Jump to content

MorietySquiggle

Members
  • Posts

    4
  • Joined

  • Last visited

Reputation

0 Neutral
  1. Hi, I have scanned my computer with Malwarebytes Anti-Malware Home, and it detected the following items: Trojan.Agent.ED PUP.Optional.Yontoo (13 of these) PUP.Optional.OpenCandy PUP.Optional.BundleInstaller.DW PUP.Optional.Babylon I quarentined and then deleted all the files and then re-ran Malwarebytes twice. It is saying the computer is clean now, but can I be sure that it is? Many thanks! Caroline The FRST.txt and Addition.txt files are shown below: Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:05-03-2016 01 Ran by Rosebud (administrator) on ROSEBUD-PC (07-04-2016 18:21:25) Running from C:\Users\Rosebud\Desktop Loaded Profiles: Rosebud (Available Profiles: Rosebud) Platform: Windows 10 Home (X64) Language: English (United States) Internet Explorer Version 11 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (IBM Corp.) C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe (Stardock Corporation) C:\Program Files\Dell\DellDock\DockLogin.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Eastman Kodak Company) C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Eastman Kodak Company) C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe (SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE (SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE () C:\ProgramData\DatacardService\DCService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe (McAfee, Inc.) C:\Program Files (x86)\Common Files\McAfee\McProxy\McProxy.exe (SoftThinks) C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe () C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE (Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe (Dell Inc.) C:\Program Files\Dell\Dell Wireless WLAN Card\BCMWLTRY.EXE (Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe (Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe (Dell Inc.) C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.EXE (Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Eastman Kodak Company) C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe (Huawei Technologies Co., Ltd.) C:\Users\Rosebud\AppData\Roaming\Telekom Internet Manager\ouc.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.11.309\SSScheduler.exe (SourceForge.net) C:\Program Files (x86)\Password Safe\pwsafe.exe (IBM Corp.) C:\Program Files (x86)\Trusteer\Rapport\bin\RapportService.exe () C:\Program Files (x86)\Common Files\Freemake Shared\ProductUpdater\ProductUpdater.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_21_0_0_197.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_21_0_0_197.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) C:\Windows\SoftwareDistribution\Download\Install\AM_Delta_Patch_1.217.848.0.exe (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Whitelisted) =========================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [305664 2009-01-23] (Alps Electric Co., Ltd.) HKLM\...\Run: [IgfxTray] => C:\Windows\system32\igfxtray.exe HKLM\...\Run: [HotKeysCmds] => C:\Windows\system32\hkcmd.exe HKLM\...\Run: [Persistence] => C:\Windows\system32\igfxpers.exe HKLM\...\Run: [Broadcom Wireless Manager UI] => C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.exe [4968960 2009-07-17] (Dell Inc.) HKLM\...\Run: [QuickSet] => C:\Program Files\Dell\QuickSet\QuickSet.exe [3180624 2009-07-03] (Dell Inc.) HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation) HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [487424 2009-11-07] (IDT, Inc.) HKLM\...\Run: [EKIJ5000StatusMonitor] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe [3182080 2012-10-08] (Eastman Kodak Company) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-12-17] (Apple Inc.) HKLM-x32\...\Run: [DellSupportCenter] => "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter HKLM-x32\...\Run: [Desktop Disc Tool] => C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe [498160 2009-10-15] () HKLM-x32\...\Run: [PDVDDXSrv] => C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe [140520 2009-06-24] (CyberLink Corp.) HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60688 2015-12-17] (Apple Inc.) HKLM-x32\...\Run: [EKStatusMonitor] => C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe [2750840 2013-12-11] (Eastman Kodak Company) HKLM-x32\...\Run: [EKIJ5000StatusMonitor] => C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe HKLM-x32\...\Run: [DataCardMonitor] => C:\Program Files (x86)\Telekom\InternetManager_H\DataCardMonitor.exe [253952 2015-05-28] (Huawei Technologies Co., Ltd.) HKLM-x32\...\Run: [ProductUpdater] => C:\Program Files (x86)\Common Files\Freemake Shared\ProductUpdater\ProductUpdater.exe [62464 2015-06-18] () HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.) HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [25577864 2016-03-12] (Dropbox, Inc.) HKU\S-1-5-21-2778284475-3753871239-3632022125-1000\...\Run: [HW_OPENEYE_OUC_Telekom Internet Manager] => C:\Program Files (x86)\Telekom\InternetManager_H\UpdateDog\ouc.exe [110592 2009-12-31] (Huawei Technologies Co., Ltd.) HKU\S-1-5-21-2778284475-3753871239-3632022125-1000\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIILE.EXE [283232 2014-12-12] (SEIKO EPSON CORPORATION) HKU\S-1-5-21-2778284475-3753871239-3632022125-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [60688 2015-10-21] (Apple Inc.) HKU\S-1-5-21-2778284475-3753871239-3632022125-1000\...\RunOnce: [Uninstall C:\Users\Rosebud\AppData\Local\Microsoft\OneDrive\17.3.5892.0626\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Rosebud\AppData\Local\Microsoft\OneDrive\17.3.5892.0626\amd64" HKU\S-1-5-21-2778284475-3753871239-3632022125-1000\...\RunOnce: [Uninstall C:\Users\Rosebud\AppData\Local\Microsoft\OneDrive\17.3.5951.0827\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Rosebud\AppData\Local\Microsoft\OneDrive\17.3.5951.0827\amd64" HKU\S-1-5-21-2778284475-3753871239-3632022125-1000\...\RunOnce: [Uninstall C:\Users\Rosebud\AppData\Local\Microsoft\OneDrive\17.3.6201.1019\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Rosebud\AppData\Local\Microsoft\OneDrive\17.3.6201.1019\amd64" HKU\S-1-5-21-2778284475-3753871239-3632022125-1000\...\RunOnce: [Uninstall C:\Users\Rosebud\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Rosebud\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\amd64" HKU\S-1-5-21-2778284475-3753871239-3632022125-1000\...\RunOnce: [Uninstall C:\Users\Rosebud\AppData\Local\Microsoft\OneDrive\17.3.6301.0127\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Rosebud\AppData\Local\Microsoft\OneDrive\17.3.6301.0127\amd64" ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => No File ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2016-04-07] ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.309\SSScheduler.exe (McAfee, Inc.) Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk [2009-12-08] ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation) Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk [2009-12-08] ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation) Startup: C:\Users\Rosebud\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk [2016-04-07] ShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation) Startup: C:\Users\Rosebud\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Password Safe.lnk [2016-04-07] ShortcutTarget: Password Safe.lnk -> C:\Program Files (x86)\Password Safe\pwsafe.exe (SourceForge.net) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.2.103 Tcpip\..\Interfaces\{2455368d-524a-4788-a794-ba4238c28828}: [DhcpNameServer] 192.168.2.1 Tcpip\..\Interfaces\{95c991db-a653-4c8b-a9a8-09112da49dd8}: [DhcpNameServer] 192.168.2.103 Internet Explorer: ================== HKU\S-1-5-21-2778284475-3753871239-3632022125-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/USCON/2 SearchScopes: HKLM -> DefaultScope {2F850598-E7CE-42F5-971C-87C6F2DFBFCC} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox SearchScopes: HKLM -> {2F850598-E7CE-42F5-971C-87C6F2DFBFCC} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox SearchScopes: HKLM-x32 -> DefaultScope {BAF37197-DF5F-4C08-81F7-B56E6F93698F} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox SearchScopes: HKLM-x32 -> {BAF37197-DF5F-4C08-81F7-B56E6F93698F} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox SearchScopes: HKU\.DEFAULT -> DefaultScope {BAF37197-DF5F-4C08-81F7-B56E6F93698F} URL = SearchScopes: HKU\S-1-5-21-2778284475-3753871239-3632022125-1000 -> DefaultScope {2F850598-E7CE-42F5-971C-87C6F2DFBFCC} URL = SearchScopes: HKU\S-1-5-21-2778284475-3753871239-3632022125-1000 -> {2F850598-E7CE-42F5-971C-87C6F2DFBFCC} URL = SearchScopes: HKU\S-1-5-21-2778284475-3753871239-3632022125-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = SearchScopes: HKU\S-1-5-21-2778284475-3753871239-3632022125-1000 -> {BAF37197-DF5F-4C08-81F7-B56E6F93698F} URL = BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2013-05-04] (Oracle Corporation) BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2010-01-12] (Google Inc.) BHO: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2013-05-14] (Skype Technologies S.A.) BHO: Google Toolbar Notifier BHO -> {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -> C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg64.dll [2010-01-12] (Google Inc.) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2013-05-04] (Oracle Corporation) BHO-x32: Search Helper -> {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} -> C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2010-09-22] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-09-10] (Oracle Corporation) BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2010-01-12] (Google Inc.) BHO-x32: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2013-05-14] (Skype Technologies S.A.) BHO-x32: Google Toolbar Notifier BHO -> {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -> C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll [2010-01-12] (Google Inc.) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-09-10] (Oracle Corporation) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2010-01-12] (Google Inc.) Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2010-01-12] (Google Inc.) Toolbar: HKU\.DEFAULT -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2010-01-12] (Google Inc.) Toolbar: HKU\S-1-5-21-2778284475-3753871239-3632022125-1000 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File Toolbar: HKU\S-1-5-21-2778284475-3753871239-3632022125-1000 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2010-01-12] (Google Inc.) DPF: HKLM-x32 {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_IKEA_Win32.cab DPF: HKLM-x32 {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} hxxps://support.dell.com/systemprofiler/SysProExe.CAB Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2013-05-14] (Skype Technologies S.A.) Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2013-05-14] (Skype Technologies S.A.) FireFox: ======== FF ProfilePath: C:\Users\Rosebud\AppData\Roaming\Mozilla\Firefox\Profiles\nt45z5r6.default-1445328340479 FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_21_0_0_197.dll [2016-04-02] () FF Plugin: @java.com/DTPlugin,version=10.21.2 -> C:\Windows\system32\npDeployJava1.dll [2013-05-04] (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.21.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2013-05-04] (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_197.dll [2016-04-02] () FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-10-14] () FF Plugin-x32: @java.com/DTPlugin,version=10.5.1 -> C:\WINDOWS\SysWOW64\npDeployJava1.dll [2012-07-05] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-09-10] (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-04] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-04] (Google Inc.) FF Plugin-x32: @veetle.com/veetleCorePlugin,version=0.9.18 -> C:\Program Files (x86)\Veetle\plugins\npVeetle.dll [2010-10-16] (Veetle Inc) FF Plugin-x32: @veetle.com/veetlePlayerPlugin,version=0.9.18 -> C:\Program Files (x86)\Veetle\Player\npvlc.dll [2010-09-21] (Veetle Inc) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-12-18] (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-12-18] (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2015-11-01] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2015-11-01] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2015-11-01] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2015-11-01] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2015-11-01] (Apple Inc.) FF Extension: 20-20 3D Viewer - IKEA - C:\Users\Rosebud\AppData\Roaming\Mozilla\Firefox\Profiles\nt45z5r6.default-1445328340479\extensions\2020Player_IKEA@2020Technologies.com [2016-03-04] FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2016-04-07] [not signed] FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2016-04-07] [not signed] FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi [2016-04-07] [not signed] FF HKLM-x32\...\Firefox\Extensions: [litmus-ff@f-secure.com] - C:\Program Files (x86)\F-Secure\NRS\litmus-ff@f-secure.com => not found FF HKLM-x32\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files\T-Mobile\InternetManager_H\OCx64\addon => not found Chrome: ======= CHR StartupUrls: Default -> "hxxp://www.google.com/ig" CHR Profile: C:\Users\Rosebud\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Slides) - C:\Users\Rosebud\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-03-03] CHR Extension: (Google Docs) - C:\Users\Rosebud\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-03-03] CHR Extension: (Google Drive) - C:\Users\Rosebud\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-12-07] CHR Extension: (Rapport) - C:\Users\Rosebud\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbjllphbppobebmjpjcijfbakobcheof [2015-07-01] CHR Extension: (YouTube) - C:\Users\Rosebud\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-24] CHR Extension: (Google Search) - C:\Users\Rosebud\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-12-07] CHR Extension: (Google Sheets) - C:\Users\Rosebud\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-03-03] CHR Extension: (Google Docs Offline) - C:\Users\Rosebud\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-29] CHR Extension: (Pin It Button) - C:\Users\Rosebud\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpdjojdkbbmdfjfahjcgigfpmkopogic [2015-09-24] CHR Extension: (Skype Click to Call) - C:\Users\Rosebud\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2015-12-07] CHR Extension: (Chrome Web Store Payments) - C:\Users\Rosebud\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-08-14] CHR Extension: (Gmail) - C:\Users\Rosebud\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-29] CHR HKU\S-1-5-21-2778284475-3753871239-3632022125-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - <not found> CHR HKU\S-1-5-21-2778284475-3753871239-3632022125-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [bbjllphbppobebmjpjcijfbakobcheof] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2013-05-14] ==================== Services (Whitelisted) ======================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-10-07] (Apple Inc.) S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [136048 2015-11-09] (Dropbox, Inc.) S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [136048 2015-11-09] (Dropbox, Inc.) R2 DCService.exe; C:\ProgramData\DatacardService\DCService.exe [229376 2010-08-19] () [File not signed] R2 DockLoginService; C:\Program Files\Dell\DellDock\DockLogin.exe [155648 2009-06-09] (Stardock Corporation) [File not signed] S3 Garmin Device Interaction Service; C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe [708616 2015-04-08] (Garmin Ltd. or its subsidiaries) S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1514464 2016-03-10] (Malwarebytes) S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1136608 2016-03-10] (Malwarebytes) S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.309\McCHSvc.exe [293128 2016-03-11] (McAfee, Inc.) R2 McProxy; C:\Program Files (x86)\Common Files\McAfee\McProxy\McProxy.exe [359952 2009-04-09] (McAfee, Inc.) S2 NPEService; C:\Users\Rosebud\Desktop\NPE.exe [3088296 2016-04-07] (Symantec Corporation) S3 OpenVPNService; C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe [14848 2011-12-15] () [File not signed] R2 RapportMgmtService; C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe [2372080 2016-03-23] (IBM Corp.) R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [362928 2015-07-10] (Microsoft Corporation) R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-07-10] (Microsoft Corporation) R2 wltrysvc; C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwltry.exe [3417088 2009-07-17] (Dell Inc.) [File not signed] ===================== Drivers (Whitelisted) ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R3 BCM43XX; C:\Windows\System32\drivers\bcmwl63al.sys [5170176 2015-06-18] (Broadcom Corporation) S0 BMLoad; C:\Windows\System32\drivers\BMLoad.sys [16512 2009-12-15] (Bytemobile, Inc.) [File not signed] R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [27008 2016-03-10] (Malwarebytes) S3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [192216 2016-04-07] (Malwarebytes) S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [65408 2016-03-10] (Malwarebytes Corporation) R1 MPFP; C:\Windows\System32\Drivers\Mpfp.sys [176144 2009-04-09] (McAfee, Inc.) R1 RapportCerberus_1609035; C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus64_1609035.sys [1156456 2016-04-07] (IBM Corp.) R1 RapportEI64; C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys [544360 2016-03-23] (IBM Corp.) R0 RapportHades64; C:\Windows\System32\Drivers\RapportHades64.sys [215560 2016-03-23] (IBM Corp.) S3 RapportKE64; C:\Windows\System32\Drivers\RapportKE64.sys [470056 2016-03-23] (IBM Corp.) R1 RapportPG64; C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys [523432 2016-03-23] (IBM Corp.) S3 tapoas; C:\Windows\System32\DRIVERS\tapoas.sys [30720 2011-08-19] (The OpenVPN Project) R1 tcpipBM; C:\Windows\system32\drivers\tcpipBM.sys [39552 2009-12-15] (Bytemobile, Inc.) [File not signed] S3 UdeCx; C:\Windows\System32\drivers\udecx.sys [44032 2015-07-10] () S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44568 2015-07-10] (Microsoft Corporation) R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [291680 2015-07-10] (Microsoft Corporation) R2 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [119648 2015-07-10] (Microsoft Corporation) R3 yukonw8; C:\Windows\System32\drivers\yk63x64.sys [295216 2015-06-18] (Marvell) U4 aspnet_state; no ImagePath S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X] U3 wpcsvc; no ImagePath ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2016-04-07 18:18 - 2016-04-07 18:21 - 00029261 _____ C:\Users\Rosebud\Desktop\FRST.txt 2016-04-07 18:17 - 2016-04-07 18:21 - 00000000 ____D C:\FRST 2016-04-07 18:16 - 2016-04-07 18:17 - 02374144 _____ (Farbar) C:\Users\Rosebud\Desktop\FRST64.exe 2016-04-07 18:07 - 2016-04-07 18:07 - 00016148 _____ C:\WINDOWS\system32\ROSEBUD-PC_Rosebud_HistoryPrediction.bin 2016-04-07 15:10 - 2012-07-05 22:06 - 00772544 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\npDeployJava1.dll 2016-04-07 15:10 - 2012-07-05 22:06 - 00687544 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\deployJava1.dll 2016-04-07 14:38 - 2016-04-07 18:09 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2016-04-07 14:08 - 2016-04-07 14:08 - 00000000 ____D C:\NPE 2016-04-07 14:07 - 2016-04-07 18:14 - 00037942 _____ C:\WINDOWS\ntbtlog.txt 2016-04-07 13:57 - 2016-04-07 13:57 - 00000000 ____D C:\ProgramData\SMR501 2016-04-07 13:57 - 2015-08-30 17:02 - 00246772 _____ C:\WINDOWS\ntbtlog.txt.bak 2016-04-07 13:49 - 2016-04-07 13:49 - 00002011 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk 2016-04-07 13:49 - 2016-04-07 13:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus 2016-04-07 13:48 - 2016-04-07 13:49 - 00000000 ____D C:\Program Files\McAfee Security Scan 2016-04-07 13:47 - 2016-04-07 13:47 - 08597336 _____ (McAfee, Inc.) C:\Users\Rosebud\Downloads\SecurityScan_Release.exe 2016-04-07 13:33 - 2016-04-07 14:05 - 00000000 ____D C:\Users\Rosebud\AppData\Local\NPE 2016-04-07 13:33 - 2016-04-07 13:33 - 00000000 ____D C:\ProgramData\Norton 2016-04-07 13:32 - 2016-04-07 13:33 - 03088296 _____ (Symantec Corporation) C:\Users\Rosebud\Desktop\NPE.exe 2016-04-07 11:53 - 2016-04-07 11:53 - 06516656 _____ (Tim Kosse) C:\Users\Rosebud\Downloads\FileZilla_3.16.1_win64-setup.exe 2016-04-07 11:10 - 2016-04-07 14:58 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2016-04-07 11:09 - 2016-04-07 12:37 - 00001177 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2016-04-07 11:09 - 2016-04-07 11:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware 2016-04-07 11:08 - 2016-04-07 11:09 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware 2016-04-07 11:08 - 2016-04-07 11:08 - 00000000 ____D C:\ProgramData\Malwarebytes 2016-04-07 11:08 - 2016-03-10 14:09 - 00065408 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys 2016-04-07 11:08 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys 2016-04-07 11:08 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys 2016-04-07 11:07 - 2016-04-07 11:07 - 22851472 _____ (Malwarebytes ) C:\Users\Rosebud\Downloads\mbam-setup-2.2.1.1043.exe 2016-04-03 13:43 - 2016-04-03 13:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox 2016-03-10 21:13 - 2016-03-10 21:14 - 00000000 ____D C:\Users\Rosebud\AppData\Local\Comms 2016-03-10 13:54 - 2016-02-23 16:41 - 00299600 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMASF.DLL 2016-03-10 13:54 - 2016-02-23 16:07 - 22322624 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll 2016-03-10 13:54 - 2016-02-23 13:55 - 24592896 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2016-03-10 13:54 - 2016-02-23 13:45 - 06788608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll 2016-03-10 13:54 - 2016-02-23 13:14 - 00841728 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32spl.dll 2016-03-10 13:54 - 2016-02-23 12:55 - 14241792 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll 2016-03-10 13:54 - 2016-02-23 12:48 - 21859840 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll 2016-03-10 13:54 - 2016-02-23 12:48 - 05157376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll 2016-03-10 13:54 - 2016-02-23 12:11 - 12589056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll 2016-03-10 13:53 - 2016-02-23 16:53 - 01314496 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll 2016-03-10 13:53 - 2016-02-23 16:52 - 00858408 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe 2016-03-10 13:53 - 2016-02-23 16:51 - 00633184 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fvevol.sys 2016-03-10 13:53 - 2016-02-23 16:51 - 00146784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe 2016-03-10 13:53 - 2016-02-23 16:50 - 00630160 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll 2016-03-10 13:53 - 2016-02-23 16:48 - 08022368 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe 2016-03-10 13:53 - 2016-02-23 16:48 - 01294352 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi 2016-03-10 13:53 - 2016-02-23 16:48 - 01123952 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe 2016-03-10 13:53 - 2016-02-23 16:41 - 01150816 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll 2016-03-10 13:53 - 2016-02-23 16:41 - 00078040 _____ (Microsoft Corporation) C:\WINDOWS\system32\wkscli.dll 2016-03-10 13:53 - 2016-02-23 16:40 - 00110584 _____ (Microsoft Corporation) C:\WINDOWS\system32\srvcli.dll 2016-03-10 13:53 - 2016-02-23 16:38 - 00272752 _____ (Microsoft Corporation) C:\WINDOWS\system32\sqmapi.dll 2016-03-10 13:53 - 2016-02-23 16:36 - 00080128 _____ (Microsoft Corporation) C:\WINDOWS\system32\netapi32.dll 2016-03-10 13:53 - 2016-02-23 16:11 - 00781984 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfds.dll 2016-03-10 13:53 - 2016-02-23 16:11 - 00658784 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupEngine.dll 2016-03-10 13:53 - 2016-02-23 16:11 - 00103776 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupApi.dll 2016-03-10 13:53 - 2016-02-23 16:08 - 03622272 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2016-03-10 13:53 - 2016-02-23 15:39 - 00607416 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe 2016-03-10 13:53 - 2016-02-23 15:30 - 01643872 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll 2016-03-10 13:53 - 2016-02-23 15:25 - 01085632 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll 2016-03-10 13:53 - 2016-02-23 15:23 - 00952968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll 2016-03-10 13:53 - 2016-02-23 15:21 - 00529456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll 2016-03-10 13:53 - 2016-02-23 15:21 - 00141152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe 2016-03-10 13:53 - 2016-02-23 15:11 - 00249976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMASF.DLL 2016-03-10 13:53 - 2016-02-23 15:11 - 00073360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\srvcli.dll 2016-03-10 13:53 - 2016-02-23 15:11 - 00055808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wkscli.dll 2016-03-10 13:53 - 2016-02-23 15:09 - 00229352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sqmapi.dll 2016-03-10 13:53 - 2016-02-23 15:06 - 00069232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netapi32.dll 2016-03-10 13:53 - 2016-02-23 14:58 - 00150528 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe 2016-03-10 13:53 - 2016-02-23 14:50 - 00395264 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupShim.dll 2016-03-10 13:53 - 2016-02-23 14:50 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetCfgNotifyObjectHost.exe 2016-03-10 13:53 - 2016-02-23 14:42 - 00658536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfds.dll 2016-03-10 13:53 - 2016-02-23 14:42 - 00467296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupEngine.dll 2016-03-10 13:53 - 2016-02-23 14:42 - 00078176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupApi.dll 2016-03-10 13:53 - 2016-02-23 14:39 - 02879024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2016-03-10 13:53 - 2016-02-23 14:38 - 20858360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll 2016-03-10 13:53 - 2016-02-23 14:35 - 00365568 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll 2016-03-10 13:53 - 2016-02-23 14:20 - 00138240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dfsc.sys 2016-03-10 13:53 - 2016-02-23 14:17 - 00333312 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll 2016-03-10 13:53 - 2016-02-23 14:16 - 02237952 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll 2016-03-10 13:53 - 2016-02-23 14:15 - 00539728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe 2016-03-10 13:53 - 2016-02-23 14:15 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll 2016-03-10 13:53 - 2016-02-23 13:59 - 00319488 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkBindingEngineMigPlugin.dll 2016-03-10 13:53 - 2016-02-23 13:59 - 00104960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rasl2tp.sys 2016-03-10 13:53 - 2016-02-23 13:57 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupSvc.dll 2016-03-10 13:53 - 2016-02-23 13:45 - 12504576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2016-03-10 13:53 - 2016-02-23 13:42 - 00771072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll 2016-03-10 13:53 - 2016-02-23 13:42 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\system32\asycfilt.dll 2016-03-10 13:53 - 2016-02-23 13:38 - 02663424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll 2016-03-10 13:53 - 2016-02-23 13:37 - 00057344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetCfgNotifyObjectHost.exe 2016-03-10 13:53 - 2016-02-23 13:36 - 00281600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupShim.dll 2016-03-10 13:53 - 2016-02-23 13:25 - 00303104 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll 2016-03-10 13:53 - 2016-02-23 13:18 - 00031232 _____ (Microsoft Corporation) C:\WINDOWS\system32\seclogon.dll 2016-03-10 13:53 - 2016-02-23 13:17 - 00133120 _____ (Microsoft Corporation) C:\WINDOWS\system32\browser.dll 2016-03-10 13:53 - 2016-02-23 13:17 - 00058368 _____ (Microsoft Corporation) C:\WINDOWS\system32\browcli.dll 2016-03-10 13:53 - 2016-02-23 13:08 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxSysprep.dll 2016-03-10 13:53 - 2016-02-23 13:04 - 00225792 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsqmcons.exe 2016-03-10 13:53 - 2016-02-23 13:03 - 00450560 _____ (Microsoft Corporation) C:\WINDOWS\system32\werui.dll 2016-03-10 13:53 - 2016-02-23 13:03 - 00045568 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll 2016-03-10 13:53 - 2016-02-23 13:02 - 03587584 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys 2016-03-10 13:53 - 2016-02-23 12:55 - 19326464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2016-03-10 13:53 - 2016-02-23 12:51 - 00915456 _____ (Microsoft Corporation) C:\WINDOWS\system32\configurationclient.dll 2016-03-10 13:53 - 2016-02-23 12:51 - 00678912 _____ (Microsoft Corporation) C:\WINDOWS\system32\scapi.dll 2016-03-10 13:53 - 2016-02-23 12:46 - 00400384 _____ (Microsoft Corporation) C:\WINDOWS\system32\sharemediacpl.dll 2016-03-10 13:53 - 2016-02-23 12:45 - 01844736 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPDMC.exe 2016-03-10 13:53 - 2016-02-23 12:45 - 00574464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll 2016-03-10 13:53 - 2016-02-23 12:45 - 00088576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll 2016-03-10 13:53 - 2016-02-23 12:45 - 00078848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\asycfilt.dll 2016-03-10 13:53 - 2016-02-23 12:44 - 01821696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll 2016-03-10 13:53 - 2016-02-23 12:38 - 07524864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll 2016-03-10 13:53 - 2016-02-23 12:29 - 00043520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\browcli.dll 2016-03-10 13:53 - 2016-02-23 12:17 - 00393728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werui.dll 2016-03-10 13:53 - 2016-02-23 12:17 - 00037376 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll 2016-03-10 13:53 - 2016-02-23 12:03 - 01495040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPDMC.exe 2016-03-10 13:53 - 2016-02-23 12:00 - 11263488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2016-03-10 13:53 - 2016-02-23 12:00 - 05457408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll 2016-03-10 13:53 - 2016-02-23 11:58 - 18800640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2016-04-07 18:16 - 2016-03-05 14:35 - 00004162 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{3A17DBC5-3320-4871-9CD1-52CC67C6B158} 2016-04-07 18:10 - 2013-01-29 23:23 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2016-04-07 18:09 - 2012-01-22 03:01 - 00000000 ____D C:\Users\Rosebud\AppData\Local\PasswordSafe 2016-04-07 18:09 - 2011-03-15 23:36 - 00000924 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job 2016-04-07 18:07 - 2015-11-09 14:37 - 00000928 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job 2016-04-07 18:07 - 2015-10-21 19:39 - 00000000 ____D C:\Users\Rosebud 2016-04-07 18:05 - 2010-01-12 22:50 - 00000000 ____D C:\ProgramData\Kodak 2016-04-07 18:04 - 2015-07-30 23:52 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT 2016-04-07 15:52 - 2012-05-04 06:22 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job 2016-04-07 15:47 - 2015-10-22 05:32 - 00000000 ___DC C:\WINDOWS\Panther 2016-04-07 15:42 - 2015-11-09 14:37 - 00000932 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job 2016-04-07 15:34 - 2011-03-15 23:36 - 00000928 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job 2016-04-07 15:27 - 2015-10-04 20:12 - 00000000 ____D C:\Users\Rosebud\AppData\Local\CrashDumps 2016-04-07 14:41 - 2012-07-08 20:08 - 00000000 ____D C:\Caroline 2016-04-07 14:06 - 2015-07-10 11:05 - 00262144 ___SH C:\WINDOWS\system32\config\BBI 2016-04-07 13:29 - 2010-03-06 12:58 - 00000000 ____D C:\Users\Rosebud\AppData\Roaming\Dropbox 2016-04-07 12:40 - 2015-10-21 20:03 - 00955156 _____ C:\WINDOWS\system32\PerfStringBackup.INI 2016-04-07 12:40 - 2015-07-31 00:40 - 00000000 ____D C:\WINDOWS\INF 2016-04-07 12:39 - 2013-08-02 14:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trusteer Endpoint Protection 2016-04-07 12:37 - 2016-03-01 22:18 - 00000966 _____ C:\Users\Public\Desktop\Inkscape 0.91.lnk 2016-04-07 12:37 - 2016-01-16 11:20 - 00001824 _____ C:\Users\Public\Desktop\iTunes.lnk 2016-04-07 12:37 - 2015-11-01 09:45 - 00001916 _____ C:\Users\Public\Desktop\QuickTime Player.lnk 2016-04-07 12:37 - 2015-10-21 21:08 - 00002417 _____ C:\Users\Rosebud\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk 2016-04-07 12:37 - 2015-10-21 21:04 - 00001053 _____ C:\Users\Rosebud\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Optional Features.lnk 2016-04-07 12:37 - 2015-09-29 20:32 - 00002049 _____ C:\Users\Public\Desktop\Acrobat Reader DC.lnk 2016-04-07 12:37 - 2015-07-10 21:42 - 00001326 _____ C:\Users\Public\Desktop\Freemake Video Converter.lnk 2016-04-07 12:37 - 2015-05-28 12:20 - 00001278 _____ C:\Users\Public\Desktop\Telekom Internet Manager.lnk 2016-04-07 12:37 - 2015-04-10 11:51 - 00001892 _____ C:\Users\Public\Desktop\Garmin Express.lnk 2016-04-07 12:37 - 2015-02-06 15:44 - 00001146 _____ C:\Users\Public\Desktop\Icecream PDF Split and Merge.lnk 2016-04-07 12:37 - 2014-09-09 20:52 - 00001153 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk 2016-04-07 12:37 - 2014-08-30 14:31 - 00002158 _____ C:\Users\Public\Desktop\KODAK AiO Home Center.lnk 2016-04-07 12:37 - 2014-08-30 14:30 - 00002077 _____ C:\Users\Public\Desktop\Get CleanPrint.lnk 2016-04-07 12:37 - 2012-11-06 11:00 - 00001876 _____ C:\Users\Public\Desktop\PrintProjects.lnk 2016-04-07 12:37 - 2012-03-16 11:34 - 00001131 _____ C:\Users\Public\Desktop\OpenVPN GUI.lnk 2016-04-07 12:37 - 2012-01-23 16:43 - 00002491 _____ C:\Users\Public\Desktop\Safari.lnk 2016-04-07 12:37 - 2011-11-02 17:15 - 00002049 _____ C:\Users\Public\Desktop\TweakNow RegCleaner 2011.lnk 2016-04-07 12:37 - 2011-10-03 11:09 - 00001171 _____ C:\Users\Public\Desktop\WinEdt 6.lnk 2016-04-07 12:36 - 2015-10-06 12:02 - 00001063 _____ C:\Users\Rosebud\Desktop\Notepad++.lnk 2016-04-07 12:36 - 2015-05-28 12:33 - 00001278 _____ C:\Users\Rosebud\Desktop\Telekom Internet Manager.lnk 2016-04-07 12:36 - 2012-11-07 10:27 - 00001800 _____ C:\Users\Rosebud\Desktop\Google Drive.lnk 2016-04-07 12:36 - 2012-01-22 02:58 - 00001036 _____ C:\Users\Rosebud\Desktop\Password Safe.lnk 2016-04-07 12:34 - 2015-09-10 07:42 - 00000000 __RHD C:\Users\Public\AccountPictures 2016-04-07 12:30 - 2015-07-30 23:49 - 00361016 _____ C:\WINDOWS\system32\FNTCACHE.DAT 2016-04-07 12:25 - 2015-07-31 00:42 - 00000000 ____D C:\Program Files\Windows Portable Devices 2016-04-07 12:25 - 2015-07-31 00:42 - 00000000 ____D C:\Program Files\Windows Multimedia Platform 2016-04-07 12:25 - 2015-07-31 00:42 - 00000000 ____D C:\Program Files (x86)\Windows Portable Devices 2016-04-07 12:25 - 2015-07-31 00:42 - 00000000 ____D C:\Program Files (x86)\Windows Multimedia Platform 2016-04-07 12:20 - 2015-10-21 19:53 - 00001576 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk 2016-04-07 12:20 - 2015-09-29 20:32 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk 2016-04-07 12:20 - 2015-09-14 14:37 - 00001024 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla.lnk 2016-04-07 12:20 - 2014-09-02 21:41 - 00001231 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Publish or Perish 4.lnk 2016-04-07 12:20 - 2014-02-18 10:34 - 00001104 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 8.lnk 2016-04-07 12:20 - 2012-01-23 16:43 - 00002503 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Safari.lnk 2016-04-07 12:20 - 2011-10-03 11:09 - 00001183 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinEdt 6.lnk 2016-04-07 12:20 - 2011-08-25 18:58 - 00001301 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MATLAB R2011a.lnk 2016-04-07 12:20 - 2011-05-07 12:04 - 00001165 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2016-04-07 12:20 - 2011-03-15 23:38 - 00002274 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk 2016-04-07 12:20 - 2010-10-24 14:51 - 00001460 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk 2016-04-07 12:20 - 2010-10-24 14:51 - 00001376 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Photo Gallery.lnk 2016-04-07 12:20 - 2010-10-24 14:51 - 00001307 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Movie Maker.lnk 2016-04-07 12:20 - 2010-10-24 14:50 - 00002488 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk 2016-04-07 12:20 - 2010-01-22 21:22 - 00002535 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk 2016-04-07 12:20 - 2010-01-14 22:37 - 00002088 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerDVD DX.lnk 2016-04-07 12:20 - 2010-01-14 21:29 - 00002607 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Communicator 2007.lnk 2016-04-07 12:20 - 2010-01-11 21:46 - 00001979 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell Help Documentation.lnk 2016-04-07 12:20 - 2009-12-08 16:26 - 00002675 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Software Updates.lnk 2016-04-07 12:20 - 2009-12-08 16:14 - 00002557 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office PowerPoint Viewer 2007.lnk 2016-04-07 12:07 - 2015-09-14 14:41 - 00000000 ____D C:\Users\Rosebud\AppData\Roaming\FileZilla 2016-04-07 11:55 - 2015-09-14 14:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client 2016-04-07 11:55 - 2015-09-14 14:37 - 00000000 ____D C:\Program Files\FileZilla FTP Client 2016-04-07 11:55 - 2015-07-31 00:42 - 00000000 ____D C:\WINDOWS\AppReadiness 2016-04-07 11:47 - 2015-07-31 00:42 - 00000000 ___HD C:\Program Files\WindowsApps 2016-04-03 14:10 - 2015-07-31 00:42 - 00000000 ____D C:\WINDOWS\rescache 2016-04-03 13:43 - 2015-11-09 14:37 - 00000000 ____D C:\Program Files (x86)\Dropbox 2016-04-03 12:19 - 2015-07-31 00:25 - 00000000 ____D C:\WINDOWS\CbsTemp 2016-03-26 18:13 - 2014-09-09 21:00 - 00000000 __HDC C:\ProgramData\~0 2016-03-23 19:18 - 2015-06-10 21:06 - 00215560 _____ (IBM Corp.) C:\WINDOWS\system32\Drivers\RapportHades64.sys 2016-03-23 19:18 - 2011-10-04 10:36 - 00470056 _____ (IBM Corp.) C:\WINDOWS\system32\Drivers\RapportKE64.sys 2016-03-11 08:30 - 2013-08-20 20:32 - 00000000 ____D C:\WINDOWS\system32\MRT 2016-03-10 22:12 - 2010-01-14 22:20 - 143659408 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2016-03-10 21:13 - 2015-10-21 21:00 - 00000000 ____D C:\Users\Rosebud\AppData\Local\Packages 2016-03-08 09:10 - 2015-07-31 00:43 - 00829944 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2016-03-08 09:10 - 2015-07-31 00:43 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl ==================== Files in the root of some directories ======= 2010-01-22 21:05 - 2015-07-16 21:59 - 0000035 _____ () C:\Users\Rosebud\AppData\Roaming\AVSMediaPlayer.m3u 2010-09-23 11:14 - 2010-09-23 11:14 - 0000118 _____ () C:\Users\Rosebud\AppData\Roaming\jahuwaldt.Digitizer.props 2011-10-08 13:03 - 2011-10-08 13:03 - 0000600 _____ () C:\Users\Rosebud\AppData\Roaming\winscp.rnd 2010-10-28 11:58 - 2011-04-03 13:04 - 0060068 _____ () C:\Users\Rosebud\AppData\Local\c4u.log 2010-01-17 22:19 - 2013-03-11 21:33 - 0026112 _____ () C:\Users\Rosebud\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2010-01-12 22:48 - 2011-04-03 13:03 - 0176334 _____ () C:\Users\Rosebud\AppData\Local\installer.log 2011-10-08 13:03 - 2011-10-08 14:21 - 0000600 _____ () C:\Users\Rosebud\AppData\Local\PUTTY.RND 2016-03-05 14:42 - 2016-03-05 14:42 - 0001218 _____ () C:\Users\Rosebud\AppData\Local\recently-used.xbel 2012-11-16 16:28 - 2014-01-29 22:53 - 0007601 _____ () C:\Users\Rosebud\AppData\Local\Resmon.ResmonCfg 2011-06-09 11:26 - 2011-06-09 11:26 - 0000000 _____ () C:\Users\Rosebud\AppData\Local\{6D9B0A85-4F09-49B7-961C-5A2590D2ED54} 2011-10-27 10:36 - 2011-10-27 10:38 - 0000000 _____ () C:\Users\Rosebud\AppData\Local\{C8106061-8F81-4F39-B245-E381C81629F2} 2011-10-05 08:48 - 2011-10-05 08:48 - 0000000 _____ () C:\Users\Rosebud\AppData\Local\{FDAAE0E8-FCCE-481A-878C-A292B2F1139F} 2010-11-15 15:08 - 2010-11-15 15:08 - 0000056 ____H () C:\ProgramData\ezsidmv.dat Some files in TEMP: ==================== C:\Users\Rosebud\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpunhl1_.dll C:\Users\Rosebud\AppData\Local\Temp\SkypeSetup.exe C:\Users\Rosebud\AppData\Local\Temp\VideoConverter.exe ==================== Bamital & volsnap ================= (There is no automatic fix for files that do not pass verification.) C:\WINDOWS\system32\winlogon.exe => File is digitally signed C:\WINDOWS\system32\wininit.exe => File is digitally signed C:\WINDOWS\explorer.exe => File is digitally signed C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed C:\WINDOWS\system32\svchost.exe => File is digitally signed C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed C:\WINDOWS\system32\services.exe => File is digitally signed C:\WINDOWS\system32\User32.dll => File is digitally signed C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed C:\WINDOWS\system32\userinit.exe => File is digitally signed C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed C:\WINDOWS\system32\rpcss.dll => File is digitally signed C:\WINDOWS\system32\dnsapi.dll => File is digitally signed C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2016-04-02 21:51 ==================== End of FRST.txt ============================ Additional scan result of Farbar Recovery Scan Tool (x64) Version:05-03-2016 01 Ran by Rosebud (2016-04-07 18:25:29) Running from C:\Users\Rosebud\Desktop Windows 10 Home (X64) (2015-10-21 18:59:31) Boot Mode: Normal ========================================================== ==================== Accounts: ============================= Administrator (S-1-5-21-2778284475-3753871239-3632022125-500 - Administrator - Disabled) DefaultAccount (S-1-5-21-2778284475-3753871239-3632022125-503 - Limited - Disabled) Guest (S-1-5-21-2778284475-3753871239-3632022125-501 - Limited - Disabled) HomeGroupUser$ (S-1-5-21-2778284475-3753871239-3632022125-1002 - Limited - Enabled) Rosebud (S-1-5-21-2778284475-3753871239-3632022125-1000 - Administrator - Enabled) => C:\Users\Rosebud ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.010.20060 - Adobe Systems Incorporated) Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.1.0.4880 - Adobe Systems Incorporated) Adobe Flash Player 21 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 21.0.0.197 - Adobe Systems Incorporated) Advanced Audio FX Engine (HKLM-x32\...\Advanced Audio FX Engine) (Version: 1.12.05 - Creative Technology Ltd) aioprnt (Version: 5.3.1.0 - Eastman Kodak Company) Hidden aioscnnr (x32 Version: 6.2.3.10 - Your Company Name) Hidden aioscnnr (x32 Version: 7.6.13.10 - Your Company Name) Hidden ANT Drivers Installer x64 (Version: 2.3.4 - Garmin Ltd or its subsidiaries) Hidden Apple Application Support (32-bit) (HKLM-x32\...\{7FA9ECCF-A2DE-4DA1-BFF3-81260DBDA68F}) (Version: 4.1.2 - Apple Inc.) Apple Application Support (64-bit) (HKLM\...\{691F30EB-9009-475A-B8A9-E1BF39598FD5}) (Version: 4.1.2 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{3540181E-340A-4E7A-B409-31663472B2F7}) (Version: 9.1.0.6 - Apple Inc.) Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.) AVS Media Player 3.1 (HKLM-x32\...\AVS Media Player_is1) (Version: - Online Media Technologies Ltd.) AVS Update Manager 1.0 (HKLM-x32\...\AVS Update Manager_is1) (Version: - Online Media Technologies Ltd.) AVS Video Converter 6 (HKLM-x32\...\AVS4YOU Video Converter 6_is1) (Version: - Online Media Technologies Ltd.) AVS4YOU Software Navigator 1.3 (HKLM-x32\...\AVS4YOU Software Navigator_is1) (Version: - Online Media Technologies Ltd.) Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.) C4USelfUpdater (x32 Version: 1.00.0000 - Your Company Name) Hidden center (x32 Version: 7.8.0.0 - Eastman Kodak Company) Hidden Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.) Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.) Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.) Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation) D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden Dell DataSafe Local Backup - Support Software (HKLM-x32\...\{A9668246-FB70-4103-A1E3-66C9BC2EFB49}) (Version: 2.31 - Dell) Dell DataSafe Local Backup (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 9.3.44 - Dell) Dell Dock (HKLM\...\{E60B7350-EA5F-41E0-9D6F-E508781E36D2}) (Version: 2.0.0 - Dell) Dell Driver Download Manager (HKU\S-1-5-21-2778284475-3753871239-3632022125-1000\...\f031ef6ac137efc5) (Version: 2.1.0.0 - Dell Inc.) Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc) Dell Getting Started Guide (HKLM-x32\...\{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}) (Version: 1.00.0000 - Dell Inc.) Dell Touchpad (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 7.104.115.102 - Alps Electric) Dell Webcam Central (HKLM-x32\...\Dell Webcam Central) (Version: 1.40.05 - Creative Technology Ltd) Dell Wireless WLAN Card Utility (HKLM\...\Dell Wireless WLAN Card Utility) (Version: 5.30.21.0 - Dell Inc.) Dropbox (HKLM-x32\...\Dropbox) (Version: 3.16.1 - Dropbox, Inc.) Dropbox Update Helper (x32 Version: 1.3.27.37 - Dropbox, Inc.) Hidden Elevated Installer (x32 Version: 4.0.15.0 - Garmin Ltd or its subsidiaries) Hidden EndNote X3 (HKLM-x32\...\{86B3F2D6-AC2B-4E88-8AE1-F2F77F781B0C}) (Version: 13.0.0.4094 - Thomson Reuters) EPSON XP-205 207 Series Printer Uninstall (HKLM\...\EPSON XP-205 207 Series) (Version: - SEIKO EPSON Corporation) essentials (x32 Version: 7.8.0.0 - Eastman Kodak Company) Hidden FileZilla Client 3.16.1 (HKLM-x32\...\FileZilla Client) (Version: 3.16.1 - Tim Kosse) FilmStar 32-bit (HKLM-x32\...\FilmStar 32-bit) (Version: - ) Freemake Video Converter version 4.1.6 (HKLM-x32\...\Freemake Video Converter_is1) (Version: 4.1.6 - Ellora Assets Corporation) Garmin Express (HKLM-x32\...\{50755d67-ae60-4e47-b3d6-ce44d01b5a95}) (Version: 4.0.15.0 - Garmin Ltd or its subsidiaries) Garmin Express (x32 Version: 4.0.15.0 - Garmin Ltd or its subsidiaries) Hidden Garmin Express Tray (x32 Version: 4.0.15.0 - Garmin Ltd or its subsidiaries) Hidden Google Chrome (HKLM-x32\...\Google Chrome) (Version: 49.0.2623.110 - Google Inc.) Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: - Google Inc.) Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden Google Update Helper (x32 Version: 1.3.29.5 - Google Inc.) Hidden Icecream PDF Split and Merge version 1.07 (HKLM-x32\...\{95DC4DB4-99FB-4FB2-ADBD-97F194EDEB4D}_is1) (Version: 1.07 - Icecream Apps) iCloud (HKLM\...\{4B48E22A-2FB0-4EFA-B99E-954B1E50CD69}) (Version: 5.1.0.34 - Apple Inc.) IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6255.0 - IDT) ImageJ 1.44p (HKLM-x32\...\ImageJ_is1) (Version: - NIH) Inkscape 0.91 (HKLM\...\{81922150-317E-4BB0-A31D-FF1C14F707C5}) (Version: 0.91 - inkscape.org) Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: - Intel Corporation) Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.5.0.1029 - Intel Corporation) Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - Intel Corporation) iTunes (HKLM\...\{FBEB98F8-64E4-4FA3-A15E-4A9F42FF962E}) (Version: 12.3.2.35 - Apple Inc.) Java 7 Update 21 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417021FF}) (Version: 7.0.210 - Oracle) Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle) Java(TM) 6 Update 14 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416014FF}) (Version: 6.0.140 - Sun Microsystems, Inc.) Java(TM) 6 Update 29 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216014FF}) (Version: 6.0.290 - Sun Microsystems, Inc.) Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Kodak AIO Printer (Version: 7.8.1.0 - Eastman Kodak Company) Hidden KODAK AiO Software (HKLM-x32\...\{E0F274B7-592B-4669-8FB8-8D9825A09858}) (Version: 7.8.5.2 - Eastman Kodak Company) ksDIP (x32 Version: 3.20.0000.0000 - Eastman Kodak Company) Hidden Live! Cam Avatar Creator (HKLM-x32\...\{65D0C510-D7B6-4438-9FC8-E6B91115AB0D}) (Version: 4.6.3009.1 - Creative Technology Ltd) Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes) MATLAB R2011a (HKLM\...\MatlabR2011a) (Version: 7.12 - The MathWorks, Inc.) McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.11.309.1 - McAfee, Inc.) Mendeley Desktop 1.0.1 (HKLM-x32\...\Mendeley Desktop) (Version: 1.0.1 - Mendeley Ltd.) Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-0011-0000-0000-0000000FF1CE}_PROPLUSR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft) Microsoft Office Communicator 2007 (HKLM-x32\...\{E5BA0430-919F-46DD-B656-0796F8A5ADFF}) (Version: 2.0.6362.0 - Microsoft Corporation) Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation) Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation) Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\...\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation) Microsoft Office Professional Plus 2007 (HKLM-x32\...\PROPLUSR) (Version: 12.0.6612.1000 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation) Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\...\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation) Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (HKLM\...\{EE936C7A-EA40-31D5-9B65-8E3E089C3828}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation) Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.) MiKTeX 2.9 (HKLM-x32\...\MiKTeX 2.9) (Version: 2.9 - MiKTeX.org) Motorola Mobile Drivers Installation 5.4.0 (HKLM\...\{B0C6CCC9-0BAB-4636-A06F-B43B6FBC25DF}) (Version: 5.4.0 - Motorola Inc.) Mozilla Firefox 45.0.1 (x86 en-GB) (HKLM-x32\...\Mozilla Firefox 45.0.1 (x86 en-GB)) (Version: 45.0.1 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 45.0.1.5918 - Mozilla) MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) My Dell (HKLM\...\PC-Doctor for Windows) (Version: 3.5.6426.22 - PC-Doctor, Inc.) Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.8.3 - Notepad++ Team) ocr (x32 Version: 6.2.3.50 - Eastman Kodak Company) Hidden OpenVPN 2.2.2 (HKLM-x32\...\OpenVPN) (Version: 2.2.2 - ) Password Safe (HKLM-x32\...\Password Safe) (Version: - ) PowerDVD DX (HKLM-x32\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 8.3.5424 - CyberLink Corp.) PreReq (x32 Version: 6.2.4.0 - Eastman Kodak Company) Hidden PrimoPDF -- brought to you by Nitro PDF Software (HKLM-x32\...\PrimoPDF) (Version: 5 - Nitro PDF Software) PrintProjects (HKLM-x32\...\PrintProjects) (Version: 1.0.0.9282 - RocketLife Inc.) Quickset64 (HKLM\...\{87CF757E-C1F1-4D22-865C-00C6950B5258}) (Version: 9.6.6 - Dell Inc.) QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.) Rapport (Version: 3.5.1205.12 - Trusteer) Hidden Rapport (x32 Version: 3.5.1609.47 - Trusteer) Hidden ResearchSoft Direct Export Helper (HKLM-x32\...\ResearchSoft Direct Export Helper) (Version: - ) Safari (HKLM-x32\...\{FA4C2D53-205F-4245-9717-F3761154824D}) (Version: 5.34.57.2 - Apple Inc.) SigmaPlot 8.0 (HKLM-x32\...\{7DA83DDA-0EB0-11D6-A937-00C04F091145}) (Version: - ) Skype Click to Call (HKLM-x32\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 6.9.12585 - Skype Technologies S.A.) Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.) Software Updater (HKLM-x32\...\{8DBC5A0A-31C4-46C7-B252-6B593EA11A87}) (Version: 4.3.7 - SEIKO EPSON CORPORATION) TeamViewer 8 (HKLM-x32\...\TeamViewer 8) (Version: 8.0.26038 - TeamViewer) Telekom Internet Manager (HKLM-x32\...\Telekom Internet Manager) (Version: 11.301.05.05.748 - Huawei Technologies Co.,Ltd) Trusteer Endpoint Protection (HKLM-x32\...\Rapport_msi) (Version: 3.5.1609.47 - Trusteer) TweakNow RegCleaner 2011 (HKLM-x32\...\TweakNow RegCleaner 2011_is1) (Version: 6.4.5 - TweakNow.com) Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-0011-0000-0000-0000000FF1CE}_PROPLUSR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft) Veetle TV 0.9.18 (HKLM-x32\...\Veetle TV) (Version: 0.9.18 - Veetle, Inc) Windows Driver Package - Dynastream Innovations, Inc. ANT LibUSB Drivers (04/11/2012 1.2.40.201) (HKLM\...\F9D2A789F9CFF8CEC36B544F53877C80F1F73C46) (Version: 04/11/2012 1.2.40.201 - Dynastream Innovations, Inc.) Windows Driver Package - Silicon Labs Software (DSI_SiUSBXp_3_1) USB (02/06/2007 3.1) (HKLM\...\D1506E0025B5A3F9EB8270FE81C1EEDD9388B8A2) (Version: 02/06/2007 3.1 - Silicon Labs Software) Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation) Windows Live Sync (HKLM-x32\...\{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}) (Version: 14.0.8089.726 - Microsoft Corporation) WinEdt 6 (HKLM-x32\...\WinEdt 6) (Version: 6.0 - WinEdt Team) WinRAR 4.01 (64-bit) (HKLM\...\WinRAR archiver) (Version: 4.01.0 - win.rar GmbH) ==================== Custom CLSID (Whitelisted): ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) CustomCLSID: HKU\S-1-5-21-2778284475-3753871239-3632022125-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\Rosebud\AppData\Local\Microsoft\OneDrive\17.3.6302.0225\FileCoAuth.exe (Microsoft Corporation) ==================== Scheduled Tasks (Whitelisted) ============= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) Task: {0098B7F8-131A-4321-BA86-57C0AC9E8658} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\Windows\ehome\MCUpdate.exe Task: {034A6DFF-BD7F-42C9-A5CA-E14EF30F5954} - System32\Tasks\{A0F45334-1D54-40F7-BADB-FEB38722BCD6} => Firefox.exe hxxp://ui.skype.com/ui/0/6.0.0.126/en/go/help.faq.installer?LastError=1618 Task: {067CFB1F-D353-4626-8EE1-FF42FDB610B9} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\Windows\ehome\ehPrivJob.exe Task: {0796CC1F-4FE1-4D4C-B642-C7AA5EF9EEE7} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\Windows\ehome\ehPrivJob.exe Task: {08C05DCB-4577-49DE-BAC6-D30CCB68F23D} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION Task: {0EF1C7FB-AD58-4B17-8C17-048FF8221798} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-12-14] (Adobe Systems Incorporated) Task: {129CD992-5BBE-43F2-A1D5-12B939B14CD5} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\Windows\ehome\ehPrivJob.exe Task: {13152401-706A-4512-A714-F92522D538F9} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2015-11-09] (Dropbox, Inc.) Task: {1A43BC67-DA8B-4215-804E-0883EE3CB754} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\Windows\ehome\ehPrivJob.exe Task: {2409048A-609D-483F-AE6E-87DD9D56A998} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\Windows\ehome\ehrec.exe Task: {25AA35B0-17A6-4D53-9812-50CACBF1FE00} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION Task: {26D035EA-1933-4C52-BCF0-FD0169C96F43} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-29] (Google Inc.) Task: {2805566E-76C0-4A30-BCF8-88EE0D83AF12} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\Windows\ehome\ehrec.exe Task: {2C649B99-B92F-465E-84FC-B8517A2D33FD} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\Windows\ehome\ehPrivJob.exe Task: {3A219264-7C8A-42DC-97FD-1A5571E20708} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION Task: {44D58D9F-EC2E-409C-9898-51504F07037B} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\Windows\ehome\mcupdate.exe Task: {5097E0CA-BE41-496E-B6B4-E0F066CE750F} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\Windows\ehome\ehPrivJob.exe Task: {52C2CEBB-3590-408B-AA5E-38A1E6762845} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-29] (Google Inc.) Task: {53F9FA69-39AF-4436-95CF-3A3D09641323} - System32\Tasks\{B0A28BCF-105A-4BDC-B98B-846B2036152D} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2014-12-11] (Skype Technologies S.A.) Task: {5BE3B602-E01E-4B1B-8908-12E8A068F8D1} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION Task: {5D5C0AB1-AA2D-4F60-B6E5-5590AABEFA48} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\Windows\ehome\ehPrivJob.exe Task: {5F8CC3CE-B482-46A8-B4CE-C50D5D78DD6C} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2016-03-10] (Microsoft Corporation) Task: {60F50F98-9525-47BF-B2D8-9A3784441671} - System32\Tasks\{C810A043-8DDA-45EB-BECF-2A11FDB10552} => pcalua.exe -a "E:\COSMOS\Website\Offline Site Development\dsl-win-v380\Install DSL v380.exe" -d "E:\COSMOS\Website\Offline Site Development\dsl-win-v380" Task: {63FE4042-FEAD-4786-A623-B0245B2AFC44} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION Task: {6AC1E7BD-18EC-4940-A618-AFAC30D64AD7} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION Task: {7A66CEB3-F811-4EBD-A80C-2B8E1C30DD69} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION Task: {81BE3181-D6B5-4ED4-B7AA-00F404C11B37} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\Windows\ehome\ehPrivJob.exe Task: {8F6B1880-D49C-4068-91A2-6697ECA053AC} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-08-27] (Apple Inc.) Task: {927001DC-0D0B-4E64-A812-A865C22F578E} - System32\Tasks\GarminUpdaterTask => C:\Program Files (x86)\Garmin\Express Self Updater\ExpressSelfUpdater.exe Task: {935A6283-4F4A-4175-A3B5-479B5F7B5CF2} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION Task: {991EC07A-6C22-489B-A6EA-3F32357F2051} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\Windows\ehome\ehPrivJob.exe Task: {A41A8353-6B3E-4A75-AEFF-71FBF1DF4028} - \PCDoctorBackgroundMonitorTask -> No File <==== ATTENTION Task: {A8D64032-4F4D-446F-A722-2234F6DBAE5B} - \PCDEventLauncherTask -> No File <==== ATTENTION Task: {A9A6C089-1578-4F1F-8FD2-489E12858F65} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION Task: {AEA935D9-F4FC-4F9B-A801-0CF0BB9718BE} - \SystemToolsDailyTest -> No File <==== ATTENTION Task: {B2732475-6458-4120-9BD8-C9949A35E5DA} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-04-02] (Adobe Systems Incorporated) Task: {B7C8ABB6-BC05-4253-BFF6-6B367762BF65} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\Windows\ehome\mcupdate.exe Task: {BBD9B359-9279-4334-8A39-215FE1AC4A53} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION Task: {C02F3B0C-DDD5-4AFC-8D8D-30C15C313238} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe Task: {C2DF9C68-2E07-44AD-A951-E550062CECDE} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\Windows\ehome\mcupdate.exe Task: {C9AC1370-0BA7-4793-8D27-82239F9C3C66} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\Windows\ehome\mcupdate.exe Task: {CB0D2A25-1318-4F23-9E83-52BDF907D6ED} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\Windows\ehome\mcupdate.exe Task: {CE18ECF5-0BED-4AF0-B7AE-D9CAFEC4C7E6} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\Windows\ehome\ehPrivJob.exe Task: {D320FD39-B399-4751-A8C4-67B3831AFDBA} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\Windows\ehome\ehPrivJob.exe Task: {D39A3699-EF5F-429F-BA22-9E2B627CB406} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2015-11-09] (Dropbox, Inc.) Task: {D40A9373-D6CA-4D6C-88A5-20C333F63CB8} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION Task: {D467F90D-2418-4B45-AB12-A62D2F28058A} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\Windows\ehome\ehPrivJob.exe Task: {DCDC4774-5EA8-4B47-91CA-CAF5A8C389F1} - System32\Tasks\Apple Diagnostics => C:\Program Files (x86)\Common Files\Apple\Internet Services\EReporter.exe [2015-12-01] (Apple Inc.) Task: {EDFCCBF7-1F5D-4285-B852-00DACB0541A2} - System32\Tasks\DCTN02K1\Administrator - Start WLAN Tray Applet => C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.EXE [2009-07-17] (Dell Inc.) Task: {F352A09E-179F-4880-A2DE-829F01B450A2} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\Windows\ehome\ehPrivJob.exe Task: {F5482B7C-6E07-4D63-B9F9-487ABB61B80B} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\Windows\ehome\mcupdate.exe (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Shortcuts ============================= (The entries could be listed to be restored or removed.) ==================== Loaded Modules (Whitelisted) ============== 2015-07-10 05:33 - 2015-07-10 05:33 - 00028160 _____ () C:\WINDOWS\SYSTEM32\efsext.dll 2015-09-10 07:08 - 2015-09-10 07:08 - 00032768 _____ () C:\WINDOWS\SYSTEM32\licensemanagerapi.dll 2010-10-18 11:07 - 2009-12-21 03:42 - 00090624 _____ () C:\WINDOWS\System32\Primomonnt.dll 2015-09-10 07:08 - 2015-09-10 07:08 - 00404480 _____ () C:\WINDOWS\System32\diagtrack_wininternal.dll 2015-10-13 06:45 - 2015-10-13 06:45 - 00085800 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll 2015-10-13 06:45 - 2015-10-13 06:45 - 01328912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll 2010-08-19 10:52 - 2010-08-19 10:52 - 00229376 _____ () C:\ProgramData\DatacardService\DCService.exe 2009-12-08 16:11 - 2009-07-17 03:06 - 00033280 _____ () C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE 2009-12-08 16:11 - 2009-07-17 03:06 - 00058368 _____ () C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwlrmt.dll 2015-10-22 05:27 - 2015-10-22 05:27 - 02494712 _____ () C:\WINDOWS\system32\CoreUIComponents.dll 2015-10-22 05:27 - 2015-10-22 05:27 - 02494712 _____ () C:\WINDOWS\System32\CoreUIComponents.dll 2016-03-16 12:17 - 2016-03-16 12:17 - 00052912 _____ () C:\Program Files\FileZilla FTP Client\fzshellext_64.dll 2011-08-21 17:06 - 2011-05-28 23:05 - 00164864 _____ () C:\Program Files\WinRAR\rarext.dll 2015-10-22 05:27 - 2015-10-22 05:27 - 00429056 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll 2015-07-10 05:13 - 2015-07-10 05:13 - 00143360 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\XamlTileRendering.dll 2016-01-16 11:58 - 2015-11-25 06:20 - 06569472 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll 2016-01-16 11:57 - 2015-11-25 06:17 - 00471040 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll 2016-01-16 11:57 - 2015-11-25 06:17 - 01808384 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll 2015-10-22 05:27 - 2015-10-22 05:27 - 02274816 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll 2015-07-10 21:42 - 2015-06-18 12:22 - 00062464 _____ () C:\Program Files (x86)\Common Files\Freemake Shared\ProductUpdater\ProductUpdater.exe 2015-07-10 05:16 - 2015-07-10 06:39 - 00215352 _____ () c:\windows\system32\WerEtw.dll 2009-12-08 16:15 - 2009-09-17 21:05 - 00128240 ____N () C:\Program Files (x86)\Dell DataSafe Local Backup\STLog.dll 2009-12-08 16:15 - 2009-09-17 21:04 - 00115952 ____N () C:\Program Files (x86)\Dell DataSafe Local Backup\PSTVdsDisk.dll 2015-10-13 06:46 - 2015-10-13 06:46 - 01040144 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll 2014-02-06 01:52 - 2014-02-06 01:52 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll 2015-10-13 06:45 - 2015-10-13 06:45 - 00237328 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxslt.dll 2015-06-02 14:51 - 2015-06-02 14:51 - 00545792 _____ () C:\Program Files (x86)\Trusteer\Rapport\bin\js32.dll ==================== Alternate Data Streams (Whitelisted) ========= (If an entry is included in the fixlist, only the ADS will be removed.) ==================== Safe Mode (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver" ==================== EXE Association (Whitelisted) =============== (If an entry is included in the fixlist, the registry item will be restored to default or removed.) ==================== Internet Explorer trusted/restricted =============== (If an entry is included in the fixlist, it will be removed from the registry.) ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2009-07-14 04:34 - 2016-04-07 13:49 - 00001041 ____A C:\WINDOWS\system32\Drivers\etc\hosts 127.0.0.1 www.cosmos.dev 0.0.0.1 mssplus.mcafee.com ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-2778284475-3753871239-3632022125-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Rosebud\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper DNS Servers: 192.168.2.103 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) Windows Firewall is enabled. ==================== MSCONFIG/TASK MANAGER disabled items == (Currently there is no automatic fix for this section.) HKLM\...\StartupApproved\Run: => "SysTrayApp" HKLM\...\StartupApproved\Run: => "iTunesHelper" HKLM\...\StartupApproved\Run32: => "APSDaemon" HKLM\...\StartupApproved\Run32: => "PDVDDXSrv" HKLM\...\StartupApproved\Run32: => "Desktop Disc Tool" HKLM\...\StartupApproved\Run32: => "Dropbox" HKU\S-1-5-21-2778284475-3753871239-3632022125-1000\...\StartupApproved\StartupFolder: => "Dell Dock.lnk" HKU\S-1-5-21-2778284475-3753871239-3632022125-1000\...\StartupApproved\StartupFolder: => "Dropbox.lnk" HKU\S-1-5-21-2778284475-3753871239-3632022125-1000\...\StartupApproved\StartupFolder: => "Netzmanager.lnk" ==================== FirewallRules (Whitelisted) =============== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139 FirewallRules: [{281FA80D-89E9-4CE0-B72D-7CE631AF36D1}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{A01370A8-0F31-441B-8C09-1798A8B74C44}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{6B4C3263-F53D-47CB-BAEB-30A00DE96F13}] => (Allow) C:\ProgramData\Kodak\Installer\Setup.exe FirewallRules: [{E3DC3C07-6077-4851-BC8C-9FF952974BD8}] => (Allow) C:\ProgramData\Kodak\Installer\Setup.exe FirewallRules: [{C0AAAF40-060C-4DCB-ADE6-9F4642DE7FBD}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Firmware\KodakAiOUpdater.exe FirewallRules: [{E1BE07A6-DFFE-4F20-A342-EC916AAC3437}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Firmware\KodakAiOUpdater.exe FirewallRules: [{1921E10A-2938-422B-B382-7669EA277FDE}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\NetworkPrinterDiscovery.exe FirewallRules: [{4B185433-FDF3-4575-ADC5-741AD3323193}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\NetworkPrinterDiscovery.exe FirewallRules: [{93144161-E82E-4023-88F2-4043EE20E92B}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\Kodak.Statistics.exe FirewallRules: [{E5CC1F2E-49B4-4EB6-916D-F0B972230623}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\Kodak.Statistics.exe FirewallRules: [{7E7F6C5E-A98B-4F96-8219-37C610B9C733}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe FirewallRules: [{5121145A-BF84-42E9-A0D5-48B349C920DD}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe FirewallRules: [{895E3B75-BB99-4353-B1B8-B3AF9DE8A1A7}] => (Allow) LPort=9322 FirewallRules: [{ABA6340C-8BE3-418D-8AE5-970F89C0AD09}] => (Allow) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe FirewallRules: [{A6F62C82-EA5A-4FF1-9DA8-6DAE740B0930}] => (Allow) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe FirewallRules: [{B392DF5E-3422-4EF9-BBAE-D9007B9EAAD7}] => (Allow) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe FirewallRules: [{1AFB05DA-26CD-40B5-AAD5-BC8CEA9366F5}] => (Allow) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe FirewallRules: [{68CDEE1E-23C6-40C7-BFEA-2D53438D5094}] => (Allow) LPort=5353 FirewallRules: [{68C7A28A-EE7B-4031-AE30-97D64FC7C4DB}] => (Allow) C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe FirewallRules: [{89320EDE-F162-4830-AC97-492E9184ADAA}] => (Allow) C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe FirewallRules: [{0462F10B-AA17-441F-9B9B-644ACA53CCDC}] => (Allow) C:\Windows\SysWOW64\msiexec.exe FirewallRules: [{B24C0AEF-0E44-449F-9D51-D69238F5F5CE}] => (Allow) C:\Windows\SysWOW64\msiexec.exe FirewallRules: [{E29C825F-067F-47C1-BA33-053F9DCA9C4C}] => (Allow) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe FirewallRules: [{A9FDA66E-431F-4EAD-9CFF-C336D63EFAD3}] => (Allow) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe FirewallRules: [{625D6B76-0362-427D-AF36-CB189CE6FA48}] => (Allow) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer.exe FirewallRules: [{6CB49AF9-2FA7-4E81-BD08-A73F5D10C719}] => (Allow) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer.exe FirewallRules: [{93036CEF-C5FF-4040-A785-828C1F9A5EC2}] => (Allow) C:\Users\Rosebud\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe FirewallRules: [{3B9275BC-DDB8-44CB-8719-268FC193892B}] => (Allow) C:\Users\Rosebud\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe FirewallRules: [{91517D64-FF44-4589-ABE5-95416284C4F5}] => (Allow) C:\ProgramData\Kodak\Installer\Setup.exe FirewallRules: [{91AEF478-C8A1-4335-8E5E-FD4D5B47CCA1}] => (Allow) C:\ProgramData\Kodak\Installer\Setup.exe FirewallRules: [{2B635701-A7EC-43D4-830E-45061B5C5915}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Firmware\KodakAiOUpdater.exe FirewallRules: [{3B069B2E-E471-46CC-B4F7-B78F8BD15254}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Firmware\KodakAiOUpdater.exe FirewallRules: [{5FEF79B2-5E5F-40D4-9C0A-CF51A3150D8F}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\NetworkPrinterDiscovery.exe FirewallRules: [{B3A766CD-927D-40FE-A16F-BA6A4BB2D167}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\NetworkPrinterDiscovery.exe FirewallRules: [{C70F623D-F28A-49C7-96FF-5358F8485932}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\Kodak.Statistics.exe FirewallRules: [{BCBD78EA-3867-4480-B87F-0335AA90F6D4}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\Kodak.Statistics.exe FirewallRules: [{23D54D7A-BC1D-43E8-A08F-945CD4B66C7E}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe FirewallRules: [{1B6928A0-9A55-4BDC-87C6-F1C7BB5C4355}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe FirewallRules: [{EEB83E30-B25F-44E3-BD34-A71D8D2345DB}] => (Allow) LPort=9322 FirewallRules: [{81CED988-BCCD-4C78-8C77-B6A2D9114AEE}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{4AD4A14B-5833-418D-990D-A0338F288DF3}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{07497436-C7D2-4FE7-BACD-652A784FAD72}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{05B2DBCD-1B90-43A1-91E1-B0399309E85D}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{8CB80A13-9449-4B01-B4AA-7A8FCF9F83A1}] => (Allow) LPort=5353 FirewallRules: [{A14B1C34-6E46-4025-B6B8-A15C0216E290}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe FirewallRules: [{D8F53177-B1A7-4139-8512-37118269F98D}] => (Allow) LPort=1900 FirewallRules: [{7C9E0D92-83D3-4D09-AAB1-BC0A022E0A3D}] => (Allow) LPort=2869 FirewallRules: [{231704F8-232B-411C-90BB-6E6DF05737F7}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe FirewallRules: [{B8AF602E-861B-42E1-84D0-EB7AF6B3CC44}] => (Allow) C:\Program Files (x86)\TeamViewer\Version5\TeamViewer.exe FirewallRules: [{48CA801B-DC20-4B6D-98EA-5C66A52744D4}] => (Allow) C:\Program Files (x86)\TeamViewer\Version5\TeamViewer.exe FirewallRules: [{16443398-1BFA-41DC-907B-D51749D6E979}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe FirewallRules: [{6497D47E-56A3-4E8A-87CC-B999B4663E07}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD DX\PowerDVD.exe FirewallRules: [{CD7386BE-4BFE-434E-A513-739819E80636}] => (Allow) C:\Program Files (x86)\Windows Live\Sync\WindowsLiveSync.exe FirewallRules: [{44BD437A-0B52-40AF-BC11-B86D0B42F8D2}] => (Allow) svchost.exe FirewallRules: [{4FBAE9B4-AF49-43CE-87C6-1B7E6456DCA5}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe FirewallRules: [{A3B6587C-0ABA-4939-83B9-415DF5E402D8}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{FDBFBDFD-E57F-4CAA-BE22-945327FE01C6}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{C8FDC2D9-E6C8-4B59-AF2E-E747890CC098}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{391693E4-F923-425F-9128-DC535DF63BB9}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{B34D5FD0-CACC-4C42-B910-06111E7B7B4F}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{CFF3F35E-D41B-4AE4-904A-50337A8F433F}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{78DD70A8-28A2-47A9-8A4F-9267B2FBF461}] => (Allow) C:\Program Files\iTunes\iTunes.exe FirewallRules: [{0BB80E13-12D1-430E-BA74-4ECB74465EE3}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe FirewallRules: [{3D0BE540-C1BF-42AE-BB03-1F0F9266F5DD}] => (Allow) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe ==================== Restore Points ========================= 10-03-2016 21:33:41 Windows Update 26-03-2016 18:19:34 Installed Rapport 03-04-2016 12:11:00 Windows Update 07-04-2016 12:34:58 Installed Rapport ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (04/07/2016 06:21:18 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: The program FRST64.exe version 5.3.2016.1 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel. Process ID: e10 Start Time: 01d190e90d82616e Termination Time: 11 Application Path: C:\Users\Rosebud\Desktop\FRST64.exe Report Id: bda0367a-fcdc-11e5-8d81-0025647dd35b Faulting package full name: Faulting package-relative application ID: Error: (04/07/2016 06:05:47 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: mDNSCoreReceiveResponse: Unexpected conflict discarding 18 116.2.168.192.in-addr.arpa. PTR Rosebud-PC.local. Error: (04/07/2016 06:05:47 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: mDNSCoreReceiveResponse: Received from 192.168.2.116:5353 20 116.2.168.192.in-addr.arpa. PTR Rosebud-PC-2.local. Error: (04/07/2016 03:26:55 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: AcroRd32.exe, version: 15.10.20056.36345, time stamp: 0x56741546 Faulting module name: PPKLite.api, version: 15.10.20060.43353, time stamp: 0x56d0a55f Exception code: 0xc0000005 Fault offset: 0x0024656d Faulting process id: 0x1e0 Faulting application start time: 0xAcroRd32.exe0 Faulting application path: AcroRd32.exe1 Faulting module path: AcroRd32.exe2 Report Id: AcroRd32.exe3 Faulting package full name: AcroRd32.exe4 Faulting package-relative application ID: AcroRd32.exe5 Error: (04/07/2016 03:10:38 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: SystemSettings.exe, version: 10.0.10240.16384, time stamp: 0x559f39ae Faulting module name: SettingsHandlers_StorageSense.dll, version: 10.0.10240.16384, time stamp: 0x559f3d87 Exception code: 0xc0000005 Fault offset: 0x00000000000174b9 Faulting process id: 0x1bf4 Faulting application start time: 0xSystemSettings.exe0 Faulting application path: SystemSettings.exe1 Faulting module path: SystemSettings.exe2 Report Id: SystemSettings.exe3 Faulting package full name: SystemSettings.exe4 Faulting package-relative application ID: SystemSettings.exe5 Error: (04/07/2016 02:08:20 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Local Hostname Rosebud-PC.local already in use; will try Rosebud-PC-2.local instead Error: (04/07/2016 02:08:20 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: mDNSCoreReceiveResponse: ProbeCount 2; will deregister 4 Rosebud-PC.local. Addr 192.168.2.116 Error: (04/07/2016 02:08:20 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: mDNSCoreReceiveResponse: Received from 192.168.2.116:5353 16 Rosebud-PC.local. AAAA 2003:0084:A979:A601:0408:96AF:F706:D169 Error: (04/07/2016 02:08:20 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: mDNSCoreReceiveResponse: Resetting to Probing: 16 Rosebud-PC.local. AAAA FE80:0000:0000:0000:0408:96AF:F706:D169 Error: (04/07/2016 02:08:20 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: mDNSCoreReceiveResponse: Received from 192.168.2.116:5353 16 Rosebud-PC.local. AAAA 2003:0084:A979:A601:0408:96AF:F706:D169 System errors: ============= Error: (04/07/2016 06:05:47 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The NPEService service failed to start due to the following error: %%1053 Error: (04/07/2016 06:05:47 PM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: A timeout was reached (30000 milliseconds) while waiting for the NPEService service to connect. Error: (04/07/2016 06:05:42 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The MBAMService service failed to start due to the following error: %%1053 Error: (04/07/2016 06:05:42 PM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: A timeout was reached (30000 milliseconds) while waiting for the MBAMService service to connect. Error: (04/07/2016 06:05:41 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The MBAMScheduler service failed to start due to the following error: %%1053 Error: (04/07/2016 06:05:41 PM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: A timeout was reached (30000 milliseconds) while waiting for the MBAMScheduler service to connect. Error: (04/07/2016 06:03:50 PM) (Source: Application Popup) (EventID: 875) (User: ) Description: BMLoad.sys Error: (04/07/2016 06:04:46 PM) (Source: EventLog) (EventID: 6008) (User: ) Description: The previous system shutdown at 4:07:47 PM on ‎4/‎7/‎2016 was unexpected. Error: (04/07/2016 03:48:36 PM) (Source: Service Control Manager) (EventID: 7011) (User: ) Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the WinDefend service. Error: (04/07/2016 03:48:01 PM) (Source: Service Control Manager) (EventID: 7011) (User: ) Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the WinDefend service. CodeIntegrity: =================================== Date: 2016-04-07 18:23:27.161 Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2016-04-07 18:23:26.934 Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2016-04-07 18:23:26.676 Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2016-04-07 18:23:14.395 Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2016-04-07 15:54:17.416 Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2016-04-07 15:32:30.828 Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2016-04-07 15:32:30.622 Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2016-04-07 15:32:30.405 Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2016-04-07 15:32:30.062 Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2016-04-07 15:32:29.864 Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. ==================== Memory info =========================== Processor: Pentium(R) Dual-Core CPU T4300 @ 2.10GHz Percentage of memory in use: 49% Total physical RAM: 4056.36 MB Available physical RAM: 2029.26 MB Total Virtual: 8152.36 MB Available Virtual: 6099.82 MB ==================== Drives ================================ Drive c: (OS) (Fixed) (Total:451.07 GB) (Free:273.62 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 465.8 GB) (Disk ID: 75349890) Partition 1: (Not Active) - (Size=39 MB) - (Type=DE) Partition 2: (Active) - (Size=14.6 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=451.1 GB) - (Type=07 NTFS) ==================== End of Addition.txt ============================
  2. Hi, I have just scanned my computer with Malwarebytes Anti-Malware Home, and it detected the following items: Trojan.Agent.ED PUP.Optional.Yontoo (13 of these) PUP.Optional.OpenCandy PUP.Optional.BundleInstaller.DW PUP.Optional.Babylon I quarentined and then deleted all the files and then re-ran Malwarebytes twice. It is saying the computer is clean now, but can I be sure that it is? Many thanks! Caroline
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.