[-] Folder Deleted : C:\Program Files (x86)\20668AF2-1463173963-E311-AB28-008CFA7E37CB
[-] Folder Deleted : C:\WINDOWS\SysWOW64\config\systemprofile\AppData\Roaming\tencent
[-] Folder Deleted : C:\WINDOWS\SysWOW64\config\systemprofile\AppData\Roaming\Uncheckit
[-] Folder Deleted : C:\Users\oliver\AppData\Local\20668AF2-1463181474-E311-AB28-008CFA7E37CB
[-] Folder Deleted : C:\Users\oliver\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\腾讯软件
[-] Folder Deleted : C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\YourGSearchFinder_br
[-] Folder Deleted : C:\Users\oliver\AppData\Local\VirtualStore\Program Files (x86)\tencent
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SEARCHSCOPES\IELNKSRCH
[-] Key Deleted : HKEY_CLASSES_ROOT\AllFilesystemObjects\shellex\ContextMenuHandlers\QMContextUninstall
[-] Key Deleted : HKEY_CLASSES_ROOT\Folder\ShellEx\ContextMenuHandlers\QMContextUninstall
[-] Key Deleted : HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{ielnksrch}
[-] Key Deleted : HKCU\SOFTWARE\Mozilla\Firefox\{EB52F1AB-3C2B-424F-9794-833C687025CF}
[-] Key Deleted : HKLM\SOFTWARE\Mozilla\Firefox\{EB52F1AB-3C2B-424F-9794-833C687025CF}
[-] Key Deleted : HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.qq.qmchext
[-] Key Deleted : HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\QMContextScan
[-] Key Deleted : HKLM\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\QMContextScan
[-] Key Deleted : HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\Application Hosting
[-] Key Deleted : HKLM\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\QMContextScan
[-] Key Deleted : HKLM\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\QMContextUninstall
[-] Key Deleted : HKLM\SOFTWARE\Classes\QMContextUninstall.QMContextUninstallMenu
[-] Key Deleted : HKLM\SOFTWARE\Classes\QMContextUninstall.QMContextUninstallMenu.1
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{51BEE30D-EEC8-4BA3-930B-298B8E759EB1}
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1E9BD312-7C8C-4422-906D-897F6D7714F2}
[-] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{7A30415C-ABEE-4674-B64B-4CA145EEB0CA}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{70DE12EA-79F4-46BC-9812-86DB50A2FD64}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{50F4150A-48B2-417A-BE4C-C83F580FB904}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{63332668-8CE1-445D-A5EE-25929176714E}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{754DF2CE-51E8-4895-B53C-6381418B84AE}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{29B6CFD5-0064-411A-8C42-9890C83F9921}
[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E52EB753-1F56-4DF7-BE53-2C314AC5F8A1}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E7270EC6-0113-4A78-B610-E501D0A9E48E}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D4801E96-E7A1-45F6-B124-7A36DFB40B81}
[-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E52EB753-1F56-4DF7-BE53-2C314AC5F8A1}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{35627C7C-DB28-4772-9A6F-7607FFCBF9FF}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{445E3964-15B0-472A-95F4-6242DD2EA066}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{573F9869-D92C-4B7E-A9C3-F042278D5078}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{593BE60A-1C6A-44F9-946D-A5EAB2D53511}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{6E1533F0-E0B5-465A-9F16-98FF0C76D493}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C049F583-D724-4BAB-8F47-F13BCA41B808}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{50F4150A-48B2-417A-BE4C-C83F580FB904}
[-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{29B6CFD5-0064-411A-8C42-9890C83F9921}
[-] Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved [{63332668-8CE1-445D-A5EE-25929176714E}]
[-] Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved [{754DF2CE-51E8-4895-B53C-6381418B84AE}]
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PopupProduct
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{365ADADE-814B-400C-877C-95E9F684BBEB}
[-] Data Restored : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
[-] Data Restored : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
[-] Data Restored : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
[-] Data Restored : HKU\S-1-5-21-2472899907-1604452211-935407213-1001\Software\Microsoft\Internet Explorer\Main [Start Page]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{82D9C473-2D97-428C-A409-EBB198731E9C}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{52D109BA-1C48-4DAA-A7EC-D00F820D3AFB}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{FF5B06E8-21DC-4CF4-9158-81AD115A2475}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{491FCB4C-B249-4025-8CB4-EE4000CFE774}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{347195AA-E229-4564-BEF4-517A0F0C0409}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{CC677246-B20D-49B7-B32E-909BBC09A4AF}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{CE8B7490-A48E-4A24-8D15-C3C7087CA891}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{9607B9A9-9A66-414A-8CE0-EE542240469D}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{44F2C5E0-DBF0-4EF4-8386-679FC9198D27}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{63890222-C44E-413A-8A3C-9C7B35F63D67}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{6D3FB261-2114-4A99-9D68-7390B82742D9}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{2A9CE69E-F549-4049-8CC1-E5357914951B}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{D7F9DD3F-EF99-4A3B-A8E8-DB696C6682F8}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{32971A39-B97D-48B1-9230-8E7E713024B9}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{DEF4880F-337F-4A32-9BC9-39705962CEBB}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{9B6754D9-BFE0-4C5A-9B9E-9E7D1E99BBD6}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{74DDF6E6-EEFE-4FE5-B55C-4BA6C7AE4526}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{12BD19D5-8906-419A-85A8-41928D8E5CEE}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{E9E447E5-F41D-409D-BB1B-912C1BF94A3C}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{4CDA80AF-9E28-41A0-9B82-8C4B8D0DC7DB}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{48EA8908-D563-4370-9117-DCBFAE38EB66}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{6366A041-76E0-4A70-AC11-C85C4FE088E9}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{5F58CE07-55EC-445A-9686-1F2AD2D38983}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{B872AAC2-A9B0-4CA3-BE02-DCE0256A32C5}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{28FA86E9-6646-4A29-8F72-26A0CFA0DCD6}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{47005EFD-8E05-428B-8062-21198CB5143B}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{EDACF653-D870-42D2-A1C0-6FAD88B07037}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{EC6E757F-95B1-4794-8163-DE411C1BBCB3}]
[-] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules [{CCE1D71F-D18C-49EB-95EE-66117682F4F7}]
[-] Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
[-] Data Restored : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes [DefaultScope]
[-] Data Restored : HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command []
[-] Data Restored : HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command []
[-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\mini2015.qq.com
[-] Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\winzipersvc
[-] Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\qkseeService
[-] Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\GoogleChromeUpService
[-] [C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\prefs.js] Deleted : user_pref("browser.newtab.url", "hxxp://www.hohosearch.com/?ts=AHEqAn4rB38sC0..&v=20160513&uid=D65811CD2053B48C3A5F6FABEFC539D4&ptid=ftp&mode=loadm");
[-] [C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\prefs.js] Deleted : user_pref("browser.search.defaultenginename", "hohosearch");
[-] [C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\prefs.js] Deleted : user_pref("browser.search.defaultenginename.US", "data:text/plain,browser.search.defaultenginename.US=hohosearch");
[-] [C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\prefs.js] Deleted : user_pref("browser.search.searchengine.hp", "hxxp://www.hohosearch.com/?ts=AHEqAn4rB38sC0..&v=20160513&uid=D65811CD2053B48C3A5F6FABEFC539D4&ptid=ftp&mode=loadm");
[-] [C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\prefs.js] Deleted : user_pref("browser.search.searchengine.sp", "hxxp://www.hohosearch.com/chrome.php?mode=ffsengext&ptid=ftp&q={searchTerms}&ts=AHEqAn4rB38sC0..&uid=D65811CD2053B48C3A5F6FABEFC539D4&v=20160513");
[-] [C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\prefs.js] Deleted : user_pref("browser.search.searchengine.uid", "D65811CD2053B48C3A5F6FABEFC539D4");
[-] [C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\prefs.js] Deleted : user_pref("browser.search.searchengine.url", "hxxp://www.hohosearch.com/chrome.php?mode=ffsengext&ptid=ftp&q={searchTerms}&ts=AHEqAn4rB38sC0..&uid=D65811CD2053B48C3A5F6FABEFC539D4&v=20160513");
[-] [C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\prefs.js] Deleted : user_pref("browser.search.selectedEngine", "hohosearch");
[-] [C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\prefs.js] Deleted : user_pref("browser.startup.homepage", "hxxp://www.hohosearch.com/?ts=AHEqAn4rB38sC0..&v=20160513&uid=D65811CD2053B48C3A5F6FABEFC539D4&ptid=ftp&mode=loadm");
[-] [C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\prefs.js] Deleted : user_pref("extensions.mywebsearch.prevKwdEnabled", true);
[-] [C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\prefs.js] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.BUTTON_STRUCTURE", "[{\"b\":224520315,\"c\":\"mindspark.magnify\",\"p\":\"L.0\"},{\"b\":224520316,\"c\":\"mindspark.entersearchterms\",\"p\":\"L.0.0[...]
[-] [C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\prefs.js] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.browser.version.last", "46.0");
[-] [C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\prefs.js] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.firstKnownVersion", "7.38.8.45986");
[-] [C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\prefs.js] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.homepage", "/index.jhtml?n=782a813d");
[-] [C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\prefs.js] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.hp.enabled", true);
[-] [C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\prefs.js] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.hp.guardType", "HPR");
[-] [C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\prefs.js] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.initialized", true);
[-] [C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\prefs.js] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.installation.installDate", "2016051517");
[-] [C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\prefs.js] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.installation.success", true);
[-] [C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\prefs.js] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.lastActivePing", "1466240765863");
[-] [C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\prefs.js] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.lastKnownVersion", "7.38.8.45986");
[-] [C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\prefs.js] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.lssState", "{\"previousLocales\":[\"en-US\",\"en\"],\"supportedLocales\":[\"de\",\"es\",\"pt\",\"ja\",\"en\"],\"defaultLocale\":\"en\",\"supportedLo[...]
[-] [C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\prefs.js] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.options.defaultSearch", false);
[-] [C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\prefs.js] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.options.homePageEnabled", false);
[-] [C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\prefs.js] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.options.keywordEnabled", true);
[-] [C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\prefs.js] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.options.tabEnabled", false);
[-] [C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\prefs.js] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.productDeliveryOption.language", "en");
[-] [C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\prefs.js] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.productDeliveryOption.type", "Toolbar");
[-] [C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\prefs.js] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.searchHistory", "roy bennettshear walls");
[-] [C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\prefs.js] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.successUrl", "hxxp://www.hohosearch.com/chrome.php?uid=D65811CD2053B48C3A5F6FABEFC539D4&ptid=ftp&ts=AHEqAn4rB38sC0..&v=20160513&mode=ffexttoolbar&q=[...]
[-] [C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\prefs.js] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.toolbarCollapsed", false);
[-] [C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\prefs.js] Deleted : user_pref("extensions.toolbar.mindspark._brMembers_.uninstallTasks", "{\"prefBranchesToDelete\":[\"extensions.toolbar.mindspark._brMembers_.\"],\"filesToDelete\":[\"C:\\\\Users\\\\oliver\\\\AppData\\\[...]
[-] [C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\prefs.js] Deleted : user_pref("extensions.toolbar.mindspark.hp.enabled", true);
[-] [C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\prefs.js] Deleted : user_pref("keyword.URL", "hxxp://www.hohosearch.com/chrome.php?uid=D65811CD2053B48C3A5F6FABEFC539D4&ptid=ftp&ts=AHEqAn4rB38sC0..&v=20160513&mode=ffexttoolbar&q=");
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:19-05-2016
Ran by oliver (administrator) on TOSHIBA (18-06-2016 13:12:46)
Running from C:\Users\oliver\Desktop
Loaded Profiles: oliver (Available Profiles: oliver & Administrator)
Platform: Windows 8.1 Single Language (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: "C:\Program Files (x86)\Weness\Application\chrome.exe" "%1")
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe
(Windows ® Win 7 DDK provider) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe
(Toshiba Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Vodafone) C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
(Tencent) C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QQPCRTP.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Tencent) C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QQPCTray.exe
() C:\Program Files (x86)\3G Voice Modem\HSPALauncher.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Tencent) C:\Program Files (x86)\Common Files\Tencent\QQDownload\130\Tencentdl.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(TODO: <Company name>) C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [TSSSrv] => C:\Program Files (x86)\TOSHIBA\System Setting\TSSSrv.exe [296520 2013-09-11] (TOSHIBA Corporation)
HKLM-x32\...\Run: [HSDPALauncher] => C:\Program Files (x86)\3G Voice Modem\HSPALauncher.exe [233472 2012-02-22] ()
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [RIMBBLaunchAgent.exe] => C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [267792 2013-01-17] (Research In Motion Limited)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1085656 2015-12-18] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ic-0.9d8fbedaf301b8.exe -start] => C:\Users\oliver\AppData\Local\Temp\113257328\ic-0.9d8fbedaf301b8.exe -start <===== ATTENTION
HKLM-x32\...\Run: [ QQPCTray] => C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QQPCTray.exe [362304 2016-05-13] (Tencent)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [7390096 2016-06-15] (AVAST Software)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\!SASWinLogon-x32: C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.DLL [X]
HKU\S-1-5-21-2472899907-1604452211-935407213-1001\...\MountPoints2: {19471a77-b763-11e3-8259-a4db30eaa69f} - "E:\autorun.exe"
HKU\S-1-5-21-2472899907-1604452211-935407213-1001\...\MountPoints2: {19471aa6-b763-11e3-8259-a4db30eaa69f} - "F:\autorun.exe"
HKU\S-1-5-21-2472899907-1604452211-935407213-1001\...\MountPoints2: {19471c18-b763-11e3-8259-a4db30eaa69f} - "E:\setup_vmc_lite.exe" /checkApplicationPresence
HKU\S-1-5-21-2472899907-1604452211-935407213-1001\...\MountPoints2: {19471d04-b763-11e3-8259-a4db30eaa69f} - "E:\setup_vmc_lite.exe" /checkApplicationPresence
HKU\S-1-5-21-2472899907-1604452211-935407213-1001\...\MountPoints2: {207c0123-c1a6-11e3-825e-a4db30eaa69f} - "E:\setup_vmc_lite.exe" /checkApplicationPresence
HKU\S-1-5-21-2472899907-1604452211-935407213-1001\...\MountPoints2: {207c0976-c1a6-11e3-825e-a4db30eaa69f} - "E:\setup_vmc_lite.exe" /checkApplicationPresence
HKU\S-1-5-21-2472899907-1604452211-935407213-1001\...\MountPoints2: {63fe9841-0c39-11e5-8264-a4db30eaa69f} - "E:\setup_vmc_lite.exe" /checkApplicationPresence
HKU\S-1-5-21-2472899907-1604452211-935407213-1001\...\MountPoints2: {63fe9936-0c39-11e5-8264-a4db30eaa69f} - "E:\setup_vmc_lite.exe" /checkApplicationPresence
HKU\S-1-5-21-2472899907-1604452211-935407213-1001\...\MountPoints2: {b09f42fb-8162-11e4-825f-a4db30eaa69f} - "E:\setup_vmc_lite.exe" /checkApplicationPresence
HKU\S-1-5-21-2472899907-1604452211-935407213-1001\...\MountPoints2: {cd6cbf1e-6786-11e4-825f-a4db30eaa69f} - "E:\setup_vmc_lite.exe" /checkApplicationPresence
HKU\S-1-5-21-2472899907-1604452211-935407213-1001\...\MountPoints2: {e6d772f0-fa56-11e4-8261-a4db30eaa69f} - "E:\setup_vmc_lite.exe" /checkApplicationPresence
ShellExecuteHooks-x32: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files (x86)\SUPERAntiSpyware\SASSEH.DLL No File [ ]
ShellIconOverlayIdentifiers: [.QMDeskTopGCIcon] -> {B7667919-3765-4815-A66D-98A09BE662D6} => C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QMGCShellExt64.dll [2016-05-13] (Tencent)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2016-06-15] (AVAST Software)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 168.210.2.2 196.14.239.2
Tcpip\..\Interfaces\{290EC7AD-1445-480D-A04F-A1F7C70EF173}: [DhcpNameServer] 168.210.2.2 196.14.239.2
Tcpip\..\Interfaces\{2DE2FEA3-6B46-4870-967F-A3D0A56DA5D4}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{6965B23C-CD2F-42AA-959F-E29AA033569C}: [DhcpNameServer] 192.168.42.129
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.2345.com/?34838
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-2472899907-1604452211-935407213-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.2345.com/?34838
HKU\S-1-5-21-2472899907-1604452211-935407213-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.toshibamea.com
HKU\S-1-5-21-2472899907-1604452211-935407213-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.toshibamea.com
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKU\S-1-5-21-2472899907-1604452211-935407213-1001 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
BHO: 电脑管家网页防火墙 -> {7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B} -> C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\TSWebMon64.dat [2016-05-13] (Tencent)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2016-06-15] (AVAST Software)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-06-15] (AVAST Software)
FireFox:
========
FF ProfilePath: C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default
FF Keyword.URL: undefined://undefined/
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-03] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-03] (Intel Corporation)
FF Plugin-x32: @RIM.com/WebSLLauncher,version=1.0 -> C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll [2012-12-13] ()
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-06-18] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-06-18] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2012-03-17] (VideoLAN)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2013-07-13] ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-12-18] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\searchplugins\isdnex4i.xml [2016-05-13]
FF Extension: GsearchFinder - C:\Users\oliver\AppData\Roaming\Profiles\iv2umxhy.default\Extensions\@E9438230-A7DF-4D1F-8F2D-CA1D0F0F7924.xpi [2016-05-13]
FF HKLM\...\Firefox\Extensions: [
[email protected]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-06-15]
FF HKLM-x32\...\Firefox\Extensions: [
[email protected]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
Chrome:
=======
CHR Profile: C:\Users\oliver\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\oliver\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-06-18]
CHR Extension: (Google Docs) - C:\Users\oliver\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-06-18]
CHR Extension: (Google Drive) - C:\Users\oliver\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-06-18]
CHR Extension: (YouTube) - C:\Users\oliver\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-06-18]
CHR Extension: (Google Sheets) - C:\Users\oliver\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-06-18]
CHR Extension: (Google Docs Offline) - C:\Users\oliver\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-06-18]
CHR Extension: (Chrome Web Store Payments) - C:\Users\oliver\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-06-18]
CHR Extension: (Gmail) - C:\Users\oliver\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-06-18]
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [312448 2013-08-22] (Windows ® Win 7 DDK provider) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [243296 2016-06-15] (AVAST Software)
R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [370656 2016-06-15] (AVAST Software)
R3 Blackberry Device Manager; C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [577536 2013-01-18] (Research In Motion Limited) [File not signed]
R2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [235008 2013-07-16] (TODO: <Company name>) [File not signed]
R2 Intel® Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel® Corporation) [File not signed]
S3 Intel® Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel® Corporation)
R2 Intel® ME Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-03] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [169432 2013-09-03] (Intel Corporation)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [219752 2014-06-20] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [279488 2016-01-25] (McAfee, Inc.)
R2 QQPCRtp; C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QQPCRTP.exe [313936 2016-05-13] (Tencent)
U2 QQRepairdac; C:\Program Files (x86)\Tencent\QQPCMGR\QQRepairdac [147176 2016-06-18] ()
S2 QQRepairFixSVC; C:\Program Files (x86)\Tencent\QQPCMGR\QQRepairFixSVC [147176 2016-06-18] ()
S4 THAccelSvc; C:\Program Files\TOSHIBA\HDD Accelerator\THAccelSvc.exe [216976 2013-07-16] (TOSHIBA CORPORATION)
R2 VMCService; C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [14336 2008-07-04] (Vodafone) [File not signed]
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)
S2 QQRepairf54; "C:\Program Files (x86)\Tencent\QQPCMGR\QQRepairf54" [X]
S2 Quoteex; C:\ProgramData\\Quoteex\\Quoteex.exe shuz -f "C:\ProgramData\\Quoteex\\Quoteex.dat" -l -a
S2 WenessU; "C:\Program Files (x86)\Weness\Update\WenessUpdate.exe" [X]
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [37656 2016-06-15] (AVAST Software)
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [37144 2016-06-15] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [107792 2016-06-15] (AVAST Software)
R1 aswNetSec; C:\Windows\system32\drivers\aswNetSec.sys [536312 2016-06-15] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [103064 2016-06-15] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [74544 2016-06-15] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1070904 2016-06-15] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [465792 2016-06-15] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [166432 2016-06-15] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [287528 2016-06-15] (AVAST Software)
R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3858944 2013-10-24] (Qualcomm Atheros Communications, Inc.)
S3 cfwids; C:\Windows\System32\drivers\cfwids.sys [72128 2014-06-20] (McAfee, Inc.)
S3 dg_ssudbus; C:\Windows\system32\DRIVERS\ssudbus.sys [129152 2016-04-25] (Samsung Electronics Co., Ltd.)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-03] (Intel Corporation)
S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [181704 2014-06-20] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [351656 2016-01-29] (McAfee, Inc.)
S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [70600 2014-06-20] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [523792 2014-06-20] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [847608 2016-01-29] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [348552 2014-06-20] (McAfee, Inc.)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3344352 2013-07-08] (Intel Corporation)
R1 QMUdisk; C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QMUdisk64.sys [184952 2016-05-18] (Tencent)
R2 qqsysmonx64; C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QQSysMonX64.sys [154744 2016-05-13] (电脑管家)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [78336 2013-01-03] (Research In Motion Limited)
R3 RimVSerPort; C:\Windows\system32\DRIVERS\RimSerial_AMD64.sys [44544 2012-12-10] (Research in Motion Ltd)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2014-08-06] (Synaptics Incorporated)
R1 softaal; C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\softaal64.sys [44664 2016-05-13] (Tencent)
R1 SRepairDrv; \??\C:\Program Files (x86)\Tencent\QQPCMGR\SRepairDrv [179320 2016-06-18] ()
R3 TAOAccelerator; C:\WINDOWS\system32\Drivers\TAOAccelerator64.sys [99480 2016-05-13] (Tencent)
R2 TAOKernelDriver; C:\WINDOWS\system32\Drivers\TAOKernelEx64.sys [143992 2016-05-13] (Tencent Technology(Shenzhen) Company Limited)
R1 TFsFlt; C:\Windows\System32\Drivers\TFsFltX64.sys [97400 2016-05-13] (电脑管家)
R0 THAccel; C:\Windows\System32\DRIVERS\THAccel.sys [110976 2013-03-25] (TOSHIBA Corporation)
R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [32624 2013-08-19] (Windows ® Win 7 DDK provider)
R3 TS888x64; C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\TS888x64.sys [38520 2016-06-18] (Tencent)
S1 TSDefenseBt; C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\TSDefenseBT64.sys [28984 2016-05-13] (Tencent)
R2 tsnethlpx64; C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\TsNetHlpX64.sys [57976 2016-05-13] ()
R1 TSSysKit; C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\TSSysKit64.sys [96888 2016-05-13] (电脑管家)
S3 usbrndis6; C:\Windows\System32\drivers\usb80236.sys [20992 2015-04-25] (Microsoft Corporation)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)
S3 wirelessusbser; C:\Windows\system32\DRIVERS\3GDatausbser64.sys [120832 2009-11-09] (Haier Incorporated)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-06-18 13:11 - 2016-06-18 13:12 - 00030159 _____ C:\Users\oliver\Desktop\Addition.txt
2016-06-18 13:09 - 2016-06-18 13:12 - 00020967 _____ C:\Users\oliver\Desktop\FRST.txt
2016-06-18 13:03 - 2016-06-18 13:03 - 00038520 _____ (Tencent) C:\WINDOWS\SysWOW64\Drivers\TS888x64.sys
2016-06-18 13:03 - 2016-05-13 23:13 - 00143992 _____ (Tencent Technology(Shenzhen) Company Limited) C:\WINDOWS\system32\Drivers\TAOKernelEx64.sys
2016-06-18 13:03 - 2016-05-13 23:13 - 00099480 _____ (Tencent) C:\WINDOWS\system32\Drivers\TAOAccelerator64.sys
2016-06-18 13:01 - 2016-06-18 13:03 - 00000000 ____D C:\ProgramData\TXQMPC
2016-06-18 12:47 - 2016-06-18 12:47 - 00002286 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-06-18 12:46 - 2016-06-18 12:45 - 03703360 _____ C:\Users\oliver\Desktop\AdwCleaner(1).exe
2016-06-18 12:42 - 2016-06-18 12:45 - 03703360 _____ C:\Users\oliver\Downloads\AdwCleaner(1).exe
2016-06-18 12:31 - 2016-06-18 13:04 - 00000910 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2016-06-18 12:31 - 2016-06-18 12:36 - 00000914 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2016-06-18 12:31 - 2016-06-18 12:31 - 00003886 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2016-06-18 12:31 - 2016-06-18 12:31 - 00003650 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2016-06-18 12:31 - 2016-06-18 12:31 - 00000000 ____D C:\Users\oliver\AppData\Local\Google
2016-06-18 12:29 - 2016-06-18 12:29 - 00987728 _____ (Google Inc.) C:\Users\oliver\Desktop\ChromeSetup.exe
2016-06-17 12:55 - 2016-06-18 12:57 - 00000000 ____D C:\AdwCleaner
2016-06-17 12:22 - 2016-06-17 12:22 - 00406618 _____ C:\Users\oliver\Downloads\TYRIS Organogram Mar 2015.pdf
2016-06-17 11:54 - 2016-06-17 12:27 - 44782080 _____ C:\Users\oliver\Downloads\AlwaysOn-WiFi.msi
2016-06-17 10:23 - 2016-06-17 10:23 - 00004847 _____ C:\Users\oliver\Desktop\JRT.txt
2016-06-17 10:18 - 2016-06-17 10:05 - 01610816 _____ (Malwarebytes) C:\Users\oliver\Desktop\JRT.exe
2016-06-17 10:15 - 2016-06-17 10:16 - 03703360 _____ C:\Users\oliver\Downloads\AdwCleaner (1).exe
2016-06-17 10:14 - 2016-06-17 10:17 - 03703360 _____ C:\Users\oliver\Downloads\AdwCleaner.exe
2016-06-17 10:00 - 2016-06-17 10:05 - 01610816 _____ (Malwarebytes) C:\Users\oliver\Downloads\JRT.exe
2016-06-17 09:53 - 2016-06-17 09:53 - 00005274 _____ C:\Users\oliver\Desktop\LDReport.txt
2016-06-16 06:36 - 2016-06-16 06:36 - 00001879 _____ C:\Users\oliver\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\avast! antivirus.lnk
2016-06-15 22:49 - 2016-06-15 22:49 - 00001949 _____ C:\Users\Public\Desktop\Avast Internet Security.lnk
2016-06-15 22:49 - 2016-06-15 22:49 - 00000000 ____D C:\Users\oliver\AppData\Roaming\AVAST Software
2016-06-15 22:49 - 2016-06-15 22:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2016-06-15 22:48 - 2016-06-15 22:48 - 00003038 _____ C:\WINDOWS\System32\Tasks\SafeZone scheduled Autoupdate 1466023706
2016-06-15 22:48 - 2016-06-15 22:48 - 00001064 _____ C:\Users\Public\Desktop\Avast SafeZone Browser.lnk
2016-06-15 22:48 - 2016-06-15 22:48 - 00001064 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast SafeZone Browser.lnk
2016-06-15 22:47 - 2016-06-18 11:08 - 00004182 _____ C:\WINDOWS\System32\Tasks\avast! Emergency Update
2016-06-15 22:47 - 2016-06-15 22:47 - 00465792 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys
2016-06-15 22:47 - 2016-06-15 22:47 - 00398152 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2016-06-15 22:47 - 2016-06-15 22:47 - 00287528 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswVmm.sys
2016-06-15 22:47 - 2016-06-15 22:47 - 00166432 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswStm.sys
2016-06-15 22:47 - 2016-06-15 22:47 - 00107792 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys
2016-06-15 22:47 - 2016-06-15 22:47 - 00103064 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys
2016-06-15 22:47 - 2016-06-15 22:47 - 00074544 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRvrt.sys
2016-06-15 22:47 - 2016-06-15 22:47 - 00037656 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswHwid.sys
2016-06-15 22:47 - 2016-06-15 22:46 - 01070904 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSnx.sys
2016-06-15 22:47 - 2016-06-15 22:46 - 00536312 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswNetSec.sys
2016-06-15 22:47 - 2016-06-15 22:46 - 00037144 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswKbd.sys
2016-06-15 22:46 - 2016-06-15 22:46 - 00052184 _____ (AVAST Software) C:\WINDOWS\avastSS.scr
2016-06-15 22:46 - 2016-06-15 22:46 - 00000000 ____D C:\Program Files\AVAST Software
2016-06-15 21:58 - 2016-06-15 21:58 - 00000000 ____D C:\Users\oliver\AppData\Roaming\PDF Software
2016-06-15 20:05 - 2016-06-15 20:05 - 00000000 ____D C:\Users\oliver\AppData\LocalLow\uTorrent
2016-06-15 19:01 - 2016-06-15 19:01 - 00000000 ____D C:\Users\oliver\AppData\Roaming\SUPERAntiSpyware.com
2016-06-15 12:46 - 2016-06-15 12:46 - 00005274 _____ C:\Users\oliver\Desktop\report.txt
2016-06-15 11:35 - 2016-04-12 17:46 - 14467584 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2016-06-15 11:35 - 2016-04-12 17:30 - 12879872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2016-06-15 11:34 - 2016-06-03 19:11 - 00472576 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcasvc.dll
2016-06-15 11:34 - 2016-06-03 15:38 - 01413120 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2016-06-15 11:34 - 2016-06-02 19:51 - 00050352 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2016-06-15 11:34 - 2016-05-29 17:04 - 01204224 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2016-06-15 11:34 - 2016-05-29 17:04 - 00569856 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2016-06-15 11:34 - 2016-05-29 17:04 - 00544256 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2016-06-15 11:34 - 2016-05-29 17:04 - 00276480 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2016-06-15 11:34 - 2016-05-29 17:04 - 00265216 _____ (Microsoft Corporation) C:\WINDOWS\system32\centel.dll
2016-06-15 11:34 - 2016-05-29 17:04 - 00076800 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2016-06-15 11:28 - 2016-05-21 19:28 - 25802752 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2016-06-15 11:28 - 2016-05-21 18:57 - 20341248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2016-06-15 11:28 - 2016-05-21 00:09 - 00572416 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2016-06-15 11:28 - 2016-05-21 00:08 - 02895360 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2016-06-15 11:28 - 2016-05-21 00:02 - 06051328 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2016-06-15 11:28 - 2016-05-20 23:57 - 00497664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2016-06-15 11:28 - 2016-05-20 23:55 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2016-06-15 11:28 - 2016-05-20 23:54 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2016-06-15 11:28 - 2016-05-20 23:50 - 02287104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2016-06-15 11:28 - 2016-05-20 23:44 - 00663552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2016-06-15 11:28 - 2016-05-20 23:29 - 13815808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2016-06-15 11:28 - 2016-05-20 23:27 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2016-06-15 11:28 - 2016-05-20 23:25 - 00315392 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2016-06-15 11:28 - 2016-05-20 23:25 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2016-06-15 11:28 - 2016-05-20 23:21 - 00279040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2016-06-15 11:28 - 2016-05-20 23:21 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2016-06-15 11:28 - 2016-05-20 23:19 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2016-06-15 11:28 - 2016-05-20 23:16 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2016-06-15 11:28 - 2016-05-20 23:14 - 04610048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2016-06-15 11:28 - 2016-05-20 23:12 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2016-06-15 11:28 - 2016-05-20 23:11 - 15420928 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2016-06-15 11:28 - 2016-05-20 23:11 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2016-06-15 11:28 - 2016-05-20 23:09 - 00693248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2016-06-15 11:28 - 2016-05-20 23:09 - 00379392 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2016-06-15 11:28 - 2016-05-20 23:08 - 02055680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2016-06-15 11:28 - 2016-05-20 23:08 - 00806400 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2016-06-15 11:28 - 2016-05-20 23:06 - 02131968 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2016-06-15 11:28 - 2016-05-20 22:46 - 02597888 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2016-06-15 11:28 - 2016-05-20 22:42 - 02121216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2016-06-15 11:28 - 2016-05-20 22:38 - 01310208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2016-06-15 11:28 - 2016-05-20 22:38 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2016-06-15 11:28 - 2016-05-20 22:34 - 01544192 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2016-06-15 11:28 - 2016-05-20 22:23 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2016-06-15 11:28 - 2016-04-14 17:25 - 02778624 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2016-06-15 11:28 - 2016-04-14 17:11 - 02464768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2016-06-15 11:28 - 2016-01-31 21:17 - 00118624 _____ (Microsoft Corporation) C:\WINDOWS\system32\consent.exe
2016-06-15 11:28 - 2016-01-31 20:07 - 00110080 _____ (Microsoft Corporation) C:\WINDOWS\system32\appinfo.dll
2016-06-15 11:28 - 2016-01-31 19:42 - 03320832 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2016-06-15 11:28 - 2016-01-31 19:14 - 03607040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
2016-06-15 10:19 - 2016-06-15 10:19 - 00000072 _____ C:\WINDOWS\SysWOW64\EN_1043541421.html
2016-06-15 10:19 - 2016-05-12 20:38 - 00135336 _____ (Microsoft Corporation) C:\WINDOWS\system32\gpapi.dll
2016-06-15 10:19 - 2016-05-12 19:43 - 00115704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gpapi.dll
2016-06-15 10:19 - 2016-05-12 18:17 - 00331776 _____ (Microsoft Corporation) C:\WINDOWS\system32\polstore.dll
2016-06-15 10:19 - 2016-05-12 18:08 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\FwRemoteSvr.dll
2016-06-15 10:19 - 2016-05-12 18:07 - 01360896 _____ (Microsoft Corporation) C:\WINDOWS\system32\gpsvc.dll
2016-06-15 10:19 - 2016-05-12 17:59 - 00398848 _____ (Microsoft Corporation) C:\WINDOWS\system32\IPSECSVC.DLL
2016-06-15 10:19 - 2016-05-12 17:43 - 00291328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\polstore.dll
2016-06-15 10:19 - 2016-05-12 17:37 - 00050176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FwRemoteSvr.dll
2016-06-15 10:18 - 2016-06-15 10:18 - 00000073 _____ C:\WINDOWS\SysWOW64\EN_1043478453.html
2016-06-15 10:18 - 2016-06-15 10:18 - 00000072 _____ C:\WINDOWS\SysWOW64\EN_1043488625.html
2016-06-15 10:18 - 2016-06-15 10:18 - 00000072 _____ C:\WINDOWS\SysWOW64\EN_1043488218.html
2016-06-15 10:18 - 2016-06-15 10:18 - 00000072 _____ C:\WINDOWS\SysWOW64\EN_1043485718.html
2016-06-15 10:18 - 2016-06-15 10:18 - 00000072 _____ C:\WINDOWS\SysWOW64\EN_1043485218.html
2016-06-15 10:18 - 2016-06-15 10:18 - 00000072 _____ C:\WINDOWS\SysWOW64\EN_1043479796.html
2016-06-15 10:18 - 2016-06-15 10:18 - 00000072 _____ C:\WINDOWS\SysWOW64\EN_1043477031.html
2016-06-15 10:18 - 2016-06-15 10:18 - 00000072 _____ C:\WINDOWS\SysWOW64\EN_1043476609.html
2016-06-15 10:18 - 2016-05-06 17:45 - 00748544 _____ (Microsoft Corporation) C:\WINDOWS\system32\StructuredQuery.dll
2016-06-15 10:18 - 2016-05-06 17:23 - 00503808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StructuredQuery.dll
2016-06-15 10:17 - 2016-06-15 10:17 - 00000072 _____ C:\WINDOWS\SysWOW64\us_1043430578.html
2016-06-15 10:17 - 2016-06-15 10:17 - 00000072 _____ C:\WINDOWS\SysWOW64\EN_1043460046.html
2016-06-15 10:17 - 2016-06-15 10:17 - 00000072 _____ C:\WINDOWS\SysWOW64\EN_1043456687.html
2016-06-15 10:17 - 2016-06-15 10:17 - 00000072 _____ C:\WINDOWS\SysWOW64\EN_1043431593.html
2016-06-15 10:17 - 2016-06-15 10:17 - 00000000 ____D C:\WINDOWS\SysWOW64\_tWm
2016-06-15 10:17 - 2016-05-09 23:35 - 07075328 _____ (Microsoft Corporation) C:\WINDOWS\system32\glcndFilter.dll
2016-06-15 10:17 - 2016-05-09 22:56 - 05270016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\glcndFilter.dll
2016-06-15 10:17 - 2016-05-09 22:45 - 07793152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2016-06-15 10:17 - 2016-05-09 22:23 - 05265920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2016-06-15 10:09 - 2016-05-14 01:09 - 04169216 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2016-06-15 09:51 - 2016-05-16 23:13 - 00563016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2016-06-15 09:51 - 2016-05-16 23:13 - 00397224 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcryptprimitives.dll
2016-06-15 09:51 - 2016-05-16 23:13 - 00340872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcryptprimitives.dll
2016-06-15 09:51 - 2016-05-16 23:13 - 00178008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2016-06-15 09:51 - 2016-05-14 01:07 - 00675328 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv2.sys
2016-06-15 09:51 - 2016-05-14 01:07 - 00416768 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv.sys
2016-06-15 09:51 - 2016-05-14 01:06 - 00243712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srvnet.sys
2016-06-15 09:51 - 2016-05-14 00:34 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2016-06-15 09:51 - 2016-05-13 23:58 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2016-06-15 09:50 - 2016-05-19 01:15 - 01379040 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll
2016-06-15 09:50 - 2016-05-18 22:35 - 01097216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll
2016-06-15 09:50 - 2016-05-18 07:31 - 00372568 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2016-06-15 09:50 - 2016-05-18 07:31 - 00315224 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2016-06-15 09:50 - 2016-05-14 22:01 - 00363104 _____ (Microsoft Corporation) C:\WINDOWS\system32\ws2_32.dll
2016-06-15 09:50 - 2016-05-14 22:01 - 00320720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ws2_32.dll
2016-06-15 09:50 - 2016-05-14 01:07 - 00281088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netbt.sys
2016-06-15 09:50 - 2016-05-14 01:04 - 00044032 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2016-06-15 09:50 - 2016-05-14 00:19 - 00035840 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2016-06-15 09:50 - 2016-05-13 23:58 - 00339456 _____ (Microsoft Corporation) C:\WINDOWS\system32\mswsock.dll
2016-06-15 09:50 - 2016-05-13 23:45 - 00802816 _____ (Microsoft Corporation) C:\WINDOWS\system32\winhttp.dll
2016-06-15 09:50 - 2016-05-13 23:35 - 00286208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mswsock.dll
2016-06-15 09:50 - 2016-05-13 23:26 - 00631808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winhttp.dll
2016-06-15 09:49 - 2016-06-15 09:49 - 01415179 _____ C:\Users\oliver\Downloads\gibela_supplier_day_get_on_board_presentation.pdf
2016-06-15 09:49 - 2016-06-15 09:49 - 00140782 _____ C:\Users\oliver\Downloads\gibela_supplier_specs_.pdf
2016-06-15 09:48 - 2016-06-15 09:48 - 00605642 _____ C:\Users\oliver\Downloads\gibela_8steps_factsheet.pdf
2016-06-15 09:48 - 2016-06-15 09:48 - 00283988 _____ C:\Users\oliver\Downloads\gibela_supplier_support.pdf
2016-06-15 09:37 - 2016-06-15 09:42 - 3354066944 _____ C:\Users\oliver\Downloads\Zootropolis[HowardMoore2016]byKenzo[dvd9].iso
2016-06-10 10:41 - 2016-06-10 10:41 - 09651146 _____ C:\Users\oliver\Downloads\1505111_Ramadaan_8Pg_Inland-8_compressed.pdf
2016-06-10 09:23 - 2016-06-10 09:23 - 00000000 ____D C:\ProgramData\Office Genuine Advantage
2016-06-06 15:20 - 2016-06-06 15:20 - 00000127 _____ C:\Users\oliver\Desktop\ckfiles.txt
2016-06-06 11:17 - 2016-06-06 11:17 - 00007360 _____ C:\Users\oliver\Downloads\Walls09 21 16.23.3912_Shaft Wall_Elevator Door Rough Opening.pdf
2016-06-06 11:16 - 2016-06-06 11:16 - 00039417 _____ C:\Users\oliver\Downloads\Walls09 21 16.23.3910_Shaft Wall_Lobby Elevator Door Elevation.pdf
2016-06-06 11:15 - 2016-06-06 17:27 - 00015505 _____ C:\Users\oliver\Desktop\Meilijian-Erf- Dingani1.xlsx
2016-06-06 10:53 - 2016-06-06 10:53 - 00398495 _____ C:\Users\oliver\Downloads\WallsCEMCO SURE-BOARD 200W.pdf
2016-06-06 10:44 - 2016-06-06 10:44 - 02384017 _____ C:\Users\oliver\Downloads\Walls-shaft-wall-systems-catalog-en-SA926.pdf
2016-06-06 09:45 - 2016-06-06 09:46 - 00000000 ___DC C:\Users\oliver\AppData\Local\MigWiz
2016-06-05 09:27 - 2016-06-16 16:19 - 00000000 ____D C:\Users\oliver\Desktop\FlashDrive
2016-06-03 09:04 - 2016-06-15 13:22 - 798703020 _____ C:\Users\oliver\Downloads\[ www.UsaBit.com ] - Sofia the First The Floating Palace 2013 DVDRIP XVID AC3 ACAB.avi
2016-06-03 08:31 - 2016-06-03 08:31 - 00251202 _____ C:\Users\oliver\Desktop\KingdomPT.Profile.pdf
2016-06-01 13:14 - 2016-06-01 13:14 - 02031992 _____ (Microsoft Corporation) C:\Users\oliver\Desktop\MGADiag (1).exe
2016-06-01 13:14 - 2016-06-01 13:08 - 00468480 _____ () C:\Users\oliver\Desktop\CKScanner.exe
2016-05-30 09:46 - 2016-05-30 09:48 - 00000000 ___HD C:\$WINDOWS.~BT
2016-05-24 13:01 - 2016-05-24 13:05 - 00271415 _____ C:\Users\oliver\Desktop\QuotatonParkingCampaignParkingFloorCRST.pdf
2016-05-23 21:22 - 2016-05-23 21:22 - 00000000 ____D C:\Users\oliver\AppData\Local\Avg2015
2016-05-23 13:52 - 2016-05-23 13:53 - 00122409 _____ C:\Users\oliver\Downloads\FW__INQUIRY_ABOUT_SUBCONTRACTING_WORK_.zip.part
2016-05-23 13:48 - 2016-05-23 13:49 - 00207725 _____ C:\Users\oliver\Downloads\SEEKING_SUBCONTRACTING_WORK.zip
2016-05-23 09:45 - 2016-05-23 14:23 - 404512768 _____ C:\Users\oliver\Downloads\Lepoard Boot.cdr
2016-05-20 21:26 - 2016-05-20 22:05 - 00000000 ____D C:\Users\oliver\Desktop\Linkedin
2016-05-20 12:28 - 2016-06-18 13:12 - 00000000 ____D C:\FRST
2016-05-20 12:20 - 2016-05-20 12:23 - 02382336 _____ (Farbar) C:\Users\oliver\Desktop\FRST64.exe
2016-05-19 18:57 - 2016-05-19 18:57 - 00172080 _____ C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS
2016-05-19 18:57 - 2016-05-19 18:57 - 00032304 ____R (Symantec Corporation) C:\WINDOWS\system32\Drivers\SymIMV.sys
2016-05-19 18:57 - 2016-05-19 18:57 - 00010655 _____ C:\WINDOWS\system32\Drivers\SYMEVENT64x86.CAT
2016-05-19 18:57 - 2016-05-19 18:57 - 00000000 ____D C:\Program Files\Symantec
2016-05-19 18:57 - 2016-05-19 18:57 - 00000000 ____D C:\Program Files\Common Files\Symantec Shared
2016-05-19 18:56 - 2016-05-19 18:57 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Internet Security
2016-05-19 18:56 - 2016-05-19 18:56 - 00000000 ____D C:\WINDOWS\system32\Drivers\NISx64
2016-05-19 18:56 - 2016-05-19 18:56 - 00000000 ____D C:\Program Files (x86)\Norton Internet Security
2016-05-19 18:55 - 2016-05-19 18:55 - 00000000 ____D C:\Program Files (x86)\NortonInstaller
2016-05-19 18:38 - 2016-06-15 22:06 - 00000000 ____D C:\ProgramData\MFAData
2016-05-19 18:38 - 2016-05-19 18:38 - 00000000 ____D C:\Users\oliver\AppData\Local\MFAData
2016-05-19 10:01 - 2016-05-23 09:05 - 377196995 _____ C:\Users\oliver\Downloads\AVG Antivirus Pro 2015 15.0 Build 6081 (x86x64) Multilingual + Keys [4realtorrentz].rar
2016-05-19 09:25 - 2016-06-15 22:16 - 00000000 ____D C:\ProgramData\Avg
2016-05-19 09:24 - 2016-06-15 22:16 - 00000000 ____D C:\Users\oliver\AppData\Local\AvgSetupLog
2016-05-19 09:24 - 2016-05-19 09:24 - 00000000 ____D C:\Users\oliver\AppData\Local\Avg
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-06-18 13:08 - 2014-10-20 11:25 - 00003596 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2472899907-1604452211-935407213-1001
2016-06-18 13:04 - 2016-05-13 23:11 - 00000000 ____D C:\ProgramData\Tencent
2016-06-18 13:03 - 2013-08-22 16:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-06-18 12:58 - 2016-05-18 09:32 - 00000000 ____D C:\WINDOWS\system32\log
2016-06-18 12:47 - 2016-05-18 09:44 - 00002298 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-06-18 12:47 - 2016-05-17 10:18 - 00000000 ____D C:\Program Files (x86)\Google
2016-06-18 12:44 - 2016-05-18 09:20 - 00000000 _____ C:\Users\Public\Documents\report.dat
2016-06-18 12:35 - 2013-09-22 19:59 - 00863592 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-06-18 12:35 - 2013-08-22 15:36 - 00000000 ____D C:\WINDOWS\Inf
2016-06-18 11:34 - 2016-02-19 22:27 - 00000000 ____D C:\Users\oliver\AppData\Local\Research In Motion
2016-06-18 11:21 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-06-18 11:20 - 2013-08-22 17:36 - 00000000 ___HD C:\Program Files\WindowsApps
2016-06-18 11:08 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\NDF
2016-06-17 11:49 - 2016-05-13 23:11 - 00000000 ____D C:\Users\oliver\AppData\Roaming\Tencent
2016-06-17 11:01 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\rescache
2016-06-17 09:36 - 2016-01-17 17:43 - 00000000 ____D C:\Program Files (x86)\SMADAV
2016-06-16 18:57 - 2013-08-22 16:44 - 00481208 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2016-06-16 16:25 - 2016-03-03 22:01 - 00000000 ____D C:\WINDOWS\system32\appraiser
2016-06-16 16:25 - 2013-08-22 17:36 - 00000000 ___RD C:\WINDOWS\ToastData
2016-06-16 16:21 - 2014-03-29 22:08 - 00000000 ____D C:\Users\oliver\Documents\zsoftware
2016-06-16 15:00 - 2014-11-06 20:13 - 00000000 ____D C:\Users\oliver\AppData\Roaming\vlc
2016-06-16 12:36 - 2013-08-22 17:20 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-06-16 12:26 - 2014-10-20 17:07 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-06-16 12:22 - 2014-10-20 17:07 - 142482544 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-06-16 11:17 - 2016-02-20 16:13 - 00000000 ____D C:\Users\oliver\Desktop\SCREENSHOTS
2016-06-16 06:36 - 2014-10-31 23:20 - 00000000 ____D C:\Users\oliver\AppData\Roaming\uTorrent
2016-06-15 22:48 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\tracing
2016-06-15 22:47 - 2016-03-08 20:41 - 00000000 ____D C:\ProgramData\AVAST Software
2016-06-15 20:04 - 2013-08-22 15:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2016-06-15 12:36 - 2016-01-17 20:01 - 00000000 ____D C:\Users\oliver\Desktop\KingdomProjects
2016-06-15 10:17 - 2016-02-24 09:31 - 00001896 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-06-15 10:17 - 2016-02-24 09:31 - 00001884 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2016-06-15 10:17 - 2014-10-20 10:34 - 00001742 _____ C:\Users\oliver\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-06-06 16:07 - 2014-12-11 20:35 - 00123272 _____ C:\Users\oliver\AppData\Local\GDIPFONTCACHEV1.DAT
2016-06-06 15:16 - 2014-03-29 21:40 - 00000000 ____D C:\Users\oliver\Documents\Sifiso100
2016-06-06 10:37 - 2016-05-13 23:18 - 00000000 ____D C:\Program Files (x86)\Cluudomclwuse
2016-06-06 10:36 - 2014-03-29 22:31 - 00000000 ____D C:\Users\oliver\Documents\DinganiFolder
2016-06-06 10:35 - 2016-01-24 14:15 - 00000000 ____D C:\Users\oliver\Desktop\TodoFile
2016-06-05 10:26 - 2016-01-17 17:43 - 00000000 __SHD C:\[Smad-Cage]
2016-06-03 18:15 - 2014-12-28 13:33 - 00000000 ____D C:\Users\oliver\AppData\Roaming\dvdcss
2016-06-03 11:44 - 2014-10-20 10:30 - 00000000 ____D C:\Users\oliver
2016-06-01 09:20 - 2016-03-03 22:01 - 00000000 ___SD C:\WINDOWS\SysWOW64\GWX
2016-06-01 09:20 - 2016-03-03 22:01 - 00000000 ___SD C:\WINDOWS\system32\GWX
2016-05-30 10:32 - 2016-02-03 21:25 - 00000000 ____D C:\Users\oliver\Desktop\Advertising Photos
2016-05-30 09:52 - 2013-09-23 05:37 - 00000000 ___DC C:\WINDOWS\Panther
2016-05-26 11:35 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2016-05-19 18:56 - 2013-11-12 02:10 - 00000000 ____D C:\ProgramData\Norton
2016-05-19 12:29 - 2016-03-11 11:18 - 00000000 ____D C:\Users\oliver\Desktop\QueenAkermans
2016-05-19 08:29 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\ModemLogs
==================== Files in the root of some directories =======
2016-05-13 23:09 - 2016-05-13 23:09 - 6494208 _____ () C:\Users\oliver\AppData\Roaming\agent.dat
2016-05-13 23:09 - 2016-05-13 23:09 - 0054272 _____ () C:\Users\oliver\AppData\Roaming\ApplicationHosting.dat
2016-05-13 23:09 - 2016-05-13 23:09 - 1626777 _____ () C:\Users\oliver\AppData\Roaming\Cof-In.tst
2016-05-13 23:09 - 2016-05-13 23:09 - 0065568 _____ () C:\Users\oliver\AppData\Roaming\Config.xml
2016-05-13 23:09 - 2016-05-13 23:09 - 0848437 _____ () C:\Users\oliver\AppData\Roaming\Doublehold.bin
2016-05-13 23:08 - 2016-05-13 23:08 - 0015840 _____ () C:\Users\oliver\AppData\Roaming\InstallationConfiguration.xml
2016-05-13 23:08 - 2016-05-13 23:08 - 0127488 _____ () C:\Users\oliver\AppData\Roaming\Installer.dat
2016-05-13 23:09 - 2016-05-13 23:09 - 0126464 _____ () C:\Users\oliver\AppData\Roaming\lobby.dat
2016-05-13 23:09 - 2016-05-13 23:09 - 0018432 _____ () C:\Users\oliver\AppData\Roaming\Main.dat
2016-05-13 23:09 - 2016-05-13 23:09 - 0005568 _____ () C:\Users\oliver\AppData\Roaming\md.xml
2016-05-13 23:09 - 2016-05-13 23:09 - 0126464 _____ () C:\Users\oliver\AppData\Roaming\noah.dat
2016-02-19 22:27 - 2016-04-30 08:20 - 0000385 _____ () C:\Users\oliver\AppData\Roaming\Rim.Desktop.Exception.log
2016-02-19 22:25 - 2016-02-19 22:25 - 0001111 _____ () C:\Users\oliver\AppData\Roaming\Rim.Desktop.HttpServerSetup.log
2016-02-19 22:27 - 2016-04-30 08:20 - 0000385 _____ () C:\Users\oliver\AppData\Roaming\Rim.DesktopHelper.Exception.log
2016-05-13 23:09 - 2016-05-13 23:09 - 0072717 _____ () C:\Users\oliver\AppData\Roaming\Truetom.tst
2016-05-13 23:09 - 2016-05-13 23:09 - 0032038 _____ () C:\Users\oliver\AppData\Roaming\uninstall_temp.ico
2008-05-23 17:48 - 2008-05-23 17:48 - 0020270 _____ () C:\ProgramData\DeviceInstaller.xml
2008-06-23 13:02 - 2008-06-23 13:02 - 0097410 ____R () C:\ProgramData\DeviceManager.xml.rc4
2013-11-12 01:49 - 2013-11-12 01:49 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
Some files in TEMP:
====================
C:\Users\oliver\AppData\Local\Temp\1B76.tmp.exe
C:\Users\oliver\AppData\Local\Temp\avg-9cedb840-73a8-467d-aefb-c46484975b33.exe
C:\Users\oliver\AppData\Local\Temp\DeviceSetup64.exe
C:\Users\oliver\AppData\Local\Temp\libeay32.dll
C:\Users\oliver\AppData\Local\Temp\MediaPlayer__11426.exe
C:\Users\oliver\AppData\Local\Temp\msconfig.exe
C:\Users\oliver\AppData\Local\Temp\msvcr120.dll
C:\Users\oliver\AppData\Local\Temp\qqpcmgr_v11.5.17490.219_45371_Silence.exe
C:\Users\oliver\AppData\Local\Temp\sqlite3.dll
C:\Users\oliver\AppData\Local\Temp\Uninstall.exe
C:\Users\oliver\AppData\Local\Temp\uttE359.tmp.exe
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2016-06-15 19:24
==================== End of FRST.txt ============================
Additional scan result of Farbar Recovery Scan Tool (x64) Version:19-05-2016
Ran by oliver (2016-06-18 13:13:44)
Running from C:\Users\oliver\Desktop
Windows 8.1 Single Language (X64) (2014-10-20 08:34:12)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-2472899907-1604452211-935407213-500 - Administrator - Disabled) => C:\Users\Administrator
Guest (S-1-5-21-2472899907-1604452211-935407213-501 - Limited - Disabled)
oliver (S-1-5-21-2472899907-1604452211-935407213-1001 - Administrator - Enabled) => C:\Users\oliver
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: 电脑管家系统防护 (Enabled - Up to date) {6F9C3F92-B625-0E47-F0B1-447602EC65F5}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: 电脑管家系统防护 (Enabled - Up to date) {D4FDDE76-901F-01C9-CA01-7F04796B2F48}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
µTorrent (HKU\S-1-5-21-2472899907-1604452211-935407213-1001\...\uTorrent) (Version: 3.4.7.42330 - BitTorrent Inc.)
3G Voice Modem (HKLM-x32\...\InstallShield_{3A59AA92-8BAC-4795-B17A-5535ED4AA9FA}) (Version: 1.0 - 3G Voice)
3G Voice Modem (x32 Version: 1.0 - 3G Voice) Hidden
Adobe Reader XI (11.0.14) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AB0000000001}) (Version: 11.0.14 - Adobe Systems Incorporated)
Atheros Driver Installation Program (HKLM-x32\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 10.0 - Atheros)
Avast Internet Security (HKLM-x32\...\Avast) (Version: 11.2.2260 - AVAST Software)
Bejeweled 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
BlackBerry Desktop Software 7.1 (HKLM-x32\...\BlackBerry_Desktop) (Version: 7.1.0.41 - Research In Motion Ltd.)
BlackBerry Desktop Software 7.1 (x32 Version: 7.1.0.41 - Research In Motion Ltd.) Hidden
FastStone Photo Resizer 3.2 (HKLM-x32\...\FastStone Photo Resizer) (Version: 3.2 - FastStone Soft.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 51.0.2704.103 - Google Inc.)
Google Update Helper (x32 Version: 1.3.29.5 - Google Inc.) Hidden
Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3282 - Intel Corporation)
Luxor Evolved (x32 Version: 2.2.0.98 - WildTangent) Hidden
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4454.1510 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Preview Redistributable (x64) - 12.0.20617 (HKLM-x32\...\{448652c1-f5f3-4230-98c6-68c10c88b1fb}) (Version: 12.0.20617.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Preview Redistributable (x86) - 12.0.20617 (HKLM-x32\...\{1f407217-9aec-4146-8504-e64ac959c534}) (Version: 12.0.20617.1 - Microsoft Corporation)
Mozilla Firefox 46.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 46.0.1 (x86 en-US)) (Version: 46.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 46.0.1.5966 - Mozilla)
Norton Internet Security (HKLM-x32\...\NIS) (Version: 16.0.0.125 - Symantec Corporation)
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.1.300 - Qualcomm Atheros)
Qualcomm Atheros Inc.® AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.21 - Qualcomm Atheros Inc.)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.39052 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7023 - Realtek Semiconductor Corp.)
SafeFinder (HKLM-x32\...\{D05C2B68-CF99-4650-8AAC-6B50311C42A3}) (Version: 1.0.0.0 - Linkury) <==== ATTENTION
SafeZone Stable 1.48.2066.98 (x32 Version: 1.48.2066.98 - Avast Software) Hidden
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.14055.3 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.14055.3 - Samsung Electronics Co., Ltd.) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.10.51 - Synaptics Incorporated)
TOSHIBA Audio Enhancement (HKLM\...\{1515F5E3-29EA-4CD1-A981-032D88880F09}) (Version: 2.0.17.0 - Toshiba Corporation)
TOSHIBA Desktop Assist (HKLM\...\{95CCACF0-010D-45F0-82BF-858643D8BC02}) (Version: 1.02.01.6407 - Toshiba Corporation)
TOSHIBA Display Utility (HKLM\...\{84FA4D2D-4273-4C66-BD3D-ADD3FE48DFA2}) (Version: 1.1.5.0 - Toshiba Corporation)
TOSHIBA eco Utility (HKLM\...\{5944B9D4-3C2A-48DE-931E-26B31714A2F7}) (Version: 2.2.0.6404 - Toshiba Corporation)
TOSHIBA Function Key (HKLM\...\{16562A90-71BC-41A0-B890-D91B0C267120}) (Version: 1.1.0001.6403 - Toshiba Corporation)
TOSHIBA HDD Accelerator (HKLM\...\{DB4D9937-0B14-4EF1-BF9A-BB7E3B9DCB04}) (Version: 2.1.0000 - Toshiba Corporation)
TOSHIBA Manuals (HKLM-x32\...\{90FF4432-21B7-4AF6-BA6E-FB8C1FED9173}) (Version: 10.10 - TOSHIBA)
TOSHIBA Password Utility (HKLM-x32\...\{B1786E63-2127-42C9-95A3-146E5F727BF1}) (Version: v2.1.0.14 - Toshiba Corporation)
TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.9.09.6400 - Toshiba Corporation)
TOSHIBA Recovery Media Creator (HKLM-x32\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 3.1.02.55065006 - Toshiba Corporation)
TOSHIBA Service Station (HKLM\...\{FBFCEEA5-96EA-4C8E-9262-43CBBEBAE413}) (Version: 2.6.8 - Toshiba Corporation)
TOSHIBA System Driver (HKLM-x32\...\{1E6A96A1-2BAB-43EF-8087-30437593C66C}) (Version: 1.00.0030 - Toshiba Corporation)
TOSHIBA System Settings (HKLM-x32\...\{05A55927-DB9B-4E26-BA44-828EBFF829F0}) (Version: 1.1.2.32001 - Toshiba Corporation)
TOSHIBA VIDEO PLAYER (HKLM\...\{FF07604E-C860-40E9-A230-E37FA41F103A}) (Version: 5.3.27.102 - Toshiba Corporation)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.0.1 (HKLM-x32\...\VLC media player) (Version: 2.0.1 - VideoLAN)
Vodafone Mobile Connect Lite (HKLM-x32\...\{C656142F-EFE1-44CD-BFAD-6CBC6DCB9860}) (Version: 9.3.3.10523 - Vodafone)
WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
WildTangent Games App (Toshiba Games) (x32 Version: 4.0.10.20 - WildTangent) Hidden
WinRAR 4.10 beta 4 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 4.10.4 - win.rar GmbH)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {0282E1DB-AAF6-424A-9B54-45C0B4B6DED1} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2016-06-03] (AVAST Software)
Task: {21E2C840-A3A3-4435-9F8A-3FDCE35B4E0E} - System32\Tasks\TOSHIBA\HotKeysCmds => C:\Windows\system32\hkcmd.exe [2013-08-31] (Intel Corporation)
Task: {26B1AE00-EC41-46AD-9793-74D66D6EE879} - System32\Tasks\SafeZone scheduled Autoupdate 1466023706 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2016-03-30] (Avast Software)
Task: {31D5CE8E-CD48-4A3F-9762-A9CAC96FCCD1} - System32\Tasks\TOSHIBA\TSVU => c:\Program Files\TOSHIBA\TOSHIBA Smart View Utility\TosSmartViewLauncher.exe [2013-07-23] (TOSHIBA)
Task: {495E3F97-7B83-4F5C-BF3D-9AD70267C6D5} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2016-06-16] (Microsoft Corporation)
Task: {5C4C6110-9EE4-4C06-8924-F039FB97128D} - System32\Tasks\Resolution+ Setting Task => C:\Program Files\Toshiba\TOSHIBA Smart View Utility\Plugins\ResolutionPlus\TosRegPermissionChg.exe [2013-08-28] (TODO: <Company name>)
Task: {681C6E34-07E7-461F-97F0-C9DB36CB1659} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-06-18] (Google Inc.)
Task: {681D84BE-6314-4B16-A2EA-2BC39342FCEC} - System32\Tasks\TOSHIBA\TecoResident => C:\Program Files\TOSHIBA\Teco\TecoResident.exe [2013-08-21] (TOSHIBA Corporation)
Task: {685D3C83-7A4D-4A4E-9B4C-BEEB1F517135} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2016-06-15] (AVAST Software)
Task: {73FC3073-E28C-487E-B3AB-48A7AF63712A} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe [2013-07-31] (TOSHIBA Corporation)
Task: {830B4638-C920-4C2C-9D2E-3F1D3C1651EF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-06-18] (Google Inc.)
Task: {960CDA20-480F-43A4-98A3-C765F7B869BF} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_ERROR_HB => C:\WINDOWS\system32\MRT.exe [2016-06-16] (Microsoft Corporation)
Task: {981BC066-930D-462F-92CE-2A02D76B7AEE} - System32\Tasks\TOSHIBA\TosWaitSrv => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [2013-08-13] (TOSHIBA Corporation)
Task: {9F33B46A-AC92-4E96-8534-B7D4D54E4115} - System32\Tasks\TOSHIBA\IgfxTray => C:\Windows\system32\igfxtray.exe [2013-08-31] (Intel Corporation)
Task: {C608F8E3-75B2-4FB2-AA7D-1BE342D8E709} - System32\Tasks\TOSHIBA\Adobe ARM => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-12-18] (Adobe Systems Incorporated)
Task: {E33D88D4-11E3-4789-BF91-D22C3F6666D6} - System32\Tasks\TOSHIBA\Persistence => C:\Windows\system32\igfxpers.exe [2013-08-31] (Intel Corporation)
Task: {EB28C38A-99FD-4ABB-853D-11CB19A3EB9C} - System32\Tasks\RTKCPL => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [2013-08-21] (Realtek Semiconductor)
Task: {F661E3BE-4142-489B-BC8E-CF71EDF29E56} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2014-08-06] (Synaptics Incorporated)
Task: {FEEC7355-F4C2-46CD-8E73-1B2959446EE5} - System32\Tasks\TOSHIBA\TCrdMain => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2013-08-17] (TOSHIBA Corporation)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
==================== Loaded Modules (Whitelisted) ==============
2016-03-03 21:18 - 2011-12-07 12:40 - 00193536 _____ () C:\Program Files (x86)\WinRAR\rarext64.dll
2012-02-22 14:31 - 2012-02-22 14:31 - 00233472 _____ () C:\Program Files (x86)\3G Voice Modem\HSPALauncher.exe
2012-07-18 19:38 - 2012-07-18 19:38 - 00020904 _____ () C:\Program Files\TOSHIBA\Hotkey\SmoothView.dll
2013-08-13 04:52 - 2013-08-13 04:52 - 00094208 _____ () C:\Windows\system32\IccLibDll_x64.dll
2016-05-23 21:10 - 2016-05-23 21:10 - 01459712 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Windows.UI\5062f8f84e45fee3a39c25e1f72b3461\Windows.UI.ni.dll
2013-08-22 09:19 - 2013-08-22 08:54 - 00050176 _____ () C:\WINDOWS\system32\WinMetadata\Windows.Data.winmd
2016-05-23 21:09 - 2016-05-23 21:09 - 00363520 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Windows.Foundation\e2e1cd64b91b7395a96ebcde35a63a1c\Windows.Foundation.ni.dll
2016-06-15 22:46 - 2016-06-15 22:46 - 00123344 _____ () C:\Program Files\AVAST Software\Avast\log.dll
2016-06-15 22:46 - 2016-06-15 22:46 - 00135816 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2016-06-18 12:36 - 2016-06-18 12:36 - 02935808 _____ () C:\Program Files\AVAST Software\Avast\defs\16061800\algo.dll
2016-06-15 22:46 - 2016-06-15 22:46 - 00478144 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2016-05-13 23:12 - 2016-05-13 23:12 - 00115904 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QMAntiInject.dll
2016-05-13 23:13 - 2016-05-13 23:13 - 00088416 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\zlib.dll
2016-05-13 23:12 - 2016-05-13 23:12 - 00488640 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\sqlite.dll
2016-05-13 23:13 - 2016-05-13 23:13 - 00100704 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\tinyxml.dll
2016-05-13 23:13 - 2016-05-13 23:13 - 00046784 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\plugins\sysspeeduprtpplugin\SysSpeedupRtpPlugin.dll
2016-05-13 23:17 - 2016-03-28 21:11 - 00070848 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\plugins\qmiemalrtpplugin\qmiemalrtpplugin.dll
2016-05-13 23:12 - 2016-02-28 00:55 - 00036128 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\oDayProtect.dll
2016-05-13 23:12 - 2016-05-13 23:12 - 00128192 _____ () c:\program files (x86)\tencent\qqpcmgr\11.5.17490.219\qmrtpcontroller.dll
2016-05-13 23:13 - 2016-05-13 23:13 - 00194912 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\xImage.dll
2016-05-13 23:12 - 2016-05-13 23:12 - 00342368 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\arkGraphic.dll
2016-05-13 23:12 - 2016-05-13 23:12 - 02156896 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\GF.dll
2016-05-13 23:13 - 2016-05-13 23:13 - 00092512 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\xGraphic32.dll
2016-05-13 23:12 - 2016-05-13 23:12 - 00158048 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\libpng.dll
2016-05-13 23:12 - 2016-05-13 23:12 - 00285024 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\libjpegturbo.dll
2016-05-13 23:12 - 2016-05-13 23:12 - 00137568 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\libexpatw.dll
2016-05-13 23:12 - 2016-05-13 23:12 - 00045408 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\jgImage.dll
2016-05-13 23:12 - 2016-05-13 23:12 - 00014176 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\jgIOStub.dll
2016-05-13 23:12 - 2016-05-13 23:12 - 00169152 _____ () c:\program files (x86)\tencent\qqpcmgr\11.5.17490.219\qmhipslogpolicy.dll
2016-05-13 23:12 - 2016-05-13 23:12 - 00083136 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\MemDefrag.dll
2016-05-13 23:12 - 2016-05-13 23:12 - 00337088 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QMTrayPlugin\QMAutoTaskPlugin\SubPlugins\OperationFileCloudMgr.dll
2016-05-13 23:12 - 2016-05-13 23:12 - 00379232 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\DlForQd.dll
2016-05-13 23:12 - 2016-05-13 23:12 - 00251072 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\11.5.17490.219\QMWlanMacDll.dll
2016-06-15 22:47 - 2016-06-15 22:47 - 40539648 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2013-11-12 01:43 - 2013-09-03 17:52 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\ACE.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Service"
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 15:25 - 2016-06-18 13:14 - 00001006 ____A C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 down.baidu2016.com
127.0.0.1 123.sogou.com
127.0.0.1 www.czzsyzgm.com
127.0.0.1 www.czzsyzxl.com
127.0.0.1 union.baidu2019.com
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-2472899907-1604452211-935407213-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\oliver\Desktop\2015 Jan -Mar\2015 Photoz\20150816_141156.jpg
DNS Servers: 168.210.2.2 - 196.14.239.2
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{AFA7664F-4339-4BFF-BEA5-E4348581EA7F}] => (Allow) C:\Users\oliver\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{4FC6104F-5332-4C91-B6F9-865E9ED9A7DB}] => (Allow) C:\Users\oliver\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{2991F92C-F468-4A74-8C63-B231ADA46514}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{8F9E0023-9C48-4536-A04B-2B81667B9012}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [TCP Query User{3693C593-2BCB-4353-B1DA-3CF65A170CAA}C:\program files (x86)\symantec\norton online backup\nobuclient.exe] => (Block) C:\program files (x86)\symantec\norton online backup\nobuclient.exe
FirewallRules: [UDP Query User{286332D7-CAFA-4DC1-AD56-C19A5CC5DC4E}C:\program files (x86)\symantec\norton online backup\nobuclient.exe] => (Block) C:\program files (x86)\symantec\norton online backup\nobuclient.exe
FirewallRules: [{9EF185E1-B126-4718-B7FC-AAA0B4BADD16}] => (Allow) C:\Program Files (x86)\Research In Motion\BlackBerry Desktop\Rim.Desktop.exe
FirewallRules: [{A6794C50-F486-4611-B3F9-F08E2BE1CD77}] => (Allow) C:\Program Files (x86)\Research In Motion\BlackBerry Desktop\Rim.Desktop.exe
FirewallRules: [{29E6EA8B-2EE2-4AB6-B4D9-98F656DE21F3}] => (Allow) LPort=4481
FirewallRules: [{A3E5BB69-CD2F-4054-80A6-2CD4148B492D}] => (Allow) LPort=4481
FirewallRules: [{28D15ECE-0217-476C-95FD-48B398B08C95}] => (Allow) LPort=4482
FirewallRules: [{4AC3ACA7-6174-4851-840A-5411A0DB2F63}] => (Allow) LPort=4482
FirewallRules: [{5063CBF1-D5FE-4F16-972D-3D8A7B9ABEE0}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{F3984F31-D74F-4D54-BE56-4B973327C5C6}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{CA2530F3-785D-42F6-9D2A-3D6B96CCC625}C:\program files (x86)\symantec\norton online backup\nobuclient.exe] => (Block) C:\program files (x86)\symantec\norton online backup\nobuclient.exe
FirewallRules: [UDP Query User{F6AC9B01-1EFD-40BA-8EA8-3A72D0C89CB4}C:\program files (x86)\symantec\norton online backup\nobuclient.exe] => (Block) C:\program files (x86)\symantec\norton online backup\nobuclient.exe
FirewallRules: [{7AAD88D3-89A9-4BB5-8436-0329BEDBE951}] => (Allow) C:\Users\oliver\AppData\Local\Temp\113257328\download\MiniThunderPlatform.exe
FirewallRules: [{2901F26E-F099-4876-AB35-91F5B26262DC}] => (Allow) C:\Users\oliver\AppData\Local\Temp\113257328\download\MiniThunderPlatform.exe
FirewallRules: [{AD563E48-9E59-4538-8BE8-2688FBBFF20F}] => (Allow) C:\Windows\Temp\download\MiniThunderPlatform.exe
FirewallRules: [{D7C74366-A051-41F7-9E0C-D63025416878}] => (Allow) C:\Windows\Temp\download\MiniThunderPlatform.exe
FirewallRules: [{C2D35217-18D0-466A-A347-E2CB4EC7EF94}] => (Allow) C:\Program Files (x86)\Weness\Update\WenessUpdate.exe
FirewallRules: [{F9024118-639E-4682-BA33-9EA7328E342A}] => (Allow) C:\Program Files (x86)\Weness\Application\chrome.exe
FirewallRules: [{745C808F-7CE7-48E6-A3BC-EEC01EF33F49}] => (Allow) C:\ProgramData\Weness\Weness.exe
FirewallRules: [{4B2962B3-13BA-49AE-AFC8-307FF0E9C72E}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{B380446F-0388-47CE-B40A-7C177D0E6088}] => (Allow) C:\program files (x86)\common files\tencent\qqdownload\130\bugreport_xf.exe
FirewallRules: [{E76DF126-61C4-4C25-94B6-0C40D065B8D5}] => (Allow) C:\program files (x86)\common files\tencent\qqdownload\130\tencentdl.exe
==================== Restore Points =========================
01-06-2016 09:12:46 Scheduled Checkpoint
12-06-2016 20:26:22 Scheduled Checkpoint
16-06-2016 12:21:44 Windows Update
17-06-2016 10:19:38 JRT Pre-Junkware Removal
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (06/18/2016 01:04:31 PM) (Source: Perflib) (EventID: 1023) (User: )
Description: rdyboost4
Error: (06/18/2016 01:03:20 PM) (Source: VMCService) (EventID: 0) (User: )
Description: conflictManagerTypeValue
Error: (06/18/2016 12:58:32 PM) (Source: VMCService) (EventID: 0) (User: )
Description: conflictManagerTypeValue
Error: (06/18/2016 11:03:58 AM) (Source: VMCService) (EventID: 0) (User: )
Description: GetLoggedOnUser
Error: (06/18/2016 11:03:56 AM) (Source: VMCService) (EventID: 0) (User: )
Description: GetLoggedOnUser
Error: (06/17/2016 12:45:00 PM) (Source: VMCService) (EventID: 0) (User: )
Description: conflictManagerTypeValue
Error: (06/17/2016 12:26:34 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005
Error: (06/17/2016 11:48:46 AM) (Source: VMCService) (EventID: 0) (User: )
Description: conflictManagerTypeValue
Error: (06/17/2016 11:43:40 AM) (Source: VMCService) (EventID: 0) (User: )
Description: GetLoggedOnUser
Error: (06/17/2016 11:43:38 AM) (Source: VMCService) (EventID: 0) (User: )
Description: GetLoggedOnUser
System errors:
=============
Error: (06/18/2016 01:14:09 PM) (Source: Microsoft-Windows-DNS-Client) (EventID: 1012) (User: NT AUTHORITY)
Description: There was an error while attempting to read the local hosts file.
Error: (06/18/2016 01:05:29 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Update Service(WenessU) service failed to start due to the following error:
%%2
Error: (06/18/2016 01:03:56 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: The ScRegSetValueExW call failed for Start with the following error:
%%5
Error: (06/18/2016 01:03:49 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: The ScRegSetValueExW call failed for Start with the following error:
%%5
Error: (06/18/2016 01:03:23 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: The QQPCMgr RTP Service service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
Error: (06/18/2016 01:03:09 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Quoteex service failed to start due to the following error:
%%2
Error: (06/18/2016 12:57:58 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Search service, but this action failed with the following error:
%%1056
Error: (06/18/2016 12:57:30 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Windows Presentation Foundation Font Cache 3.0.0.0 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
Error: (06/18/2016 12:57:29 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The SSFK service failed to start due to the following error:
%%1006
Error: (06/18/2016 12:57:28 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The TMachInfo service terminated unexpectedly. It has done this 1 time(s).
CodeIntegrity:
===================================
Date: 2016-05-10 17:35:15.879
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-04-28 20:01:23.310
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-04-24 22:48:43.375
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-03-19 10:39:53.298
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2016-03-11 11:03:19.304
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.
==================== Memory info ===========================
Processor: Intel® Celeron® CPU 1037U @ 1.80GHz
Percentage of memory in use: 49%
Total physical RAM: 3975.27 MB
Available physical RAM: 2006.05 MB
Total Virtual: 4807.27 MB
Available Virtual: 2772.01 MB
==================== Drives ================================
Drive c: (TI31142400B) (Fixed) (Total:454.84 GB) (Free:206.12 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 00000000)
Partition: GPT.
==================== End of Addition.txt ============================
This topic is locked
Sign In
Create Account
