19:11 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2015-11-29 19:11 - 2015-10-30 01:24 - 00000000 ____D C:\WINDOWS\Help
2015-11-29 19:11 - 2015-10-30 01:24 - 00000000 ____D C:\ProgramData\USOPrivate
2015-11-29 19:11 - 2015-10-24 07:08 - 00000000 ____D C:\WINDOWS\system32\appmgmt
2015-11-29 19:11 - 2015-10-23 21:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Western Digital
2015-11-29 19:11 - 2015-10-23 07:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-11-29 19:11 - 2015-10-22 21:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell
2015-11-29 19:10 - 2015-10-30 01:24 - 00000000 ____D C:\Program Files\Common Files\System
2015-11-29 19:10 - 2015-10-30 01:24 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2015-11-29 19:06 - 2015-10-30 00:28 - 00000000 ____D C:\WINDOWS\system32\Sysprep
2015-11-29 19:03 - 2015-08-07 08:43 - 00000000 ____D C:\Temp
2015-11-29 18:53 - 2015-10-30 03:14 - 00000000 ____D C:\WINDOWS\ServiceProfiles
2015-11-27 22:06 - 2015-10-23 14:54 - 00002469 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat DC.lnk
2015-11-27 01:54 - 2015-10-23 16:43 - 00000000 ____D C:\Program Files\Dell
2015-11-25 08:00 - 2015-09-19 15:25 - 00000000 ____D C:\Users\ronni\Documents\My Skype Files
2015-11-24 20:43 - 2015-10-23 21:58 - 00000000 ____D C:\ProgramData\Hewlett-Packard
2015-11-24 20:43 - 2015-10-23 21:57 - 00000000 ____D C:\WINDOWS\System32\Tasks\Hewlett-Packard
2015-11-24 20:43 - 2015-10-23 13:44 - 00000000 ____D C:\Program Files (x86)\Hewlett-Packard
2015-11-24 20:42 - 2015-10-23 06:39 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2015-11-24 20:20 - 2015-10-22 21:11 - 00000000 ____D C:\Users\ronni\AppData\Local\Dell
2015-11-24 04:04 - 2015-08-06 17:03 - 00000000 ___RD C:\Users\ronni\Downloads\2. SL2 Installer
2015-11-23 10:57 - 2015-10-28 15:13 - 00000000 ____D C:\Program Files (x86)\Yubico
2015-11-23 10:04 - 2015-10-22 19:28 - 00000000 ____D C:\Program Files\Synergy
2015-11-23 07:01 - 2015-10-23 15:01 - 00000000 ____D C:\Program Files\Common Files\Adobe
2015-11-22 15:00 - 2015-10-23 21:50 - 00000000 ____D C:\ProgramData\Oracle
2015-11-22 14:59 - 2015-10-23 21:50 - 00097888 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2015-11-22 14:59 - 2015-10-23 21:50 - 00000000 ____D C:\Program Files (x86)\Java
2015-11-22 14:59 - 2015-08-31 08:26 - 00000000 ____D C:\Users\ronni\.oracle_jre_usage
2015-11-22 10:08 - 2015-11-02 18:31 - 00000000 ____D C:\Program Files (x86)\NovaStor
2015-11-21 17:02 - 2015-10-23 07:22 - 00000000 ____D C:\ProgramData\Skype
2015-11-20 13:46 - 2015-10-22 19:28 - 00002443 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Synergy.lnk
2015-11-20 06:19 - 2015-10-28 18:42 - 00000364 _____ C:\WINDOWS\Tasks\HPCeeScheduleForronni.job
2015-11-19 19:51 - 2015-10-22 20:10 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-11-19 19:43 - 2015-10-22 18:51 - 00000000 ____D C:\WINDOWS\system32\MRT
2015-11-19 19:38 - 2015-10-22 18:51 - 145617392 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-11-12 11:32 - 2015-10-23 07:18 - 00000000 ____D C:\Program Files (x86)\Postbox
2015-11-11 12:12 - 2015-08-06 17:12 - 00000000 ___RD C:\Users\ronni\Downloads\5. Storyline 360 Projects
2015-11-09 13:03 - 2015-10-22 19:32 - 00000000 ____D C:\Program Files (x86)\Dropbox
2015-11-09 08:44 - 2015-10-23 07:18 - 00000000 ____D C:\Users\ronni\AppData\Local\Postbox
2015-11-06 15:12 - 2015-08-10 15:54 - 00000000 ____D C:\Users\ronni\Documents\Virtual Machines
2015-11-06 07:05 - 2015-10-23 21:37 - 00891876 _____ C:\WINDOWS\SysWOW64\PerfStringBackup.INI
2015-11-06 07:05 - 2015-10-23 21:36 - 00000000 ____D C:\Program Files (x86)\VMware
2015-11-05 12:28 - 2015-11-04 11:25 - 00000000 ____D C:\Users\ronni\Downloads\1. DarkSpider Mobile Audio Testing
2015-11-05 06:49 - 2015-10-22 17:13 - 00000000 ___HD C:\$SysReset

==================== Files in the root of some directories =======

2015-11-05 12:28 - 2015-11-24 12:43 - 0000166 _____ () C:\Users\ronni\AppData\Roaming\licecap.ini
2015-10-31 17:06 - 2015-10-31 17:06 - 0000038 ___SH () C:\Users\ronni\AppData\Local\5678c43253f8bbb5ed82a9.59421958
2015-11-02 18:31 - 2015-11-02 18:49 - 0000106 __RSH () C:\ProgramData\1.17.1.lic
2015-10-28 17:13 - 2015-10-28 17:13 - 0000057 _____ () C:\ProgramData\Ament.ini
2015-11-02 18:30 - 2015-11-03 06:54 - 0004736 ____H () C:\ProgramData\nsActivation.act

Some files in TEMP:
====================
C:\Users\ronni\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpi6g6mw.dll
C:\Users\ronni\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmppwsvyk.dll

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-11-29 18:53

==================== End of FRST.txt ============================

 

 

 

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version:05-12-2015
Ran by ronni (2015-12-05 10:28:28)
Running from C:\Users\ronni\Desktop
Windows 10 Pro (X64) (2015-11-30 01:45:20)
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-2076635440-3871483252-621631334-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-2076635440-3871483252-621631334-503 - Limited - Disabled)
Guest (S-1-5-21-2076635440-3871483252-621631334-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2076635440-3871483252-621631334-1004 - Limited - Enabled)
ronni (S-1-5-21-2076635440-3871483252-621631334-1001 - Administrator - Enabled) => C:\Users\ronni

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Symantec Endpoint Protection.cloud (Enabled - Up to date) {53C7D717-52E2-B95E-FA61-6F32ECC805DB}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Symantec Endpoint Protection.cloud (Enabled - Up to date) {E8A636F3-74D8-B6D0-C0D1-5440974F4F66}
FW: Symantec Endpoint Protection.cloud (Enabled) {6BFC5632-188D-B806-D13E-C607121B42A0}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

1Password 4.6.0.592 (HKLM-x32\...\1Password4_is1) (Version: 4.0 - AgileBits)
Acronis True Image 2016 (HKLM-x32\...\{64AB919C-28AA-4260-A147-1A88E53EE978}Visible) (Version: 19.0.6027 - Acronis)
Acronis True Image 2016 (x32 Version: 19.0.6027 - Acronis) Hidden
Adobe Acrobat DC (HKLM-x32\...\{AC76BA86-1033-FFFF-7760-0C0F074E4100}) (Version: 15.009.20079 - Adobe Systems Incorporated)
Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 3.4.1.181 - Adobe Systems Incorporated)
Adobe Photoshop CC 2015 (HKLM-x32\...\{793C2BF7-A4FE-4608-91C9-9282C5801C21}) (Version: 16.1 - Adobe Systems Incorporated)
AirPort (HKLM-x32\...\{AA68AAAE-41F0-40B5-8896-5947F5FD6889}) (Version: 5.6.1.2 - Apple Inc.)
AirServer Universal (x64) (Version: 4.0.31 - App Dynamic) Hidden
AirServer Universal (x64) 4.0.31 (HKLM-x32\...\{73d28dd8-64ca-4c40-970e-62004f8767d0}) (Version: 4.0.31 - AppDynamic ehf)
Apple Application Support (32-bit) (HKLM-x32\...\{649A1FD9-5892-46AD-8DF0-C4A43FF61CB7}) (Version: 4.1 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{0DE0A178-AC7B-4650-806C-CF226DE03766}) (Version: 4.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{3540181E-340A-4E7A-B409-31663472B2F7}) (Version: 9.1.0.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)
Articulate Storyline 3 (HKLM-x32\...\{1b3fe3b3-ac80-44d7-afb1-85b749fe5cc7}) (Version: 3.0.40.0 - Articulate)
Articulate Studio (HKLM-x32\...\{ed13b7e7-cb58-4627-946a-8c1fe92f82f3}) (Version: 5.0.40.0 - Articulate)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Chrome Remote Desktop Host (HKLM-x32\...\{CDF9E1C8-4B97-4F8B-A848-7DD0E8BEB89F}) (Version: 47.0.2526.18 - Google Inc.)
Dell Command | Configure (HKLM-x32\...\{DF3680A9-B4C6-48D1-ACEF-0FF004446314}) (Version: 3.1.0.250 - Dell Inc.)
Dell Command | Monitor (HKLM\...\{DF0B9A53-C87D-49F9-95E3-AEAAC8C4D77B}) (Version: 9.1.0.98 - Dell Inc.)
Dell Command | Update (HKLM-x32\...\{EC542D5D-B608-4145-A8F7-749C02BE6D94}) (Version: 2.1.1 - Dell Inc.)
Dell Precision Optimizer (HKLM-x32\...\{D66A3355-FEA4-4F60-8BAF-D6CBEDB396D8}) (Version: 03.00.06 - Dell Inc.)
Dropbox (HKLM-x32\...\Dropbox) (Version: 3.10.11 - Dropbox, Inc.)
Dropbox Update Helper (x32 Version: 1.3.27.37 - Dropbox, Inc.) Hidden
Droplr for Windows (HKLM\...\{910F803C-E7A2-4CFB-B516-07E57B459333}_is1) (Version: 3.0.4 - Droplr)
f.lux (HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\Flux) (Version:  - )
FileZilla Client 3.14.1 (HKLM-x32\...\FileZilla Client) (Version: 3.14.1 - Tim Kosse)
GitHub (HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\5f7eb300e2ea4ebf) (Version: 3.0.6.4 - GitHub, Inc.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 47.0.2526.73 - Google Inc.)
Google Update Helper (x32 Version: 1.3.29.1 - Google Inc.) Hidden
Herramientas de corrección de Microsoft Office 2016: español (Version: 16.0.4266.1001 - Microsoft Corporation) Hidden
HP Officejet Pro 8600 Basic Device Software (HKLM\...\{791A06E2-340F-43B0-8FAB-62D151339362}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Support Solutions Framework (HKLM-x32\...\{F6A11738-3EE4-4573-AEA5-6CD5D491C167}) (Version: 12.0.30.219 - Hewlett-Packard Company)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
iCloud (HKLM\...\{B33C558F-772F-4308-A059-390FBF9BAAAE}) (Version: 5.0.2.61 - Apple Inc.)
Intel® Chipset Device Software (x32 Version: 10.1.2.8 - Intel® Corporation) Hidden
Intel® Network Connections 20.1.2019.0 (HKLM\...\PROSetDX) (Version: 20.1.2019.0 - Intel)
iTunes (HKLM\...\{E690A491-702F-4DEC-9977-C015D1DBB57C}) (Version: 12.3.1.23 - Apple Inc.)
Java 8 Update 66 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218066F0}) (Version: 8.0.660.18 - Oracle Corporation)
Kits Configuration Installer (x32 Version: 10.0.26624 - Microsoft) Hidden
L8 Control Center Lite (HKLM-x32\...\{F055953B-0F13-4120-9933-6F858AED1C82}) (Version: 1.0.0 - SmartLight Inc.)
L8 DFU Lite (HKLM-x32\...\{DCE54CCA-9BEA-489B-B17F-2B8ACE366692}) (Version: 1.1 - SmartLight Inc.)
Maxx Audio Installer (x64) (Version: 2.6.6005.4 - Waves Audio Ltd.) Hidden
Microsoft LifeCam (HKLM\...\{6965A8D2-465D-4F98-9FAA-0E9E2348F329}) (Version: 3.22.270.0 - Microsoft Corporation)
Microsoft Office Standard 2016 (HKLM\...\Office16.STANDARD) (Version: 16.0.4266.1001 - Microsoft Corporation)
Microsoft Online Services Sign-in Assistant (HKLM\...\{46E637E2-AC34-4B45-B5DF-D20903A3DB61}) (Version: 7.250.4303.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23026 (HKLM-x32\...\{e46eca4f-393b-40df-9f49-076faf788d83}) (Version: 14.0.23026.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.60715 - Microsoft Corporation)
Mozilla Firefox 41.0.2 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 41.0.2 (x86 en-US)) (Version: 41.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 41.0.2 - Mozilla)
MyHarmony - 1  (HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\036a0e4fc6a247ec) (Version: 1.0.1.257 - Logitech)
NVIDIA 3D Vision Driver 353.62 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 353.62 - NVIDIA Corporation)
NVIDIA Graphics Driver 353.62 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 353.62 - NVIDIA Corporation)
NVIDIA HD Audio Driver 1.3.34.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.34.3 - NVIDIA Corporation)
NVIDIA nView 146.33 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView) (Version: 146.33 - NVIDIA Corporation)
NVIDIA WMI 2.22.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVWMI) (Version: 2.22.0 - NVIDIA Corporation)
Outils de vérification linguistique 2016 de Microsoft Office - Français (Version: 16.0.4266.1001 - Microsoft Corporation) Hidden
Paprika Recipe Manager (HKLM-x32\...\{44E3DA6C-3794-4376-9DC6-6E3B9EF5300B}) (Version: 1.0.6 - Hindsight Labs LLC)
Password Safe (HKLM-x32\...\Password Safe) (Version:  - )
Pericom PI7C9X795x PCI Express UART Device (HKLM-x32\...\{3003CF95-F9AA-4999-8829-F0C253FDDE76}) (Version: 1.02.0426.2014 - Pericom Semiconductor Corporation)
Postbox (4.0.8) (HKLM-x32\...\Postbox (4.0.8)) (Version: 4.0.8 (en-US) - Postbox, Inc.)
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Realtek Audio COM Components (HKLM-x32\...\{2355B503-9B11-4449-861D-1C1748B26320}) (Version: 1.0.2 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6075 - Realtek Semiconductor Corp.)
ShellExtensionx64 (Version: 5.0.40.0 - Articulate) Hidden
Skype™ 7.14 (HKLM-x32\...\{6A0549A9-1B96-498C-ACBC-3943001FEB19}) (Version: 7.14.106 - Skype Technologies S.A.)
Slack (HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\slack) (Version: 1.2.7 - Slack Technologies)
Snagit 9.1.3 (HKLM-x32\...\{5C47C8B6-77FF-4FC7-A388-66FCF9CFC24C}) (Version: 9.1.3.19 - TechSmith Corporation)
Storyline (x32 Version: 3.0.40.0 - Articulate) Hidden
Studio (x32 Version: 5.0.40.0 - Articulate) Hidden
Symantec Endpoint Protection.cloud (x32 Version: 22.5.2.15 - Symantec Corporation) Hidden
Symantec.cloud - Cloud Agent (Version: 2.03.71.2618 - Symantec Corporation) Hidden
Symantec.cloud - Endpoint Protection (Version: 6.00.10.704 - Symantec Corporation) Hidden
Symantec.cloud (HKLM\...\Symantec Hosted Services ARP) (Version:  - Symantec Corporation)
Synergy (64-bit) (HKLM\...\{68C1AA13-4370-4761-B53F-1862C2CE26CB}) (Version: 1.7.5 - The Synergy Project)
Thunderbolt™ Software (HKLM-x32\...\{E265C71F-14DA-462C-A06A-CBA776B695F1}) (Version: 15.2.32.250 - Intel Corporation)
Toolkit Documentation (x32 Version: 10.0.26624 - Microsoft) Hidden
VMware Workstation (HKLM\...\{1D15EBBF-9FBE-43C1-B83C-4AA154D11E12}) (Version: 12.0.1 - VMware, Inc.)
WD Access (HKLM-x32\...\{b63cacc5-a0ce-427f-88c1-0db455d5ab6c}) (Version: 1.0.5627.18840 - Western Digital Technologies, Inc.)
WD Access (x32 Version: 1.0.5627.18840 - Western Digital Technologies, Inc) Hidden
WD My Cloud (HKLM\...\{3082756C-2147-411F-AE6A-9DCEF0121903}) (Version: 1.0.7.5 - Western Digital Technologies, Inc.)
WD Quick View (HKLM-x32\...\{CF54EA13-0BA9-426A-A296-D108C9DBEFF3}) (Version: 2.4.13.7 - Western Digital Technologies, Inc.)
WD SmartWare (HKLM\...\{6E80972C-C76A-4CFB-AD8E-003BF777B7AA}) (Version: 2.4.13.7 - Western Digital Technologies, Inc.)
WD SmartWare Installer (HKLM-x32\...\{30d59263-cfde-4ddb-9021-e280187620b2}) (Version: 2.4.13.7 - Western Digital Technologies, Inc.)
Windows Assessment and Deployment Kit - Windows 10 (HKLM-x32\...\{c09c49ab-d6a5-4543-bb31-639821977b42}) (Version: 10.0.26624 - Microsoft Corporation)
Yubico Authenticator (HKLM-x32\...\yubioath-desktop) (Version: 2.3.0 - Yubico AB)
Yubikey Client API (HKLM\...\{EDDC279F-4B94-4A9F-A2E9-E8421BBC2FA0}) (Version: 4.0.0 - Yubico)
YubiKey Logon (HKLM\...\{75D38D93-162A-4FEA-80F2-390E8B4B1FB3}) (Version: 1.0.0.7 - Yubico AB)
YubiKey NEO Manager (HKLM-x32\...\yubikey-neo-manager) (Version: 1.4.0 - Yubico AB)
YubiKey Personalization Tool (HKLM-x32\...\yubikey-personalization-gui) (Version: 3.1.23 - Yubico AB)
YubiKey PIV Manager (HKLM-x32\...\YubiKey PIV Manager) (Version: 1.1.1 - Yubico AB)
Zoom (HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\ZoomUMX) (Version: 3.5 - Zoom Video Communications, Inc.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-2076635440-3871483252-621631334-1001_Classes\CLSID\{0E270DAA-1BE6-48F2-AC49-E5AB8EBF6D88}\InprocServer32 -> %%systemroot%%\system32\shell32.dll => No File
CustomCLSID: HKU\S-1-5-21-2076635440-3871483252-621631334-1001_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\ronni\AppData\Local\Microsoft\OneDrive\17.3.6201.1019_1\FileCoAuth.exe (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2076635440-3871483252-621631334-1001_Classes\CLSID\{e8c77137-e224-5791-b6e9-ff0305797a13}\InprocServer32 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Systems)

==================== Restore Points =========================

03-12-2015 07:47:04 Articulate Storyline 360
04-12-2015 12:07:50 Articulate Storyline 3
04-12-2015 12:09:10 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2015-10-22 17:24 - 2015-10-22 17:22 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0B5CAB7E-0412-44A7-9AE5-7C5FE1EE40B5} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-08-26] (Apple Inc.)
Task: {0E21FEFB-626B-4CB3-8B5B-0EF16DC7331F} - System32\Tasks\Endpoint Protection.cloud\Norton Error Analyzer => C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\22.5.2.15\SymErr.exe [2015-05-19] (Symantec Corporation)
Task: {0FD34A41-BDD8-4798-B972-A9010347D7F9} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2015-10-22] (Dropbox, Inc.)
Task: {135A2E9B-D13F-4AC4-AE3E-E8788605904A} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-10-28] (Adobe Systems Incorporated)
Task: {3A531290-A9A5-4614-9D19-3238AAEC1A3C} - System32\Tasks\Intel\Thunderbolt\Start Thunderbolt application on login if service is up => Thunderbolt.exe
Task: {3AF500A8-0A45-41CC-BF63-CE876A156745} - System32\Tasks\Dell\Command Update => C:\Program Files (x86)\Dell\CommandUpdate\DellCommandUpdate.exe [2015-11-05] (Dell Inc.)
Task: {4715CD96-E41D-4065-BD31-221F0CF20BC6} - System32\Tasks\Endpoint Protection.cloud\Norton Autofix => C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\22.5.2.15\SymErr.exe [2015-05-19] (Symantec Corporation)
Task: {5462AA80-41A5-441C-A6BA-FB3C2C437D67} - System32\Tasks\Intel\Thunderbolt\Start Thunderbolt application when hardware is detected => Thunderbolt.exe
Task: {54AEBAFE-F185-4F1C-BDFF-FAE7EC435DF2} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2015-09-28] (Hewlett-Packard)
Task: {772E75E2-B98F-41E9-98F8-FAC44592CFCF} - System32\Tasks\RtHDVBg_PushButton => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2015-10-31] (Realtek Semiconductor)
Task: {7B94207C-F729-4597-BCE6-C4057355D355} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-10-22] (Google Inc.)
Task: {8428EBF2-D439-4D7E-9287-1BFFA403FA52} - System32\Tasks\Norton WSC Integration => C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\22.5.2.15\WSCStub.exe [2015-07-16] (Symantec Corporation)
Task: {91580ABB-AFEC-43B0-8D62-D5A273574128} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-11-19] (Microsoft Corporation)
Task: {9DFB90A5-92CD-4835-877D-F95A5886DF2B} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files\Microsoft Office\Office16\msoia.exe [2015-07-31] (Microsoft Corporation)
Task: {B8461540-1281-47B3-A470-052E106DA1CC} - System32\Tasks\Intel\Thunderbolt\Start Thunderbolt service when hardware is detected => Sc.exe start ThunderboltService
Task: {BF294D02-9125-465C-BDD1-A91671E5E6F3} - System32\Tasks\Dell\PPO SM Manual Update => C:\Program Files\Dell\PPO\DcsuWrap.exe [2015-09-15] (Dell Inc.)
Task: {C61070A6-DE9D-4486-A7AA-F6EB87A9090A} - System32\Tasks\{C5D332FB-6D92-48CE-BFC9-5867A79EE00F} => launchwinapp.exe hxxp://www.skype.com/go/downloading?source=lightinstaller&ver=7.13.0.101&LastError=12002
Task: {D907C9EE-D155-44EC-9620-5AE2A6B73576} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office16\OLicenseHeartbeat.exe [2015-07-31] (Microsoft Corporation)
Task: {E0723824-728B-484A-AC0B-D641990BB814} - System32\Tasks\Endpoint Protection.cloud\Norton Error Processor => C:\Program Files\Symantec.cloud\EndpointProtectionAgent\Engine\22.5.2.15\SymErr.exe [2015-05-19] (Symantec Corporation)
Task: {E20563C1-0008-4128-B444-698DB0B3C1F3} - System32\Tasks\HPCeeScheduleForronni => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
Task: {E2500FDD-AF42-42C3-87D3-BFC13A61503D} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2015-10-22] (Dropbox, Inc.)
Task: {E2F6B24E-5653-4123-B0CF-C981DF5777B6} - System32\Tasks\Intel\Thunderbolt\Start Thunderbolt service on boot if driver is up => tbtsvc.exe
Task: {F36CAA42-3FE5-484C-901C-EB4C749BF2B3} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-10-22] (Google Inc.)
Task: {FBAFE34E-BC94-4F0E-B457-C1B5EB72A333} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files\Microsoft Office\Office16\msoia.exe [2015-07-31] (Microsoft Corporation)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\HPCeeScheduleForronni.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2015-10-30 01:18 - 2015-10-30 01:18 - 00185856 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2015-10-22 21:03 - 2015-06-17 03:22 - 03163976 _____ () C:\WINDOWS\system32\nvwmi64.exe
2015-11-29 19:03 - 2015-07-22 19:10 - 00116552 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-10-13 04:45 - 2015-10-13 04:45 - 00085800 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-10-13 04:45 - 2015-10-13 04:45 - 01328912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-06-19 13:09 - 2015-06-19 13:09 - 01332792 _____ () C:\Program Files\Dell\Command Monitor\shared\bin\libxml2.dll
2015-11-19 20:19 - 2015-11-19 20:19 - 00311488 _____ () C:\Program Files\Synergy\synergyd.exe
2015-10-18 18:32 - 2015-10-18 18:32 - 12465856 _____ () C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe
2015-10-30 01:17 - 2015-10-30 01:17 - 02652784 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2015-10-30 01:18 - 2015-10-30 03:07 - 00591360 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2015-10-30 01:17 - 2015-10-30 01:17 - 02652784 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2015-11-14 04:23 - 2015-11-14 04:23 - 00553120 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll
2015-10-27 03:46 - 2015-10-27 03:46 - 08901800 _____ () C:\Program Files\Microsoft Office\Office16\1033\GrooveIntlResource.dll
2015-10-16 04:02 - 2015-10-16 04:02 - 00043480 _____ () C:\Program Files\FileZilla FTP Client\fzshellext_64.dll
2015-10-26 09:42 - 2015-09-15 19:14 - 00076800 _____ () C:\Program Files\Droplr\extensions\DroplrShellContextMenu.dll
2015-10-22 21:03 - 2015-06-17 03:22 - 00714048 _____ () C:\Program Files\NVIDIA Corporation\nview\nvshell.dll
2015-10-30 01:17 - 2015-10-30 01:17 - 00093696 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.Shell.SharedUtilities.dll
2015-10-30 01:17 - 2015-10-30 01:17 - 00472064 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2015-10-30 01:17 - 2015-10-30 01:17 - 00674816 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\MtcUvc.dll
2015-10-30 01:18 - 2015-10-30 03:07 - 08005632 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2015-10-30 01:18 - 2015-10-30 03:07 - 00936448 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2015-10-30 01:18 - 2015-10-30 03:07 - 02483200 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2015-10-30 01:18 - 2015-10-30 03:07 - 04089856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2015-11-19 20:19 - 2015-11-19 20:19 - 00801984 _____ () C:\Program Files\Synergy\synergyc.exe
2015-11-29 22:03 - 2015-11-29 22:04 - 00144384 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_1.11.19004.0_x86__8wekyb3d8bbwe\SkypeHost.exe
2015-11-14 04:22 - 2015-11-14 04:22 - 31401120 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
2015-11-19 13:26 - 2015-11-19 13:27 - 09074176 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_2015.23.23.0_x64__8wekyb3d8bbwe\WinStore.Entertainment.Mobile.dll
2015-11-19 13:26 - 2015-11-19 13:27 - 02416640 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_2015.23.23.0_x64__8wekyb3d8bbwe\MS.Entertainment.Common.Mobile.dll
2015-11-26 11:13 - 2015-11-26 11:13 - 07211112 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
2015-12-03 18:07 - 2015-12-03 18:11 - 00012800 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_15.1201.10020.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
2015-12-03 18:07 - 2015-12-03 18:11 - 11526656 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_15.1201.10020.0_x64__8wekyb3d8bbwe\Microsoft.Photos.dll
2015-11-19 13:28 - 2015-11-19 13:28 - 00258560 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_15.1201.10020.0_x64__8wekyb3d8bbwe\StoreRatingPromotion.dll
2015-12-03 17:57 - 2015-12-03 17:58 - 00011776 _____ () C:\Program Files\WindowsApps\Microsoft.People_10.0.3350.0_x64__8wekyb3d8bbwe\PeopleApp.exe
2015-12-03 17:57 - 2015-12-03 17:58 - 08346112 _____ () C:\Program Files\WindowsApps\Microsoft.People_10.0.3350.0_x64__8wekyb3d8bbwe\PeopleApp.dll
2015-12-03 17:57 - 2015-12-03 17:59 - 00125440 _____ () C:\Program Files\WindowsApps\Microsoft.People_10.0.3350.0_x64__8wekyb3d8bbwe\PeopleUtilRT.Windows.dll
2015-12-03 17:57 - 2015-12-03 17:59 - 03368448 _____ () C:\Program Files\WindowsApps\Microsoft.People_10.0.3350.0_x64__8wekyb3d8bbwe\PeopleShared.Windows.dll
2015-12-03 17:57 - 2015-12-03 17:57 - 01267200 _____ () C:\Program Files\WindowsApps\Microsoft.People_10.0.3350.0_x64__8wekyb3d8bbwe\BackgroundTasks.Windows.dll
2015-12-03 17:57 - 2015-12-03 18:00 - 00334848 _____ () C:\Program Files\WindowsApps\Microsoft.People_10.0.3350.0_x64__8wekyb3d8bbwe\PersonPicture.UAP.dll
2015-10-16 04:02 - 2015-10-16 04:02 - 00039384 _____ () C:\Program Files\FileZilla FTP Client\fzshellext.dll
2015-10-18 18:32 - 2015-10-18 18:32 - 01301696 _____ () C:\Program Files (x86)\VMware\VMware Workstation\libxml2.dll
2015-10-18 18:32 - 2015-10-18 18:32 - 00165056 _____ () C:\Program Files (x86)\VMware\VMware Workstation\nfc-types.dll
2015-10-18 18:32 - 2015-10-18 18:32 - 00191680 _____ () C:\Program Files (x86)\VMware\VMware Workstation\LIBEXPAT.dll
2015-10-18 18:32 - 2015-10-18 18:32 - 00388800 _____ () C:\Program Files (x86)\VMware\VMware Workstation\ssoClient.dll
2015-10-22 19:31 - 2015-04-28 08:50 - 00376832 _____ () C:\Program Files (x86)\1Password 4\js3215R.dll
2015-11-29 22:03 - 2015-11-29 22:04 - 00152064 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_1.11.19004.0_x86__8wekyb3d8bbwe\SkypeBackgroundTasks.dll
2015-11-29 22:03 - 2015-11-29 22:05 - 18906624 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_1.11.19004.0_x86__8wekyb3d8bbwe\SkyWrap.dll
2015-11-25 19:35 - 2015-11-25 19:35 - 00124416 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\js\node_modules\fs-ext\build\Release\fs-ext.node
2015-11-25 19:35 - 2015-11-25 19:35 - 00188416 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\js\node_modules\node-vulcanjs\build\Release\VulcanJS.node
2015-11-25 19:35 - 2015-11-25 19:35 - 00121344 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\js\node_modules\ref\build\Release\binding.node
2015-11-25 19:35 - 2015-11-25 19:35 - 00129536 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\js\node_modules\ffi\build\Release\ffi_bindings.node
2015-11-25 13:22 - 2015-11-25 13:22 - 00158384 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\js\node_modules\node-ProxyResolver\native\ProxyResolverWin.dll
2015-11-25 19:35 - 2015-11-25 19:35 - 00081408 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\js\node_modules\idle-gc\build\Release\idle-gc.node
2015-11-25 19:48 - 2015-11-25 19:48 - 00124416 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\js\node_modules\fs-ext\build\Release\fs-ext.node
2015-11-25 19:48 - 2015-11-25 19:48 - 00121344 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\js\node_modules\ref\build\Release\binding.node
2015-11-25 19:48 - 2015-11-25 19:48 - 00129536 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\js\node_modules\ffi\build\Release\ffi_bindings.node
2015-11-25 19:48 - 2015-11-25 19:48 - 00188416 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\js\node_modules\node-vulcanjs\build\Release\VulcanJS.node
2015-11-25 13:15 - 2015-11-25 13:15 - 00158384 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\js\node_modules\node-ProxyResolver\native\ProxyResolverWin.dll
2015-11-25 19:48 - 2015-11-25 19:48 - 00085504 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\js\node_modules\ws\build\Release\bufferutil.node
2015-11-25 19:48 - 2015-11-25 19:48 - 00086016 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\js\node_modules\ws\build\Release\validation.node
2015-11-25 19:48 - 2015-11-25 19:48 - 00081408 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\js\node_modules\idle-gc\build\Release\idle-gc.node
2015-11-26 10:40 - 2015-11-26 10:40 - 00035760 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\thread_pool.dll
2015-11-26 10:42 - 2015-11-26 10:42 - 00445872 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\ulxmlrpcpp.dll
2015-11-26 10:36 - 2015-11-26 10:36 - 00115632 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\EXPAT.dll
2015-11-26 11:07 - 2015-11-26 11:07 - 19884832 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\ti_managers.dll
2015-11-26 10:43 - 2015-11-26 10:43 - 00056752 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\rpc_client.dll
2015-08-11 14:36 - 2015-08-11 14:36 - 00024896 _____ () C:\Program Files (x86)\Common Files\Acronis\Infrastructure\core_workers_shared_context.dll
2015-11-26 11:13 - 2015-11-26 11:13 - 04093976 _____ () C:\Program Files (x86)\Common Files\Acronis\Infrastructure\atih_mms_addon.dll
2015-08-23 14:59 - 2015-08-23 14:59 - 00606672 _____ () C:\Program Files (x86)\Common Files\Acronis\Infrastructure\sqlite3.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\ronni\Desktop\Different Languages to test with (Ronnie's Org. Copy).docx:com.dropbox.attributes
AlternateDataStreams: C:\Users\ronni\Desktop\WSS - SL1 Backup.story:com.dropbox.attributes
AlternateDataStreams: C:\Users\ronni\Documents\StorylineBVT.story:com.apple.metadatakMDItemDownloadedDate
AlternateDataStreams: C:\Users\ronni\Documents\StorylineBVT.story:com.apple.metadatakMDItemWhereFroms
AlternateDataStreams: C:\Users\ronni\Documents\StorylineBVT.story:com.apple.quarantine

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\amikay.com -> hxxp://utm.amikay.com
IE trusted site: HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\amikay.com -> hxxps://utm.amikay.com
IE trusted site: HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\cleverreach.com -> hxxp://novastor.cleverreach.com
IE trusted site: HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\desk.com -> hxxp://desk.com
IE trusted site: HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\desk.com -> hxxps://desk.com
IE trusted site: HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\google-analytics.com -> hxxp://google-analytics.com
IE trusted site: HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\google-analytics.com -> hxxps://google-analytics.com
IE trusted site: HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\google.com -> hxxp://google.com
IE trusted site: HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\google.com -> hxxps://google.com
IE trusted site: HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\monitor-eqatec.com -> hxxp://monitor-eqatec.com
IE trusted site: HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\monitor-eqatec.com -> hxxps://monitor-eqatec.com
IE trusted site: HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\netsuite.com -> hxxp://netsuite.com
IE trusted site: HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\netsuite.com -> hxxps://netsuite.com
IE trusted site: HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\novabackup.com -> hxxp://novabackup.com
IE trusted site: HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\novabackup.com -> hxxps://novabackup.com
IE trusted site: HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\novabackup.de -> hxxp://novabackup.de
IE trusted site: HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\novabackup.de -> hxxps://novabackup.de
IE trusted site: HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\novastor.com -> hxxp://novastor.com
IE trusted site: HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\novastor.com -> hxxps://novastor.com
IE trusted site: HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\novastor.de -> hxxp://novastor.de

There are 3 more sites.

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2076635440-3871483252-621631334-1001\Control Panel\Desktop\\Wallpaper -> C:\WINDOWS\web\wallpaper\Windows\img0.jpg
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: YSearchUtilSvc => 2
HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\StartupApproved\Run: => "CudaDrive"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{AF4E748F-28F8-4873-B9A6-DAB573258A12}] => (Allow) C:\Program Files\Synergy\synergys.exe
FirewallRules: [{3608E620-7FE8-4FE8-BDC7-9D193E802D04}] => (Allow) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
FirewallRules: [{6AD3FD4E-C8FB-48FA-8F6C-DE88ED2A2FC4}] => (Allow) C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe
FirewallRules: [{0C67ED51-47A6-4CC7-B8D7-FCC8A5BD181C}] => (Allow) C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe
FirewallRules: [{3784BED8-1A5A-4254-BE0B-CADC87AF9D42}] => (Allow) C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe
FirewallRules: [{367381CB-D2B0-41E4-B27B-408EA0C630DD}] => (Allow) C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe
FirewallRules: [{49127C6E-58A9-4A47-AB5D-069D8DA47FF6}] => (Allow) C:\Program Files (x86)\Google\Chrome Remote Desktop\47.0.2526.18\remoting_host.exe
FirewallRules: [{9AC218BC-1EF3-4CD9-985A-A92E3402FB28}] => (Allow) C:\Program Files\CudaDrive\CudaDrive.exe
FirewallRules: [{C2C77E74-EB26-4137-AFF3-0F2BCC49514A}] => (Allow) C:\Program Files\CudaDrive\CudaDrive.exe
FirewallRules: [{7C4FBE8A-C532-40CE-A128-3EAAA1097915}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{5D7F7DC8-F768-4EFA-85E7-B3EBE1FC5412}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{7B6671F8-91D3-4728-9EB4-B6E8478472DE}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{FEE3B898-0936-46DB-BEC6-8506BEA11C53}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{74747F6B-52B8-4B3C-BC87-8FE6330A70C3}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [UDP Query User{31B4B241-8390-4F46-B19C-99DDDDA50E54}C:\program files (x86)\western digital\wd app manager\wdappmanager.exe] => (Allow) C:\program files (x86)\western digital\wd app manager\wdappmanager.exe
FirewallRules: [TCP Query User{F2F81AC9-316A-4B04-AF80-E6E3DA9E37AF}C:\program files (x86)\western digital\wd app manager\wdappmanager.exe] => (Allow) C:\program files (x86)\western digital\wd app manager\wdappmanager.exe
FirewallRules: [{A4BC56BD-CDE6-4FD2-8AA0-49DB0CF02ABE}] => (Allow) C:\Program Files (x86)\AirPort\APAgent.exe
FirewallRules: [{5A5F9B00-D748-4709-8318-A33B829C2A07}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPPSdr\HPDiagnosticCoreUI.exe
FirewallRules: [{07B37D65-65A7-4B47-9E19-9297C5CDD390}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPPSdr\HPDiagnosticCoreUI.exe
FirewallRules: [{89750EC5-DAB2-49B7-B3D6-F4DAF49D87E5}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [{59BBB347-C801-45BA-B0BE-630D3B138029}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicator.exe
FirewallRules: [{F7C7DE0B-7BA7-4AF6-9B66-8B6828F38ACA}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\Bin\DeviceSetup.exe
FirewallRules: [{E1BAC570-15E5-4359-B6CF-462123A3C854}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\bin\SendAFax.exe
FirewallRules: [{762F7F3C-5E5F-4AF7-8353-D8AC9E98F90F}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\bin\DigitalWizards.exe
FirewallRules: [{0117124E-CFB8-44A0-BFCF-60A36311366E}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\bin\FaxApplications.exe
FirewallRules: [{650134A6-BAEE-4F28-9993-5E7221C0DA2C}] => (Allow) C:\Program Files\App Dynamic\AirServer\AirServer.exe
FirewallRules: [{6D107773-EF07-4CB7-8BD0-CF4EC8751568}] => (Allow) C:\Program Files\App Dynamic\AirServer\AirServer.exe
FirewallRules: [{60DD9BD4-1572-492D-8F97-CEB915BA443D}] => (Allow) C:\Program Files (x86)\Microsoft LifeCam\LifeTray.exe
FirewallRules: [{91C07DF0-7979-45A6-B072-2FE6D23C68F7}] => (Allow) C:\Program Files (x86)\Microsoft LifeCam\LifeTray.exe
FirewallRules: [{F293A704-6105-478C-AD6D-F66FE1BDE0EC}] => (Allow) C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe
FirewallRules: [{7D4D9510-386B-4563-8F17-9CFCE2DB5B8D}] => (Allow) C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe
FirewallRules: [{3C1AE6E0-5AC6-4998-9F5B-A0C231352A22}] => (Allow) C:\Program Files (x86)\Microsoft LifeCam\LifeEnC2.exe
FirewallRules: [{FA82613B-5D71-49D1-B849-31915CC9848D}] => (Allow) C:\Program Files (x86)\Microsoft LifeCam\LifeEnC2.exe
FirewallRules: [{DDBBEE37-666D-4A8B-B3BB-10620BB69E00}] => (Allow) C:\Program Files (x86)\Microsoft LifeCam\LifeCam.exe
FirewallRules: [{9DBB8E4A-3BF3-4D5E-AD67-4401F9A7AFB0}] => (Allow) C:\Program Files (x86)\Microsoft LifeCam\LifeCam.exe
FirewallRules: [{E67DAE4E-011D-41FD-B3A2-9796CEB948DB}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{B6DC5DB3-09FD-4BDA-A386-B3446EC993CC}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{613ED860-6DC6-48FF-A99C-B01AE48C4892}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{D193D01C-46F8-4EB7-A4C0-C10BBC462665}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{4A5C8B4B-4E6E-48AD-98D2-617A0EA14990}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{C3079843-5B38-4ED7-B575-F2A7736E7383}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\Infrastructure\mms_mini.exe

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (12/05/2015 05:04:01 AM) (Source: Office 2016 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073418220

Error: (12/04/2015 07:04:40 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "Articulate.Drawing.Internal,processorArchitecture="x86",type="win32",version="2.30.0.4"1".
Dependent Assembly Articulate.Drawing.Internal,processorArchitecture="x86",type="win32",version="2.30.0.4" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (12/04/2015 07:04:40 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "Articulate.Drawing.Internal,processorArchitecture="x86",type="win32",version="2.30.0.4"1".
Dependent Assembly Articulate.Drawing.Internal,processorArchitecture="x86",type="win32",version="2.30.0.4" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (12/04/2015 07:04:40 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "Articulate.Drawing.Internal,processorArchitecture="x86",type="win32",version="2.30.0.4"1".
Dependent Assembly Articulate.Drawing.Internal,processorArchitecture="x86",type="win32",version="2.30.0.4" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (12/04/2015 12:31:57 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "Articulate.Drawing.Internal,processorArchitecture="x86",type="win32",version="2.30.0.4"1".
Dependent Assembly Articulate.Drawing.Internal,processorArchitecture="x86",type="win32",version="2.30.0.4" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (12/04/2015 12:31:57 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "Articulate.Drawing.Internal,processorArchitecture="x86",type="win32",version="2.30.0.4"1".
Dependent Assembly Articulate.Drawing.Internal,processorArchitecture="x86",type="win32",version="2.30.0.4" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (12/04/2015 12:31:52 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "Articulate.Drawing.Internal,processorArchitecture="x86",type="win32",version="2.30.0.4"1".
Dependent Assembly Articulate.Drawing.Internal,processorArchitecture="x86",type="win32",version="2.30.0.4" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (12/04/2015 12:31:52 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "Articulate.Drawing.Internal,processorArchitecture="x86",type="win32",version="2.30.0.4"1".
Dependent Assembly Articulate.Drawing.Internal,processorArchitecture="x86",type="win32",version="2.30.0.4" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (12/04/2015 12:31:50 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "Articulate.Drawing.Internal,processorArchitecture="x86",type="win32",version="2.30.0.4"1".
Dependent Assembly Articulate.Drawing.Internal,processorArchitecture="x86",type="win32",version="2.30.0.4" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (12/04/2015 12:31:49 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "Articulate.Drawing.Internal,processorArchitecture="x86",type="win32",version="2.30.0.4"1".
Dependent Assembly Articulate.Drawing.Internal,processorArchitecture="x86",type="win32",version="2.30.0.4" could not be found.
Please use sxstrace.exe for detailed diagnosis.

System errors:
=============
Error: (12/04/2015 05:07:34 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80070643: Update for Windows 10 Version 1511 for x64-based Systems (KB3122947).

Error: (12/04/2015 03:28:38 AM) (Source: DCOM) (EventID: 10016) (User: DELL-PRECISION7)
Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}DELL-PRECISION7ronniS-1-5-21-2076635440-3871483252-621631334-1001LocalHost (Using LRPC)Microsoft.WindowsStore_2015.23.23.0_x64__8wekyb3d8bbweS-1-15-2-1609473798-1231923017-684268153-4268514328-882773646-2760585773-1760938157

Error: (12/03/2015 01:45:56 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Acronis Nonstop Backup Service service terminated unexpectedly.  It has done this 1 time(s).

Error: (12/02/2015 02:16:52 PM) (Source: volsnap) (EventID: 36) (User: )
Description: The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.

Error: (12/02/2015 01:30:50 PM) (Source: DCOM) (EventID: 10010) (User: DELL-PRECISION7)
Description: {E844CD23-864D-4921-B18B-ED60A150E112}

Error: (12/01/2015 05:40:13 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The DSM SA Data Manager service terminated unexpectedly.  It has done this 1 time(s).

Error: (12/01/2015 05:40:10 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Windows Modules Installer service terminated with the following error:
%%16389

Error: (12/01/2015 05:40:00 PM) (Source: DCOM) (EventID: 10010) (User: DELL-PRECISION7)
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}

Error: (12/01/2015 05:39:59 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The User Data Access_5f8c08f service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 10000 milliseconds: Restart the service.

Error: (12/01/2015 05:39:59 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The User Data Storage_5f8c08f service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 10000 milliseconds: Restart the service.

CodeIntegrity:
===================================
  Date: 2015-12-01 03:10:30.353
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-11-29 19:38:42.862
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-11-29 19:38:17.469
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-11-29 19:02:00.608
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

==================== Memory info ===========================

Processor: Intel® Xeon® CPU E5-2630 v3 @ 2.40GHz
Percentage of memory in use: 27%
Total physical RAM: 16308.14 MB
Available physical RAM: 11844.31 MB
Total Virtual: 19252.14 MB
Available Virtual: 14092.29 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:874.24 GB) (Free:485.84 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 931.5 GB) (Disk ID: 559B5A2B)
Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
Partition 2: (Active) - (Size=11.7 GB) - (Type=27)
Partition 3: (Not Active) - (Size=874.2 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

 


Edited by ronniem1, 05 December 2015 - 10:31 AM.

  • 0

Advertisements

#2
dbreeze
Posted 07 December 2015 - 08:03 PM

dbreeze

    Trusted Helper

  • Malware Removal
  • 2,216 posts

Hi ronniem1,

Welcome to Geeks to Go. My name is dbreeze and I'll be helping you with this problem. Before I get into the removal of malware / correction of your problem, I need you to be aware of the following:

  • Please read all of my response through at least once before attempting to follow the procedures described.I would recommend printing them out, if you can, as you can check off each step as you complete it. Also, as some of the cleaning may be done in Safe Mode and there will be no internet connection then, you will find that having the steps printed for reference speeds the cleaning process along. If there's anything you don't understand or isn't totally clear to you, please come back to me for clarification before you start those steps.
  • All of the assistants and staff at Geeks to Go are here on a volunteer basis; please respect our time given to the cause of helping others.If you are going to be away for more than 4 days, please let me know here. (I will do the same for you.) We do realize that 'life happens' and situations arise unexpectedly; we just ask that you keep us up to date. That being said, please notice the following Geeks to Go rule:
  • Posts that are not replied to in four (4) days will result in the topic being closed. We have not forgotten you; this is just an effort to keep the boards organized and flowing. To continue on your closed topic, please PM me or any Moderator to have the topic reactivated. If, at any time during our working together, I have not responded to you in 2 days (48 hours), then please PM me.
  • Malware removal is a complex, multiple step process; please stay with me on this thread (don't start another thread) until I declare that your logs are clean and you are good to go. The absence of apparent issues does not mean your system is clean; I will tell you when everything looks good for you to go and help you remove the tools we have used.
  • If any of the security programs on your system should give any warnings about the software tools I ask you to download and use, please do not be alarmed.All of the tools I will have you use are safe to use (as instructed) and malware free.
  • While we strive to disrupt your system as little as possible, things happen.If you can, it would be best to back up your personal files now (if you do not already have a backup). You can store these on a CD/DVD, USB drive or stick, anywhere but on your same system. This will save you from possible anguish later if something unforeseen happens.
  • Please do not run any other tools or scanners than what I ask you to.Some of the openly available software made for malware removal can make changes to your system that interfere with the cleaning of the malware, or even destroy your system. I will use only what the situation calls for and direct you in the proper use of that software.
  • Please do not attach any log files to your replies unless I specifically ask you.Instead please copy and paste so as to include the log in your reply. You can do this in separate posts if it's easier for you.


- Save ALL Tools to your Desktop-

 

All the tools that I will have you download should be placed on the desktop unless otherwise stated. If you are familiar with how to save files to the desktop then you can skip this step.

Since you are continuing with this step then I assume you are unfamiliar with saving files to your desktop. As a result it's easiest if you configure your browser(s) to download any tools to the desktop by default. Please use the appropriate instructions below depending on the browser you are using.
Chrome.JPGGoogle Chrome - Click the "Customize and control Google Chrome" button in the upper right-corner of the browser.Settings.JPG Choose Settings. at the bottom of the screen click the
"Show advanced settings..." link. Scroll down to find the Downloads section and click the Change... button. Select your desktop and click OK.
Firefox.JPGMozilla Firefox - Click the "Open Menu" button in the upper right-corner of the browser. Settings.JPG Choose Options. In the downloads section, click the Browse button, click on the Desktop folder
and the click the "Select Folder" button. Click OK to get out of the Options menu.
IE.jpgInternet Explorer - Click the Tools menu in the upper right-corner of the browser. Tools.JPG Select View downloads. Select the Options link in the lower left of the window. Click Browse and
select the Desktop and then choose the Select Folder button. Click OK to get out of the download options screen and then click Close to get out of the View Downloads screen.
NOTE: IE8 Does not support changing download locations in this manner. You will need to download the tool(s) to the default folder, usually Downloads, then copy them to the desktop.
 

Quoted from and used by permission of BrianDrab.  Thank you.

Let's get started....
The log show noting 'bad' per se but there are a few questionable items on the system ...

Open notepad by pressing the Windows Key + R Key, typing in Notepad in the Run dialog and then pressing Enter.  Please copy the contents of the quote box below. To do this highlight the contents of the box and right click on it and select copy. Paste this into the open notepad. Save it to your desktop as fixlist.txt
 


Start
CreateRestorePoint:
CloseProcesses:
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\Run: [Zoom] => 0
HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\Run: [GoogleChromeAutoLaunch_223ED3D3CBA109DB2E19244C4385A7C9] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [741704 2015-11-24] (Google Inc.)
HKU\S-1-5-21-2076635440-3871483252-621631334-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.gogle.com/
CHR Extension: (Google Search) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27]
CHR Extension: (Chrome Remote Desktop) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbchcmhmhahfdphkhkmpfmihenigjmpp [2015-11-04]
CHR Extension: (Bitly Unleash the power of the link) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\iabeihobmhlgpkcgjiloemdbofjbdcic [2015-10-22]
C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\iabeihobmhlgpkcgjiloemdbofjbdcic
C:\Users\ronni\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpi6g6mw.dll
C:\Users\ronni\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmppwsvyk.dll
CustomCLSID: HKU\S-1-5-21-2076635440-3871483252-621631334-1001_Classes\CLSID\{0E270DAA-1BE6-48F2-AC49-E5AB8EBF6D88}\InprocServer32 -> %%systemroot%%\system32\shell32.dll => No File
AlternateDataStreams: C:\Users\ronni\Desktop\Different Languages to test with (Ronnie's Org. Copy).docx:com.dropbox.attributes
AlternateDataStreams: C:\Users\ronni\Desktop\WSS - SL1 Backup.story:com.dropbox.attributes
AlternateDataStreams: C:\Users\ronni\Documents\StorylineBVT.story:com.apple.metadata"kMDItemDownloadedDate
AlternateDataStreams: C:\Users\ronni\Documents\StorylineBVT.story:com.apple.metadata"kMDItemWhereFroms
AlternateDataStreams: C:\Users\ronni\Documents\StorylineBVT.story:com.apple.quarantine
cmd: ipconfig /flushdns
cmd: netsh advfirewall reset
cmd: netsh advfirewall set allprofiles state on
Reg: Reg Delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /F
Reg: Reg Add "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /F
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
CMD: bitsadmin /reset /allusers
RemoveProxy:
EmptyTemp:
Reboot:
end
 


NOTE. It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST64 by right clicking on the FRST64.exe file, selecting "Run as Administrator..".  The User Account Control may open up; if it does, select Yes to continue to let FRST open and load.  

The tool will check for an updated version of itself every time it loads; please allow it to do this and the program will either inform you it is downloading an updated copy (and to wait until it is safe to continue) or show nothing (meaning there is no update found) and you can continue on.  Press the Fix button just once and wait.  The tool will create a restore point, process the script and ask for a restart of your system.

Press%20the%20FIX%20button_zpsdd5zi3mt.p

If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.

When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
 

 


  • 0

#3
ronniem1
Posted 09 December 2015 - 09:37 AM

ronniem1

    Member

  • Topic Starter
  • Member
  • PipPip
  • 15 posts
Fix result of Farbar Recovery Scan Tool (x64) Version:05-12-2015
Ran by ronni (2015-12-09 09:23:54) Run:1
Running from C:\Users\ronni\Desktop
Loaded Profiles: ronni (Available Profiles: ronni)
Boot Mode: Normal
==============================================
 
fixlist content:
*****************
Start
CreateRestorePoint:
CloseProcesses:
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\Run: [Zoom] => 0
HKU\S-1-5-21-2076635440-3871483252-621631334-1001\...\Run: [GoogleChromeAutoLaunch_223ED3D3CBA109DB2E19244C4385A7C9] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [741704 2015-11-24] (Google Inc.)
HKU\S-1-5-21-2076635440-3871483252-621631334-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.gogle.com/
CHR Extension: (Google Search) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27]
CHR Extension: (Chrome Remote Desktop) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbchcmhmhahfdphkhkmpfmihenigjmpp [2015-11-04]
CHR Extension: (Bitly Unleash the power of the link) - C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\iabeihobmhlgpkcgjiloemdbofjbdcic [2015-10-22]
C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\iabeihobmhlgpkcgjiloemdbofjbdcic
C:\Users\ronni\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpi6g6mw.dll
C:\Users\ronni\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmppwsvyk.dll
CustomCLSID: HKU\S-1-5-21-2076635440-3871483252-621631334-1001_Classes\CLSID\{0E270DAA-1BE6-48F2-AC49-E5AB8EBF6D88}\InprocServer32 -> %%systemroot%%\system32\shell32.dll => No File
AlternateDataStreams: C:\Users\ronni\Desktop\Different Languages to test with (Ronnie's Org. Copy).docx:com.dropbox.attributes
AlternateDataStreams: C:\Users\ronni\Desktop\WSS - SL1 Backup.story:com.dropbox.attributes
AlternateDataStreams: C:\Users\ronni\Documents\StorylineBVT.story:com.apple.metadata"kMDItemDownloadedDate
AlternateDataStreams: C:\Users\ronni\Documents\StorylineBVT.story:com.apple.metadata"kMDItemWhereFroms
AlternateDataStreams: C:\Users\ronni\Documents\StorylineBVT.story:com.apple.quarantine
cmd: ipconfig /flushdns
cmd: netsh advfirewall reset
cmd: netsh advfirewall set allprofiles state on
Reg: Reg Delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /F
Reg: Reg Add "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /F
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
CMD: bitsadmin /reset /allusers
RemoveProxy:
EmptyTemp:
Reboot:
end
*****************
 
Restore point was successfully created.
Processes closed successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value removed successfully
HKU\S-1-5-21-2076635440-3871483252-621631334-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Zoom => value removed successfully
HKU\S-1-5-21-2076635440-3871483252-621631334-1001\Software\Microsoft\Windows\CurrentVersion\Run\\GoogleChromeAutoLaunch_223ED3D3CBA109DB2E19244C4385A7C9 => value removed successfully
HKU\S-1-5-21-2076635440-3871483252-621631334-1001\Software\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully
C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf => moved successfully
C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbchcmhmhahfdphkhkmpfmihenigjmpp => moved successfully
C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\iabeihobmhlgpkcgjiloemdbofjbdcic => moved successfully
"C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\iabeihobmhlgpkcgjiloemdbofjbdcic" => not found.
"C:\Users\ronni\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpi6g6mw.dll" => not found.
"C:\Users\ronni\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmppwsvyk.dll" => not found.
"HKU\S-1-5-21-2076635440-3871483252-621631334-1001_Classes\CLSID\{0E270DAA-1BE6-48F2-AC49-E5AB8EBF6D88}" => key removed successfully
C:\Users\ronni\Desktop\Different Languages to test with (Ronnie's Org. Copy).docx => ":com.dropbox.attributes" ADS removed successfully.
C:\Users\ronni\Desktop\WSS - SL1 Backup.story => ":com.dropbox.attributes" ADS removed successfully.
"C:\Users\ronni\Documents\StorylineBVT.story" => ":com.apple.metadata"kMDItemDownloadedDate" ADS not found.
"C:\Users\ronni\Documents\StorylineBVT.story" => ":com.apple.metadata"kMDItemWhereFroms" ADS not found.
C:\Users\ronni\Documents\StorylineBVT.story => ":com.apple.quarantine" ADS removed successfully.
 
=========  ipconfig /flushdns =========
 
 
Windows IP Configuration
 
Successfully flushed the DNS Resolver Cache.
 
========= End of CMD: =========
 
 
=========  netsh advfirewall reset =========
 
Ok.
 
 
========= End of CMD: =========
 
 
=========  netsh advfirewall set allprofiles state on =========
 
Ok.
 
 
========= End of CMD: =========
 
 
========= Reg Delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /F =========
 
ERROR: The system was unable to find the specified registry key or value.
 
 
========= End of Reg: =========
 
 
========= Reg Add "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg" /F =========
 
The operation completed successfully.
 
 
 
========= End of Reg: =========
 
 
========= reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========
 
The operation completed successfully.
 
 
 
========= End of Reg: =========
 
 
========= reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========
 
The operation completed successfully.
 
 
 
========= End of Reg: =========
 
 
=========  bitsadmin /reset /allusers =========
 
 
BITSADMIN version 3.0 [ 7.8.10586 ]
BITS administration utility.
© Copyright 2000-2006 Microsoft Corp.
 
BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.
 
{8354E285-3BBA-418E-8877-DD3AC66032AF} canceled.
{A63F162E-A051-40EB-884B-0EC2A928EBD1} canceled.
2 out of 2 jobs canceled.
 
========= End of CMD: =========
 
 
========= RemoveProxy: =========
 
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully
HKU\S-1-5-21-2076635440-3871483252-621631334-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\S-1-5-21-2076635440-3871483252-621631334-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully
 
 
========= End of RemoveProxy: =========
 
EmptyTemp: => 848.3 MB temporary data Removed.
 
 
The system needed a reboot.
 
==== End of Fixlog 09:24:17 ====

  • 0

#4
dbreeze
Posted 09 December 2015 - 11:38 AM

dbreeze

    Trusted Helper

  • Malware Removal
  • 2,216 posts

How is your system running now?  Any issues?

 

 

Next steps .....

AdwCleaner by Xplode

Download AdwCleaner from here or from here. Save the file to the desktop.


NOTE: If you are using IE 8 or above you may get a warning that stops the program from downloading. Just click on the warning and allow the download to complete.

Close all open windows and browsers.

  • Vista/7/8 users: Right click the AdwCleaner icon on the desktop, click Run as administrator and accept the UAC prompt to run AdwCleaner.
    You will see the following console:

    AdwCleaner_v5016_zpsf8ln0fea.png
  • Click the Scan button and wait for the scan to finish.
  • After the Scan has finished the window may or may not show what it found and above, in the progress bar, you will see: Waiting for action. Please uncheck elements you don't want to remove.
  • Click the Clean button.
  • Everything checked will be deleted.
  • When the program has finished cleaning a report appears.
  • Once done it will ask to reboot, allow this

    adwcleaner_delete_restart.jpg
  • On reboot a log will be produced please copy / paste that in your next reply. This report is also saved to C:\AdwCleaner\AdwCleaner[C0].txt

Optional:

NOTE: If you see AVG Secure Search being targeted for deletion, Here's Why and Here. You can always Reinstall it.


  • 0

#5
ronniem1
Posted 09 December 2015 - 01:15 PM

ronniem1

    Member

  • Topic Starter
  • Member
  • PipPip
  • 15 posts
# AdwCleaner v5.024 - Logfile created 09/12/2015 at 11:50:00
# Updated 07/12/2015 by Xplode
# Database : 2015-12-07.3 [Server]
# Operating system : Windows 10 Pro  (x64)
# Username : ronni - DELL-PRECISION7
# Running from : C:\Users\ronni\Downloads\CleanPC-GoGeeks\adwcleaner_5.024.exe
# Option : Cleaning
 
***** [ Services ] *****
 
 
***** [ Folders ] *****
 
[-] Folder Deleted : C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Extensions\iabeihobmhlgpkcgjiloemdbofjbdcic
 
***** [ Files ] *****
 
 
***** [ DLLs ] *****
 
 
***** [ Shortcuts ] *****
 
 
***** [ Scheduled tasks ] *****
 
 
***** [ Registry ] *****
 
 
***** [ Web browsers ] *****
 
[-] [C:\Users\ronni\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Deleted : iabeihobmhlgpkcgjiloemdbofjbdcic
 
*************************
 
:: "Tracing" keys removed
:: Winsock settings cleared
 
########## EOF - C:\AdwCleaner\AdwCleaner[C2].txt - [952 bytes] ##########

  • 0

#6
dbreeze
Posted 09 December 2015 - 08:15 PM

dbreeze

    Trusted Helper

  • Malware Removal
  • 2,216 posts

Malwarebytes' Anti-Malware
Please download the latest version of Malwarebytes' Anti-Malware from here .

Double Click on the mbam-setup.exe file to install the application.

Do not check on the Trial of Professional version. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.

If an update is found, it will download and install the latest version.

When the main screen opens, if the database is out of date, you can click on the Fix Now banner or the Update Now link
Main%20Screen_zpsnnwza0ky.png

Once updated, please select Settings > Detection and Protection. Please ensure that "Scan for Rootkits" is selected along with Non-Malware Protection PUP and PUM are set to "Treat detections as malware"
Detection%20Settings_zpsaviydqil.png

Once the settings have been configured, select the Dashboard tab to return to the Main screen and select "Scan Now >>" to start the scan.
Main%20Screen_zpsnnwza0ky.png

The scan may take some time to finish, so please be patient.
mbam21-scaninprogress_zps38w26yvt.jpg

If any malware is found, you will be presented with a screen like the one below.
mbam21-removeselected_zpsg83p7wis.jpg

Please click on the Save Results >> link / button and select the As text file from the dropdown list. I would suggest you save the file on your desktop (as we need the report attached here for review and it is easy to find on the desktop).

After you have saved the report file, return to the Potential Threats Detected page and click on Cancel. You can close MBAM after that.

Please attach the report file to a post here; I will review the file and script what needs to be removed (if there is anything).
 


  • 0

#7
ronniem1
Posted 10 December 2015 - 12:18 PM

ronniem1

    Member

  • Topic Starter
  • Member
  • PipPip
  • 15 posts
Malwarebytes Anti-Malware
www.malwarebytes.org
 
Scan Date: 12/10/2015
Scan Time: 11:58 AM
Logfile: malwb.txt
Administrator: Yes
 
Version: 2.2.0.1024
Malware Database: v2015.12.10.05
Rootkit Database: v2015.12.07.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled
 
OS: Windows 10
CPU: x64
File System: NTFS
User: ronni
 
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 386623
Time Elapsed: 18 min, 38 sec
 
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
 
Processes: 0
(No malicious items detected)
 
Modules: 0
(No malicious items detected)
 
Registry Keys: 2
RiskWare.CompromisedCert, HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\98A04E4163357790C4A79E6D713FF0AF51FE6927, , [97d6792a99f2bb7b5afeea159f6459a7], 
RiskWare.CompromisedCert, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\98A04E4163357790C4A79E6D713FF0AF51FE6927, , [6d006a39f9923bfb3d1b42bd36cdb749], 
 
Registry Values: 0
(No malicious items detected)
 
Registry Data: 0
(No malicious items detected)
 
Folders: 0
(No malicious items detected)
 
Files: 0
(No malicious items detected)
 
Physical Sectors: 0
(No malicious items detected)
 
 
(end)

  • 0

#8
dbreeze
Posted 10 December 2015 - 09:27 PM

dbreeze

    Trusted Helper

  • Malware Removal
  • 2,216 posts

Thank you for the MBAM log; we will take care of that and this scan's findings in a bit ....

 

This next step may take a while (just to warn you) .....

ESET Online does not work with IE 11 (Internet Explorer) at the moment (a few weeks ago anyway) so if you have IE 11, Chrome or Firefox has to be used instead.  ESET Online does work with IE 10 and earlier.

You can leave Norton Enabled even though ESET may warn about it. just makes the scan take longer. The pictures below showing what to click may be blue instead of green on the ESET website now, but the procedure is still the same

Please read carefully and Slowly, Notice all the settings listed below to check before starting the scan. Stop and ask if you have any questions.

Take note of the NO tick in the Remove found threats setting below at it needs to have the tick removed.

-------------------------------------------------------------------------------------------------------------------

Hold down Control key and click on the following link to open ESET OnlineScan in a new window.

Link =>> ESET Online Scanner  <<

Click the Run ESET Online Scanner located on the left side of the page (not the free trial).

abfacb96-0c99-4b59-b9e9-9298aa0ee3ec_zps

For browsers other than Internet Explorer only: (Microsoft Internet Explorer users can skip this step)
Click on the esetsmartinstaller link in the popup window that opens. Save it to your desktop.

Getinstallerpopup2_zps65f446a6.png

Double click on the icon on your desktop.

desktopfile_zps98a1ee89.png

Check (accept) the Terms of Use.

TOU_zps4ecd3406.png

Click the START button.
Accept any security warnings from your browser.

Now in the Computer scan settings window that appears:-
Make sure that the option Enable detection of potentially unwanted applications is selected.
Now click on Advanced Settings and configure the options as follows:

Remove found threats is Not checked
Scan archives is checked
Scan for potentially unsafe applications is checked
Enable Anti-Stealth Technology is checked


Now click on: Start
Loadsettings_2014-08-23_zps3f2d0c88.png



ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.

Downloadingsignatures_zps36c38587.png


Scanningdisplay_zpsec3aac14.png

When the scan is finished, if any threats are found you will see the screen below.  Click to view the found threats.

Threatsfound_zpsfe95fb4e.png

At the bottom of the listed threats, there is an option to save the results to a text file.  Please do this so you can attach the results here for review and removal of the items that are not false positives (these will be scripted out so do not worry).

Exporttotextfile_zps16cb487f.png

Once the log text file is saved, return to the Scan Finished screen by clicking "<<Back", then click on the uninstall button and click Finish.

UninstallcheckedandFinish_zps6fb26ad8.pn

Attach the saved log file in your next reply please.  Thanks.
 


  • 0

#9
ronniem1
Posted 11 December 2015 - 11:55 AM

ronniem1

    Member

  • Topic Starter
  • Member
  • PipPip
  • 15 posts

Hello there - 

 

ESET found zero infections.   

 

What about the two issues malware bytes found?

 

 

Attached Thumbnails

  • ESET.png

Edited by ronniem1, 11 December 2015 - 11:55 AM.

  • 0

#10
dbreeze
Posted 11 December 2015 - 08:59 PM

dbreeze

    Trusted Helper

  • Malware Removal
  • 2,216 posts

I'm going to have you remove them >>>>

 

Open notepad by pressing the Windows Key + R Key, typing in Notepad in the Run dialog and then pressing Enter.  Please copy the contents of the quote box below. To do this highlight the contents of the box and right click on it and select copy. Paste this into the open notepad. Save it to your desktop as fixlist.txt
 

Start
CreateRestorePoint:
CloseProcesses:
Unlock: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\98A04E4163357790C4A79E6D713FF0AF51FE6927
UNlock: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\98A04E4163357790C4A79E6D713FF0AF51FE6927
REG: reg delete HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\98A04E4163357790C4A79E6D713FF0AF51FE6927 /f
REG: reg delete HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\98A04E4163357790C4A79E6D713FF0AF51FE6927 /f
CMD: bitsadmin /reset /allusers
RemoveProxy:
EmptyTemp:
Reboot:
end


NOTE. It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST64 by right clicking on the FRST64.exe file, selecting "Run as Administrator..".  The User Account Control may open up; if it does, select Yes to continue to let FRST open and load.  

The tool will check for an updated version of itself every time it loads; please allow it to do this and the program will either inform you it is downloading an updated copy (and to wait until it is safe to continue) or show nothing (meaning there is no update found) and you can continue on.  Press the Fix button just once and wait.  The tool will create a restore point, process the script and ask for a restart of your system.

Press%20the%20FIX%20button_zpsdd5zi3mt.p

If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.

When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
 

 


  • 0

#11
ronniem1
Posted 13 December 2015 - 08:25 AM

ronniem1

    Member

  • Topic Starter
  • Member
  • PipPip
  • 15 posts
Fix result of Farbar Recovery Scan Tool (x64) Version:12-12-2015 01
Ran by ronni (2015-12-12 14:26:15) Run:2
Running from C:\Users\ronni\Downloads\CleanPC-GoGeeks
Loaded Profiles: ronni (Available Profiles: ronni)
Boot Mode: Normal
==============================================
 
fixlist content:
*****************
Start
CreateRestorePoint:
CloseProcesses:
Unlock: HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\98A04E4163357790C4A79E6D713FF0AF51FE6927
UNlock: HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\98A04E4163357790C4A79E6D713FF0AF51FE6927
REG: reg delete HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\98A04E4163357790C4A79E6D713FF0AF51FE6927 /f
REG: reg delete HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\98A04E4163357790C4A79E6D713FF0AF51FE6927 /f
CMD: bitsadmin /reset /allusers
RemoveProxy:
EmptyTemp:
Reboot:
end
*****************
 
Restore point was successfully created.
Processes closed successfully.
"HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\98A04E4163357790C4A79E6D713FF0AF51FE6927" => key was unlocked
"HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\98A04E4163357790C4A79E6D713FF0AF51FE6927" => key was unlocked
 
========= reg delete HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\98A04E4163357790C4A79E6D713FF0AF51FE6927 /f =========
 
The operation completed successfully.
 
 
 
========= End of Reg: =========
 
 
========= reg delete HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\98A04E4163357790C4A79E6D713FF0AF51FE6927 /f =========
 
ERROR: The system was unable to find the specified registry key or value.
 
 
========= End of Reg: =========
 
 
=========  bitsadmin /reset /allusers =========
 
 
BITSADMIN version 3.0 [ 7.8.10586 ]
BITS administration utility.
© Copyright 2000-2006 Microsoft Corp.
 
BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.
 
0 out of 0 jobs canceled.
 
========= End of CMD: =========
 
 
========= RemoveProxy: =========
 
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully
HKU\S-1-5-21-2076635440-3871483252-621631334-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\S-1-5-21-2076635440-3871483252-621631334-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully
 
 
========= End of RemoveProxy: =========
 
EmptyTemp: => 414.6 MB temporary data Removed.
 
 
The system needed a reboot.
 
==== End of Fixlog 14:27:51 ====

  • 0

#12
dbreeze
Posted 13 December 2015 - 01:41 PM

dbreeze

    Trusted Helper

  • Malware Removal
  • 2,216 posts

All right!! :D Your logs are clean and you're good to go now!! :thumbsup: We've got some final steps left to do to clean up our tools and get your system in good running condition and then you are on your way. It has been really great to work with you.  Thanks. :cool:


Clean up of Malware Removal Tools
Now that we are through using these tools, let's clean them off your system so that should you ever need to have malware removed again (we hope not) fresh, updated copies will be downloaded.
If you did not do so at the end of its scan, please uninstall ESET Online Scanner at this time.  You can use the Control Panel 'Add / Remove Programs' or 'Programs and Features' utility to uninstall it.
 

  • Download Delfix from here to your desktop and double click it to start the program
  • Ensure Remove disinfection tools is ticked
    Also tick:
  • Activate UAC
  • Create registry backup
  • Purge system restore
  • Reset system settings
  • DelFixSelectall_zps0f04cec4.png
  • Click Run
  • The program will run for a few moments and then notepad will open with a log. Please paste the log in your next reply.

You can delete any log files left on your desktop as these are no longer needed.


You are now done! :yeah:

Now some information on programs to help keep you safe:

Consider a program that will check for out-of-date programs on your system
Some programs don't have update checks built in or make you run the application to start the check for updates process. An easier way to stay on top of the current versions of your installed programs is to use a version checking program like Heimdal Free from Heimdal Security (you can get the software from here and read more about it on the same page).

Next, an Antivirus program. You NEED one; free is just as good as paid-for as long as you keep them updated. ONLY use one at a time as having more than that will cause system problems. Here are some free ones to check out:
Microsoft Security Essentials
Avast! Free Antivirus

Next, a firewall is a must have now-a-days. The built in firewall in Windows 7 (and above) is fine (just make sure it is turned on (Start > Control Panel > Windows Firewall)). Or, if you like, you could check out of the free ones listed here:
Zone Alarm Free Firewall  -  installer includes foistware so read the options very carefully

=== options ====
Unchecky is a small service that runs in the background to help keep those "extra toolbars" and tag along search engines from automatically installing.  By automatically directing you to a custom install with all the options unchecked, only what you manually choose and confirm gets installed.

CryptoPrevent is a free program that prevents CryptoLocker / ransomware from infecting your PC by locking down the OS so the malware can not get a grip on your system.  You can read the details about this program here.

Also, consider adding MalwareBytes Antimalware to your arsenal of safe keeping programs. Use the free version (not the paid or trial version) and you won't have a problem with your antivirus scanner program. Keep it updated and run a scan with it once a week.

Lastly, if you use Firefox as your main web browser, consider adding the NoScript and AdBlockPlus add-ons to the browser to block scripting hijacks and remove unwanted ads from the pages you view.

You may also find some information and tips at this thread:
 How did I get infected in the first place?
and
COMPUTER SECURITY - a short quide to staying safer online
 

I'll leave this topic open for a few days so that if you have any questions you can come back here. Surf safe, my friend!!
 

 


  • 0

#13
ronniem1
Posted 04 January 2016 - 09:47 AM

ronniem1

    Member

  • Topic Starter
  • Member
  • PipPip
  • 15 posts

All done.  You can close this topic/board and mark as solved. 


  • 0

#14
dbreeze
Posted 04 January 2016 - 12:10 PM

dbreeze

    Trusted Helper

  • Malware Removal
  • 2,216 posts

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.


  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics


Also tagged with one or more of these keywords: CleanPC, FRST, adwcleaner, performance, JRT

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP