Jump to content

arnolfini

Honorary Members
 View Profile  See their activity

  • Posts

    123

  • Joined

  • Last visited

 Content Type 

Posts posted by arnolfini

    Painfully slow, weird--won't sync with time server

    in Resolved Malware Removal Logs

    Posted

    Here are the logs if anyone can help:

    Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 15-03-2017
    Ran by esther (administrator) on HOME-PC (13-04-2017 19:28:53)
    Running from C:\Users\esther\Desktop
    Loaded Profiles: esther (Available Profiles: esther)
    Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) Language: English (United States)
    Internet Explorer Version 9 (Default browser: IE)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (Microsoft Corporation) C:\Windows\System32\SLsvc.exe
    (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
    (Copyright 2017.) C:\Program Files\Zemana AntiMalware\ZAM.exe
    (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
    (Copyright 2017.) C:\Program Files\Zemana AntiMalware\ZAM.exe
    (Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe
    (Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
    (Geek Unіnstaller) C:\Users\esther\Desktop\geek.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
    (Farbar) C:\Users\esther\Desktop\FRST-15.03.2017.exe

    ==================== Registry (Whitelisted) ====================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [ZAM] => C:\Program Files\Zemana AntiMalware\ZAM.exe [14522512 2017-04-03] (Copyright 2017.)
    HKU\S-1-5-21-1426848440-783321390-1561973993-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [7348440 2017-03-03] (Piriform Ltd)
    HKU\S-1-5-21-1426848440-783321390-1561973993-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> 
    BootExecute: autocheck autochk * bootdelete

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
    Tcpip\..\Interfaces\{045F92B2-8D4D-4A86-A046-02270758B5B8}: [DhcpNameServer] 192.168.0.1
    ManualProxies: 

    Internet Explorer:
    ==================
    HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
    HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
    HKU\S-1-5-21-1426848440-783321390-1561973993-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.com/?gws_rd=ssl
    SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
    SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
    SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
    SearchScopes: HKU\S-1-5-21-1426848440-783321390-1561973993-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
    BHO: RealPlayer Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll [2011-03-19] (RealPlayer)
    BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2013-06-23] (Oracle Corporation)
    BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
    BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2013-06-23] (Oracle Corporation)
    BHO: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll [2013-08-13] (Adblock Plus)
    Toolbar: HKU\S-1-5-21-1426848440-783321390-1561973993-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
    Toolbar: HKU\S-1-5-21-1426848440-783321390-1561973993-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

    FireFox:
    ========
    FF Extension: (SySaver) - C:\Program Files\Mozilla Firefox\extensions\ecyoivyyjrojzoyplneg@nrbkkafymvigofepbi.org [2014-01-28] [not signed]
    FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF Extension: (Microsoft .NET Framework Assistant) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-12-02] [not signed]
    FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
    FF Extension: (RealPlayer Browser Record Plugin) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011-03-19] [not signed]
    FF Plugin: @canon.com/MycameraPlugin -> C:\Program Files\Canon\MyCamera Download Plugin\NPCIG.dll [2008-10-15] (CANON INC.)
    FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\system32\npDeployJava1.dll [2013-06-23] (Oracle Corporation)
    FF Plugin: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2013-06-23] (Oracle Corporation)
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll [2014-02-13] ( Microsoft Corporation)
    FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-30] (Microsoft Corporation)
    FF Plugin: @real.com/nppl3260;version=12.0.1.633 -> C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll [2011-03-19] (RealNetworks, Inc.)
    FF Plugin: @real.com/nprjplug;version=12.0.1.633 -> C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll [2011-03-19] (RealNetworks, Inc.)
    FF Plugin: @real.com/nprphtml5videoshim;version=12.0.1.633 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll [2011-03-19] (RealNetworks, Inc.)
    FF Plugin: @real.com/nprpjplug;version=12.0.1.633 -> C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll [2011-03-19] (RealNetworks, Inc.)
    FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.33.3\npGoogleUpdate3.dll [2017-04-11] (Google Inc.)
    FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.33.3\npGoogleUpdate3.dll [2017-04-11] (Google Inc.)
    FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2015-09-24] (Adobe Systems Inc.)

    Chrome: 
    =======
    CHR DefaultProfile: Default
    CHR StartupUrls: Default -> "hxxps://login.comcast.net/login?forceAuthn=false&ts=25b3a688&ipAddrAuthn=false&lang=en&s=portal&deviceAuthn=false&r=comcast.net&continue=http%3A%2F%2Fxfinity.comcast.net%2F&passive=false&rm=2"
    CHR Profile: C:\Users\esther\AppData\Local\Google\Chrome\User Data\Default [2017-04-13]
    CHR Extension: (Google Docs) - C:\Users\esther\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-15]
    CHR Extension: (Google Drive) - C:\Users\esther\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-22]
    CHR Extension: (YouTube) - C:\Users\esther\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-25]
    CHR Extension: (Adblock Plus) - C:\Users\esther\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2017-04-06]
    CHR Extension: (Google Search) - C:\Users\esther\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-01]
    CHR Extension: (Google Docs Offline) - C:\Users\esther\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-24]
    CHR Extension: (AdBlock) - C:\Users\esther\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2017-04-13]
    CHR Extension: (RealPlayer HTML5Video Downloader Extension) - C:\Users\esther\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk [2014-06-06]
    CHR Extension: (Chrome Web Store Payments) - C:\Users\esther\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-08]
    CHR Extension: (Email Access Online) - C:\Users\esther\AppData\Local\Google\Chrome\User Data\Default\Extensions\olmbmhlfpgbjlgcgfnhabhmljbmkpjin [2016-10-25]
    CHR Extension: (Gmail) - C:\Users\esther\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-01]
    CHR Profile: C:\Users\esther\AppData\Local\Google\Chrome\User Data\System Profile [2016-02-22]
    CHR HKLM\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx [2011-03-19]

    ==================== Services (Whitelisted) ====================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    S4 AERTFilters; C:\Windows\system32\AERTSrv.exe [77824 2007-12-05] (Andrea Electronics Corporation)
    S2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22216 2014-03-11] (Microsoft Corporation)
    R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-19] (Microsoft Corporation)
    R2 ZAMSvc; C:\Program Files\Zemana AntiMalware\ZAM.exe [14522512 2017-04-03] (Copyright 2017.)

    ===================== Drivers (Whitelisted) ======================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    S3 BVRPMPR5; C:\Windows\system32\drivers\BVRPMPR5.SYS [49904 2010-06-21] (Avanquest Software) [File not signed]
    S3 MpFilter; C:\Windows\system32\DRIVERS\MpFilter.sys [231960 2014-01-25] (Microsoft Corporation)
    R1 ZAM; C:\Windows\System32\drivers\zam32.sys [181496 2017-04-12] (Zemana Ltd.)
    R1 ZAM_Guard; C:\Windows\System32\drivers\zamguard32.sys [181496 2017-04-12] (Zemana Ltd.)
    S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
    S3 GEARAspiWDM; system32\DRIVERS\GEARAspiWDM.sys [X]
    S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
    S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
    S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
    S1 OMCI; \??\C:\Windows\SYSTEM32\DRIVERS\OMCI.SYS [X]

    ==================== NetSvcs (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    ==================== One Month Created files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2017-04-13 19:28 - 2017-04-13 19:29 - 00011285 _____ C:\Users\esther\Desktop\FRST.txt
    2017-04-13 19:28 - 2017-04-13 19:28 - 00000000 ____D C:\FRST
    2017-04-13 19:27 - 2017-04-13 19:27 - 01766912 _____ (Farbar) C:\Users\esther\Desktop\FRST-15.03.2017.exe
    2017-04-13 13:30 - 2017-04-13 13:30 - 04089296 _____ C:\Users\esther\Downloads\adwcleaner_6.045 (1).exe
    2017-04-13 13:30 - 2017-04-13 13:30 - 01663672 _____ (Malwarebytes) C:\Users\esther\Downloads\JRT.exe
    2017-04-12 19:57 - 2017-04-13 19:28 - 00680264 _____ C:\Windows\ZAM_Guard.krnl.trace
    2017-04-12 19:57 - 2017-04-13 19:28 - 00668850 _____ C:\Windows\ZAM.krnl.trace
    2017-04-12 19:57 - 2017-04-12 19:57 - 00181496 _____ (Zemana Ltd.) C:\Windows\system32\Drivers\zam32.sys
    2017-04-12 19:56 - 2017-04-12 19:57 - 00000000 ____D C:\Program Files\Zemana AntiMalware
    2017-04-12 19:56 - 2017-04-12 19:56 - 00181496 _____ (Zemana Ltd.) C:\Windows\system32\Drivers\zamguard32.sys
    2017-04-12 19:56 - 2017-04-12 19:56 - 00000000 ____D C:\Users\esther\AppData\Local\Zemana
    2017-04-12 19:56 - 2017-04-12 19:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zemana AntiMalware
    2017-04-12 19:55 - 2017-04-12 19:55 - 05774688 _____ (Zemana Ltd. ) C:\Users\esther\Downloads\Zemana.AntiMalware.Setup.exe
    2017-04-12 19:52 - 2017-04-12 19:52 - 04089296 _____ C:\Users\esther\Downloads\adwcleaner_6.045.exe
    2017-04-12 19:34 - 2017-04-12 19:36 - 00000000 ____D C:\Users\esther\AppData\Local\SquirrelTemp
    2017-04-12 19:32 - 2017-04-12 19:47 - 00000000 ____D C:\Users\esther\AppData\Roaming\Geek Uninstaller
    2017-03-22 12:00 - 2017-02-11 11:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
    2017-03-19 12:12 - 2017-02-11 11:22 - 00304640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
    2017-03-19 12:12 - 2017-02-09 13:11 - 03610856 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
    2017-03-19 12:12 - 2017-02-09 13:11 - 03558120 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
    2017-03-19 12:11 - 2017-01-28 13:02 - 01253888 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
    2017-03-19 12:10 - 2017-02-11 12:54 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
    2017-03-19 12:10 - 2017-02-11 12:53 - 00299520 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
    2017-03-19 12:10 - 2017-02-11 12:16 - 01029120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
    2017-03-19 12:10 - 2017-02-11 12:16 - 00219648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
    2017-03-19 12:10 - 2017-02-11 12:16 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
    2017-03-19 12:10 - 2017-02-11 12:16 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
    2017-03-19 12:10 - 2017-02-11 11:35 - 01172480 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
    2017-03-19 12:10 - 2017-02-11 11:34 - 00486912 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
    2017-03-19 12:10 - 2017-02-11 11:25 - 00682496 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
    2017-03-19 12:10 - 2017-02-11 11:23 - 01073152 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
    2017-03-19 12:10 - 2017-02-11 11:23 - 00802304 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
    2017-03-19 12:10 - 2017-02-09 13:04 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\icm32.dll
    2017-03-19 12:10 - 2017-02-09 11:33 - 02074112 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
    2017-03-19 12:09 - 2017-01-13 16:16 - 00739840 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
    2017-03-19 12:09 - 2017-01-05 12:58 - 01314816 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
    2017-03-19 10:09 - 2017-03-03 20:33 - 01816064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
    2017-03-19 10:09 - 2017-03-03 20:32 - 12841472 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
    2017-03-19 10:09 - 2017-03-03 20:28 - 09756160 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
    2017-03-19 10:09 - 2017-03-03 20:28 - 01140736 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
    2017-03-19 10:09 - 2017-03-03 20:28 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
    2017-03-19 10:09 - 2017-03-03 20:27 - 01805312 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
    2017-03-19 10:09 - 2017-03-03 20:27 - 01130496 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
    2017-03-19 10:09 - 2017-03-03 20:27 - 00429056 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
    2017-03-19 10:09 - 2017-03-03 20:26 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
    2017-03-19 10:09 - 2017-03-03 20:26 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
    2017-03-19 10:09 - 2017-03-03 20:26 - 00719360 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
    2017-03-19 10:09 - 2017-03-03 20:26 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
    2017-03-19 10:09 - 2017-03-03 20:26 - 00354304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
    2017-03-19 10:09 - 2017-03-03 20:26 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
    2017-03-19 10:09 - 2017-03-03 20:26 - 00223744 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
    2017-03-19 10:09 - 2017-03-03 20:26 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
    2017-03-19 10:09 - 2017-03-03 20:26 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
    2017-03-19 10:09 - 2017-03-03 20:26 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
    2017-03-19 10:09 - 2017-03-03 20:26 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
    2017-03-19 10:09 - 2017-03-03 20:26 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
    2017-03-19 10:09 - 2017-03-03 20:26 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
    2017-03-19 10:09 - 2017-03-03 20:26 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe

    ==================== One Month Modified files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2017-04-13 19:26 - 2006-11-02 08:47 - 00003664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
    2017-04-13 19:26 - 2006-11-02 08:47 - 00003664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
    2017-04-13 13:27 - 2006-11-02 07:18 - 00000000 ____D C:\Windows\inf
    2017-04-13 13:27 - 2006-11-02 06:33 - 00751014 _____ C:\Windows\system32\PerfStringBackup.INI
    2017-04-13 13:21 - 2009-11-27 14:49 - 00000000 ____D C:\Users\esther
    2017-04-13 13:19 - 2006-11-02 09:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
    2017-04-13 13:13 - 2006-11-02 09:01 - 00032636 _____ C:\Windows\Tasks\SCHEDLGU.TXT
    2017-04-13 12:53 - 2015-04-21 08:28 - 00098520 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamswissarmy.sys
    2017-04-13 12:15 - 2012-12-12 10:04 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
    2017-04-12 21:24 - 2015-06-29 00:54 - 00000000 ____D C:\AdwCleaner
    2017-04-12 20:20 - 2010-05-05 08:32 - 00000000 ____D C:\Users\esther\AppData\Roaming\Yahoo!
    2017-04-12 20:15 - 2014-01-29 14:13 - 00000258 __RSH C:\ProgramData\ntuser.pol
    2017-04-12 19:50 - 2011-12-01 15:05 - 00000000 ____D C:\Users\esther\AppData\Local\CrashDumps
    2017-04-12 19:42 - 2007-01-06 13:31 - 00000000 ____D C:\Program Files\CCleaner
    2017-04-12 19:35 - 2007-01-06 14:01 - 00001945 _____ C:\Windows\epplauncher.mif
    2017-04-12 19:35 - 2007-01-06 13:43 - 00000000 ____D C:\Program Files\Microsoft Security Client
    2017-04-12 19:31 - 2017-01-26 09:08 - 06960664 _____ (Geek Unіnstaller) C:\Users\esther\Desktop\geek.exe
    2017-04-11 18:39 - 2006-11-02 07:18 - 00000000 ____D C:\Windows\rescache
    2017-04-07 18:06 - 2009-11-28 10:12 - 00430248 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
    2017-03-19 12:33 - 2006-11-02 08:47 - 00228936 _____ C:\Windows\system32\FNTCACHE.DAT
    2017-03-19 12:30 - 2006-11-02 08:37 - 00000000 ____D C:\Program Files\Movie Maker
    2017-03-19 12:09 - 2013-08-16 03:11 - 00000000 ____D C:\Windows\system32\MRT
    2017-03-19 12:02 - 2006-11-02 06:24 - 135706696 ____C (Microsoft Corporation) C:\Windows\system32\mrt.exe

    ==================== Files in the root of some directories =======

    2015-04-21 08:27 - 2015-04-21 08:27 - 0000037 _____ () C:\Users\esther\AppData\Roaming\mbam.context.scan
    2014-01-28 11:08 - 2015-05-05 11:38 - 0000110 _____ () C:\Users\esther\AppData\Roaming\WB.CFG
    2009-11-27 14:49 - 2014-07-28 08:55 - 0001356 _____ () C:\Users\esther\AppData\Local\d3d9caps.dat
    2010-05-18 10:28 - 2010-05-18 10:28 - 0003584 _____ () C:\Users\esther\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    2014-02-03 20:29 - 2014-02-03 20:29 - 0000000 _____ () C:\Users\esther\AppData\Local\{1C7D3C7B-09EA-44D2-B94E-6BC18D35BCA4}
    2014-07-28 07:10 - 2014-07-28 07:10 - 0000000 _____ () C:\Users\esther\AppData\Local\{1D06E9EC-9751-4665-8EBC-79E4D83F3386}
    2014-08-04 11:52 - 2014-08-04 11:52 - 0000000 _____ () C:\Users\esther\AppData\Local\{1F09F8AE-E306-45DB-B83E-52A706F38AD1}
    2014-10-21 10:11 - 2014-10-21 10:11 - 0000000 _____ () C:\Users\esther\AppData\Local\{33B11449-EF1D-4E8C-B719-77A036FC2E78}
    2014-02-02 13:52 - 2014-02-02 13:52 - 0000000 _____ () C:\Users\esther\AppData\Local\{4D1FCD32-00EA-4923-827C-49795A121F83}
    2014-09-10 07:52 - 2014-09-10 07:52 - 0000000 _____ () C:\Users\esther\AppData\Local\{68D1B714-15C4-4526-BE45-E93F18FF9D66}
    2014-09-10 07:52 - 2014-09-10 07:53 - 0000000 _____ () C:\Users\esther\AppData\Local\{C3E5BFF8-EDA6-40FD-ACCC-4CEF4A13B20A}
    2014-08-22 09:37 - 2014-08-22 09:38 - 0000000 _____ () C:\Users\esther\AppData\Local\{E63F41C6-838E-4D4D-8BA8-A5EB06507049}
    2015-01-23 13:11 - 2015-01-23 13:11 - 0000000 _____ () C:\Users\esther\AppData\Local\{E6DD172C-8093-4E6F-9EB6-0ACCBE127876}
    2014-02-04 19:05 - 2014-02-04 19:05 - 0000000 _____ () C:\Users\esther\AppData\Local\{F00171EF-2221-4329-B5A6-34F1BC87BB46}
    2012-06-17 13:06 - 2012-06-17 13:06 - 0000000 _____ () C:\ProgramData\63367755e7d38e37468cfb63f0373e0e_c
    2014-02-01 15:06 - 2014-02-02 13:25 - 0002763 _____ () C:\ProgramData\connector.swf
    2010-07-27 08:57 - 2010-08-02 14:54 - 0001248 _____ () C:\ProgramData\hpzinstall.log

    Some files in TEMP:
    ====================
    2017-04-12 20:01 - 2015-06-24 15:21 - 10113976 _____ (SurfRight B.V.) C:\Users\esther\AppData\Local\Temp\HitmanPro.exe

    ==================== Bamital & volsnap ======================

    (There is no automatic fix for files that do not pass verification.)

    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\system32\winlogon.exe => File is digitally signed
    C:\Windows\system32\wininit.exe => File is digitally signed
    C:\Windows\system32\svchost.exe => File is digitally signed
    C:\Windows\system32\services.exe => File is digitally signed
    C:\Windows\system32\User32.dll => File is digitally signed
    C:\Windows\system32\userinit.exe => File is digitally signed
    C:\Windows\system32\rpcss.dll => File is digitally signed
    C:\Windows\system32\dnsapi.dll => File is digitally signed
    C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

    LastRegBack: 2017-04-13 13:59

    ==================== End of FRST.txt ============================

     

    Additional scan result of Farbar Recovery Scan Tool (x86) Version: 15-03-2017
    Ran by esther (13-04-2017 19:29:29)
    Running from C:\Users\esther\Desktop
    Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) (2009-11-27 17:46:33)
    Boot Mode: Normal
    ==========================================================


    ==================== Accounts: =============================

    Administrator (S-1-5-21-1426848440-783321390-1561973993-500 - Administrator - Disabled)
    esther (S-1-5-21-1426848440-783321390-1561973993-1000 - Administrator - Enabled) => C:\Users\esther
    Guest (S-1-5-21-1426848440-783321390-1561973993-501 - Limited - Disabled)

    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    ==================== Installed Programs ======================

    (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    Acrobat.com (HKLM\...\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 2.0.0.0 - Adobe Systems Incorporated)
    Acrobat.com (Version: 2.0.0 - Adobe Systems Incorporated) Hidden
    Adblock Plus for IE (32-bit) (HKLM\...\{4653FE0D-2762-41B6-A757-8C4F00B790C3}) (Version: 1.0 - Eyeo GmbH)
    Adblock Plus for IE (HKLM\...\{1ce01891-839b-4ad1-b629-2e608ba0c6ba}) (Version: 1.0 - )
    Adobe AIR (HKLM\...\Adobe AIR) (Version: 2.0.2.12610 - Adobe Systems Inc.)
    Adobe Flash Player 23 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 23.0.0.207 - Adobe Systems Incorporated)
    Adobe Reader X (10.1.16) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.16 - Adobe Systems Incorporated)
    AVG 2012 (Version: 12.0.2433 - AVG Technologies) Hidden
    Bing Rewards Client Installer (Version: 16.0.345.0 - Microsoft Corporation) Hidden
    Canon Utilities CameraWindow DC 8 (HKLM\...\CameraWindowDC) (Version: 8.8.0.17 - Canon Inc.)
    CCleaner (HKLM\...\CCleaner) (Version: 5.28 - Piriform)
    Comcast Access (HKLM\...\com.comcast.access.13A1FA90F0FC9DC009FB0956ADD0F13F8608561B.1) (Version: ComcastAccess-1.59 - Comcast Cable Communications Management LLC)
    Comcast Access (Version: 1.59 - Comcast Cable Communications Management LLC) Hidden
    Comcast High-Speed Internet Install Wizard (HKLM\...\ComcastHSI) (Version:  - Comcast Cable Communications, LLC)
    Dell Resource CD (HKLM\...\{42929F0F-CE14-47AF-9FC7-FF297A603021}) (Version: 1.10.0000 - Dell Inc.)
    Dell SupportAssist (HKLM\...\PC-Doctor for Windows) (Version: 1.1.6664.10 - Dell)
    Dell System Detect (HKU\S-1-5-21-1426848440-783321390-1561973993-1000\...\73f463568823ebbe) (Version: 6.3.0.6 - Dell)
    Google Chrome (HKLM\...\Google Chrome) (Version: 49.0.2623.112 - Google Inc.)
    Google Update Helper (Version: 1.3.23.0 - SaveSense) Hidden <==== ATTENTION
    Google Update Helper (Version: 1.3.33.3 - Google Inc.) Hidden
    Hardware Helper (HKLM\...\Hardware Helper_is1) (Version:  - Driver-Soft Inc.)
    Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version:  - )
    Intel(R) PRO Network Connections 12.1.11.0 (HKLM\...\PROSetDX) (Version:  - Intel)
    Java 7 Update 25 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.250 - Oracle)
    Malwarebytes Anti-Malware version 2.1.8.1057 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
    Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
    Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
    Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    MSXML 4.0 SP2 (KB927978) (HKLM\...\{37477865-A3F1-4772-AD43-AAFC6BCFF99F}) (Version: 4.20.9841.0 - Microsoft Corporation)
    MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
    MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
    MSXML 4.0 SP2 Parser and SDK (HKLM\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
    OLYMPUS Digital Camera Updater (HKLM\...\{2A9E8F56-C31B-4DBB-BFE2-0F4EC8192355}) (Version: 1.0.3 - OLYMPUS IMAGING CORP.)
    OLYMPUS Master 2 (HKLM\...\{3A1AB8E6-748E-4B95-AA2D-FE9952EB3106}) (Version: 1.0.13 - OLYMPUS IMAGING CORP.)
    OLYMPUS Viewer 3 (HKLM\...\{04B5B5DD-A55E-4A9D-A17E-C7E80222379D}) (Version: 1.0.2 - OLYMPUS IMAGING CORP.)
    QuickTime (HKLM\...\QuickTime) (Version:  - )
    RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0 - RealNetworks, Inc) Hidden
    RealPlayer (HKLM\...\RealPlayer 12.0) (Version:  - RealNetworks)
    Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5408 - Realtek Semiconductor Corp.)
    RealUpgrade 1.1 (Version: 1.1.0 - RealNetworks, Inc.) Hidden
    Rhapsody MP3 Download Manager (HKLM\...\{A3D44AD8-D3C9-45E4-B861-3B653C6EF620}) (Version: 1.0.4.219 - RealNetworks)
    Simple Adblock (HKLM\...\{A9A75A7F-4785-430D-8013-77BC1FD13A4C}) (Version: 1.1.5 - Simple Adblock)
    Supple -- Episode 1 (remove only) (HKLM\...\Supple -- Episode 1) (Version:  - )
    UTH Calling Card (HKLM\...\{C2835850-FCEB-4A1A-A213-57E7A9A8EC62}) (Version: 7.0.454 - LogMeIn, Inc.)
    Windows Driver Package - OLYMPUS IMAGING CORP. Camera Communication Driver Package (09/09/2009 1.0.0.0) (HKLM\...\E77704EF5E71F4F18CADFBFA68595AFE036D5D97) (Version: 09/09/2009 1.0.0.0 - OLYMPUS IMAGING CORP.)
    Windows Live ID Sign-in Assistant (HKLM\...\{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}) (Version: 6.500.3165.0 - Microsoft Corporation)
    Zemana AntiMalware (HKLM\...\{8F0CD7D1-42F3-4195-95CD-833578D45057}_is1) (Version: 2.72.0.388 - Zemana Ltd.)

    ==================== Custom CLSID (Whitelisted): ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    ==================== Scheduled Tasks (Whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    Task: {097523D3-C5D6-47AC-856F-2C95FC03E969} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2017-03-03] (Piriform Ltd)
    Task: {1CCD98B0-113A-477F-8922-CAEF7436D577} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-1426848440-783321390-1561973993-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2011-01-24] (RealNetworks, Inc.)
    Task: {2CB7A841-3A95-4B5E-A93F-7466F8ACB1F5} - System32\Tasks\{1687D340-94F6-4E96-9801-83416BA765C6} => pcalua.exe -a E:\Launcher.exe -d E:\
    Task: {40A54D1A-4907-4B43-A705-3C0D1AA7C5FF} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-1426848440-783321390-1561973993-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2011-01-24] (RealNetworks, Inc.)
    Task: {4B11D352-4AB4-4A55-97A4-D4AD4ABF41A3} - System32\Tasks\ReclaimerUpdateXML_esther => C:\Users\esther\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.60\agent\rnupgagent.exe [2013-09-30] (RealNetworks, Inc.)
    Task: {52670497-692D-49D6-9343-662AA082F8E9} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-09-04] (Google Inc.)
    Task: {83F15CAC-B2FB-455A-8AA1-3CDFA7B3DAD8} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-12-14] (Adobe Systems Incorporated)
    Task: {A8F2B9CC-B5A5-4254-A55E-18E4FF896D34} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2016-11-25] (Adobe Systems Incorporated)
    Task: {BCE5A883-3BFE-407C-9677-1F4BCB8F60A7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-09-04] (Google Inc.)
    Task: {C35CF2DD-7CD8-485F-BC3F-5C8F768DA264} - \OffersWizard Update -> No File <==== ATTENTION
    Task: {CC7AA49F-5C02-4C6E-ADF6-D52F5254ED0F} - System32\Tasks\{E1F5820E-28F4-4FD0-A610-466479EFFD99} => pcalua.exe -a E:\setup.exe -d E:\

    (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

    Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

    ==================== Shortcuts =============================

    (The entries could be listed to be restored or removed.)

    ==================== Loaded Modules (Whitelisted) ==============

    2017-04-12 19:57 - 2017-04-12 19:57 - 00130928 _____ () C:\Program Files\Zemana AntiMalware\ZAMShellExt32.dll
    2014-05-28 13:06 - 2012-07-27 04:27 - 00020288 _____ () C:\Program Files\CCleaner\branding.dll

    ==================== Alternate Data Streams (Whitelisted) =========

    (If an entry is included in the fixlist, only the ADS will be removed.)

    AlternateDataStreams: C:\ProgramData\TEMP:373E1720 [118]

    ==================== Safe Mode (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)

    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AmmyyAdmin => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AmmyyAdmin_31C => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AmmyyAdmin_6F4 => ""="Service"

    ==================== Association (Whitelisted) ===============

    (If an entry is included in the fixlist, the registry item will be restored to default or removed.)


    ==================== Internet Explorer trusted/restricted ===============

    (If an entry is included in the fixlist, it will be removed from the registry.)

    IE trusted site: HKU\S-1-5-21-1426848440-783321390-1561973993-1000\...\dell.com -> dell.com

    ==================== Hosts content: ===============================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2006-11-02 06:23 - 2006-09-18 17:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts

    127.0.0.1       localhost
    ::1             localhost

    ==================== Other Areas ============================

    (Currently there is no automatic fix for this section.)

    HKU\S-1-5-21-1426848440-783321390-1561973993-1000\Control Panel\Desktop\\Wallpaper -> 
    DNS Servers: 192.168.0.1
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 2) (ConsentPromptBehaviorUser: 1) (EnableLUA: 1)
    Windows Firewall is enabled.

    ==================== MSCONFIG/TASK MANAGER disabled items ==

    MSCONFIG\Services: AdobeARMservice => 2
    MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3
    MSCONFIG\Services: AERTFilters => 2
    MSCONFIG\Services: AmmyyAdmin => 2
    MSCONFIG\Services: gupdate => 2
    MSCONFIG\Services: gupdatem => 3
    MSCONFIG\startupreg: CCleaner Monitoring => "C:\Program Files\CCleaner\CCleaner.exe" /MONITOR
    MSCONFIG\startupreg: ehTray.exe => C:\Windows\ehome\ehTray.exe
    MSCONFIG\startupreg: HotKeysCmds => C:\Windows\system32\hkcmd.exe
    MSCONFIG\startupreg: IgfxTray => C:\Windows\system32\igfxtray.exe
    MSCONFIG\startupreg: OM2_Monitor => "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" -NoStart
    MSCONFIG\startupreg: OV3_Monitor => "C:\Program Files\OLYMPUS\OLYMPUS Viewer 3\FirstStart.exe" /OS
    MSCONFIG\startupreg: Persistence => C:\Windows\system32\igfxpers.exe
    MSCONFIG\startupreg: RtHDVCpl => RtHDVCpl.exe
    MSCONFIG\startupreg: Windows Defender => %ProgramFiles%\Windows Defender\MSASCui.exe -hide

    ==================== FirewallRules (Whitelisted) ===============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    FirewallRules: [WinCollab-DFSR-In-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
    FirewallRules: [WinCollab-DFSR-Out-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
    FirewallRules: [WinCollab-In-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
    FirewallRules: [WinCollab-Out-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
    FirewallRules: [WinCollab-In-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
    FirewallRules: [WinCollab-Out-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
    FirewallRules: [{C7FAFDB4-4D7E-4557-9A65-AD419C55745D}] => (Allow) LPort=80
    FirewallRules: [{D288A750-0312-49D4-88D4-83BA56E01D95}] => (Allow) LPort=80
    FirewallRules: [{D5698ADA-74CA-4F34-9436-9BB1025E89E7}] => (Allow) LPort=80
    FirewallRules: [{BB99781F-8A54-463C-A0CE-815431038A92}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
    FirewallRules: [TCP Query User{C24AE363-E921-4176-B6C0-B8A75718CB44}C:\users\esther\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe] => (Allow) C:\users\esther\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe
    FirewallRules: [UDP Query User{66F4856B-950C-48F6-ABB1-DA5107F4CD89}C:\users\esther\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe] => (Allow) C:\users\esther\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe
    FirewallRules: [TCP Query User{BF313E19-7195-4A45-BF15-1EB03C9B7589}C:\logmein rescue calling card\callingcard.exe] => (Block) C:\logmein rescue calling card\callingcard.exe
    FirewallRules: [UDP Query User{86FBAAF5-CCA7-4453-A989-A810A0005D3E}C:\logmein rescue calling card\callingcard.exe] => (Block) C:\logmein rescue calling card\callingcard.exe
    FirewallRules: [{C910226C-E8AC-477B-B9D4-6CB91A4DFB99}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe

    ==================== Restore Points =========================

    03-02-2017 18:19:04 Windows Update
    06-02-2017 12:16:09 Scheduled Checkpoint
    13-02-2017 21:07:29 Windows Update
    17-02-2017 13:29:08 Windows Update
    19-02-2017 16:24:03 Scheduled Checkpoint
    21-02-2017 07:28:20 Scheduled Checkpoint
    21-02-2017 07:40:52 Windows Update
    22-02-2017 19:13:58 Scheduled Checkpoint
    23-02-2017 13:00:22 Windows Update
    25-02-2017 09:44:53 Scheduled Checkpoint
    02-03-2017 09:51:55 Scheduled Checkpoint
    02-03-2017 10:02:49 Windows Update
    04-03-2017 10:22:55 Scheduled Checkpoint
    08-03-2017 19:24:30 Scheduled Checkpoint
    08-03-2017 19:37:14 Windows Update
    10-03-2017 19:11:53 Scheduled Checkpoint
    11-03-2017 11:55:54 Scheduled Checkpoint
    13-03-2017 08:48:18 Windows Update
    16-03-2017 08:06:37 Scheduled Checkpoint
    19-03-2017 12:00:18 Windows Update
    21-03-2017 19:45:22 Scheduled Checkpoint
    22-03-2017 12:00:28 Windows Update
    23-03-2017 20:46:33 Scheduled Checkpoint
    27-03-2017 16:40:03 Scheduled Checkpoint
    27-03-2017 16:52:33 Windows Update
    30-03-2017 17:27:55 Windows Update
    04-04-2017 10:26:51 Windows Update
    06-04-2017 17:04:05 Scheduled Checkpoint
    10-04-2017 08:51:52 Scheduled Checkpoint
    10-04-2017 09:05:14 Windows Update
    11-04-2017 19:08:04 Scheduled Checkpoint
    12-04-2017 08:53:12 Scheduled Checkpoint
    13-04-2017 13:37:31 JRT Pre-Junkware Removal
    13-04-2017 19:06:52 JRT Pre-Junkware Removal

    ==================== Faulty Device Manager Devices =============

    Name: 6TO4 Adapter
    Description: Microsoft 6to4 Adapter
    Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
    Manufacturer: Microsoft
    Service: tunnel
    Problem: : This device cannot start. (Code10)
    Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
    On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


    ==================== Event log errors: =========================

    Application errors:
    ==================

    System errors:
    =============

    CodeIntegrity:
    ===================================
      Date: 2017-04-13 12:57:55.688
      Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

      Date: 2017-04-13 12:57:55.095
      Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

      Date: 2017-04-13 12:57:54.502
      Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

      Date: 2017-04-13 12:57:53.909
      Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

      Date: 2017-04-13 12:57:53.317
      Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

      Date: 2017-04-13 12:57:52.708
      Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

      Date: 2017-04-13 12:57:51.148
      Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

      Date: 2017-04-13 12:57:50.524
      Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

      Date: 2017-04-13 12:57:49.916
      Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

      Date: 2017-04-13 12:57:49.323
      Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.


    ==================== Memory info =========================== 

    Processor: Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz
    Percentage of memory in use: 68%
    Total physical RAM: 2036.45 MB
    Available physical RAM: 646.25 MB
    Total Virtual: 4319.94 MB
    Available Virtual: 2199.75 MB

    ==================== Drives ================================

    Drive c: (OS) (Fixed) (Total:288.04 GB) (Free:198.64 GB) NTFS ==>[drive with boot components (obtained from BCD)]
    Drive d: (RECOVERY) (Fixed) (Total:10 GB) (Free:3.88 GB) NTFS

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298.1 GB) (Disk ID: 08000000)
    Partition 1: (Not Active) - (Size=47 MB) - (Type=DE)
    Partition 2: (Not Active) - (Size=10 GB) - (Type=07 NTFS)
    Partition 3: (Active) - (Size=288 GB) - (Type=07 NTFS)

    ==================== End of Addition.txt ============================

     

    Wildtangent present

    in Resolved Malware Removal Logs

    Posted

    Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 15-03-2017
    Ran by Mike (administrator) on HARRYPOTTER (12-04-2017 05:29:10)
    Running from C:\Users\Mike\Desktop
    Loaded Profiles: Mike (Available Profiles: Mike & Administrator & Guest)
    Platform: Windows 10 Home Version 1607 (X64) Language: English (United States)
    Internet Explorer Version 11 (Default browser: Chrome)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
    (Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
    (Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
    (Microsoft Corporation) C:\Windows\System32\InputMethod\CHS\ChsIME.exe
    (Pixart Imaging Inc) C:\Windows\System32\TiltWheelMouse.exe
    (Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
    (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE
    (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerSt.exe
    (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe
    (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    (CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
    (Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
    (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
    (Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
    () C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1703.601.0_x64__8wekyb3d8bbwe\Calculator.exe
    (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
    (Geek Unіnstaller) C:\Users\Mike\Downloads\geek\geek.exe
    (Geek Unіnstaller) C:\Users\Mike\AppData\Local\Temp\geek64.exe
    (Microsoft Corporation) C:\Windows\System32\dllhost.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.13.133.0_x64__kzf8qxf38zg5c\SkypeHost.exe
    (Microsoft) C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.13.133.0_x64__kzf8qxf38zg5c\SkypeApp.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Microsoft Corporation) C:\Windows\System32\smartscreen.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Microsoft Corporation) C:\Windows\System32\InstallAgent.exe
    (Microsoft Corporation) C:\Windows\System32\InstallAgentUserBroker.exe
    (Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
    (Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Microsoft Corporation) C:\Program Files\Internet Explorer\ielowutil.exe
    (Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.1051_none_7f2bf7ea21d201b2\TiWorker.exe

    ==================== Registry (Whitelisted) ====================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [MouseDriver] => C:\WINDOWS\system32\TiltWheelMouse.exe [241152 2013-04-09] (Pixart Imaging Inc)
    HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [631808 2017-01-03] (Microsoft Corporation)
    HKLM\...\Run: [ZAM] => C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe [14516464 2017-03-28] (Copyright 2017.)
    HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2780112 2017-01-20] (Malwarebytes)
    HKLM-x32\...\Run: [AccelerometerSysTrayApplet] => C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerST.exe [77088 2013-03-01] (Hewlett-Packard Company)
    HKLM-x32\...\Run: [HPMessageService] => C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe [1045304 2013-02-25] (Hewlett-Packard Development Company, L.P.)
    HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [335232 2015-04-10] (Oracle Corporation)
    HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [452272 2012-08-31] (CANON INC.)
    HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1160408 2016-12-19] (Adobe Systems Incorporated)
    HKU\S-1-5-21-3872570739-2396358053-2626862775-1002\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9364696 2017-03-03] (Piriform Ltd)
    HKU\S-1-5-21-3872570739-2396358053-2626862775-1002\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\Mystify.scr [152064 2016-07-16] (Microsoft Corporation)
    ShellIconOverlayIdentifiers: [  GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google)
    ShellIconOverlayIdentifiers: [  GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google)
    ShellIconOverlayIdentifiers: [  GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google)
    ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Mike\AppData\Local\Microsoft\OneDrive\17.3.6743.1212\amd64\FileSyncShell64.dll [2017-01-28] (Microsoft Corporation)
    ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Mike\AppData\Local\Microsoft\OneDrive\17.3.6743.1212\amd64\FileSyncShell64.dll [2017-01-28] (Microsoft Corporation)
    ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Mike\AppData\Local\Microsoft\OneDrive\17.3.6743.1212\amd64\FileSyncShell64.dll [2017-01-28] (Microsoft Corporation)
    ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Mike\AppData\Local\Microsoft\OneDrive\17.3.6743.1212\FileSyncShell.dll [2017-01-28] (Microsoft Corporation)
    ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Mike\AppData\Local\Microsoft\OneDrive\17.3.6743.1212\FileSyncShell.dll [2017-01-28] (Microsoft Corporation)
    ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Mike\AppData\Local\Microsoft\OneDrive\17.3.6743.1212\FileSyncShell.dll [2017-01-28] (Microsoft Corporation)
    Startup: C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk [2015-12-12]
    ShortcutTarget: Send to OneNote.lnk -> C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE (Microsoft Corporation)

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
    Tcpip\..\Interfaces\{05c3badc-87e0-4a19-9931-4316c8515cb8}: [DhcpNameServer] 192.168.0.1
    Tcpip\..\Interfaces\{ba543bac-f5dc-42fd-b3f8-92c0928bac8b}: [DhcpNameServer] 75.75.75.75 75.75.76.76

    Internet Explorer:
    ==================
    HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.msn.com/HPNOT13/1
    HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPNOT13/1
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = 
    HKU\S-1-5-21-3872570739-2396358053-2626862775-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPNOT13/1
    HKU\S-1-5-21-3872570739-2396358053-2626862775-1002\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://g.msn.com/HPNOT13/1
    SearchScopes: HKLM -> {59C43DA6-EC65-4CC1-AE6B-1FE6DA283A76} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
    SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
    SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
    SearchScopes: HKU\S-1-5-21-3872570739-2396358053-2626862775-1002 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
    BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2016-05-15] (Microsoft Corporation)
    BHO: No Name -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> No File
    BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-04-24] (Oracle Corporation)
    BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2016-05-15] (Microsoft Corporation)
    BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-24] (Oracle Corporation)
    BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard)
    BHO-x32: No Name -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> No File
    BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)
    Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-05-15] (Microsoft Corporation)
    Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-05-15] (Microsoft Corporation)
    Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-05-15] (Microsoft Corporation)
    Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-05-15] (Microsoft Corporation)
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} -  No File

    FireFox:
    ========
    FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-24] (Oracle Corporation)
    FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-24] (Oracle Corporation)
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50905.0\npctrl.dll [2017-02-10] ( Microsoft Corporation)
    FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1166636.dll [2012-08-08] (Adobe Systems, Inc.)
    FF Plugin-x32: @authentec.com/ffwloplugin -> C:\Program Files (x86)\HP SimplePass\npffwloplugin.dll [2013-06-07] ( HP)
    FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50905.0\npctrl.dll [2017-02-10] ( Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2016-05-15] (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.3\npGoogleUpdate3.dll [2017-04-12] (Google Inc.)
    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.3\npGoogleUpdate3.dll [2017-04-12] (Google Inc.)
    FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2012-10-12] ()
    FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-12-23] (Adobe Systems Inc.)

    Chrome: 
    =======
    CHR DefaultProfile: Default
    CHR HomePage: Default -> chrome://apps/
    CHR Profile: C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default [2017-04-12]
    CHR Extension: (Google Drive) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-21]
    CHR Extension: (YouTube) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-24]
    CHR Extension: (Adblock Plus) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2017-04-03]
    CHR Extension: (Pushbullet) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\chlffgpmiacpedhhbkiomidkjlcfhogd [2016-12-11]
    CHR Extension: (Add to Amazon Wish List) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\ciagpekplgpbepdgggflgmahnjgiaced [2016-06-01]
    CHR Extension: (Google Search) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-28]
    CHR Extension: (High Contrast) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\djcfdncoelnlbldjfhinnjlhdjlikmph [2016-12-11]
    CHR Extension: (Adobe Acrobat) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2017-04-03]
    CHR Extension: (Google Calendar) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjicmeblgpmajnghnpcppodonldlgfn [2017-01-09]
    CHR Extension: (Dota 2 Trained Heroes) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\enadgfobcafbklbkhcdpfljaoacefdfj [2016-12-11]
    CHR Extension: (Chrome Remote Desktop) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbchcmhmhahfdphkhkmpfmihenigjmpp [2017-04-03]
    CHR Extension: (Google Play Movies & TV) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\gdijeikdkaembjbdobgfkoidjkpbmlkd [2017-01-03]
    CHR Extension: (Google Docs Offline) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-16]
    CHR Extension: (Desktop Notifications for Android) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\giicnncicnopjohcpamieklkiacdoeni [2016-12-11]
    CHR Extension: (Google Keep) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcfcmgpnmpinpidjdgejehjchlbglpde [2016-06-19]
    CHR Extension: (Google Play Music) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\icppfcnhkcmnfdhfhphakoifcfokfdhg [2016-06-07]
    CHR Extension: (Google Music) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbjijkbhhpooledgnalojcgkmllbcnog [2017-04-03]
    CHR Extension: (Awesome Reload All Tabs Button) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\kamfkajbgmjkfmfgcikbmbmpjfokfijk [2016-04-06]
    CHR Extension: (Google Play) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\komhbcfkdcgmcdoenjcjheifdiabikfi [2015-02-12]
    CHR Extension: (GosuGamers Chrome Extension) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhpjniojlbdhldmiaefpmekpihnlgilj [2016-08-03]
    CHR Extension: (Progress Bar Timer) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmnlbapfmmoaehepmgbkgfcgpddlhbko [2016-12-11]
    CHR Extension: (Google Maps) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\lneaknkopdijkpnocmklfnjbeapigfbh [2015-09-17]
    CHR Extension: (Google Keep Chrome Extension) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\lpcaedmchfhocbbapmcbpinfpgnhiddi [2016-08-08]
    CHR Extension: (Chrome Web Store Payments) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-04-03]
    CHR Extension: (Google Play Music) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohpkjjfnffomjmcjinebceemmnfeadhk [2016-04-22]
    CHR Extension: (Gmail) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-29]
    CHR Extension: (Chrome Media Router) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-04-06]
    CHR HKU\S-1-5-21-3872570739-2396358053-2626862775-1002\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
    CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
    CHR HKLM-x32\...\Chrome\Extension: [kanflfepiobnpjbljmngfgegijhdpljm] - C:\Program Files (x86)\HP SimplePass\tschrome.crx [2013-04-01]

    ==================== Services (Whitelisted) ====================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    S4 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2013-02-14] (Advanced Micro Devices, Inc.) [File not signed]
    S4 chromoting; C:\Program Files (x86)\Google\Chrome Remote Desktop\57.0.2987.37\remoting_host.exe [72024 2017-02-07] (Google Inc.)
    R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [2911472 2016-05-15] (Microsoft Corporation)
    S4 FPLService; C:\Program Files (x86)\HP SimplePass\TrueSuiteService.exe [1641768 2013-06-07] (HP)
    S4 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [135488 2017-04-08] (SurfRight B.V.)
    S4 HPWMISVC; C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe [1039160 2013-02-01] (Hewlett-Packard Development Company, L.P.)
    S4 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4355024 2017-01-20] (Malwarebytes)
    S3 npggsvc; C:\WINDOWS\SysWOW64\GameMon.des [3916368 2016-01-09] (INCA Internet Co., Ltd.)
    S4 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [269400 2016-10-05] (Synaptics Incorporated)
    S4 TrueService; C:\Program Files\Common Files\AuthenTec\TrueService.exe [401856 2013-01-08] (AuthenTec, Inc.)
    S4 valWBFPolicyService; C:\Windows\system32\valWBFPolicyService.exe [28160 2013-02-12] () [File not signed]
    R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
    R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103712 2017-03-04] (Microsoft Corporation)
    S4 ZAMSvc; C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe [14516464 2017-03-28] (Copyright 2017.)

    ===================== Drivers (Whitelisted) ======================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    U5 amd_sata; C:\Windows\System32\Drivers\amd_sata.sys [80552 2012-11-30] (Advanced Micro Devices)
    U5 amd_xata; C:\Windows\System32\Drivers\amd_xata.sys [26280 2012-11-30] (Advanced Micro Devices)
    S3 AtiDCM; C:\AMD\WU-CCC2\ccc2_install\Support64\atdcm64a.sys [28416 2014-03-13] (Advanced Micro Devices, Inc.)
    R3 AtiHDAudioService; C:\WINDOWS\system32\drivers\AtihdWT6.sys [102912 2015-05-28] (Advanced Micro Devices)
    S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.)
    S3 ElcMouLFlt; C:\WINDOWS\System32\drivers\ElcMouLFlt.sys [28648 2015-09-11] (ELECOM)
    S3 ElcMouUFlt; C:\WINDOWS\System32\drivers\ElcMouUFlt.sys [27624 2015-09-11] (ELECOM)
    R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [77440 2017-03-24] ()
    R2 MBAMChameleon; C:\WINDOWS\system32\drivers\MBAMChameleon.sys [186304 2017-04-03] (Malwarebytes)
    S3 MBAMFarflt; C:\WINDOWS\system32\drivers\farflt.sys [111544 2017-04-09] (Malwarebytes)
    S3 MBAMProtection; C:\WINDOWS\system32\drivers\mbam.sys [43968 2017-04-09] (Malwarebytes)
    R0 MBAMSwissArmy; C:\WINDOWS\System32\drivers\MBAMSwissArmy.sys [251832 2017-04-09] (Malwarebytes)
    S3 MBAMWebProtection; C:\WINDOWS\system32\drivers\mwac.sys [92096 2017-04-09] (Malwarebytes)
    S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
    R3 netr28x; C:\WINDOWS\system32\DRIVERS\netr28x.sys [2554528 2015-06-12] (MediaTek Inc.)
    R3 RSP2STOR; C:\WINDOWS\system32\DRIVERS\RtsP2Stor.sys [310528 2015-06-05] (Realtek Semiconductor Corp.)
    R3 rtbth; C:\WINDOWS\System32\drivers\rtbth.sys [1219200 2015-06-03] (Ralink Technology, Corp.)
    R3 SmbDrv; C:\WINDOWS\system32\DRIVERS\Smb_driver_AMDASF.sys [76376 2016-10-05] (Synaptics Incorporated)
    S3 SmbDrvI; C:\WINDOWS\System32\drivers\Smb_driver_Intel.sys [31984 2013-02-06] (Synaptics Incorporated)
    S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [165504 2016-09-05] (Samsung Electronics Co., Ltd.)
    S3 t_mouse.sys; C:\WINDOWS\system32\DRIVERS\t_mouse.sys [6144 2013-04-09] ()
    S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
    R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
    R3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
    R3 WirelessButtonDriver; C:\WINDOWS\System32\drivers\WirelessButtonDriver64.sys [20800 2012-08-31] (Hewlett-Packard Development Company, L.P.)
    R1 ZAM; C:\WINDOWS\System32\drivers\zam64.sys [203680 2017-04-03] (Zemana Ltd.)
    R1 ZAM_Guard; C:\WINDOWS\System32\drivers\zamguard64.sys [203680 2017-04-03] (Zemana Ltd.)

    ==================== NetSvcs (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    ==================== One Month Created files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2017-04-12 05:29 - 2017-04-12 05:31 - 00023472 _____ C:\Users\Mike\Desktop\FRST.txt
    2017-04-12 05:28 - 2017-04-12 05:29 - 00000000 ____D C:\FRST
    2017-04-12 05:27 - 2017-04-12 05:28 - 02424832 _____ (Farbar) C:\Users\Mike\Desktop\FRST64.exe
    2017-04-12 05:27 - 2017-04-12 05:27 - 00003446 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA1d20589e410f747
    2017-04-12 05:27 - 2017-04-12 05:27 - 00003322 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore1d20589e3f5d424
    2017-04-12 05:26 - 2017-04-12 05:26 - 01766912 _____ (Farbar) C:\Users\Mike\Downloads\FRST.exe
    2017-04-09 18:31 - 2012-10-24 15:44 - 00656048 _____ (WildTangent, Inc.) C:\ProgramData\uninstall1900599.exe
    2017-04-08 19:41 - 2017-04-08 20:20 - 00000000 ____D C:\ProgramData\HitmanPro
    2017-04-08 19:41 - 2017-04-08 19:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
    2017-04-08 19:41 - 2017-04-08 19:41 - 00000000 ____D C:\Program Files\HitmanPro
    2017-04-08 19:40 - 2017-04-08 19:40 - 11583584 _____ (SurfRight B.V.) C:\Users\Mike\Downloads\hitmanpro_x64.exe
    2017-04-07 09:56 - 2017-04-07 09:57 - 02353748 _____ ( ) C:\Users\Mike\Downloads\BatteryCat_v13_w32-setup (1).exe
    2017-04-07 09:42 - 2017-04-07 10:01 - 00000000 ____D C:\Users\Mike\Downloads\hwmonitor_1.31
    2017-04-07 09:35 - 2017-04-07 09:35 - 01413811 _____ C:\Users\Mike\Downloads\hwmonitor_1.31.zip
    2017-04-07 09:34 - 2017-04-07 09:34 - 00870400 _____ C:\Users\Mike\Downloads\coconut_battery_for_windows.iso
    2017-04-06 21:41 - 2017-04-06 21:41 - 00985054 _____ C:\Users\Mike\Downloads\EFRCSetup.exe
    2017-04-06 21:41 - 2017-04-06 21:41 - 00000000 ____D C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Free Registry Cleaner
    2017-04-06 21:41 - 2017-04-06 21:41 - 00000000 ____D C:\Users\Mike\AppData\Roaming\Eusing
    2017-04-06 21:41 - 2017-04-06 21:41 - 00000000 ____D C:\Program Files (x86)\Eusing Free Registry Cleaner
    2017-04-06 21:25 - 2017-04-06 21:25 - 00000000 ____D C:\ProgramData\Emsisoft
    2017-04-06 21:21 - 2017-04-06 21:40 - 00000000 ____D C:\EEK
    2017-04-06 21:00 - 2017-04-06 21:20 - 293165344 _____ C:\Users\Mike\Downloads\EmsisoftEmergencyKit (1).exe
    2017-04-06 21:00 - 2017-04-06 21:01 - 01663904 _____ (Malwarebytes) C:\Users\Mike\Downloads\JRT (1).exe
    2017-04-06 19:43 - 2017-04-06 19:50 - 292921008 _____ C:\Users\Mike\Downloads\EmsisoftEmergencyKit.exe
    2017-04-06 19:43 - 2017-04-06 19:43 - 01663904 _____ (Malwarebytes) C:\Users\Mike\Downloads\JRT.exe
    2017-04-06 19:18 - 2017-03-16 00:38 - 00034088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CompPkgSup.dll
    2017-04-06 19:18 - 2017-03-16 00:05 - 18362368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
    2017-04-06 19:16 - 2017-03-16 00:46 - 01600632 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
    2017-04-06 19:15 - 2017-03-16 01:17 - 01617760 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
    2017-04-06 19:15 - 2017-03-16 01:17 - 00142176 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
    2017-04-06 19:15 - 2017-03-16 00:47 - 00038768 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompPkgSup.dll
    2017-04-06 19:15 - 2017-03-16 00:19 - 22565376 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
    2017-04-06 19:15 - 2017-03-16 00:03 - 23676416 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
    2017-04-05 20:03 - 2017-04-08 19:28 - 00000000 ____D C:\AdwCleaner
    2017-04-05 20:03 - 2017-04-05 20:03 - 04089296 _____ C:\Users\Mike\Downloads\AdwCleaner.exe
    2017-04-04 18:23 - 2017-03-04 03:57 - 00315744 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
    2017-04-04 18:23 - 2017-03-04 02:56 - 00248992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\policymanager.dll
    2017-04-04 18:23 - 2017-03-04 02:53 - 00136032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudExperienceHostUser.dll
    2017-04-04 18:23 - 2017-03-04 02:51 - 00576408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
    2017-04-04 18:23 - 2017-03-04 02:47 - 01853224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
    2017-04-04 18:23 - 2017-03-04 02:47 - 01557808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll
    2017-04-04 18:23 - 2017-03-04 02:47 - 01344448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsrcsnk.dll
    2017-04-04 18:23 - 2017-03-04 02:47 - 01277856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfasfsrcsnk.dll
    2017-04-04 18:23 - 2017-03-04 02:47 - 00640976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\evr.dll
    2017-04-04 18:23 - 2017-03-04 02:47 - 00374448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFPlay.dll
    2017-04-04 18:23 - 2017-03-04 02:45 - 00173408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\basecsp.dll
    2017-04-04 18:23 - 2017-03-04 02:42 - 00545944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
    2017-04-04 18:23 - 2017-03-04 02:36 - 05685760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
    2017-04-04 18:23 - 2017-03-04 02:30 - 00095232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataTimeUtil.dll
    2017-04-04 18:23 - 2017-03-04 02:30 - 00051712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usoapi.dll
    2017-04-04 18:23 - 2017-03-04 02:30 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LaunchWinApp.exe
    2017-04-04 18:23 - 2017-03-04 02:30 - 00026112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\odbcconf.dll
    2017-04-04 18:23 - 2017-03-04 02:29 - 00112640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssitlb.dll
    2017-04-04 18:23 - 2017-03-04 02:29 - 00039424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XInputUap.dll
    2017-04-04 18:23 - 2017-03-04 02:29 - 00019968 _____ C:\WINDOWS\SysWOW64\GamePanelExternalHook.dll
    2017-04-04 18:23 - 2017-03-04 02:28 - 00224256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExSMime.dll
    2017-04-04 18:23 - 2017-03-04 02:27 - 00275968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\accountaccessor.dll
    2017-04-04 18:23 - 2017-03-04 02:27 - 00141824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Radios.dll
    2017-04-04 18:23 - 2017-03-04 02:26 - 00156672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDeviceRegistration.dll
    2017-04-04 18:23 - 2017-03-04 02:26 - 00156672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BcastDVRHelper.dll
    2017-04-04 18:23 - 2017-03-04 02:26 - 00147456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VCardParser.dll
    2017-04-04 18:23 - 2017-03-04 02:26 - 00138240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DisplayManager.dll
    2017-04-04 18:23 - 2017-03-04 02:26 - 00123904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.HostName.dll
    2017-04-04 18:23 - 2017-03-04 02:26 - 00065024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Gaming.UI.GameBar.dll
    2017-04-04 18:23 - 2017-03-04 02:26 - 00047104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Shell.Search.UriHandler.dll
    2017-04-04 18:23 - 2017-03-04 02:26 - 00038912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wfdprov.dll
    2017-04-04 18:23 - 2017-03-04 02:26 - 00025600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netiougc.exe
    2017-04-04 18:23 - 2017-03-04 02:25 - 00152064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MCCSEngineShared.dll
    2017-04-04 18:23 - 2017-03-04 02:25 - 00136192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinRtTracing.dll
    2017-04-04 18:23 - 2017-03-04 02:25 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BrowserSettingSync.dll
    2017-04-04 18:23 - 2017-03-04 02:25 - 00097792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.System.SystemManagement.dll
    2017-04-04 18:23 - 2017-03-04 02:25 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tbauth.dll
    2017-04-04 18:23 - 2017-03-04 02:24 - 00328192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\daxexec.dll
    2017-04-04 18:23 - 2017-03-04 02:24 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scksp.dll
    2017-04-04 18:23 - 2017-03-04 02:24 - 00129024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.SerialCommunication.dll
    2017-04-04 18:23 - 2017-03-04 02:24 - 00088576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDeviceRegistration.Ngc.dll
    2017-04-04 18:23 - 2017-03-04 02:24 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.ServiceDiscovery.Dnssd.dll
    2017-04-04 18:23 - 2017-03-04 02:24 - 00022016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBrokerCookies.exe
    2017-04-04 18:23 - 2017-03-04 02:23 - 00392192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Gaming.Input.dll
    2017-04-04 18:23 - 2017-03-04 02:23 - 00374784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.LowLevel.dll
    2017-04-04 18:23 - 2017-03-04 02:23 - 00334848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DavSyncProvider.dll
    2017-04-04 18:23 - 2017-03-04 02:23 - 00315904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Gaming.XboxLive.Storage.dll
    2017-04-04 18:23 - 2017-03-04 02:23 - 00299520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataAccountApis.dll
    2017-04-04 18:23 - 2017-03-04 02:23 - 00231936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll
    2017-04-04 18:23 - 2017-03-04 02:22 - 00332288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapConfiguration.dll
    2017-04-04 18:23 - 2017-03-04 02:22 - 00265728 _____ C:\WINDOWS\SysWOW64\Windows.Perception.Stub.dll
    2017-04-04 18:23 - 2017-03-04 02:22 - 00237568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SyncSettings.dll
    2017-04-04 18:23 - 2017-03-04 02:22 - 00231424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudBackupSettings.dll
    2017-04-04 18:23 - 2017-03-04 02:22 - 00230912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\icm32.dll
    2017-04-04 18:23 - 2017-03-04 02:22 - 00212992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cemapi.dll
    2017-04-04 18:23 - 2017-03-04 02:22 - 00183296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchFilterHost.exe
    2017-04-04 18:23 - 2017-03-04 02:22 - 00117760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AuthBroker.dll
    2017-04-04 18:23 - 2017-03-04 02:21 - 01243136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.FaceAnalysis.dll
    2017-04-04 18:23 - 2017-03-04 02:21 - 00609280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Import.dll
    2017-04-04 18:23 - 2017-03-04 02:21 - 00575488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll
    2017-04-04 18:23 - 2017-03-04 02:21 - 00298496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.Management.dll
    2017-04-04 18:23 - 2017-03-04 02:21 - 00202752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.HumanInterfaceDevice.dll
    2017-04-04 18:23 - 2017-03-04 02:21 - 00185856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Identity.Provider.dll
    2017-04-04 18:23 - 2017-03-04 02:20 - 00632832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sud.dll
    2017-04-04 18:23 - 2017-03-04 02:20 - 00562176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.SmartCards.dll
    2017-04-04 18:23 - 2017-03-04 02:20 - 00426496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Wallet.dll
    2017-04-04 18:23 - 2017-03-04 02:20 - 00426496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OneDriveSettingSyncProvider.dll
    2017-04-04 18:23 - 2017-03-04 02:20 - 00386048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.WiFiDirect.dll
    2017-04-04 18:23 - 2017-03-04 02:20 - 00284672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\apprepsync.dll
    2017-04-04 18:23 - 2017-03-04 02:20 - 00218624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WwaApi.dll
    2017-04-04 18:23 - 2017-03-04 02:20 - 00206336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vaultcli.dll
    2017-04-04 18:23 - 2017-03-04 02:20 - 00175616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Scanners.dll
    2017-04-04 18:23 - 2017-03-04 02:20 - 00125952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\apprepapi.dll
    2017-04-04 18:23 - 2017-03-04 02:19 - 00498688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mbsmsapi.dll
    2017-04-04 18:23 - 2017-03-04 02:19 - 00431616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\efswrt.dll
    2017-04-04 18:23 - 2017-03-04 02:19 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Picker.dll
    2017-04-04 18:23 - 2017-03-04 02:19 - 00226816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dhcpcore6.dll
    2017-04-04 18:23 - 2017-03-04 02:18 - 00567808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ChatApis.dll
    2017-04-04 18:23 - 2017-03-04 02:18 - 00314368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Usb.dll
    2017-04-04 18:23 - 2017-03-04 02:18 - 00253952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
    2017-04-04 18:23 - 2017-03-04 02:18 - 00074752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\updatepolicy.dll
    2017-04-04 18:23 - 2017-03-04 02:17 - 00529920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StructuredQuery.dll
    2017-04-04 18:23 - 2017-03-04 02:17 - 00297472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchProtocolHost.exe
    2017-04-04 18:23 - 2017-03-04 02:16 - 00858112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EmailApis.dll
    2017-04-04 18:23 - 2017-03-04 02:16 - 00636928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winhttp.dll
    2017-04-04 18:23 - 2017-03-04 02:16 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll
    2017-04-04 18:23 - 2017-03-04 02:15 - 00313856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
    2017-04-04 18:23 - 2017-03-04 02:13 - 01228288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usercpl.dll
    2017-04-04 18:23 - 2017-03-04 02:13 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppointmentApis.dll
    2017-04-04 18:23 - 2017-03-04 02:13 - 00675840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.dll
    2017-04-04 18:23 - 2017-03-04 02:13 - 00653312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.AccountsControl.dll
    2017-04-04 18:23 - 2017-03-04 02:12 - 00886272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aadtb.dll
    2017-04-04 18:23 - 2017-03-04 02:12 - 00589312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Sensors.dll
    2017-04-04 18:23 - 2017-03-04 02:10 - 03307008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
    2017-04-04 18:23 - 2017-03-04 02:10 - 01077760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Editing.dll
    2017-04-04 18:23 - 2017-03-04 02:10 - 00471552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.BackgroundMediaPlayback.dll
    2017-04-04 18:23 - 2017-03-04 02:09 - 00795648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MiracastReceiver.dll
    2017-04-04 18:23 - 2017-03-04 02:09 - 00343040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PlayToDevice.dll
    2017-04-04 18:23 - 2017-03-04 02:09 - 00123904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ProximityCommon.dll
    2017-04-04 18:23 - 2017-03-04 02:07 - 00895488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Streaming.dll
    2017-04-04 18:23 - 2017-03-04 02:07 - 00545280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmkvsrcsnk.dll
    2017-04-04 18:23 - 2017-03-04 02:06 - 05380608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingMaps.dll
    2017-04-04 18:23 - 2017-03-04 02:06 - 03198464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdp.dll
    2017-04-04 18:23 - 2017-03-04 02:06 - 00220672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PlayToReceiver.dll
    2017-04-04 18:23 - 2017-03-04 02:06 - 00090624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll
    2017-04-04 18:23 - 2017-03-04 02:05 - 01221120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Audio.dll
    2017-04-04 18:23 - 2017-03-04 02:05 - 01133568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vssapi.dll
    2017-04-04 18:23 - 2017-03-04 02:05 - 00545792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\uReFS.dll
    2017-04-04 18:23 - 2017-03-04 02:05 - 00134144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ErrorDetails.dll
    2017-04-04 18:23 - 2017-03-04 02:05 - 00089600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CameraCaptureUI.dll
    2017-04-04 18:23 - 2017-03-04 02:04 - 00640000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MCRecvSrc.dll
    2017-04-04 18:23 - 2017-03-04 02:03 - 02363904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapRouter.dll
    2017-04-04 18:23 - 2017-03-04 02:03 - 02109952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapGeocoder.dll
    2017-04-04 18:23 - 2017-03-04 02:03 - 01247232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll
    2017-04-04 18:23 - 2017-03-04 02:03 - 00409600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMVSENCD.DLL
    2017-04-04 18:23 - 2017-03-04 02:03 - 00400384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PlayToManager.dll
    2017-04-04 18:23 - 2017-03-04 02:02 - 01004544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Input.Inking.dll
    2017-04-04 18:23 - 2017-03-04 02:02 - 00580608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hgcpl.dll
    2017-04-04 18:23 - 2017-03-04 02:01 - 01988096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssrch.dll
    2017-04-04 18:23 - 2017-03-04 02:01 - 01656320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Perception.dll
    2017-04-04 18:23 - 2017-03-04 02:01 - 01595904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
    2017-04-04 18:23 - 2017-03-04 02:01 - 01564160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\quartz.dll
    2017-04-04 18:23 - 2017-03-04 02:01 - 01232384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Maps.dll
    2017-04-04 18:23 - 2017-03-04 02:01 - 01154560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Pimstore.dll
    2017-04-04 18:23 - 2017-03-04 02:01 - 00773120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchIndexer.exe
    2017-04-04 18:23 - 2017-03-04 02:01 - 00560640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserLanguagesCpl.dll
    2017-04-04 18:23 - 2017-03-04 02:00 - 02996736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
    2017-04-04 18:23 - 2017-03-04 02:00 - 02483200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
    2017-04-04 18:23 - 2017-03-04 02:00 - 00850944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ContactApis.dll
    2017-04-04 18:23 - 2017-03-04 02:00 - 00751104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.BackgroundTransfer.dll
    2017-04-04 18:23 - 2017-03-04 02:00 - 00691200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
    2017-04-04 18:23 - 2017-03-04 02:00 - 00654336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MbaeApiPublic.dll
    2017-04-04 18:23 - 2017-03-04 02:00 - 00598528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Web.dll
    2017-04-04 18:23 - 2017-03-04 01:59 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Core.TextInput.dll
    2017-04-04 18:22 - 2017-03-04 03:09 - 02206496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2vdec.dll
    2017-04-04 18:22 - 2017-03-04 03:09 - 00497416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dnsapi.dll
    2017-04-04 18:22 - 2017-03-04 03:04 - 02048496 _____ C:\WINDOWS\SysWOW64\CoreUIComponents.dll
    2017-04-04 18:22 - 2017-03-04 03:02 - 00184416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\IPHLPAPI.DLL
    2017-04-04 18:22 - 2017-03-04 02:56 - 00263472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll
    2017-04-04 18:22 - 2017-03-04 02:54 - 02277288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d11.dll
    2017-04-04 18:22 - 2017-03-04 02:54 - 00524776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxgi.dll
    2017-04-04 18:22 - 2017-03-04 02:53 - 02256080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
    2017-04-04 18:22 - 2017-03-04 02:53 - 01431232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll
    2017-04-04 18:22 - 2017-03-04 02:53 - 00975744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.appcore.dll
    2017-04-04 18:22 - 2017-03-04 02:53 - 00861024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll
    2017-04-04 18:22 - 2017-03-04 02:53 - 00781152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWAHost.exe
    2017-04-04 18:22 - 2017-03-04 02:53 - 00493912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
    2017-04-04 18:22 - 2017-03-04 02:47 - 06667528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
    2017-04-04 18:22 - 2017-03-04 02:47 - 04023000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
    2017-04-04 18:22 - 2017-03-04 02:47 - 01360456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetsrc.dll
    2017-04-04 18:22 - 2017-03-04 02:47 - 01202384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll
    2017-04-04 18:22 - 2017-03-04 02:47 - 01123912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfplat.dll
    2017-04-04 18:22 - 2017-03-04 02:47 - 00981376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetcore.dll
    2017-04-04 18:22 - 2017-03-04 02:47 - 00976184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfds.dll
    2017-04-04 18:22 - 2017-03-04 02:47 - 00952416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll
    2017-04-04 18:22 - 2017-03-04 02:47 - 00530480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mf.dll
    2017-04-04 18:22 - 2017-03-04 02:47 - 00352760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MMDevAPI.dll
    2017-04-04 18:22 - 2017-03-04 02:46 - 00321792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LockAppHost.exe
    2017-04-04 18:22 - 2017-03-04 02:40 - 00306800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.MediaControl.dll
    2017-04-04 18:22 - 2017-03-04 02:30 - 01631232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Resources.dll
    2017-04-04 18:22 - 2017-03-04 02:29 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctfp.dll
    2017-04-04 18:22 - 2017-03-04 02:27 - 00055296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\findnetprinters.dll
    2017-04-04 18:22 - 2017-03-04 02:26 - 00177664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Web.Diagnostics.dll
    2017-04-04 18:22 - 2017-03-04 02:25 - 00255488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\unimdm.tsp
    2017-04-04 18:22 - 2017-03-04 02:25 - 00251904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mscandui.dll
    2017-04-04 18:22 - 2017-03-04 02:25 - 00175104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiapi.dll
    2017-04-04 18:22 - 2017-03-04 02:24 - 00142336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.WiFi.dll
    2017-04-04 18:22 - 2017-03-04 02:24 - 00093184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctfui.dll
    2017-04-04 18:22 - 2017-03-04 02:23 - 00531456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iprtrmgr.dll
    2017-04-04 18:22 - 2017-03-04 02:23 - 00506368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcastdvr.exe
    2017-04-04 18:22 - 2017-03-04 02:23 - 00291840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Search.ProtocolHandler.MAPI2.dll
    2017-04-04 18:22 - 2017-03-04 02:23 - 00184320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserMgrProxy.dll
    2017-04-04 18:22 - 2017-03-04 02:23 - 00172032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netiohlp.dll
    2017-04-04 18:22 - 2017-03-04 02:22 - 01299968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVPXENC.dll
    2017-04-04 18:22 - 2017-03-04 02:22 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DafPrintProvider.dll
    2017-04-04 18:22 - 2017-03-04 02:21 - 00670208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.PointOfService.dll
    2017-04-04 18:22 - 2017-03-04 02:21 - 00483840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.AllJoyn.dll
    2017-04-04 18:22 - 2017-03-04 02:21 - 00389632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
    2017-04-04 18:22 - 2017-03-04 02:20 - 13873664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
    2017-04-04 18:22 - 2017-03-04 02:20 - 00534528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PCPTpm12.dll
    2017-04-04 18:22 - 2017-03-04 02:20 - 00506880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DevicePairing.dll
    2017-04-04 18:22 - 2017-03-04 02:20 - 00368128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlanui.dll
    2017-04-04 18:22 - 2017-03-04 02:20 - 00325120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleacc.dll
    2017-04-04 18:22 - 2017-03-04 02:20 - 00271360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\deviceaccess.dll
    2017-04-04 18:22 - 2017-03-04 02:19 - 00714752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssvp.dll
    2017-04-04 18:22 - 2017-03-04 02:19 - 00390656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredProvDataModel.dll
    2017-04-04 18:22 - 2017-03-04 02:19 - 00318464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchFolder.dll
    2017-04-04 18:22 - 2017-03-04 02:18 - 01231360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wcnwiz.dll
    2017-04-04 18:22 - 2017-03-04 02:18 - 00819200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppContracts.dll
    2017-04-04 18:22 - 2017-03-04 02:18 - 00747520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Ocr.dll
    2017-04-04 18:22 - 2017-03-04 02:18 - 00548352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ddraw.dll
    2017-04-04 18:22 - 2017-03-04 02:18 - 00525824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintDialogs.dll
    2017-04-04 18:22 - 2017-03-04 02:18 - 00284672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.dll
    2017-04-04 18:22 - 2017-03-04 02:18 - 00254464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssphtb.dll
    2017-04-04 18:22 - 2017-03-04 02:18 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssph.dll
    2017-04-04 18:22 - 2017-03-04 02:17 - 00238080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AboveLockAppHost.dll
    2017-04-04 18:22 - 2017-03-04 02:16 - 00968704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Unistore.dll
    2017-04-04 18:22 - 2017-03-04 02:16 - 00816640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NaturalLanguage6.dll
    2017-04-04 18:22 - 2017-03-04 02:16 - 00762880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mprddm.dll
    2017-04-04 18:22 - 2017-03-04 02:16 - 00500224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Graphics.Printing.dll
    2017-04-04 18:22 - 2017-03-04 02:16 - 00465920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LockAppBroker.dll
    2017-04-04 18:22 - 2017-03-04 02:16 - 00288256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CryptoWinRT.dll
    2017-04-04 18:22 - 2017-03-04 02:15 - 01543680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mmc.exe
    2017-04-04 18:22 - 2017-03-04 02:15 - 00509440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
    2017-04-04 18:22 - 2017-03-04 02:14 - 01534464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Graphics.Printing.3D.dll
    2017-04-04 18:22 - 2017-03-04 02:14 - 00236032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmWmiPl.dll
    2017-04-04 18:22 - 2017-03-04 02:13 - 06474752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mspaint.exe
    2017-04-04 18:22 - 2017-03-04 02:13 - 04613120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
    2017-04-04 18:22 - 2017-03-04 02:13 - 03733504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll
    2017-04-04 18:22 - 2017-03-04 02:13 - 02458112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\themecpl.dll
    2017-04-04 18:22 - 2017-03-04 02:13 - 00497152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LogonController.dll
    2017-04-04 18:22 - 2017-03-04 02:12 - 00901120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Bluetooth.dll
    2017-04-04 18:22 - 2017-03-04 02:12 - 00884224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
    2017-04-04 18:22 - 2017-03-04 02:12 - 00395264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dmenrollengine.dll
    2017-04-04 18:22 - 2017-03-04 02:11 - 01357312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSPhotography.dll
    2017-04-04 18:22 - 2017-03-04 02:11 - 01320448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comsvcs.dll
    2017-04-04 18:22 - 2017-03-04 02:11 - 00355328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\RTMediaFrame.dll
    2017-04-04 18:22 - 2017-03-04 02:10 - 00259584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msdtcuiu.dll
    2017-04-04 18:22 - 2017-03-04 02:08 - 00713216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wpnapps.dll
    2017-04-04 18:22 - 2017-03-04 02:07 - 02643456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll
    2017-04-04 18:22 - 2017-03-04 02:07 - 01255936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AzureSettingSyncProvider.dll
    2017-04-04 18:22 - 2017-03-04 02:06 - 06109184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll
    2017-04-04 18:22 - 2017-03-04 02:05 - 00458752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlidprov.dll
    2017-04-04 18:22 - 2017-03-04 02:03 - 00359936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mtxclu.dll
    2017-04-04 18:22 - 2017-03-04 02:02 - 02740224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
    2017-04-04 18:22 - 2017-03-04 02:02 - 02138112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputService.dll
    2017-04-04 18:22 - 2017-03-04 02:02 - 01709056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActiveSyncProvider.dll
    2017-04-04 18:22 - 2017-03-04 02:02 - 01170944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Speech.dll
    2017-04-04 18:22 - 2017-03-04 02:02 - 01155072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVP9DEC.dll
    2017-04-04 18:22 - 2017-03-04 02:01 - 02646528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CertEnroll.dll
    2017-04-04 18:22 - 2017-03-04 02:01 - 01993216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
    2017-04-04 18:22 - 2017-03-04 02:01 - 01556992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll
    2017-04-04 18:22 - 2017-03-04 02:01 - 01013248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Web.Http.dll
    2017-04-04 18:22 - 2017-03-04 02:01 - 00827904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.appcore.dll
    2017-04-04 18:22 - 2017-03-04 02:01 - 00620544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll
    2017-04-04 18:22 - 2017-03-04 02:01 - 00566784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ShareHost.dll
    2017-04-04 18:22 - 2017-03-04 02:01 - 00422400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.dll
    2017-04-04 18:22 - 2017-03-04 02:00 - 04557824 _____ (Microsoft) C:\WINDOWS\SysWOW64\dbgeng.dll
    2017-04-04 18:22 - 2017-03-04 02:00 - 01883648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll
    2017-04-04 18:22 - 2017-03-04 02:00 - 01170944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Phone.dll
    2017-04-04 18:22 - 2017-03-04 02:00 - 00862208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll
    2017-04-04 18:22 - 2017-03-04 02:00 - 00798208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
    2017-04-04 18:22 - 2017-03-04 02:00 - 00711680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Search.dll
    2017-04-04 18:22 - 2017-03-04 02:00 - 00444416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSync.dll
    2017-04-04 18:22 - 2017-03-04 02:00 - 00348160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Midi.dll
    2017-04-04 18:22 - 2017-03-04 01:59 - 00353280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TextInputFramework.dll
    2017-04-04 18:22 - 2017-03-04 01:57 - 00783360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TSWorkspace.dll
    2017-04-04 18:22 - 2017-03-04 01:57 - 00449024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TpmCoreProvisioning.dll
    2017-04-04 18:22 - 2017-03-04 01:57 - 00299008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\RADCUI.dll
    2017-04-04 18:22 - 2017-03-04 01:36 - 00483840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
    2017-04-04 18:21 - 2017-03-04 03:57 - 00484584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
    2017-04-04 18:21 - 2017-03-04 03:40 - 00965472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll
    2017-04-04 18:21 - 2017-03-04 03:24 - 00090976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\IPMIDrv.sys
    2017-04-04 18:21 - 2017-03-04 03:09 - 01969912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hevcdecoder.dll
    2017-04-04 18:21 - 2017-03-04 03:08 - 00130912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storahci.sys
    2017-04-04 18:21 - 2017-03-04 03:07 - 00557400 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys
    2017-04-04 18:21 - 2017-03-04 02:53 - 05722320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
    2017-04-04 18:21 - 2017-03-04 02:53 - 00313568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlanapi.dll
    2017-04-04 18:21 - 2017-03-04 02:52 - 00549088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SHCore.dll
    2017-04-04 18:21 - 2017-03-04 02:52 - 00272720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wintrust.dll
    2017-04-04 18:21 - 2017-03-04 02:51 - 01980768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll
    2017-04-04 18:21 - 2017-03-04 02:50 - 00846560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WinTypes.dll
    2017-04-04 18:21 - 2017-03-04 02:47 - 20969928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
    2017-04-04 18:21 - 2017-03-04 02:46 - 04312248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
    2017-04-04 18:21 - 2017-03-04 02:42 - 01415240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
    2017-04-04 18:21 - 2017-03-04 02:42 - 01260784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
    2017-04-04 18:21 - 2017-03-04 02:42 - 00276832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\input.dll
    2017-04-04 18:21 - 2017-03-04 02:34 - 00258560 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\xboxgip.sys
    2017-04-04 18:21 - 2017-03-04 02:27 - 00045056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ddrawex.dll
    2017-04-04 18:21 - 2017-03-04 02:21 - 00631296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\main.cpl
    2017-04-04 18:21 - 2017-03-04 02:21 - 00196608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tapi32.dll
    2017-04-04 18:21 - 2017-03-04 02:20 - 00424960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msutb.dll
    2017-04-04 18:21 - 2017-03-04 02:19 - 00414208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winspool.drv
    2017-04-04 18:21 - 2017-03-04 02:19 - 00181760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tcpipcfg.dll
    2017-04-04 18:21 - 2017-03-04 02:18 - 00896512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontext.dll
    2017-04-04 18:21 - 2017-03-04 02:16 - 00850432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rasgcw.dll
    2017-04-04 18:21 - 2017-03-04 02:16 - 00760832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\appwiz.cpl
    2017-04-04 18:21 - 2017-03-04 02:16 - 00711680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
    2017-04-04 18:21 - 2017-03-04 02:16 - 00526336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mscms.dll
    2017-04-04 18:21 - 2017-03-04 02:16 - 00368128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiobj.dll
    2017-04-04 18:21 - 2017-03-04 02:15 - 00336384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\azroleui.dll
    2017-04-04 18:21 - 2017-03-04 02:13 - 07626752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
    2017-04-04 18:21 - 2017-03-04 02:13 - 00256512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\thumbcache.dll
    2017-04-04 18:21 - 2017-03-04 02:12 - 00700416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Storage.Search.dll
    2017-04-04 18:21 - 2017-03-04 02:11 - 01323008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_fs.dll
    2017-04-04 18:21 - 2017-03-04 02:11 - 01137152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_health.dll
    2017-04-04 18:21 - 2017-03-04 02:10 - 00300544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\regedit.exe
    2017-04-04 18:21 - 2017-03-04 02:09 - 00570368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\clusapi.dll
    2017-04-04 18:21 - 2017-03-04 02:07 - 02748928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mispace.dll
    2017-04-04 18:21 - 2017-03-04 02:06 - 02153984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\storagewmi.dll
    2017-04-04 18:21 - 2017-03-04 02:05 - 07468544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
    2017-04-04 18:21 - 2017-03-04 02:05 - 00298496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\resutils.dll
    2017-04-04 18:21 - 2017-03-04 02:04 - 00753152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\imapi2fs.dll
    2017-04-04 18:21 - 2017-03-04 02:04 - 00719872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_sr.dll
    2017-04-04 18:21 - 2017-03-04 02:02 - 04423680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll
    2017-04-04 18:21 - 2017-03-04 02:02 - 02484736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gameux.dll
    2017-04-04 18:21 - 2017-03-04 02:01 - 02682880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netshell.dll
    2017-04-04 18:21 - 2017-03-04 02:01 - 01571840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
    2017-04-04 18:21 - 2017-03-04 02:01 - 01293312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPDMC.exe
    2017-04-04 18:21 - 2017-03-04 02:00 - 02003968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
    2017-04-04 18:21 - 2017-03-04 01:57 - 03106304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstsc.exe
    2017-04-04 18:20 - 2017-03-04 03:19 - 02049480 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpmde.dll
    2017-04-04 18:20 - 2017-03-04 03:09 - 00857440 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWAHost.exe
    2017-04-04 18:20 - 2017-03-04 03:09 - 00527808 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWanAPI.dll
    2017-04-04 18:20 - 2017-03-04 03:04 - 01362512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmpmde.dll
    2017-04-04 18:20 - 2017-03-04 02:45 - 00112120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gpapi.dll
    2017-04-04 18:20 - 2017-03-04 02:36 - 00126976 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssitlb.dll
    2017-04-04 18:20 - 2017-03-04 02:30 - 00206336 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchFilterHost.exe
    2017-04-04 18:20 - 2017-03-04 02:28 - 00390144 _____ (Microsoft Corporation) C:\WINDOWS\system32\Search.ProtocolHandler.MAPI2.dll
    2017-04-04 18:20 - 2017-03-04 02:27 - 06574592 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanmm.dll
    2017-04-04 18:20 - 2017-03-04 02:27 - 00778752 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssvp.dll
    2017-04-04 18:20 - 2017-03-04 02:27 - 00358912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.dll
    2017-04-04 18:20 - 2017-03-04 02:27 - 00349184 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchProtocolHost.exe
    2017-04-04 18:20 - 2017-03-04 02:26 - 00468992 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanconn.dll
    2017-04-04 18:20 - 2017-03-04 02:26 - 00409600 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanui.dll
    2017-04-04 18:20 - 2017-03-04 02:25 - 00245760 _____ (Microsoft Corporation) C:\WINDOWS\system32\WwaApi.dll
    2017-04-04 18:20 - 2017-03-04 02:25 - 00168448 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssph.dll
    2017-04-04 18:20 - 2017-03-04 02:25 - 00057344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WPDShServiceObj.dll
    2017-04-04 18:20 - 2017-03-04 02:24 - 01293312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcnwiz.dll
    2017-04-04 18:20 - 2017-03-04 02:23 - 00963584 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebcamUi.dll
    2017-04-04 18:20 - 2017-03-04 02:22 - 00254464 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssphtb.dll
    2017-04-04 18:20 - 2017-03-04 02:16 - 01456640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
    2017-04-04 18:20 - 2017-03-04 02:16 - 00846336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WebcamUi.dll
    2017-04-04 18:20 - 2017-03-04 02:12 - 04596224 _____ (Microsoft Corporation) C:\WINDOWS\system32\xpsrchvw.exe
    2017-04-04 18:20 - 2017-03-04 02:10 - 01555456 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPDMC.exe
    2017-04-04 18:20 - 2017-03-04 02:10 - 01282048 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
    2017-04-04 18:20 - 2017-03-04 02:10 - 00816640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll
    2017-04-04 18:20 - 2017-03-04 02:08 - 03405312 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll
    2017-04-04 18:20 - 2017-03-04 02:07 - 00903680 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchIndexer.exe
    2017-04-04 18:20 - 2017-03-04 02:07 - 00391168 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll
    2017-04-04 18:20 - 2017-03-04 02:06 - 02538496 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssrch.dll
    2017-04-04 18:20 - 2017-03-04 02:06 - 01424896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Maps.dll
    2017-04-04 18:20 - 2017-03-04 02:06 - 01369088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Phone.dll
    2017-04-04 18:20 - 2017-03-04 02:05 - 03520512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\xpsrchvw.exe
    2017-04-04 18:19 - 2017-03-04 03:09 - 01860288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll
    2017-04-04 18:19 - 2017-03-04 02:39 - 00372736 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXTaskFactory.dll
    2017-04-04 18:19 - 2017-03-04 02:35 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\system32\musdialoghandlers.dll
    2017-04-04 18:19 - 2017-03-04 02:34 - 00237568 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Web.Diagnostics.dll
    2017-04-04 18:19 - 2017-03-04 02:34 - 00226304 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
    2017-04-04 18:19 - 2017-03-04 02:34 - 00123904 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll
    2017-04-04 18:19 - 2017-03-04 02:34 - 00085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe
    2017-04-04 18:19 - 2017-03-04 02:33 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Gaming.UI.GameBar.dll
    2017-04-04 18:19 - 2017-03-04 02:32 - 00193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinRtTracing.dll
    2017-04-04 18:19 - 2017-03-04 02:32 - 00179712 _____ (Microsoft Corporation) C:\WINDOWS\system32\MCCSEngineShared.dll
    2017-04-04 18:19 - 2017-03-04 02:32 - 00113664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.ServiceDiscovery.Dnssd.dll
    2017-04-04 18:19 - 2017-03-04 02:31 - 00467968 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Gaming.XboxLive.Storage.dll
    2017-04-04 18:19 - 2017-03-04 02:31 - 00149504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Core.dll
    2017-04-04 18:19 - 2017-03-04 02:30 - 00418304 _____ C:\WINDOWS\system32\Windows.Perception.Stub.dll
    2017-04-04 18:19 - 2017-03-04 02:30 - 00127488 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Credentials.UI.UserConsentVerifier.dll
    2017-04-04 18:19 - 2017-03-04 02:30 - 00120320 _____ (Microsoft Corporation) C:\WINDOWS\system32\DafPrintProvider.dll
    2017-04-04 18:19 - 2017-03-04 02:29 - 00730112 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
    2017-04-04 18:19 - 2017-03-04 02:29 - 00126464 _____ (Microsoft Corporation) C:\WINDOWS\system32\XblGameSaveExt.dll
    2017-04-04 18:19 - 2017-03-04 02:29 - 00082944 _____ (Microsoft Corporation) C:\WINDOWS\system32\moshost.dll
    2017-04-04 18:19 - 2017-03-04 02:28 - 01507840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.FaceAnalysis.dll
    2017-04-04 18:19 - 2017-03-04 02:28 - 00216576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Scanners.dll
    2017-04-04 18:19 - 2017-03-04 02:27 - 00590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\efswrt.dll
    2017-04-04 18:19 - 2017-03-04 02:27 - 00549376 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
    2017-04-04 18:19 - 2017-03-04 02:27 - 00446976 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapConfiguration.dll
    2017-04-04 18:19 - 2017-03-04 02:27 - 00252416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Identity.Provider.dll
    2017-04-04 18:19 - 2017-03-04 02:26 - 00561664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Wallet.dll
    2017-04-04 18:19 - 2017-03-04 02:25 - 01388544 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Cred.dll
    2017-04-04 18:19 - 2017-03-04 02:25 - 00320000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
    2017-04-04 18:19 - 2017-03-04 02:24 - 00671744 _____ (Microsoft Corporation) C:\WINDOWS\system32\mbsmsapi.dll
    2017-04-04 18:19 - 2017-03-04 02:19 - 01403392 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Editing.dll
    2017-04-04 18:19 - 2017-03-04 02:16 - 00100864 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpninprc.dll
    2017-04-04 18:19 - 2017-03-04 02:10 - 02852864 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsThresholdAdminFlowUI.dll
    2017-04-04 18:19 - 2017-03-04 02:09 - 00765440 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Sensors.dll
    2017-04-04 18:19 - 2017-03-04 02:08 - 02424320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Perception.dll
    2017-04-04 18:19 - 2017-03-04 02:08 - 01266176 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Input.Inking.dll
    2017-04-04 18:19 - 2017-02-21 22:17 - 00448285 _____ C:\WINDOWS\system32\ApnDatabase.xml
    2017-04-04 18:19 - 2016-05-29 14:38 - 08886976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OneDriveSetup.exe
    2017-04-04 18:18 - 2017-03-04 03:26 - 00794416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Shell.Broker.dll
    2017-04-04 18:18 - 2017-03-04 03:24 - 02482280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll
    2017-04-04 18:18 - 2017-03-04 03:24 - 02186896 _____ (Microsoft Corporation) C:\WINDOWS\system32\hevcdecoder.dll
    2017-04-04 18:18 - 2017-03-04 03:24 - 00108384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys
    2017-04-04 18:18 - 2017-03-04 03:23 - 02512304 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMVDECOD.DLL
    2017-04-04 18:18 - 2017-03-04 03:22 - 02213760 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
    2017-04-04 18:18 - 2017-03-04 03:18 - 01181024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys
    2017-04-04 18:18 - 2017-03-04 03:18 - 00118624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tdx.sys
    2017-04-04 18:18 - 2017-03-04 03:17 - 00409952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS
    2017-04-04 18:18 - 2017-03-04 03:10 - 00360040 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlows.exe
    2017-04-04 18:18 - 2017-03-04 03:09 - 01293152 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll
    2017-04-04 18:18 - 2017-03-04 03:09 - 00396168 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanapi.dll
    2017-04-04 18:18 - 2017-03-04 03:06 - 01706488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
    2017-04-04 18:18 - 2017-03-04 03:04 - 08169536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
    2017-04-04 18:18 - 2017-03-04 03:04 - 01063472 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfds.dll
    2017-04-04 18:18 - 2017-03-04 03:03 - 04260576 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
    2017-04-04 18:18 - 2017-03-04 03:03 - 01989072 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
    2017-04-04 18:18 - 2017-03-04 03:03 - 01848072 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsrcsnk.dll
    2017-04-04 18:18 - 2017-03-04 03:03 - 01723560 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcMon.exe
    2017-04-04 18:18 - 2017-03-04 03:03 - 01702392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfasfsrcsnk.dll
    2017-04-04 18:18 - 2017-03-04 03:03 - 01473048 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfplat.dll
    2017-04-04 18:18 - 2017-03-04 03:03 - 01454512 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetsrc.dll
    2017-04-04 18:18 - 2017-03-04 03:03 - 01301112 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll
    2017-04-04 18:18 - 2017-03-04 03:03 - 01071736 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetcore.dll
    2017-04-04 18:18 - 2017-03-04 03:03 - 01062480 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll
    2017-04-04 18:18 - 2017-03-04 03:03 - 00811416 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFCaptureEngine.dll
    2017-04-04 18:18 - 2017-03-04 03:03 - 00596040 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf.dll
    2017-04-04 18:18 - 2017-03-04 03:03 - 00443232 _____ (Microsoft Corporation) C:\WINDOWS\system32\MMDevAPI.dll
    2017-04-04 18:18 - 2017-03-04 03:03 - 00382272 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppHost.exe
    2017-04-04 18:18 - 2017-03-04 02:57 - 02536288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
    2017-04-04 18:18 - 2017-03-04 02:36 - 00119296 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataTimeUtil.dll
    2017-04-04 18:18 - 2017-03-04 02:36 - 00101888 _____ (Microsoft Corporation) C:\WINDOWS\system32\DuCsps.dll
    2017-04-04 18:18 - 2017-03-04 02:36 - 00073728 _____ (Microsoft Corporation) C:\WINDOWS\system32\usoapi.dll
    2017-04-04 18:18 - 2017-03-04 02:35 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\odbcconf.dll
    2017-04-04 18:18 - 2017-03-04 02:34 - 00047104 _____ (Microsoft Corporation) C:\WINDOWS\system32\wfdprov.dll
    2017-04-04 18:18 - 2017-03-04 02:33 - 00295424 _____ (Microsoft Corporation) C:\WINDOWS\system32\unimdm.tsp
    2017-04-04 18:18 - 2017-03-04 02:33 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\netiougc.exe
    2017-04-04 18:18 - 2017-03-04 02:31 - 00322048 _____ (Microsoft Corporation) C:\WINDOWS\system32\accountaccessor.dll
    2017-04-04 18:18 - 2017-03-04 02:31 - 00187904 _____ (Microsoft Corporation) C:\WINDOWS\system32\VCardParser.dll
    2017-04-04 18:18 - 2017-03-04 02:30 - 00535552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\nwifi.sys
    2017-04-04 18:18 - 2017-03-04 02:30 - 00052224 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpipreg.sys
    2017-04-04 18:18 - 2017-03-04 02:29 - 01291264 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVPXENC.dll
    2017-04-04 18:18 - 2017-03-04 02:29 - 00249856 _____ (Microsoft Corporation) C:\WINDOWS\system32\cemapi.dll
    2017-04-04 18:18 - 2017-03-04 02:29 - 00235008 _____ (Microsoft Corporation) C:\WINDOWS\system32\tapi32.dll
    2017-04-04 18:18 - 2017-03-04 02:29 - 00203264 _____ (Microsoft Corporation) C:\WINDOWS\system32\PimIndexMaintenance.dll
    2017-04-04 18:18 - 2017-03-04 02:28 - 00556544 _____ (Microsoft Corporation) C:\WINDOWS\system32\iprtrmgr.dll
    2017-04-04 18:18 - 2017-03-04 02:28 - 00462848 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansec.dll
    2017-04-04 18:18 - 2017-03-04 02:27 - 00719872 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdiWiFi.sys
    2017-04-04 18:18 - 2017-03-04 02:27 - 00292864 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll
    2017-04-04 18:18 - 2017-03-04 02:26 - 00631296 _____ (Microsoft Corporation) C:\WINDOWS\system32\WlanMediaManager.dll
    2017-04-04 18:18 - 2017-03-04 02:26 - 00383488 _____ (Microsoft Corporation) C:\WINDOWS\system32\DavSyncProvider.dll
    2017-04-04 18:18 - 2017-03-04 02:26 - 00366080 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchFolder.dll
    2017-04-04 18:18 - 2017-03-04 02:26 - 00307200 _____ (Microsoft Corporation) C:\WINDOWS\system32\PrintDialogs3D.dll
    2017-04-04 18:18 - 2017-03-04 02:25 - 00748544 _____ (Microsoft Corporation) C:\WINDOWS\system32\ChatApis.dll
    2017-04-04 18:18 - 2017-03-04 02:25 - 00579584 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.UX.EapRequestHandler.dll
    2017-04-04 18:18 - 2017-03-04 02:25 - 00548864 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll
    2017-04-04 18:18 - 2017-03-04 02:25 - 00284160 _____ (Microsoft Corporation) C:\WINDOWS\system32\AboveLockAppHost.dll
    2017-04-04 18:18 - 2017-03-04 02:23 - 01184256 _____ (Microsoft Corporation) C:\WINDOWS\system32\Unistore.dll
    2017-04-04 18:18 - 2017-03-04 02:23 - 01145856 _____ (Microsoft Corporation) C:\WINDOWS\system32\EmailApis.dll
    2017-04-04 18:18 - 2017-03-04 02:23 - 00945152 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasgcw.dll
    2017-04-04 18:18 - 2017-03-04 02:23 - 00820224 _____ (Microsoft Corporation) C:\WINDOWS\system32\PrintRenderAPIHost.DLL
    2017-04-04 18:18 - 2017-03-04 02:23 - 00583680 _____ (Microsoft Corporation) C:\WINDOWS\system32\PrintDialogs.dll
    2017-04-04 18:18 - 2017-03-04 02:23 - 00526336 _____ (Microsoft Corporation) C:\WINDOWS\system32\winspool.drv
    2017-04-04 18:18 - 2017-03-04 02:23 - 00330752 _____ (Microsoft Corporation) C:\WINDOWS\system32\NgcCtnrSvc.dll
    2017-04-04 18:18 - 2017-03-04 02:21 - 06285824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
    2017-04-04 18:18 - 2017-03-04 02:21 - 01937920 _____ (Microsoft Corporation) C:\WINDOWS\system32\mmc.exe
    2017-04-04 18:18 - 2017-03-04 02:19 - 03777536 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
    2017-04-04 18:18 - 2017-03-04 02:19 - 00458752 _____ (Microsoft Corporation) C:\WINDOWS\system32\RTMediaFrame.dll
    2017-04-04 18:18 - 2017-03-04 02:19 - 00410112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv.sys
    2017-04-04 18:18 - 2017-03-04 02:18 - 01762816 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSPhotography.dll
    2017-04-04 18:18 - 2017-03-04 02:18 - 01189376 _____ (Microsoft Corporation) C:\WINDOWS\system32\sdengin2.dll
    2017-04-04 18:18 - 2017-03-04 02:18 - 00156672 _____ (Microsoft Corporation) C:\WINDOWS\system32\RelPost.exe
    2017-04-04 18:18 - 2017-03-04 02:17 - 07812096 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll
    2017-04-04 18:18 - 2017-03-04 02:17 - 00864256 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpnapps.dll
    2017-04-04 18:18 - 2017-03-04 02:16 - 13441536 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
    2017-04-04 18:18 - 2017-03-04 02:16 - 01908224 _____ (Microsoft Corporation) C:\WINDOWS\system32\AzureSettingSyncProvider.dll
    2017-04-04 18:18 - 2017-03-04 02:16 - 00870400 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmkvsrcsnk.dll
    2017-04-04 18:18 - 2017-03-04 02:16 - 00626688 _____ (Microsoft Corporation) C:\WINDOWS\system32\SpaceControl.dll
    2017-04-04 18:18 - 2017-03-04 02:13 - 01366016 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpncore.dll
    2017-04-04 18:18 - 2017-03-04 02:13 - 01217024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Audio.dll
    2017-04-04 18:18 - 2017-03-04 02:13 - 00858112 _____ (Microsoft Corporation) C:\WINDOWS\system32\mprddm.dll
    2017-04-04 18:18 - 2017-03-04 02:13 - 00125952 _____ (Microsoft Corporation) C:\WINDOWS\system32\sdshext.dll
    2017-04-04 18:18 - 2017-03-04 02:12 - 00947712 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVP9DEC.dll
    2017-04-04 18:18 - 2017-03-04 02:12 - 00805888 _____ (Microsoft Corporation) C:\WINDOWS\system32\FrameServer.dll
    2017-04-04 18:18 - 2017-03-04 02:11 - 03441664 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapRouter.dll
    2017-04-04 18:18 - 2017-03-04 02:11 - 02953216 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapGeocoder.dll
    2017-04-04 18:18 - 2017-03-04 02:11 - 01891328 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnidui.dll
    2017-04-04 18:18 - 2017-03-04 02:10 - 01536000 _____ (Microsoft Corporation) C:\WINDOWS\system32\SpeechPal.dll
    2017-04-04 18:18 - 2017-03-04 02:10 - 01399296 _____ (Microsoft Corporation) C:\WINDOWS\system32\Pimstore.dll
    2017-04-04 18:18 - 2017-03-04 02:10 - 01033216 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsStore.dll
    2017-04-04 18:18 - 2017-03-04 02:10 - 00579072 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppBroker.dll
    2017-04-04 18:18 - 2017-03-04 02:09 - 01359360 _____ (Microsoft Corporation) C:\WINDOWS\system32\usercpl.dll
    2017-04-04 18:18 - 2017-03-04 02:09 - 00846336 _____ (Microsoft Corporation) C:\WINDOWS\system32\MbaeApiPublic.dll
    2017-04-04 18:18 - 2017-03-04 02:09 - 00771072 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppointmentApis.dll
    2017-04-04 18:18 - 2017-03-04 02:08 - 12349952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
    2017-04-04 18:18 - 2017-03-04 02:08 - 08076288 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
    2017-04-04 18:18 - 2017-03-04 02:08 - 02800128 _____ (Microsoft Corporation) C:\WINDOWS\system32\netshell.dll
    2017-04-04 18:18 - 2017-03-04 02:08 - 01981440 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
    2017-04-04 18:18 - 2017-03-04 02:08 - 00834048 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32spl.dll
    2017-04-04 18:18 - 2017-03-04 02:08 - 00792576 _____ (Microsoft Corporation) C:\WINDOWS\system32\spoolsv.exe
    2017-04-04 18:18 - 2017-03-04 02:07 - 02370048 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll
    2017-04-04 18:18 - 2017-03-04 02:07 - 01792512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Wpc.dll
    2017-04-04 18:18 - 2017-03-04 02:06 - 01131008 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
    2017-04-04 18:18 - 2017-03-04 02:06 - 00842240 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntshrui.dll
    2017-04-04 18:18 - 2017-03-04 02:04 - 01826816 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
    2017-04-04 18:18 - 2017-03-04 02:04 - 00998912 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWorkspace.dll
    2017-04-04 18:18 - 2017-03-04 02:04 - 00433152 _____ (Microsoft Corporation) C:\WINDOWS\system32\TextInputFramework.dll
    2017-04-04 18:18 - 2017-03-04 02:04 - 00340992 _____ (Microsoft Corporation) C:\WINDOWS\system32\RADCUI.dll
    2017-04-04 18:18 - 2017-03-04 02:01 - 01493504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Wpc.dll
    2017-04-04 18:17 - 2017-03-04 03:15 - 01000280 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
    2017-04-04 18:17 - 2017-03-04 03:09 - 07220696 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
    2017-04-04 18:17 - 2017-03-04 03:03 - 22223968 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
    2017-04-04 18:17 - 2017-03-04 03:01 - 00137936 _____ (Microsoft Corporation) C:\WINDOWS\system32\AuthHost.exe
    2017-04-04 18:17 - 2017-03-04 02:57 - 00387872 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpps.dll
    2017-04-04 18:17 - 2017-03-04 02:32 - 00263680 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExSMime.dll
    2017-04-04 18:17 - 2017-03-04 02:29 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BlockedShutdown.dll
    2017-04-04 18:17 - 2017-03-04 02:28 - 00741888 _____ (Microsoft Corporation) C:\WINDOWS\system32\internetmail.dll
    2017-04-04 18:17 - 2017-03-04 02:27 - 00456192 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiobj.dll
    2017-04-04 18:17 - 2017-03-04 02:27 - 00200192 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiapi.dll
    2017-04-04 18:17 - 2017-03-04 02:21 - 00809984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Storage.Search.dll
    2017-04-04 18:17 - 2017-03-04 02:20 - 00611328 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Graphics.Printing.dll
    2017-04-04 18:17 - 2017-03-04 02:19 - 00635904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
    2017-04-04 18:17 - 2017-03-04 02:18 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\indexeddbserver.dll
    2017-04-04 18:17 - 2017-03-04 02:15 - 01078784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Streaming.dll
    2017-04-04 18:17 - 2017-03-04 02:12 - 07654912 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll
    2017-04-04 18:17 - 2017-03-04 02:10 - 01917440 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActiveSyncProvider.dll
    2017-04-04 18:17 - 2017-03-04 02:07 - 01512448 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataService.dll
    2017-04-04 18:17 - 2017-03-04 02:06 - 02820096 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputService.dll
    2017-04-04 18:17 - 2017-03-04 02:06 - 01013760 _____ (Microsoft Corporation) C:\WINDOWS\system32\ContactApis.dll
    2017-04-04 18:17 - 2017-03-04 02:04 - 00531456 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmCoreProvisioning.dll
    2017-04-04 18:17 - 2017-03-04 02:02 - 00510464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhotoScreensaver.scr
    2017-04-04 18:16 - 2017-03-04 03:27 - 00603488 _____ (Microsoft Corporation) C:\WINDOWS\system32\ContentDeliveryManager.Utilities.dll
    2017-04-04 18:16 - 2017-03-04 03:18 - 00219040 _____ (Microsoft Corporation) C:\WINDOWS\system32\IPHLPAPI.DLL
    2017-04-04 18:16 - 2017-03-04 03:09 - 02750384 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
    2017-04-04 18:16 - 2017-03-04 03:09 - 00402272 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
    2017-04-04 18:16 - 2017-03-04 03:08 - 00223584 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
    2017-04-04 18:16 - 2017-03-04 03:03 - 00523712 _____ (Microsoft Corporation) C:\WINDOWS\system32\DMRServer.dll
    2017-04-04 18:16 - 2017-03-04 03:03 - 00241496 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHost.dll
    2017-04-04 18:16 - 2017-03-04 03:03 - 00160096 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHostBroker.dll
    2017-04-04 18:16 - 2017-03-04 02:33 - 00185344 _____ (Microsoft Corporation) C:\WINDOWS\system32\DisplayManager.dll
    2017-04-04 18:16 - 2017-03-04 02:31 - 00280064 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_WorkAccess.dll
    2017-04-04 18:16 - 2017-03-04 02:30 - 00231424 _____ (Microsoft Corporation) C:\WINDOWS\system32\shutdownux.dll
    2017-04-04 18:16 - 2017-03-04 02:30 - 00180224 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Cortana.OneCore.dll
    2017-04-04 18:16 - 2017-03-04 02:30 - 00058880 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Shell.Search.UriHandler.dll
    2017-04-04 18:16 - 2017-03-04 02:30 - 00025600 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBrokerCookies.exe
    2017-04-04 18:16 - 2017-03-04 02:29 - 00343552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.SmartCards.Phone.dll
    2017-04-04 18:16 - 2017-03-04 02:29 - 00171520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.SerialCommunication.dll
    2017-04-04 18:16 - 2017-03-04 02:29 - 00156672 _____ (Microsoft Corporation) C:\WINDOWS\system32\BrowserSettingSync.dll
    2017-04-04 18:16 - 2017-03-04 02:28 - 00568320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.LowLevel.dll
    2017-04-04 18:16 - 2017-03-04 02:28 - 00279552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.HumanInterfaceDevice.dll
    2017-04-04 18:16 - 2017-03-04 02:27 - 00311296 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncSettings.dll
    2017-04-04 18:16 - 2017-03-04 02:26 - 00949248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.PointOfService.dll
    2017-04-04 18:16 - 2017-03-04 02:26 - 00431616 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Cortana.Desktop.dll
    2017-04-04 18:16 - 2017-03-04 02:26 - 00337408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Picker.dll
    2017-04-04 18:16 - 2017-03-04 02:25 - 00437248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Usb.dll
    2017-04-04 18:16 - 2017-03-04 02:23 - 00541696 _____ (Microsoft Corporation) C:\WINDOWS\system32\ipnathlp.dll
    2017-04-04 18:16 - 2017-03-04 02:22 - 00822784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
    2017-04-04 18:16 - 2017-03-04 02:20 - 00650752 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXService.dll
    2017-04-04 18:16 - 2017-03-04 02:19 - 00166912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Tabbtn.dll
    2017-04-04 18:16 - 2017-03-04 02:17 - 01105408 _____ (Microsoft Corporation) C:\WINDOWS\system32\MiracastReceiver.dll
    2017-04-04 18:16 - 2017-03-04 02:17 - 00442368 _____ (Microsoft Corporation) C:\WINDOWS\system32\PlayToDevice.dll
    2017-04-04 18:16 - 2017-03-04 02:17 - 00440320 _____ (Microsoft Corporation) C:\WINDOWS\system32\fhcfg.dll
    2017-04-04 18:16 - 2017-03-04 02:16 - 00187904 _____ (Microsoft Corporation) C:\WINDOWS\system32\dialclient.dll
    2017-04-04 18:16 - 2017-03-04 02:14 - 00279552 _____ (Microsoft Corporation) C:\WINDOWS\system32\PlayToReceiver.dll
    2017-04-04 18:16 - 2017-03-04 02:13 - 19411968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
    2017-04-04 18:16 - 2017-03-04 02:13 - 00222720 _____ (Microsoft Corporation) C:\WINDOWS\system32\WorkFoldersShell.dll
    2017-04-04 18:16 - 2017-03-04 02:13 - 00112640 _____ (Microsoft Corporation) C:\WINDOWS\system32\CameraCaptureUI.dll
    2017-04-04 18:16 - 2017-03-04 02:13 - 00112128 _____ (Microsoft Corporation) C:\WINDOWS\system32\WorkFoldersGPExt.dll
    2017-04-04 18:16 - 2017-03-04 02:11 - 00572416 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhotoScreensaver.scr
    2017-04-04 18:16 - 2017-03-04 02:10 - 02095616 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
    2017-04-04 18:16 - 2017-03-04 02:10 - 00104960 _____ (Microsoft Corporation) C:\WINDOWS\system32\WorkFolders.exe
    2017-04-04 18:16 - 2017-03-04 02:08 - 01780224 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
    2017-04-04 18:16 - 2017-03-04 02:07 - 12178944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
    2017-04-04 18:16 - 2017-03-04 02:06 - 04746752 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
    2017-04-04 18:16 - 2017-03-04 02:03 - 06044672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
    2017-04-04 18:16 - 2017-03-04 02:03 - 03666432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
    2017-04-04 18:16 - 2017-03-04 02:00 - 02026496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
    2017-04-04 18:15 - 2017-03-04 03:15 - 00063328 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dam.sys
    2017-04-04 18:15 - 2017-03-04 03:09 - 00681312 _____ (Microsoft Corporation) C:\WINDOWS\system32\SHCore.dll
    2017-04-04 18:15 - 2017-03-04 03:09 - 00658784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
    2017-04-04 18:15 - 2017-03-04 03:09 - 00635864 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxgi.dll
    2017-04-04 18:15 - 2017-03-04 03:08 - 00450400 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys
    2017-04-04 18:15 - 2017-03-04 03:07 - 00432992 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys
    2017-04-04 18:15 - 2017-03-04 03:03 - 00755648 _____ (Microsoft Corporation) C:\WINDOWS\system32\evr.dll
    2017-04-04 18:15 - 2017-03-04 03:03 - 00424616 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFPlay.dll
    2017-04-04 18:15 - 2017-03-04 02:36 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mskssrv.sys
    2017-04-04 18:15 - 2017-03-04 02:30 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dfsc.sys
    2017-04-04 18:15 - 2017-03-04 02:29 - 00505856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.WiFiDirect.dll
    2017-04-04 18:15 - 2017-03-04 02:28 - 00912384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.SmartCards.dll
    2017-04-04 18:15 - 2017-03-04 02:26 - 00264704 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsrslvr.dll
    2017-04-04 18:15 - 2017-03-04 02:20 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll
    2017-04-04 18:15 - 2017-03-04 02:12 - 13085184 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
    2017-04-04 18:15 - 2017-03-04 02:11 - 00975872 _____ (Microsoft Corporation) C:\WINDOWS\HelpPane.exe
    2017-04-04 18:15 - 2017-03-04 02:11 - 00774656 _____ (Microsoft Corporation) C:\WINDOWS\system32\WorkfoldersControl.dll
    2017-04-04 18:15 - 2017-03-04 02:10 - 01275392 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Bluetooth.dll
    2017-04-04 18:15 - 2017-03-04 02:09 - 08125952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
    2017-04-04 18:15 - 2017-03-04 02:07 - 01840640 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
    2017-04-04 18:15 - 2017-03-04 02:07 - 01513472 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
    2017-04-04 18:15 - 2017-03-04 02:07 - 00909312 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Search.dll
    2017-04-04 18:14 - 2017-03-04 03:24 - 00646688 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsapi.dll
    2017-04-04 18:14 - 2017-03-04 03:22 - 07786336 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
    2017-04-04 18:14 - 2017-03-04 03:19 - 02681200 _____ C:\WINDOWS\system32\CoreUIComponents.dll
    2017-04-04 18:14 - 2017-03-04 03:11 - 00328008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll
    2017-04-04 18:14 - 2017-03-04 03:10 - 02828384 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d11.dll
    2017-04-04 18:14 - 2017-03-04 03:10 - 02189664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
    2017-04-04 18:14 - 2017-03-04 03:09 - 01157000 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll
    2017-04-04 18:14 - 2017-03-04 03:03 - 01694712 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmde.dll
    2017-04-04 18:14 - 2017-03-04 02:37 - 01631232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Resources.dll
    2017-04-04 18:14 - 2017-03-04 02:35 - 00047616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ddrawex.dll
    2017-04-04 18:14 - 2017-03-04 02:33 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\tbauth.dll
    2017-04-04 18:14 - 2017-03-04 02:31 - 00266240 _____ (Microsoft Corporation) C:\WINDOWS\system32\dhcpcore6.dll
    2017-04-04 18:14 - 2017-03-04 02:31 - 00247808 _____ (Microsoft Corporation) C:\WINDOWS\system32\icm32.dll
    2017-04-04 18:14 - 2017-03-04 02:30 - 00635904 _____ (Microsoft Corporation) C:\WINDOWS\system32\FlightSettings.dll
    2017-04-04 18:14 - 2017-03-04 02:28 - 00394752 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ks.sys
    2017-04-04 18:14 - 2017-03-04 02:28 - 00223744 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.HostName.dll
    2017-04-04 18:14 - 2017-03-04 02:27 - 00460288 _____ (Microsoft Corporation) C:\WINDOWS\system32\CredProvDataModel.dll
    2017-04-04 18:14 - 2017-03-04 02:27 - 00432128 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpAXHolder.dll
    2017-04-04 18:14 - 2017-03-04 02:27 - 00295424 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudBackupSettings.dll
    2017-04-04 18:14 - 2017-03-04 02:26 - 00658432 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasmans.dll
    2017-04-04 18:14 - 2017-03-04 02:26 - 00579072 _____ (Microsoft Corporation) C:\WINDOWS\system32\ddraw.dll
    2017-04-04 18:14 - 2017-03-04 02:26 - 00476160 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
    2017-04-04 18:14 - 2017-03-04 02:26 - 00261632 _____ (Microsoft Corporation) C:\WINDOWS\system32\indexeddbserver.dll
    2017-04-04 18:14 - 2017-03-04 02:25 - 00425984 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadcloudap.dll
    2017-04-04 18:14 - 2017-03-04 02:24 - 01025536 _____ (Microsoft Corporation) C:\WINDOWS\system32\XboxNetApiSvc.dll
    2017-04-04 18:14 - 2017-03-04 02:24 - 00945664 _____ (Microsoft Corporation) C:\WINDOWS\system32\iphlpsvc.dll
    2017-04-04 18:14 - 2017-03-04 02:23 - 00634368 _____ (Microsoft Corporation) C:\WINDOWS\system32\StructuredQuery.dll
    2017-04-04 18:14 - 2017-03-04 02:23 - 00320512 _____ (Microsoft Corporation) C:\WINDOWS\system32\thumbcache.dll
    2017-04-04 18:14 - 2017-03-04 02:21 - 00591360 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
    2017-04-04 18:14 - 2017-03-04 02:20 - 01280512 _____ (Microsoft Corporation) C:\WINDOWS\system32\werconcpl.dll
    2017-04-04 18:14 - 2017-03-04 02:19 - 01639424 _____ (Microsoft Corporation) C:\WINDOWS\system32\comsvcs.dll
    2017-04-04 18:14 - 2017-03-04 02:19 - 01589760 _____ (Microsoft Corporation) C:\WINDOWS\system32\msdtctm.dll
    2017-04-04 18:14 - 2017-03-04 02:18 - 17198592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
    2017-04-04 18:14 - 2017-03-04 02:15 - 01837056 _____ (Microsoft Corporation) C:\WINDOWS\system32\workfolderssvc.dll
    2017-04-04 18:14 - 2017-03-04 02:14 - 00588288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidprov.dll
    2017-04-04 18:14 - 2017-03-04 02:13 - 00982528 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
    2017-04-04 18:14 - 2017-03-04 02:13 - 00937472 _____ (Microsoft Corporation) C:\WINDOWS\system32\MCRecvSrc.dll
    2017-04-04 18:14 - 2017-03-04 02:13 - 00539136 _____ (Microsoft Corporation) C:\WINDOWS\system32\PlayToManager.dll
    2017-04-04 18:14 - 2017-03-04 02:12 - 01040896 _____ (Microsoft Corporation) C:\WINDOWS\system32\NaturalLanguage6.dll
    2017-04-04 18:14 - 2017-03-04 02:12 - 00467968 _____ (Microsoft Corporation) C:\WINDOWS\system32\Geolocation.dll
    2017-04-04 18:14 - 2017-03-04 02:11 - 04474368 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll
    2017-04-04 18:14 - 2017-03-04 02:11 - 00821248 _____ (Microsoft Corporation) C:\WINDOWS\system32\uDWM.dll
    2017-04-04 18:14 - 2017-03-04 02:10 - 02208768 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Graphics.Printing.3D.dll
    2017-04-04 18:14 - 2017-03-04 02:10 - 00971264 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.appcore.dll
    2017-04-04 18:14 - 2017-03-04 02:10 - 00913920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.dll
    2017-04-04 18:14 - 2017-03-04 02:09 - 01633792 _____ (Microsoft Corporation) C:\WINDOWS\system32\quartz.dll
    2017-04-04 18:14 - 2017-03-04 02:08 - 00540160 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSync.dll
    2017-04-04 18:14 - 2017-03-04 02:07 - 02895872 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
    2017-04-04 18:14 - 2017-03-04 02:07 - 02691072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll
    2017-04-04 18:14 - 2017-03-04 02:07 - 01348608 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll
    2017-04-04 18:14 - 2017-03-04 02:07 - 00875520 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
    2017-04-04 18:14 - 2017-03-04 02:07 - 00774656 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Web.dll
    2017-04-04 18:14 - 2017-03-04 02:07 - 00707584 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll
    2017-04-04 18:14 - 2017-03-04 02:06 - 03202048 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
    2017-04-04 18:14 - 2017-03-04 02:06 - 02475008 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
    2017-04-04 18:14 - 2017-03-04 02:06 - 02287104 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
    2017-04-04 18:14 - 2017-03-04 02:05 - 01328640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Web.Http.dll
    2017-04-04 18:14 - 2017-03-04 02:05 - 00924672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.BackgroundTransfer.dll
    2017-04-04 18:13 - 2017-03-04 02:37 - 00025088 _____ C:\WINDOWS\system32\GamePanelExternalHook.dll
    2017-04-04 18:13 - 2017-03-04 02:33 - 00162304 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmcertinst.exe
    2017-04-04 18:13 - 2017-03-04 02:33 - 00095232 _____ (Microsoft Corporation) C:\WINDOWS\system32\tzautoupdate.dll
    2017-04-04 18:13 - 2017-03-04 02:32 - 00249856 _____ (Microsoft Corporation) C:\WINDOWS\system32\scksp.dll
    2017-04-04 18:13 - 2017-03-04 02:28 - 00587776 _____ (Microsoft Corporation) C:\WINDOWS\system32\vpnike.dll
    2017-04-04 18:13 - 2017-03-04 02:28 - 00349696 _____ (Microsoft Corporation) C:\WINDOWS\system32\icsvcext.dll
    2017-04-04 18:13 - 2017-03-04 02:28 - 00193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\certprop.dll
    2017-04-04 18:13 - 2017-03-04 02:25 - 01016320 _____ (Microsoft Corporation) C:\WINDOWS\system32\XblAuthManager.dll
    2017-04-04 18:13 - 2017-03-04 02:23 - 00775168 _____ (Microsoft Corporation) C:\WINDOWS\system32\GamePanel.exe
    2017-04-04 18:13 - 2017-03-04 02:21 - 00945664 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebFilter.dll
    2017-04-04 18:13 - 2017-03-04 02:20 - 01913856 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_fs.dll
    2017-04-04 18:13 - 2017-03-04 02:20 - 00203776 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXApplicabilityBlob.dll
    2017-04-04 18:13 - 2017-03-04 02:19 - 01584128 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_health.dll
    2017-04-04 18:13 - 2017-03-04 02:17 - 00730624 _____ (Microsoft Corporation) C:\WINDOWS\system32\clusapi.dll
    2017-04-04 18:13 - 2017-03-04 02:17 - 00661504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WpcWebFilter.dll
    2017-04-04 18:13 - 2017-03-04 02:16 - 03289088 _____ (Microsoft Corporation) C:\WINDOWS\system32\mispace.dll
    2017-04-04 18:13 - 2017-03-04 02:15 - 02860032 _____ (Microsoft Corporation) C:\WINDOWS\system32\storagewmi.dll
    2017-04-04 18:13 - 2017-03-04 02:15 - 01443328 _____ (Microsoft Corporation) C:\WINDOWS\system32\VSSVC.exe
    2017-04-04 18:13 - 2017-03-04 02:14 - 01562112 _____ (Microsoft Corporation) C:\WINDOWS\system32\vssapi.dll
    2017-04-04 18:13 - 2017-03-04 02:14 - 00374784 _____ (Microsoft Corporation) C:\WINDOWS\system32\resutils.dll
    2017-04-04 18:13 - 2017-03-04 02:14 - 00130560 _____ (Microsoft Corporation) C:\WINDOWS\system32\SpaceAgent.exe
    2017-04-04 18:13 - 2017-03-04 02:13 - 05114368 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdp.dll
    2017-04-04 18:13 - 2017-03-04 02:13 - 00947200 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_sr.dll
    2017-04-04 18:13 - 2017-03-04 02:06 - 05384192 _____ (Microsoft) C:\WINDOWS\system32\dbgeng.dll
    2017-04-04 18:13 - 2017-03-04 02:05 - 01121280 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadtb.dll
    2017-04-04 18:13 - 2017-03-04 02:04 - 00035328 _____ (Microsoft Corporation) C:\WINDOWS\system32\spaceman.exe
    2017-04-04 18:12 - 2017-03-04 03:35 - 00590952 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
    2017-04-04 18:12 - 2017-03-04 03:35 - 00378720 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
    2017-04-04 18:12 - 2017-03-04 03:24 - 00354264 _____ (Microsoft Corporation) C:\WINDOWS\system32\systemreset.exe
    2017-04-04 18:12 - 2017-03-04 03:18 - 00764392 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
    2017-04-04 18:12 - 2017-03-04 03:15 - 00404320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinSetupUI.dll
    2017-04-04 18:12 - 2017-03-04 03:11 - 00266544 _____ (Microsoft Corporation) C:\WINDOWS\system32\policymanager.dll
    2017-04-04 18:12 - 2017-03-04 03:09 - 00578392 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
    2017-04-04 18:12 - 2017-03-04 03:09 - 00178520 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudExperienceHostUser.dll
    2017-04-04 18:12 - 2017-03-04 03:07 - 02913144 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll
    2017-04-04 18:12 - 2017-03-04 03:07 - 02446704 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll
    2017-04-04 18:12 - 2017-03-04 03:07 - 01267512 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinTypes.dll
    2017-04-04 18:12 - 2017-03-04 03:07 - 00682808 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
    2017-04-04 18:12 - 2017-03-04 03:07 - 00116064 _____ (Microsoft Corporation) C:\WINDOWS\system32\icfupgd.dll
    2017-04-04 18:12 - 2017-03-04 03:03 - 04674360 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
    2017-04-04 18:12 - 2017-03-04 03:01 - 00201568 _____ (Microsoft Corporation) C:\WINDOWS\system32\basecsp.dll
    2017-04-04 18:12 - 2017-03-04 03:01 - 00128648 _____ (Microsoft Corporation) C:\WINDOWS\system32\gpapi.dll
    2017-04-04 18:12 - 2017-03-04 02:58 - 01416224 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
    2017-04-04 18:12 - 2017-03-04 02:58 - 00628552 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
    2017-04-04 18:12 - 2017-03-04 02:58 - 00322912 _____ (Microsoft Corporation) C:\WINDOWS\system32\input.dll
    2017-04-04 18:12 - 2017-03-04 02:57 - 00372432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.MediaControl.dll
    2017-04-04 18:12 - 2017-03-04 02:42 - 07216640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
    2017-04-04 18:12 - 2017-03-04 02:36 - 00217600 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctfp.dll
    2017-04-04 18:12 - 2017-03-04 02:36 - 00048640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll
    2017-04-04 18:12 - 2017-03-04 02:36 - 00043008 _____ (Microsoft Corporation) C:\WINDOWS\system32\LaunchWinApp.exe
    2017-04-04 18:12 - 2017-03-04 02:35 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIRibbonRes.dll
    2017-04-04 18:12 - 2017-03-04 02:34 - 00124416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.System.SystemManagement.dll
    2017-04-04 18:12 - 2017-03-04 02:34 - 00116224 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctfui.dll
    2017-04-04 18:12 - 2017-03-04 02:33 - 00259072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Family.SyncEngine.dll
    2017-04-04 18:12 - 2017-03-04 02:33 - 00057344 _____ (Microsoft Corporation) C:\WINDOWS\system32\BluetoothDesktopHandlers.dll
    2017-04-04 18:12 - 2017-03-04 02:33 - 00046592 _____ (Microsoft Corporation) C:\WINDOWS\system32\XInputUap.dll
    2017-04-04 18:12 - 2017-03-04 02:32 - 00196096 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDeviceRegistration.dll
    2017-04-04 18:12 - 2017-03-04 02:32 - 00193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.WiFi.dll
    2017-04-04 18:12 - 2017-03-04 02:32 - 00133632 _____ (Microsoft Corporation) C:\WINDOWS\system32\MediaFoundation.DefaultPerceptionProvider.dll
    2017-04-04 18:12 - 2017-03-04 02:32 - 00073216 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepositoryBroker.dll
    2017-04-04 18:12 - 2017-03-04 02:31 - 00567296 _____ (Microsoft Corporation) C:\WINDOWS\system32\DevicePairing.dll
    2017-04-04 18:12 - 2017-03-04 02:31 - 00122880 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.StateRepositoryClient.dll
    2017-04-04 18:12 - 2017-03-04 02:30 - 00547840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Gaming.Input.dll
    2017-04-04 18:12 - 2017-03-04 02:30 - 00463872 _____ (Microsoft Corporation) C:\WINDOWS\system32\daxexec.dll
    2017-04-04 18:12 - 2017-03-04 02:30 - 00300544 _____ (Microsoft Corporation) C:\WINDOWS\system32\mscandui.dll
    2017-04-04 18:12 - 2017-03-04 02:30 - 00236544 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_Flights.dll
    2017-04-04 18:12 - 2017-03-04 02:30 - 00205824 _____ (Microsoft Corporation) C:\WINDOWS\system32\netiohlp.dll
    2017-04-04 18:12 - 2017-03-04 02:30 - 00186368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Radios.dll
    2017-04-04 18:12 - 2017-03-04 02:29 - 00289792 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeveloperOptionsSettingsHandlers.dll
    2017-04-04 18:12 - 2017-03-04 02:29 - 00125952 _____ (Microsoft Corporation) C:\WINDOWS\system32\appinfo.dll
    2017-04-04 18:12 - 2017-03-04 02:28 - 00947712 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettings.Handlers.dll
    2017-04-04 18:12 - 2017-03-04 02:28 - 00651264 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.AllJoyn.dll
    2017-04-04 18:12 - 2017-03-04 02:28 - 00623104 _____ (Microsoft Corporation) C:\WINDOWS\system32\PCPTpm12.dll
    2017-04-04 18:12 - 2017-03-04 02:28 - 00268800 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserMgrProxy.dll
    2017-04-04 18:12 - 2017-03-04 02:28 - 00267264 _____ (Microsoft Corporation) C:\WINDOWS\system32\vaultcli.dll
    2017-04-04 18:12 - 2017-03-04 02:28 - 00147456 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsrv.dll
    2017-04-04 18:12 - 2017-03-04 02:27 - 00852480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Import.dll
    2017-04-04 18:12 - 2017-03-04 02:27 - 00379392 _____ (Microsoft Corporation) C:\WINDOWS\system32\apprepsync.dll
    2017-04-04 18:12 - 2017-03-04 02:27 - 00324608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll
    2017-04-04 18:12 - 2017-03-04 02:27 - 00252928 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll
    2017-04-04 18:12 - 2017-03-04 02:27 - 00176128 _____ (Microsoft Corporation) C:\WINDOWS\system32\apprepapi.dll
    2017-04-04 18:12 - 2017-03-04 02:26 - 00643072 _____ (Microsoft Corporation) C:\WINDOWS\system32\main.cpl
    2017-04-04 18:12 - 2017-03-04 02:26 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIRibbonRes.dll
    2017-04-04 18:12 - 2017-03-04 02:26 - 00464896 _____ (Microsoft Corporation) C:\WINDOWS\system32\msutb.dll
    2017-04-04 18:12 - 2017-03-04 02:26 - 00450048 _____ (Microsoft Corporation) C:\WINDOWS\system32\werui.dll
    2017-04-04 18:12 - 2017-03-04 02:26 - 00407552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Management.dll
    2017-04-04 18:12 - 2017-03-04 02:26 - 00090112 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatepolicy.dll
    2017-04-04 18:12 - 2017-03-04 02:25 - 01060352 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppContracts.dll
    2017-04-04 18:12 - 2017-03-04 02:25 - 00526848 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneDriveSettingSyncProvider.dll
    2017-04-04 18:12 - 2017-03-04 02:24 - 01092096 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplicationFrame.dll
    2017-04-04 18:12 - 2017-03-04 02:24 - 00956416 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
    2017-04-04 18:12 - 2017-03-04 02:24 - 00655872 _____ (Microsoft Corporation) C:\WINDOWS\system32\sud.dll
    2017-04-04 18:12 - 2017-03-04 02:24 - 00560128 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppReadiness.dll
    2017-04-04 18:12 - 2017-03-04 02:24 - 00495104 _____ (Microsoft Corporation) C:\WINDOWS\system32\DataSenseHandlers.dll
    2017-04-04 18:12 - 2017-03-04 02:24 - 00478208 _____ (Microsoft Corporation) C:\WINDOWS\system32\DXP.dll
    2017-04-04 18:12 - 2017-03-04 02:24 - 00329728 _____ (Microsoft Corporation) C:\WINDOWS\system32\deviceaccess.dll
    2017-04-04 18:12 - 2017-03-04 02:23 - 00896512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.AccountsControl.dll
    2017-04-04 18:12 - 2017-03-04 02:23 - 00715776 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll
    2017-04-04 18:12 - 2017-03-04 02:23 - 00496128 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettings.UserAccountsHandlers.dll
    2017-04-04 18:12 - 2017-03-04 02:22 - 00869888 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
    2017-04-04 18:12 - 2017-03-04 02:22 - 00410112 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
    2017-04-04 18:12 - 2017-03-04 02:21 - 00776192 _____ (Microsoft Corporation) C:\WINDOWS\system32\TabletPC.cpl
    2017-04-04 18:12 - 2017-03-04 02:21 - 00347648 _____ (Microsoft Corporation) C:\WINDOWS\system32\rascustom.dll
    2017-04-04 18:12 - 2017-03-04 02:20 - 01361408 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedStartModel.dll
    2017-04-04 18:12 - 2017-03-04 02:20 - 00893952 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll
    2017-04-04 18:12 - 2017-03-04 02:20 - 00282112 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmWmiPl.dll
    2017-04-04 18:12 - 2017-03-04 02:19 - 00376832 _____ (Microsoft Corporation) C:\WINDOWS\system32\CryptoWinRT.dll
    2017-04-04 18:12 - 2017-03-04 02:19 - 00083456 _____ (Microsoft Corporation) C:\WINDOWS\system32\tabcal.exe
    2017-04-04 18:12 - 2017-03-04 02:18 - 01227264 _____ (Microsoft Corporation) C:\WINDOWS\system32\gpsvc.dll
    2017-04-04 18:12 - 2017-03-04 02:16 - 00649216 _____ (Microsoft Corporation) C:\WINDOWS\system32\vds.exe
    2017-04-04 18:12 - 2017-03-04 02:15 - 09130496 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
    2017-04-04 18:12 - 2017-03-04 02:14 - 04749312 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
    2017-04-04 18:12 - 2017-03-04 02:14 - 01547264 _____ (Microsoft Corporation) C:\WINDOWS\system32\wbengine.exe
    2017-04-04 18:12 - 2017-03-04 02:14 - 00167936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ErrorDetails.dll
    2017-04-04 18:12 - 2017-03-04 02:13 - 00961024 _____ (Microsoft Corporation) C:\WINDOWS\system32\imapi2fs.dll
    2017-04-04 18:12 - 2017-03-04 02:13 - 00054272 _____ (Microsoft Corporation) C:\WINDOWS\system32\MultiDigiMon.exe
    2017-04-04 18:12 - 2017-03-04 02:12 - 01692160 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
    2017-04-04 18:12 - 2017-03-04 02:12 - 00828416 _____ (Microsoft Corporation) C:\WINDOWS\system32\appwiz.cpl
    2017-04-04 18:12 - 2017-03-04 02:11 - 02611200 _____ (Microsoft Corporation) C:\WINDOWS\system32\gameux.dll
    2017-04-04 18:12 - 2017-03-04 02:11 - 02278400 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
    2017-04-04 18:12 - 2017-03-04 02:11 - 01643008 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Speech.dll
    2017-04-04 18:12 - 2017-03-04 02:11 - 01312768 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorDataService.exe
    2017-04-04 18:12 - 2017-03-04 02:11 - 00818176 _____ (Microsoft Corporation) C:\WINDOWS\system32\winhttp.dll
    2017-04-04 18:12 - 2017-03-04 02:10 - 06664192 _____ (Microsoft Corporation) C:\WINDOWS\system32\mspaint.exe
    2017-04-04 18:12 - 2017-03-04 02:10 - 01586176 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll
    2017-04-04 18:12 - 2017-03-04 02:10 - 00960000 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll
    2017-04-04 18:12 - 2017-03-04 02:10 - 00770560 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll
    2017-04-04 18:12 - 2017-03-04 02:10 - 00460800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Midi.dll
    2017-04-04 18:12 - 2017-03-04 02:09 - 00653824 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserLanguagesCpl.dll
    2017-04-04 18:12 - 2017-03-04 02:08 - 00629248 _____ (Microsoft Corporation) C:\WINDOWS\system32\hgcpl.dll
    2017-04-04 18:12 - 2017-03-04 02:07 - 02914816 _____ (Microsoft Corporation) C:\WINDOWS\system32\CertEnroll.dll
    2017-04-04 18:12 - 2017-03-04 02:07 - 02512384 _____ (Microsoft Corporation) C:\WINDOWS\system32\themecpl.dll
    2017-04-04 18:12 - 2017-03-04 02:07 - 01490944 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
    2017-04-04 18:12 - 2017-03-04 02:07 - 01064448 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
    2017-04-04 18:12 - 2017-03-04 02:07 - 00716800 _____ (Microsoft Corporation) C:\WINDOWS\system32\ShareHost.dll
    2017-04-04 18:12 - 2017-03-04 02:07 - 00389632 _____ (Microsoft Corporation) C:\WINDOWS\system32\stobject.dll
    2017-04-04 18:12 - 2017-03-04 02:06 - 04060672 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIRibbon.dll
    2017-04-04 18:12 - 2017-03-04 02:06 - 03614720 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
    2017-04-04 18:12 - 2017-03-04 02:06 - 02317824 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
    2017-04-04 18:12 - 2017-03-04 02:06 - 00881664 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
    2017-04-04 18:12 - 2017-03-04 02:06 - 00483328 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.dll
    2017-04-04 18:12 - 2017-03-04 02:05 - 01726976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll
    2017-04-04 18:12 - 2017-03-04 02:05 - 00180224 _____ (Microsoft Corporation) C:\WINDOWS\system32\enrollmentapi.dll
    2017-04-04 18:12 - 2017-03-04 02:01 - 03478528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIRibbon.dll
    2017-04-04 18:12 - 2016-07-15 22:29 - 00017408 _____ (Microsoft Corporation) C:\WINDOWS\system32\CspCellularSettings.dll
    2017-04-04 18:12 - 2016-07-15 22:28 - 00125440 _____ (Microsoft Corporation) C:\WINDOWS\system32\EnterpriseAPNCsp.dll
    2017-04-04 18:12 - 2016-07-15 22:26 - 00128512 _____ (Microsoft Corporation) C:\WINDOWS\system32\CfgSPCellular.dll
    2017-04-04 18:11 - 2017-03-04 03:57 - 00192352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aepic.dll
    2017-04-04 18:11 - 2017-03-04 03:35 - 01294688 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
    2017-04-04 18:11 - 2017-03-04 03:35 - 00655200 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
    2017-04-04 18:11 - 2017-03-04 03:35 - 00565088 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
    2017-04-04 18:11 - 2017-03-04 03:35 - 00343904 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
    2017-04-04 18:11 - 2017-03-04 03:35 - 00315232 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcntel.dll
    2017-04-04 18:11 - 2017-03-04 03:35 - 00242528 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
    2017-04-04 18:11 - 2017-03-04 03:35 - 00086368 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
    2017-04-04 18:11 - 2017-03-04 03:35 - 00038240 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCensus.exe
    2017-04-04 18:11 - 2017-03-04 03:25 - 01117024 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll
    2017-04-04 18:11 - 2017-03-04 03:24 - 01051112 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
    2017-04-04 18:11 - 2017-03-04 03:24 - 00894096 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
    2017-04-04 18:11 - 2017-03-04 03:22 - 01354312 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
    2017-04-04 18:11 - 2017-03-04 03:22 - 01172984 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
    2017-04-04 18:11 - 2017-03-04 03:21 - 02255712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
    2017-04-04 18:11 - 2017-03-04 03:20 - 00379744 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Classpnp.sys
    2017-04-04 18:11 - 2017-03-04 03:20 - 00128352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\partmgr.sys
    2017-04-04 18:11 - 2017-03-04 03:13 - 00635456 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
    2017-04-04 18:11 - 2017-03-04 03:08 - 00624048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
    2017-04-04 18:11 - 2017-03-04 03:08 - 00509280 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
    2017-04-04 18:11 - 2017-03-04 03:08 - 00342456 _____ (Microsoft Corporation) C:\WINDOWS\system32\wintrust.dll
    2017-04-04 18:11 - 2017-03-04 03:07 - 01100128 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
    2017-04-04 18:11 - 2017-03-04 03:07 - 00989016 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
    2017-04-04 18:11 - 2017-03-04 03:07 - 00947552 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.efi
    2017-04-04 18:11 - 2017-03-04 03:07 - 00811872 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.exe
    2017-04-04 18:11 - 2017-03-04 03:07 - 00110944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hvsocket.sys
    2017-04-04 18:11 - 2017-03-04 03:07 - 00080224 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmbkmcl.sys
    2017-04-04 18:11 - 2017-03-04 02:59 - 01570208 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
    2017-04-04 18:11 - 2017-03-04 02:34 - 00080896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmbkmclr.sys
    2017-04-04 18:11 - 2017-03-04 02:27 - 00391168 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleacc.dll
    2017-04-04 18:11 - 2017-03-04 02:26 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll
    2017-04-04 18:11 - 2017-03-04 02:23 - 03753984 _____ (Microsoft Corporation) C:\WINDOWS\system32\bootux.dll
    2017-04-04 18:11 - 2017-03-04 02:18 - 00320512 _____ (Microsoft Corporation) C:\WINDOWS\regedit.exe
    2017-04-04 18:11 - 2017-03-04 02:17 - 01082368 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll
    2017-04-04 18:11 - 2017-03-04 02:16 - 00583168 _____ (Microsoft Corporation) C:\WINDOWS\system32\BootMenuUX.dll
    2017-04-04 18:11 - 2017-03-04 02:13 - 00628736 _____ (Microsoft Corporation) C:\WINDOWS\system32\uReFS.dll
    2017-04-04 18:11 - 2017-03-04 02:11 - 01656832 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
    2017-04-04 18:11 - 2017-03-04 02:08 - 01714688 _____ (Microsoft Corporation) C:\WINDOWS\system32\dui70.dll
    2017-04-04 18:11 - 2017-03-04 02:06 - 04708864 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExplorerFrame.dll
    2017-04-04 18:11 - 2017-03-04 02:03 - 01817088 _____ (Microsoft Corporation) C:\WINDOWS\system32\ResetEngine.dll
    2017-04-04 17:00 - 2017-04-07 09:57 - 00000000 ____D C:\Program Files (x86)\BatteryCat
    2017-04-04 16:59 - 2017-04-04 17:00 - 02353748 _____ ( ) C:\Users\Mike\Downloads\BatteryCat_v13_w32-setup.exe
    2017-04-03 20:39 - 2017-04-03 20:40 - 00000000 ____D C:\Users\Mike\AppData\Roaming\Geek Uninstaller
    2017-04-03 20:38 - 2017-04-09 13:46 - 00000000 ____D C:\Users\Mike\Downloads\geek
    2017-04-03 20:38 - 2017-04-03 20:38 - 02793495 _____ C:\Users\Mike\Downloads\geek.zip
    2017-04-03 20:35 - 2017-04-09 10:01 - 00092096 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
    2017-04-03 20:35 - 2017-04-09 10:00 - 00111544 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
    2017-04-03 20:35 - 2017-04-03 20:35 - 00186304 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMChameleon.sys
    2017-04-03 20:34 - 2017-04-09 10:00 - 00251832 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
    2017-04-03 20:34 - 2017-04-09 10:00 - 00043968 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
    2017-04-03 20:34 - 2017-04-03 20:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
    2017-04-03 20:34 - 2017-04-03 20:34 - 00000000 ____D C:\ProgramData\Malwarebytes
    2017-04-03 20:34 - 2017-04-03 20:34 - 00000000 ____D C:\Program Files\Malwarebytes
    2017-04-03 20:34 - 2017-03-24 04:10 - 00077440 _____ C:\WINDOWS\system32\Drivers\mbae64.sys
    2017-04-03 20:30 - 2017-04-03 20:33 - 59272008 _____ (Malwarebytes ) C:\Users\Mike\Downloads\mb3-setup-consumer-3.0.6.1469-1096.exe
    2017-04-03 20:28 - 2017-04-12 05:30 - 00179519 _____ C:\WINDOWS\ZAM.krnl.trace
    2017-04-03 20:28 - 2017-04-12 05:30 - 00151824 _____ C:\WINDOWS\ZAM_Guard.krnl.trace
    2017-04-03 20:28 - 2017-04-03 20:28 - 00203680 _____ (Zemana Ltd.) C:\WINDOWS\system32\Drivers\zamguard64.sys
    2017-04-03 20:28 - 2017-04-03 20:28 - 00203680 _____ (Zemana Ltd.) C:\WINDOWS\system32\Drivers\zam64.sys
    2017-04-03 20:28 - 2017-04-03 20:28 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zemana AntiMalware
    2017-04-03 20:28 - 2017-04-03 20:28 - 00000000 ____D C:\Program Files (x86)\Zemana AntiMalware
    2017-04-03 20:27 - 2017-04-03 20:27 - 00000000 ____D C:\Users\Mike\AppData\Local\Zemana
    2017-04-03 20:26 - 2017-04-03 20:27 - 05766464 _____ (Zemana Ltd. ) C:\Users\Mike\Downloads\Zemana.AntiMalware.Setup.exe
    2017-04-03 20:26 - 2017-04-03 20:26 - 00002860 _____ C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
    2017-04-03 20:26 - 2017-04-03 20:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
    2017-04-03 20:25 - 2017-04-03 20:26 - 00000000 ____D C:\Program Files\CCleaner
    2017-04-03 20:25 - 2017-04-03 20:25 - 09274608 _____ (Piriform Ltd) C:\Users\Mike\Downloads\ccsetup528.exe
    2017-04-02 02:13 - 2017-04-02 02:13 - 00000000 ____D C:\$WINDOWS.~BT
    2017-04-02 02:12 - 2017-04-02 02:12 - 00000000 ___HD C:\$SysReset
    2017-04-01 22:30 - 2017-04-01 22:31 - 59272008 _____ (Malwarebytes ) C:\Users\Guest.HarryPotter\Downloads\mb3-setup-consumer-3.0.6.1469-1096.exe
    2017-04-01 22:24 - 2017-04-01 22:24 - 00985054 _____ C:\Users\Guest.HarryPotter\Downloads\EFRCSetup.exe
    2017-04-01 22:23 - 2017-04-01 22:23 - 05766464 _____ (Zemana Ltd. ) C:\Users\Guest.HarryPotter\Downloads\Zemana.AntiMalware.Setup.exe
    2017-04-01 22:21 - 2017-04-01 22:22 - 09274608 _____ (Piriform Ltd) C:\Users\Guest.HarryPotter\Downloads\ccsetup528.exe
    2017-04-01 22:10 - 2017-04-01 22:10 - 00000000 __SHD C:\found.000
    2017-04-01 19:58 - 2017-04-01 19:58 - 00000000 ____D C:\Users\Guest.HarryPotter\AppData\Local\AuthenTec
    2017-04-01 19:54 - 2017-04-02 09:37 - 00000000 ____D C:\Users\Guest.HarryPotter\AppData\Local\CrashDumps
    2017-04-01 19:53 - 2017-04-01 19:53 - 00000020 ___SH C:\Users\Guest.HarryPotter\ntuser.ini

    ==================== One Month Modified files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2017-04-12 05:29 - 2016-07-16 07:47 - 00000000 ___HD C:\Program Files\WindowsApps
    2017-04-12 05:29 - 2016-07-16 07:47 - 00000000 ____D C:\WINDOWS\AppReadiness
    2017-04-12 05:28 - 2017-01-04 10:23 - 00004158 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{4A7A6489-B655-426D-8A49-468943BA6759}
    2017-04-12 05:25 - 2017-01-03 12:27 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
    2017-04-09 10:13 - 2016-07-16 07:45 - 00000000 ____D C:\WINDOWS\INF
    2017-04-09 10:11 - 2017-01-03 14:58 - 00401544 _____ C:\WINDOWS\system32\prfh0804.dat
    2017-04-09 10:11 - 2017-01-03 14:58 - 00127302 _____ C:\WINDOWS\system32\prfc0804.dat
    2017-04-09 10:11 - 2017-01-03 12:37 - 01808146 _____ C:\WINDOWS\system32\PerfStringBackup.INI
    2017-04-09 10:05 - 2017-01-03 12:57 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
    2017-04-09 10:05 - 2016-07-16 02:04 - 00524288 _____ C:\WINDOWS\system32\config\BBI
    2017-04-09 10:05 - 2016-06-07 02:01 - 00065536 _____ C:\WINDOWS\system32\spu_storage.bin
    2017-04-09 10:02 - 2013-11-21 19:41 - 00000000 ____D C:\Users\Mike\AppData\LocalLow\AuthenTec
    2017-04-08 21:09 - 2016-07-16 07:47 - 00000000 ____D C:\WINDOWS\rescache
    2017-04-08 18:47 - 2015-02-13 11:35 - 00532136 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
    2017-04-07 09:59 - 2014-08-20 00:08 - 00000000 ____D C:\Users\Mike\AppData\Local\VirtualStore
    2017-04-06 20:52 - 2017-01-03 12:38 - 00000000 ____D C:\Users\Mike
    2017-04-06 20:51 - 2016-07-16 07:47 - 00000000 ____D C:\WINDOWS\system32\appraiser
    2017-04-06 19:48 - 2016-07-16 07:36 - 00000000 ____D C:\WINDOWS\CbsTemp
    2017-04-06 14:26 - 2013-09-24 08:02 - 00000000 __RHD C:\Users\Public\AccountPictures
    2017-04-06 05:44 - 2017-01-03 12:27 - 00289464 _____ C:\WINDOWS\system32\FNTCACHE.DAT
    2017-04-06 05:44 - 2014-08-20 22:01 - 00000000 ____D C:\Program Files\Microsoft Silverlight
    2017-04-06 05:44 - 2014-08-20 22:01 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
    2017-04-06 05:40 - 2016-07-16 07:47 - 00000000 ___SD C:\WINDOWS\SysWOW64\F12
    2017-04-06 05:40 - 2016-07-16 07:47 - 00000000 ____D C:\WINDOWS\SysWOW64\setup
    2017-04-06 05:39 - 2016-07-16 07:47 - 00000000 ___SD C:\WINDOWS\system32\F12
    2017-04-06 05:39 - 2016-07-16 07:47 - 00000000 ___RD C:\WINDOWS\PrintDialog
    2017-04-06 05:39 - 2016-07-16 07:47 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
    2017-04-06 05:39 - 2016-07-16 07:47 - 00000000 ___RD C:\Program Files\Windows Defender
    2017-04-06 05:39 - 2016-07-16 07:47 - 00000000 ____D C:\WINDOWS\system32\setup
    2017-04-06 05:39 - 2016-07-16 07:47 - 00000000 ____D C:\WINDOWS\system32\oobe
    2017-04-06 05:39 - 2016-07-16 07:47 - 00000000 ____D C:\WINDOWS\ShellExperiences
    2017-04-06 05:39 - 2016-07-16 07:47 - 00000000 ____D C:\WINDOWS\bcastdvr
    2017-04-06 05:39 - 2016-07-16 07:47 - 00000000 ____D C:\Program Files\Windows Photo Viewer
    2017-04-06 05:39 - 2016-07-16 07:47 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer
    2017-04-06 05:39 - 2016-07-16 07:47 - 00000000 ____D C:\Program Files (x86)\Windows Defender
    2017-04-05 18:49 - 2014-08-20 00:15 - 00002279 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
    2017-04-04 22:26 - 2014-08-20 01:40 - 00000000 ____D C:\WINDOWS\system32\MRT
    2017-04-04 22:19 - 2014-08-20 01:40 - 138634176 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
    2017-04-04 22:00 - 2014-08-20 22:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
    2017-04-04 14:42 - 2013-09-24 05:41 - 00000000 ____D C:\ProgramData\Norton
    2017-04-04 14:42 - 2013-09-24 05:40 - 00000000 ____D C:\Program Files (x86)\NortonInstaller
    2017-04-04 05:58 - 2016-07-16 07:47 - 00000000 ___HD C:\WINDOWS\ELAMBKUP
    2017-04-04 05:58 - 2016-07-16 02:04 - 00032768 _____ C:\WINDOWS\system32\config\ELAM
    2017-04-04 05:52 - 2013-09-24 05:40 - 00000000 ____D C:\ProgramData\NortonInstaller
    2017-04-03 20:34 - 2015-12-21 09:45 - 00000000 ____D C:\Users\Mike\Tracing
    2017-04-03 20:34 - 2014-08-20 22:59 - 00000000 ____D C:\Program Files (x86)\Steam
    2017-04-03 20:32 - 2017-01-03 15:25 - 00000000 ___DC C:\WINDOWS\Panther
    2017-04-03 20:32 - 2015-09-09 00:19 - 00000000 ____D C:\Users\Mike\AppData\Local\CrashDumps
    2017-04-02 09:35 - 2017-01-03 12:38 - 00000000 ____D C:\Users\Guest.HarryPotter
    2017-04-02 09:35 - 2015-01-15 22:53 - 00000000 ____D C:\Users\Guest.HarryPotter\AppData\LocalLow\AuthenTec
    2017-04-01 19:56 - 2015-01-15 22:53 - 00000000 ____D C:\Users\Guest.HarryPotter\AppData\Local\Packages
    2017-04-01 10:47 - 2014-11-22 21:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
    2017-04-01 10:44 - 2015-07-23 13:46 - 00000000 ____D C:\Program Files\Common Files\AV

    ==================== Files in the root of some directories =======

    2016-08-09 15:30 - 2016-08-09 15:30 - 0000057 _____ () C:\ProgramData\Ament.ini
    2017-04-09 18:31 - 2012-10-24 15:44 - 0656048 _____ (WildTangent, Inc.) C:\ProgramData\uninstall1900599.exe

    Files to move or delete:
    ====================
    C:\ProgramData\uninstall1900599.exe


    Some files in TEMP:
    ====================
    2017-04-09 13:47 - 2017-04-09 13:47 - 3957784 _____ (Geek Unіnstaller) C:\Users\Mike\AppData\Local\Temp\geek64.exe

    ==================== Bamital & volsnap ======================

    (There is no automatic fix for files that do not pass verification.)

    C:\WINDOWS\system32\winlogon.exe => File is digitally signed
    C:\WINDOWS\system32\wininit.exe => File is digitally signed
    C:\WINDOWS\explorer.exe => File is digitally signed
    C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
    C:\WINDOWS\system32\svchost.exe => File is digitally signed
    C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
    C:\WINDOWS\system32\services.exe => File is digitally signed
    C:\WINDOWS\system32\User32.dll => File is digitally signed
    C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
    C:\WINDOWS\system32\userinit.exe => File is digitally signed
    C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
    C:\WINDOWS\system32\rpcss.dll => File is digitally signed
    C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
    C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
    C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

    LastRegBack: 2017-04-06 14:36

    ==================== End of FRST.txt ============================

     

    Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-03-2017
    Ran by Mike (12-04-2017 05:33:34)
    Running from C:\Users\Mike\Desktop
    Windows 10 Home Version 1607 (X64) (2017-01-03 17:17:16)
    Boot Mode: Normal
    ==========================================================


    ==================== Accounts: =============================

    Administrator (S-1-5-21-3872570739-2396358053-2626862775-500 - Administrator - Disabled) => C:\Users\Administrator
    DefaultAccount (S-1-5-21-3872570739-2396358053-2626862775-503 - Limited - Disabled)
    Guest (S-1-5-21-3872570739-2396358053-2626862775-501 - Limited - Enabled) => C:\Users\Guest.HarryPotter
    Mike (S-1-5-21-3872570739-2396358053-2626862775-1002 - Administrator - Enabled) => C:\Users\Mike

    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    ==================== Installed Programs ======================

    (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    4 Elements II (x32 Version: 2.2.0.98 - WildTangent) Hidden
    7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
    Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.023.20070 - Adobe Systems Incorporated)
    Adobe Shockwave Player 11.6 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.6.6.636 - Adobe Systems, Inc.)
    Airport Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden
    AMD Catalyst Install Manager (HKLM\...\{6E20D0AE-0E89-2FE7-4F69-C1A2799EFA65}) (Version: 8.0.911.0 - Advanced Micro Devices, Inc.)
    Anki (HKLM-x32\...\Anki) (Version:  - )
    Assassin's Creed (HKLM-x32\...\{8CFA9151-6404-409A-AF22-4632D04582FD}) (Version: 1.02 - Ubisoft)
    AuthenTec TrueAPI 64-bit (Version: 1.6.0.87 - AuthenTec, Inc.) Hidden
    Azteca (x32 Version: 2.2.0.97 - WildTangent) Hidden
    BatteryCat 1.3 (HKLM-x32\...\BatteryCat_is1) (Version:  - )
    Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
    Blade & Soul (HKLM-x32\...\InstallShield_{C3F383C1-D050-4A40-843F-8171A6A02C3A}) (Version: 1.0.63.237 - NC Interactive, LLC)
    Blade & Soul (x32 Version: 1.0.63.237 - NC Interactive, LLC) Hidden
    Bounce Symphony (x32 Version: 2.2.0.97 - WildTangent) Hidden
    Build-a-lot (x32 Version: 2.2.0.98 - WildTangent) Hidden
    Canon IJ Network Scanner Selector EX (HKLM-x32\...\Canon_IJ_Network_Scanner_Selector_EX) (Version:  - Canon Inc.)
    Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version: 3.2.0 - Canon Inc.)
    Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version:  - Canon Inc.)
    Canon MX450 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX450_series) (Version: 1.00 - Canon Inc.)
    CCleaner (HKLM\...\CCleaner) (Version: 5.28 - Piriform)
    Child of Light (HKLM\...\Steam App 256290) (Version:  - Ubisoft Montréal)
    Chrome Remote Desktop Host (HKLM-x32\...\{88D5D9A4-48C4-4D0A-88B9-3E18661CF0D9}) (Version: 57.0.2987.37 - Google Inc.)
    Cradle Of Egypt Collector's Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden
    Cradle of Rome 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
    Curse at Twilight (x32 Version: 3.0.2.32 - WildTangent) Hidden
    Cyberlink PhotoDirector (HKLM-x32\...\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.1.3711 - CyberLink Corp.)
    CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.3.2606 - CyberLink Corp.)
    CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.6.6117 - CyberLink Corp.)
    D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
    Delicious: Emily's Childhood Memories Premium Edition (x32 Version: 3.0.2.32 - WildTangent) Hidden
    Eusing Free Registry Cleaner (HKLM-x32\...\Eusing Free Registry Cleaner) (Version:  - Eusing Software)
    Farm Frenzy (x32 Version: 2.2.0.98 - WildTangent) Hidden
    FINAL FANTASY VIII (HKLM-x32\...\Steam App 39150) (Version:  - SQUARE ENIX)
    Finale NotePad 2012 (HKLM-x32\...\Finale NotePad 2012) (Version: 2012..r1.5 - MakeMusic)
    Google Chrome (HKLM-x32\...\Google Chrome) (Version: 57.0.2987.133 - Google Inc.)
    Google Drive (HKLM-x32\...\{A1238426-ECDF-4639-BE2F-8D12A97AE23C}) (Version: 2.34.5075.1619 - Google, Inc.)
    Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
    Google Update Helper (x32 Version: 1.3.33.3 - Google Inc.) Hidden
    Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden
    Hewlett-Packard ACLM.NET v1.2.1.1 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
    HitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.18.284 - SurfRight B.V.)
    House of 1000 Doors: Family Secrets (x32 Version: 2.2.0.98 - WildTangent) Hidden
    HP 3D DriveGuard (HKLM-x32\...\{AE2F1669-5B1F-47C5-B639-78D74DD0BCE4}) (Version: 6.0.9.1 - Hewlett-Packard Company)
    HP Connected Music (Meridian - installer) (HKLM-x32\...\StartHPConnectedMusic) (Version: 1.0 - Meridian Audio Ltd)
    HP CoolSense (HKLM-x32\...\{59F8C5AA-91BD-423D-BF05-09A80F39898F}) (Version: 2.10.62 - Hewlett-Packard Company)
    HP Documentation (HKLM-x32\...\{0FEE0C28-850D-4AC0-92E7-57D214134102}) (Version: 1.2.0.0 - Hewlett-Packard)
    HP MyRoom (HKLM-x32\...\{9C35EDE5-4B0F-45E7-A438-314BA889948E}) (Version: 9.0.0.0 - Hewlett-Packard Company)
    HP Officejet Pro 8600 Basic Device Software (HKLM\...\{791A06E2-340F-43B0-8FAB-62D151339362}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
    HP Quick Start (HKLM-x32\...\{574F0207-8E98-46CD-8F79-318348C98C46}) (Version: 1.0.4660.30220 - Hewlett-Packard)
    HP Registration Service (HKLM\...\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.6317.4309 - Hewlett-Packard)
    HP SimplePass (HKLM-x32\...\{4BACA3B8-F63A-44ED-9A8D-48B4D02AD268}) (Version: 6.0.100.276 - Hewlett-Packard)
    HP Support Assistant (HKLM-x32\...\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}) (Version: 7.0.39.15 - Hewlett-Packard Company)
    HP System Event Utility (HKLM-x32\...\{C27D60E4-3132-45A3-A71A-E3BD1DA3F794}) (Version: 1.0.4 - Hewlett-Packard Company)
    HP Utility Center (HKLM\...\{73237EBB-B26F-4628-8754-4EFE563D72E9}) (Version: 2.1.5 - Hewlett-Packard Company)
    HP Wireless Button Driver (HKLM-x32\...\{941DE69D-6CEE-4171-8F1F-3D7E352AA498}) (Version: 1.0.6.1 - Hewlett-Packard Company)
    IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6454.0 - IDT)
    Java 8 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418045F0}) (Version: 8.0.450 - Oracle Corporation)
    Java SE Development Kit 8 Update 45 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180450}) (Version: 8.0.450.14 - Oracle Corporation)
    Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
    Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
    Luxor Evolved (x32 Version: 2.2.0.98 - WildTangent) Hidden
    Mah Jong Medley (x32 Version: 2.2.0.95 - WildTangent) Hidden
    Mahjongg Dimensions Deluxe: Tiles in Time (x32 Version: 2.2.0.98 - WildTangent) Hidden
    Malwarebytes version 3.0.6.1469 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.0.6.1469 - Malwarebytes)
    Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4454.1510 - Microsoft Corporation)
    Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
    Microsoft OneDrive (HKU\S-1-5-21-3872570739-2396358053-2626862775-1002\...\OneDriveSetup.exe) (Version: 17.3.6743.1212 - Microsoft Corporation)
    Microsoft OneNote Home and Student 2016 - en-us (HKLM\...\OneNoteFreeRetail - en-us) (Version: 16.0.6868.2067 - Microsoft Corporation)
    Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50905.0 - Microsoft Corporation)
    Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
    Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
    Mystery P.I. - Curious Case of Counterfeit Cove (x32 Version: 2.2.0.98 - WildTangent) Hidden
    NCSOFT Game Launcher (HKLM-x32\...\NCLauncher_NCWest) (Version:  - NCSOFT)
    NetBeans IDE 8.0.2 (HKLM\...\nbi-nb-base-8.0.2.0.201411181905) (Version: 8.0.2 - NetBeans.org)
    NVIDIA PhysX (HKLM-x32\...\{E10DB5DA-E576-40EA-A7FC-1CB2A7B283A6}) (Version: 9.09.1112 - NVIDIA Corporation)
    OEM Application Profile (HKLM-x32\...\{C89A97B6-F991-EBB5-77B7-927BCF420EBE}) (Version: 1.00.0000 - Advanced Micro Devices, Inc.)
    Office 16 Click-to-Run Extensibility Component (x32 Version: 16.0.6828.1019 - Microsoft Corporation) Hidden
    Office 16 Click-to-Run Licensing Component (Version: 16.0.6828.1019 - Microsoft Corporation) Hidden
    Office 16 Click-to-Run Localization Component (x32 Version: 16.0.6828.1019 - Microsoft Corporation) Hidden
    Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden
    Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
    Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
    Ralink Bluetooth Stack64 (HKLM\...\{7B83C685-3EA9-544F-9580-368394C67C3A}) (Version: 11.0.737.2 - Mediatek)
    Ralink RT3290 802.11bgn Wi-Fi Adapter (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 5.0.23.0 - Mediatek)
    Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.10.1226.2012 - Realtek)
    Realtek PCIE Card Reader (HKLM-x32\...\{0D61A55C-3ADC-409F-BF5B-A1766D1F5944}) (Version: 6.2.9200.29053 - Realtek Semiconductor Corp.)
    Roads of Rome 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
    Royal Envoy 2 Collector's Edition (x32 Version: 3.0.2.32 - WildTangent) Hidden
    Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)
    swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
    Synaptics ClickPad Driver (HKLM\...\SynTPDeinstKey) (Version: 19.2.4.10 - Synaptics Incorporated)
    Tales of Lagoona (x32 Version: 2.2.0.110 - WildTangent) Hidden
    Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
    Uplay (HKLM-x32\...\Uplay) (Version: 4.3 - Ubisoft)
    Vacation Quest™ - Australia (x32 Version: 3.0.2.32 - WildTangent) Hidden
    Validity WBF DDK (HKLM\...\{3DA747CA-A84B-4821-9F18-5807214AB79A}) (Version: 4.5.117.0 - Validity Sensors, Inc.)
    WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
    WildTangent Games App (HP Games) (x32 Version: 4.0.10.5 - WildTangent) Hidden
    Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
    Youda Jewel Shop (x32 Version: 3.0.2.32 - WildTangent) Hidden
    Zemana AntiMalware (HKLM-x32\...\{8F0CD7D1-42F3-4195-95CD-833578D45057}_is1) (Version: 2.72.0.345 - Zemana Ltd.)
    Zuma's Revenge (x32 Version: 2.2.0.98 - WildTangent) Hidden

    ==================== Custom CLSID (Whitelisted): ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    ==================== Scheduled Tasks (Whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    Task: {074A2A7E-CFDF-4FD1-A12F-00376FDCA303} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2017-03-03] (Piriform Ltd)
    Task: {094CD275-5C71-4753-B57E-5566CA859498} - \Microsoft\Windows\SideShow\AutoWake -> No File <==== ATTENTION
    Task: {0AC78A7F-F2BD-4781-9C65-D9B16683E824} - \Microsoft\Windows\UpdateOrchestrator\USO_UxBroker_Display -> No File <==== ATTENTION
    Task: {0D21BBCE-5FF6-4613-B62C-48148CA6EAA1} - \Microsoft\Windows\RAC\RacTask -> No File <==== ATTENTION
    Task: {0F6DBBD1-1FA5-490B-A482-1F43FCC689E6} - \Microsoft\Windows\SideShow\SystemDataProviders -> No File <==== ATTENTION
    Task: {11BEDDFB-BCE0-4B2A-A2A6-4AB7412655F1} - \Microsoft\Windows\RemovalTools\MRT_HB -> No File <==== ATTENTION
    Task: {1A4230A2-E136-4936-9B22-DDF624BB8332} - \Microsoft\Windows\IME\SQM data sender -> No File <==== ATTENTION
    Task: {1D391053-5A4B-4005-B602-7D3997A04218} - System32\Tasks\GoogleUpdateTaskMachineUA1d20589e410f747 => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
    Task: {23DD186F-49BE-4D41-9AE7-DC4D1A28FABA} - \GoogleUpdateTaskMachineUA -> No File <==== ATTENTION
    Task: {2DE23CB9-8CC8-4CDA-A65E-2B2D7A2132C7} - \Microsoft\Windows\WindowsUpdate\AUSessionConnect -> No File <==== ATTENTION
    Task: {334945C8-13BE-4227-B27F-00277D1771DA} - \Hewlett-Packard\HP CoolSense\HP CoolSense Start at Logon -> No File <==== ATTENTION
    Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - \Microsoft\Windows\Workplace Join\Automatic-Workplace-Join -> No File <==== ATTENTION
    Task: {357AB417-9E02-42FA-B3E7-7FE74AF1C816} - \Synaptics TouchPad Enhancements -> No File <==== ATTENTION
    Task: {3A6C4D76-6A32-44EF-8DC4-57C984735A96} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime -> No File <==== ATTENTION
    Task: {3ABFB734-3ABF-4C75-B777-64C061C79958} - \Microsoft\Windows\Setup\GWXTriggers\Time-Weekend -> No File <==== ATTENTION
    Task: {49F3A632-4C39-4AD2-B026-E4C0F33431D7} - \Hewlett-Packard\HP Support Assistant\Update Check -> No File <==== ATTENTION
    Task: {4CF2CB82-BE5B-4326-B841-CADB1CECAD6A} - \GoogleUpdateTaskMachineCore -> No File <==== ATTENTION
    Task: {4D8687FA-0545-450A-B9C8-EF750A9E88E0} - \Microsoft\Windows\UpdateOrchestrator\USO_UxBroker_ReadyToReboot -> No File <==== ATTENTION
    Task: {4FBFAB50-AC9F-48F3-8286-EBCCA44ED4B2} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
    Task: {5306F9D8-8BD9-4DAA-87F3-FEE976A678A4} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime -> No File <==== ATTENTION
    Task: {577DE119-B13A-4F32-B4E9-DFF3497F0D30} - \Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan -> No File <==== ATTENTION
    Task: {59B1E423-344D-4A74-B257-CDF59320D0CB} - \HPCeeScheduleForMike -> No File <==== ATTENTION
    Task: {5A3FB241-0B11-4EA5-BC66-0D9F1B406040} - \Microsoft\Windows\Customer Experience Improvement Program\BthSQM -> No File <==== ATTENTION
    Task: {5ADE7426-5E0C-491B-A31E-B6A9E0435DBB} - \Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report -> No File <==== ATTENTION
    Task: {5D2906A6-AB4B-441F-AB17-FFD4CA4CE5B3} - \MirageAgent -> No File <==== ATTENTION
    Task: {62FF6AAE-ABBE-4525-B6F8-3AB54CBD1364} - \Hewlett-Packard\HP Support Assistant\PC Tuneup -> No File <==== ATTENTION
    Task: {6AF9C298-445D-4C1A-8DAB-040F7710F0DA} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
    Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - \Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task -> No File <==== ATTENTION
    Task: {73B18AA2-8410-45B1-9735-4F3F5E726071} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
    Task: {758F3A26-D10B-408D-90DB-9FA7B2EE8DE1} - \Norton WSC Integration -> No File <==== ATTENTION
    Task: {78360123-9D48-42A2-8921-FC25CF9578CC} - \Microsoft\Windows\Shell\FamilySafetyUpload -> No File <==== ATTENTION
    Task: {80CB9DA6-0C50-4B02-94FC-C28E1DF45E44} - \Hewlett-Packard\HP Support Assistant\PC Health Analysis -> No File <==== ATTENTION
    Task: {81EE7268-BD8F-402D-A669-63B736DB51D3} - \Microsoft\Windows\SysResetLogSuccess -> No File <==== ATTENTION
    Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - \Microsoft\Windows\SkyDrive\Routine Maintenance Task -> No File <==== ATTENTION
    Task: {88AC6CEF-9D90-455C-A03D-77B56316B09D} - \Microsoft OneDrive Auto Update Task-S-1-5-21-3872570739-2396358053-2626862775-1002 -> No File <==== ATTENTION
    Task: {89BBA882-6FEC-42DA-BCCF-1DB4C924950E} - \Microsoft\Windows\WindowsUpdate\Scheduled Start With Network -> No File <==== ATTENTION
    Task: {8B6759EE-1C08-4B8F-955C-774AB5A6544E} - \Microsoft\Windows\SideShow\SessionAgent -> No File <==== ATTENTION
    Task: {8C77F777-A227-4A2A-892B-FD3C9065D89E} - \Microsoft\Office\Office Automatic Updates -> No File <==== ATTENTION
    Task: {8FA24A41-01EA-4219-8D40-C8EC67395803} - \Microsoft\Windows\UpdateOrchestrator\Policy Install -> No File <==== ATTENTION
    Task: {990460E3-13B4-476E-9B85-110EF5949519} - System32\Tasks\GoogleUpdateTaskMachineCore1d20589e3f5d424 => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
    Task: {9A93480E-DD69-4A37-9694-9880DFF7ABFD} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
    Task: {A02F0FDC-BEC8-4C92-8F92-D2C3DC0A5B1B} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
    Task: {A79FE138-F30D-4F87-8BB6-917D1984FC02} - \Microsoft\Windows\Setup\gwx\rundetector -> No File <==== ATTENTION
    Task: {AB333376-6B9F-4495-8592-15927BE626C1} - \Adobe Acrobat Update Task -> No File <==== ATTENTION
    Task: {B2F408D7-8D19-478D-8233-168BBFE9F31C} - \Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start -> No File <==== ATTENTION
    Task: {B31CED95-B056-4EAB-B535-58FC484CEC73} - \Microsoft\Windows\WindowsUpdate\AUFirmwareInstall -> No File <==== ATTENTION
    Task: {C4AE3C3E-C327-4689-B6FD-C11FB31AE88B} - \Microsoft\Windows\NetCfg\BindingWorkItemQueueHandler -> No File <==== ATTENTION
    Task: {C9DCF59E-6B97-4C0C-8641-B8261089C8CA} - \Microsoft\Windows\MobilePC\HotStart -> No File <==== ATTENTION
    Task: {CC1EA591-CF85-4464-A7CD-AC655D99FF41} - \Microsoft\Windows\WindowsUpdate\AUScheduledInstall -> No File <==== ATTENTION
    Task: {CD6F0810-CB34-45BF-8A08-86C0202CC413} - \Microsoft\Office\Office ClickToRun Service Monitor -> No File <==== ATTENTION
    Task: {CE2DE968-E342-40D7-9566-427D45E4A886} - \Microsoft\Windows\PerfTrack\BackgroundConfigSurveyor -> No File <==== ATTENTION
    Task: {CEB1FD32-A280-4176-B11B-F2847F16B412} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
    Task: {CFBE5995-1040-4228-A733-D2969CFCFEED} - \Microsoft\Windows\Setup\GWXTriggers\OnIdle-5d -> No File <==== ATTENTION
    Task: {CFFC9446-8E86-4C53-9C5F-7EEB30F74372} - \Optimize Start Menu Cache Files-S-1-5-21-3872570739-2396358053-2626862775-1002 -> No File <==== ATTENTION
    Task: {DB21EF32-6BA9-4118-BBC1-BC4FF48961E5} - \Microsoft\Windows\SideShow\GadgetManager -> No File <==== ATTENTION
    Task: {E4674C28-17BD-41C7-80DC-51EB20889203} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
    Task: {EA6A441D-8384-4A01-A645-AC4387E41DAF} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
    Task: {EA9394FC-D444-4AFE-9589-90936F5E0CBE} - \Remediation\AntimalwareMigrationTask -> No File <==== ATTENTION
    Task: {EC7543D2-41A9-4258-9792-0D13DB8428E2} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
    Task: {EDD1F16C-B733-44B3-B8C7-E82A15D49FE3} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
    Task: {F12CF22E-FA06-4A93-8FB4-2D82A17B7FCA} - \Microsoft\Windows Live\SOXE\Extractor Definitions Update Task -> No File <==== ATTENTION
    Task: {FC4D8CB4-260A-468E-BA25-5F3464C15DA3} - \Hewlett-Packard\HP Support Assistant\Critical Actions Pending -> No File <==== ATTENTION
    Task: {FFA3F6F1-4221-454A-8C9D-F4B3D1A46ADC} - \Optimize Start Menu Cache Files-S-1-5-21-3872570739-2396358053-2626862775-500 -> No File <==== ATTENTION

    (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: C:\WINDOWS\Tasks\HPCeeScheduleForMike.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

    ==================== Shortcuts =============================

    (The entries could be listed to be restored or removed.)

    ShortcutWithArgument: C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_lneaknkopdijkpnocmklfnjbeapigfbh\Google Maps.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) ->  --profile-directory=Default --app-id=lneaknkopdijkpnocmklfnjbeapigfbh
    ShortcutWithArgument: C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_komhbcfkdcgmcdoenjcjheifdiabikfi\Google Play.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) ->  --profile-directory=Default --app-id=komhbcfkdcgmcdoenjcjheifdiabikfi
    ShortcutWithArgument: C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_ejjicmeblgpmajnghnpcppodonldlgfn\Google Calendar.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) ->  --profile-directory=Default --app-id=ejjicmeblgpmajnghnpcppodonldlgfn
    ShortcutWithArgument: C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_apdfllckaahabafndbhieahigkjlhalf\Google Drive.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) ->  --profile-directory=Default --app-id=apdfllckaahabafndbhieahigkjlhalf
    ShortcutWithArgument: C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Web Applications\www.netflix.com\http_80\Netflix.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) ->  --app=hxxp://www.netflix.com/WiHome
    ShortcutWithArgument: C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Play Movies & TV.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) ->  --profile-directory=Default --app-id=gdijeikdkaembjbdobgfkoidjkpbmlkd
    ShortcutWithArgument: C:\Users\Mike\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\fd4d8e7501576f3f\Pushbullet.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=chlffgpmiacpedhhbkiomidkjlcfhogd

    ==================== Loaded Modules (Whitelisted) ==============

    2016-07-16 07:42 - 2016-07-16 07:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
    2017-04-04 18:14 - 2017-03-04 03:19 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
    2015-12-12 14:32 - 2016-05-15 11:51 - 00417480 _____ () C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ApiClient.dll
    2017-04-04 18:14 - 2017-03-04 03:19 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll
    2016-03-16 13:33 - 2016-05-15 14:51 - 08919752 _____ () C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\1033\GrooveIntlResource.dll
    2017-01-03 15:13 - 2017-01-03 15:13 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
    2017-04-04 18:11 - 2017-03-04 02:31 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
    2017-04-03 20:34 - 2017-04-03 20:35 - 03879424 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1703.601.0_x64__8wekyb3d8bbwe\Calculator.exe
    2017-04-04 18:16 - 2017-03-04 02:12 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
    2017-04-04 18:17 - 2017-03-04 02:05 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
    2017-04-04 18:17 - 2017-03-04 02:05 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
    2017-04-04 18:17 - 2017-03-04 02:05 - 01033216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
    2017-04-04 18:17 - 2017-03-04 02:05 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
    2017-04-04 18:16 - 2017-03-04 02:08 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
    2017-04-10 18:12 - 2017-04-10 18:13 - 00077312 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.13.133.0_x64__kzf8qxf38zg5c\SkypeHost.exe
    2017-04-10 18:12 - 2017-04-10 18:13 - 00189952 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.13.133.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
    2017-04-10 18:12 - 2017-04-10 18:13 - 42507264 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.13.133.0_x64__kzf8qxf38zg5c\SkyWrap.dll
    2017-04-10 18:12 - 2017-04-10 18:13 - 02334184 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.13.133.0_x64__kzf8qxf38zg5c\skypert.dll
    2017-04-10 18:12 - 2017-04-10 18:13 - 00135168 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.13.133.0_x64__kzf8qxf38zg5c\SkypeHost.Proxies.dll
    2017-04-10 18:12 - 2017-04-10 18:12 - 00181248 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.13.133.0_x64__kzf8qxf38zg5c\Microsoft.Skype.ImageTool.dll
    2017-04-10 18:12 - 2017-04-10 18:13 - 00040960 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.13.133.0_x64__kzf8qxf38zg5c\TraceProvider.dll
    2013-09-24 05:12 - 2011-12-05 20:27 - 00158536 _____ () C:\WINDOWS\System32\SRSLabs\{176F4E15-8F7C-4833-ADED-81FAE8CCD186}\slcc3d64.dll
    2017-04-05 18:49 - 2017-03-28 22:04 - 02187096 _____ () C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\libglesv2.dll
    2017-04-05 18:49 - 2017-03-28 22:04 - 00086360 _____ () C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.133\libegl.dll

    ==================== Alternate Data Streams (Whitelisted) =========

    (If an entry is included in the fixlist, only the ADS will be removed.)


    ==================== Safe Mode (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

    ==================== Association (Whitelisted) ===============

    (If an entry is included in the fixlist, the registry item will be restored to default or removed.)


    ==================== Internet Explorer trusted/restricted ===============

    (If an entry is included in the fixlist, it will be removed from the registry.)


    ==================== Hosts content: ===============================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2013-08-22 09:25 - 2013-08-22 09:25 - 00000824 ____N C:\WINDOWS\system32\Drivers\etc\hosts


    ==================== Other Areas ============================

    (Currently there is no automatic fix for this section.)

    HKU\S-1-5-21-3872570739-2396358053-2626862775-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Mike\Pictures\Wallpapers\vyborg-rossiya-rassvet.jpg
    DNS Servers: 192.168.0.1
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
    Windows Firewall is enabled.

    ==================== MSCONFIG/TASK MANAGER disabled items ==

    MSCONFIG\Services: AdobeARMservice => 2
    MSCONFIG\Services: AMD External Events Utility => 2
    MSCONFIG\Services: AMD FUEL Service => 2
    MSCONFIG\Services: chromoting => 2
    MSCONFIG\Services: FPLService => 2
    MSCONFIG\Services: GamesAppService => 3
    MSCONFIG\Services: gupdate => 2
    MSCONFIG\Services: gupdatem => 3
    MSCONFIG\Services: HitmanProScheduler => 2
    MSCONFIG\Services: HP Support Assistant Service => 2
    MSCONFIG\Services: hpqwmiex => 3
    MSCONFIG\Services: hpsrv => 2
    MSCONFIG\Services: HPWMISVC => 2
    MSCONFIG\Services: IconMan_R => 2
    MSCONFIG\Services: MBAMService => 2
    MSCONFIG\Services: Steam Client Service => 3
    MSCONFIG\Services: SynTPEnhService => 2
    MSCONFIG\Services: TrueService => 3
    MSCONFIG\Services: valWBFPolicyService => 2
    MSCONFIG\Services: ZAMSvc => 2
    HKLM\...\StartupApproved\Run32: => "WindowsDefender"
    HKLM\...\StartupApproved\Run32: => "ZAM"
    HKLM\...\StartupApproved\Run32: => "Malwarebytes TrayApp"
    HKU\S-1-5-21-3872570739-2396358053-2626862775-1002\...\StartupApproved\Run: => "CCleaner Monitoring"
    HKU\S-1-5-21-3872570739-2396358053-2626862775-1002\...\StartupApproved\Run: => "GoogleChromeAutoLaunch_A9A28D217F0AF6C0AE66A9006030A09A"

    ==================== FirewallRules (Whitelisted) ===============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
    FirewallRules: [{E76D428C-B4B6-4FBE-889E-DB25E217A59C}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicatorCom.exe
    FirewallRules: [{46E8FF17-A9FC-4C03-B9B5-80FFCC2B19D1}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicator.exe
    FirewallRules: [{F4A9ACB0-FD3F-4F82-A443-03FAB620DA9D}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\Bin\DeviceSetup.exe
    FirewallRules: [{A504837F-A319-4264-91D6-12D4C0C269A5}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\bin\SendAFax.exe
    FirewallRules: [{2DA020E4-10FE-46B7-9F3A-10F6CD82014F}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\bin\DigitalWizards.exe
    FirewallRules: [{DC32DD7A-1966-47C0-8F8D-15E1639D9294}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\bin\FaxApplications.exe
    FirewallRules: [{516F64CC-1CE3-4D24-86B1-F546160EDCC9}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
    FirewallRules: [{46878B2A-3436-43C2-B6BB-571EC56601C2}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
    FirewallRules: [{673C2C86-9681-4551-91E3-759FF0DE1C22}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
    FirewallRules: [{C9FEE6A7-2002-46F5-93DE-56E0EB9F3AC1}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
    FirewallRules: [{4DA64FF8-3D97-4200-AD28-0ABD17DF7AFC}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDirector10\PDR10.EXE
    FirewallRules: [{C5014FF5-B6EE-43E6-843B-90A18EB1A461}] => (Allow) C:\Program Files (x86)\HPConnectedMusic\HPConnectedMusic.exe
    FirewallRules: [{C8EAF3ED-C875-4835-8DDC-A9D72D053C8E}] => (Allow) C:\Program Files (x86)\HPConnectedMusic\HPConnectedMusic.exe
    FirewallRules: [{E5A1F5FE-8090-4561-B049-0E8FE00C0B7A}] => (Allow) C:\Users\Administrator\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
    FirewallRules: [{884E13D8-84C1-408E-834A-DE4F73344A56}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
    FirewallRules: [{864B3EBF-6656-4CD6-9E4C-1AD73A27B715}] => (Allow) LPort=2869
    FirewallRules: [{C3ED4B1C-5128-4967-B66E-9E6DDF0DE2DD}] => (Allow) LPort=1900
    FirewallRules: [{B6403D3C-D8CD-4286-BB81-3249DE7AD01C}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
    FirewallRules: [{02EA29A9-1D33-4D26-9912-CE48F32BC17F}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\FINAL FANTASY VIII\FF8_Launcher.exe
    FirewallRules: [{2B865DC8-9CFA-408B-B968-A4F54DECC844}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\FINAL FANTASY VIII\FF8_Launcher.exe
    FirewallRules: [{5289924A-1C7E-407B-B3A5-D7E2CAE7A33C}] => (Allow) C:\Program Files (x86)\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe
    FirewallRules: [{8F0AA0CF-8187-4323-914D-606DE5CBF93D}] => (Allow) C:\Program Files (x86)\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe
    FirewallRules: [{17F3210E-C200-405A-BA76-C364E772E3B3}] => (Allow) C:\Program Files (x86)\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe
    FirewallRules: [{5DA6594C-9A3F-4145-A24A-83A0BABC08EF}] => (Allow) C:\Program Files (x86)\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe
    FirewallRules: [{A67B4157-023A-4ADA-8FC7-BB6BEECC8A31}] => (Allow) C:\Program Files (x86)\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe
    FirewallRules: [{2506F4BE-A885-4455-BF8C-85595957AB6D}] => (Allow) C:\Program Files (x86)\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe
    FirewallRules: [{86B77A84-D08E-4371-84CE-9453A95C3C10}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Child of Light\ChildofLight.exe
    FirewallRules: [{5348D207-365F-42B7-AB3F-8E0417704C67}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Child of Light\ChildofLight.exe
    FirewallRules: [{9EE556D0-9D6E-436C-871D-8DDB7D01284E}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Child of Light\ChildofLight.exe
    FirewallRules: [{E24AE70E-4BAD-491D-86A4-4F3137DA82B7}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Child of Light\ChildofLight.exe
    FirewallRules: [{E9015A19-0336-4F63-BB44-25A0518F7A01}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPDeviceDetection3.exe
    FirewallRules: [{78E84F74-D48E-4D05-AEDE-1DCEA3A790D7}] => (Allow) C:\Program Files (x86)\Google\Chrome Remote Desktop\57.0.2987.37\remoting_host.exe
    FirewallRules: [{BFB8CBAC-47A1-40A2-B9EB-D611A5492C1E}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    ==================== Restore Points =========================

    04-04-2017 17:40:23 Scheduled Checkpoint

    ==================== Faulty Device Manager Devices =============

    Name: Generic PnP Monitor
    Description: Generic PnP Monitor
    Class Guid: {4d36e96e-e325-11ce-bfc1-08002be10318}
    Manufacturer: (Standard monitor types)
    Service: monitor
    Problem: : This device is disabled. (Code 22)
    Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (04/09/2017 10:04:57 AM) (Source: ATIeRecord) (EventID: 16396) (User: )
    Description: ATI EEU PnP start/stop failed

    Error: (04/09/2017 10:00:29 AM) (Source: ATIeRecord) (EventID: 16396) (User: )
    Description: ATI EEU PnP start/stop failed

    Error: (04/09/2017 09:57:53 AM) (Source: ATIeRecord) (EventID: 16396) (User: )
    Description: ATI EEU PnP start/stop failed

    Error: (04/08/2017 07:29:28 PM) (Source: ATIeRecord) (EventID: 16396) (User: )
    Description: ATI EEU PnP start/stop failed

    Error: (04/08/2017 06:36:01 PM) (Source: ATIeRecord) (EventID: 16396) (User: )
    Description: ATI EEU PnP start/stop failed

    Error: (04/06/2017 09:07:53 PM) (Source: VSS) (EventID: 8193) (User: )
    Description: Volume Shadow Copy Service error: Unexpected error calling routine QueryFullProcessImageNameW.  hr = 0x80070006, The handle is invalid.
    .


    Operation:
       Executing Asynchronous Operation

    Context:
       Current State: DoSnapshotSet

    Error: (04/06/2017 09:03:55 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
    Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

    Details:
    AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

    System Error:
    Access is denied.
    .

    Error: (04/06/2017 08:53:33 PM) (Source: ATIeRecord) (EventID: 16396) (User: )
    Description: ATI EEU PnP start/stop failed

    Error: (04/06/2017 08:32:12 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: HARRYPOTTER)
    Description: Activation of app microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1 failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.

    Error: (04/06/2017 08:32:12 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: HARRYPOTTER)
    Description: Activation of app Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy!App failed with error: -2147024865 See the Microsoft-Windows-TWinUI/Operational log for additional information.


    System errors:
    =============
    Error: (04/09/2017 10:25:26 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
    Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
    {8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
     and APPID 
    {F72671A9-012C-4725-9D2F-2A4D32D65169}
     to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

    Error: (04/09/2017 10:05:03 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
    Description: The Sync Host_6e6e5 service terminated with the following error: 
    Access is denied.

    Error: (04/09/2017 10:04:56 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
    Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
    {D63B10C5-BB46-4990-A94F-E40B9D520160}
     and APPID 
    {9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
     to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

    Error: (04/09/2017 10:02:53 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
    Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
    {8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
     and APPID 
    {F72671A9-012C-4725-9D2F-2A4D32D65169}
     to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

    Error: (04/09/2017 09:57:51 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
    Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
    {D63B10C5-BB46-4990-A94F-E40B9D520160}
     and APPID 
    {9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
     to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

    Error: (04/08/2017 07:38:37 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
    Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
    {8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
     and APPID 
    {F72671A9-012C-4725-9D2F-2A4D32D65169}
     to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

    Error: (04/08/2017 07:28:47 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: The Windows Search service failed to start due to the following error: 
    The service did not start due to a logon failure.

    Error: (04/08/2017 07:28:47 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
    Description: The WSearch service was unable to log on as NT AUTHORITY\SYSTEM with the currently configured password due to the following error: 
    The request is not supported.


    To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).

    Error: (04/08/2017 07:28:31 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
    Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID 
    {D63B10C5-BB46-4990-A94F-E40B9D520160}
     and APPID 
    {9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
     to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

    Error: (04/08/2017 07:28:17 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
    Description: The Windows Search service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 30000 milliseconds: Restart the service.


    CodeIntegrity:
    ===================================
      Date: 2017-01-23 12:48:15.163
      Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

      Date: 2017-01-23 12:48:15.155
      Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

      Date: 2017-01-23 12:48:15.130
      Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

      Date: 2017-01-23 12:48:15.122
      Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

      Date: 2017-01-23 12:48:15.087
      Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

      Date: 2017-01-23 12:48:15.079
      Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

      Date: 2017-01-23 12:48:15.053
      Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

      Date: 2017-01-23 12:48:15.044
      Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

      Date: 2017-01-23 12:48:15.014
      Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

      Date: 2017-01-23 12:48:15.005
      Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.


    ==================== Memory info =========================== 

    Processor: AMD A10-5750M APU with Radeon(tm) HD Graphics 
    Percentage of memory in use: 35%
    Total physical RAM: 7386.27 MB
    Available physical RAM: 4780.26 MB
    Total Virtual: 7898.27 MB
    Available Virtual: 5095.36 MB

    ==================== Drives ================================

    Drive c: (Windows) (Fixed) (Total:672.85 GB) (Free:570.63 GB) NTFS ==>[system with boot components (obtained from drive)]
    Drive d: (RECOVERY) (Fixed) (Total:23.83 GB) (Free:2.35 GB) NTFS ==>[system with boot components (obtained from drive)]

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (Size: 698.6 GB) (Disk ID: C26F4193)

    Partition: GPT.

    ==================== End of Addition.txt ============================

     

     

     

    Very slow, CPU maxxed, and mouse locks up

    in Resolved Malware Removal Logs

    Posted

    Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 15-03-2017
    Ran by Roland (administrator) on ROLAND-PC (30-03-2017 14:21:53)
    Running from C:\Users\Roland\Desktop
    Loaded Profiles: Roland (Available Profiles: Roland)
    Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
    Internet Explorer Version 11 (Default browser: Chrome)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (Stardock Corporation) C:\Program Files\Dell\DellDock\DockLogin.exe
    (SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
    (SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE
    (SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
    (SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
    (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
    (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
    (SoftThinks SAS) C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe
    (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.32.7\GoogleCrashHandler.exe
    (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.32.7\GoogleCrashHandler64.exe
    (Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
    (Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    (IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
    (Intel Corporation) C:\Windows\System32\igfxtray.exe
    (SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe
    (Intel Corporation) C:\Windows\System32\igfxsrvc.exe
    (TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
    (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    () C:\Program Files (x86)\Dell DataSafe Local Backup\Components\scheduler\STService.exe
    (Intel Corporation) C:\Windows\System32\hkcmd.exe
    (SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe
    (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
    (Intel Corporation) C:\Windows\System32\igfxpers.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
    (Microsoft Corporation) C:\Program Files\Microsoft IntelliType Pro\itype.exe
    (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    (Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
    (Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Microsoft Corporation) C:\Windows\System32\dllhost.exe
    (Microsoft Corporation) C:\Windows\System32\dllhost.exe
    (Microsoft Corporation) C:\Windows\System32\dllhost.exe

    ==================== Registry (Whitelisted) ====================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1808680 2009-06-25] (Synaptics Incorporated)
    HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [444416 2009-06-29] (IDT, Inc.)
    HKLM\...\Run: [itype] => c:\Program Files\Microsoft IntelliType Pro\itype.exe [1873256 2011-08-10] (Microsoft Corporation)
    HKLM-x32\...\Run: [FUFAXSTM] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe [847872 2009-12-03] (SEIKO EPSON CORPORATION)
    Winlogon\Notify\GoToAssist: 
    Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
    HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\Run: [EPSON Artisan 830 Series] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGXA.EXE [224768 2010-01-12] (SEIKO EPSON CORPORATION)
    Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk [2009-09-23]
    ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
    Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk [2009-09-23]
    ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
    BootExecute: 

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
    Tcpip\..\Interfaces\{D106EC69-996A-405C-BFA0-2F6611237F58}: [DhcpNameServer] 192.168.0.1
    Tcpip\..\Interfaces\{FEC7D3F0-8222-44DB-A6F2-AA3C2578E80A}: [DhcpNameServer] 192.168.0.1

    Internet Explorer:
    ==================
    HKU\S-1-5-21-3236689562-672039265-411895171-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
    HKU\S-1-5-21-3236689562-672039265-411895171-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp
    SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
    SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
    BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_121\bin\ssv.dll [2017-02-22] (Oracle Corporation)
    BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
    BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-29] (Google Inc.)
    BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-02-22] (Oracle Corporation)
    BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\ssv.dll [2017-02-22] (Oracle Corporation)
    BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
    BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-29] (Google Inc.)
    BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-02-22] (Oracle Corporation)
    DPF: HKLM-x32 {50647AB5-18FD-4142-82B0-5852478DD0D5} hxxp://webeffective.keynote.com/applications/pconnector/download/ConnectorLauncher.cab

    FireFox:
    ========
    FF ProfilePath: C:\Users\Roland\AppData\Roaming\TomTom\HOME\Profiles\phu6xfhq.default [2014-06-23]
    FF Extension: (Map status indicator) - C:\Program Files (x86)\TomTom HOME 2\xul\extensions\MapShare-status@tomtom.com [2012-03-02] [not signed]
    FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
    FF Extension: (HP Smart Web Printing) - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011-01-03] [not signed]
    FF HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
    FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_25_0_0_127.dll [2017-03-20] ()
    FF Plugin: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-02-22] (Oracle Corporation)
    FF Plugin: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-02-22] (Oracle Corporation)
    FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
    FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_25_0_0_127.dll [2017-03-20] ()
    FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2015-08-26] (Google, Inc.)
    FF Plugin-x32: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-02-22] (Oracle Corporation)
    FF Plugin-x32: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-02-22] (Oracle Corporation)
    FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
    FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-16] (Google Inc.)
    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-16] (Google Inc.)
    FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-12-23] (Adobe Systems Inc.)
    FF Plugin HKU\S-1-5-21-3236689562-672039265-411895171-1000: @citrixonline.com/appdetectorplugin -> C:\Users\Roland\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2014-07-21] (Citrix Online)

    Chrome: 
    =======
    CHR HomePage: Default -> bing.com/?pc=__PARAM__
    CHR DefaultSearchURL: Default -> hxxp://www.bing.com/search?FORM=__PARAM__DF&PC=__PARAM__&q={searchTerms}
    CHR DefaultSearchKeyword: Default -> bing.com
    CHR DefaultSuggestURL: Default -> hxxp://www.bing.com/osjson.aspx?FORM=__PARAM__DF&PC=__PARAM__&query={searchTerms}
    CHR Profile: C:\Users\Roland\AppData\Local\Google\Chrome\User Data\Default [2017-03-30]
    CHR Extension: (Bing) - C:\Users\Roland\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfedoihopcjdfjihhhojdclnfdgomdho [2017-03-29]
    CHR Extension: (Chrome Web Store Payments) - C:\Users\Roland\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-19]
    CHR HKU\S-1-5-21-3236689562-672039265-411895171-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nfedoihopcjdfjihhhojdclnfdgomdho] - hxxps://clients2.google.com/service/update2/crx
    CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx

    ==================== Services (Whitelisted) ====================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    S4 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
    R2 DockLoginService; C:\Program Files\Dell\DellDock\DockLogin.exe [155648 2008-12-18] (Stardock Corporation) [File not signed]
    R3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-23] (Hewlett-Packard Co.) [File not signed]
    R2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-23] (Hewlett-Packard Co.) [File not signed]
    R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1039360 2010-10-22] (Hewlett-Packard Co.) [File not signed]
    S4 lxdb_device; C:\Windows\system32\lxdbcoms.exe [566192 2007-02-02] ( )
    S4 lxdb_device; C:\Windows\SysWOW64\lxdbcoms.exe [537520 2007-02-02] ( )
    S3 MSSQL$MSSMLBIZ; c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
    S2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
    S2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
    S4 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\STacSV64.exe [240128 2009-06-29] (IDT, Inc.)

    ===================== Drivers (Whitelisted) ======================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    S2 BrPar; C:\Windows\SysWOW64\drivers\BrPar.sys [19537 2000-07-24] (Brother Industries Ltd.) [File not signed]
    R1 ElRawDisk; C:\Windows\system32\drivers\ElRawDsk.sys [31432 2012-04-17] (EldoS Corporation)
    S3 FlyUsb; C:\Windows\System32\DRIVERS\FlyUsb.sys [24576 2009-11-10] (LeapFrog)
    S3 sdcfilter; C:\Windows\System32\DRIVERS\sdcfilter.sys [38144 2016-04-17] (Sophos Limited)
    R2 sntp; C:\Windows\System32\DRIVERS\sntp.sys [116144 2016-04-16] (Sophos Limited)
    S3 ssmirrdr; C:\Windows\System32\DRIVERS\ssmirrdr.sys [10112 2011-03-15] (support.com, Inc)
    U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [35064 2015-05-28] ()
    U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-13] (Microsoft Corporation)
    R3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()
    S1 ZAM; \??\C:\Windows\System32\drivers\zam64.sys [X]
    R1 ZAM_Guard; \??\C:\Windows\System32\drivers\zamguard64.sys [X]

    ==================== NetSvcs (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    ==================== One Month Created files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2017-03-30 14:21 - 2017-03-30 14:22 - 00014630 _____ C:\Users\Roland\Desktop\FRST.txt
    2017-03-30 05:34 - 2017-03-30 05:34 - 00985054 _____ C:\Users\Roland\Desktop\EFRCSetup.exe
    2017-03-30 05:34 - 2017-03-30 05:34 - 00001055 _____ C:\Users\Roland\Desktop\Eusing Free Registry Cleaner.lnk
    2017-03-30 05:34 - 2017-03-30 05:34 - 00000000 ____D C:\Users\Roland\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Free Registry Cleaner
    2017-03-30 05:34 - 2017-03-30 05:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Registry Cleaner
    2017-03-30 05:34 - 2017-03-30 05:34 - 00000000 ____D C:\Program Files (x86)\Eusing Free Registry Cleaner
    2017-03-29 14:51 - 2017-03-29 14:51 - 00002046 _____ C:\FixitRegBackup.reg
    2017-03-29 05:35 - 2017-03-30 14:21 - 00035161 _____ C:\Windows\ZAM_Guard.krnl.trace
    2017-03-29 05:35 - 2017-03-30 05:37 - 00046041 _____ C:\Windows\ZAM.krnl.trace
    2017-03-29 05:28 - 2017-03-29 05:29 - 08545968 _____ (AVAST Software) C:\Users\Roland\Desktop\avastclear.exe
    2017-03-28 15:23 - 2017-03-28 15:23 - 00000408 _____ C:\Scan_170328-152228.txt
    2017-03-28 15:09 - 2017-03-28 15:09 - 00000000 ____D C:\ProgramData\Emsisoft
    2017-03-28 14:58 - 2017-03-28 15:23 - 00000000 ____D C:\EEK
    2017-03-28 14:50 - 2017-03-28 14:55 - 288977232 _____ C:\Users\Roland\Desktop\EmsisoftEmergencyKit.exe
    2017-03-28 14:34 - 2017-03-28 14:34 - 01663904 _____ (Malwarebytes) C:\Users\Roland\Desktop\JRT.exe
    2017-03-28 14:33 - 2017-03-28 14:33 - 04089296 _____ C:\Users\Roland\Desktop\adwcleaner_6.045.exe
    2017-03-27 16:16 - 2017-03-27 16:16 - 00000000 ____D C:\Users\Roland\Desktop\geek
    2017-03-27 16:00 - 2017-03-27 16:27 - 00000000 ____D C:\Users\Roland\AppData\Roaming\Geek Uninstaller
    2017-03-27 14:29 - 2017-03-30 14:21 - 00000000 ____D C:\FRST
    2017-03-27 14:29 - 2017-03-27 14:29 - 02424832 _____ (Farbar) C:\Users\Roland\Desktop\FRST64.exe
    2017-03-25 07:14 - 2017-03-25 07:14 - 00000000 ____D C:\ProgramData\SWCUTemp
    2017-03-24 20:20 - 2017-03-24 20:20 - 02030536 _____ (Bleeping Computer, LLC) C:\Users\Roland\Downloads\rkill.exe
    2017-03-24 18:07 - 2017-03-24 18:07 - 00012872 _____ (SurfRight B.V.) C:\Windows\system32\bootdelete.exe
    2017-03-24 17:37 - 2017-03-24 17:37 - 00079086 _____ C:\Windows\system32\.crusader
    2017-03-24 17:20 - 2017-03-30 05:37 - 00000000 ____D C:\Users\Roland\AppData\Local\Zemana
    2017-03-24 17:19 - 2017-03-24 17:20 - 05763056 _____ (Zemana Ltd. ) C:\Users\Roland\Downloads\Zemana.AntiMalware.Setup.exe
    2017-03-24 17:17 - 2017-03-24 17:18 - 11581544 _____ (SurfRight B.V.) C:\Users\Roland\Downloads\HitmanPro_x64.exe
    2017-03-24 17:14 - 2017-03-28 14:42 - 00000000 ____D C:\AdwCleaner
    2017-03-24 17:14 - 2017-03-24 17:14 - 04031440 _____ C:\Users\Roland\Downloads\adwcleaner_6.044.exe
    2017-03-24 17:13 - 2017-03-24 17:13 - 00000000 ____D C:\Program Files\Malwarebytes
    2017-03-24 17:12 - 2017-03-24 17:13 - 57131432 _____ (Malwarebytes ) C:\Users\Roland\Downloads\mb3-setup-consumer-3.0.6.1469-1075.exe
    2017-03-24 11:38 - 2017-03-24 11:38 - 00000000 ____D C:\Users\Roland\AppData\Roaming\Eusing
    2017-03-24 11:26 - 2017-03-25 07:10 - 00007605 _____ C:\Users\Roland\AppData\Local\resmon.resmoncfg
    2017-03-24 11:06 - 2017-03-24 11:06 - 00002794 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
    2017-03-24 11:06 - 2017-03-24 11:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
    2017-03-24 11:06 - 2017-03-24 11:06 - 00000000 ____D C:\Program Files\CCleaner
    2017-03-20 20:54 - 2017-02-22 22:59 - 00453720 _____ C:\Windows\system32\Drivers\etc\hosts.20170320-205400.backup
    2017-03-19 21:40 - 2017-03-19 21:40 - 00044952 _____ () C:\Windows\system32\Drivers\staport.sys
    2017-03-09 19:44 - 2017-03-10 16:46 - 00000000 ____D C:\Users\Roland\AppData\Local\Glance
    2017-03-09 15:35 - 2017-03-19 21:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TurboTax 2016

    ==================== One Month Modified files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2017-03-30 07:45 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\inf
    2017-03-30 05:37 - 2009-07-14 00:45 - 00014240 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2017-03-30 05:37 - 2009-07-14 00:45 - 00014240 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2017-03-30 05:35 - 2010-10-02 08:07 - 00000000 ____D C:\ProgramData\Malwarebytes
    2017-03-30 05:28 - 2009-11-13 22:18 - 00000000 ____D C:\Users\Roland\AppData\Local\SoftThinks
    2017-03-30 05:28 - 2009-11-13 22:18 - 00000000 ____D C:\Users\Default\AppData\Local\SoftThinks
    2017-03-30 05:28 - 2009-11-13 22:18 - 00000000 ____D C:\Users\Default User\AppData\Local\SoftThinks
    2017-03-30 05:28 - 2009-09-23 17:33 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup
    2017-03-30 05:28 - 2009-07-14 01:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
    2017-03-29 18:23 - 2009-11-13 20:13 - 00000000 ____D C:\Users\Roland
    2017-03-29 14:54 - 2015-12-10 17:04 - 00000000 ____D C:\Windows\System32\Tasks\AVAST Software
    2017-03-28 15:26 - 2009-12-02 20:43 - 00000000 ____D C:\Windows\Minidump
    2017-03-28 14:44 - 2009-11-20 22:26 - 00000000 ____D C:\Program Files (x86)\PC Drivers HeadQuarters
    2017-03-27 17:48 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\system32\NDF
    2017-03-27 17:21 - 2009-11-17 11:02 - 00000000 ____D C:\ProgramData\FINPACK
    2017-03-27 17:21 - 2009-11-17 11:02 - 00000000 ____D C:\Program Files (x86)\FINPACK
    2017-03-27 16:09 - 2014-11-02 04:44 - 00000000 ____D C:\Users\Roland\Desktop\cyber sec
    2017-03-27 15:49 - 2009-11-13 22:29 - 00000000 ___SD C:\Users\Roland\AppData\LocalLow\Temp
    2017-03-26 19:48 - 2016-11-16 16:43 - 00000000 ____D C:\Users\Roland\Desktop\Web Stuff
    2017-03-26 19:43 - 2009-11-15 18:45 - 00000000 ____D C:\Users\Roland\Documents\2 Fm Decions Current
    2017-03-26 19:36 - 2009-07-14 01:13 - 00803678 _____ C:\Windows\system32\PerfStringBackup.INI
    2017-03-24 20:14 - 2012-12-25 21:16 - 00000000 ____D C:\Users\Roland\AppData\Local\CrashDumps
    2017-03-24 17:38 - 2013-04-25 09:04 - 00000000 ____D C:\Program Files (x86)\iolo
    2017-03-24 17:37 - 2011-01-03 21:35 - 00000000 ____D C:\Program Files (x86)\Yahoo!
    2017-03-24 17:31 - 2013-04-25 09:05 - 00000000 ____D C:\ProgramData\iolo
    2017-03-21 14:31 - 2012-10-12 14:38 - 00000000 ____D C:\Users\Roland\AppData\Local\ElevatedDiagnostics
    2017-03-21 12:25 - 2014-12-27 23:08 - 00000000 ____D C:\Users\Roland\Desktop\Pics 12 14
    2017-03-21 12:22 - 2017-02-09 21:01 - 00000000 ____D C:\Users\Roland\Desktop\217 AGO
    2017-03-21 11:59 - 2012-02-12 20:15 - 00000000 ____D C:\Users\Roland\Desktop\Unused Ikons
    2017-03-20 21:04 - 2013-09-14 09:46 - 00004312 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
    2017-03-20 21:04 - 2012-03-28 21:26 - 00802904 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
    2017-03-20 21:04 - 2011-11-11 14:59 - 00000000 ____D C:\Windows\system32\Macromed
    2017-03-20 21:04 - 2011-06-03 20:27 - 00144472 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
    2017-03-20 21:04 - 2009-09-23 17:25 - 00000000 ____D C:\Windows\SysWOW64\Macromed
    2017-03-20 20:54 - 2009-07-13 22:34 - 00454268 ____R C:\Windows\system32\Drivers\etc\hosts.20170324-134951.backup
    2017-03-20 19:31 - 2016-01-22 13:50 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
    2017-03-19 21:46 - 2010-12-16 22:40 - 00002269 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
    2017-03-19 21:46 - 2010-12-16 22:40 - 00002257 _____ C:\Users\Public\Desktop\Google Chrome.lnk
    2017-03-19 21:36 - 2009-11-13 20:13 - 00112616 _____ C:\Users\Roland\AppData\Local\GDIPFONTCACHEV1.DAT
    2017-03-19 21:31 - 2017-01-26 16:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
    2017-03-19 21:31 - 2014-01-06 15:40 - 00000000 ____D C:\Program Files\UVK - Ultra Virus Killer
    2017-03-19 21:31 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\AppCompat
    2017-03-19 21:29 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\registration
    2017-03-19 21:26 - 2016-01-05 12:35 - 00000000 ____D C:\Users\Roland\AppData\Roaming\Intuit
    2017-03-18 19:25 - 2012-10-12 15:05 - 00000000 ____D C:\temp
    2017-03-15 20:46 - 2016-10-27 20:52 - 00000000 ____D C:\Users\Roland\Desktop\Email Stuff
    2017-03-14 17:24 - 2013-12-13 21:13 - 00000000 ____D C:\Users\Roland\Desktop\Ishler feed prices
    2017-03-10 22:27 - 2016-01-05 12:41 - 00000000 ____D C:\Users\Roland\Documents\TurboTax
    2017-03-09 15:46 - 2014-11-02 04:40 - 00000000 ____D C:\Users\Roland\Desktop\friends
    2017-03-09 15:37 - 2016-01-05 12:33 - 00000629 _____ C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc

    ==================== Files in the root of some directories =======

    2014-05-21 15:58 - 2014-05-21 15:58 - 0000268 ___RH () C:\Users\Roland\AppData\Roaming\Smooth Strings
    2014-05-21 15:59 - 2014-05-21 15:59 - 0000268 ___RH () C:\Users\Roland\AppData\Roaming\Solid Colors
    2014-05-21 15:58 - 2014-05-21 15:58 - 0000268 ___RH () C:\Users\Roland\AppData\Roaming\Sound Effects
    2014-05-21 15:57 - 2014-05-21 15:57 - 0000268 ___RH () C:\Users\Roland\AppData\Roaming\Static Library
    2017-03-24 11:26 - 2017-03-25 07:10 - 0007605 _____ () C:\Users\Roland\AppData\Local\resmon.resmoncfg
    2013-04-23 21:48 - 2013-04-23 21:48 - 2250054 _____ () C:\ProgramData\1.bmp
    2013-04-23 21:47 - 2013-04-23 21:47 - 0302806 _____ () C:\ProgramData\1.jpg
    2011-01-03 21:26 - 2011-01-03 21:38 - 0000802 _____ () C:\ProgramData\hpzinstall.log
    2016-01-05 12:33 - 2017-03-09 15:37 - 0000629 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
    2014-05-21 15:57 - 2014-05-21 15:57 - 0000020 ____H () C:\ProgramData\PKP_DLeo.DAT
    2014-05-21 15:59 - 2014-05-21 15:59 - 0000020 ____H () C:\ProgramData\PKP_DLes.DAT
    2014-05-21 15:58 - 2014-05-23 11:55 - 0000020 ____H () C:\ProgramData\PKP_DLet.DAT
    2014-05-21 15:58 - 2014-05-21 15:58 - 0000020 ____H () C:\ProgramData\PKP_DLev.DAT
    2014-05-21 15:58 - 2014-05-21 15:58 - 0000268 ___RH () C:\ProgramData\Soundtrack
    2014-05-21 15:59 - 2014-05-21 15:59 - 0000268 ___RH () C:\ProgramData\Space Choir
    2014-05-21 15:58 - 2014-05-21 15:58 - 0000268 ___RH () C:\ProgramData\Spacious
    2014-05-21 15:57 - 2014-05-21 15:57 - 0000268 ___RH () C:\ProgramData\String Ensemble
    2012-10-12 17:31 - 2012-10-12 19:46 - 0028232 _____ () C:\ProgramData\xportnchk.ini

    Some files in TEMP:
    ====================
    2017-03-30 05:34 - 2017-03-30 05:34 - 3957784 _____ (Geek Unіnstaller) C:\Users\Roland\AppData\Local\Temp\geek64.exe
    2017-03-30 05:36 - 2017-03-24 17:18 - 11581544 _____ (SurfRight B.V.) C:\Users\Roland\AppData\Local\Temp\HitmanPro.exe

    ==================== Bamital & volsnap ======================

    (There is no automatic fix for files that do not pass verification.)

    C:\Windows\system32\winlogon.exe => File is digitally signed
    C:\Windows\system32\wininit.exe => File is digitally signed
    C:\Windows\SysWOW64\wininit.exe => File is digitally signed
    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\SysWOW64\explorer.exe => File is digitally signed
    C:\Windows\system32\svchost.exe => File is digitally signed
    C:\Windows\SysWOW64\svchost.exe => File is digitally signed
    C:\Windows\system32\services.exe => File is digitally signed
    C:\Windows\system32\User32.dll => File is digitally signed
    C:\Windows\SysWOW64\User32.dll => File is digitally signed
    C:\Windows\system32\userinit.exe => File is digitally signed
    C:\Windows\SysWOW64\userinit.exe => File is digitally signed
    C:\Windows\system32\rpcss.dll => File is digitally signed
    C:\Windows\system32\dnsapi.dll => File is digitally signed
    C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
    C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

    LastRegBack: 2017-03-20 22:23

    ==================== End of FRST.txt ============================

     

    Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-03-2017
    Ran by Roland (30-03-2017 14:22:46)
    Running from C:\Users\Roland\Desktop
    Windows 7 Home Premium Service Pack 1 (X64) (2009-11-14 00:13:43)
    Boot Mode: Normal
    ==========================================================


    ==================== Accounts: =============================

    Administrator (S-1-5-21-3236689562-672039265-411895171-500 - Administrator - Disabled)
    Guest (S-1-5-21-3236689562-672039265-411895171-501 - Limited - Disabled)
    HomeGroupUser$ (S-1-5-21-3236689562-672039265-411895171-1002 - Limited - Enabled)
    Roland (S-1-5-21-3236689562-672039265-411895171-1000 - Administrator - Enabled) => C:\Users\Roland
    SophosSAUROLAND-PC0 (S-1-5-21-3236689562-672039265-411895171-1006 - Limited - Enabled)

    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: Norton Security Suite (Enabled - Up to date) {63DF5164-9100-186D-2187-8DC619EFD8BF}
    AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AS: Norton Security Suite (Enabled - Up to date) {D8BEB080-B73A-17E3-1B37-B6B462689202}
    FW: Norton Security Suite (Enabled) {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

    ==================== Installed Programs ======================

    (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    470_Help (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
    470_Readme (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
    64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
    7-Zip 15.12 (HKLM-x32\...\{23170F69-40C1-2701-1512-000001000000}) (Version: 15.12.00.0 - Igor Pavlov)
    7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )
    ABBYY FineReader 9.0 Sprint (HKLM-x32\...\ABBYY FineReader 9.0 Sprint) (Version: 9.01.513.58212 - ABBYY)
    ABBYY FineReader 9.0 Sprint (x32 Version: 9.01.513.58212 - ABBYY) Hidden
    Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.023.20070 - Adobe Systems Incorporated)
    Adobe Flash Player 25 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 25.0.0.127 - Adobe Systems Incorporated)
    Adobe Flash Player 25 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 25.0.0.127 - Adobe Systems Incorporated)
    Advanced Audio FX Engine (HKLM-x32\...\Advanced Audio FX Engine) (Version: 1.12.05 - Creative Technology Ltd)
    BPDSoftware (x32 Version: 130.0.000.000 - Hewlett-Packard) Hidden
    BPDSoftware_Ini (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
    Brother HL-5040 (HKLM-x32\...\Brother HL-5040) (Version:  - )
    BufferChm (x32 Version: 130.0.331.000 - Hewlett-Packard) Hidden
    Business Contact Manager for Outlook 2007 SP2 (HKLM-x32\...\Business Contact Manager) (Version: 3.0.8619.1 - Microsoft Corporation)
    Business Contact Manager for Outlook 2007 SP2 (x32 Version: 3.0.8619.1 - Microsoft Corporation) Hidden
    CCleaner (HKLM\...\CCleaner) (Version: 5.28 - Piriform)
    Citrix Online Launcher (HKLM-x32\...\{3E7E6F1E-7376-475A-8BC9-E3126B20CF5F}) (Version: 1.0.198 - Citrix)
    D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
    Dell DataSafe Local Backup - Support Software (HKLM-x32\...\{A9668246-FB70-4103-A1E3-66C9BC2EFB49}) (Version: 9.4.60 - Dell)
    Dell DataSafe Local Backup (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 9.4.60 - Dell)
    Dell Dock (HKLM\...\{E60B7350-EA5F-41E0-9D6F-E508781E36D2}) (Version: 2.0.0 - Dell)
    Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)
    Dell Getting Started Guide (HKLM-x32\...\{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}) (Version: 1.00.0000 - Dell Inc.)
    Dell Support Center (Support Software) (HKLM-x32\...\{E3BFEE55-39E2-4BE0-B966-89FE583822C1}) (Version: 2.5.09100 - Dell)
    Dell Touchpad (HKLM\...\SynTPDeinstKey) (Version: 13.2.3.0 - Synaptics Incorporated)
    Dell Webcam Central (HKLM-x32\...\Dell Webcam Central) (Version: 1.40.05 - Creative Technology Ltd)
    DeviceDiscovery (x32 Version: 130.0.465.000 - Hewlett-Packard) Hidden
    EPSON Artisan 810 Series Printer Uninstall (HKLM\...\EPSON Artisan 810 Series) (Version:  - SEIKO EPSON Corporation)
    EPSON Artisan 830 Series Printer Uninstall (HKLM\...\EPSON Artisan 830 Series) (Version:  - SEIKO EPSON Corporation)
    Epson Event Manager (HKLM-x32\...\{03B8AA32-F23C-4178-B8E6-09ECD07EAA47}) (Version: 2.40.0001 - SEIKO EPSON CORPORATION)
    Epson FAX Utility (HKLM-x32\...\{0CBE6C93-CB2E-4378-91EE-12BE6D4E2E4A}) (Version: 1.10.00 - SEIKO EPSON CORPORATION)
    Epson Print CD (HKLM-x32\...\{D16A31F9-276D-4968-A753-FFEAC56995D0}) (Version: 2.00.00 - SEIKO EPSON CORPORATION)
    EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)
    EpsonNet Setup 3.2 (HKLM-x32\...\{C9D8A041-2963-4B31-8FFC-1500F3DB9293}) (Version: 3.2a - SEIKO EPSON CORPORATION)
    Eusing Free Registry Cleaner (HKLM-x32\...\Eusing Free Registry Cleaner) (Version:  - Eusing Software)
    FINPACK (HKLM-x32\...\FINPACK) (Version:  - )
    Google Chrome (HKLM-x32\...\Google Chrome) (Version: 57.0.2987.110 - Google Inc.)
    Google Earth (HKLM-x32\...\{F6430171-B86B-4639-839E-374913E7911D}) (Version: 7.1.8.3036 - Google)
    Google Earth Pro (HKLM-x32\...\{35DAA04C-1720-4BE3-A920-A03731EC6A1D}) (Version: 7.1.5.1557 - Google)
    Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.8231.2252 - Google Inc.)
    Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
    Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
    Google Update Helper (x32 Version: 1.3.32.7 - Google Inc.) Hidden
    Google+ Auto Backup (HKLM-x32\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google)
    GoToAssist 8.0.0.514 (HKLM-x32\...\GoToAssist) (Version:  - )
    GPBaseService2 (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
    H470 (x32 Version: 130.0.000.000 - Hewlett-Packard) Hidden
    HP Customer Participation Program 13.0 (HKLM\...\HPExtendedCapabilities) (Version: 13.0 - HP)
    HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP)
    HP OfficeJet H470 (HKLM\...\{2B71BB94-F52C-4EF2-85E8-45E63296EDF2}) (Version: 13.0 - HP)
    HP Smart Web Printing 4.51 (HKLM\...\HP Smart Web Printing) (Version: 4.51 - HP)
    HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
    HP Update (HKLM-x32\...\{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}) (Version: 5.003.001.001 - Hewlett-Packard)
    HPDiagnosticAlert (x32 Version: 1.00.0000 - Microsoft) Hidden
    HPProductAssistant (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
    HPSSupply (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
    Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version:  - Intel Corporation)
    Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.5.0.1029 - Intel Corporation)
    Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
    Java 8 Update 121 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180121F0}) (Version: 8.0.1210.13 - Oracle Corporation)
    Java 8 Update 121 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180121F0}) (Version: 8.0.1210.13 - Oracle Corporation)
    Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    LeapFrog Connect (HKLM-x32\...\UPCShell) (Version: 2.3.11.8936 - LeapFrog)
    LeapFrog Connect (x32 Version: 2.3.11.8936 - LeapFrog) Hidden
    LeapFrog Tag Plugin (x32 Version: 2.3.11.8936 - LeapFrog) Hidden
    Lexmark 840 Series (HKLM\...\Lexmark 840 Series) (Version:  - Lexmark International, Inc.)
    Live! Cam Avatar Creator (HKLM-x32\...\{65D0C510-D7B6-4438-9FC8-E6B91115AB0D}) (Version: 4.6.3009.1 - Creative Technology Ltd)
    MarketResearch (x32 Version: 130.0.374.000 - Hewlett-Packard) Hidden
    Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
    Microsoft IntelliType Pro 8.2 (HKLM\...\Microsoft IntelliType Pro 8.2) (Version: 8.20.469.0 - Microsoft Corporation)
    Microsoft Office 2003 Web Components (HKLM-x32\...\{90A40409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
    Microsoft Office 2007 Primary Interop Assemblies (HKLM-x32\...\{50120000-1105-0000-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
    Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-0014-0000-0000-0000000FF1CE}_PROR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
    Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
    Microsoft Office Accounting 2008 (HKLM-x32\...\Microsoft Office Accounting 2008) (Version: 3.0.8627.1 - Microsoft Corporation)
    Microsoft Office Accounting 2008 Equifax Addin (HKLM-x32\...\{0C2AF762-0565-4C91-9F55-B8B53BB82A38}) (Version: 3.0.8231.0 - Microsoft Corporation)
    Microsoft Office Accounting 2008 Fixed Asset Manager (HKLM-x32\...\{E3DF6916-2472-43D9-8B3C-9F2F0AAB01B5}) (Version: 3.0.8231.0 - Microsoft Corporation)
    Microsoft Office Accounting 2008 PayPal Addin (HKLM-x32\...\{B391EECE-DFEA-4FC5-9D40-47FA43E2DBE6}) (Version: 3.0.8231.0 - Microsoft Corporation)
    Microsoft Office Accounting ADP Payroll Addin (HKLM-x32\...\{5FA793A6-0071-42C1-9355-8F69A428C44F}) (Version: 0.0.0.0 - ADP)
    Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
    Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
    Microsoft Office Professional 2007 (HKLM-x32\...\PROR) (Version: 12.0.6612.1000 - Microsoft Corporation)
    Microsoft Office Small Business Connectivity Components (HKLM-x32\...\{A939D341-5A04-4E0A-BB55-3E65B386432D}) (Version: 2.0.7024.0 - Microsoft Corporation)
    Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs (HKLM-x32\...\{90120000-00B2-0409-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
    Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50428.0 - Microsoft Corporation)
    Microsoft SQL Server 2005 (HKLM-x32\...\Microsoft SQL Server 2005) (Version:  - Microsoft Corporation)
    Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
    Microsoft SQL Server Native Client (HKLM\...\{9ACF3FDB-C8E6-444C-8C64-13A221F7BFFD}) (Version: 9.00.5000.00 - Microsoft Corporation)
    Microsoft SQL Server Setup Support Files (English) (HKLM-x32\...\{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}) (Version: 9.00.5000.00 - Microsoft Corporation)
    Microsoft SQL Server VSS Writer (HKLM\...\{B636C9B9-A3F2-4DCE-ADCC-72E095018385}) (Version: 9.00.5000.00 - Microsoft Corporation)
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable - KB2467175 (HKLM-x32\...\{a0fe116e-9a8a-466f-aee0-625cb7c207e3}) (Version: 8.0.51011 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{052bac4a-6f79-46d4-a024-1ce1b4f73cd4}) (Version: 8.0.58299 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{820B6609-4C97-3A2B-B644-573B06A0F0CC}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Works 6-9 Converter (HKLM-x32\...\{95140000-0137-0409-0000-0000000FF1CE}) (Version: 14.0.6120.5002 - Microsoft Corporation)
    MPM (HKLM-x32\...\{00772F8B-37FF-4704-A47D-72B30BFAF126}) (Version: 1.00.0000 - Hewlett-Packard)
    Network64 (Version: 130.0.579.000 - Hewlett-Packard) Hidden
    Network64 (Version: 140.0.221.000 - Hewlett-Packard) Hidden
    Nikon Message Center 2 (HKLM-x32\...\{B014EE44-9197-4513-9613-71E6EB1B514E}) (Version: 2.1.0 - Nikon)
    Nikon Movie Editor (HKLM-x32\...\{5CAD3393-EEC0-44CE-9F93-BCAA365B77FB}) (Version: 2.6.0 - Nikon)
    Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9.140.248 - Google, Inc.)
    Picture Control Utility x64 (HKLM\...\{11953C65-BB4E-4CA4-B0F0-2600A4B20040}) (Version: 1.4.7 - Nikon)
    PowerDVD DX (HKLM-x32\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 8.3.5424 - CyberLink Corp.)
    ProductContext (x32 Version: 130.0.000.000 - Hewlett-Packard) Hidden
    Quickset64 (HKLM\...\{87CF757E-C1F1-4D22-865C-00C6950B5258}) (Version: 9.6.6 - Dell Inc.)
    Reliable IT repair tool (HKLM\...\UVK - Ultra virus killer) (Version: 5.9.0.1 - Reliable IT)
    Roxio Burn (HKLM-x32\...\{B2E47DE7-800B-40BB-BD1F-9F221C3AEE87}) (Version: 1.0 - Roxio)
    Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 13.0 - HP)
    SmartWebPrinting (x32 Version: 130.0.457.000 - Hewlett-Packard) Hidden
    SolutionCenter (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
    Status (x32 Version: 130.0.469.000 - Hewlett-Packard) Hidden
    TomTom HOME 2.8.3.2499 (HKLM-x32\...\TomTom HOME) (Version: 2.8.3.2499 - TomTom)
    TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
    Toolbox (x32 Version: 130.0.648.000 - Hewlett-Packard) Hidden
    TrayApp (x32 Version: 130.0.422.000 - Hewlett-Packard) Hidden
    TurboTax 2015 (HKLM-x32\...\TurboTax 2015) (Version: 2015.0 - Intuit, Inc)
    Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-0014-0000-0000-0000000FF1CE}_PROR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
    Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
    Use the entry named LeapFrog Connect to uninstall (LeapFrog Tag Plugin) (HKLM-x32\...\TagPlugin) (Version: 2.3.11.8936 - LeapFrog)
    ViewNX 2 (HKLM\...\{635BE602-BB9C-4C59-8CC5-93F9366E8A21}) (Version: 2.6.0 - Nikon)
    WebEx (HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\ActiveTouchMeetingClient) (Version:  - Cisco WebEx LLC)
    WebReg (x32 Version: 130.0.132.017 - Hewlett-Packard) Hidden
    Windows Driver Package - LeapFrog (FlyUsb) USB  (11/05/2008 1.1.1.0) (HKLM\...\781745E87AFF80C0C1388CFF79D19ECAB2E9BB47) (Version: 11/05/2008 1.1.1.0 - LeapFrog)
    Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
    Windows Live Sync (HKLM-x32\...\{FDD810CA-D5E3-40E9-AB7B-36440B0D41EF}) (Version: 14.0.8050.1202 - Microsoft Corporation)

    ==================== Custom CLSID (Whitelisted): ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    ==================== Scheduled Tasks (Whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    Task: {000E6622-8E66-4CB8-BB22-0F4F4C9CAD71} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)
    Task: {0726F637-A340-47AC-8B8F-6087BA8A0E2C} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-03-20] (Adobe Systems Incorporated)
    Task: {15832EAB-161B-4C8A-96A7-11300F4C614B} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2017-03-03] (Piriform Ltd)
    Task: {20F7C2B2-27FE-45D5-9359-9EA921ECC318} - System32\Tasks\{B2F436F5-BB82-4B49-AA0E-CF73AB8ED396} => pcalua.exe -a C:\Users\Roland\Desktop\install_flash_player_9.exe -d C:\Users\Roland\Desktop
    Task: {2C4E3533-1253-41DD-A189-F2AE3C1BD123} - System32\Tasks\{0340C534-D0C2-4710-BD77-C5035BF28B2D} => C:\Program Files (x86)\iolo\Common\Lib\ioloLManager.exe 
    Task: {57946441-35E3-4F03-BB0D-B5F132F26294} - System32\Tasks\{911256C9-F921-4261-91B8-2BD6F6AD8D8C} => pcalua.exe -a D:\setup.exe -d D:\
    Task: {5F38FEEE-8C02-46AF-A131-3495F00C96DC} - System32\Tasks\{CE6D138D-5A2A-4319-8091-2DF841919D35} => C:\Program Files (x86)\iolo\Common\Lib\ioloLManager.exe 
    Task: {8796A92C-9213-47B3-838D-44229A147DA5} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)
    Task: {A6CEFA61-91CB-4C24-B433-ADFFFE59AC68} - System32\Tasks\{F1F36E3E-E697-479D-8DCD-598E6B1EAD20} => pcalua.exe -a "C:\Program Files (x86)\FINPACK\FINPACK.exe" -d "C:\Program Files (x86)\FINPACK"
    Task: {C067F5CD-BD7C-4EC2-86A8-B44B1938E709} - System32\Tasks\Microsoft_Hardware_Launch_IType_exe => c:\Program Files\Microsoft IntelliType Pro\IType.exe [2011-08-10] (Microsoft Corporation)
    Task: {C56D37B2-D883-47CE-BC6F-D066233631ED} - System32\Tasks\{47FBF903-CA97-4C8A-9129-AA1B50D7A5AB} => C:\Program Files (x86)\iolo\Common\Lib\ioloLManager.exe 
    Task: {DD3422B8-7429-47EF-99E6-189B5A044880} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-12-19] (Adobe Systems Incorporated)
    Task: {E49F9117-EAD7-49CF-888D-268FFDA38A82} - System32\Tasks\{F3743546-E375-4083-AA1F-907F3B6A7548} => C:\Program Files (x86)\iolo\Common\Lib\ioloLManager.exe 

    (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


    ==================== Shortcuts =============================

    (The entries could be listed to be restored or removed.)

    ==================== Loaded Modules (Whitelisted) ==============

    2009-09-23 17:34 - 2011-08-18 11:05 - 02751808 _____ () C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
    2017-03-19 21:46 - 2017-03-16 00:11 - 02885464 _____ () C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.110\libglesv2.dll
    2017-03-19 21:46 - 2017-03-16 00:11 - 00099672 _____ () C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.110\libegl.dll

    ==================== Alternate Data Streams (Whitelisted) =========

    (If an entry is included in the fixlist, only the ADS will be removed.)


    ==================== Safe Mode (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SAVService => ""="service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\GoToAssist => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SAVService => ""="service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SntpService => ""="service"

    ==================== Association (Whitelisted) ===============

    (If an entry is included in the fixlist, the registry item will be restored to default or removed.)


    ==================== Internet Explorer trusted/restricted ===============

    (If an entry is included in the fixlist, it will be removed from the registry.)

    IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
    IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
    IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
    IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
    IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
    IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
    IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
    IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
    IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
    IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
    IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
    IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
    IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
    IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
    IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
    IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
    IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
    IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
    IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
    IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

    There are 7933 more sites.

    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\007guard.com -> install.007guard.com
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\008i.com -> 008i.com
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\008k.com -> www.008k.com
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\00hq.com -> www.00hq.com
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\010402.com -> 010402.com
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\0scan.com -> www.0scan.com
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\1-2005-search.com -> www.1-2005-search.com
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\1-domains-registrations.com -> www.1-domains-registrations.com
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\1000gratisproben.com -> www.1000gratisproben.com
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\1001namen.com -> www.1001namen.com
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\100888290cs.com -> mir.100888290cs.com
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\100sexlinks.com -> www.100sexlinks.com
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\10sek.com -> www.10sek.com
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\12-26.net -> user1.12-26.net
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\12-27.net -> user1.12-27.net
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\123fporn.info -> www.123fporn.info
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\123moviedownload.com -> www.123moviedownload.com
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\123simsen.com -> www.123simsen.com

    There are 7933 more sites.


    ==================== Hosts content: ===============================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2017-03-27 18:21 - 2017-03-29 19:19 - 00000035 ____A C:\Windows\system32\Drivers\etc\hosts


    ==================== Other Areas ============================

    (Currently there is no automatic fix for this section.)

    HKU\S-1-5-21-3236689562-672039265-411895171-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Roland\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
    DNS Servers: 192.168.0.1
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
    Windows Firewall is enabled.

    ==================== MSCONFIG/TASK MANAGER disabled items ==

    MSCONFIG\startupreg: CCleaner Monitoring => "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
    MSCONFIG\startupreg: EEventManager => "C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe"
    MSCONFIG\startupreg: IAAnotif => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe
    MSCONFIG\startupreg: Malwarebytes TrayApp => 
    MSCONFIG\startupreg: Nikon Message Center 2 => C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe -s
    MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    MSCONFIG\startupreg: ZAM => "C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe" /minimized

    ==================== FirewallRules (Whitelisted) ===============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    FirewallRules: [{038284C9-21D7-4C57-B2CA-3129CA4F6DCB}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
    FirewallRules: [{F0D53FFF-117C-4CFC-B466-6444D4129286}] => (Allow) svchost.exe
    FirewallRules: [{690CD6B3-A821-4EE2-8E8B-7E19FB36832E}] => (Allow) C:\Program Files (x86)\Windows Live\Sync\WindowsLiveSync.exe
    FirewallRules: [{32867B3C-68D8-430C-8CE8-C97BDE04BD36}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD DX\PowerDVD.exe
    FirewallRules: [{181BC4D1-CF38-4CD8-8098-41602D3B2F18}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe
    FirewallRules: [TCP Query User{D28938A5-4200-4414-A6EB-7BA4AC3FCD04}C:\program files (x86)\internet explorer\iexplore.exe] => (Block) C:\program files (x86)\internet explorer\iexplore.exe
    FirewallRules: [UDP Query User{8E202954-8352-4CD4-894F-1BA42C4764C8}C:\program files (x86)\internet explorer\iexplore.exe] => (Block) C:\program files (x86)\internet explorer\iexplore.exe
    FirewallRules: [{F307F74A-05EB-40FC-8E92-93EB3ECF0991}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
    FirewallRules: [TCP Query User{59B3E3EE-53C5-4CF5-8606-E5F1128C9806}C:\program files (x86)\google\google earth\client\googleearth.exe] => (Allow) C:\program files (x86)\google\google earth\client\googleearth.exe
    FirewallRules: [UDP Query User{F0C51941-73EC-45D2-8A6F-90026BBF867D}C:\program files (x86)\google\google earth\client\googleearth.exe] => (Allow) C:\program files (x86)\google\google earth\client\googleearth.exe
    FirewallRules: [{260AA70C-A480-4AF7-871F-99F2B749BC5A}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
    FirewallRules: [{5339CD95-FB28-4685-9D54-9988E3F183CC}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
    FirewallRules: [{CFF3455C-2156-4845-A327-B93D17C0C93F}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hposid01.exe
    FirewallRules: [{D896FF1F-17E7-4BAC-9BFC-0D508F7AAC0B}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpoews01.exe
    FirewallRules: [{A8FBF3FF-A95E-4024-A43A-32CB44CB1CA0}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgplgtupl.exe
    FirewallRules: [{17D9F753-3D9E-40D8-9FBD-2545F6A72B9E}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
    FirewallRules: [{E6D2905E-809F-4396-8C77-B0658DFA32C4}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqusgm.exe
    FirewallRules: [{3276CC50-06F1-4193-80BC-BAED1CE4B134}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqusgh.exe
    FirewallRules: [{5F485083-100A-4E25-ADE9-1C64E5182FB6}] => (Allow) C:\Program Files (x86)\HP\hp software update\hpwucli.exe
    FirewallRules: [{83EDD164-EED3-49EF-BA0D-D9E6669D3072}] => (Allow) C:\Program Files (x86)\HP\digital imaging\smart web printing\smartwebprintexe.exe
    FirewallRules: [{D4EAAD28-FC03-412C-A0CF-563335C18C16}] => (Allow) C:\Windows\SysWOW64\lxdbcoms.exe
    FirewallRules: [{10E19EEF-EDA0-47D5-B24C-158A6E2E3888}] => (Allow) C:\Windows\SysWOW64\lxdbcoms.exe
    FirewallRules: [{51E24C8D-B58A-409F-901F-98610A557676}] => (Allow) C:\Windows\System32\lxdbcoms.exe
    FirewallRules: [{D2B83F41-1755-4309-8E66-76D1B3716E99}] => (Allow) C:\Windows\System32\lxdbcoms.exe
    FirewallRules: [{8D1C7B49-C381-4550-B2BE-E4EE22167B34}] => (Allow) C:\Windows\System32\spool\drivers\x64\3\lxdbpswx.exe
    FirewallRules: [{2916B473-DF6B-458C-B41E-F85CC6FC8323}] => (Allow) C:\Windows\System32\spool\drivers\x64\3\lxdbpswx.exe
    FirewallRules: [{36F4ED32-684C-4802-8D96-D100011FEC0B}] => (Allow) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
    FirewallRules: [{CEBC5D2A-8BA9-4887-8345-78A37B9317E1}] => (Allow) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
    FirewallRules: [{04571419-0A36-4653-A059-CA1DC1381894}] => (Allow) C:\Program Files (x86)\EpsonNet\EpsonNet Setup\tool10\ENEasyApp.exe
    FirewallRules: [{24018CCD-8012-4613-9263-158C940FF7EE}] => (Allow) C:\Program Files (x86)\EpsonNet\EpsonNet Setup\tool10\ENEasyApp.exe
    FirewallRules: [TCP Query User{308B603B-5966-44A6-9264-C690374408C7}D:\common\driver update\edupdate.exe] => (Allow) D:\common\driver update\edupdate.exe
    FirewallRules: [UDP Query User{D1E302F4-6D01-492F-BF27-A47A7973E015}D:\common\driver update\edupdate.exe] => (Allow) D:\common\driver update\edupdate.exe
    FirewallRules: [TCP Query User{6F5C2C91-CCE1-49A5-995D-EFE441B0D738}C:\program files (x86)\epson software\event manager\eeventmanager.exe] => (Allow) C:\program files (x86)\epson software\event manager\eeventmanager.exe
    FirewallRules: [UDP Query User{4BAED64E-A588-4C7F-B491-BF0F3DB128B3}C:\program files (x86)\epson software\event manager\eeventmanager.exe] => (Allow) C:\program files (x86)\epson software\event manager\eeventmanager.exe
    FirewallRules: [TCP Query User{9F434B64-5201-479E-8F3C-B40F759C2E71}C:\windows\syswow64\msiexec.exe] => (Allow) C:\windows\syswow64\msiexec.exe
    FirewallRules: [UDP Query User{6AE359A2-D450-4E3C-9AF1-55D995355106}C:\windows\syswow64\msiexec.exe] => (Allow) C:\windows\syswow64\msiexec.exe
    FirewallRules: [{2727304C-2BD1-45AF-A226-F6A8D9C22580}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdater.exe
    FirewallRules: [{BA134C11-FA2A-4CE3-9CE2-494F0B1CCA50}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
    FirewallRules: [{BC05E73F-B080-452C-B93B-A769D25C1DCF}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
    FirewallRules: [{ACFE8DF7-A332-485F-A453-F061445889BD}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
    FirewallRules: [{DB4D48C7-A8D4-4052-8501-96F6DBD0562C}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
    FirewallRules: [{570E300A-8EB8-4318-BB81-19FDCF191021}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
    FirewallRules: [{807140A2-9538-407D-ADD0-AA344E9A618E}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    ==================== Restore Points =========================

    09-03-2017 15:33:04 Installed TurboTax 2016 wrapper
    09-03-2017 15:42:48 Installed TurboTax 2016 wpaiper
    19-03-2017 21:15:38 Restore Operation
    27-03-2017 18:17:39 Restore Point Created by FRST
    28-03-2017 14:23:14 Restore Point Created by FRST
    28-03-2017 14:43:06 JRT Pre-Junkware Removal
    29-03-2017 14:49:57 Installed Microsoft Fix it 50692
    29-03-2017 14:53:29 Restore Point Created by FRST
    29-03-2017 19:18:34 Restore Point Created by FRST

    ==================== Faulty Device Manager Devices =============

    Name: HP OfficeJet Pro 8710
    Description: HP OfficeJet Pro 8710
    Class Guid: 
    Manufacturer: 
    Service: 
    Problem: : The drivers for this device are not installed. (Code 28)
    Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

    Name: hp LaserJet 4200
    Description: hp LaserJet 4200
    Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
    Manufacturer: Hewlett-Packard
    Service: 
    Problem: : This device is disabled. (Code 22)
    Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (03/29/2017 07:18:46 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
    Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

    Details:
    AddWin32ServiceFiles: Unable to back up image of service Sophos Web Intelligence Update since QueryServiceConfig API failed

    System Error:
    The system cannot find the file specified.
    .

    Error: (03/27/2017 06:18:08 PM) (Source: Windows Search Service) (EventID: 7010) (User: )
    Description: The index cannot be initialized.

    Details:
        The content index catalog is corrupt.  (HRESULT : 0xc0041801) (0xc0041801)

    Error: (03/27/2017 06:18:08 PM) (Source: Windows Search Service) (EventID: 3058) (User: )
    Description: The application cannot be initialized.

    Context: Windows Application

    Details:
        The content index catalog is corrupt.  (HRESULT : 0xc0041801) (0xc0041801)

    Error: (03/27/2017 06:18:08 PM) (Source: Windows Search Service) (EventID: 3028) (User: )
    Description: The gatherer object cannot be initialized.

    Context: Windows Application, SystemIndex Catalog

    Details:
        The content index catalog is corrupt.  (HRESULT : 0xc0041801) (0xc0041801)

    Error: (03/27/2017 06:18:08 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
    Description: The plug-in in <Search.TripoliIndexer> cannot be initialized.

    Context: Windows Application, SystemIndex Catalog

    Details:
        Element not found.  (HRESULT : 0x80070490) (0x80070490)

    Error: (03/27/2017 06:18:08 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
    Description: The plug-in in <Search.JetPropStore> cannot be initialized.

    Context: Windows Application, SystemIndex Catalog

    Details:
        The content index catalog is corrupt.  (HRESULT : 0xc0041801) (0xc0041801)

    Error: (03/27/2017 06:18:08 PM) (Source: Windows Search Service) (EventID: 9002) (User: )
    Description: The Windows Search Service cannot load the property store information.

    Context: Windows Application, SystemIndex Catalog

    Details:
        The content index database is corrupt.  (HRESULT : 0xc0041800) (0xc0041800)

    Error: (03/27/2017 06:18:08 PM) (Source: Windows Search Service) (EventID: 7042) (User: )
    Description: The Windows Search Service is being stopped because there is a problem with the indexer: The catalog is corrupt.

    Details:
        The content index catalog is corrupt.  (HRESULT : 0xc0041801) (0xc0041801)

    Error: (03/27/2017 06:18:08 PM) (Source: Windows Search Service) (EventID: 7040) (User: )
    Description: The search service has detected corrupted data files in the index {id=4700}. The service will attempt to automatically correct this problem by rebuilding the index.

    Details:
        The content index catalog is corrupt.  (HRESULT : 0xc0041801) (0xc0041801)

    Error: (03/27/2017 06:18:07 PM) (Source: Windows Search Service) (EventID: 9000) (User: )
    Description: The Windows Search Service cannot open the Jet property store.

    Details:
        0x%08x (0xc0041800 - The content index database is corrupt.  (HRESULT : 0xc0041800))


    System errors:
    =============
    Error: (03/30/2017 02:14:30 PM) (Source: DCOM) (EventID: 10010) (User: )
    Description: The server {4EB61BAC-A3B6-4760-9581-655041EF4D69} did not register with DCOM within the required timeout.

    Error: (03/30/2017 05:37:21 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
    Description: The ZAM Controller Service service terminated unexpectedly.  It has done this 1 time(s).

    Error: (03/30/2017 05:28:24 AM) (Source: Service Control Manager) (EventID: 7002) (User: )
    Description: The BrPar service depends on the Parallel arbitrator group and no member of this group started.

    Error: (03/30/2017 05:21:39 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
    Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Wlansvc service.

    Error: (03/29/2017 09:43:38 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
    Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Netman service.

    Error: (03/29/2017 07:20:39 PM) (Source: Service Control Manager) (EventID: 7002) (User: )
    Description: The BrPar service depends on the Parallel arbitrator group and no member of this group started.

    Error: (03/29/2017 07:19:05 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
    Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Search service, but this action failed with the following error: 
    An instance of the service is already running.

    Error: (03/29/2017 07:18:33 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
    Description: The EPSON V5 Service4(04) service terminated unexpectedly.  It has done this 1 time(s).

    Error: (03/29/2017 07:18:33 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
    Description: The Intuit Update Service v4 service terminated unexpectedly.  It has done this 1 time(s).

    Error: (03/29/2017 07:18:33 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
    Description: The SoftThinks Agent Service service terminated unexpectedly.  It has done this 1 time(s).


    ==================== Memory info =========================== 

    Processor: Pentium(R) Dual-Core CPU T4300 @ 2.10GHz
    Percentage of memory in use: 32%
    Total physical RAM: 4056.36 MB
    Available physical RAM: 2719.09 MB
    Total Virtual: 8110.91 MB
    Available Virtual: 6227.96 MB

    ==================== Drives ================================

    Drive c: (OS) (Fixed) (Total:446.59 GB) (Free:330.61 GB) NTFS

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (Size: 465.8 GB) (Disk ID: 2B391CB6)
    Partition 1: (Not Active) - (Size=298 MB) - (Type=DE)
    Partition 2: (Active) - (Size=18.9 GB) - (Type=07 NTFS)
    Partition 3: (Not Active) - (Size=446.6 GB) - (Type=07 NTFS)

    ==================== End of Addition.txt ============================

     

    Very slow, CPU maxxed, and mouse locks up

    in Resolved Malware Removal Logs

    Posted

    Fix result of Farbar Recovery Scan Tool (x64) Version: 15-03-2017
    Ran by Roland (29-03-2017 19:18:31) Run:5
    Running from C:\Users\Roland\Desktop
    Loaded Profiles: Roland (Available Profiles: Roland)
    Boot Mode: Normal
    ==============================================

    fixlist content:
    *****************
    Start
    CloseProcesses:
    CreateRestorePoint:
    C:\ProgramData\AVAST Software
    C:\Windows\system32\Drivers\aswsnx.sys.148997402374507
    C:\Windows\system32\Drivers\aswsp.sys.148997402494610
    C:\Windows\system32\Drivers\aswvmm.sys.148997402578812
    AS: Microsoft Security Essentials (Enabled - Up to date) {84E27563-E198-C6D6-D9BC-D9F020245508}
    CMD: ipconfig /flushdns
    Hosts:
    EmptyTemp:
    end
    *****************

    Processes closed successfully.
    Restore point was successfully created.
    C:\ProgramData\AVAST Software => moved successfully
    C:\Windows\system32\Drivers\aswsnx.sys.148997402374507 => moved successfully
    C:\Windows\system32\Drivers\aswsp.sys.148997402494610 => moved successfully
    C:\Windows\system32\Drivers\aswvmm.sys.148997402578812 => moved successfully
    AS: Microsoft Security Essentials (Enabled - Up to date) {84E27563-E198-C6D6-D9BC-D9F020245508} => removed successfully

    ========= ipconfig /flushdns =========


    Windows IP Configuration

    Successfully flushed the DNS Resolver Cache.

    ========= End of CMD: =========

    C:\Windows\System32\Drivers\etc\hosts => moved successfully
    Hosts restored successfully.

    =========== EmptyTemp: ==========

    BITS transfer queue => 8388608 B
    DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 2596828 B
    Java, Flash, Steam htmlcache => 0 B
    Windows/system/drivers => 0 B
    Edge => 0 B
    Chrome => 16497636 B
    Firefox => 0 B
    Opera => 0 B

    Temp, IE cache, history, cookies, recent:
    Users => 0 B
    Default => 0 B
    Public => 0 B
    ProgramData => 0 B
    systemprofile => 0 B
    systemprofile32 => 0 B
    LocalService => 0 B
    NetworkService => 0 B
    Roland => 46188 B

    RecycleBin => 41738 B
    EmptyTemp: => 26.3 MB temporary data Removed.

    ================================


    The system needed a reboot.

    ==== End of Fixlog 19:19:13 ====

    Very slow, CPU maxxed, and mouse locks up

    in Resolved Malware Removal Logs

    Posted

    Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 15-03-2017
    Ran by Roland (administrator) on ROLAND-PC (29-03-2017 18:34:41)
    Running from C:\Users\Roland\Desktop
    Loaded Profiles: Roland (Available Profiles: Roland)
    Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
    Internet Explorer Version 11 (Default browser: Chrome)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (Stardock Corporation) C:\Program Files\Dell\DellDock\DockLogin.exe
    (SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
    (SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE
    (SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
    (SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
    (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
    (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
    (SoftThinks SAS) C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe
    (Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
    (Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    (TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
    (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    (SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe
    () C:\Program Files (x86)\Dell DataSafe Local Backup\Components\scheduler\STService.exe
    (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
    (Copyright 2017.) C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe
    (SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
    (Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
    (Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
    (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.32.7\GoogleCrashHandler.exe
    (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.32.7\GoogleCrashHandler64.exe
    (Microsoft Corporation) C:\Windows\System32\rundll32.exe
    (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    (IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
    (Intel Corporation) C:\Windows\System32\igfxtray.exe
    (Intel Corporation) C:\Windows\System32\hkcmd.exe
    (Intel Corporation) C:\Windows\System32\igfxsrvc.exe
    (Intel Corporation) C:\Windows\System32\igfxpers.exe
    (Microsoft Corporation) C:\Program Files\Microsoft IntelliType Pro\itype.exe
    (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    (Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
    (Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
    (Copyright 2017.) C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Microsoft Corporation) C:\Windows\System32\dllhost.exe
    (Microsoft Corporation) C:\Windows\System32\dllhost.exe

    ==================== Registry (Whitelisted) ====================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1808680 2009-06-25] (Synaptics Incorporated)
    HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [444416 2009-06-29] (IDT, Inc.)
    HKLM\...\Run: [itype] => c:\Program Files\Microsoft IntelliType Pro\itype.exe [1873256 2011-08-10] (Microsoft Corporation)
    HKLM-x32\...\Run: [FUFAXSTM] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe [847872 2009-12-03] (SEIKO EPSON CORPORATION)
    HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-12-12] (Oracle Corporation)
    Winlogon\Notify\GoToAssist: 
    Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
    HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\Run: [EPSON Artisan 830 Series] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGXA.EXE [224768 2010-01-12] (SEIKO EPSON CORPORATION)
    Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk [2009-09-23]
    ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
    Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk [2009-09-23]
    ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
    BootExecute: 

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
    Tcpip\..\Interfaces\{D106EC69-996A-405C-BFA0-2F6611237F58}: [DhcpNameServer] 192.168.0.1
    Tcpip\..\Interfaces\{FEC7D3F0-8222-44DB-A6F2-AA3C2578E80A}: [DhcpNameServer] 192.168.0.1

    Internet Explorer:
    ==================
    HKU\S-1-5-21-3236689562-672039265-411895171-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
    HKU\S-1-5-21-3236689562-672039265-411895171-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp
    SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
    SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
    BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_121\bin\ssv.dll [2017-02-22] (Oracle Corporation)
    BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
    BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-29] (Google Inc.)
    BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-02-22] (Oracle Corporation)
    BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\ssv.dll [2017-02-22] (Oracle Corporation)
    BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
    BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-29] (Google Inc.)
    BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-02-22] (Oracle Corporation)
    DPF: HKLM-x32 {50647AB5-18FD-4142-82B0-5852478DD0D5} hxxp://webeffective.keynote.com/applications/pconnector/download/ConnectorLauncher.cab

    FireFox:
    ========
    FF ProfilePath: C:\Users\Roland\AppData\Roaming\TomTom\HOME\Profiles\phu6xfhq.default [2014-06-23]
    FF Extension: (Map status indicator) - C:\Program Files (x86)\TomTom HOME 2\xul\extensions\MapShare-status@tomtom.com [2012-03-02] [not signed]
    FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
    FF Extension: (HP Smart Web Printing) - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011-01-03] [not signed]
    FF HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
    FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_25_0_0_127.dll [2017-03-20] ()
    FF Plugin: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-02-22] (Oracle Corporation)
    FF Plugin: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-02-22] (Oracle Corporation)
    FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
    FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_25_0_0_127.dll [2017-03-20] ()
    FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2015-08-26] (Google, Inc.)
    FF Plugin-x32: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-02-22] (Oracle Corporation)
    FF Plugin-x32: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-02-22] (Oracle Corporation)
    FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
    FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-16] (Google Inc.)
    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-16] (Google Inc.)
    FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-12-23] (Adobe Systems Inc.)
    FF Plugin HKU\S-1-5-21-3236689562-672039265-411895171-1000: @citrixonline.com/appdetectorplugin -> C:\Users\Roland\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2014-07-21] (Citrix Online)

    Chrome: 
    =======
    CHR HomePage: Default -> bing.com/?pc=__PARAM__
    CHR DefaultSearchURL: Default -> hxxp://www.bing.com/search?FORM=__PARAM__DF&PC=__PARAM__&q={searchTerms}
    CHR DefaultSearchKeyword: Default -> bing.com
    CHR DefaultSuggestURL: Default -> hxxp://www.bing.com/osjson.aspx?FORM=__PARAM__DF&PC=__PARAM__&query={searchTerms}
    CHR Profile: C:\Users\Roland\AppData\Local\Google\Chrome\User Data\Default [2017-03-29]
    CHR Extension: (Bing) - C:\Users\Roland\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfedoihopcjdfjihhhojdclnfdgomdho [2017-03-29]
    CHR Extension: (Chrome Web Store Payments) - C:\Users\Roland\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-19]
    CHR HKU\S-1-5-21-3236689562-672039265-411895171-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nfedoihopcjdfjihhhojdclnfdgomdho] - hxxps://clients2.google.com/service/update2/crx
    CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx

    ==================== Services (Whitelisted) ====================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    S4 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
    R2 DockLoginService; C:\Program Files\Dell\DellDock\DockLogin.exe [155648 2008-12-18] (Stardock Corporation) [File not signed]
    R3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-23] (Hewlett-Packard Co.) [File not signed]
    R2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-23] (Hewlett-Packard Co.) [File not signed]
    R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1039360 2010-10-22] (Hewlett-Packard Co.) [File not signed]
    S4 lxdb_device; C:\Windows\system32\lxdbcoms.exe [566192 2007-02-02] ( )
    S4 lxdb_device; C:\Windows\SysWOW64\lxdbcoms.exe [537520 2007-02-02] ( )
    R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4355024 2017-01-20] (Malwarebytes)
    S3 MSSQL$MSSMLBIZ; c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
    S2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
    S2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
    S4 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\STacSV64.exe [240128 2009-06-29] (IDT, Inc.)
    R2 ZAMSvc; C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe [14509296 2017-03-22] (Copyright 2017.)

    ===================== Drivers (Whitelisted) ======================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    S2 BrPar; C:\Windows\SysWOW64\drivers\BrPar.sys [19537 2000-07-24] (Brother Industries Ltd.) [File not signed]
    R1 ElRawDisk; C:\Windows\system32\drivers\ElRawDsk.sys [31432 2012-04-17] (EldoS Corporation)
    R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [77408 2017-02-24] ()
    S3 FlyUsb; C:\Windows\System32\DRIVERS\FlyUsb.sys [24576 2009-11-10] (LeapFrog)
    R2 MBAMChameleon; C:\Windows\system32\drivers\MBAMChameleon.sys [186304 2017-03-29] (Malwarebytes)
    R3 MBAMProtection; C:\Windows\system32\drivers\mbam.sys [43968 2017-03-29] (Malwarebytes)
    R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [251840 2017-03-29] (Malwarebytes)
    R3 MBAMWebProtection; C:\Windows\system32\drivers\mwac.sys [82208 2017-03-29] (Malwarebytes)
    S3 sdcfilter; C:\Windows\System32\DRIVERS\sdcfilter.sys [38144 2016-04-17] (Sophos Limited)
    R2 sntp; C:\Windows\System32\DRIVERS\sntp.sys [116144 2016-04-16] (Sophos Limited)
    S3 ssmirrdr; C:\Windows\System32\DRIVERS\ssmirrdr.sys [10112 2011-03-15] (support.com, Inc)
    U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [35064 2015-05-28] ()
    U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-13] (Microsoft Corporation)
    R3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()
    R1 ZAM; C:\Windows\System32\drivers\zam64.sys [203680 2017-03-24] (Zemana Ltd.)
    R1 ZAM_Guard; C:\Windows\System32\drivers\zamguard64.sys [203680 2017-03-24] (Zemana Ltd.)

    ==================== NetSvcs (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    ==================== One Month Created files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2017-03-29 17:50 - 2017-03-29 18:35 - 00015888 _____ C:\Users\Roland\Desktop\FRST.txt
    2017-03-29 14:51 - 2017-03-29 14:51 - 00002046 _____ C:\FixitRegBackup.reg
    2017-03-29 14:49 - 2017-03-29 14:49 - 00806400 _____ C:\Users\Roland\Desktop\MicrosoftFixit50692.msi
    2017-03-29 05:35 - 2017-03-29 18:34 - 00066927 _____ C:\Windows\ZAM.krnl.trace
    2017-03-29 05:35 - 2017-03-29 18:34 - 00030960 _____ C:\Windows\ZAM_Guard.krnl.trace
    2017-03-29 05:28 - 2017-03-29 05:29 - 08545968 _____ (AVAST Software) C:\Users\Roland\Desktop\avastclear.exe
    2017-03-28 15:23 - 2017-03-28 15:23 - 00000408 _____ C:\Scan_170328-152228.txt
    2017-03-28 15:09 - 2017-03-28 15:09 - 00000000 ____D C:\ProgramData\Emsisoft
    2017-03-28 14:58 - 2017-03-28 15:23 - 00000000 ____D C:\EEK
    2017-03-28 14:50 - 2017-03-28 14:55 - 288977232 _____ C:\Users\Roland\Desktop\EmsisoftEmergencyKit.exe
    2017-03-28 14:34 - 2017-03-28 14:34 - 01663904 _____ (Malwarebytes) C:\Users\Roland\Desktop\JRT.exe
    2017-03-28 14:33 - 2017-03-28 14:33 - 04089296 _____ C:\Users\Roland\Desktop\adwcleaner_6.045.exe
    2017-03-27 16:16 - 2017-03-27 16:16 - 00000000 ____D C:\Users\Roland\Desktop\geek
    2017-03-27 16:00 - 2017-03-27 16:27 - 00000000 ____D C:\Users\Roland\AppData\Roaming\Geek Uninstaller
    2017-03-27 14:29 - 2017-03-29 18:34 - 00000000 ____D C:\FRST
    2017-03-27 14:29 - 2017-03-27 14:29 - 02424832 _____ (Farbar) C:\Users\Roland\Desktop\FRST64.exe
    2017-03-25 07:14 - 2017-03-25 07:14 - 00000000 ____D C:\ProgramData\SWCUTemp
    2017-03-24 20:20 - 2017-03-24 20:20 - 02030536 _____ (Bleeping Computer, LLC) C:\Users\Roland\Downloads\rkill.exe
    2017-03-24 18:28 - 2017-03-24 18:28 - 00203680 _____ (Zemana Ltd.) C:\Windows\system32\Drivers\zamguard64.sys
    2017-03-24 18:28 - 2017-03-24 18:28 - 00203680 _____ (Zemana Ltd.) C:\Windows\system32\Drivers\zam64.sys
    2017-03-24 18:28 - 2017-03-24 18:28 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zemana AntiMalware
    2017-03-24 18:28 - 2017-03-24 18:28 - 00000000 ____D C:\Program Files (x86)\Zemana AntiMalware
    2017-03-24 18:07 - 2017-03-24 18:07 - 00012872 _____ (SurfRight B.V.) C:\Windows\system32\bootdelete.exe
    2017-03-24 17:37 - 2017-03-24 17:37 - 00079086 _____ C:\Windows\system32\.crusader
    2017-03-24 17:20 - 2017-03-24 17:20 - 00000000 ____D C:\Users\Roland\AppData\Local\Zemana
    2017-03-24 17:19 - 2017-03-24 17:20 - 05763056 _____ (Zemana Ltd. ) C:\Users\Roland\Downloads\Zemana.AntiMalware.Setup.exe
    2017-03-24 17:19 - 2017-03-24 17:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
    2017-03-24 17:19 - 2017-03-24 17:19 - 00000000 ____D C:\Program Files\HitmanPro
    2017-03-24 17:18 - 2017-03-24 17:37 - 00000000 ____D C:\ProgramData\HitmanPro
    2017-03-24 17:17 - 2017-03-24 17:18 - 11581544 _____ (SurfRight B.V.) C:\Users\Roland\Downloads\HitmanPro_x64.exe
    2017-03-24 17:14 - 2017-03-29 17:39 - 00082208 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
    2017-03-24 17:14 - 2017-03-29 14:56 - 00251840 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
    2017-03-24 17:14 - 2017-03-29 14:56 - 00186304 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMChameleon.sys
    2017-03-24 17:14 - 2017-03-29 14:56 - 00043968 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
    2017-03-24 17:14 - 2017-03-28 14:42 - 00000000 ____D C:\AdwCleaner
    2017-03-24 17:14 - 2017-03-27 14:19 - 00111544 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
    2017-03-24 17:14 - 2017-03-24 17:14 - 04031440 _____ C:\Users\Roland\Downloads\adwcleaner_6.044.exe
    2017-03-24 17:13 - 2017-03-24 17:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
    2017-03-24 17:13 - 2017-03-24 17:13 - 00000000 ____D C:\Program Files\Malwarebytes
    2017-03-24 17:13 - 2017-02-24 06:23 - 00077408 _____ C:\Windows\system32\Drivers\mbae64.sys
    2017-03-24 17:12 - 2017-03-24 17:13 - 57131432 _____ (Malwarebytes ) C:\Users\Roland\Downloads\mb3-setup-consumer-3.0.6.1469-1075.exe
    2017-03-24 11:38 - 2017-03-24 11:38 - 00000000 ____D C:\Users\Roland\AppData\Roaming\Eusing
    2017-03-24 11:26 - 2017-03-25 07:10 - 00007605 _____ C:\Users\Roland\AppData\Local\resmon.resmoncfg
    2017-03-24 11:06 - 2017-03-24 11:06 - 00002794 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
    2017-03-24 11:06 - 2017-03-24 11:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
    2017-03-24 11:06 - 2017-03-24 11:06 - 00000000 ____D C:\Program Files\CCleaner
    2017-03-20 20:54 - 2017-02-22 22:59 - 00453720 _____ C:\Windows\system32\Drivers\etc\hosts.20170320-205400.backup
    2017-03-19 21:40 - 2017-03-19 21:40 - 00044952 _____ () C:\Windows\system32\Drivers\staport.sys
    2017-03-09 19:44 - 2017-03-10 16:46 - 00000000 ____D C:\Users\Roland\AppData\Local\Glance
    2017-03-09 15:35 - 2017-03-19 21:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TurboTax 2016

    ==================== One Month Modified files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2017-03-29 18:23 - 2009-11-13 20:13 - 00000000 ____D C:\Users\Roland
    2017-03-29 18:20 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\inf
    2017-03-29 17:42 - 2009-07-14 00:45 - 00014240 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2017-03-29 17:42 - 2009-07-14 00:45 - 00014240 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2017-03-29 14:56 - 2009-11-13 22:18 - 00000000 ____D C:\Users\Roland\AppData\Local\SoftThinks
    2017-03-29 14:56 - 2009-11-13 22:18 - 00000000 ____D C:\Users\Default\AppData\Local\SoftThinks
    2017-03-29 14:56 - 2009-11-13 22:18 - 00000000 ____D C:\Users\Default User\AppData\Local\SoftThinks
    2017-03-29 14:56 - 2009-09-23 17:33 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup
    2017-03-29 14:55 - 2009-07-14 01:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
    2017-03-29 14:54 - 2015-12-10 17:04 - 00000000 ____D C:\Windows\System32\Tasks\AVAST Software
    2017-03-29 05:35 - 2015-12-10 17:00 - 00000000 ____D C:\ProgramData\AVAST Software
    2017-03-28 15:26 - 2009-12-02 20:43 - 00000000 ____D C:\Windows\Minidump
    2017-03-28 14:44 - 2009-11-20 22:26 - 00000000 ____D C:\Program Files (x86)\PC Drivers HeadQuarters
    2017-03-27 17:48 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\system32\NDF
    2017-03-27 17:21 - 2009-11-17 11:02 - 00000000 ____D C:\ProgramData\FINPACK
    2017-03-27 17:21 - 2009-11-17 11:02 - 00000000 ____D C:\Program Files (x86)\FINPACK
    2017-03-27 16:09 - 2014-11-02 04:44 - 00000000 ____D C:\Users\Roland\Desktop\cyber sec
    2017-03-27 15:49 - 2009-11-13 22:29 - 00000000 ___SD C:\Users\Roland\AppData\LocalLow\Temp
    2017-03-26 19:48 - 2016-11-16 16:43 - 00000000 ____D C:\Users\Roland\Desktop\Web Stuff
    2017-03-26 19:43 - 2009-11-15 18:45 - 00000000 ____D C:\Users\Roland\Documents\2 Fm Decions Current
    2017-03-26 19:36 - 2009-07-14 01:13 - 00803678 _____ C:\Windows\system32\PerfStringBackup.INI
    2017-03-24 20:14 - 2012-12-25 21:16 - 00000000 ____D C:\Users\Roland\AppData\Local\CrashDumps
    2017-03-24 17:38 - 2013-04-25 09:04 - 00000000 ____D C:\Program Files (x86)\iolo
    2017-03-24 17:37 - 2011-01-03 21:35 - 00000000 ____D C:\Program Files (x86)\Yahoo!
    2017-03-24 17:31 - 2013-04-25 09:05 - 00000000 ____D C:\ProgramData\iolo
    2017-03-24 17:13 - 2010-10-02 08:07 - 00000000 ____D C:\ProgramData\Malwarebytes
    2017-03-21 14:31 - 2012-10-12 14:38 - 00000000 ____D C:\Users\Roland\AppData\Local\ElevatedDiagnostics
    2017-03-21 12:25 - 2014-12-27 23:08 - 00000000 ____D C:\Users\Roland\Desktop\Pics 12 14
    2017-03-21 12:22 - 2017-02-09 21:01 - 00000000 ____D C:\Users\Roland\Desktop\217 AGO
    2017-03-21 11:59 - 2012-02-12 20:15 - 00000000 ____D C:\Users\Roland\Desktop\Unused Ikons
    2017-03-20 21:04 - 2013-09-14 09:46 - 00004312 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
    2017-03-20 21:04 - 2012-03-28 21:26 - 00802904 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
    2017-03-20 21:04 - 2011-11-11 14:59 - 00000000 ____D C:\Windows\system32\Macromed
    2017-03-20 21:04 - 2011-06-03 20:27 - 00144472 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
    2017-03-20 21:04 - 2009-09-23 17:25 - 00000000 ____D C:\Windows\SysWOW64\Macromed
    2017-03-20 20:54 - 2009-07-13 22:34 - 00454268 ____R C:\Windows\system32\Drivers\etc\hosts.20170324-134951.backup
    2017-03-20 19:31 - 2016-01-22 13:50 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
    2017-03-19 21:46 - 2010-12-16 22:40 - 00002269 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
    2017-03-19 21:46 - 2010-12-16 22:40 - 00002257 _____ C:\Users\Public\Desktop\Google Chrome.lnk
    2017-03-19 21:38 - 2015-12-10 17:04 - 00969560 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.148997402374507
    2017-03-19 21:38 - 2015-12-10 17:04 - 00513496 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.148997402494610
    2017-03-19 21:38 - 2015-12-10 17:04 - 00292704 _____ (AVAST Software) C:\Windows\system32\Drivers\aswvmm.sys.148997402578812
    2017-03-19 21:36 - 2009-11-13 20:13 - 00112616 _____ C:\Users\Roland\AppData\Local\GDIPFONTCACHEV1.DAT
    2017-03-19 21:31 - 2017-01-26 16:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
    2017-03-19 21:31 - 2014-01-06 15:40 - 00000000 ____D C:\Program Files\UVK - Ultra Virus Killer
    2017-03-19 21:31 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\AppCompat
    2017-03-19 21:29 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\registration
    2017-03-19 21:26 - 2016-01-05 12:35 - 00000000 ____D C:\Users\Roland\AppData\Roaming\Intuit
    2017-03-18 19:25 - 2012-10-12 15:05 - 00000000 ____D C:\temp
    2017-03-15 20:46 - 2016-10-27 20:52 - 00000000 ____D C:\Users\Roland\Desktop\Email Stuff
    2017-03-14 17:24 - 2013-12-13 21:13 - 00000000 ____D C:\Users\Roland\Desktop\Ishler feed prices
    2017-03-10 22:27 - 2016-01-05 12:41 - 00000000 ____D C:\Users\Roland\Documents\TurboTax
    2017-03-09 15:46 - 2014-11-02 04:40 - 00000000 ____D C:\Users\Roland\Desktop\friends
    2017-03-09 15:37 - 2016-01-05 12:33 - 00000629 _____ C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc

    ==================== Files in the root of some directories =======

    2014-05-21 15:58 - 2014-05-21 15:58 - 0000268 ___RH () C:\Users\Roland\AppData\Roaming\Smooth Strings
    2014-05-21 15:59 - 2014-05-21 15:59 - 0000268 ___RH () C:\Users\Roland\AppData\Roaming\Solid Colors
    2014-05-21 15:58 - 2014-05-21 15:58 - 0000268 ___RH () C:\Users\Roland\AppData\Roaming\Sound Effects
    2014-05-21 15:57 - 2014-05-21 15:57 - 0000268 ___RH () C:\Users\Roland\AppData\Roaming\Static Library
    2017-03-24 11:26 - 2017-03-25 07:10 - 0007605 _____ () C:\Users\Roland\AppData\Local\resmon.resmoncfg
    2013-04-23 21:48 - 2013-04-23 21:48 - 2250054 _____ () C:\ProgramData\1.bmp
    2013-04-23 21:47 - 2013-04-23 21:47 - 0302806 _____ () C:\ProgramData\1.jpg
    2011-01-03 21:26 - 2011-01-03 21:38 - 0000802 _____ () C:\ProgramData\hpzinstall.log
    2016-01-05 12:33 - 2017-03-09 15:37 - 0000629 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc
    2014-05-21 15:57 - 2014-05-21 15:57 - 0000020 ____H () C:\ProgramData\PKP_DLeo.DAT
    2014-05-21 15:59 - 2014-05-21 15:59 - 0000020 ____H () C:\ProgramData\PKP_DLes.DAT
    2014-05-21 15:58 - 2014-05-23 11:55 - 0000020 ____H () C:\ProgramData\PKP_DLet.DAT
    2014-05-21 15:58 - 2014-05-21 15:58 - 0000020 ____H () C:\ProgramData\PKP_DLev.DAT
    2014-05-21 15:58 - 2014-05-21 15:58 - 0000268 ___RH () C:\ProgramData\Soundtrack
    2014-05-21 15:59 - 2014-05-21 15:59 - 0000268 ___RH () C:\ProgramData\Space Choir
    2014-05-21 15:58 - 2014-05-21 15:58 - 0000268 ___RH () C:\ProgramData\Spacious
    2014-05-21 15:57 - 2014-05-21 15:57 - 0000268 ___RH () C:\ProgramData\String Ensemble
    2012-10-12 17:31 - 2012-10-12 19:46 - 0028232 _____ () C:\ProgramData\xportnchk.ini

    ==================== Bamital & volsnap ======================

    (There is no automatic fix for files that do not pass verification.)

    C:\Windows\system32\winlogon.exe => File is digitally signed
    C:\Windows\system32\wininit.exe => File is digitally signed
    C:\Windows\SysWOW64\wininit.exe => File is digitally signed
    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\SysWOW64\explorer.exe => File is digitally signed
    C:\Windows\system32\svchost.exe => File is digitally signed
    C:\Windows\SysWOW64\svchost.exe => File is digitally signed
    C:\Windows\system32\services.exe => File is digitally signed
    C:\Windows\system32\User32.dll => File is digitally signed
    C:\Windows\SysWOW64\User32.dll => File is digitally signed
    C:\Windows\system32\userinit.exe => File is digitally signed
    C:\Windows\SysWOW64\userinit.exe => File is digitally signed
    C:\Windows\system32\rpcss.dll => File is digitally signed
    C:\Windows\system32\dnsapi.dll => File is digitally signed
    C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
    C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

    LastRegBack: 2017-03-20 22:23

    ==================== End of FRST.txt ============================

    Very slow, CPU maxxed, and mouse locks up

    in Resolved Malware Removal Logs

    Posted


    LastRegBack: 2017-03-20 22:23

    ==================== End of FRST.txt ============================

     

    Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-03-2017
    Ran by Roland (29-03-2017 17:47:53)
    Running from C:\Users\Roland\Desktop
    Windows 7 Home Premium Service Pack 1 (X64) (2009-11-14 00:13:43)
    Boot Mode: Normal
    ==========================================================


    ==================== Accounts: =============================

    Administrator (S-1-5-21-3236689562-672039265-411895171-500 - Administrator - Disabled)
    Guest (S-1-5-21-3236689562-672039265-411895171-501 - Limited - Disabled)
    HomeGroupUser$ (S-1-5-21-3236689562-672039265-411895171-1002 - Limited - Enabled)
    Roland (S-1-5-21-3236689562-672039265-411895171-1000 - Administrator - Enabled) => C:\Users\Roland
    SophosSAUROLAND-PC0 (S-1-5-21-3236689562-672039265-411895171-1006 - Limited - Enabled)

    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: Norton Security Suite (Enabled - Up to date) {63DF5164-9100-186D-2187-8DC619EFD8BF}
    AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AS: Norton Security Suite (Enabled - Up to date) {D8BEB080-B73A-17E3-1B37-B6B462689202}
    AS: Microsoft Security Essentials (Enabled - Up to date) {84E27563-E198-C6D6-D9BC-D9F020245508}
    FW: Norton Security Suite (Enabled) {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

    ==================== Installed Programs ======================

    (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    470_Help (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
    470_Readme (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
    64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
    7-Zip 15.12 (HKLM-x32\...\{23170F69-40C1-2701-1512-000001000000}) (Version: 15.12.00.0 - Igor Pavlov)
    7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )
    ABBYY FineReader 9.0 Sprint (HKLM-x32\...\ABBYY FineReader 9.0 Sprint) (Version: 9.01.513.58212 - ABBYY)
    ABBYY FineReader 9.0 Sprint (x32 Version: 9.01.513.58212 - ABBYY) Hidden
    Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.023.20070 - Adobe Systems Incorporated)
    Adobe Flash Player 25 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 25.0.0.127 - Adobe Systems Incorporated)
    Adobe Flash Player 25 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 25.0.0.127 - Adobe Systems Incorporated)
    Advanced Audio FX Engine (HKLM-x32\...\Advanced Audio FX Engine) (Version: 1.12.05 - Creative Technology Ltd)
    BPDSoftware (x32 Version: 130.0.000.000 - Hewlett-Packard) Hidden
    BPDSoftware_Ini (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
    Brother HL-5040 (HKLM-x32\...\Brother HL-5040) (Version:  - )
    BufferChm (x32 Version: 130.0.331.000 - Hewlett-Packard) Hidden
    Business Contact Manager for Outlook 2007 SP2 (HKLM-x32\...\Business Contact Manager) (Version: 3.0.8619.1 - Microsoft Corporation)
    Business Contact Manager for Outlook 2007 SP2 (x32 Version: 3.0.8619.1 - Microsoft Corporation) Hidden
    CCleaner (HKLM\...\CCleaner) (Version: 5.28 - Piriform)
    Citrix Online Launcher (HKLM-x32\...\{3E7E6F1E-7376-475A-8BC9-E3126B20CF5F}) (Version: 1.0.198 - Citrix)
    D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
    Dell DataSafe Local Backup - Support Software (HKLM-x32\...\{A9668246-FB70-4103-A1E3-66C9BC2EFB49}) (Version: 9.4.60 - Dell)
    Dell DataSafe Local Backup (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 9.4.60 - Dell)
    Dell Dock (HKLM\...\{E60B7350-EA5F-41E0-9D6F-E508781E36D2}) (Version: 2.0.0 - Dell)
    Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)
    Dell Getting Started Guide (HKLM-x32\...\{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}) (Version: 1.00.0000 - Dell Inc.)
    Dell Support Center (Support Software) (HKLM-x32\...\{E3BFEE55-39E2-4BE0-B966-89FE583822C1}) (Version: 2.5.09100 - Dell)
    Dell Touchpad (HKLM\...\SynTPDeinstKey) (Version: 13.2.3.0 - Synaptics Incorporated)
    Dell Webcam Central (HKLM-x32\...\Dell Webcam Central) (Version: 1.40.05 - Creative Technology Ltd)
    DeviceDiscovery (x32 Version: 130.0.465.000 - Hewlett-Packard) Hidden
    EPSON Artisan 810 Series Printer Uninstall (HKLM\...\EPSON Artisan 810 Series) (Version:  - SEIKO EPSON Corporation)
    EPSON Artisan 830 Series Printer Uninstall (HKLM\...\EPSON Artisan 830 Series) (Version:  - SEIKO EPSON Corporation)
    Epson Event Manager (HKLM-x32\...\{03B8AA32-F23C-4178-B8E6-09ECD07EAA47}) (Version: 2.40.0001 - SEIKO EPSON CORPORATION)
    Epson FAX Utility (HKLM-x32\...\{0CBE6C93-CB2E-4378-91EE-12BE6D4E2E4A}) (Version: 1.10.00 - SEIKO EPSON CORPORATION)
    Epson Print CD (HKLM-x32\...\{D16A31F9-276D-4968-A753-FFEAC56995D0}) (Version: 2.00.00 - SEIKO EPSON CORPORATION)
    EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)
    EpsonNet Setup 3.2 (HKLM-x32\...\{C9D8A041-2963-4B31-8FFC-1500F3DB9293}) (Version: 3.2a - SEIKO EPSON CORPORATION)
    FINPACK (HKLM-x32\...\FINPACK) (Version:  - )
    Google Chrome (HKLM-x32\...\Google Chrome) (Version: 57.0.2987.110 - Google Inc.)
    Google Earth (HKLM-x32\...\{F6430171-B86B-4639-839E-374913E7911D}) (Version: 7.1.8.3036 - Google)
    Google Earth Pro (HKLM-x32\...\{35DAA04C-1720-4BE3-A920-A03731EC6A1D}) (Version: 7.1.5.1557 - Google)
    Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.8231.2252 - Google Inc.)
    Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
    Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
    Google Update Helper (x32 Version: 1.3.32.7 - Google Inc.) Hidden
    Google+ Auto Backup (HKLM-x32\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google)
    GoToAssist 8.0.0.514 (HKLM-x32\...\GoToAssist) (Version:  - )
    GPBaseService2 (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
    H470 (x32 Version: 130.0.000.000 - Hewlett-Packard) Hidden
    HitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.15.281 - SurfRight B.V.)
    HP Customer Participation Program 13.0 (HKLM\...\HPExtendedCapabilities) (Version: 13.0 - HP)
    HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP)
    HP OfficeJet H470 (HKLM\...\{2B71BB94-F52C-4EF2-85E8-45E63296EDF2}) (Version: 13.0 - HP)
    HP Smart Web Printing 4.51 (HKLM\...\HP Smart Web Printing) (Version: 4.51 - HP)
    HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
    HP Update (HKLM-x32\...\{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}) (Version: 5.003.001.001 - Hewlett-Packard)
    HPDiagnosticAlert (x32 Version: 1.00.0000 - Microsoft) Hidden
    HPProductAssistant (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
    HPSSupply (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
    Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version:  - Intel Corporation)
    Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.5.0.1029 - Intel Corporation)
    Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
    Java 8 Update 121 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180121F0}) (Version: 8.0.1210.13 - Oracle Corporation)
    Java 8 Update 121 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180121F0}) (Version: 8.0.1210.13 - Oracle Corporation)
    Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    LeapFrog Connect (HKLM-x32\...\UPCShell) (Version: 2.3.11.8936 - LeapFrog)
    LeapFrog Connect (x32 Version: 2.3.11.8936 - LeapFrog) Hidden
    LeapFrog Tag Plugin (x32 Version: 2.3.11.8936 - LeapFrog) Hidden
    Lexmark 840 Series (HKLM\...\Lexmark 840 Series) (Version:  - Lexmark International, Inc.)
    Live! Cam Avatar Creator (HKLM-x32\...\{65D0C510-D7B6-4438-9FC8-E6B91115AB0D}) (Version: 4.6.3009.1 - Creative Technology Ltd)
    Malwarebytes version 3.0.6.1469 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.0.6.1469 - Malwarebytes)
    MarketResearch (x32 Version: 130.0.374.000 - Hewlett-Packard) Hidden
    Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
    Microsoft IntelliType Pro 8.2 (HKLM\...\Microsoft IntelliType Pro 8.2) (Version: 8.20.469.0 - Microsoft Corporation)
    Microsoft Office 2003 Web Components (HKLM-x32\...\{90A40409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
    Microsoft Office 2007 Primary Interop Assemblies (HKLM-x32\...\{50120000-1105-0000-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
    Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-0014-0000-0000-0000000FF1CE}_PROR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
    Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
    Microsoft Office Accounting 2008 (HKLM-x32\...\Microsoft Office Accounting 2008) (Version: 3.0.8627.1 - Microsoft Corporation)
    Microsoft Office Accounting 2008 Equifax Addin (HKLM-x32\...\{0C2AF762-0565-4C91-9F55-B8B53BB82A38}) (Version: 3.0.8231.0 - Microsoft Corporation)
    Microsoft Office Accounting 2008 Fixed Asset Manager (HKLM-x32\...\{E3DF6916-2472-43D9-8B3C-9F2F0AAB01B5}) (Version: 3.0.8231.0 - Microsoft Corporation)
    Microsoft Office Accounting 2008 PayPal Addin (HKLM-x32\...\{B391EECE-DFEA-4FC5-9D40-47FA43E2DBE6}) (Version: 3.0.8231.0 - Microsoft Corporation)
    Microsoft Office Accounting ADP Payroll Addin (HKLM-x32\...\{5FA793A6-0071-42C1-9355-8F69A428C44F}) (Version: 0.0.0.0 - ADP)
    Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
    Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
    Microsoft Office Professional 2007 (HKLM-x32\...\PROR) (Version: 12.0.6612.1000 - Microsoft Corporation)
    Microsoft Office Small Business Connectivity Components (HKLM-x32\...\{A939D341-5A04-4E0A-BB55-3E65B386432D}) (Version: 2.0.7024.0 - Microsoft Corporation)
    Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs (HKLM-x32\...\{90120000-00B2-0409-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
    Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50428.0 - Microsoft Corporation)
    Microsoft SQL Server 2005 (HKLM-x32\...\Microsoft SQL Server 2005) (Version:  - Microsoft Corporation)
    Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
    Microsoft SQL Server Native Client (HKLM\...\{9ACF3FDB-C8E6-444C-8C64-13A221F7BFFD}) (Version: 9.00.5000.00 - Microsoft Corporation)
    Microsoft SQL Server Setup Support Files (English) (HKLM-x32\...\{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}) (Version: 9.00.5000.00 - Microsoft Corporation)
    Microsoft SQL Server VSS Writer (HKLM\...\{B636C9B9-A3F2-4DCE-ADCC-72E095018385}) (Version: 9.00.5000.00 - Microsoft Corporation)
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable - KB2467175 (HKLM-x32\...\{a0fe116e-9a8a-466f-aee0-625cb7c207e3}) (Version: 8.0.51011 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{052bac4a-6f79-46d4-a024-1ce1b4f73cd4}) (Version: 8.0.58299 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{820B6609-4C97-3A2B-B644-573B06A0F0CC}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Works 6-9 Converter (HKLM-x32\...\{95140000-0137-0409-0000-0000000FF1CE}) (Version: 14.0.6120.5002 - Microsoft Corporation)
    MPM (HKLM-x32\...\{00772F8B-37FF-4704-A47D-72B30BFAF126}) (Version: 1.00.0000 - Hewlett-Packard)
    Network64 (Version: 130.0.579.000 - Hewlett-Packard) Hidden
    Network64 (Version: 140.0.221.000 - Hewlett-Packard) Hidden
    Nikon Message Center 2 (HKLM-x32\...\{B014EE44-9197-4513-9613-71E6EB1B514E}) (Version: 2.1.0 - Nikon)
    Nikon Movie Editor (HKLM-x32\...\{5CAD3393-EEC0-44CE-9F93-BCAA365B77FB}) (Version: 2.6.0 - Nikon)
    Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9.140.248 - Google, Inc.)
    Picture Control Utility x64 (HKLM\...\{11953C65-BB4E-4CA4-B0F0-2600A4B20040}) (Version: 1.4.7 - Nikon)
    PowerDVD DX (HKLM-x32\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 8.3.5424 - CyberLink Corp.)
    ProductContext (x32 Version: 130.0.000.000 - Hewlett-Packard) Hidden
    Quickset64 (HKLM\...\{87CF757E-C1F1-4D22-865C-00C6950B5258}) (Version: 9.6.6 - Dell Inc.)
    Reliable IT repair tool (HKLM\...\UVK - Ultra virus killer) (Version: 5.9.0.1 - Reliable IT)
    Roxio Burn (HKLM-x32\...\{B2E47DE7-800B-40BB-BD1F-9F221C3AEE87}) (Version: 1.0 - Roxio)
    Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 13.0 - HP)
    SmartWebPrinting (x32 Version: 130.0.457.000 - Hewlett-Packard) Hidden
    SolutionCenter (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
    Status (x32 Version: 130.0.469.000 - Hewlett-Packard) Hidden
    TomTom HOME 2.8.3.2499 (HKLM-x32\...\TomTom HOME) (Version: 2.8.3.2499 - TomTom)
    TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
    Toolbox (x32 Version: 130.0.648.000 - Hewlett-Packard) Hidden
    TrayApp (x32 Version: 130.0.422.000 - Hewlett-Packard) Hidden
    TurboTax 2015 (HKLM-x32\...\TurboTax 2015) (Version: 2015.0 - Intuit, Inc)
    Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-0014-0000-0000-0000000FF1CE}_PROR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
    Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
    Use the entry named LeapFrog Connect to uninstall (LeapFrog Tag Plugin) (HKLM-x32\...\TagPlugin) (Version: 2.3.11.8936 - LeapFrog)
    ViewNX 2 (HKLM\...\{635BE602-BB9C-4C59-8CC5-93F9366E8A21}) (Version: 2.6.0 - Nikon)
    WebEx (HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\ActiveTouchMeetingClient) (Version:  - Cisco WebEx LLC)
    WebReg (x32 Version: 130.0.132.017 - Hewlett-Packard) Hidden
    Windows Driver Package - LeapFrog (FlyUsb) USB  (11/05/2008 1.1.1.0) (HKLM\...\781745E87AFF80C0C1388CFF79D19ECAB2E9BB47) (Version: 11/05/2008 1.1.1.0 - LeapFrog)
    Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
    Windows Live Sync (HKLM-x32\...\{FDD810CA-D5E3-40E9-AB7B-36440B0D41EF}) (Version: 14.0.8050.1202 - Microsoft Corporation)
    Zemana AntiMalware (HKLM-x32\...\{8F0CD7D1-42F3-4195-95CD-833578D45057}_is1) (Version: 2.72.0.324 - Zemana Ltd.)

    ==================== Custom CLSID (Whitelisted): ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    ==================== Scheduled Tasks (Whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    Task: {000E6622-8E66-4CB8-BB22-0F4F4C9CAD71} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)
    Task: {0726F637-A340-47AC-8B8F-6087BA8A0E2C} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-03-20] (Adobe Systems Incorporated)
    Task: {15832EAB-161B-4C8A-96A7-11300F4C614B} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2017-03-03] (Piriform Ltd)
    Task: {20F7C2B2-27FE-45D5-9359-9EA921ECC318} - System32\Tasks\{B2F436F5-BB82-4B49-AA0E-CF73AB8ED396} => pcalua.exe -a C:\Users\Roland\Desktop\install_flash_player_9.exe -d C:\Users\Roland\Desktop
    Task: {2C4E3533-1253-41DD-A189-F2AE3C1BD123} - System32\Tasks\{0340C534-D0C2-4710-BD77-C5035BF28B2D} => C:\Program Files (x86)\iolo\Common\Lib\ioloLManager.exe 
    Task: {57946441-35E3-4F03-BB0D-B5F132F26294} - System32\Tasks\{911256C9-F921-4261-91B8-2BD6F6AD8D8C} => pcalua.exe -a D:\setup.exe -d D:\
    Task: {5F38FEEE-8C02-46AF-A131-3495F00C96DC} - System32\Tasks\{CE6D138D-5A2A-4319-8091-2DF841919D35} => C:\Program Files (x86)\iolo\Common\Lib\ioloLManager.exe 
    Task: {8796A92C-9213-47B3-838D-44229A147DA5} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)
    Task: {A6CEFA61-91CB-4C24-B433-ADFFFE59AC68} - System32\Tasks\{F1F36E3E-E697-479D-8DCD-598E6B1EAD20} => pcalua.exe -a "C:\Program Files (x86)\FINPACK\FINPACK.exe" -d "C:\Program Files (x86)\FINPACK"
    Task: {C067F5CD-BD7C-4EC2-86A8-B44B1938E709} - System32\Tasks\Microsoft_Hardware_Launch_IType_exe => c:\Program Files\Microsoft IntelliType Pro\IType.exe [2011-08-10] (Microsoft Corporation)
    Task: {C56D37B2-D883-47CE-BC6F-D066233631ED} - System32\Tasks\{47FBF903-CA97-4C8A-9129-AA1B50D7A5AB} => C:\Program Files (x86)\iolo\Common\Lib\ioloLManager.exe 
    Task: {DD3422B8-7429-47EF-99E6-189B5A044880} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-12-19] (Adobe Systems Incorporated)
    Task: {E49F9117-EAD7-49CF-888D-268FFDA38A82} - System32\Tasks\{F3743546-E375-4083-AA1F-907F3B6A7548} => C:\Program Files (x86)\iolo\Common\Lib\ioloLManager.exe 

    (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


    ==================== Shortcuts =============================

    (The entries could be listed to be restored or removed.)

    ==================== Loaded Modules (Whitelisted) ==============

    2017-03-24 18:28 - 2017-03-24 18:28 - 00154480 _____ () C:\Program Files (x86)\Zemana AntiMalware\ZAMShellExt64.dll
    2009-09-23 17:34 - 2011-08-18 11:05 - 02751808 _____ () C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
    2017-03-24 17:13 - 2017-02-24 06:23 - 02264352 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\PoliciesControllerImpl.dll
    2017-03-24 17:13 - 2017-02-24 06:23 - 02264528 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MwacLib.dll
    2017-03-19 21:46 - 2017-03-16 00:11 - 02885464 _____ () C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.110\libglesv2.dll
    2017-03-19 21:46 - 2017-03-16 00:11 - 00099672 _____ () C:\Program Files (x86)\Google\Chrome\Application\57.0.2987.110\libegl.dll

    ==================== Alternate Data Streams (Whitelisted) =========

    (If an entry is included in the fixlist, only the ADS will be removed.)


    ==================== Safe Mode (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SAVService => ""="service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\GoToAssist => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SAVService => ""="service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SntpService => ""="service"

    ==================== Association (Whitelisted) ===============

    (If an entry is included in the fixlist, the registry item will be restored to default or removed.)


    ==================== Internet Explorer trusted/restricted ===============

    (If an entry is included in the fixlist, it will be removed from the registry.)

    IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
    IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
    IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
    IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
    IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
    IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
    IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
    IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
    IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
    IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
    IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
    IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
    IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
    IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
    IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
    IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
    IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
    IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
    IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
    IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

    There are 7933 more sites.

    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\007guard.com -> install.007guard.com
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\008i.com -> 008i.com
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\008k.com -> www.008k.com
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\00hq.com -> www.00hq.com
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\010402.com -> 010402.com
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\0scan.com -> www.0scan.com
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\1-2005-search.com -> www.1-2005-search.com
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\1-domains-registrations.com -> www.1-domains-registrations.com
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\1000gratisproben.com -> www.1000gratisproben.com
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\1001namen.com -> www.1001namen.com
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\100888290cs.com -> mir.100888290cs.com
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\100sexlinks.com -> www.100sexlinks.com
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\10sek.com -> www.10sek.com
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\12-26.net -> user1.12-26.net
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\12-27.net -> user1.12-27.net
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\123fporn.info -> www.123fporn.info
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\123moviedownload.com -> www.123moviedownload.com
    IE restricted site: HKU\S-1-5-21-3236689562-672039265-411895171-1000\...\123simsen.com -> www.123simsen.com

    There are 7933 more sites.


    ==================== Hosts content: ===============================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2017-03-27 18:21 - 2017-03-27 18:21 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

    127.0.0.1       localhost

    ==================== Other Areas ============================

    (Currently there is no automatic fix for this section.)

    HKU\S-1-5-21-3236689562-672039265-411895171-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Roland\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
    DNS Servers: 192.168.0.1
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
    Windows Firewall is enabled.

    ==================== MSCONFIG/TASK MANAGER disabled items ==

    MSCONFIG\startupreg: CCleaner Monitoring => "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
    MSCONFIG\startupreg: EEventManager => "C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe"
    MSCONFIG\startupreg: IAAnotif => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe
    MSCONFIG\startupreg: Malwarebytes TrayApp => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe
    MSCONFIG\startupreg: Nikon Message Center 2 => C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe -s
    MSCONFIG\startupreg: ZAM => "C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe" /minimized

    ==================== FirewallRules (Whitelisted) ===============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    FirewallRules: [{038284C9-21D7-4C57-B2CA-3129CA4F6DCB}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
    FirewallRules: [{F0D53FFF-117C-4CFC-B466-6444D4129286}] => (Allow) svchost.exe
    FirewallRules: [{690CD6B3-A821-4EE2-8E8B-7E19FB36832E}] => (Allow) C:\Program Files (x86)\Windows Live\Sync\WindowsLiveSync.exe
    FirewallRules: [{32867B3C-68D8-430C-8CE8-C97BDE04BD36}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD DX\PowerDVD.exe
    FirewallRules: [{181BC4D1-CF38-4CD8-8098-41602D3B2F18}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe
    FirewallRules: [TCP Query User{D28938A5-4200-4414-A6EB-7BA4AC3FCD04}C:\program files (x86)\internet explorer\iexplore.exe] => (Block) C:\program files (x86)\internet explorer\iexplore.exe
    FirewallRules: [UDP Query User{8E202954-8352-4CD4-894F-1BA42C4764C8}C:\program files (x86)\internet explorer\iexplore.exe] => (Block) C:\program files (x86)\internet explorer\iexplore.exe
    FirewallRules: [{F307F74A-05EB-40FC-8E92-93EB3ECF0991}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
    FirewallRules: [TCP Query User{59B3E3EE-53C5-4CF5-8606-E5F1128C9806}C:\program files (x86)\google\google earth\client\googleearth.exe] => (Allow) C:\program files (x86)\google\google earth\client\googleearth.exe
    FirewallRules: [UDP Query User{F0C51941-73EC-45D2-8A6F-90026BBF867D}C:\program files (x86)\google\google earth\client\googleearth.exe] => (Allow) C:\program files (x86)\google\google earth\client\googleearth.exe
    FirewallRules: [{260AA70C-A480-4AF7-871F-99F2B749BC5A}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
    FirewallRules: [{5339CD95-FB28-4685-9D54-9988E3F183CC}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
    FirewallRules: [{CFF3455C-2156-4845-A327-B93D17C0C93F}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hposid01.exe
    FirewallRules: [{D896FF1F-17E7-4BAC-9BFC-0D508F7AAC0B}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpoews01.exe
    FirewallRules: [{A8FBF3FF-A95E-4024-A43A-32CB44CB1CA0}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgplgtupl.exe
    FirewallRules: [{17D9F753-3D9E-40D8-9FBD-2545F6A72B9E}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
    FirewallRules: [{E6D2905E-809F-4396-8C77-B0658DFA32C4}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqusgm.exe
    FirewallRules: [{3276CC50-06F1-4193-80BC-BAED1CE4B134}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqusgh.exe
    FirewallRules: [{5F485083-100A-4E25-ADE9-1C64E5182FB6}] => (Allow) C:\Program Files (x86)\HP\hp software update\hpwucli.exe
    FirewallRules: [{83EDD164-EED3-49EF-BA0D-D9E6669D3072}] => (Allow) C:\Program Files (x86)\HP\digital imaging\smart web printing\smartwebprintexe.exe
    FirewallRules: [{D4EAAD28-FC03-412C-A0CF-563335C18C16}] => (Allow) C:\Windows\SysWOW64\lxdbcoms.exe
    FirewallRules: [{10E19EEF-EDA0-47D5-B24C-158A6E2E3888}] => (Allow) C:\Windows\SysWOW64\lxdbcoms.exe
    FirewallRules: [{51E24C8D-B58A-409F-901F-98610A557676}] => (Allow) C:\Windows\System32\lxdbcoms.exe
    FirewallRules: [{D2B83F41-1755-4309-8E66-76D1B3716E99}] => (Allow) C:\Windows\System32\lxdbcoms.exe
    FirewallRules: [{8D1C7B49-C381-4550-B2BE-E4EE22167B34}] => (Allow) C:\Windows\System32\spool\drivers\x64\3\lxdbpswx.exe
    FirewallRules: [{2916B473-DF6B-458C-B41E-F85CC6FC8323}] => (Allow) C:\Windows\System32\spool\drivers\x64\3\lxdbpswx.exe
    FirewallRules: [{36F4ED32-684C-4802-8D96-D100011FEC0B}] => (Allow) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
    FirewallRules: [{CEBC5D2A-8BA9-4887-8345-78A37B9317E1}] => (Allow) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
    FirewallRules: [{04571419-0A36-4653-A059-CA1DC1381894}] => (Allow) C:\Program Files (x86)\EpsonNet\EpsonNet Setup\tool10\ENEasyApp.exe
    FirewallRules: [{24018CCD-8012-4613-9263-158C940FF7EE}] => (Allow) C:\Program Files (x86)\EpsonNet\EpsonNet Setup\tool10\ENEasyApp.exe
    FirewallRules: [TCP Query User{308B603B-5966-44A6-9264-C690374408C7}D:\common\driver update\edupdate.exe] => (Allow) D:\common\driver update\edupdate.exe
    FirewallRules: [UDP Query User{D1E302F4-6D01-492F-BF27-A47A7973E015}D:\common\driver update\edupdate.exe] => (Allow) D:\common\driver update\edupdate.exe
    FirewallRules: [TCP Query User{6F5C2C91-CCE1-49A5-995D-EFE441B0D738}C:\program files (x86)\epson software\event manager\eeventmanager.exe] => (Allow) C:\program files (x86)\epson software\event manager\eeventmanager.exe
    FirewallRules: [UDP Query User{4BAED64E-A588-4C7F-B491-BF0F3DB128B3}C:\program files (x86)\epson software\event manager\eeventmanager.exe] => (Allow) C:\program files (x86)\epson software\event manager\eeventmanager.exe
    FirewallRules: [TCP Query User{9F434B64-5201-479E-8F3C-B40F759C2E71}C:\windows\syswow64\msiexec.exe] => (Allow) C:\windows\syswow64\msiexec.exe
    FirewallRules: [UDP Query User{6AE359A2-D450-4E3C-9AF1-55D995355106}C:\windows\syswow64\msiexec.exe] => (Allow) C:\windows\syswow64\msiexec.exe
    FirewallRules: [{2727304C-2BD1-45AF-A226-F6A8D9C22580}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdater.exe
    FirewallRules: [{BA134C11-FA2A-4CE3-9CE2-494F0B1CCA50}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
    FirewallRules: [{BC05E73F-B080-452C-B93B-A769D25C1DCF}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
    FirewallRules: [{ACFE8DF7-A332-485F-A453-F061445889BD}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
    FirewallRules: [{DB4D48C7-A8D4-4052-8501-96F6DBD0562C}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
    FirewallRules: [{570E300A-8EB8-4318-BB81-19FDCF191021}] => (Allow) C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
    FirewallRules: [{807140A2-9538-407D-ADD0-AA344E9A618E}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

    ==================== Restore Points =========================

    09-03-2017 15:33:04 Installed TurboTax 2016 wrapper
    09-03-2017 15:42:48 Installed TurboTax 2016 wpaiper
    19-03-2017 21:15:38 Restore Operation
    27-03-2017 18:17:39 Restore Point Created by FRST
    28-03-2017 14:23:14 Restore Point Created by FRST
    28-03-2017 14:43:06 JRT Pre-Junkware Removal
    29-03-2017 14:49:57 Installed Microsoft Fix it 50692
    29-03-2017 14:53:29 Restore Point Created by FRST

    ==================== Faulty Device Manager Devices =============

    Name: HP OfficeJet Pro 8710
    Description: HP OfficeJet Pro 8710
    Class Guid: 
    Manufacturer: 
    Service: 
    Problem: : The drivers for this device are not installed. (Code 28)
    Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

    Name: hp LaserJet 4200
    Description: hp LaserJet 4200
    Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
    Manufacturer: Hewlett-Packard
    Service: 
    Problem: : This device is disabled. (Code 22)
    Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (03/27/2017 06:18:08 PM) (Source: Windows Search Service) (EventID: 7010) (User: )
    Description: The index cannot be initialized.

    Details:
        The content index catalog is corrupt.  (HRESULT : 0xc0041801) (0xc0041801)

    Error: (03/27/2017 06:18:08 PM) (Source: Windows Search Service) (EventID: 3058) (User: )
    Description: The application cannot be initialized.

    Context: Windows Application

    Details:
        The content index catalog is corrupt.  (HRESULT : 0xc0041801) (0xc0041801)

    Error: (03/27/2017 06:18:08 PM) (Source: Windows Search Service) (EventID: 3028) (User: )
    Description: The gatherer object cannot be initialized.

    Context: Windows Application, SystemIndex Catalog

    Details:
        The content index catalog is corrupt.  (HRESULT : 0xc0041801) (0xc0041801)

    Error: (03/27/2017 06:18:08 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
    Description: The plug-in in <Search.TripoliIndexer> cannot be initialized.

    Context: Windows Application, SystemIndex Catalog

    Details:
        Element not found.  (HRESULT : 0x80070490) (0x80070490)

    Error: (03/27/2017 06:18:08 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
    Description: The plug-in in <Search.JetPropStore> cannot be initialized.

    Context: Windows Application, SystemIndex Catalog

    Details:
        The content index catalog is corrupt.  (HRESULT : 0xc0041801) (0xc0041801)

    Error: (03/27/2017 06:18:08 PM) (Source: Windows Search Service) (EventID: 9002) (User: )
    Description: The Windows Search Service cannot load the property store information.

    Context: Windows Application, SystemIndex Catalog

    Details:
        The content index database is corrupt.  (HRESULT : 0xc0041800) (0xc0041800)

    Error: (03/27/2017 06:18:08 PM) (Source: Windows Search Service) (EventID: 7042) (User: )
    Description: The Windows Search Service is being stopped because there is a problem with the indexer: The catalog is corrupt.

    Details:
        The content index catalog is corrupt.  (HRESULT : 0xc0041801) (0xc0041801)

    Error: (03/27/2017 06:18:08 PM) (Source: Windows Search Service) (EventID: 7040) (User: )
    Description: The search service has detected corrupted data files in the index {id=4700}. The service will attempt to automatically correct this problem by rebuilding the index.

    Details:
        The content index catalog is corrupt.  (HRESULT : 0xc0041801) (0xc0041801)

    Error: (03/27/2017 06:18:07 PM) (Source: Windows Search Service) (EventID: 9000) (User: )
    Description: The Windows Search Service cannot open the Jet property store.

    Details:
        0x%08x (0xc0041800 - The content index database is corrupt.  (HRESULT : 0xc0041800))

    Error: (03/27/2017 06:18:07 PM) (Source: ESENT) (EventID: 455) (User: )
    Description: Windows (3904) Windows: Error -1811 occurred while opening logfile C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS00117.log.


    System errors:
    =============
    Error: (03/29/2017 02:56:29 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
    Description: The following boot-start or system-start driver(s) failed to load: 
    Sophos Endpoint Defense

    Error: (03/29/2017 02:55:36 PM) (Source: Service Control Manager) (EventID: 7002) (User: )
    Description: The BrPar service depends on the Parallel arbitrator group and no member of this group started.

    Error: (03/29/2017 02:55:20 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: The Sophos Web Intelligence Update service failed to start due to the following error: 
    The system cannot find the file specified.

    Error: (03/29/2017 02:54:29 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: The Print Spooler service failed to start due to the following error: 
    The service did not start due to a logon failure.

    Error: (03/29/2017 02:54:29 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
    Description: The Spooler service was unable to log on as NT AUTHORITY\SYSTEM with the currently configured password due to the following error: 
    The request is not supported.


    To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).

    Error: (03/29/2017 02:54:28 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: The SQL Server Browser service failed to start due to the following error: 
    The service did not start due to a logon failure.

    Error: (03/29/2017 02:54:28 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
    Description: The SQLBrowser service was unable to log on as NT AUTHORITY\NetworkService with the currently configured password due to the following error: 
    The request is not supported.


    To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).

    Error: (03/29/2017 02:53:59 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
    Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Search service, but this action failed with the following error: 
    An instance of the service is already running.

    Error: (03/29/2017 02:53:38 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
    Description: The ZAM Controller Service service terminated unexpectedly.  It has done this 1 time(s).

    Error: (03/29/2017 02:53:29 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
    Description: The Windows Presentation Foundation Font Cache 3.0.0.0 service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 0 milliseconds: Restart the service.


    ==================== Memory info =========================== 

    Processor: Pentium(R) Dual-Core CPU T4300 @ 2.10GHz
    Percentage of memory in use: 69%
    Total physical RAM: 4056.36 MB
    Available physical RAM: 1232.37 MB
    Total Virtual: 8110.91 MB
    Available Virtual: 5501.28 MB

    ==================== Drives ================================

    Drive c: (OS) (Fixed) (Total:446.59 GB) (Free:330.55 GB) NTFS

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (Size: 465.8 GB) (Disk ID: 2B391CB6)
    Partition 1: (Not Active) - (Size=298 MB) - (Type=DE)
    Partition 2: (Active) - (Size=18.9 GB) - (Type=07 NTFS)
    Partition 3: (Not Active) - (Size=446.6 GB) - (Type=07 NTFS)

    ==================== End of Addition.txt ============================

    Very slow, CPU maxxed, and mouse locks up

    in Resolved Malware Removal Logs

    Posted

    Fix result of Farbar Recovery Scan Tool (x64) Version: 15-03-2017
    Ran by Roland (29-03-2017 14:53:28) Run:4
    Running from C:\Users\Roland\Desktop
    Loaded Profiles: Roland (Available Profiles: Roland)
    Boot Mode: Normal
    ==============================================

    fixlist content:
    *****************
    Start
    CloseProcesses:
    CreateRestorePoint:
    ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
    ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
    SearchScopes: HKLM -> DefaultScope {992B097A-F42C-4068-9B57-8F0F69F735AA} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
    SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
    SearchScopes: HKLM -> {598DAE95-DAD6-4990-A6FA-89F5528F5FBC} URL = 
    SearchScopes: HKLM -> {992B097A-F42C-4068-9B57-8F0F69F735AA} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
    SearchScopes: HKLM-x32 -> DefaultScope {992B097A-F42C-4068-9B57-8F0F69F735AA} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
    SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
    SearchScopes: HKLM-x32 -> {992B097A-F42C-4068-9B57-8F0F69F735AA} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
    SearchScopes: HKU\S-1-5-21-3236689562-672039265-411895171-1000 -> x-osid:1:search:3F3D596FB2A545659B3F13D7CEB86011 URL = 
    SearchScopes: HKU\S-1-5-21-3236689562-672039265-411895171-1000 -> {992B097A-F42C-4068-9B57-8F0F69F735AA} URL = 
    FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF => not found
    FF HKLM\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF => not found
    CHR HomePage: Default -> bing.com/?pc=__PARAM__
    CHR NewTab: Default ->  Not-active:"chrome-extension://keeehhjhphcojjapflaajmgbnkgibaba/newtab/blank.html", Not-active:"chrome-extension://khimdpalkmijiicmeogdijibkkmlhfol/stubby.html", Not-active:"chrome-extension://kgfgkmglngfjihijajckoidgoglmajan/newtab/newtab.html"
    CHR DefaultSearchURL: Default -> hxxp://srchnet.com/search/{searchTerms}
    CHR Extension: (Avast Online Security) - C:\Users\Roland\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2017-03-19]
    CHR Extension: (Bing) - C:\Users\Roland\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfedoihopcjdfjihhhojdclnfdgomdho [2016-08-31]
    R1 aswbidsdriver; C:\Windows\system32\drivers\aswbidsdrivera.sys [309272 2017-03-19] (AVAST Software s.r.o.)
    R0 aswbidsh; C:\Windows\system32\drivers\aswbidsha.sys [189768 2017-03-19] (AVAST Software s.r.o.)
    R0 aswblog; C:\Windows\system32\drivers\aswbloga.sys [334600 2017-03-19] (AVAST Software s.r.o.)
    R0 aswbuniv; C:\Windows\system32\drivers\aswbuniva.sys [48528 2017-03-19] (AVAST Software s.r.o.)
    S3 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [38296 2017-03-19] (AVAST Software)
    R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [32088 2017-03-19] (AVAST Software)
    R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [126600 2017-03-19] (AVAST Software)
    R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [100640 2017-03-19] (AVAST Software)
    R0 aswRvrt; C:\Windows\system32\drivers\aswRvrt.sys [75704 2017-03-19] (AVAST Software)
    R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [993608 2017-03-19] (AVAST Software)
    R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [548928 2017-03-21] (AVAST Software)
    R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [162528 2017-03-19] (AVAST Software)
    R0 aswVmm; C:\Windows\system32\drivers\aswVmm.sys [337592 2017-03-19] (AVAST Software)
    C:\Windows\system32\drivers\aswbidsdrivera.sys
    C:\Windows\system32\drivers\aswbidsha.sys
    C:\Windows\system32\drivers\aswbloga.sys
    C:\Windows\system32\drivers\aswbuniva.sys
    C:\Windows\system32\drivers\aswHwid.sys
    C:\Windows\system32\drivers\aswKbd.sys 
    C:\Windows\system32\drivers\aswMonFlt.sys
    C:\Windows\system32\drivers\aswRdr2.sys
    C:\Windows\system32\drivers\aswRvrt.sys
    C:\Windows\system32\drivers\aswSnx.sys
    C:\Windows\system32\drivers\aswSP.sys
    C:\Windows\system32\drivers\aswStm.sys
    C:\Windows\system32\drivers\aswVmm.sys
    R1 SAVOnAccess; C:\Windows\System32\DRIVERS\savonaccess.sys [201168 2017-02-03] (Sophos Limited)
    C:\Windows\System32\DRIVERS\savonaccess.sys
    R0 Sophos Endpoint Defense; C:\Windows\System32\DRIVERS\SophosED.sys [200760 2017-02-03] (Sophos Limited)
    C:\Windows\System32\DRIVERS\SophosED.sys
    S4 SophosBootDriver; C:\Windows\System32\DRIVERS\SophosBootDriver.sys [27904 2016-04-16] (Sophos Limited)
    C:\Windows\System32\DRIVERS\SophosBootDriver.sys
    C:\Program Files (x86)\Eusing Free Registry Cleaner
    C:\Program Files\AVAST Software
    C:\6b250ebe7832362a99249059 
    C:\Program Files\Sophos
    C:\ProgramData\Sophos
    C:\Program Files (x86)\Sophos
    2017-03-19 21:52 - 2015-12-10 17:04 - 00547904 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.148997492429004
    2017-03-19 21:52 - 2015-12-10 17:04 - 00337592 _____ (AVAST Software) C:\Windows\system32\Drivers\aswvmm.sys.148997492880006
    AV: Microsoft Security Essentials (Enabled - Up to date) {3F839487-C7A2-C958-E30C-E2825BA31FB5}
    Task: {42D84E80-EF07-499A-84A4-7ED19604493F} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2017-01-27] (AVAST Software)
    EmptyTemp:
    end
    *****************

    Processes closed successfully.
    Restore point was successfully created.
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00asw => key not found. 
    HKCR\CLSID\{472083B0-C522-11CF-8763-00608CC02F24} => key not found. 
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00avast => key not found. 
    HKCR\CLSID\{472083B0-C522-11CF-8763-00608CC02F24} => key not found. 
    HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
    HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found. 
    HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found. 
    HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{598DAE95-DAD6-4990-A6FA-89F5528F5FBC} => key not found. 
    HKCR\CLSID\{598DAE95-DAD6-4990-A6FA-89F5528F5FBC} => key not found. 
    HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{992B097A-F42C-4068-9B57-8F0F69F735AA} => key not found. 
    HKCR\CLSID\{992B097A-F42C-4068-9B57-8F0F69F735AA} => key not found. 
    HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
    HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found. 
    HKCR\Wow6432Node\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found. 
    HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{992B097A-F42C-4068-9B57-8F0F69F735AA} => key not found. 
    HKCR\Wow6432Node\CLSID\{992B097A-F42C-4068-9B57-8F0F69F735AA} => key not found. 
    HKU\S-1-5-21-3236689562-672039265-411895171-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\x-osid:1:search:3F3D596FB2A545659B3F13D7CEB86011 => key not found. 
    HKCR\CLSID\x-osid:1:search:3F3D596FB2A545659B3F13D7CEB86011 => key not found. 
    HKU\S-1-5-21-3236689562-672039265-411895171-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{992B097A-F42C-4068-9B57-8F0F69F735AA} => key not found. 
    HKCR\CLSID\{992B097A-F42C-4068-9B57-8F0F69F735AA} => key not found. 
    HKLM\Software\Mozilla\Firefox\Extensions\\wrc@avast.com => value not found.
    HKLM\Software\Mozilla\Firefox\Extensions\\sp@avast.com => value not found.
    Chrome HomePage => removed successfully
    Chrome NewTab => removed successfully
    Chrome DefaultSearchURL => removed successfully
    C:\Users\Roland\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki => not found
    C:\Users\Roland\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfedoihopcjdfjihhhojdclnfdgomdho => moved successfully
    aswbidsdriver => service not found.
    aswbidsh => service not found.
    aswblog => service not found.
    aswbuniv => service not found.
    aswHwid => service not found.
    aswKbd => service not found.
    aswMonFlt => service not found.
    aswRdr => service not found.
    aswRvrt => service not found.
    aswSnx => service not found.
    aswSP => service not found.
    aswStm => service not found.
    aswVmm => service not found.
    "C:\Windows\system32\drivers\aswbidsdrivera.sys" => not found.
    "C:\Windows\system32\drivers\aswbidsha.sys" => not found.
    "C:\Windows\system32\drivers\aswbloga.sys" => not found.
    "C:\Windows\system32\drivers\aswbuniva.sys" => not found.
    "C:\Windows\system32\drivers\aswHwid.sys" => not found.
    "C:\Windows\system32\drivers\aswKbd.sys" => not found.
    "C:\Windows\system32\drivers\aswMonFlt.sys" => not found.
    "C:\Windows\system32\drivers\aswRdr2.sys" => not found.
    "C:\Windows\system32\drivers\aswRvrt.sys" => not found.
    "C:\Windows\system32\drivers\aswSnx.sys" => not found.
    "C:\Windows\system32\drivers\aswSP.sys" => not found.
    "C:\Windows\system32\drivers\aswStm.sys" => not found.
    "C:\Windows\system32\drivers\aswVmm.sys" => not found.
    SAVOnAccess => Unable to stop service.
    HKLM\System\CurrentControlSet\Services\SAVOnAccess => key removed successfully
    SAVOnAccess => service removed successfully
    C:\Windows\System32\DRIVERS\savonaccess.sys => moved successfully
    Sophos Endpoint Defense => Unable to stop service.
    HKLM\System\CurrentControlSet\Services\Sophos Endpoint Defense => key could not remove, key could be protected
    C:\Windows\System32\DRIVERS\SophosED.sys => moved successfully
    HKLM\System\CurrentControlSet\Services\SophosBootDriver => key removed successfully
    SophosBootDriver => service removed successfully
    C:\Windows\System32\DRIVERS\SophosBootDriver.sys => moved successfully
    C:\Program Files (x86)\Eusing Free Registry Cleaner => moved successfully
    "C:\Program Files\AVAST Software" => not found.
    C:\6b250ebe7832362a99249059 => moved successfully
    C:\Program Files\Sophos => moved successfully
    C:\ProgramData\Sophos => moved successfully
    C:\Program Files (x86)\Sophos => moved successfully
    C:\Windows\system32\Drivers\aswsp.sys.148997492429004 => moved successfully
    C:\Windows\system32\Drivers\aswvmm.sys.148997492880006 => moved successfully
    AV: Microsoft Security Essentials (Enabled - Up to date) {3F839487-C7A2-C958-E30C-E2825BA31FB5} => removed successfully
    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{42D84E80-EF07-499A-84A4-7ED19604493F} => key removed successfully
    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{42D84E80-EF07-499A-84A4-7ED19604493F} => key removed successfully
    C:\Windows\System32\Tasks\AVAST Software\Avast settings backup => moved successfully
    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AVAST Software\Avast settings backup => key removed successfully

    =========== EmptyTemp: ==========

    BITS transfer queue => 0 B
    DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 10637912 B
    Java, Flash, Steam htmlcache => 0 B
    Windows/system/drivers => 6003 B
    Edge => 0 B
    Chrome => 73663058 B
    Firefox => 0 B
    Opera => 0 B

    Temp, IE cache, history, cookies, recent:
    Users => 0 B
    Default => 0 B
    Public => 0 B
    ProgramData => 0 B
    systemprofile => 128 B
    systemprofile32 => 0 B
    LocalService => 0 B
    NetworkService => 0 B
    Roland => 3390991 B

    RecycleBin => 0 B
    EmptyTemp: => 83.6 MB temporary data Removed.

    ================================

    Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 29-03-2017 14:56:47)


    Result of scheduled keys to remove after reboot:

    HKLM\System\CurrentControlSet\Services\Sophos Endpoint Defense => key removed successfully

    ==== End of Fixlog 14:56:47 ====

     

    It just takes forever to load windows on startup. So there must be a lost of processes being started...

    Very slow, CPU maxxed, and mouse locks up

    in Resolved Malware Removal Logs

    Posted

    Emsisoft Emergency Kit - Version 2017.2
    Scan log

    Date    Scan Method    Objects Scanned    Objects Detected    Duration    Type    Computer Name    
    3/28/2017 3:12:27 PM    Malware    137137    2    0:08:47    Manual scan    ROLAND-PC    
     

    Fix result of Farbar Recovery Scan Tool (x64) Version: 15-03-2017
    Ran by Roland (28-03-2017 14:23:08) Run:3
    Running from C:\Users\Roland\Desktop
    Loaded Profiles: Roland (Available Profiles: Roland)
    Boot Mode: Normal
    ==============================================

    fixlist content:
    *****************
    Start
    CloseProcesses:
    CreateRestorePoint:
    ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
    ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
    SearchScopes: HKLM -> DefaultScope {992B097A-F42C-4068-9B57-8F0F69F735AA} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
    SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
    SearchScopes: HKLM -> {598DAE95-DAD6-4990-A6FA-89F5528F5FBC} URL = 
    SearchScopes: HKLM -> {992B097A-F42C-4068-9B57-8F0F69F735AA} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
    SearchScopes: HKLM-x32 -> DefaultScope {992B097A-F42C-4068-9B57-8F0F69F735AA} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
    SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
    SearchScopes: HKLM-x32 -> {992B097A-F42C-4068-9B57-8F0F69F735AA} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
    SearchScopes: HKU\S-1-5-21-3236689562-672039265-411895171-1000 -> x-osid:1:search:3F3D596FB2A545659B3F13D7CEB86011 URL = 
    SearchScopes: HKU\S-1-5-21-3236689562-672039265-411895171-1000 -> {992B097A-F42C-4068-9B57-8F0F69F735AA} URL = 
    FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF => not found
    FF HKLM\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF => not found
    CHR HomePage: Default -> bing.com/?pc=__PARAM__
    CHR NewTab: Default ->  Not-active:"chrome-extension://keeehhjhphcojjapflaajmgbnkgibaba/newtab/blank.html", Not-active:"chrome-extension://khimdpalkmijiicmeogdijibkkmlhfol/stubby.html", Not-active:"chrome-extension://kgfgkmglngfjihijajckoidgoglmajan/newtab/newtab.html"
    CHR DefaultSearchURL: Default -> hxxp://srchnet.com/search/{searchTerms}
    CHR Extension: (Avast Online Security) - C:\Users\Roland\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2017-03-19]
    CHR Extension: (Bing) - C:\Users\Roland\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfedoihopcjdfjihhhojdclnfdgomdho [2016-08-31]
    R1 aswbidsdriver; C:\Windows\system32\drivers\aswbidsdrivera.sys [309272 2017-03-19] (AVAST Software s.r.o.)
    R0 aswbidsh; C:\Windows\system32\drivers\aswbidsha.sys [189768 2017-03-19] (AVAST Software s.r.o.)
    R0 aswblog; C:\Windows\system32\drivers\aswbloga.sys [334600 2017-03-19] (AVAST Software s.r.o.)
    R0 aswbuniv; C:\Windows\system32\drivers\aswbuniva.sys [48528 2017-03-19] (AVAST Software s.r.o.)
    S3 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [38296 2017-03-19] (AVAST Software)
    R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [32088 2017-03-19] (AVAST Software)
    R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [126600 2017-03-19] (AVAST Software)
    R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [100640 2017-03-19] (AVAST Software)
    R0 aswRvrt; C:\Windows\system32\drivers\aswRvrt.sys [75704 2017-03-19] (AVAST Software)
    R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [993608 2017-03-19] (AVAST Software)
    R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [548928 2017-03-21] (AVAST Software)
    R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [162528 2017-03-19] (AVAST Software)
    R0 aswVmm; C:\Windows\system32\drivers\aswVmm.sys [337592 2017-03-19] (AVAST Software)
    C:\Windows\system32\drivers\aswbidsdrivera.sys
    C:\Windows\system32\drivers\aswbidsha.sys
    C:\Windows\system32\drivers\aswbloga.sys
    C:\Windows\system32\drivers\aswbuniva.sys
    C:\Windows\system32\drivers\aswHwid.sys
    C:\Windows\system32\drivers\aswKbd.sys 
    C:\Windows\system32\drivers\aswMonFlt.sys
    C:\Windows\system32\drivers\aswRdr2.sys
    C:\Windows\system32\drivers\aswRvrt.sys
    C:\Windows\system32\drivers\aswSnx.sys
    C:\Windows\system32\drivers\aswSP.sys
    C:\Windows\system32\drivers\aswStm.sys
    C:\Windows\system32\drivers\aswVmm.sys
    R1 SAVOnAccess; C:\Windows\System32\DRIVERS\savonaccess.sys [201168 2017-02-03] (Sophos Limited)
    C:\Windows\System32\DRIVERS\savonaccess.sys
    R0 Sophos Endpoint Defense; C:\Windows\System32\DRIVERS\SophosED.sys [200760 2017-02-03] (Sophos Limited)
    C:\Windows\System32\DRIVERS\SophosED.sys
    S4 SophosBootDriver; C:\Windows\System32\DRIVERS\SophosBootDriver.sys [27904 2016-04-16] (Sophos Limited)
    C:\Windows\System32\DRIVERS\SophosBootDriver.sys
    C:\Program Files (x86)\Eusing Free Registry Cleaner
    C:\Program Files\AVAST Software
    C:\6b250ebe7832362a99249059 
    C:\Program Files\Sophos
    C:\ProgramData\Sophos
    C:\Program Files (x86)\Sophos
    2017-03-19 21:52 - 2015-12-10 17:04 - 00547904 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.148997492429004
    2017-03-19 21:52 - 2015-12-10 17:04 - 00337592 _____ (AVAST Software) C:\Windows\system32\Drivers\aswvmm.sys.148997492880006
    AV: Microsoft Security Essentials (Enabled - Up to date) {3F839487-C7A2-C958-E30C-E2825BA31FB5}
    Task: {42D84E80-EF07-499A-84A4-7ED19604493F} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2017-01-27] (AVAST Software)
    EmptyTemp:
    end
    *****************

    Processes closed successfully.
    Restore point was successfully created.
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00asw => key removed successfully
    HKCR\CLSID\{472083B0-C522-11CF-8763-00608CC02F24} => key not found. 
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00avast => key removed successfully
    HKCR\CLSID\{472083B0-C522-11CF-8763-00608CC02F24} => key not found. 
    HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
    HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key removed successfully
    HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found. 
    HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{598DAE95-DAD6-4990-A6FA-89F5528F5FBC} => key removed successfully
    HKCR\CLSID\{598DAE95-DAD6-4990-A6FA-89F5528F5FBC} => key not found. 
    HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{992B097A-F42C-4068-9B57-8F0F69F735AA} => key removed successfully
    HKCR\CLSID\{992B097A-F42C-4068-9B57-8F0F69F735AA} => key not found. 
    HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
    HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key removed successfully
    HKCR\Wow6432Node\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => key not found. 
    HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{992B097A-F42C-4068-9B57-8F0F69F735AA} => key removed successfully
    HKCR\Wow6432Node\CLSID\{992B097A-F42C-4068-9B57-8F0F69F735AA} => key not found. 
    HKU\S-1-5-21-3236689562-672039265-411895171-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\x-osid:1:search:3F3D596FB2A545659B3F13D7CEB86011 => key removed successfully
    HKCR\CLSID\x-osid:1:search:3F3D596FB2A545659B3F13D7CEB86011 => key not found. 
    HKU\S-1-5-21-3236689562-672039265-411895171-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{992B097A-F42C-4068-9B57-8F0F69F735AA} => key removed successfully
    HKCR\CLSID\{992B097A-F42C-4068-9B57-8F0F69F735AA} => key not found. 
    HKLM\Software\Mozilla\Firefox\Extensions\\wrc@avast.com => value removed successfully
    HKLM\Software\Mozilla\Firefox\Extensions\\sp@avast.com => value removed successfully
    Chrome HomePage => removed successfully
    Chrome NewTab => removed successfully
    Chrome DefaultSearchURL => removed successfully
    C:\Users\Roland\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki => moved successfully
    C:\Users\Roland\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfedoihopcjdfjihhhojdclnfdgomdho => moved successfully
    aswbidsdriver => Unable to stop service.
    HKLM\System\CurrentControlSet\Services\aswbidsdriver => key could not remove, key could be protected
    aswbidsh => Unable to stop service.
    HKLM\System\CurrentControlSet\Services\aswbidsh => key could not remove, key could be protected
    aswblog => Unable to stop service.
    HKLM\System\CurrentControlSet\Services\aswblog => key could not remove, key could be protected
    aswbuniv => Unable to stop service.
    HKLM\System\CurrentControlSet\Services\aswbuniv => key could not remove, key could be protected
    HKLM\System\CurrentControlSet\Services\aswHwid => key could not remove, key could be protected
    aswKbd => Unable to stop service.
    HKLM\System\CurrentControlSet\Services\aswKbd => key could not remove, key could be protected
                                                                                                                                                                                                                                                                                    
    Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 28-03-2017 14:27:51)

    ==> ATTENTION: ATTENTION: System is not rebooted.

    Result of scheduled keys to remove after reboot:

                                                                                                                                                                                                                                                                                                                                                                                                             => could not remove key.: incorrect path. 
     
     = = = =   E n d   o f   F i x l o g   1 4 : 2 7 : 5 1   = = = = 

     

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Junkware Removal Tool (JRT) by Malwarebytes
    Version: 8.1.2 (03.10.2017)
    Operating System: Windows 7 Home Premium x64 
    Ran by Roland (Administrator) on Tue 03/28/2017 at 14:43:02.06
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


    File System: 63 

    Failed to delete: C:\Users\Roland\Appdata\LocalLow\FCTB000100685 (Folder) 
    Failed to delete: C:\Program Files (x86)\pc drivers headquarters (Folder) 
    Successfully deleted: C:\ProgramData\pc drivers headquarters (Folder) 
    Successfully deleted: C:\Users\Roland\AppData\Local\{01E37EFB-A9CF-472A-8A66-380DDA78B0F6} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{0611E918-9D5D-4CDA-B6A9-ABA84E237579} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{07B6C054-CE28-4225-8B30-FD3823CD8D05} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{0B47C94D-E38E-46D2-88C0-7F9A4E546674} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{1523C13E-4104-4ACA-9164-D814DF604552} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{15E0503F-B625-4745-9AD3-66DAD05DF1C8} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{1CC8F2C5-F611-4F30-9D53-0072F10517F7} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{1EB8817B-E8CB-4300-B64A-A385DAED04DF} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{204F5F6C-D3F4-4570-9EDC-E419089E88AA} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{30C6ACDA-43C2-483E-AA25-932B5ED82C73} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{35A594AF-5377-474B-9663-BCDC2D4E828B} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{39222190-A9E7-40DC-A9D8-4461C1E2606E} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{3AF52FE7-0B03-49AF-9233-EBFDF311C95C} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{40226A5D-FC16-46E4-B2C2-588992951011} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{459AB414-6143-4BC9-801E-B4525A280C1B} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{45C04332-A13C-4077-A02D-18801CE8DDB7} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{479F589B-9C82-449A-8900-0A43CBD9AA40} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{494D164C-2CFF-44D1-8583-A1CB2FFAA189} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{5B474DCE-3B84-477E-ABB4-A3C78B6B4F9D} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{60DF5603-EC94-4108-B6D3-6BE3B1B3D9BD} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{69CC3356-E8DD-40B8-9267-D47AE95E8038} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{793D04E6-D267-4413-9E5E-426A3DE59680} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{7ABA525B-C9EE-43D1-B209-B82DB9998B6D} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{7AFD01B4-C6C7-430D-9469-04B7A61CB8E7} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{7C14E444-7386-4BEC-B88D-C74B917141D9} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{833E7D69-87C0-4AE7-922D-094864E041DA} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{8C01F396-AEBC-4EC1-BFCD-FE6E72C45780} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{920B00E0-BB3E-460A-8E34-01615B98EA36} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{9520AED4-9CC8-4C19-8396-B53C23DE9C56} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{9A64A2D8-628F-4DD6-8308-0E3A855F2D0C} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{A14269AC-00B1-4E40-9106-B3984BC4FC1C} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{A9D4EAD1-28FD-4B64-BE8B-CB04B74BA26A} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{AC913F41-0680-4117-BE19-B02AE53927CE} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{AF517D25-1A92-4360-8056-6833D6B0ECD2} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{B1979E48-C6A3-4786-9B3D-204EACFD44C4} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{B1C670C7-8A5E-4C24-A0B6-9C939F27FDDD} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{B2C98C58-E9DC-41E9-8790-722C76CAEB19} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{B5E00C4B-BDE4-4463-9C8A-86D321B2E340} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{BC2ABD31-1679-4FC8-8FB1-0BD4C13885EC} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{D059B5B0-6E1A-4129-96DD-15755AA7D89C} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{D0C6D325-B75B-4849-8D5E-774F026BB5A5} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{D5E7C8A8-1B2F-48C4-AA90-B50DCA4F355E} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{D801FDD4-DB3D-4CFA-9531-EA4A260BBC97} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{E2130CE9-05E1-48FB-870B-A3E55332A2D7} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{E9474D49-E1C8-4458-849F-0FA47C447FB1} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{EF623AD3-6007-44D0-A842-5A923657421F} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{F07844FA-C8A7-4CE9-8CB5-E2ED28C81626} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{F3089F29-4530-429B-82D4-42012087F02B} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{F695C53C-4D40-43CF-8CC4-55C30357B7EA} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{FC2C7216-3B7F-48DD-9E59-855DBCC84A8B} (Empty Folder)
    Successfully deleted: C:\Users\Roland\AppData\Local\{FF77A4CF-DB37-4E06-B9F1-30F4C895EA09} (Empty Folder)
    Successfully deleted: C:\Windows\wininit.ini (File) 
    Successfully deleted: C:\Users\Roland\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4VWXYMIA (Temporary Internet Files Folder) 
    Successfully deleted: C:\Users\Roland\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HKFR8JHF (Temporary Internet Files Folder) 
    Successfully deleted: C:\Users\Roland\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J88XULPZ (Temporary Internet Files Folder) 
    Successfully deleted: C:\Users\Roland\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K0PSXRXL (Temporary Internet Files Folder) 
    Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4VWXYMIA (Temporary Internet Files Folder) 
    Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HKFR8JHF (Temporary Internet Files Folder) 
    Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J88XULPZ (Temporary Internet Files Folder) 
    Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K0PSXRXL (Temporary Internet Files Folder) 

    Registry: 1 

    Successfully deleted: HKCU\Software\Microsoft\Internet Explorer\Search\\SearchAssistant (Registry Value) 


    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Scan was completed on Tue 03/28/2017 at 14:49:33.71
    End of JRT log
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     

     

     

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.