m31tvwbz37.com popup

awakenedmachine · October 7, 2014

Wasn't able to find this one in any lists. I have a self-opening tab that's telling me to update my video player on Chrome. It's obviously malware. Any tips on figuring out where it's hiding and how to get rid of it? I've used malwarebytes and other tools and it's still there, didn't see evidence of it in the logs after cleaning so I don't think I was re-infected. Thanks. Attached a screenshot.

MrCharlie · October 7, 2014

Welcome to the forum. (Do what you can)

General P2P/Piracy Warning:

1. If you're using Peer 2 Peer software such uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.
2. If you have illegal/cracked software (MS Office, Adobe Products), cracks, keygens, custom (Adobe) host file, etc. on the system, please remove or uninstall them now and read the policy on Piracy.
Failure to remove such software will result in your topic being closed and no further assistance being provided.

<====><====><====><====><====><====><====><====>

1. Please run a Threat Scan with Malwarebytes (if possible)

Start Malwarebytes 2.0.........

Click on Settings > Detection and Protection > Non-Malware Protection > PUP (Potentially Unwanted Program) detections > Make sure it's set to Treat detections as malware

Same for PUM (Potentially Unwanted Modifications)

Quarantine all that's found

Post the log (save the log as a .txt file not .xml)

Then......

2. Please download Farbar Recovery Scan Tool (FRST) and save it to a folder.

(use correct version for your system.....Which system am I using?)

FRST <----for 32 bit systems

FRST64 <----for 64 bit systems

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button. (make sure the Addition box is checked)
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

If the logs are large, you can attach them:

To attach a log:

Bottom right corner of this page.

New window that comes up.

Last................

3. Please download and run RogueKiller 32 bit to your desktop.

RogueKiller<---use this one for 64 bit systems

Which system am I using?

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Wait for the Prescan to finish

Click Scan to scan the system.

When the scan completes > Don't Fix anything! > Click on the Report Button > Copy and paste the Report back here.

Don't run any other options, they're not all bad!!!!!!!

RogueKiller logs will also be located here:

%programdata%/RogueKiller/Logs <-------W7

C:\Documents and Settings\All Users\Application Data\RogueKiller\Logs <-------XP

(please don't put logs in code or quotes and use the default font)

MrC

Note:

Please read all of my instructions completely including these.

Make sure system restore is turned on and running. Create a new restore point

Make sure you're subscribed to this topic: Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly

Removing malware can be unpredictable...unlikely but things can go very wrong! Backup any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive

<+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

<+>The removal of malware isn't instantaneous, please be patient.

<+>When we are done, I'll give to instructions on how to cleanup all the tools and logs

<+>Please stick with me until I give you the "all clear".

------->Your topic will be closed if you haven't replied within 3 days!<--------

If I don't respond within 24 hours, please send me a PM

awakenedmachine · October 8, 2014

Hi Mr Charlie, thanks I appreciate your help! I'm not sure where to find "%programdata%/RogueKiller/Logs" under Windows 7.

awakenedmachine · October 8, 2014

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-10-2014

01

Ran by mcnattin (administrator) on EVRT-156-03 on 08-10-2014 07:54:27

Running from \\ad.uillinois.edu\engr\users\mcnattin\Downloads

Loaded Profile: mcnattin (Available profiles: rrc & jonweber & jmatz & ece-

mrtryit & mcnattin & rrc & selevins & smcdouga & default_user & eha & rrc &

engrit)

Platform: Windows 7 Enterprise Service Pack 1 (X64) OS Language: English

(United States)

Internet Explorer Version 11

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool:

http://www.news-

gazette.com/

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache =

http://www.msn.com/?ocid=iehp

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect

Cache_TIMESTAMP = 0xB0300F036C75CD01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache

AcceptLangs = en-US

SearchScopes: HKLM-x32 - DefaultScope {388C4A6A-974A-41C4-8E4A-698F1A47AEF1}

URL =

SearchScopes: HKCU - DefaultScope {C41AF01F-218C-45FF-8B57-7DE6E22421BE} URL =

https://www.google.com/search?q={searchTerms}

SearchScopes: HKCU - {14C3FAB3-095E-4B6B-9916-D94DB30EDA76} URL =

http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie=

{inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage=

{startPage}

SearchScopes: HKCU - {388C4A6A-974A-41C4-8E4A-698F1A47AEF1} URL =

http://search.conduit.com/ResultsExt.aspx?q={searchTerms}

&SearchSource=4&ctid=CT3310511&CUI=UN12705562493146363&UM=2

SearchScopes: HKCU - {C41AF01F-218C-45FF-8B57-7DE6E22421BE} URL =

https://www.google.com/search?q={searchTerms}

BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:

\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} ->

C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft

Corporation)

BHO: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} ->

C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6}

-> C:\Program Files\Common Files\Microsoft Shared\Windows Live

\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: LastPass Vault -> {95D9ECF5-2A4D-4550-BE49-70D42F71296E} -> C:\Program

Files (x86)\LastPass\LPToolbar_x64.dll (LastPass)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF}

-> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft

Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-

ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL

(Microsoft Corporation)

BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9}

-> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:

\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft

Corporation)

BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E}

-> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft

Corporation)

BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}

-> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-

5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows

Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: LastPass Vault -> {95D9ECF5-2A4D-4550-BE49-70D42F71296E} -> C:

\Program Files (x86)\LastPass\LPToolbar.dll (LastPass)

BHO-x32: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} ->

C:\Program Files (x86)\McAfee\SiteAdvisor Enterprise\McIEPlg.dll ()

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-

42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL

(Microsoft Corporation)

BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-

ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL

(Microsoft Corporation)

BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-

9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle

Corporation)

Toolbar: HKLM - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} -

C:\Program Files (x86)\LastPass\LPToolbar_x64.dll (LastPass)

Toolbar: HKLM-x32 - McAfee SiteAdvisor - {0EBBBE48-BAD4-4B4C-8E5A-

516ABECAE064} - C:\Program Files (x86)\McAfee\SiteAdvisor Enterprise

\McIEPlg.dll ()

Toolbar: HKLM-x32 - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5}

- C:\Program Files (x86)\LastPass\LPToolbar.dll (LastPass)

Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File

DPF: HKLM-x32 {0168C7BF-F5DE-4AB7-8734-C836DA82C957}

http://fssc11.fssc.uiuc.edu/webclient/redist/AccWebUtils.cab

DPF: HKLM-x32 {0C5CF442-582E-4357-B116-765DA99CAA8C}

https://bxsprod.apps.uillinois.edu/WX/client/IrcViewer.cab

DPF: HKLM-x32 {76392179-60A8-462D-8961-B95C14DAADF4}

https://docdirectdweb.admin.uillinois.edu:8443/ddrint/content/ddiprintengine.c

ab

DPF: HKLM-x32 {89F1C7A1-B54D-406D-8CD6-901D277F6388}

https://bxsprod.apps.uillinois.edu/wx/client/IrcResultSet.cab

DPF: HKLM-x32 {8BBA76EE-6A1A-4421-9035-7ED6BBC70C74}

https://bxsprod.apps.uillinois.edu/wx/client/XSComponentCheck.cab

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000}

http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7}

http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - No File

Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program

Files (x86)\McAfee\SiteAdvisor Enterprise\McIEPlg.dll ()

Hosts: There are more than one entry in Hosts. See Hosts section of

Addition.txt

Tcpip\Parameters: [DhcpNameServer] 130.126.2.131

FireFox:

========

FF ProfilePath: C:\Users\mcnattin\AppData\Roaming\Mozilla\Firefox\Profiles

\vp2cw0ef.default

FF DefaultSearchEngine: SweetPacks Customized Web Search

FF SelectedSearchEngine: SweetPacks Customized Web Search

FF Homepage: hxxp://news.google.com/

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash

\NPSWF64_15_0_0_152.dll ()

FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java

\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java

\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @lastpass.com/NPLastPass -> C:\Program Files (x86)\LastPass

\nplastpass64.dll (LastPass)

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft

Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:

\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash

\NPSWF32_15_0_0_152.dll ()

FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files

(x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files

(x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @lastpass.com/NPLastPass -> C:\Program Files (x86)\LastPass

\nplastpass.dll (LastPass)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files

(x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft

Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files

(x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:

\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:

\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3522.0110 -> C:\Program Files

(x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @nullsoft.com/winampDetector;version=1 -> C:\Program Files

(x86)\Winamp Detect\npwachk.dll (Nullsoft, Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files

(x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files

(x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader

10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\mcnattin

\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies

ApS)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox

\plugins\np-mswmp.dll (Microsoft Corporation)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox

\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox

\plugins\nppdf32.dll (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox

\plugins\npqtplugin.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox

\plugins\npqtplugin2.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox

\plugins\npqtplugin3.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox

\plugins\npqtplugin4.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox

\plugins\npqtplugin5.dll (Apple Inc.)

FF Extension: LastPass - C:\Users\mcnattin\AppData\Roaming\Mozilla\Firefox

\Profiles\vp2cw0ef.default\Extensions\support@lastpass.com [2014-09-17]

FF Extension: SweetPacks - C:\Users\mcnattin\AppData\Roaming\Mozilla\Firefox

\Profiles\vp2cw0ef.default\Extensions\{7e8a1050-cf67-4575-92df-dcc60e7d952d}

[2013-11-25]

FF Extension: Social Fixer - C:\Users\mcnattin\AppData\Roaming\Mozilla

\Firefox\Profiles\vp2cw0ef.default\Extensions\socialfixer@mattkruse.com.xpi

[2014-07-25]

FF HKLM-x32\...\Firefox\Extensions: [{B7082FAA-CB62-4872-9106-E42DD88EDE45}] -

C:\Program Files (x86)\McAfee\SiteAdvisor Enterprise

FF Extension: McAfee SiteAdvisor - C:\Program Files (x86)\McAfee\SiteAdvisor

Enterprise [2010-03-02]

Chrome:

=======

CHR HomePage: Profile 2 -> hxxp://www.forcedo.com/#

CHR StartupUrls: Profile 2 -> "hxxp://www.forcedo.com/#"

CHR DefaultSearchKeyword: Profile 2 ->

E0D11BE5E06A225F116A1FF58F4826BC3FA9EABF41B19A7DC78690EBDCC453FD

CHR DefaultSearchURL: Profile 2 ->

FD87EFB74A3F0E83E1A787594A33EA5647CFEBCB36932F9EE2FBAD3DF0FD8C48

CHR Profile: C:\Users\mcnattin\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Entanglement Web App) - C:\Users\mcnattin\AppData\Local

\Google\Chrome\User Data\Default\Extensions\aciahcmjmecflokailenpkdchphgkefd

[2012-08-08]

CHR Extension: (Atari - Lunar Lander) - C:\Users\mcnattin\AppData\Local

\Google\Chrome\User Data\Default\Extensions\aheampccjiggeiflpcjolbabpohbpclg

[2012-08-08]

CHR Extension: (Google Drive) - C:\Users\mcnattin\AppData\Local\Google\Chrome

\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-12-19]

CHR Extension: (Atari - Crystal Castles) - C:\Users\mcnattin\AppData\Local

\Google\Chrome\User Data\Default\Extensions\banaddnhdpncehndeoafnlibnkffodab

[2012-08-08]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\mcnattin

\AppData\Local\Google\Chrome\User Data\Default\Extensions

\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-07-25]

CHR Extension: (Isle of Tune) - C:\Users\mcnattin\AppData\Local\Google\Chrome

\User Data\Default\Extensions\bljldflafhmbedhjnlncilbhfcnfabgb [2012-08-08]

CHR Extension: (YouTube) - C:\Users\mcnattin\AppData\Local\Google\Chrome\User

Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-08-08]

CHR Extension: (Add to Amazon Wish List) - C:\Users\mcnattin\AppData\Local

\Google\Chrome\User Data\Default\Extensions\ciagpekplgpbepdgggflgmahnjgiaced

[2012-08-08]

CHR Extension: (Google Search) - C:\Users\mcnattin\AppData\Local\Google

\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-

08-08]

CHR Extension: (MightyText - SMS Text Messaging from Computer) - C:\Users

\mcnattin\AppData\Local\Google\Chrome\User Data\Default\Extensions

\dkfhfaphfkopdgpbfkebjfcblcafcmpi [2012-08-08]

CHR Extension: (Autocomplete = on) - C:\Users\mcnattin\AppData\Local\Google

\Chrome\User Data\Default\Extensions\ecpgkdflcnofdbbkiggklcfmgbnbabhh [2012-

08-08]

CHR Extension: (Full Screen Weather) - C:\Users\mcnattin\AppData\Local\Google

\Chrome\User Data\Default\Extensions\fkkaebihfmbofclegkcfkkemepfehibg [2012-

08-08]

CHR Extension: (Mail Checker Plus for Google Mail™) - C:\Users\mcnattin

\AppData\Local\Google\Chrome\User Data\Default\Extensions

\gffjhibehnempbkeheiccaincokdjbfe [2013-12-19]

CHR Extension: (AdBlock) - C:\Users\mcnattin\AppData\Local\Google\Chrome\User

Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-12-19]

CHR Extension: (LastPass: Free Password Manager) - C:\Users\mcnattin\AppData

\Local\Google\Chrome\User Data\Default\Extensions

\hdokiejnpimakedhajhdlcegeplioahd [2012-08-08]

CHR Extension: (Atari - Asteroids) - C:\Users\mcnattin\AppData\Local\Google

\Chrome\User Data\Default\Extensions\hlkamaohjodmnhiehbogggcllkndklok [2012-

08-08]

CHR Extension: (Obvibase: a truly simple database) - C:\Users\mcnattin

\AppData\Local\Google\Chrome\User Data\Default\Extensions

\hoddinokjifhganfcgkjmkkngljebjdj [2013-12-19]

CHR Extension: (Social Fixer for Facebook) - C:\Users\mcnattin\AppData\Local

\Google\Chrome\User Data\Default\Extensions\ifmhoabcaeehkljcfclfiieohkohdgbb

[2013-12-19]

CHR Extension: (Atari - Battlezone) - C:\Users\mcnattin\AppData\Local\Google

\Chrome\User Data\Default\Extensions\kdlhdokojmnkodfdbmcmkefgomjfmemj [2012-

08-08]

CHR Extension: (BugMeNot Lite) - C:\Users\mcnattin\AppData\Local\Google

\Chrome\User Data\Default\Extensions\lackfehpdclhclidcbbfcemcpolgdgnb [2012-

08-08]

CHR Extension: (Unfriend Alerts) - C:\Users\mcnattin\AppData\Local\Google

\Chrome\User Data\Default\Extensions\lgbeldbnadmemecalekdfnffgobkpafc [2014-

01-27]

CHR Extension: (Poppit!) - C:\Users\mcnattin\AppData\Local\Google\Chrome\User

Data\Default\Extensions\mcbkbpnkkkipelfledbfocopglifcfmi [2012-08-08]

CHR Extension: (Google Wallet) - C:\Users\mcnattin\AppData\Local\Google

\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-

10-28]

CHR Extension: (Atari - Adventure) - C:\Users\mcnattin\AppData\Local\Google

\Chrome\User Data\Default\Extensions\oacddljgpcacoonoenpchddloknchghg [2012-

08-08]

CHR Extension: (Outlook.com) - C:\Users\mcnattin\AppData\Local\Google\Chrome

\User Data\Default\Extensions\pfpeapihoiogbcmdmnibeplnikfnhoge [2013-12-19]

CHR Extension: (Gmail) - C:\Users\mcnattin\AppData\Local\Google\Chrome\User

Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-08-08]

CHR Extension: (Tapatalk Notifier) - C:\Users\mcnattin\AppData\Local\Google

\Chrome\User Data\Default\Extensions\plfhcjljnfjpfcbjpgnflfofmahljkjj [2013-

12-19]

CHR Profile: C:\Users\mcnattin\AppData\Local\Google\Chrome\User Data\Profile 1

CHR Extension: (No Name) - C:\Users\mcnattin\AppData\Local\Google\Chrome\User

Data\Profile 1\Extensions\banjjklfojcdbofbhbgiedekefohoaff [2013-11-21]

CHR Extension: (YouTube) - C:\Users\mcnattin\AppData\Local\Google\Chrome\User

Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-08-08]

CHR Extension: (Google Search) - C:\Users\mcnattin\AppData\Local\Google

\Chrome\User Data\Profile 1\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012

-08-08]

CHR Extension: (Gmail) - C:\Users\mcnattin\AppData\Local\Google\Chrome\User

Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-08-08]

CHR Profile: C:\Users\mcnattin\AppData\Local\Google\Chrome\User Data\Profile 2

CHR Extension: (Stopwatch) - C:\Users\mcnattin\AppData\Local\Google\Chrome

\User Data\Profile 2\Extensions\aadoiekgkmkaegbfdigeldnihdhebpon [2013-12-17]

CHR Extension: (Entanglement Web App) - C:\Users\mcnattin\AppData\Local

\Google\Chrome\User Data\Profile 2\Extensions\aciahcmjmecflokailenpkdchphgkefd

[2013-12-17]

CHR Extension: (Atari - Lunar Lander) - C:\Users\mcnattin\AppData\Local

\Google\Chrome\User Data\Profile 2\Extensions\aheampccjiggeiflpcjolbabpohbpclg

[2013-12-17]

CHR Extension: (Google Drive) - C:\Users\mcnattin\AppData\Local\Google\Chrome

\User Data\Profile 2\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-12-17]

CHR Extension: (Atari - Crystal Castles) - C:\Users\mcnattin\AppData\Local

\Google\Chrome\User Data\Profile 2\Extensions\banaddnhdpncehndeoafnlibnkffodab

[2013-12-17]

CHR Extension: (Bookmark Sentry (scanner)) - C:\Users\mcnattin\AppData\Local

\Google\Chrome\User Data\Profile 2\Extensions\bdglbbcbmgnimogcmcdenggkpdmihlga

[2014-01-09]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\mcnattin

\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions

\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-06]

CHR Extension: (Isle of Tune) - C:\Users\mcnattin\AppData\Local\Google\Chrome

\User Data\Profile 2\Extensions\bljldflafhmbedhjnlncilbhfcnfabgb [2013-12-17]

CHR Extension: (Add to Amazon Wish List) - C:\Users\mcnattin\AppData\Local

\Google\Chrome\User Data\Profile 2\Extensions\ciagpekplgpbepdgggflgmahnjgiaced

[2013-12-17]

CHR Extension: (MightyText - SMS Text Messaging from Computer) - C:\Users

\mcnattin\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions

\dkfhfaphfkopdgpbfkebjfcblcafcmpi [2014-09-09]

CHR Extension: (Add to Wunderlist) - C:\Users\mcnattin\AppData\Local\Google

\Chrome\User Data\Profile 2\Extensions\dmnddeddcgdllibmaodanoonljfdmooc [2013

-12-17]

CHR Extension: (MaskMe) - C:\Users\mcnattin\AppData\Local\Google\Chrome\User

Data\Profile 2\Extensions\dpkiidbpeijnaaacjlfnijncdlkicejg [2013-12-17]

CHR Extension: (Wunderlist - To-do and Task list) - C:\Users\mcnattin\AppData

\Local\Google\Chrome\User Data\Profile 2\Extensions

\fjliknjliaohjgjajlgolhijphojjdkc [2013-12-17]

CHR Extension: (Full Screen Weather) - C:\Users\mcnattin\AppData\Local\Google

\Chrome\User Data\Profile 2\Extensions\fkkaebihfmbofclegkcfkkemepfehibg [2013

-12-17]

CHR Extension: (LastPass: Free Password Manager) - C:\Users\mcnattin\AppData

\Local\Google\Chrome\User Data\Profile 2\Extensions

\hdokiejnpimakedhajhdlcegeplioahd [2013-12-13]

CHR Extension: (Atari - Asteroids) - C:\Users\mcnattin\AppData\Local\Google

\Chrome\User Data\Profile 2\Extensions\hlkamaohjodmnhiehbogggcllkndklok [2013

-12-17]

CHR Extension: (Obvibase: a truly simple database) - C:\Users\mcnattin

\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions

\hoddinokjifhganfcgkjmkkngljebjdj [2013-12-17]

CHR Extension: (Kindle Cloud Reader) - C:\Users\mcnattin\AppData\Local\Google

\Chrome\User Data\Profile 2\Extensions\icdipabjmbhpdkjaihfjoikhjjeneebd [2014

-02-20]

CHR Extension: (SMS from Gmail™ & Facebook™ (MightyText)) - C:\Users\mcnattin

\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions

\iffdacemhfpnchinokehhnppllonacfj [2014-04-02]

CHR Extension: (Social Fixer for Facebook) - C:\Users\mcnattin\AppData\Local

\Google\Chrome\User Data\Profile 2\Extensions\ifmhoabcaeehkljcfclfiieohkohdgbb

[2013-12-17]

CHR Extension: (Clearly) - C:\Users\mcnattin\AppData\Local\Google\Chrome\User

Data\Profile 2\Extensions\iooicodkiihhpojmmeghjclgihfjdjhj [2014-01-09]

CHR Extension: (Atari - Battlezone) - C:\Users\mcnattin\AppData\Local\Google

\Chrome\User Data\Profile 2\Extensions\kdlhdokojmnkodfdbmcmkefgomjfmemj [2013

-12-17]

CHR Extension: (Poppit!) - C:\Users\mcnattin\AppData\Local\Google\Chrome\User

Data\Profile 2\Extensions\mcbkbpnkkkipelfledbfocopglifcfmi [2013-12-17]

CHR Extension: (Hangouts) - C:\Users\mcnattin\AppData\Local\Google\Chrome\User

Data\Profile 2\Extensions\nckgahadagoaajjgafhacjanaoiihapd [2014-04-23]

CHR Extension: (LastPass Vault) - C:\Users\mcnattin\AppData\Local\Google

\Chrome\User Data\Profile 2\Extensions\ncliohomlfopnmlfkepkcbnhmeijkhhf [2013

-12-13]

CHR Extension: (Google Wallet) - C:\Users\mcnattin\AppData\Local\Google

\Chrome\User Data\Profile 2\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013

-07-19]

CHR Extension: (TabCloud) - C:\Users\mcnattin\AppData\Local\Google\Chrome\User

Data\Profile 2\Extensions\npecfdijgoblfcgagoijgmgejmcpnhof [2014-10-03]

CHR Extension: (Atari - Adventure) - C:\Users\mcnattin\AppData\Local\Google

\Chrome\User Data\Profile 2\Extensions\oacddljgpcacoonoenpchddloknchghg [2013

-12-17]

CHR Extension: (Click&Clean App) - C:\Users\mcnattin\AppData\Local\Google

\Chrome\User Data\Profile 2\Extensions\pdabfienifkbhoihedcgeogidfmibmhp [2013

-12-17]

CHR HKCU\...\Chrome\Extension: [banjjklfojcdbofbhbgiedekefohoaff] - C:\Users

\mcnattin\AppData\Local\CRE\banjjklfojcdbofbhbgiedekefohoaff.crx [2013-11-20]

CHR HKLM-x32\...\Chrome\Extension: [banjjklfojcdbofbhbgiedekefohoaff] - C:

\Users\mcnattin\AppData\Local\CRE\banjjklfojcdbofbhbgiedekefohoaff.crx [2013-

11-20]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the

registry. The file will not be moved unless listed separately.)

R2 BESClient; C:\Program Files (x86)\BigFix Enterprise\BES Client

\BESClient.exe [6540560 2014-06-13] (IBM Corp.)

R2 CcmExec; C:\Windows\CCM\CcmExec.exe [1571000 2013-09-11] (Microsoft

Corporation)

S4 CmRcService; C:\Windows\CCM\RemCtrl\CmRcService.exe [577720 2013-09-11]

(Microsoft Corporation)

R3 lpasvc; C:\Program Files\Microsoft Policy Platform\policyHost.exe [50280

2012-08-02] (Microsoft Corporation)

S3 lppsvc; C:\Program Files\Microsoft Policy Platform\policyHost.exe [50280

2012-08-02] (Microsoft Corporation)

R2 MbaeSvc; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe

[441144 2014-08-29] (Malwarebytes Corporation)

R2 McAfee SiteAdvisor Enterprise Service; C:\Program Files (x86)\McAfee

\SiteAdvisor Enterprise\McSACore.exe [231424 2009-05-05] () [File not signed]

R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808

2014-03-11] (Microsoft Corporation)

R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [50688 2012-07-31]

(Hewlett-Packard) [File not signed]

R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014

-03-11] (Microsoft Corporation)

S3 OpenVPNService; C:\Program Files (x86)\HMA! Pro VPN\bin\openvpnserv.exe

[37176 2013-09-25] (The OpenVPN Project)

R2 OracleMTSRecoveryService; C:\oracle\ora10g\bin\omtsreco.exe [57616 2005-08

-15] (Oracle Corporation) [File not signed]

R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [66048 2012-07-31]

(Hewlett-Packard) [File not signed]

S3 PSEXESVC; C:\Windows\PSEXESVC.EXE [99592 2010-04-07] (Sysinternals)

S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-02-28]

(Riverbed Technology, Inc.)

R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy

2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)

R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy

2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)

R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy

2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)

S3 smstsmgr; C:\Windows\CCM\TSManager.exe [276152 2013-09-11] (Microsoft

Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the

registry. The file will not be moved unless listed separately.)

R1 cbfs3; C:\Windows\system32\drivers\cbfs3.sys [352008 2012-11-10] (EldoS

Corporation)

R1 ESProtectionDriver; C:\Program Files (x86)\Malwarebytes Anti-Exploit

\mbae64.sys [63000 2014-08-30] ()

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25]

(Microsoft Corporation)

R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11]

(Microsoft Corporation)

R2 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-02-28] (Riverbed

Technology, Inc.)

R3 prepdrvr; C:\Windows\System32\DRIVERS\prepdrv.sys [26984 2013-09-11]

(Microsoft Corporation)

R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-13] (Brother

Industries Ltd.)

S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry.

Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-08 07:54 - 2014-10-08 07:54 - 00000000 ____D () C:\FRST

2014-10-07 14:17 - 2014-10-07 14:17 - 00000000 ____D () C:\Users\mcnattin

\AppData\Roaming\Xerox

2014-10-07 14:17 - 2014-10-07 14:17 - 00000000 ____D () C:\ProgramData\Xerox

2014-10-06 00:00 - 2014-09-24 21:08 - 00371712 _____ (Microsoft Corporation)

C:\Windows\system32\qdvd.dll

2014-10-06 00:00 - 2014-09-24 20:40 - 00519680 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\qdvd.dll

2014-09-30 13:30 - 2014-09-30 13:30 - 00000000 ____D () C:\hpbiostemp

2014-09-24 11:25 - 2014-09-15 13:10 - 37217224 _____ (Lenovo Group Limited)

C:\Users\mcnattin\Downloads\LSCSetup64.exe

2014-09-24 02:00 - 2014-09-09 17:11 - 00002048 _____ (Microsoft Corporation)

C:\Windows\system32\tzres.dll

2014-09-24 02:00 - 2014-09-09 16:47 - 00002048 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\tzres.dll

2014-09-23 03:00 - 2014-06-26 21:08 - 02777088 _____ (Microsoft Corporation)

C:\Windows\system32\msmpeg2vdec.dll

2014-09-23 03:00 - 2014-06-26 20:45 - 02285056 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\msmpeg2vdec.dll

2014-09-22 10:09 - 2014-08-01 06:53 - 01031168 _____ (Microsoft Corporation)

C:\Windows\system32\TSWorkspace.dll

2014-09-22 10:09 - 2014-08-01 06:35 - 00793600 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\TSWorkspace.dll

2014-09-22 10:09 - 2014-06-23 22:29 - 02565120 _____ (Microsoft Corporation)

C:\Windows\system32\d3d10warp.dll

2014-09-22 10:09 - 2014-06-23 21:59 - 01987584 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\d3d10warp.dll

2014-09-22 10:09 - 2014-05-30 03:08 - 00340992 _____ (Microsoft Corporation)

C:\Windows\system32\schannel.dll

2014-09-22 10:09 - 2014-05-30 03:08 - 00314880 _____ (Microsoft Corporation)

C:\Windows\system32\msv1_0.dll

2014-09-22 10:09 - 2014-05-30 03:08 - 00307200 _____ (Microsoft Corporation)

C:\Windows\system32\ncrypt.dll

2014-09-22 10:09 - 2014-05-30 03:08 - 00210944 _____ (Microsoft Corporation)

C:\Windows\system32\wdigest.dll

2014-09-22 10:09 - 2014-05-30 03:08 - 00086528 _____ (Microsoft Corporation)

C:\Windows\system32\TSpkg.dll

2014-09-22 10:09 - 2014-05-30 03:08 - 00022016 _____ (Microsoft Corporation)

C:\Windows\system32\credssp.dll

2014-09-22 10:09 - 2014-05-30 02:52 - 00259584 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\msv1_0.dll

2014-09-22 10:09 - 2014-05-30 02:52 - 00247808 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\schannel.dll

2014-09-22 10:09 - 2014-05-30 02:52 - 00220160 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\ncrypt.dll

2014-09-22 10:09 - 2014-05-30 02:52 - 00172032 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\wdigest.dll

2014-09-22 10:09 - 2014-05-30 02:52 - 00065536 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\TSpkg.dll

2014-09-22 10:09 - 2014-05-30 02:52 - 00017408 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\credssp.dll

2014-09-22 10:08 - 2014-09-04 21:10 - 00578048 _____ (Microsoft Corporation)

C:\Windows\system32\aepdu.dll

2014-09-22 10:08 - 2014-09-04 21:05 - 00424448 _____ (Microsoft Corporation)

C:\Windows\system32\aeinv.dll

2014-09-22 10:08 - 2014-06-24 21:05 - 14175744 _____ (Microsoft Corporation)

C:\Windows\system32\shell32.dll

2014-09-22 10:08 - 2014-06-24 20:41 - 12874240 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\shell32.dll

2014-09-10 03:10 - 2014-08-19 13:05 - 00374968 _____ (Microsoft Corporation)

C:\Windows\system32\iedkcs32.dll

2014-09-10 03:10 - 2014-08-19 12:39 - 00327872 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\iedkcs32.dll

2014-09-10 03:10 - 2014-08-18 18:01 - 23591424 _____ (Microsoft Corporation)

C:\Windows\system32\mshtml.dll

2014-09-10 03:10 - 2014-08-18 17:29 - 02724864 _____ (Microsoft Corporation)

C:\Windows\system32\mshtml.tlb

2014-09-10 03:10 - 2014-08-18 17:29 - 00004096 _____ (Microsoft Corporation)

C:\Windows\system32\ieetwcollectorres.dll

2014-09-10 03:10 - 2014-08-18 17:26 - 17455104 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\mshtml.dll

2014-09-10 03:10 - 2014-08-18 17:20 - 02793984 _____ (Microsoft Corporation)

C:\Windows\system32\iertutil.dll

2014-09-10 03:10 - 2014-08-18 17:19 - 05833728 _____ (Microsoft Corporation)

C:\Windows\system32\jscript9.dll

2014-09-10 03:10 - 2014-08-18 17:15 - 00547328 _____ (Microsoft Corporation)

C:\Windows\system32\vbscript.dll

2014-09-10 03:10 - 2014-08-18 17:15 - 00066048 _____ (Microsoft Corporation)

C:\Windows\system32\iesetup.dll

2014-09-10 03:10 - 2014-08-18 17:14 - 00083968 _____ (Microsoft Corporation)

C:\Windows\system32\MshtmlDac.dll

2014-09-10 03:10 - 2014-08-18 17:14 - 00048640 _____ (Microsoft Corporation)

C:\Windows\system32\ieetwproxystub.dll

2014-09-10 03:10 - 2014-08-18 17:08 - 04232704 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\jscript9.dll

2014-09-10 03:10 - 2014-08-18 17:08 - 00051200 _____ (Microsoft Corporation)

C:\Windows\system32\jsproxy.dll

2014-09-10 03:10 - 2014-08-18 17:08 - 00033792 _____ (Microsoft Corporation)

C:\Windows\system32\iernonce.dll

2014-09-10 03:10 - 2014-08-18 17:05 - 00596480 _____ (Microsoft Corporation)

C:\Windows\system32\ieui.dll

2014-09-10 03:10 - 2014-08-18 17:03 - 00758272 _____ (Microsoft Corporation)

C:\Windows\system32\jscript9diag.dll

2014-09-10 03:10 - 2014-08-18 17:03 - 00139264 _____ (Microsoft Corporation)

C:\Windows\system32\ieUnatt.exe

2014-09-10 03:10 - 2014-08-18 17:03 - 00111616 _____ (Microsoft Corporation)

C:\Windows\system32\ieetwcollector.exe

2014-09-10 03:10 - 2014-08-18 16:57 - 02724864 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\mshtml.tlb

2014-09-10 03:10 - 2014-08-18 16:56 - 00940032 _____ (Microsoft Corporation)

C:\Windows\system32\MsSpellCheckingFacility.exe

2014-09-10 03:10 - 2014-08-18 16:51 - 00446464 _____ (Microsoft Corporation)

C:\Windows\system32\dxtmsft.dll

2014-09-10 03:10 - 2014-08-18 16:46 - 00454656 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\vbscript.dll

2014-09-10 03:10 - 2014-08-18 16:45 - 00072704 _____ (Microsoft Corporation)

C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-09-10 03:10 - 2014-08-18 16:45 - 00061952 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\iesetup.dll

2014-09-10 03:10 - 2014-08-18 16:44 - 00061952 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\MshtmlDac.dll

2014-09-10 03:10 - 2014-08-18 16:44 - 00051200 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\ieetwproxystub.dll

2014-09-10 03:10 - 2014-08-18 16:42 - 02185728 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\iertutil.dll

2014-09-10 03:10 - 2014-08-18 16:40 - 00195584 _____ (Microsoft Corporation)

C:\Windows\system32\msrating.dll

2014-09-10 03:10 - 2014-08-18 16:39 - 00085504 _____ (Microsoft Corporation)

C:\Windows\system32\mshtmled.dll

2014-09-10 03:10 - 2014-08-18 16:39 - 00043008 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\jsproxy.dll

2014-09-10 03:10 - 2014-08-18 16:39 - 00032768 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\iernonce.dll

2014-09-10 03:10 - 2014-08-18 16:38 - 00289280 _____ (Microsoft Corporation)

C:\Windows\system32\dxtrans.dll

2014-09-10 03:10 - 2014-08-18 16:37 - 00440320 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\ieui.dll

2014-09-10 03:10 - 2014-08-18 16:36 - 00112128 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\ieUnatt.exe

2014-09-10 03:10 - 2014-08-18 16:35 - 00597504 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\jscript9diag.dll

2014-09-10 03:10 - 2014-08-18 16:27 - 00365056 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\dxtmsft.dll

2014-09-10 03:10 - 2014-08-18 16:25 - 00727040 _____ (Microsoft Corporation)

C:\Windows\system32\msfeeds.dll

2014-09-10 03:10 - 2014-08-18 16:25 - 00707072 _____ (Microsoft Corporation)

C:\Windows\system32\ie4uinit.exe

2014-09-10 03:10 - 2014-08-18 16:23 - 02104832 _____ (Microsoft Corporation)

C:\Windows\system32\inetcpl.cpl

2014-09-10 03:10 - 2014-08-18 16:23 - 01249280 _____ (Microsoft Corporation)

C:\Windows\system32\mshtmlmedia.dll

2014-09-10 03:10 - 2014-08-18 16:22 - 00060416 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-09-10 03:10 - 2014-08-18 16:19 - 00164864 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\msrating.dll

2014-09-10 03:10 - 2014-08-18 16:17 - 00243200 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\dxtrans.dll

2014-09-10 03:10 - 2014-08-18 16:17 - 00069632 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\mshtmled.dll

2014-09-10 03:10 - 2014-08-18 16:16 - 13588480 _____ (Microsoft Corporation)

C:\Windows\system32\ieframe.dll

2014-09-10 03:10 - 2014-08-18 16:15 - 11769856 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\ieframe.dll

2014-09-10 03:10 - 2014-08-18 16:15 - 02310656 _____ (Microsoft Corporation)

C:\Windows\system32\wininet.dll

2014-09-10 03:10 - 2014-08-18 16:09 - 00603136 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\msfeeds.dll

2014-09-10 03:10 - 2014-08-18 16:08 - 02014208 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\inetcpl.cpl

2014-09-10 03:10 - 2014-08-18 16:07 - 01068032 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\mshtmlmedia.dll

2014-09-10 03:10 - 2014-08-18 15:55 - 01447424 _____ (Microsoft Corporation)

C:\Windows\system32\urlmon.dll

2014-09-10 03:10 - 2014-08-18 15:46 - 01812992 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\wininet.dll

2014-09-10 03:10 - 2014-08-18 15:38 - 01190400 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\urlmon.dll

2014-09-10 03:10 - 2014-08-18 15:38 - 00775168 _____ (Microsoft Corporation)

C:\Windows\system32\ieapfltr.dll

2014-09-10 03:10 - 2014-08-18 15:36 - 00678400 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\ieapfltr.dll

2014-09-10 03:01 - 2014-07-06 21:06 - 01460736 _____ (Microsoft Corporation)

C:\Windows\system32\lsasrv.dll

2014-09-10 03:01 - 2014-07-06 21:06 - 00728064 _____ (Microsoft Corporation)

C:\Windows\system32\kerberos.dll

2014-09-10 03:01 - 2014-07-06 20:40 - 00550912 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\kerberos.dll

2014-09-10 03:01 - 2014-07-06 20:40 - 00022016 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\secur32.dll

2014-09-10 03:01 - 2014-07-06 20:39 - 00096768 _____ (Microsoft Corporation)

C:\Windows\SysWOW64\sspicli.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-08 07:54 - 2014-08-25 09:10 - 00004966 _____ () C:\Windows

\System32\Tasks\Microsoft Office 15 Sync Maintenance for {c7484f29-59d5-4295-

a244-d8fa0e95c746} evrt-156-03.ad.uillinois.edu

2014-10-08 07:54 - 2012-08-06 10:47 - 01156168 _____ () C:\Windows

\WindowsUpdate.log

2014-10-08 07:54 - 2010-04-07 09:59 - 00000582 _____ () C:\Windows\SMSCFG.INI

2014-10-08 07:51 - 2013-08-01 10:12 - 00000000 ___RD () C:\Users\mcnattin

\Dropbox

2014-10-08 07:51 - 2013-08-01 10:10 - 00000000 ____D () C:\Users\mcnattin

\AppData\Roaming\Dropbox

2014-10-08 07:50 - 2013-01-04 09:31 - 00000898 _____ () C:\Windows\Tasks

\GoogleUpdateTaskMachineCore.job

2014-10-08 07:50 - 2012-08-08 08:39 - 00006714 __RSH () C:\Users\mcnattin

\ntuser.pol

2014-10-08 07:50 - 2012-08-08 08:39 - 00000000 ____D () C:\Users\mcnattin

2014-10-08 07:49 - 2014-07-25 13:33 - 00012873 _____ () C:\Windows

\setupact.log

2014-10-08 07:49 - 2010-02-22 17:49 - 00002304 _____ () C:\Windows

\system32\config\netlogon.ftl

2014-10-08 07:49 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks

\SA.DAT

2014-10-08 07:48 - 2014-07-25 13:33 - 00012194 _____ () C:\Windows\PFRO.log

2014-10-08 07:43 - 2012-08-07 09:42 - 00000830 _____ () C:\Windows\Tasks\Adobe

Flash Player Updater.job

2014-10-08 07:30 - 2013-01-04 09:31 - 00000902 _____ () C:\Windows\Tasks

\GoogleUpdateTaskMachineUA.job

2014-10-08 05:29 - 2010-04-08 16:27 - 00000268 _____ () C:\Windows\Tasks\Adnet

Computers Wakeup.job

2014-10-08 03:29 - 2014-09-05 08:10 - 00003922 _____ () C:\Windows

\System32\Tasks\User_Feed_Synchronization-{B06CF94F-FA13-4762-AE5A-

7D2412E37E7E}

2014-10-07 16:24 - 2014-06-12 14:13 - 00000000 ____D () C:\ProgramData

\Malwarebytes Anti-Exploit

2014-10-07 16:18 - 2014-04-11 08:10 - 00122584 _____ (Malwarebytes

Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-10-07 14:18 - 2009-07-13 23:45 - 00018144 ____H () C:\Windows

\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-

601632D005A0

2014-10-07 14:18 - 2009-07-13 23:45 - 00018144 ____H () C:\Windows

\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-

601632D005A0

2014-10-07 14:17 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows

\system32\spool

2014-10-07 14:14 - 2014-08-14 08:13 - 00000576 _____ () C:\Windows

\LkmdfCoInst.log

2014-10-07 14:13 - 2012-10-12 16:21 - 00018960 _____ (Logitech, Inc.) C:

\Windows\system32\Drivers\LNonPnP.sys

2014-09-30 15:43 - 2010-02-25 11:42 - 00060746 __RSH () C:\ProgramData

\ntuser.pol

2014-09-25 13:42 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\rescache

2014-09-25 11:10 - 2012-08-08 09:59 - 00000000 ____D () C:\Users\mcnattin

\AppData\Local\Google

2014-09-23 22:43 - 2012-08-07 09:42 - 00701104 _____ (Adobe Systems

Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-09-23 22:43 - 2012-08-07 09:42 - 00003768 _____ () C:\Windows

\System32\Tasks\Adobe Flash Player Updater

2014-09-23 22:43 - 2011-06-13 16:45 - 00071344 _____ (Adobe Systems

Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-09-23 03:12 - 2012-08-06 12:35 - 00000000 ____D () C:\Program Files

\Microsoft Silverlight

2014-09-23 03:12 - 2012-08-06 12:35 - 00000000 ____D () C:\Program Files

(x86)\Microsoft Silverlight

2014-09-23 03:12 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows

\SysWOW64\Dism

2014-09-23 03:12 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows

\system32\Dism

2014-09-23 03:09 - 2012-08-06 12:36 - 00000000 ____D () C:\ProgramData

\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight

2014-09-23 03:08 - 2013-12-17 15:05 - 00000000 ____D () C:\Windows

\system32\MRT

2014-09-23 03:00 - 2014-04-25 03:01 - 00000000 ___SD () C:\Windows

\system32\CompatTel

2014-09-22 16:17 - 2012-08-08 14:24 - 00000000 ____D () C:\Users\mcnattin

\AppData\Roaming\PC-Mac PasswordVault 2.x

2014-09-22 01:42 - 2010-02-22 17:18 - 00278152 ____N (Microsoft Corporation)

C:\Windows\system32\MpSigStub.exe

2014-09-17 21:06 - 2013-08-01 10:11 - 00000000 ____D () C:\Users\mcnattin

\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

2014-09-10 03:12 - 2013-04-01 13:15 - 00000000 ___RD () C:\ProgramData

\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013

2014-09-10 03:12 - 2010-02-25 12:31 - 00000000 ____D () C:\ProgramData

\Microsoft Help

2014-09-10 03:05 - 2010-04-07 10:01 - 01662722 _____ () C:\Windows

\SysWOW64\PerfStringBackup.INI

2014-09-10 03:05 - 2010-03-24 11:11 - 00750468 _____ () C:\Windows

\system32\perfh00C.dat

2014-09-10 03:05 - 2010-03-24 11:11 - 00151186 _____ () C:\Windows

\system32\perfc00C.dat

2014-09-10 03:05 - 2009-07-14 00:13 - 01662722 _____ () C:\Windows

\system32\PerfStringBackup.INI

2014-09-09 15:14 - 2014-06-12 14:13 - 00000000 ____D () C:\ProgramData

\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Exploit

2014-09-09 15:14 - 2014-06-12 14:13 - 00000000 ____D () C:\Program Files

(x86)\Malwarebytes Anti-Exploit

2014-09-08 08:04 - 2010-03-19 12:45 - 00000000 ____D () C:\Windows\Minidump

Some content of TEMP:

====================

C:\Users\mcnattin\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-

8f84-3e3e7ecf0d81}.tmpspgtqd.dll

C:\Users\rrc\AppData\Local\Temp\AdobeUpdater12345.exe

C:\Users\rrc\AppData\Local\Temp\FlashPlayerUpdate.exe

C:\Users\rrc\AppData\Local\Temp\FP_AX_MSI_INSTALLER.exe

C:\Users\rrc\AppData\Local\Temp\FP_PL_MSI_INSTALLER.exe

C:\Users\rrc\AppData\Local\Temp\jre-6u22-windows-i586-iftw-rv.exe

C:\Users\rrc\AppData\Local\Temp\jre-6u23-windows-i586-iftw-rv.exe

C:\Users\rrc\AppData\Local\Temp\jre-6u24-windows-i586-iftw-rv.exe

C:\Users\rrc\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe

C:\Users\rrc\AppData\Local\Temp\setup.exe

C:\Users\rrc.UOFI\AppData\Local\Temp\H2Reg.exe

C:\Users\rrc.UOFI\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe

C:\Users\rrc.UOFI\AppData\Local\Temp\ose00000.exe

C:\Users\rrc.UOFI\AppData\Local\Temp\unzip.exe

C:\Users\rrc.UOFI\AppData\Local\Temp\zip.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-10-06 03:31

==================== End Of Log ============================

MrCharlie · October 8, 2014

Open up notepad and un-check Word Wrap under Format

Now repost the logs.

MrC

awakenedmachine · October 8, 2014

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 06-10-2014

==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Forefront Endpoint Protection (Enabled - Up to date) {641105E6-

77ED-3F35-A304-765193BCB75F}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-

DA132C1ACF46}

AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-

A930-C1CA5F20A4B0}

AS: Microsoft Forefront Endpoint Protection (Enabled - Up to date) {DF70E402-

51D7-30BB-99B4-4D23E83BFDE2}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to

unhide them. The adware programs should be uninstalled manually.)

64 Bit HP CIO Components Installer (Version: 13.2.1 - Hewlett-Packard) Hidden

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 14.0.0.178 - Adobe Systems

Incorporated)

Adobe AIR (x32 Version: 14.0.0.178 - Adobe Systems Incorporated) Hidden

Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX)

(Version: 15.0.0.167 - Adobe Systems Incorporated)

Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin)

(Version: 15.0.0.152 - Adobe Systems Incorporated)

Adobe PDFL 8.0 (HKLM-x32\...\{FAE96886-BFF3-40F0-B04D-320A8A45DDEB}) (Version:

5.40.322 - EMC)

Adobe PDFL 9.1 Component (HKLM-x32\...\{BCFBD0D3-4169-4CBE-84D0-5DC3BC9298B5})

(Version: 9.1 - EMC)

Adobe Reader X (10.1.11) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AA1000000001})

(Version: 10.1.11 - Adobe Systems Incorporated)

Amazon Cloud Drive (HKCU\...\23ab716f18849b6f) (Version: 2.1.2013.1340 -

Amazon)

Amazon Cloud Player (HKCU\...\Amazon Amazon Cloud Player) (Version: 1.7.0.344

- Amazon Services LLC)

Amazon Kindle (HKCU\...\Amazon Kindle) (Version: - Amazon)

Apple Application Support (HKLM-x32\...\{AAC5D43E-816D-4C2D-8E51-

55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842})

(Version: 7.1.1.3 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE})

(Version: 2.1.3.127 - Apple Inc.)

Aspell English Dictionary-0.50-2 (HKLM-x32\...\Aspell English Dictionary_is1)

(Version: - GNU)

Audacity 2.0.5 (HKLM-x32\...\Audacity_is1) (Version: 2.0.5 - Audacity Team)

Bluetooth Stack for Windows by Toshiba (HKLM\...\{CEBB6BFB-D708-4F99-A633-

BC2600E01EF6}) (Version: v9.10.01 - TOSHIBA CORPORATION)

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 -

Apple Inc.)

Bulk Rename Utility 2.7.1.2 (HKLM-x32\...\Bulk Rename Utility_is1) (Version:

- TGRMN Software)

CCleaner (HKLM\...\CCleaner) (Version: 4.16 - Piriform)

Configuration Manager Client (Version: 5.00.7958.1000 - Microsoft Corporation)

Hidden

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-

x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{650DE870-

ECA3-4E63-8D77-778512BE5D4C}) (Version: - Microsoft)

Definition Update for Microsoft Office 2013 (KB2760587) 32-Bit Edition (HKLM-

x32\...\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{BF1E7B7B-

8FBB-45C8-B170-214AA0F4F6AE}) (Version: - Microsoft)

DirectX 9 Runtime (x32 Version: 1.00.0000 - Sonic Solutions) Hidden

DocumentDirect 4.3.6 High Resolution Print Plugin (HKLM-x32\...\{0664FD5D-

2346-4899-9BE5-AF35641847BC}) (Version: 43.68.1 - University of Illinois)

Dropbox (HKCU\...\Dropbox) (Version: 2.10.30 - Dropbox, Inc.)

Duplicate Cleaner Free 3.2.3 (HKLM-x32\...\Duplicate Cleaner Free) (Version:

3.2.3 - DigitalVolcano Software Ltd) <==== ATTENTION

eReg (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden

GNU Aspell 0.50-3 (HKLM-x32\...\GNU Aspell_is1) (Version: - GNU)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 37.0.2062.124 - Google

Inc.)

Google Drive (HKLM-x32\...\{C6640705-7479-4EE5-BC86-879F05F65E74}) (Version:

1.17.7290.4094 - Google, Inc.)

Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden

GTK+ Runtime 2.14.7 rev a (remove only) (HKLM-x32\...\GTK 2.0) (Version: - )

Helium (HKLM-x32\...\{9A781940-AC41-4D5E-8E1E-76A04B916FB9}) (Version: 1.0.0 -

ClockworkMod)

HMA! Pro VPN 2.8.3.9 (HKLM-x32\...\HMA! Pro VPN) (Version: 2.8.3.9 - Privax

Ltd)

IBM Endpoint Manager Client (HKLM-x32\...\{060E1AE8-919D-4965-9915-

B076B7F99DAF}) (Version: 9.0.787.0 - IBM Corp.)

IBM Endpoint Manager Client (HKLM-x32\...\{FAE19304-2AE1-4CDF-AB32-

5D97BE327A0B}) (Version: 9.1.1117.0 - IBM Corp.)

Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-

B9AC9A5886EA}) (Version: 9.17.10.2932 - Intel Corporation)

Java 7 Update 67 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417067FF})

(Version: 7.0.670 - Oracle)

Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF})

(Version: 7.0.670 - Oracle)

Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) Hidden

JPEGmini (HKCU\...\5d2010e174743543) (Version: 1.8.23.0 - ICVT Ltd)

LastPass (uninstall only) (HKLM-x32\...\LastPass) (Version: - LastPass)

Logitech SetPoint 6.32 (HKLM\...\sp6) (Version: 6.32.20 - Logitech)

Malwarebytes Anti-Exploit version 1.04.1.1012 (HKLM\...\Malwarebytes Anti-

Exploit_is1) (Version: 1.04.1.1012 - Malwarebytes)

Malwarebytes Anti-Malware version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-

Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)

MathType 6 (HKLM-x32\...\DSMT6) (Version: 6.7 - Design Science, Inc.)

McAfee SiteAdvisor Enterprise (HKLM-x32\...\{0B9375F0-ADAC-4843-AAFF-

BAB7D8340BE0}) (Version: 1.6.0.120 - McAfee, Inc.)

Microsoft .NET Framework 4.5.1 (FRA) (Version: 4.5.50938 - Microsoft

Corporation) Hidden

Microsoft .NET Framework 4.5.1 (Français) (HKLM\...\{92FB6C44-E685-45AD-9B20-

CADF4CABA132} - 1036) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-

CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation)

Hidden

Microsoft Access MUI (English) 2013 (x32 Version: 15.0.4569.1506 - Microsoft

Corporation) Hidden

Microsoft Access Setup Metadata MUI (English) 2013 (x32 Version:

15.0.4569.1506 - Microsoft Corporation) Hidden

Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft

Corporation) Hidden

Microsoft DCF MUI (English) 2013 (x32 Version: 15.0.4569.1506 - Microsoft

Corporation) Hidden

Microsoft Endpoint Protection Management Components (Version: 4.4.0304.0 -

Microsoft Corporation) Hidden

Microsoft Excel MUI (English) 2013 (x32 Version: 15.0.4569.1506 - Microsoft

Corporation) Hidden

Microsoft Forefront Endpoint Protection (HKLM\...\Microsoft Security Client)

(Version: 4.5.216.0 - Microsoft Corporation)

Microsoft Forefront Endpoint Protection 2010 Server Management (Version:

4.4.0304.0 - Microsoft Corporation) Hidden

Microsoft Groove MUI (English) 2013 (x32 Version: 15.0.4569.1506 - Microsoft

Corporation) Hidden

Microsoft InfoPath MUI (English) 2013 (x32 Version: 15.0.4569.1506 - Microsoft

Corporation) Hidden

Microsoft Lync MUI (English) 2013 (x32 Version: 15.0.4569.1506 - Microsoft

Corporation) Hidden

Microsoft Office 64-bit Components 2013 (Version: 15.0.4569.1506 - Microsoft

Corporation) Hidden

Microsoft Office Access MUI (English) 2010 (x32 Version: 14.0.7015.1000 -

Microsoft Corporation) Hidden

Microsoft Office Access Setup Metadata MUI (English) 2010 (x32 Version:

14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Excel MUI (English) 2010 (x32 Version: 14.0.7015.1000 -

Microsoft Corporation) Hidden

Microsoft Office Groove MUI (English) 2010 (x32 Version: 14.0.7015.1000 -

Microsoft Corporation) Hidden

Microsoft Office InfoPath MUI (English) 2010 (x32 Version: 14.0.7015.1000 -

Microsoft Corporation) Hidden

Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 -

Microsoft Corporation) Hidden

Microsoft Office OneNote MUI (English) 2010 (x32 Version: 14.0.7015.1000 -

Microsoft Corporation) Hidden

Microsoft Office OSM MUI (English) 2013 (x32 Version: 15.0.4569.1506 -

Microsoft Corporation) Hidden

Microsoft Office OSM UX MUI (English) 2013 (x32 Version: 15.0.4569.1506 -

Microsoft Corporation) Hidden

Microsoft Office Outlook MUI (English) 2010 (x32 Version: 14.0.7015.1000 -

Microsoft Corporation) Hidden

Microsoft Office PowerPoint MUI (English) 2010 (x32 Version: 14.0.7015.1000 -

Microsoft Corporation) Hidden

Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS)

(Version: 14.0.7015.1000 - Microsoft Corporation)

Microsoft Office Professional Plus 2010 (x32 Version: 14.0.7015.1000 -

Microsoft Corporation) Hidden

Microsoft Office Professional Plus 2013 (HKLM-x32\...\Office15.PROPLUS)

(Version: 15.0.4569.1506 - Microsoft Corporation)

Microsoft Office Professional Plus 2013 (x32 Version: 15.0.4569.1506 -

Microsoft Corporation) Hidden

Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft

Corporation) Hidden

Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft

Corporation) Hidden

Microsoft Office Proof (Spanish) 2010 (x32 Version: 14.0.7015.1000 - Microsoft

Corporation) Hidden

Microsoft Office Proofing (English) 2010 (x32 Version: 14.0.7015.1000 -

Microsoft Corporation) Hidden

Microsoft Office Proofing (English) 2013 (x32 Version: 15.0.4569.1506 -

Microsoft Corporation) Hidden

Microsoft Office Proofing Tools 2013 - English (x32 Version: 15.0.4569.1506 -

Microsoft Corporation) Hidden

Microsoft Office Proofing Tools 2013 - Español (x32 Version: 15.0.4569.1506 -

Microsoft Corporation) Hidden

Microsoft Office Publisher MUI (English) 2010 (x32 Version: 14.0.7015.1000 -

Microsoft Corporation) Hidden

Microsoft Office Shared 64-bit MUI (English) 2010 (Version: 14.0.7015.1000 -

Microsoft Corporation) Hidden

Microsoft Office Shared 64-bit MUI (English) 2013 (Version: 15.0.4569.1506 -

Microsoft Corporation) Hidden

Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010 (Version:

14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2013 (Version:

15.0.4569.1506 - Microsoft Corporation) Hidden

Microsoft Office Shared MUI (English) 2010 (x32 Version: 14.0.7015.1000 -

Microsoft Corporation) Hidden

Microsoft Office Shared MUI (English) 2013 (x32 Version: 15.0.4569.1506 -

Microsoft Corporation) Hidden

Microsoft Office Shared Setup Metadata MUI (English) 2010 (x32 Version:

14.0.7015.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared Setup Metadata MUI (English) 2013 (x32 Version:

15.0.4569.1506 - Microsoft Corporation) Hidden

Microsoft Office Word MUI (English) 2010 (x32 Version: 14.0.7015.1000 -

Microsoft Corporation) Hidden

Microsoft OneNote MUI (English) 2013 (x32 Version: 15.0.4569.1506 - Microsoft

Corporation) Hidden

Microsoft Outlook MUI (English) 2013 (x32 Version: 15.0.4569.1506 - Microsoft

Corporation) Hidden

Microsoft Policy Platform (Version: 1.2.3602.0 - Microsoft Corporation) Hidden

Microsoft PowerPoint MUI (English) 2013 (x32 Version: 15.0.4569.1506 -

Microsoft Corporation) Hidden

Microsoft Publisher MUI (English) 2013 (x32 Version: 15.0.4569.1506 -

Microsoft Corporation) Hidden

Microsoft Security Client (Version: 4.5.0216.0 - Microsoft Corporation) Hidden

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00})

(Version: 5.1.30514.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-

473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-

8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-

81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-

8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-

4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...

\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft

Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...

\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft

Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...

\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft

Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...

\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft

Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...

\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft

Corporation)

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...

\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft

Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...

\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft

Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\...

\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft

Corporation)

Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106 (x32 Version:

11.0.51106 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106 (x32 Version:

11.0.51106 - Microsoft Corporation) Hidden

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...

\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version:

10.0.50701 - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (Version:

10.0.50706 - Microsoft Corporation) Hidden

Microsoft Word MUI (English) 2013 (x32 Version: 15.0.4569.1506 - Microsoft

Corporation) Hidden

Movie Maker (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden

Mozilla Firefox 28.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 en-

US)) (Version: 28.0 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version:

28.0 - Mozilla)

MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden

MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden

MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden

MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71})

(Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC})

(Version: 4.20.9876.0 - Microsoft Corporation)

MusicBee 2.1 (HKLM-x32\...\MusicBee) (Version: 2.1 - Steven Mayall)

MyFreeCodec (HKCU\...\MyFreeCodec) (Version: - )

Oracle Data Provider for .NET Help (HKLM-x32\...\{6AA003BF-73E5-4911-ADB7-

71DD5674DDD4}) (Version: 10.2.000 - Oracle Corporation)

Outils de vérification linguistique 2013 de Microsoft Office - Français (x32

Version: 15.0.4569.1506 - Microsoft Corporation) Hidden

PasswordVault Lite v8.0.1 (HKLM-x32\...\PasswordVault_Lite_v8.0.1) (Version:

- )

Photo Gallery (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden

QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version:

7.75.80.95 - Apple Inc.)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-

958108FE7DBC}) (Version: 6.0.1.6080 - Realtek Semiconductor Corp.)

Recuva (HKLM\...\Recuva) (Version: 1.50 - Piriform)

Replay Media Catcher 5 (5.0.1.36) (HKLM-x32\...\Replay Media Catcher 5)

(Version: 5.0.1.36 - Applian Technologies)

Replay Music 5 (HKLM-x32\...\ReplayMusic5.60) (Version: 5.60 - Applian

Technologies Inc.)

Roxio Activation Module (x32 Version: 1.0 - Roxio) Hidden

Roxio Creator Audio (x32 Version: 3.8.0 - Roxio) Hidden

Roxio Creator Business (HKLM-x32\...\{537BF16E-7412-448C-95D8-846E85A1D817})

(Version: 10.3.56.24 - Roxio)

Roxio Creator Business v10 (x32 Version: 3.8.0 - Roxio) Hidden

Roxio Creator Copy (x32 Version: 3.8.0 - Roxio) Hidden

Roxio Creator Data (x32 Version: 3.8.0 - Roxio) Hidden

Roxio Creator Tools (x32 Version: 3.8.0 - Roxio) Hidden

Roxio MyDVD (x32 Version: 10.1.349 - Roxio) Hidden

Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-

534B1200980A}) (Version: 2.5.3.13052_10 - Samsung Electronics Co., Ltd.)

Samsung Kies (x32 Version: 2.5.3.13052_10 - Samsung Electronics Co., Ltd.)

Hidden

Samsung Story Album Viewer (HKLM-x32\...\InstallShield_{698BBAD8-B116-495D-

B879-0F07A533E57F}) (Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.)

Samsung Story Album Viewer (x32 Version: 1.0.0.13054_1 - Samsung Electronics

Co., Ltd.) Hidden

SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-

6E92D8111E44}) (Version: 1.5.45.0 - SAMSUNG Electronics Co., Ltd.)

SAP BusinessObjects Enterprise XI 3.1 Client Tools SP3 (HKLM-x32\...

\{DAEF4F05-C369-4910-87C8-819C5B3D43E2}) (Version: 12.3.0.601 - SAP AG)

SAP BusinessObjects Enterprise XI 3.1 Client Tools SP4 Update (HKLM-x32\...

\{E4949088-6126-4C72-8B74-13315AA94D74}) (Version: 12.4.0.966 - SAP AG)

Service Pack 1 for Microsoft Office 2013 (KB2850036) 32-Bit Edition (HKLM-

x32\...\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{7F6C4883-

A18C-459A-82C1-A2F9403F2DA6}) (Version: - Microsoft)

Service Pack 1 for Microsoft Office 2013 (KB2850036) 32-Bit Edition (x32

Version: - Microsoft) Hidden

Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-

x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-

32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)

Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32

Version: - Microsoft) Hidden

Slacker Software Player (HKLM-x32\...\Slacker SoftwarePlayer) (Version:

1.0.0169.0000 - Slacker)

Sonic Activation Module (x32 Version: 1.0 - Sonic Solutions) Hidden

Sonic CinePlayer Decoder Pack (x32 Version: 4.3.0 - Sonic Solutions) Hidden

Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-

FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)

SUABnR (HKLM-x32\...\InstallShield_{2485354C-6B65-4978-BB91-CCE61442377B})

(Version: 1.1.0.13103_1 - Samsung Electronics Co., Ltd.)

SUABnR (x32 Version: 1.1.0.13103_1 - Samsung Electronics Co., Ltd.) Hidden

Unity Web Player (HKCU\...\UnityWebPlayer) (Version: 4.5.0f6 - Unity

Technologies ApS)

Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...

\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{B4A38370-2ADB-46B0-

A1B0-0C4A2F7DCA31}) (Version: - Microsoft)

Update for Microsoft Excel 2010 (KB2889836) 32-Bit Edition (HKLM-x32\...

\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{9179FC17-97A8-4D98-

9E09-05720AF5D44E}) (Version: - Microsoft)

Update for Microsoft Excel 2013 (KB2889861) 32-Bit Edition (HKLM-x32\...

\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{F47D9DA0-739D-4FEE-

A2CD-16B23382F7EE}) (Version: - Microsoft)

Update for Microsoft Excel 2013 (KB2889861) 32-Bit Edition (HKLM-x32\...

\{90150000-0016-0409-0000-0000000FF1CE}_Office15.PROPLUS_{F47D9DA0-739D-4FEE-

A2CD-16B23382F7EE}) (Version: - Microsoft)

Update for Microsoft Excel 2013 (KB2889861) 32-Bit Edition (HKLM-x32\...

\{90150000-0018-0409-0000-0000000FF1CE}_Office15.PROPLUS_{F47D9DA0-739D-4FEE-

A2CD-16B23382F7EE}) (Version: - Microsoft)

Update for Microsoft Excel 2013 (KB2889861) 32-Bit Edition (HKLM-x32\...

\{90150000-001B-0409-0000-0000000FF1CE}_Office15.PROPLUS_{F47D9DA0-739D-4FEE-

A2CD-16B23382F7EE}) (Version: - Microsoft)

Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...

\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{302A8FE3-EBF5-486C-

A431-16A1CD914443}) (Version: - Microsoft)

Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...

\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{302A8FE3-EBF5-486C-

A431-16A1CD914443}) (Version: - Microsoft)

Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...

\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{4EEA3D3E-989C-4DF4-

AB0A-3042C0C12AA3}) (Version: - Microsoft)

Update for Microsoft InfoPath 2010 (KB2817396) 32-Bit Edition (HKLM-x32\...

\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{39767ECA-1731-45DB-

AB5B-6BF40E151D66}) (Version: - Microsoft)

Update for Microsoft Lync 2013 (KB2881083) 32-Bit Edition (HKLM-x32\...

\{90150000-012B-0409-0000-0000000FF1CE}_Office15.PROPLUS_{7DF13AFE-A484-4178-

A82D-EF0689A24775}) (Version: - Microsoft)

Update for Microsoft Lync 2013 (KB2889860) 32-Bit Edition (HKLM-x32\...

\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{1AB594AE-C42D-4194-

931B-29AD09067631}) (Version: - Microsoft)

Update for Microsoft Lync 2013 (KB2889860) 32-Bit Edition (HKLM-x32\...

\{90150000-002A-0000-1000-0000000FF1CE}_Office15.PROPLUS_{1AB594AE-C42D-4194-

931B-29AD09067631}) (Version: - Microsoft)

Update for Microsoft Lync 2013 (KB2889860) 32-Bit Edition (HKLM-x32\...

\{90150000-012B-0409-0000-0000000FF1CE}_Office15.PROPLUS_{1AB594AE-C42D-4194-

931B-29AD09067631}) (Version: - Microsoft)

Update for Microsoft Office 2010 (KB2494150) (HKLM-x32\...\{90140000-0011-

0000-0000-0000000FF1CE}_Office14.PROPLUS_{3FCFD88F-4D13-4F38-8625-

ABABEA7F61EA}) (Version: - Microsoft)

Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...

\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DADF7E25-FFA4-4D02-

BE84-1DAE62C18516}) (Version: - Microsoft)

Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...

\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{F4284D93-7AE8-4309-

8CF3-9AD394F35F3A}) (Version: - Microsoft)

Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...

\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{F4284D93-7AE8-4309-

8CF3-9AD394F35F3A}) (Version: - Microsoft)

Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...

\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{287A1E92-9E41-4BC1-

8920-B3D0E9220800}) (Version: - Microsoft)

Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...

\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{9D69691D-823D-4C3E-

9B12-563A3F520366}) (Version: - Microsoft)

Update for Microsoft Office 2010 (KB2687502) 32-Bit Edition (HKLM-x32\...

\{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUS_{7DE7DF97-82FE-4B3A-

AB8D-1621F9CC464A}) (Version: - Microsoft)

Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...

\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{ECFE33A3-B8B7-439A-

ADE4-59FBD29EF9B8}) (Version: - Microsoft)

Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...

\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{ECFE33A3-B8B7-439A-

ADE4-59FBD29EF9B8}) (Version: - Microsoft)

Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM-x32\...

\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{35698CB7-AAA2-4577-

B505-DBFF504AEF23}) (Version: - Microsoft)

Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...

\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{5AA578BB-759C-40FD-

9661-A737C0884541}) (Version: - Microsoft)

Update for Microsoft Office 2010 (KB2825635) 32-Bit Edition (HKLM-x32\...

\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{F1A20C69-9FE5-40FD-

9CD5-84EABC2EF64A}) (Version: - Microsoft)

Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (HKLM-x32\...

\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{BA610006-2C39-4419-

9834-CF61AB24810A}) (Version: - Microsoft)

Update for Microsoft Office 2010 (KB2837581) 32-Bit Edition (HKLM-x32\...

\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{334FB202-28D7-4BA4-

8BC9-4FE4AB233EA0}) (Version: - Microsoft)

Update for Microsoft Office 2010 (KB2837606) 32-Bit Edition (HKLM-x32\...

\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{B0D672F7-883E-4279-

8E75-D97A5445AB46}) (Version: - Microsoft)

Update for Microsoft Office 2010 (KB2878252) 32-Bit Edition (HKLM-x32\...

\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{B0DB9F71-E0F7-4FE6-

8925-35B860CAC0C4}) (Version: - Microsoft)

Update for Microsoft Office 2010 (KB2881028) 32-Bit Edition (HKLM-x32\...

\{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUS_{089DBFD7-8211-43B2-

AAAE-5BDD8C23E3A8}) (Version: - Microsoft)

Update for Microsoft Office 2010 (KB2881028) 32-Bit Edition (HKLM-x32\...

\{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUS_{794A0574-4E2F-4D58-

B2A0-D7460ACDC85C}) (Version: - Microsoft)

Update for Microsoft Office 2013 (KB2760249) 32-Bit Edition (HKLM-x32\...

\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{8C07AD38-38EB-4332-

BCB3-F55A77C927DF}) (Version: - Microsoft)

Update for Microsoft Office 2013 (KB2760344) 32-Bit Edition (HKLM-x32\...

\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{A7610F07-E844-4444-

8E1D-D5BC8AD0B4C5}) (Version: - Microsoft)

Update for Microsoft Office 2013 (KB2760544) 32-Bit Edition (HKLM-x32\...

\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{45B7D395-EB9B-414F-

9E46-5849B42326E2}) (Version: - Microsoft)

Update for Microsoft Office 2013 (KB2768012) 32-Bit Edition (HKLM-x32\...

\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{66421820-D3CA-450A-

898C-78D7E40108E6}) (Version: - Microsoft)

Update for Microsoft Office 2013 (KB2817302) 32-Bit Edition (HKLM-x32\...

\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{1644D7F6-90EE-4252-

8884-18E4E330529D}) (Version: - Microsoft)

Update for Microsoft Office 2013 (KB2817302) 32-Bit Edition (HKLM-x32\...

\{90150000-0016-0409-0000-0000000FF1CE}_Office15.PROPLUS_{1644D7F6-90EE-4252-

8884-18E4E330529D}) (Version: - Microsoft)

Update for Microsoft Office 2013 (KB2837644) 32-Bit Edition (HKLM-x32\...

\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{9BC5FF1D-9626-44D7-

BC7F-EB44BD8BDB9F}) (Version: - Microsoft)

Update for Microsoft Office 2013 (KB2863843) 32-Bit Edition (HKLM-x32\...

\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{AD7045B8-1D75-4B4C-

8120-12F045D206C7}) (Version: - Microsoft)

Update for Microsoft Office 2013 (KB2863843) 32-Bit Edition (HKLM-x32\...

\{90150000-002A-0000-1000-0000000FF1CE}_Office15.PROPLUS_{AD7045B8-1D75-4B4C-

8120-12F045D206C7}) (Version: - Microsoft)

Update for Microsoft Office 2013 (KB2880462) 32-Bit Edition (HKLM-x32\...

\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{5D6439FF-D651-4B13-

B52E-2508AB9DE19D}) (Version: - Microsoft)

Update for Microsoft Office 2013 (KB2880462) 32-Bit Edition (HKLM-x32\...

\{90150000-006E-0409-0000-0000000FF1CE}_Office15.PROPLUS_{5D6439FF-D651-4B13-

B52E-2508AB9DE19D}) (Version: - Microsoft)

Update for Microsoft Office 2013 (KB2880478) 32-Bit Edition (HKLM-x32\...

\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{7C5CEE0F-6823-4BB7-

A28F-76FEC14EB6AC}) (Version: - Microsoft)

Update for Microsoft Office 2013 (KB2881001) 32-Bit Edition (HKLM-x32\...

\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{31849233-AD8B-42D7-

9AE1-74C79C8E8C03}) (Version: - Microsoft)

Update for Microsoft Office 2013 (KB2881009) 32-Bit Edition (HKLM-x32\...

\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{7A3EF4FF-A9C8-4F7E-

8020-A45F7D319387}) (Version: - Microsoft)

Update for Microsoft Office 2013 (KB2881035) 32-Bit Edition (HKLM-x32\...

\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{01B80B63-C638-4004-

9148-75B8C8518B1E}) (Version: - Microsoft)

Update for Microsoft Office 2013 (KB2881035) 32-Bit Edition (HKLM-x32\...

\{90150000-0016-0409-0000-0000000FF1CE}_Office15.PROPLUS_{01B80B63-C638-4004-

9148-75B8C8518B1E}) (Version: - Microsoft)

Update for Microsoft Office 2013 (KB2881035) 32-Bit Edition (HKLM-x32\...

\{90150000-0090-0409-0000-0000000FF1CE}_Office15.PROPLUS_{01B80B63-C638-4004-

9148-75B8C8518B1E}) (Version: - Microsoft)

Update for Microsoft Office 2013 (KB2881039) 32-Bit Edition (HKLM-x32\...

\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{1B208923-2810-414F-

82CC-AFFC1B19563F}) (Version: - Microsoft)

Update for Microsoft Office 2013 (KB2881081) 32-Bit Edition (HKLM-x32\...

\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{6171BC1B-907E-44D4-

930A-4AE0D9260E65}) (Version: - Microsoft)

Update for Microsoft Office 2013 (KB2883036) 32-Bit Edition (HKLM-x32\...

\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{B8E73381-09B1-4895-

ACD0-34385B0F526D}) (Version: - Microsoft)

Update for Microsoft Office 2013 (KB2883049) 32-Bit Edition (HKLM-x32\...

\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{1C6260FD-A280-49FE-

89D0-CCEC647FBD8E}) (Version: - Microsoft)

Update for Microsoft Office 2013 (KB2883060) 32-Bit Edition (HKLM-x32\...

\{90150000-001F-0409-0000-0000000FF1CE}_Office15.PROPLUS_{DA288EB3-648C-433C-

88AC-71AEAAFAACF7}) (Version: - Microsoft)

Update for Microsoft Office 2013 (KB2883060) 32-Bit Edition (HKLM-x32\...

\{90150000-001F-040C-0000-0000000FF1CE}_Office15.PROPLUS_{51865C36-97D4-4210-

A33E-50BCC8CDDF72}) (Version: - Microsoft)

Update for Microsoft Office 2013 (KB2883060) 32-Bit Edition (HKLM-x32\...

\{90150000-001F-0C0A-0000-0000000FF1CE}_Office15.PROPLUS_{C20FB0E0-31F6-4958-

B94D-AEF3CC31FD87}) (Version: - Microsoft)

Update for Microsoft Office 2013 (KB2889848) 32-Bit Edition (HKLM-x32\...

\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{E1285C4F-1DB7-4A7F-

9DEF-22068D09EBFA}) (Version: - Microsoft)

Update for Microsoft Office 2013 (KB2889848) 32-Bit Edition (HKLM-x32\...

\{90150000-006E-0409-0000-0000000FF1CE}_Office15.PROPLUS_{E1285C4F-1DB7-4A7F-

9DEF-22068D09EBFA}) (Version: - Microsoft)

Update for Microsoft Office 2013 (KB2889862) 32-Bit Edition (HKLM-x32\...

\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{96AE4BBC-69CC-4004-

8B53-1F40B2461755}) (Version: - Microsoft)

Update for Microsoft Office 2013 (KB2889862) 32-Bit Edition (HKLM-x32\...

\{90150000-002A-0000-1000-0000000FF1CE}_Office15.PROPLUS_{96AE4BBC-69CC-4004-

8B53-1F40B2461755}) (Version: - Microsoft)

Update for Microsoft OneDrive for Business (KB2889866) 32-Bit Edition (HKLM-

x32\...\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{D4319725-

BE26-4B7A-AFAA-17875F8FFA61}) (Version: - Microsoft)

Update for Microsoft OneDrive for Business (KB2889866) 32-Bit Edition (HKLM-

x32\...\{90150000-002A-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D4319725-

BE26-4B7A-AFAA-17875F8FFA61}) (Version: - Microsoft)

Update for Microsoft OneDrive for Business (KB2889866) 32-Bit Edition (HKLM-

x32\...\{90150000-002A-0409-1000-0000000FF1CE}_Office15.PROPLUS_{D4319725-

BE26-4B7A-AFAA-17875F8FFA61}) (Version: - Microsoft)

Update for Microsoft OneDrive for Business (KB2889866) 32-Bit Edition (HKLM-

x32\...\{90150000-00BA-0409-0000-0000000FF1CE}_Office15.PROPLUS_{D4319725-

BE26-4B7A-AFAA-17875F8FFA61}) (Version: - Microsoft)

Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...

\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{51CCA922-A0CC-47C4-

8910-6936D97CAC2E}) (Version: - Microsoft)

Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...

\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{51CCA922-A0CC-47C4-

8910-6936D97CAC2E}) (Version: - Microsoft)

Update for Microsoft OneNote 2013 (KB2881082) 32-Bit Edition (HKLM-x32\...

\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{CA0F0611-10FB-47D4-

A642-E3BABCC73393}) (Version: - Microsoft)

Update for Microsoft OneNote 2013 (KB2881082) 32-Bit Edition (HKLM-x32\...

\{90150000-002A-0000-1000-0000000FF1CE}_Office15.PROPLUS_{CA0F0611-10FB-47D4-

A642-E3BABCC73393}) (Version: - Microsoft)

Update for Microsoft OneNote 2013 (KB2881082) 32-Bit Edition (HKLM-x32\...

\{90150000-00A1-0409-0000-0000000FF1CE}_Office15.PROPLUS_{CA0F0611-10FB-47D4-

A642-E3BABCC73393}) (Version: - Microsoft)

Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...

\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{2AB483F1-C86E-427A-

83B4-23889B03512D}) (Version: - Microsoft)

Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...

\{90140000-001A-0409-0000-0000000FF1CE}_Office14.PROPLUS_{DCE104A1-1875-4469-

A83D-A5BFA6C4640F}) (Version: - Microsoft)

Update for Microsoft Outlook 2013 (KB2880470) 32-Bit Edition (HKLM-x32\...

\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{1BCA67A6-5329-48D0-

A088-C097AC7A14BD}) (Version: - Microsoft)

Update for Microsoft Outlook 2013 (KB2880470) 32-Bit Edition (HKLM-x32\...

\{90150000-001A-0409-0000-0000000FF1CE}_Office15.PROPLUS_{1BCA67A6-5329-48D0-

A088-C097AC7A14BD}) (Version: - Microsoft)

Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...

\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{2BA40F82-F3A4-441C-

BF1A-ED4C42FF4872}) (Version: - Microsoft)

Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...

\{90140000-0018-0409-0000-0000000FF1CE}_Office14.PROPLUS_{334AA0A1-2BB1-4D74-

B66A-2B2C4D9C2C87}) (Version: - Microsoft)

Update for Microsoft PowerPoint 2013 (KB2889847) 32-Bit Edition (HKLM-x32\...

\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{F080A0ED-070F-4E33-

833F-CF893968E6A8}) (Version: - Microsoft)

Update for Microsoft PowerPoint 2013 (KB2889847) 32-Bit Edition (HKLM-x32\...

\{90150000-0018-0409-0000-0000000FF1CE}_Office15.PROPLUS_{F080A0ED-070F-4E33-

833F-CF893968E6A8}) (Version: - Microsoft)

Update for Microsoft Publisher 2013 (KB2880999) 32-Bit Edition (HKLM-x32\...

\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{7500AD77-83C6-400B-

8B2F-F8E401A7B697}) (Version: - Microsoft)

Update for Microsoft Publisher 2013 (KB2880999) 32-Bit Edition (HKLM-x32\...

\{90150000-0019-0409-0000-0000000FF1CE}_Office15.PROPLUS_{7500AD77-83C6-400B-

8B2F-F8E401A7B697}) (Version: - Microsoft)

Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition

(HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_

{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft)

Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition

(HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_

{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft)

Update for Microsoft Visio 2010 (KB2880526) 32-Bit Edition (HKLM-x32\...

\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{7B29D8B8-6A87-496C-

A65E-B935E740448A}) (Version: - Microsoft)

Update for Microsoft Visio 2013 (KB2837632) 32-Bit Edition (HKLM-x32\...

\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{6D8F4981-88A1-4386-

8B3C-A51021FD8395}) (Version: - Microsoft)

Update for Microsoft Visio Viewer 2010 (KB2837587) 32-Bit Edition (HKLM-

x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{38CF30E4-

3348-4BD1-A859-B630C355A56F}) (Version: - Microsoft)

Update for Microsoft Visio Viewer 2013 (KB2817301) 32-Bit Edition (HKLM-

x32\...\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{25C61889-

2E44-4BE1-9E96-9364BFDCF501}) (Version: - Microsoft)

Update for Microsoft Visio Viewer 2013 (KB2817301) 32-Bit Edition (HKLM-

x32\...\{90150000-006E-0409-0000-0000000FF1CE}_Office15.PROPLUS_{25C61889-

2E44-4BE1-9E96-9364BFDCF501}) (Version: - Microsoft)

Update for Microsoft Word 2010 (KB2880529) 32-Bit Edition (HKLM-x32\...

\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{B9B89E01-5B6B-4F73-

BC34-B2C0D8ACB4CD}) (Version: - Microsoft)

Update for Microsoft Word 2013 (KB2878319) 32-Bit Edition (HKLM-x32\...

\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{A7CD05CC-CA85-428C-

91FD-74A908D126E1}) (Version: - Microsoft)

Update for Microsoft Word 2013 (KB2889852) 32-Bit Edition (HKLM-x32\...

\{90150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUS_{20FF2192-E507-4B44-

B861-AED6BE5E890C}) (Version: - Microsoft)

Update for Microsoft Word 2013 (KB2889852) 32-Bit Edition (HKLM-x32\...

\{90150000-001A-0409-0000-0000000FF1CE}_Office15.PROPLUS_{20FF2192-E507-4B44-

B861-AED6BE5E890C}) (Version: - Microsoft)

Update for Microsoft Word 2013 (KB2889852) 32-Bit Edition (HKLM-x32\...

\{90150000-001B-0409-0000-0000000FF1CE}_Office15.PROPLUS_{20FF2192-E507-4B44-

B861-AED6BE5E890C}) (Version: - Microsoft)

Update for Microsoft Word 2013 (KB2889852) 32-Bit Edition (HKLM-x32\...

\{90150000-012B-0409-0000-0000000FF1CE}_Office15.PROPLUS_{20FF2192-E507-4B44-

B861-AED6BE5E890C}) (Version: - Microsoft)

VD64Inst (Version: 1.00.0000 - Roxio, Inc.) Hidden

Verizon Wireless Software Upgrade Assistant - Samsung(ar) (HKLM-x32\...

\{A3070098-A41D-42D9-B6D3-2EF15285E719}) (Version: 2.14.0605 - Samsung

Electronics Co., Ltd.)

Verizon Wireless Software Utility Application for Android - Samsung (HKLM-

x32\...\{B5300E76-AA13-4542-8E0E-776A280FE47E}) (Version: 2.14.0503 - Samsung

Electronics Co., Ltd.)

Virtual Account Numbers (x32 Version: 1.0.1.0 - Citi) Hidden

Visual Studio Tools for the Office system 3.0 Runtime (HKLM-x32\...\Visual

Studio Tools for the Office system 3.0 Runtime) (Version: - Microsoft

Corporation)

Visual Studio Tools for the Office system 3.0 Runtime (x32 Version: 9.0.30729

- Microsoft Corporation) Hidden

Visual Studio Tools for the Office system 3.0 Runtime Service Pack 1

(KB949258) (HKLM-x32\...\{8FB53850-246A-3507-8ADE-0060093FFEA6}.KB949258)

(Version: 1 - Microsoft Corporation)

Winamp (HKLM-x32\...\Winamp) (Version: 5.65 - Nullsoft, Inc)

Winamp Detector Plug-in (HKCU\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft,

Inc)

WinDirStat 1.1.2 (HKCU\...\WinDirStat) (Version: - )

Windows Firewall Configuration Provider (HKLM\...\{109A5A16-E09E-4B82-A784-

D1780F1190D6}) (Version: 1.2.3412.0 - Microsoft Corporation)

Windows Live Communications Platform (x32 Version: 16.4.3522.0110 - Microsoft

Corporation) Hidden

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3522.0110 -

Microsoft Corporation)

Windows Live Essentials (x32 Version: 16.4.3522.0110 - Microsoft Corporation)

Hidden

Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft

Corporation) Hidden

Windows Live Installer (x32 Version: 16.4.3522.0110 - Microsoft Corporation)

Hidden

Windows Live Photo Common (x32 Version: 16.4.3522.0110 - Microsoft

Corporation) Hidden

Windows Live PIMT Platform (x32 Version: 16.4.3522.0110 - Microsoft

Corporation) Hidden

Windows Live SOXE (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden

Windows Live SOXE Definitions (x32 Version: 16.4.3522.0110 - Microsoft

Corporation) Hidden

Windows Live UX Platform (x32 Version: 16.4.3522.0110 - Microsoft Corporation)

Hidden

Windows Live UX Platform Language Pack (x32 Version: 16.4.3522.0110 -

Microsoft Corporation) Hidden

Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-

867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)

WinPcap 4.1.3 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2980 - Riverbed

Technology, Inc.)

Wunderlist (HKLM-x32\...\{1ca68332-4ba1-4943-9010-eaa1aa45b492}) (Version:

2.3.0.31 - 6 Wunderkinder GmbH)

Wunderlist (x32 Version: 2.3.0.31 - 6 Wunderkinder GmbH) Hidden

YNAB 4 version 4.3.196 (HKLM-x32\...\com.ynab.YNAB4.LiveCaptive_is1) (Version:

4.3.196 - YouNeedABudget.com)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any

eventual file will not be moved.)