Help removing n1.smartyads

RSD · October 15, 2015

I'm getting pop ups every now and then from the n1.smartyads and Malwarebytes seems to be blocking it, but won't remove it even during a full scan. Can someone help me remove it and tell me how I picked it up or it got through?

Thanks,

Scott

TwinHeadedEagle · October 16, 2015

Hello,

They call me TwinHeadedEagle around here, and I'll try to help your with your issue.

Before we start please read and note the following:

We're primarily oriented on malware removal here, so you must know that some issues just cannot be solved and you must be prepared for this. Some tools we use here will remove your browser search history, so backup your important links and all the files whose loss is unacceptable.
Limit your internet access to posting here, some infections just wait to steal typed-in passwords.
Please be patient. I know it is frustrating when your PC isn't working properly, but malware removal takes time. Keep in mind that private life gets in the way too. Note that we may live in totally different time zones, what may cause some delays between answers.
Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
Do not paste the logs in your posts, attachments make my work easier. There is a More reply options button, that gives you Upload Files option below which you can use to attach your reports. Always attach reports from all tools.
Always execute my instructions in given order. If for some reason you cannot completely follow one instruction, inform me about that.
Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.
If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.

I can't foresee everything, so if anything not covered in my instructions happens, please stop and inform me!

There are no silly questions. Never be afraid to ask if in doubt!

Rules and policies

We won't support any piracy.

That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!

The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!

Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.

Only one of them will run on your system, that will be the right version.

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

RSD · October 16, 2015

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:15-10-2015 01

Ran by Scott Duncan (administrator) on SCOTTDUNCAN-PC (16-10-2015 06:34:56)

Running from C:\Users\Scott Duncan\Downloads

Loaded Profiles: Scott Duncan & Ctx_StreamingSvc & (Available Profiles: Scott Duncan & Ctx_StreamingSvc & DefaultAppPool)

Platform: Windows 10 Home (X64) Language: English (United States)

Internet Explorer Version 11 (Default browser: Chrome)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

(Citrix Systems, Inc.) C:\Program Files (x86)\Common Files\Citrix\System32\CdfSvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe

(Microsoft Corporation) C:\Windows\System32\mqsvc.exe

(Symantec Corporation) C:\Program Files (x86)\PC Checkup\SymcPCCULaunchSvc.exe

(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\Streaming Client\RadeHlprSvc.exe

(Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.10.26\ccSvcHst.exe

(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe

(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe

(TOSHIBA Corporation) C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe

(TOSHIBA Corporation) C:\Program Files\Toshiba\TECO\TecoService.exe

(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe

(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe

(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\Streaming Client\RadeSvc.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

(TOSHIBA Corporation) C:\Program Files\Toshiba\TPHM\TPCHSrv.exe

(TOSHIBA Corporation) C:\Program Files\Toshiba\TOSHIBA HDD SSD Alert\TosSmartSrv.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\22.5.4.24\nis.exe

(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

(Verizon) C:\Program Files (x86)\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.10.26\ccSvcHst.exe

(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\22.5.4.24\nis.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(TOSHIBA Corporation) C:\Program Files\Toshiba\Power Saver\TPwrMain.exe

(TOSHIBA Corporation) C:\Program Files\Toshiba\FlashCards\TCrdMain.exe

(TOSHIBA Corporation) C:\Program Files\Toshiba\TECO\Teco.exe

(TOSHIBA Corporation) C:\Program Files\Toshiba\TPHM\TPCHWMsg.exe

(Intel Corporation) C:\Windows\System32\igfxext.exe

(TOSHIBA Corporation) C:\Program Files\Toshiba\TOSHIBA HDD SSD Alert\TosSENotify.exe

(TOSHIBA Corporation) C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe

(TOSHIBA Corporation) C:\Program Files\Toshiba\ReelTime\TosReelTimeMonitor.exe

(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe

(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE

(Google Inc.) C:\Users\Scott Duncan\AppData\Local\Programs\Google\MusicManager\MusicManager.exe

(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe

(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe

(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe

(Dropbox, Inc.) C:\Users\Scott Duncan\AppData\Roaming\Dropbox\bin\Dropbox.exe

(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe

(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe

(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe

(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe

(GoPro) C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe

(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\46.0.2490.71\nacl64.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch

HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [566696 2011-03-02] (TOSHIBA Corporation)

HKLM\...\Run: [HSON] => C:\Program Files\TOSHIBA\TBS\HSON.exe [296824 2010-09-25] (TOSHIBA Corporation)

HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [973176 2010-12-15] (TOSHIBA Corporation)

HKLM\...\Run: [smartAudio] => C:\Program Files\CONEXANT\SAII\SAIICpl.exe [316032 2010-12-14] (Conexant systems, Inc.)

HKLM\...\Run: [Teco] => C:\Program Files\TOSHIBA\TECO\Teco.exe [1520552 2011-03-02] (TOSHIBA Corporation)

HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [711576 2010-12-20] (TOSHIBA Corporation)

HKLM\...\Run: [TosVolRegulator] => C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)

HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [710040 2010-12-08] (TOSHIBA Corporation)

HKLM\...\Run: [TosNC] => C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe [595816 2010-04-23] (TOSHIBA Corporation)

HKLM\...\Run: [TosReelTimeMonitor] => C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [38304 2010-12-14] (TOSHIBA Corporation)

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500208 2010-03-06] (Adobe Systems Incorporated)

HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [3091224 2013-07-31] (Logitech, Inc.)

HKLM\...\Run: [synTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3944648 2015-06-12] (Synaptics Incorporated)

HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-08-13] (Apple Inc.)

HKLM-x32\...\Run: [ToshibaServiceStation] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [1295736 2011-02-11] (TOSHIBA Corporation)

HKLM-x32\...\Run: [NortonOnlineBackupReminder] => C:\Program Files (x86)\Toshiba\Toshiba Online Backup\Activation\TOBuActivation.exe [3218792 2010-08-17] (Toshiba)

HKLM-x32\...\Run: [ToshibaAppPlace] => C:\Program Files (x86)\Toshiba\Toshiba App Place\ToshibaAppPlace.exe [552960 2010-09-23] (Toshiba)

HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-05-15] (Apple Inc.)

HKLM-x32\...\Run: [switchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [AdobeCS5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [402432 2010-07-23] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [ConnectionCenter] => C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [103768 2009-09-13] (Citrix Systems, Inc.)

HKLM-x32\...\Run: [Aimersoft Helper Compact.exe] => C:\Program Files (x86)\Common Files\Aimersoft\Aimersoft Helper Compact\ASHelper.exe [1667072 2012-02-28] (AimerSoft)

HKLM-x32\...\Run: [WD Drive Unlocker] => C:\Program Files (x86)\Western Digital\WD Security\WDDriveAutoUnlock.exe [1694080 2013-07-10] (Western Digital Technologies, Inc.)

HKLM-x32\...\Run: [WD Quick View] => C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe [5564784 2015-07-20] (Western Digital Technologies, Inc.)

HKLM-x32\...\Run: [bCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)

HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)

HKLM-x32\...\Run: [DriveUtilitiesHelper] => C:\Program Files (x86)\Western Digital\WD Utilities\WDDriveUtilitiesHelper.exe [1852264 2014-05-23] (Western Digital Technologies, Inc.)

HKLM-x32\...\Run: [GoPro Studio Importer] => C:\Program Files (x86)\GoPro\Tools\Importer\GoPro Importer.exe [3217672 2015-07-02] (GoPro)

Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)

Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)

HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [iCloud] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloud.exe [43816 2015-04-26] (Apple Inc.)

HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\RunOnce: [iCloud] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloud.exe [43816 2015-04-26] (Apple Inc.)

HKU\S-1-5-21-2949255578-4130258502-838744892-1000\...\Run: [OfficeSyncProcess] => C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [721504 2015-09-02] (Microsoft Corporation)

HKU\S-1-5-21-2949255578-4130258502-838744892-1000\...\Run: [MusicManager] => C:\Users\Scott Duncan\AppData\Local\Programs\Google\MusicManager\MusicManager.exe [7646208 2015-08-13] (Google Inc.)

HKU\S-1-5-21-2949255578-4130258502-838744892-1000\...\Run: [Google Update] => C:\Users\Scott Duncan\AppData\Local\Google\Update\GoogleUpdate.exe [144200 2015-08-30] (Google Inc.)

HKU\S-1-5-21-2949255578-4130258502-838744892-1000\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22568208 2015-09-11] (Google)

HKU\S-1-5-21-2949255578-4130258502-838744892-1000\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2011-08-18] (Google Inc.)

HKU\S-1-5-21-2949255578-4130258502-838744892-1000\...\Run: [HP Officejet Pro 8600 (NET)] => C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)

HKU\S-1-5-21-2949255578-4130258502-838744892-1000\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248176 2015-04-30] (TomTom)

HKU\S-1-5-21-2949255578-4130258502-838744892-1000\...\Run: [Dropbox Update] => C:\Users\Scott Duncan\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-18] (Dropbox, Inc.)

HKU\S-1-5-21-2949255578-4130258502-838744892-1000\...\RunOnce: [uninstall C:\Users\Scott Duncan\AppData\Local\Microsoft\OneDrive\17.3.5907.0716\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Scott Duncan\AppData\Local\Microsoft\OneDrive\17.3.5907.0716\amd64"

HKU\S-1-5-21-2949255578-4130258502-838744892-1000\...\RunOnce: [uninstall C:\Users\Scott Duncan\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Scott Duncan\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64"

HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [OfficeSyncProcess] => C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [721504 2015-09-02] (Microsoft Corporation)

HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [MusicManager] => C:\Users\Scott Duncan\AppData\Local\Programs\Google\MusicManager\MusicManager.exe [7646208 2015-08-13] (Google Inc.)

HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Google Update] => C:\Users\Scott Duncan\AppData\Local\Google\Update\GoogleUpdate.exe [144200 2015-08-30] (Google Inc.)

HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22568208 2015-09-11] (Google)

HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2011-08-18] (Google Inc.)

HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [HP Officejet Pro 8600 (NET)] => C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)

HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248176 2015-04-30] (TomTom)

HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Dropbox Update] => C:\Users\Scott Duncan\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-18] (Dropbox, Inc.)

HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [uninstall C:\Users\Scott Duncan\AppData\Local\Microsoft\OneDrive\17.3.5907.0716\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Scott Duncan\AppData\Local\Microsoft\OneDrive\17.3.5907.0716\amd64"

HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [uninstall C:\Users\Scott Duncan\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Scott Duncan\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64"

HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [OfficeSyncProcess] => C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [721504 2015-09-02] (Microsoft Corporation)

HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [MusicManager] => C:\Users\Scott Duncan\AppData\Local\Programs\Google\MusicManager\MusicManager.exe [7646208 2015-08-13] (Google Inc.)

HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [Google Update] => C:\Users\Scott Duncan\AppData\Local\Google\Update\GoogleUpdate.exe [144200 2015-08-30] (Google Inc.)

HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22568208 2015-09-11] (Google)

HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2011-08-18] (Google Inc.)

HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [HP Officejet Pro 8600 (NET)] => C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)

HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248176 2015-04-30] (TomTom)

HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [Dropbox Update] => C:\Users\Scott Duncan\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-18] (Dropbox, Inc.)

HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\RunOnce: [uninstall C:\Users\Scott Duncan\AppData\Local\Microsoft\OneDrive\17.3.5907.0716\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Scott Duncan\AppData\Local\Microsoft\OneDrive\17.3.5907.0716\amd64"

HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\RunOnce: [uninstall C:\Users\Scott Duncan\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Scott Duncan\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64"

HKU\S-1-5-21-2949255578-4130258502-838744892-1003\...\Run: [sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun

HKU\S-1-5-21-2949255578-4130258502-838744892-1003\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [517632 2015-07-10] (Microsoft Corporation)

HKU\S-1-5-21-2949255578-4130258502-838744892-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun

HKU\S-1-5-21-2949255578-4130258502-838744892-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [517632 2015-07-10] (Microsoft Corporation)

HKU\S-1-5-21-2949255578-4130258502-838744892-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun

HKU\S-1-5-21-2949255578-4130258502-838744892-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [517632 2015-07-10] (Microsoft Corporation)

HKU\S-1-5-18\...\RunOnce: [iCloud] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloud.exe [43816 2015-04-26] (Apple Inc.)

ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-09-11] (Google)

ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-09-11] (Google)

ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2015-09-11] (Google)

ShellIconOverlayIdentifiers: [ OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton Internet Security\Engine64\22.5.4.24\buShell.dll [2015-08-27] (Symantec Corporation)

ShellIconOverlayIdentifiers: [ OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton Internet Security\Engine64\22.5.4.24\buShell.dll [2015-08-27] (Symantec Corporation)

ShellIconOverlayIdentifiers: [ OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton Internet Security\Engine64\22.5.4.24\buShell.dll [2015-08-27] (Symantec Corporation)

ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Scott Duncan\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll No File

ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Scott Duncan\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll No File

ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Scott Duncan\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll No File

ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Scott Duncan\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll No File

ShellIconOverlayIdentifiers-x32: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Scott Duncan\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-10-01] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Scott Duncan\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-10-01] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Scott Duncan\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-10-01] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Scott Duncan\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-10-01] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Scott Duncan\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-10-01] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Scott Duncan\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-10-01] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Scott Duncan\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-10-01] (Dropbox, Inc.)

ShellIconOverlayIdentifiers-x32: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Scott Duncan\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll [2015-10-01] (Dropbox, Inc.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Install LastPass FF RunOnce.lnk [2014-05-23]

ShortcutTarget: Install LastPass FF RunOnce.lnk -> C:\Program Files (x86)\Common Files\lpuninstall.exe (LastPass)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Install LastPass IE RunOnce.lnk [2014-05-23]

ShortcutTarget: Install LastPass IE RunOnce.lnk -> C:\Program Files (x86)\Common Files\lpuninstall.exe (LastPass)

Startup: C:\Users\Scott Duncan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-03-13]

ShortcutTarget: Dropbox.lnk -> C:\Users\Scott Duncan\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

Startup: C:\Users\Scott Duncan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Officejet Pro 8600 (Network).lnk [2014-05-26]

ShortcutTarget: Monitor Ink Alerts - HP Officejet Pro 8600 (Network).lnk -> (No File)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76

Tcpip\..\Interfaces\{67f1370f-606d-498d-bd2a-65969e2a1af2}: [DhcpNameServer] 172.16.254.1 172.16.254.2

Tcpip\..\Interfaces\{c534bed8-08ee-4e37-9d62-7abee88c5a79}: [DhcpNameServer] 75.75.75.75 75.75.76.76

Internet Explorer:

==================

HKU\S-1-5-21-2949255578-4130258502-838744892-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION

HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION

HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.toshiba.com/

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://start.toshiba.com/

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

HKU\S-1-5-21-2949255578-4130258502-838744892-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\S-1-5-21-2949255578-4130258502-838744892-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.toshiba.com/

HKU\S-1-5-21-2949255578-4130258502-838744892-1000\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.msn.com/1me10IE11ENUS/WOL_WCP

HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.toshiba.com/

HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.msn.com/1me10IE11ENUS/WOL_WCP

HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.toshiba.com/

HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.msn.com/1me10IE11ENUS/WOL_WCP

SearchScopes: HKLM -> {CD0DBE38-5D83-4061-BA5C-C1A7017210EA} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNF

SearchScopes: HKLM-x32 -> {B372E8AC-5789-48CE-83A5-5EF1EEB72CDB} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNF

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\.DEFAULT -> {CD0DBE38-5D83-4061-BA5C-C1A7017210EA} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNF

SearchScopes: HKU\S-1-5-21-2949255578-4130258502-838744892-1000 -> DefaultScope {7ADFDB83-92F4-47BB-84C8-1EE956ABCBAD} URL = hxxps://www.google.com/search?q={searchTerms}

SearchScopes: HKU\S-1-5-21-2949255578-4130258502-838744892-1000 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNP

SearchScopes: HKU\S-1-5-21-2949255578-4130258502-838744892-1000 -> {7ADFDB83-92F4-47BB-84C8-1EE956ABCBAD} URL = hxxps://www.google.com/search?q={searchTerms}

SearchScopes: HKU\S-1-5-21-2949255578-4130258502-838744892-1000 -> {B372E8AC-5789-48CE-83A5-5EF1EEB72CDB} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNF_enUS456

SearchScopes: HKU\S-1-5-21-2949255578-4130258502-838744892-1000 -> {CD0DBE38-5D83-4061-BA5C-C1A7017210EA} URL =

SearchScopes: HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {7ADFDB83-92F4-47BB-84C8-1EE956ABCBAD} URL = hxxps://www.google.com/search?q={searchTerms}

SearchScopes: HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNP

SearchScopes: HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {7ADFDB83-92F4-47BB-84C8-1EE956ABCBAD} URL = hxxps://www.google.com/search?q={searchTerms}

SearchScopes: HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {B372E8AC-5789-48CE-83A5-5EF1EEB72CDB} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNF_enUS456

SearchScopes: HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {CD0DBE38-5D83-4061-BA5C-C1A7017210EA} URL =

SearchScopes: HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1 -> DefaultScope {7ADFDB83-92F4-47BB-84C8-1EE956ABCBAD} URL = hxxps://www.google.com/search?q={searchTerms}

SearchScopes: HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNP

SearchScopes: HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1 -> {7ADFDB83-92F4-47BB-84C8-1EE956ABCBAD} URL = hxxps://www.google.com/search?q={searchTerms}

SearchScopes: HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1 -> {B372E8AC-5789-48CE-83A5-5EF1EEB72CDB} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNF_enUS456

SearchScopes: HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1 -> {CD0DBE38-5D83-4061-BA5C-C1A7017210EA} URL =

SearchScopes: HKU\S-1-5-21-2949255578-4130258502-838744892-1003 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-21-2949255578-4130258502-838744892-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-21-2949255578-4130258502-838744892-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine64\22.5.4.24\coIEPlg.dll [2015-09-23] (Symantec Corporation)

BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)

BHO: LastPass Vault -> {95D9ECF5-2A4D-4550-BE49-70D42F71296E} -> C:\Program Files (x86)\LastPass\LPToolbar_x64.dll [2014-05-23] (LastPass)

BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-09-20] (Google Inc.)

BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)

BHO: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll [2013-07-31] (Logitech, Inc.)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)

BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine\22.5.4.24\coIEPlg.dll [2015-09-23] (Symantec Corporation)

BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-20] (Google Inc.)

BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)

BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)

Toolbar: HKLM - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll [2014-05-23] (LastPass)

Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\22.5.4.24\coIEPlg.dll [2015-09-23] (Symantec Corporation)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-09-20] (Google Inc.)

Toolbar: HKLM-x32 - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar.dll [2014-05-23] (LastPass)

Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\22.5.4.24\coIEPlg.dll [2015-09-23] (Symantec Corporation)

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-20] (Google Inc.)

Toolbar: HKU\S-1-5-21-2949255578-4130258502-838744892-1000 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-09-20] (Google Inc.)

Toolbar: HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-09-20] (Google Inc.)

Toolbar: HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-09-20] (Google Inc.)

DPF: HKLM-x32 {55963676-2F5E-4BAF-AC28-CF26AA587566} hxxps://sslvpn.usawest.org/CACHE/stc/1/binaries/vpnweb.cab

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)

Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)

Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)

FireFox:

========

FF ProfilePath: C:\Users\Scott Duncan\AppData\Roaming\Mozilla\Firefox\Profiles\y52dp84x.default-1399684827563

FF Homepage: www.google.com

FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_19_0_0_207.dll [2015-10-14] ()

FF Plugin: @lastpass.com/NPLastPass -> C:\Program Files (x86)\LastPass\nplastpass64.dll [2014-05-23] (LastPass)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-10] (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_207.dll [2015-10-14] ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-07-30] ()

FF Plugin-x32: @citrix.com/Citrix Offline Plug-in -> C:\Program Files (x86)\Citrix\Streaming Client\nprade.dll [2011-07-20] ()

FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.66 -> C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIIPT.dll [2013-01-11] (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Services\IPT\npIntelWebAPIUpdater.dll [2013-01-11] (Intel Corporation)

FF Plugin-x32: @lastpass.com/NPLastPass -> C:\Program Files (x86)\LastPass\nplastpass.dll [2014-05-23] (LastPass)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-10] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-17] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-17] (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-09-26] (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-2949255578-4130258502-838744892-1000: @citrixonline.com/appdetectorplugin -> C:\Users\Scott Duncan\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2014-02-27] (Citrix Online)

FF Plugin HKU\S-1-5-21-2949255578-4130258502-838744892-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Scott Duncan\AppData\Local\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-16] (Google Inc.)

FF Plugin HKU\S-1-5-21-2949255578-4130258502-838744892-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Scott Duncan\AppData\Local\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-16] (Google Inc.)

FF Plugin HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: @citrixonline.com/appdetectorplugin -> C:\Users\Scott Duncan\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2014-02-27] (Citrix Online)

FF Plugin HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: @tools.google.com/Google Update;version=3 -> C:\Users\Scott Duncan\AppData\Local\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-16] (Google Inc.)

FF Plugin HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: @tools.google.com/Google Update;version=9 -> C:\Users\Scott Duncan\AppData\Local\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-16] (Google Inc.)

FF Plugin HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1: @citrixonline.com/appdetectorplugin -> C:\Users\Scott Duncan\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2014-02-27] (Citrix Online)

FF Plugin HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1: @tools.google.com/Google Update;version=3 -> C:\Users\Scott Duncan\AppData\Local\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-16] (Google Inc.)

FF Plugin HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1: @tools.google.com/Google Update;version=9 -> C:\Users\Scott Duncan\AppData\Local\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-16] (Google Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\CCMSDK.dll [2009-09-13] (Citrix Systems, Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\cgpcfg.dll [2009-09-13] (Citrix Systems, Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\CgpCore.dll [2009-09-13] (Citrix Systems, Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\confmgr.dll [2009-09-13] (Citrix Systems, Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\ctxlogging.dll [2009-09-13] (Citrix Systems, Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\ctxmui.dll [2009-09-13] (Citrix Systems, Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\icafile.dll [2009-09-13] (Citrix Systems, Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\icalogon.dll [2009-09-13] (Citrix Systems, Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npicaN.dll [2009-09-13] ()

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-09-26] (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2014-10-31] (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2014-10-31] (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2014-10-31] (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2014-10-31] (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2014-10-31] (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\sslsdk_b.dll [2009-08-14] (Citrix Systems, Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\TcpPServ.dll [2009-09-13] (Citrix Systems, Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\browser\plugins\npMozCouponPrinter.dll [2014-09-03] (Coupons, Inc.)

FF Plugin ProgramFiles/Appdata: C:\Users\Scott Duncan\AppData\Roaming\mozilla\plugins\npatgpc.dll [2015-04-29] (Cisco WebEx LLC)

FF Extension: LastPass - C:\Users\Scott Duncan\AppData\Roaming\Mozilla\Firefox\Profiles\y52dp84x.default-1399684827563\Extensions\support@lastpass.com [2015-09-27]

FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2015-10-03]

FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2015-10-03]

FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2015-10-03]

FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2015-10-03]

FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-10-03]

FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt

FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2014-02-26]

FF HKLM-x32\...\Firefox\Extensions: [{EBA722F5-038F-4CAF-9EE2-545A221628BC}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_22.5.2.15\coFFPlgn

FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_22.5.2.15\coFFPlgn [2015-10-11]

Chrome:

=======

CHR HomePage: Default -> hxxp://www.google.com

CHR StartupUrls: Default -> "hxxp://www.google.com/"

CHR DefaultSearchKeyword: Default -> lp

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\46.0.2490.71\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\46.0.2490.71\ppGoogleNaClPluginChrome.dll => No File

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\46.0.2490.71\pdf.dll => No File

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll => No File

CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)

CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)

CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll => No File

CHR Plugin: (Java Platform SE 7 U25) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll => No File

CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

CHR Plugin: (Shockwave Flash) - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll => No File

CHR Plugin: (Java Deployment Toolkit 7.0.250.17) - C:\windows\SysWOW64\npDeployJava1.dll => No File

CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll => No File

CHR Profile: C:\Users\Scott Duncan\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Docs) - C:\Users\Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-08-11]

CHR Extension: (Google Drive) - C:\Users\Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-08-11]

CHR Extension: (YouTube) - C:\Users\Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-08-11]

CHR Extension: (Norton Security Toolbar) - C:\Users\Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjabmdjcfcfdmffimndhafhblfmpjdpe [2015-07-30]

CHR Extension: (Google Search) - C:\Users\Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-08-11]

CHR Extension: (Logitech Smooth Scrolling) - C:\Users\Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Extensions\dkpejdfnpdkhifgbancbammdijojoffk [2014-02-26]

CHR Extension: (Add Email Signature - WiseStamp) - C:\Users\Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjjniaenghhbffhplhdcipdgidbajdp [2014-01-09]

CHR Extension: (Google Play Music) - C:\Users\Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Extensions\fahmaaghhglfmonjliepjlchgpgfmobi [2015-02-07]

CHR Extension: (Google Docs Offline) - C:\Users\Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-03]

CHR Extension: (LastPass: Free Password Manager) - C:\Users\Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd [2014-05-23]

CHR Extension: (Cisco WebEx Extension) - C:\Users\Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Extensions\jlhmfgmfgeifomenelglieieghnjghma [2015-04-29]

CHR Extension: (BBC Good Food) - C:\Users\Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Extensions\jnkffnoliaheoidfeejcmnidkkgilkja [2013-08-11]

CHR Extension: (Mafia Wars Addon) - C:\Users\Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Extensions\llfmkjppmncfcgdebajkjnopgodlcaoe [2013-08-11]

CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2014-11-06]

CHR Extension: (Watch with MPV) - C:\Users\Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdbllodbagceopopjfeohndifhjjkemc [2015-03-31]

CHR Extension: (Chrome Web Store Payments) - C:\Users\Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-31]

CHR Extension: (Gmail) - C:\Users\Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-08-11]

CHR HKLM\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Internet Security\Engine\22.5.4.24\Exts\Chrome.crx [2015-10-01]

CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx

CHR HKU\S-1-5-21-2949255578-4130258502-838744892-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx

CHR HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx

CHR HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx

CHR HKLM-x32\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Internet Security\Engine\22.5.4.24\Exts\Chrome.crx [2015-10-01]

CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx

CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-05-01]

RSD · October 16, 2015

Continued, post was too long...

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-05-29] (Apple Inc.)

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1394816 2015-05-01] (Microsoft Corporation)

R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1772672 2015-05-01] (Microsoft Corporation)

R2 CdfSvc; C:\Program Files (x86)\Common Files\Citrix\System32\CdfSvc.exe [321448 2011-05-03] (Citrix Systems, Inc.)

S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed]

R2 IHA_MessageCenter; C:\Program Files (x86)\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe [363128 2014-08-13] (Verizon) [File not signed]

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1513784 2015-10-05] (Malwarebytes)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)

R2 MSMQ; C:\Windows\system32\mqsvc.exe [26112 2015-07-30] (Microsoft Corporation)

R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\22.5.4.24\NIS.exe [282016 2015-09-24] (Symantec Corporation)

R2 Norton PC Checkup Application Launcher; C:\Program Files (x86)\PC Checkup\SymcPCCULaunchSvc.exe [132504 2013-12-26] (Symantec Corporation)

R2 OneSyncSvc_Session11; C:\WINDOWS\system32\svchost.exe [39856 2015-07-10] (Microsoft Corporation)

R2 OneSyncSvc_Session11; C:\WINDOWS\SysWOW64\svchost.exe [35176 2015-07-10] (Microsoft Corporation)

R2 PCCUJobMgr; C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.10.26\ccSvcHst.exe [126392 2011-02-03] (Symantec Corporation)

S3 PimIndexMaintenanceSvc_Session11; C:\WINDOWS\system32\svchost.exe [39856 2015-07-10] (Microsoft Corporation)

S3 PimIndexMaintenanceSvc_Session11; C:\WINDOWS\SysWOW64\svchost.exe [35176 2015-07-10] (Microsoft Corporation)

R2 RadeHlprSvc; C:\Program Files (x86)\Citrix\Streaming Client\RadeHlprSvc.exe [210864 2011-07-20] (Citrix Systems, Inc.)

R2 RadeSvc; C:\Program Files (x86)\Citrix\Streaming Client\RadeSvc.exe [1034152 2011-07-20] (Citrix Systems, Inc.)

S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]

R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [246472 2015-06-12] (Synaptics Incorporated)

S3 UnistoreSvc_Session11; C:\WINDOWS\System32\svchost.exe [39856 2015-07-10] (Microsoft Corporation)

S3 UnistoreSvc_Session11; C:\WINDOWS\SysWOW64\svchost.exe [35176 2015-07-10] (Microsoft Corporation)

S3 UserDataSvc_Session11; C:\WINDOWS\system32\svchost.exe [39856 2015-07-10] (Microsoft Corporation)

S3 UserDataSvc_Session11; C:\WINDOWS\SysWOW64\svchost.exe [35176 2015-07-10] (Microsoft Corporation)

S3 w3logsvc; C:\Windows\system32\inetsrv\w3logsvc.dll [84480 2015-07-30] (Microsoft Corporation)

R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [578560 2015-07-30] (Microsoft Corporation)

R2 WDBackup; C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe [1042808 2015-07-20] (Western Digital Technologies, Inc.)

R2 WDDriveService; C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe [306552 2015-07-20] (Western Digital Technologies, Inc.)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [362928 2015-07-10] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-07-10] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 BHDrvx64; C:\Program Files (x86)\Norton Internet Security\NortonData\22.5.2.15\Definitions\BASHDefs\20151008.001\BHDrvx64.sys [1665608 2015-10-08] (Symantec Corporation)

R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1605040.018\ccSetx64.sys [173808 2015-07-10] (Symantec Corporation)

R1 cdfdrv; C:\Windows\System32\DRIVERS\cdfdrv.sys [38448 2011-03-01] (Citrix Systems, Inc.)

R1 ctxpidmn; C:\Windows\System32\DRIVERS\ctxpidmn.sys [83288 2011-06-30] (Citrix Systems, Inc.)

R2 CtxSbx; C:\Windows\System32\DRIVERS\CtxSbx.sys [309080 2011-06-30] (Citrix Systems, Inc.)

R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [498512 2015-07-27] (Symantec Corporation)

R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [153936 2015-07-27] (Symantec Corporation)

R1 IDSVia64; C:\Program Files (x86)\Norton Internet Security\NortonData\22.5.2.15\Definitions\IPSDefs\20151015.001\IDSvia64.sys [767216 2015-09-23] (Symantec Corporation)

R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)

R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [192216 2015-10-16] (Malwarebytes)

R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-10-05] (Malwarebytes Corporation)

R3 MQAC; C:\Windows\System32\drivers\mqac.sys [175104 2015-07-30] (Microsoft Corporation)

R3 NAVENG; C:\Program Files (x86)\Norton Internet Security\NortonData\22.5.2.15\Definitions\VirusDefs\20151015.016\ENG64.SYS [138488 2015-05-20] (Symantec Corporation)

R3 NAVEX15; C:\Program Files (x86)\Norton Internet Security\NortonData\22.5.2.15\Definitions\VirusDefs\20151015.016\EX64.SYS [2146040 2015-05-20] (Symantec Corporation)

R3 rtwlane_13; C:\Windows\System32\drivers\rtwlane_13.sys [3749888 2015-07-10] (Realtek Semiconductor Corporation )

R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [42696 2015-06-12] (Synaptics Incorporated)

R3 SRTSP; C:\Windows\System32\Drivers\NISx64\1605040.018\SRTSP64.SYS [930024 2015-09-23] (Symantec Corporation)

R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1605040.018\SRTSPX64.SYS [50936 2015-07-10] (Symantec Corporation)

R0 SymEFASI; C:\Windows\System32\drivers\NISx64\1605040.018\SYMEFASI64.SYS [1620720 2015-07-10] (Symantec Corporation)

S0 SymELAM; C:\Windows\System32\drivers\NISx64\1605040.018\SymELAM.sys [24192 2015-07-10] (Symantec Corporation)

R3 SymEvent; C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS [111344 2015-07-30] (Symantec Corporation)

R1 SymIRON; C:\Windows\system32\drivers\NISx64\1605040.018\Ironx64.SYS [297720 2015-07-10] (Symantec Corporation)

R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1605040.018\SYMNETS.SYS [577768 2015-09-23] (Symantec Corporation)

R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [54424 2015-07-30] (Toshiba Corporation)

S3 UdeCx; C:\Windows\System32\drivers\udecx.sys [44032 2015-07-10] ()

S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44568 2015-07-10] (Microsoft Corporation)

S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [291680 2015-07-10] (Microsoft Corporation)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [119648 2015-07-10] (Microsoft Corporation)

S3 WsAudio_Device(1); C:\Windows\System32\drivers\VirtualAudio1.sys [31080 2013-01-25] (Wondershare)

S3 WsAudio_Device(2); C:\Windows\System32\drivers\VirtualAudio2.sys [31080 2013-01-25] (Wondershare)

S3 WsAudio_Device(3); C:\Windows\System32\drivers\VirtualAudio3.sys [31080 2013-01-25] (Wondershare)

S3 WsAudio_Device(4); C:\Windows\System32\drivers\VirtualAudio4.sys [31080 2013-01-25] (Wondershare)

S3 WsAudio_Device(5); C:\Windows\System32\drivers\VirtualAudio5.sys [31080 2013-01-25] (Wondershare)

U3 idsvc; no ImagePath

S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X]

U3 wpcsvc; no ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-10-16 06:34 - 2015-10-16 06:35 - 00058976 _____ C:\Users\Scott Duncan\Downloads\FRST.txt

2015-10-16 06:34 - 2015-10-16 06:35 - 00000000 ____D C:\FRST

2015-10-16 06:33 - 2015-10-16 06:34 - 02196480 _____ (Farbar) C:\Users\Scott Duncan\Downloads\FRST64.exe

2015-10-16 06:20 - 2015-10-16 06:20 - 00016148 _____ C:\WINDOWS\system32\SCOTTDUNCAN-PC_Scott Duncan_HistoryPrediction.bin

2015-10-14 18:08 - 2015-10-14 18:08 - 00003780 _____ C:\WINDOWS\System32\Tasks\HP AR Program Upload - ba7f4b44cf864f02826d6549b4e376f93e9981ed4b414698a43657c4252e3deb

2015-10-13 18:01 - 2015-10-13 18:01 - 00000000 ____D C:\WINDOWS\PCHEALTH

2015-10-09 05:51 - 2015-10-09 05:52 - 00000828 _____ C:\Users\Scott Duncan\Downloads\debug.log

2015-10-04 13:12 - 2015-10-02 13:36 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl

2015-10-03 16:25 - 2015-10-04 13:10 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2015-10-03 12:58 - 2015-10-16 06:10 - 00000000 ____D C:\WINDOWS\System32\Tasks\Norton Internet Security

2015-10-03 11:09 - 2015-10-03 11:09 - 11546755 _____ C:\Users\Scott Duncan\Downloads\IMG_3273 (5).MOV

2015-10-02 23:00 - 2015-10-02 23:00 - 00000000 ____D C:\Users\Scott Duncan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

2015-10-02 19:43 - 2015-10-02 19:43 - 11546835 _____ C:\Users\Scott Duncan\Downloads\IMG_3273 (4).MOV

2015-10-02 19:42 - 2015-10-02 19:42 - 11546835 _____ C:\Users\Scott Duncan\Downloads\IMG_3273 (3).MOV

2015-10-02 19:42 - 2015-10-02 19:42 - 11546835 _____ C:\Users\Scott Duncan\Downloads\IMG_3273 (2).MOV

2015-10-02 19:42 - 2015-10-02 19:42 - 11546835 _____ C:\Users\Scott Duncan\Downloads\IMG_3273 (1).MOV

2015-10-02 19:18 - 2015-10-02 19:19 - 11546835 _____ C:\Users\Scott Duncan\Downloads\IMG_3273.MOV

2015-10-02 19:17 - 2015-10-02 19:17 - 00000025 _____ C:\Users\Scott Duncan\Downloads\ATT00001 (1).txt

2015-10-01 19:56 - 2015-09-24 20:13 - 01276416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll

2015-10-01 19:56 - 2015-09-24 19:17 - 02178560 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll

2015-10-01 19:56 - 2015-09-24 19:06 - 01423872 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataService.dll

2015-10-01 19:56 - 2015-09-24 19:01 - 00856576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ContactApis.dll

2015-10-01 19:56 - 2015-09-24 19:00 - 01205248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Unistore.dll

2015-10-01 19:56 - 2015-09-24 18:42 - 01795072 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll

2015-10-01 19:56 - 2015-09-24 18:25 - 00928256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Unistore.dll

2015-10-01 19:56 - 2015-09-17 02:50 - 02464216 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll

2015-10-01 19:56 - 2015-09-17 02:50 - 01563392 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmde.dll

2015-10-01 19:56 - 2015-09-17 02:49 - 08020816 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe

2015-10-01 19:56 - 2015-09-17 02:49 - 06487248 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll

2015-10-01 19:56 - 2015-09-17 02:48 - 02824248 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll

2015-10-01 19:56 - 2015-09-17 02:48 - 02494712 _____ C:\WINDOWS\system32\CoreUIComponents.dll

2015-10-01 19:56 - 2015-09-17 02:48 - 02432336 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys

2015-10-01 19:56 - 2015-09-17 02:48 - 01983824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys

2015-10-01 19:56 - 2015-09-17 02:48 - 00809352 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll

2015-10-01 19:56 - 2015-09-17 02:48 - 00784136 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll

2015-10-01 19:56 - 2015-09-17 02:47 - 01397088 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll

2015-10-01 19:56 - 2015-09-17 02:43 - 00966416 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll

2015-10-01 19:56 - 2015-09-17 02:37 - 01295712 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpx.dll

2015-10-01 19:56 - 2015-09-17 02:28 - 05120056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll

2015-10-01 19:56 - 2015-09-17 02:28 - 02154808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll

2015-10-01 19:56 - 2015-09-17 02:27 - 01766952 _____ C:\WINDOWS\SysWOW64\CoreUIComponents.dll

2015-10-01 19:56 - 2015-09-17 02:26 - 02446648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2vdec.dll

2015-10-01 19:56 - 2015-09-17 02:26 - 00646672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll

2015-10-01 19:56 - 2015-09-17 02:25 - 00962400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll

2015-10-01 19:56 - 2015-09-17 02:20 - 00764416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.appcore.dll

2015-10-01 19:56 - 2015-09-17 02:12 - 16708608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll

2015-10-01 19:56 - 2015-09-17 02:07 - 21875712 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll

2015-10-01 19:56 - 2015-09-17 02:06 - 00467968 _____ (Microsoft Corporation) C:\WINDOWS\system32\MBMediaManager.dll

2015-10-01 19:56 - 2015-09-17 02:05 - 02226688 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkMobileSettings.dll

2015-10-01 19:56 - 2015-09-17 02:04 - 07569408 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll

2015-10-01 19:56 - 2015-09-17 02:00 - 24595456 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2015-10-01 19:56 - 2015-09-17 02:00 - 03248640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll

2015-10-01 19:56 - 2015-09-17 02:00 - 02417664 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll

2015-10-01 19:56 - 2015-09-17 01:57 - 02228736 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll

2015-10-01 19:56 - 2015-09-17 01:56 - 00859136 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll

2015-10-01 19:56 - 2015-09-17 01:55 - 02236416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll

2015-10-01 19:56 - 2015-09-17 01:55 - 01601536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Speech.dll

2015-10-01 19:56 - 2015-09-17 01:54 - 03781120 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll

2015-10-01 19:56 - 2015-09-17 01:53 - 07055872 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll

2015-10-01 19:56 - 2015-09-17 01:52 - 01181696 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll

2015-10-01 19:56 - 2015-09-17 01:51 - 13027840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll

2015-10-01 19:56 - 2015-09-17 01:51 - 02660864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll

2015-10-01 19:56 - 2015-09-17 01:51 - 01203712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Bluetooth.dll

2015-10-01 19:56 - 2015-09-17 01:49 - 02740224 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll

2015-10-01 19:56 - 2015-09-17 01:49 - 01290240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll

2015-10-01 19:56 - 2015-09-17 01:49 - 01010176 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXService.dll

2015-10-01 19:56 - 2015-09-17 01:48 - 02093056 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidsvc.dll

2015-10-01 19:56 - 2015-09-17 01:47 - 07523328 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll

2015-10-01 19:56 - 2015-09-17 01:45 - 19325440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2015-10-01 19:56 - 2015-09-17 01:45 - 04791296 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll

2015-10-01 19:56 - 2015-09-17 01:45 - 01331200 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIAutomationCore.dll

2015-10-01 19:56 - 2015-09-17 01:43 - 01213440 _____ (Microsoft Corporation) C:\WINDOWS\system32\RemoteNaturalLanguage.dll

2015-10-01 19:56 - 2015-09-17 01:42 - 02646528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll

2015-10-01 19:56 - 2015-09-17 01:40 - 06101504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll

2015-10-01 19:56 - 2015-09-17 01:40 - 01918464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll

2015-10-01 19:56 - 2015-09-17 01:40 - 01162240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Speech.dll

2015-10-01 19:56 - 2015-09-17 01:38 - 00058368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usoapi.dll

2015-10-01 19:56 - 2015-09-17 01:37 - 18806272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll

2015-10-01 19:56 - 2015-09-17 01:35 - 05079552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingMaps.dll

2015-10-01 19:56 - 2015-09-17 01:35 - 02207232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll

2015-10-01 19:56 - 2015-09-17 01:35 - 01820160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll

2015-10-01 19:56 - 2015-09-17 01:32 - 03579904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll

2015-10-01 19:56 - 2015-09-17 01:31 - 05454848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll

2015-10-01 19:56 - 2015-09-17 01:29 - 01104384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIAutomationCore.dll

2015-10-01 19:56 - 2015-09-17 01:26 - 00899584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\RemoteNaturalLanguage.dll

2015-10-01 19:56 - 2015-09-12 22:05 - 02987520 _____ (Microsoft Corporation) C:\WINDOWS\system32\esent.dll

2015-10-01 19:55 - 2015-09-24 20:35 - 00257024 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataAccountApis.dll

2015-10-01 19:55 - 2015-09-24 20:34 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneCallHistoryApis.dll

2015-10-01 19:55 - 2015-09-24 19:34 - 00195584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataAccountApis.dll

2015-10-01 19:55 - 2015-09-24 19:34 - 00172032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhoneCallHistoryApis.dll

2015-10-01 19:55 - 2015-09-24 19:24 - 00796160 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll

2015-10-01 19:55 - 2015-09-24 19:24 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll

2015-10-01 19:55 - 2015-09-24 19:23 - 00579072 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe

2015-10-01 19:55 - 2015-09-24 19:08 - 03586560 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys

2015-10-01 19:55 - 2015-09-24 19:07 - 01382400 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys

2015-10-01 19:55 - 2015-09-24 19:05 - 00288256 _____ (Microsoft Corporation) C:\WINDOWS\system32\PimIndexMaintenance.dll

2015-10-01 19:55 - 2015-09-24 19:01 - 00685568 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppointmentApis.dll

2015-10-01 19:55 - 2015-09-24 19:00 - 00752640 _____ (Microsoft Corporation) C:\WINDOWS\system32\ChatApis.dll

2015-10-01 19:55 - 2015-09-24 19:00 - 00720896 _____ (Microsoft Corporation) C:\WINDOWS\system32\EmailApis.dll

2015-10-01 19:55 - 2015-09-24 19:00 - 00163840 _____ (Microsoft Corporation) C:\WINDOWS\system32\CallHistoryClient.dll

2015-10-01 19:55 - 2015-09-24 18:53 - 00590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\MessagingDataModel2.dll

2015-10-01 19:55 - 2015-09-24 18:43 - 00613376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll

2015-10-01 19:55 - 2015-09-24 18:43 - 00480256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll

2015-10-01 19:55 - 2015-09-24 18:25 - 00625152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ContactApis.dll

2015-10-01 19:55 - 2015-09-24 18:25 - 00579584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppointmentApis.dll

2015-10-01 19:55 - 2015-09-24 18:25 - 00557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ChatApis.dll

2015-10-01 19:55 - 2015-09-24 18:25 - 00525312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EmailApis.dll

2015-10-01 19:55 - 2015-09-24 18:24 - 00131072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CallHistoryClient.dll

2015-10-01 19:55 - 2015-09-24 18:19 - 00466432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MessagingDataModel2.dll

2015-10-01 19:55 - 2015-09-19 01:14 - 00102304 _____ (Microsoft Corporation) C:\WINDOWS\system32\omadmapi.dll

2015-10-01 19:55 - 2015-09-17 02:50 - 00099664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pdc.sys

2015-10-01 19:55 - 2015-09-17 02:50 - 00088384 _____ (Microsoft Corporation) C:\WINDOWS\system32\remoteaudioendpoint.dll

2015-10-01 19:55 - 2015-09-17 02:49 - 01563472 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpmde.dll

2015-10-01 19:55 - 2015-09-17 02:49 - 00894256 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Wdf01000.sys

2015-10-01 19:55 - 2015-09-17 02:49 - 00553808 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe

2015-10-01 19:55 - 2015-09-17 02:49 - 00501008 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll

2015-10-01 19:55 - 2015-09-17 02:48 - 02156400 _____ (Microsoft Corporation) C:\WINDOWS\system32\hevcdecoder.dll

2015-10-01 19:55 - 2015-09-17 02:48 - 00584656 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf.dll

2015-10-01 19:55 - 2015-09-17 02:48 - 00555768 _____ (Microsoft Corporation) C:\WINDOWS\system32\directmanipulation.dll

2015-10-01 19:55 - 2015-09-17 02:48 - 00537080 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWanAPI.dll

2015-10-01 19:55 - 2015-09-17 02:48 - 00516448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS

2015-10-01 19:55 - 2015-09-17 02:48 - 00505696 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys

2015-10-01 19:55 - 2015-09-17 02:48 - 00476760 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFCaptureEngine.dll

2015-10-01 19:55 - 2015-09-17 02:48 - 00406864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS

2015-10-01 19:55 - 2015-09-17 02:48 - 00395088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys

2015-10-01 19:55 - 2015-09-17 02:48 - 00332624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fastfat.sys

2015-10-01 19:55 - 2015-09-17 02:48 - 00278352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys

2015-10-01 19:55 - 2015-09-17 02:48 - 00243760 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll

2015-10-01 19:55 - 2015-09-17 02:44 - 00781976 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfds.dll

2015-10-01 19:55 - 2015-09-17 02:39 - 00081488 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll

2015-10-01 19:55 - 2015-09-17 02:37 - 01168736 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys

2015-10-01 19:55 - 2015-09-17 02:28 - 01357888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll

2015-10-01 19:55 - 2015-09-17 02:28 - 00441168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe

2015-10-01 19:55 - 2015-09-17 02:28 - 00407608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll

2015-10-01 19:55 - 2015-09-17 02:28 - 00074880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\remoteaudioendpoint.dll

2015-10-01 19:55 - 2015-09-17 02:27 - 00454512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\directmanipulation.dll

2015-10-01 19:55 - 2015-09-17 02:26 - 01895568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hevcdecoder.dll

2015-10-01 19:55 - 2015-09-17 02:26 - 00508248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mf.dll

2015-10-01 19:55 - 2015-09-17 02:26 - 00434376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFCaptureEngine.dll

2015-10-01 19:55 - 2015-09-17 02:26 - 00428128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWanAPI.dll

2015-10-01 19:55 - 2015-09-17 02:21 - 00658528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfds.dll

2015-10-01 19:55 - 2015-09-17 02:11 - 00160256 _____ (Microsoft Corporation) C:\WINDOWS\system32\enrollmentapi.dll

2015-10-01 19:55 - 2015-09-17 02:10 - 00169984 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmregistration.dll

2015-10-01 19:55 - 2015-09-17 02:09 - 00269312 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll

2015-10-01 19:55 - 2015-09-17 02:09 - 00143360 _____ (Microsoft Corporation) C:\WINDOWS\system32\provops.dll

2015-10-01 19:55 - 2015-09-17 02:08 - 00494592 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll

2015-10-01 19:55 - 2015-09-17 02:08 - 00053760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Speech.Pal.dll

2015-10-01 19:55 - 2015-09-17 02:08 - 00026624 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManagerShellext.exe

2015-10-01 19:55 - 2015-09-17 02:06 - 00690688 _____ (Microsoft Corporation) C:\WINDOWS\system32\CellularAPI.dll

2015-10-01 19:55 - 2015-09-17 02:06 - 00149504 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringservice.dll

2015-10-01 19:55 - 2015-09-17 02:05 - 00483328 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneDriveSettingSyncProvider.dll

2015-10-01 19:55 - 2015-09-17 02:04 - 00910848 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedStartModel.dll

2015-10-01 19:55 - 2015-09-17 02:04 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\system32\DataSenseHandlers.dll

2015-10-01 19:55 - 2015-09-17 02:03 - 00267776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Management.dll

2015-10-01 19:55 - 2015-09-17 02:03 - 00187904 _____ (Microsoft Corporation) C:\WINDOWS\system32\provisioningcsp.dll

2015-10-01 19:55 - 2015-09-17 02:03 - 00154624 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmcertinst.exe

2015-10-01 19:55 - 2015-09-17 02:03 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngckeyenum.dll

2015-10-01 19:55 - 2015-09-17 02:03 - 00083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceEnroller.exe

2015-10-01 19:55 - 2015-09-17 02:02 - 00168960 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmmigrator.dll

2015-10-01 19:55 - 2015-09-17 02:02 - 00068096 _____ (Microsoft Corporation) C:\WINDOWS\system32\EnterpriseDesktopAppMgmtCSP.dll

2015-10-01 19:55 - 2015-09-17 02:00 - 00446976 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapConfiguration.dll

2015-10-01 19:55 - 2015-09-17 02:00 - 00106496 _____ (Microsoft Corporation) C:\WINDOWS\system32\KeywordDetectorMsftSidAdapter.dll

2015-10-01 19:55 - 2015-09-17 01:58 - 00503808 _____ (Microsoft Corporation) C:\WINDOWS\system32\tileobjserver.dll

2015-10-01 19:55 - 2015-09-17 01:57 - 00403456 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmenrollengine.dll

2015-10-01 19:55 - 2015-09-17 01:57 - 00281600 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEEventDispatcher.dll

2015-10-01 19:55 - 2015-09-17 01:57 - 00137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEStoreEventHandlers.dll

2015-10-01 19:55 - 2015-09-17 01:56 - 00521728 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll

2015-10-01 19:55 - 2015-09-17 01:56 - 00317440 _____ (Microsoft Corporation) C:\WINDOWS\system32\configmanager2.dll

2015-10-01 19:55 - 2015-09-17 01:55 - 00671232 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUDFx02000.dll

2015-10-01 19:55 - 2015-09-17 01:55 - 00366592 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll

2015-10-01 19:55 - 2015-09-17 01:55 - 00346112 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngccredprov.dll

2015-10-01 19:55 - 2015-09-17 01:55 - 00202240 _____ (Microsoft Corporation) C:\WINDOWS\system32\accountaccessor.dll

2015-10-01 19:55 - 2015-09-17 01:55 - 00121856 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmcsps.dll

2015-10-01 19:55 - 2015-09-17 01:55 - 00120832 _____ (Microsoft Corporation) C:\WINDOWS\system32\omadmclient.exe

2015-10-01 19:55 - 2015-09-17 01:55 - 00073728 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwancfg.dll

2015-10-01 19:55 - 2015-09-17 01:54 - 00780288 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll

2015-10-01 19:55 - 2015-09-17 01:54 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll

2015-10-01 19:55 - 2015-09-17 01:52 - 06572032 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanmm.dll

2015-10-01 19:55 - 2015-09-17 01:52 - 01216512 _____ (Microsoft Corporation) C:\WINDOWS\system32\netcenter.dll

2015-10-01 19:55 - 2015-09-17 01:52 - 00856576 _____ (Microsoft Corporation) C:\WINDOWS\system32\MPSSVC.dll

2015-10-01 19:55 - 2015-09-17 01:52 - 00591360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll

2015-10-01 19:55 - 2015-09-17 01:52 - 00570880 _____ (Microsoft Corporation) C:\WINDOWS\system32\MbaeApi.dll

2015-10-01 19:55 - 2015-09-17 01:52 - 00465920 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanconn.dll

2015-10-01 19:55 - 2015-09-17 01:52 - 00371712 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll

2015-10-01 19:55 - 2015-09-17 01:52 - 00204800 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll

2015-10-01 19:55 - 2015-09-17 01:52 - 00162304 _____ (Microsoft Corporation) C:\WINDOWS\system32\SubscriptionMgr.dll

2015-10-01 19:55 - 2015-09-17 01:51 - 01812480 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnidui.dll

2015-10-01 19:55 - 2015-09-17 01:51 - 01067520 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll

2015-10-01 19:55 - 2015-09-17 01:51 - 00359936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll

2015-10-01 19:55 - 2015-09-17 01:51 - 00145920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mdmregistration.dll

2015-10-01 19:55 - 2015-09-17 01:50 - 00421888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Bluetooth.dll

2015-10-01 19:55 - 2015-09-17 01:50 - 00320000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\portcls.sys

2015-10-01 19:55 - 2015-09-17 01:50 - 00312832 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsApi.dll

2015-10-01 19:55 - 2015-09-17 01:50 - 00221184 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationPeWiFi.dll

2015-10-01 19:55 - 2015-09-17 01:50 - 00204288 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationPeCell.dll

2015-10-01 19:55 - 2015-09-17 01:50 - 00036352 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\buttonconverter.sys

2015-10-01 19:55 - 2015-09-17 01:49 - 00771072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll

2015-10-01 19:55 - 2015-09-17 01:49 - 00439296 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationWebproxy.dll

2015-10-01 19:55 - 2015-09-17 01:49 - 00342016 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationGeofences.dll

2015-10-01 19:55 - 2015-09-17 01:49 - 00268800 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationFramework.dll

2015-10-01 19:55 - 2015-09-17 01:49 - 00215552 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationCrowdsource.dll

2015-10-01 19:55 - 2015-09-17 01:49 - 00176640 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationPeIP.dll

2015-10-01 19:55 - 2015-09-17 01:49 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationWiFiAdapter.dll

2015-10-01 19:55 - 2015-09-17 01:49 - 00041472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Speech.Pal.dll

2015-10-01 19:55 - 2015-09-17 01:48 - 00517632 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationController.dll

2015-10-01 19:55 - 2015-09-17 01:48 - 00408064 _____ (Microsoft Corporation) C:\WINDOWS\system32\CredProvDataModel.dll

2015-10-01 19:55 - 2015-09-17 01:48 - 00387584 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppBroker.dll

2015-10-01 19:55 - 2015-09-17 01:48 - 00347136 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncryptprov.dll

2015-10-01 19:55 - 2015-09-17 01:48 - 00273920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll

2015-10-01 19:55 - 2015-09-17 01:47 - 00513536 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngcsvc.dll

2015-10-01 19:55 - 2015-09-17 01:47 - 00371712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OneDriveSettingSyncProvider.dll

2015-10-01 19:55 - 2015-09-17 01:47 - 00186880 _____ (Microsoft Corporation) C:\WINDOWS\system32\cloudAP.dll

2015-10-01 19:55 - 2015-09-17 01:46 - 00928256 _____ (Microsoft Corporation) C:\WINDOWS\system32\JpMapControl.dll

2015-10-01 19:55 - 2015-09-17 01:46 - 00621056 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll

2015-10-01 19:55 - 2015-09-17 01:46 - 00414208 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll

2015-10-01 19:55 - 2015-09-17 01:46 - 00224256 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCore.dll

2015-10-01 19:55 - 2015-09-17 01:46 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\KnobsCsp.dll

2015-10-01 19:55 - 2015-09-17 01:46 - 00084480 _____ (Microsoft Corporation) C:\WINDOWS\system32\MDMAppInstaller.exe

2015-10-01 19:55 - 2015-09-17 01:46 - 00079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\HttpsDataSource.dll

2015-10-01 19:55 - 2015-09-17 01:46 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\system32\syncmlhook.dll

2015-10-01 19:55 - 2015-09-17 01:45 - 00869376 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapControlCore.dll

2015-10-01 19:55 - 2015-09-17 01:45 - 00832512 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsStore.dll

2015-10-01 19:55 - 2015-09-17 01:45 - 00627712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll

2015-10-01 19:55 - 2015-09-17 01:45 - 00193024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.Management.dll

2015-10-01 19:55 - 2015-09-17 01:44 - 01844736 _____ (Microsoft Corporation) C:\WINDOWS\system32\workfolderssvc.dll

2015-10-01 19:55 - 2015-09-17 01:44 - 00599552 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpnapps.dll

2015-10-01 19:55 - 2015-09-17 01:44 - 00526336 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll

2015-10-01 19:55 - 2015-09-17 01:44 - 00274944 _____ (Microsoft Corporation) C:\WINDOWS\system32\syncutil.dll

2015-10-01 19:55 - 2015-09-17 01:43 - 00378368 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemEventsBrokerServer.dll

2015-10-01 19:55 - 2015-09-17 01:43 - 00328704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapConfiguration.dll

2015-10-01 19:55 - 2015-09-17 01:43 - 00185344 _____ (Microsoft Corporation) C:\WINDOWS\system32\psmsrv.dll

2015-10-01 19:55 - 2015-09-17 01:41 - 00217088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VEEventDispatcher.dll

2015-10-01 19:55 - 2015-09-17 01:39 - 00587264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll

2015-10-01 19:55 - 2015-09-17 01:39 - 00247808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll

2015-10-01 19:55 - 2015-09-17 01:37 - 00454656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MbaeApi.dll

2015-10-01 19:55 - 2015-09-17 01:36 - 01171456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netcenter.dll

2015-10-01 19:55 - 2015-09-17 01:35 - 00828928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Bluetooth.dll

2015-10-01 19:55 - 2015-09-17 01:34 - 00253440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SensorsApi.dll

2015-10-01 19:55 - 2015-09-17 01:33 - 00574464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll

2015-10-01 19:55 - 2015-09-17 01:32 - 00336384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredProvDataModel.dll

2015-10-01 19:55 - 2015-09-17 01:32 - 00313856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LockAppBroker.dll

2015-10-01 19:55 - 2015-09-17 01:32 - 00195072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll

2015-10-01 19:55 - 2015-09-17 01:31 - 00268800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncryptprov.dll

2015-10-01 19:55 - 2015-09-17 01:30 - 00311808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll

2015-10-01 19:55 - 2015-09-17 01:29 - 00701952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\JpMapControl.dll

2015-10-01 19:55 - 2015-09-17 01:29 - 00677888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapControlCore.dll

2015-10-01 19:55 - 2015-09-17 01:29 - 00464896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll

2015-10-01 19:55 - 2015-09-17 01:28 - 00473088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wpnapps.dll

2015-10-01 19:55 - 2015-09-17 01:16 - 00512000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll

2015-10-01 19:55 - 2015-09-12 21:41 - 02639872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\esent.dll

2015-09-20 16:02 - 2015-09-20 16:02 - 00000826 _____ C:\Users\Public\Desktop\GoPro Studio.lnk

2015-09-20 16:02 - 2015-09-20 16:02 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GoPro

2015-09-20 16:02 - 2015-09-20 16:02 - 00000000 ____D C:\Program Files (x86)\GoPro

2015-09-20 16:02 - 2015-09-20 16:02 - 00000000 ____D C:\Program Files (x86)\CineForm

2015-09-20 16:01 - 2015-09-20 16:01 - 121750768 _____ (GoPro, Inc.) C:\Users\Scott Duncan\Downloads\GoProStudioPC-2.5.6.509 (3).exe

2015-09-20 15:59 - 2015-09-20 16:00 - 121750768 _____ (GoPro, Inc.) C:\Users\Scott Duncan\Downloads\GoProStudioPC-2.5.6.509 (2).exe

2015-09-20 15:58 - 2015-09-20 15:58 - 121750768 _____ (GoPro, Inc.) C:\Users\Scott Duncan\Downloads\GoProStudioPC-2.5.6.509 (1).exe

2015-09-20 15:40 - 2015-09-20 16:04 - 00000000 ____D C:\Users\Scott Duncan\AppData\Roaming\GoPro

2015-09-20 15:40 - 2015-09-20 15:40 - 00000000 ____D C:\Users\Scott Duncan\AppData\Local\GoPro

2015-09-20 15:39 - 2015-09-20 20:21 - 00000000 ____D C:\Users\Public\CineForm

2015-09-20 15:29 - 2015-09-20 15:37 - 121750768 _____ (GoPro, Inc.) C:\Users\Scott Duncan\Downloads\GoProStudioPC-2.5.6.509.exe

2015-09-17 19:52 - 2015-09-17 19:52 - 00929872 _____ (Google Inc.) C:\Users\Scott Duncan\Downloads\musicmanagerinstaller (1).exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-10-16 06:17 - 2014-02-27 20:46 - 00000634 _____ C:\WINDOWS\Tasks\G2MUpdateTask-S-1-5-21-2949255578-4130258502-838744892-1000.job

2015-10-16 06:12 - 2013-09-04 21:09 - 00000966 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-2949255578-4130258502-838744892-1000UA.job

2015-10-16 06:12 - 2013-09-04 21:09 - 00000914 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-2949255578-4130258502-838744892-1000Core.job

2015-10-16 06:09 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\AppReadiness

2015-10-16 06:08 - 2014-08-19 10:46 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-10-16 06:06 - 2015-06-18 05:55 - 00000946 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-2949255578-4130258502-838744892-1000UA.job

2015-10-16 06:06 - 2015-06-18 05:54 - 00000894 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-2949255578-4130258502-838744892-1000Core.job

2015-10-16 06:01 - 2015-08-05 19:54 - 00004178 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{7564F611-1F9E-474B-AD81-94FED0867077}

2015-10-16 06:00 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\system32\sru

2015-10-16 06:00 - 2014-08-19 10:49 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys

2015-10-16 05:59 - 2015-07-10 08:22 - 00000275 _____ C:\WINDOWS\WindowsUpdate.log

2015-10-16 05:59 - 2014-01-16 02:50 - 00000000 ___RD C:\Users\Scott Duncan\Dropbox

2015-10-16 05:59 - 2014-01-16 02:48 - 00000000 ____D C:\Users\Scott Duncan\AppData\Roaming\Dropbox

2015-10-16 05:58 - 2012-04-07 05:48 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job

2015-10-16 05:58 - 2011-08-18 16:24 - 00000932 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

2015-10-15 22:48 - 2011-08-18 16:24 - 00000936 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job

2015-10-15 22:46 - 2015-05-30 19:09 - 00000730 _____ C:\WINDOWS\Tasks\G2MUploadTask-S-1-5-21-2949255578-4130258502-838744892-1000.job

2015-10-15 21:42 - 2014-01-16 14:06 - 00000000 ____D C:\Users\Scott Duncan\Documents\Photography Biz

2015-10-15 18:51 - 2014-01-09 23:48 - 00002271 _____ C:\Users\Public\Desktop\Google Chrome.lnk

2015-10-13 22:03 - 2014-12-24 14:41 - 00003972 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task

2015-10-13 22:03 - 2014-01-28 18:04 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

2015-10-13 18:04 - 2011-12-03 21:38 - 00000000 ____D C:\ProgramData\Microsoft Help

2015-10-13 18:02 - 2015-07-10 06:55 - 00000000 ____D C:\WINDOWS\CbsTemp

2015-10-13 18:01 - 2009-07-13 22:34 - 00000478 _____ C:\WINDOWS\win.ini

2015-10-13 17:52 - 2014-08-19 10:46 - 00001182 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-10-13 17:52 - 2014-08-19 10:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-10-13 06:03 - 2015-07-29 22:43 - 01004186 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2015-10-10 14:15 - 2015-07-10 05:05 - 00032768 ___SH C:\WINDOWS\system32\config\ELAM

2015-10-10 14:12 - 2014-08-19 10:36 - 00008192 _____ C:\WINDOWS\SysWOW64\WDPABKP.dat

2015-10-10 14:11 - 2015-07-29 22:37 - 00075978 _____ C:\WINDOWS\PFRO.log

2015-10-10 14:11 - 2015-07-10 08:21 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2015-10-10 14:10 - 2015-07-29 22:45 - 00000000 ____D C:\Users\Ctx_StreamingSvc

2015-10-10 14:10 - 2015-07-10 05:05 - 00262144 ___SH C:\WINDOWS\system32\config\BBI

2015-10-10 13:19 - 2013-08-05 14:03 - 00000000 ____D C:\Program Files (x86)\PC Checkup

2015-10-08 17:06 - 2015-07-10 08:20 - 00020299 _____ C:\WINDOWS\setupact.log

2015-10-07 22:34 - 2015-07-29 22:45 - 00000000 ____D C:\Users\Scott Duncan

2015-10-06 19:07 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\rescache

2015-10-05 09:50 - 2014-08-19 10:46 - 00109272 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys

2015-10-05 09:50 - 2014-08-19 10:46 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys

2015-10-05 09:50 - 2014-08-19 10:46 - 00025816 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys

2015-10-04 13:10 - 2015-07-10 07:04 - 00000000 ___HD C:\WINDOWS\ELAMBKUP

2015-10-04 13:10 - 2014-01-09 23:13 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2015-10-04 13:08 - 2015-07-10 07:04 - 00000000 ___SD C:\WINDOWS\SysWOW64\F12

2015-10-04 13:08 - 2015-07-10 07:04 - 00000000 ___SD C:\WINDOWS\system32\F12

2015-10-04 13:08 - 2015-07-10 07:04 - 00000000 ___RD C:\WINDOWS\PurchaseDialog

2015-10-04 13:08 - 2015-07-10 07:04 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility

2015-10-04 13:08 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns

2015-10-04 13:08 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\system32\SystemResetPlatform

2015-10-04 13:08 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\system32\appraiser

2015-10-04 13:08 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\Provisioning

2015-10-04 13:08 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\L2Schemas

2015-10-03 12:57 - 2015-07-30 05:59 - 00002507 _____ C:\Users\Public\Desktop\Norton Internet Security.LNK

2015-10-03 12:57 - 2014-06-25 09:39 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Internet Security

2015-10-03 12:57 - 2012-07-18 22:51 - 00003404 _____ C:\WINDOWS\System32\Tasks\Norton WSC Integration

2015-10-03 12:57 - 2011-08-18 16:21 - 00000000 ____D C:\WINDOWS\system32\Drivers\NISx64

2015-10-02 13:36 - 2015-07-10 07:06 - 00810488 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe

2015-10-01 20:49 - 2014-03-17 12:00 - 00002126 _____ C:\Users\Public\Desktop\Google Slides.lnk

2015-10-01 20:49 - 2014-03-17 12:00 - 00002124 _____ C:\Users\Public\Desktop\Google Sheets.lnk

2015-10-01 20:49 - 2014-03-17 12:00 - 00002114 _____ C:\Users\Public\Desktop\Google Docs.lnk

2015-10-01 20:49 - 2014-03-17 12:00 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive

2015-09-30 06:53 - 2014-06-19 12:25 - 00000000 ____D C:\Users\Scott Duncan\Documents\Pets - Paperwork

2015-09-29 20:46 - 2011-11-19 13:54 - 00000059 _____ C:\WINDOWS\wpd99.drv

2015-09-29 20:46 - 2011-11-19 13:54 - 00000000 ____D C:\ProgramData\pdf995

2015-09-20 16:02 - 2013-11-11 19:57 - 00000000 ____D C:\ProgramData\Package Cache

2015-09-18 20:20 - 2015-05-30 19:09 - 00003910 _____ C:\WINDOWS\System32\Tasks\G2MUploadTask-S-1-5-21-2949255578-4130258502-838744892-1000

2015-09-18 20:20 - 2014-02-27 20:46 - 00003814 _____ C:\WINDOWS\System32\Tasks\G2MUpdateTask-S-1-5-21-2949255578-4130258502-838744892-1000

2015-09-17 21:43 - 2011-08-18 16:24 - 00003994 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA

2015-09-17 21:43 - 2011-08-18 16:24 - 00003762 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore

2015-09-16 20:40 - 2015-07-30 05:41 - 00000000 ____D C:\Users\Scott Duncan\AppData\Local\Packages

2015-09-16 06:07 - 2013-09-04 21:09 - 00004096 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2949255578-4130258502-838744892-1000UA

2015-09-16 06:07 - 2013-09-04 21:09 - 00003720 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2949255578-4130258502-838744892-1000Core

==================== Files in the root of some directories =======

2014-05-23 23:16 - 2014-05-23 23:16 - 14936064 _____ (LastPass) C:\Program Files (x86)\Common Files\lpuninstall.exe

2013-01-11 15:13 - 2013-01-11 15:13 - 0022464 _____ (Intel Corporation) C:\Users\Scott Duncan\AppData\Roaming\JomCap.dll

2013-09-22 19:00 - 2014-01-03 22:02 - 0000098 _____ () C:\Users\Scott Duncan\AppData\Roaming\WB.CFG

2013-08-29 21:03 - 2013-08-29 21:03 - 0001456 _____ () C:\Users\Scott Duncan\AppData\Local\Adobe Save for Web 12.0 Prefs

2014-01-24 15:37 - 2014-01-24 15:37 - 0000017 _____ () C:\Users\Scott Duncan\AppData\Local\resmon.resmoncfg

2014-05-26 14:50 - 2014-05-26 14:50 - 0000057 _____ () C:\ProgramData\Ament.ini

Some files in TEMP:

====================

C:\Users\Scott Duncan\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp4ntzip.dll

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed

C:\WINDOWS\system32\wininit.exe => File is digitally signed

C:\WINDOWS\explorer.exe => File is digitally signed

C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed

C:\WINDOWS\system32\svchost.exe => File is digitally signed

C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed

C:\WINDOWS\system32\services.exe => File is digitally signed

C:\WINDOWS\system32\User32.dll => File is digitally signed

C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed

C:\WINDOWS\system32\userinit.exe => File is digitally signed

C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed

C:\WINDOWS\system32\rpcss.dll => File is digitally signed

C:\WINDOWS\system32\dnsapi.dll => File is digitally signed

C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed

C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2015-10-11 06:39

==================== End of FRST.txt ============================

RSD · October 16, 2015

Additional scan result of Farbar Recovery Scan Tool (x64) Version:15-10-2015 01

Ran by Scott Duncan (2015-10-16 06:37:45)

Running from C:\Users\Scott Duncan\Downloads

Windows 10 Home (X64) (2015-07-30 09:41:14)

Boot Mode: Normal

==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-2949255578-4130258502-838744892-500 - Administrator - Disabled)

Ctx_StreamingSvc (S-1-5-21-2949255578-4130258502-838744892-1003 - Limited - Enabled) => C:\Users\Ctx_StreamingSvc

DefaultAccount (S-1-5-21-2949255578-4130258502-838744892-503 - Limited - Disabled)

Guest (S-1-5-21-2949255578-4130258502-838744892-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-2949255578-4130258502-838744892-1002 - Limited - Enabled)

Scott Duncan (S-1-5-21-2949255578-4130258502-838744892-1000 - Administrator - Enabled) => C:\Users\Scott Duncan

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Norton Internet Security (Disabled - Up to date) {53C7D717-52E2-B95E-FA61-6F32ECC805DB}

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Norton Internet Security (Disabled - Up to date) {E8A636F3-74D8-B6D0-C0D1-5440974F4F66}

FW: Norton Internet Security (Disabled) {6BFC5632-188D-B806-D13E-C607121B42A0}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.21 (HKLM-x32\...\{23170F69-40C1-2701-0921-000001000000}) (Version: 9.21.00.0 - Igor Pavlov)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 15.0.0.249 - Adobe Systems Incorporated)

Adobe Community Help (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.5.23 - Adobe Systems Incorporated.)

Adobe Flash Player 19 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 19.0.0.207 - Adobe Systems Incorporated)

Adobe Media Player (HKLM-x32\...\com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.8 - Adobe Systems Incorporated)

Adobe Photoshop CS5 (HKLM-x32\...\{15FEDA5F-141C-4127-8D7E-B962D1742728}) (Version: 12.0 - Adobe Systems Incorporated)

Adobe Photoshop Lightroom 3.6 64-bit (HKLM\...\{D4F66BBA-D79E-4F11-9B06-70C3D75A2958}) (Version: 3.6.1 - Adobe)

Adobe Reader XI (11.0.13) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.13 - Adobe Systems Incorporated)

Amazon Links (HKLM-x32\...\{3135D885-9D9A-4B4D-8D45-9DB05DA115CA}) (Version: 2.02 - TOSHIBA Corporation)

Apple Application Support (32-bit) (HKLM-x32\...\{7FE25256-B7C1-480D-B736-10A67A833AEA}) (Version: 3.2 - Apple Inc.)

Apple Application Support (64-bit) (HKLM\...\{B255D495-4734-4E9B-B4F5-96702FD4A7B9}) (Version: 3.2 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{5D61F006-168C-4B8B-B7FD-F113C10AE0E4}) (Version: 8.2.1.3 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.36 - Atheros Communications Inc.)

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

Cisco WebEx Meetings (HKLM-x32\...\ActiveTouchMeetingClient) (Version: - Cisco WebEx LLC)

Citrix Offline Plug-in (HKLM-x32\...\{70BB990A-1461-4178-943D-7F771067D95C}) (Version: 6.5.0.6684 - Citrix Systems, Inc.)

Citrix Online Launcher (HKLM-x32\...\{AC7E7905-8C59-4806-A96D-30936A2B1FC5}) (Version: 1.0.168 - Citrix)

Citrix online plug-in - web (HKLM-x32\...\CitrixOnlinePluginPackWeb) (Version: 11.2.0.31560 - Citrix Systems, Inc.)

Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.51.1.0 - Conexant)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

Dropbox (HKU\S-1-5-21-2949255578-4130258502-838744892-1000\...\Dropbox) (Version: 3.10.7 - Dropbox, Inc.)

Dropbox (HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Dropbox) (Version: 3.10.7 - Dropbox, Inc.)

Dropbox (HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Dropbox) (Version: 3.10.7 - Dropbox, Inc.)

eReg (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden

ERUNT 1.1j (HKLM-x32\...\ERUNT_is1) (Version: - Lars Hederer)

ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )

FileOpener Packages (HKU\S-1-5-21-2949255578-4130258502-838744892-1000\...\FileOpener Packages) (Version: - ) <==== ATTENTION

FileOpener Packages (HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\FileOpener Packages) (Version: - ) <==== ATTENTION

FileOpener Packages (HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\FileOpener Packages) (Version: - ) <==== ATTENTION

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 46.0.2490.71 - Google Inc.)

Google Drive (HKLM-x32\...\{CF772DD2-4767-49AE-B764-EACA6F6CD9AE}) (Version: 1.25.0286.7715 - Google, Inc.)

Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)

Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6904.2028 - Google Inc.)

Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.28.15 - Google Inc.) Hidden

GoPro App (x32 Version: 5.6.509 - GoPro, Inc.) Hidden

GoPro Studio 2.5.6 (HKLM-x32\...\{8850d4d9-a0fc-453f-ba03-ec084375d0c2}) (Version: 2.5.6.509 - GoPro, Inc.)

GoToMeeting 7.3.0.3499 (HKU\S-1-5-21-2949255578-4130258502-838744892-1000\...\GoToMeeting) (Version: 7.3.0.3499 - CitrixOnline)

GoToMeeting 7.3.0.3499 (HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\GoToMeeting) (Version: 7.3.0.3499 - CitrixOnline)

GoToMeeting 7.3.0.3499 (HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\GoToMeeting) (Version: 7.3.0.3499 - CitrixOnline)

HP FWUpdateEDO2 (HKLM-x32\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)

HP Officejet Pro 8600 Basic Device Software (HKLM\...\{791A06E2-340F-43B0-8FAB-62D151339362}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)

HP Officejet Pro 8600 Help (HKLM-x32\...\{46235FF7-2CBE-4A84-BEDA-87348D1F7850}) (Version: 28.0.0 - Hewlett Packard)

HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)

HPDiagnosticAlert (x32 Version: 1.00.0001 - Microsoft) Hidden

I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)

iCloud (HKLM\...\{709A2D23-C25E-47B5-9268-CB6FEE648504}) (Version: 4.1.1.53 - Apple Inc.)

IHA_MessageCenter (HKLM-x32\...\{53C49C8D-DFB2-42B9-A7EF-0F9CA386CC13}) (Version: 1.8.17 - Verizon)

Intel® Identity Protection Technology 1.2.28.0 (HKLM-x32\...\{A87263E8-26CB-1016-8F2F-C04708B17CE2}) (Version: 1.2.28.0 - Intel Corporation)

Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.1.80.1213 - Intel Corporation)

Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2353 - Intel Corporation)

Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.2.1004 - Intel Corporation)

iTunes (HKLM\...\{BFEAB774-C7DC-4032-B05A-DA5F7CB7B365}) (Version: 12.2.2.25 - Apple Inc.)

Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Label@Once 1.0 (HKLM-x32\...\{0D795777-9D60-4692-8386-F2B3F2B5E5BF}) (Version: 1.0 - Corel)

LastPass (uninstall only) (HKLM-x32\...\LastPass) (Version: - LastPass)

Logitech SetPoint 6.61 (HKLM\...\sp6) (Version: 6.61.15 - Logitech)

Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)

Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)

Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)

Mozilla Firefox 41.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 41.0.1 (x86 en-US)) (Version: 41.0.1 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 41.0.1.5750 - Mozilla)

Music Manager (HKU\S-1-5-21-2949255578-4130258502-838744892-1000\...\MusicManager) (Version: - Google, Inc.)

Music Manager (HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MusicManager) (Version: - Google, Inc.)

Music Manager (HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\MusicManager) (Version: - Google, Inc.)

Nik Collection (HKLM-x32\...\Nik Collection) (Version: 1.2.11 - Google)

Norton Internet Security (HKLM-x32\...\NIS) (Version: 22.5.4.24 - Symantec Corporation)

Norton PC Checkup (HKLM-x32\...\Norton PC Checkup_is1) (Version: 3.0.5.38.0 - Symantec Corporation)

PDF Settings CS5 (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden

Pdf995 (HKLM-x32\...\Pdf995) (Version: - )

PdfEdit995 (HKLM-x32\...\PdfEdit995) (Version: - )

Photomatix Pro version 4.1.3 (HKLM\...\PhotomatixPro41x64_is1) (Version: 4.1.3 - HDRsoft Sarl)

Photomatix Pro version 4.2.7 (HKLM\...\PhotomatixPro42x64_is1) (Version: 4.2.7 - HDRsoft Ltd)

Photomatix Pro version 5.0.5a (HKLM\...\PhotomatixPro5x64_is1) (Version: 5.0.5a - HDRsoft Ltd)

PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)

PlayReady PC Runtime x86 (HKLM-x32\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)

QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)

Realtek USB 2.0 Reader Driver (HKLM-x32\...\{62BBB2F0-E220-4821-A564-730807D2C34D}) (Version: 1.0.0.12 - Realtek Semiconductor Corp.)

Realtek WLAN Driver (HKLM-x32\...\{9D3D8C60-A55F-4fed-B2B9-173001290E16}) (Version: 2.00.0013 - REALTEK Semiconductor Corp.)

Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)

Signature995 (HKLM-x32\...\Signature995) (Version: - )

Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.4.0.9058 - Microsoft Corporation)

Skype Launcher (HKLM-x32\...\{DA84ECBF-4B79-47F2-B34C-95C38484C058}) (Version: 2.01 - TOSHIBA Corporation)

Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)

Smart Shooter 2 (HKLM-x32\...\SmartShooter) (Version: - Francis Hart)

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 19.0.10.0 - Synaptics Incorporated)

TomTom HOME (HKLM-x32\...\{0E09BE17-EDEA-42CA-8974-42A587F51510}) (Version: 2.9.8 - TomTom)

TomTom HOME (HKLM-x32\...\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}) (Version: 2.9.8 - TomTom)

TomTom HOME (HKLM-x32\...\{BB05590A-6602-43F3-A400-77EA0976BC0A}) (Version: 2.9.8 - TomTom)

TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)

Toshiba App Place (HKLM-x32\...\{ED3CBA78-488F-4E8C-B33F-8E3BF4DDB4D2}) (Version: 1.0.6.3 - Toshiba)

TOSHIBA Application Installer (HKLM-x32\...\{970472D0-F5F9-4158-A6E3-1AE49EFEF2D3}) (Version: 9.0.1.1 - TOSHIBA)

TOSHIBA Assist (HKLM-x32\...\{C2A276E3-154E-44DC-AAF1-FFDD7FD30E35}) (Version: 4.02.02 - TOSHIBA CORPORATION)

Toshiba Book Place (HKLM-x32\...\{92C7DC44-DAD3-49FE-B89B-F92C6BA9A331}) (Version: 2.2.6775 - K-NFB Reading Technology, Inc.)

TOSHIBA Bulletin Board (HKLM-x32\...\InstallShield_{C14518AF-1A0F-4D39-8011-69BAA01CD380}) (Version: 1.6.08.64 - TOSHIBA Corporation)

TOSHIBA Disc Creator (HKLM\...\{5DA0E02F-970B-424B-BF41-513A5018E4C0}) (Version: 2.1.0.6 for x64 - TOSHIBA Corporation)

TOSHIBA eco Utility (HKLM\...\{B3FF1CD9-B2F0-4D71-BB55-5F580401C48E}) (Version: 1.2.25.64 - TOSHIBA Corporation)

TOSHIBA Face Recognition (HKLM-x32\...\InstallShield_{F67FA545-D8E5-4209-86B1-AEE045D1003F}) (Version: 3.1.8.64 - TOSHIBA Corporation)

TOSHIBA Hardware Setup (HKLM-x32\...\InstallShield_{C4FFA951-9678-4D51-84B4-AFD15D3C45AD}) (Version: 4.08.06.00 - )

TOSHIBA HDD/SSD Alert (HKLM-x32\...\InstallShield_{D4322448-B6AF-4316-B859-D8A0E84DCB38}) (Version: 3.1.64.7 - TOSHIBA Corporation)

Toshiba Laptop Checkup (HKLM-x32\...\NortonPCCheckup) (Version: 2.0.10.26 - Symantec Corporation)

TOSHIBA Media Controller (HKLM-x32\...\{C7A4F26F-F9B0-41B2-8659-99181108CDE3}) (Version: 1.0.86.2 - TOSHIBA CORPORATION)

TOSHIBA Media Controller Plug-in (HKLM-x32\...\{F26FDF57-483E-42C8-A9C9-EEE1EDB256E0}) (Version: 1.0.6.1 - TOSHIBA CORPORATION)

Toshiba Online Backup (HKLM-x32\...\{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}) (Version: 2.0.0.25 - Toshiba)

TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.7.4.64 - TOSHIBA Corporation)

TOSHIBA Quality Application (HKLM-x32\...\{E69992ED-A7F6-406C-9280-1C156417BC49}) (Version: 1.0.3 - TOSHIBA)

TOSHIBA Recovery Media Creator (HKLM-x32\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.1.3.5109 - TOSHIBA CORPORATION)

TOSHIBA ReelTime (HKLM-x32\...\InstallShield_{24811C12-F4A9-4D0F-8494-A7B8FE46123C}) (Version: 1.7.17.64 - TOSHIBA Corporation)

TOSHIBA Resolution+ Plug-in for Windows Media Player (HKLM-x32\...\{6CB76C9D-80C2-4CB3-A4CD-D96B239E3F94}) (Version: 1.1.0 - TOSHIBA Corporation)

TOSHIBA Service Station (HKLM-x32\...\{AC6569FA-6919-442A-8552-073BE69E247A}) (Version: 2.2.9 - TOSHIBA)

TOSHIBA Sleep Utility (HKLM-x32\...\{654F7484-88C5-46DC-AB32-C66BCB0E2102}) (Version: 1.4.2.7 - TOSHIBA Corporation)

TOSHIBA Supervisor Password (HKLM-x32\...\InstallShield_{CBD6B23D-41D5-4A46-8019-6208516C9712}) (Version: 4.08.06.00 - )

TOSHIBA Value Added Package (HKLM-x32\...\InstallShield_{066CFFF8-12BF-4390-A673-75F95EFF188E}) (Version: 1.5.4.64 - TOSHIBA Corporation)

TOSHIBA Web Camera Application (HKLM-x32\...\InstallShield_{6F3C8901-EBD3-470D-87F8-AC210F6E5E02}) (Version: 2.0.0.19 - TOSHIBA Corporation)

TOSHIBA Wireless LAN Indicator (HKLM-x32\...\{CDADE9BC-612C-42B8-B929-5C6A823E7FF9}) (Version: 1.0.3 - TOSHIBA CORPORATION)

ToshibaRegistration (HKLM-x32\...\{5AF550B4-BB67-4E7E-82F1-2C4300279050}) (Version: 1.0.4 - Toshiba)

VFW_Codec32 (x32 Version: 0.1.160.0 - GoPro, Inc.) Hidden

VFW_Codec64 (Version: 0.1.160.0 - GoPro, Inc.) Hidden

VUDU To Go (HKLM-x32\...\com.vudu.air.Downloader) (Version: 2.1.4 - Vudu)

VUDU To Go (x32 Version: 2.1.4 - Vudu) Hidden

WD Drive Utilities (HKLM-x32\...\{E61CFDDA-40DD-4400-95CA-12819C50B5C2}) (Version: 1.1.0.51 - Western Digital Technologies, Inc.)

WD Quick View (HKLM-x32\...\{5B1CF5E0-D321-4766-AEF1-1E9D1C535A10}) (Version: 2.4.12.1 - Western Digital Technologies, Inc.)

WD Security (HKLM-x32\...\{2B58AB2C-D980-47FD-8633-E360314BA662}) (Version: 1.0.6.3 - Western Digital Technologies, Inc.)

WD SmartWare (HKLM\...\{02FD1EAD-43B8-4D63-AC31-8921005AF2E2}) (Version: 2.4.12.1 - Western Digital Technologies, Inc.)

WD SmartWare Installer (HKLM-x32\...\{979a4332-3eb0-4561-9f74-a4fb871cf2bd}) (Version: 2.4.12.1 - Western Digital Technologies, Inc.)

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)

Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Scott Duncan\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1_Classes\CLSID\{78550997-5DEF-4A8A-BAF9-D5774E87AC98}\InprocServer32 -> C:\Users\Scott Duncan\AppData\Local\Google\Update\1.3.28.13\psuser_64.dll => No File

CustomCLSID: HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1_Classes\CLSID\{D1EDC4F5-7F4D-4B12-906A-614ECF66DDAF}\InprocServer32 -> C:\Users\Scott Duncan\AppData\Local\Google\Update\1.3.28.15\psuser_64.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Scott Duncan\AppData\Local\Google\Update\1.3.28.15\psuser_64.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Scott Duncan\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Scott Duncan\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll => No File

CustomCLSID: HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Scott Duncan\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll => No File

CustomCLSID: HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Scott Duncan\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll => No File

CustomCLSID: HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Scott Duncan\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll => No File

CustomCLSID: HKU\S-1-5-21-2949255578-4130258502-838744892-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Scott Duncan\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2949255578-4130258502-838744892-1000_Classes\CLSID\{78550997-5DEF-4A8A-BAF9-D5774E87AC98}\InprocServer32 -> C:\Users\Scott Duncan\AppData\Local\Google\Update\1.3.28.13\psuser_64.dll => No File

CustomCLSID: HKU\S-1-5-21-2949255578-4130258502-838744892-1000_Classes\CLSID\{D1EDC4F5-7F4D-4B12-906A-614ECF66DDAF}\InprocServer32 -> C:\Users\Scott Duncan\AppData\Local\Google\Update\1.3.28.15\psuser_64.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-2949255578-4130258502-838744892-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Scott Duncan\AppData\Local\Google\Update\1.3.28.15\psuser_64.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-2949255578-4130258502-838744892-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Scott Duncan\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-2949255578-4130258502-838744892-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Scott Duncan\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll => No File

CustomCLSID: HKU\S-1-5-21-2949255578-4130258502-838744892-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Scott Duncan\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll => No File

CustomCLSID: HKU\S-1-5-21-2949255578-4130258502-838744892-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Scott Duncan\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll => No File

CustomCLSID: HKU\S-1-5-21-2949255578-4130258502-838744892-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Scott Duncan\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll => No File

==================== Restore Points =========================

23-09-2015 18:31:42 Windows Update

01-10-2015 20:57:29 Windows Update

11-10-2015 06:52:57 Scheduled Checkpoint

14-10-2015 16:52:50 Windows Update

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 22:34 - 2014-01-27 11:53 - 00000027 ____A C:\WINDOWS\system32\Drivers\etc\hosts

127.0.0.1 localhost

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0483FF19-B2AD-476B-8525-34BC69B43BA1} - System32\Tasks\HP AR Program Upload - ba7f4b44cf864f02826d6549b4e376f93e9981ed4b414698a43657c4252e3deb => C:\Program Files\HP\HP Officejet Pro 8600\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)

Task: {054C1A31-7954-4292-88DC-47ECB347A50E} - System32\Tasks\G2MUploadTask-S-1-5-21-2949255578-4130258502-838744892-1000 => C:\Users\Scott Duncan\AppData\Local\Citrix\GoToMeeting\3499\g2mupload.exe [2015-09-18] (Citrix Online, a division of Citrix Systems, Inc.)

Task: {0CD567AF-3A16-4035-94C5-D913899368E6} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2949255578-4130258502-838744892-1000Core => C:\Users\Scott Duncan\AppData\Local\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)

Task: {0FA766DD-932B-4084-A9FF-79AE4A44089D} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\Windows\ehome\mcupdate.exe

Task: {221DE1C1-46D7-4C8B-A009-40A3B2A682DF} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\Windows\ehome\ehPrivJob.exe

Task: {2B2234B1-38C4-45C1-89AF-F7830EF4C868} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\Windows\ehome\ehPrivJob.exe

Task: {2B694B51-ACCF-46BB-A171-B2196EB327CA} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-2949255578-4130258502-838744892-1000Core => C:\Users\Scott Duncan\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-18] (Dropbox, Inc.)

Task: {2F70EC75-51D6-438E-A0BE-EAE9C04234BE} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\Windows\ehome\ehPrivJob.exe

Task: {2F9EEE9D-35EC-49C7-A66A-6052F65BEB60} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\Windows\ehome\ehrec.exe

Task: {3089006A-9FDB-4777-A1F5-4DE44CA32C13} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\Windows\ehome\ehPrivJob.exe

Task: {30BF87B7-E8C9-41E4-BDFA-13ADAF78FA3D} - \Updater21802.exe -> No File <==== ATTENTION

Task: {34F8B800-EA5A-4106-A891-F7E1AF74CE77} - System32\Tasks\PC Checkup 3 Weekly Scan => C:\Program Files (x86)\PC Checkup\NLAppLauncher.exe [2013-12-26] (Symantec Corporation)

Task: {3DC7AD2C-5C3A-4B28-A174-782039D3EA85} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\Windows\ehome\ehPrivJob.exe

Task: {3EED82D1-9DE0-4542-8E06-FF238A2252F7} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe

Task: {41CFC2DB-B998-4ACE-9468-DAEEBE4112B4} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION

Task: {425BA744-0B9B-414A-92C2-0CB75E609EBC} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)

Task: {54355DBE-5A87-40A0-950F-153D81A5D352} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-10-14] (Adobe Systems Incorporated)

Task: {562C5573-3A7E-4970-9A2C-5E6A20832F20} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION

Task: {5B4DB815-858C-4A81-B7E9-9DBC54FE6EC8} - System32\Tasks\AdobeAAMUpdater-1.0-ScottDuncan-PC-Scott Duncan => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-03-06] (Adobe Systems Incorporated)

Task: {5CF0707E-4AEC-4245-A474-90276BDCEDBE} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {5E15C04F-8ACE-499C-80BB-3A915B0F2DAB} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\Windows\ehome\ehPrivJob.exe

Task: {6241290D-013A-4803-8DDE-B0442F8C74F0} - System32\Tasks\{3CA3C75F-24DE-4279-9001-CE5C4459001E} => C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE [2015-09-17] (Microsoft Corporation)

Task: {644B5C8C-238B-4997-B706-74A54C6D0EE6} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\22.5.4.24\SymErr.exe [2015-09-08] (Symantec Corporation)

Task: {654B0B50-030E-478D-8CBF-A854332258BD} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\Windows\ehome\ehPrivJob.exe

Task: {6885E303-EFC1-40B2-A204-B13E2FD573E3} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\Windows\ehome\MCUpdate.exe

Task: {74735A3C-3AE0-4297-B3BA-83712A6968D2} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\Windows\ehome\ehrec.exe

Task: {78DC1F46-38AD-496D-830A-0A35D382C696} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\Windows\ehome\ehPrivJob.exe

Task: {81B42098-D3C6-4B18-97EB-4DFE70BBFC34} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION

Task: {84DE06EF-DF18-4056-82B2-26EE54FD3E2E} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2949255578-4130258502-838744892-1000UA => C:\Users\Scott Duncan\AppData\Local\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)

Task: {8602EA65-3194-4492-AA3C-B891DE69B2BF} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\Windows\ehome\mcupdate.exe

Task: {8C18F494-17CA-4950-A9A0-9DDFB9186EBC} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\Windows\ehome\ehPrivJob.exe

Task: {8C71E3B5-F23A-4F19-A471-8BCBD42A02B6} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\Windows\ehome\mcupdate.exe

Task: {906454C7-40A1-496A-9967-A22BB51BB481} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\Windows\ehome\mcupdate.exe

Task: {A0FD47BD-9F4D-4943-8CB1-44F0D78E082B} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION

Task: {A35EE3A8-D4C7-4BC2-8DC3-47D7F18AB40C} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION

Task: {A4DAFE3D-2E85-4F1A-B354-9A793DB63613} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\Windows\ehome\ehPrivJob.exe

Task: {A7739C98-2912-4AE0-8EE2-9B073520C62F} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-09-14] (Adobe Systems Incorporated)

Task: {AB16D759-6017-4275-A742-12A26BF65B71} - System32\Tasks\G2MUpdateTask-S-1-5-21-2949255578-4130258502-838744892-1000 => C:\Users\Scott Duncan\AppData\Local\Citrix\GoToMeeting\3499\g2mupdate.exe [2015-09-18] (Citrix Online, a division of Citrix Systems, Inc.)

Task: {AE17005F-9E60-4C41-A422-1F1D2539F1F9} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\Windows\ehome\mcupdate.exe

Task: {B0BFA212-515E-4DCA-A472-5E49F98BC436} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION

Task: {B19B7A4D-2DA5-4D5D-BB1D-5144F7CA749F} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\22.5.4.24\SymErr.exe [2015-09-08] (Symantec Corporation)

Task: {B2F37559-8B00-4290-AA56-5DD5656D0DF2} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\Windows\ehome\ehPrivJob.exe

Task: {B31F7662-3303-4097-9352-47045A3522D4} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION

Task: {B497B746-4A69-43D3-8D4C-6C359B65F708} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-08-26] (Microsoft Corporation)

Task: {C05D3B8D-97CA-4B68-9757-328655E822DD} - System32\Tasks\HP AR Program Upload - 155fdf2358db467d981dad0c497fde19f643245d58da4a248b3636fb02dc4005 => C:\Program Files\HP\HP Officejet Pro 8600\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)

Task: {C3DAC4A5-6C14-4EB6-B392-BD959BF646DE} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\Windows\ehome\ehPrivJob.exe

Task: {C65880B9-9D7F-4217-9567-C57115503121} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION

Task: {CC17C9D3-0376-4A63-9347-C2637702B396} - System32\Tasks\Norton Internet Security\Norton Autofix => C:\Program Files (x86)\Norton Internet Security\Engine\22.5.4.24\SymErr.exe [2015-09-08] (Symantec Corporation)

Task: {CD5E3BFD-6C44-4E50-AD92-34CAF3CEC5DC} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\Windows\ehome\mcupdate.exe

Task: {D0EEC06C-A3AA-4441-9C25-70E99B4CF391} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe

Task: {DC287ACF-0D3A-4FB8-A01A-918CFF0C344E} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION

Task: {E39D2825-EB2A-470F-8854-01C36130F572} - System32\Tasks\DropboxUpdateTaskUserS-1-5-21-2949255578-4130258502-838744892-1000UA => C:\Users\Scott Duncan\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-18] (Dropbox, Inc.)

Task: {EB3595AC-9935-44DE-81DE-B12A79BAACCE} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-29] (Google Inc.)

Task: {EC7950D0-1475-487F-B5B3-46105AA07DDE} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\22.5.4.24\WSCStub.exe [2015-09-23] (Symantec Corporation)

Task: {F14280B9-5F3C-4F22-BCA9-DE02841F1917} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION

Task: {F4098BC1-256E-4683-B776-F935A8F26876} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\Windows\ehome\ehPrivJob.exe

Task: {F4852F45-E946-4F89-8819-E0F68C8962C7} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-2949255578-4130258502-838744892-1000Core.job => C:\Users\Scott Duncan\AppData\Local\Dropbox\Update\DropboxUpdate.exe

Task: C:\WINDOWS\Tasks\DropboxUpdateTaskUserS-1-5-21-2949255578-4130258502-838744892-1000UA.job => C:\Users\Scott Duncan\AppData\Local\Dropbox\Update\DropboxUpdate.exe

Task: C:\WINDOWS\Tasks\G2MUpdateTask-S-1-5-21-2949255578-4130258502-838744892-1000.job => C:\Users\Scott Duncan\AppData\Local\Citrix\GoToMeeting\3499\g2mupdate.exe

Task: C:\WINDOWS\Tasks\G2MUploadTask-S-1-5-21-2949255578-4130258502-838744892-1000.job => C:\Users\Scott Duncan\AppData\Local\Citrix\GoToMeeting\3499\g2mupload.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-2949255578-4130258502-838744892-1000Core.job => C:\Users\Scott Duncan\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-2949255578-4130258502-838744892-1000UA.job => C:\Users\Scott Duncan\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2015-07-30 02:30 - 2015-07-30 02:30 - 00032768 _____ () C:\WINDOWS\SYSTEM32\licensemanagerapi.dll

2011-11-19 13:54 - 2006-10-20 01:44 - 00047616 _____ () C:\WINDOWS\System32\pdf995mon64.dll

2015-08-19 06:50 - 2015-08-11 05:14 - 00404480 _____ () C:\WINDOWS\System32\diagtrack_wininternal.dll

2015-03-20 18:12 - 2015-03-20 18:12 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll

2015-05-15 16:26 - 2015-05-15 16:26 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll

2015-10-01 19:56 - 2015-09-17 02:48 - 02494712 _____ () C:\WINDOWS\system32\CoreUIComponents.dll

2015-10-01 19:56 - 2015-09-17 02:48 - 02494712 _____ () C:\WINDOWS\System32\CoreUIComponents.dll

2013-09-05 03:17 - 2013-09-05 03:17 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF

2010-10-20 18:23 - 2010-10-20 18:23 - 08801632 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll

2015-10-01 19:55 - 2015-09-17 01:48 - 00429056 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll

2015-10-01 19:56 - 2015-09-17 01:44 - 06569472 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll

2015-10-01 19:55 - 2015-09-17 01:42 - 00471040 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll

2015-10-01 19:55 - 2015-09-17 01:42 - 01808384 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll

2015-10-01 19:56 - 2015-09-17 01:43 - 02274816 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll

2015-06-01 21:00 - 2015-06-01 21:00 - 00102912 _____ () C:\Windows\System32\IccLibDll_x64.dll

2010-11-18 20:18 - 2010-11-18 20:18 - 11190784 _____ () C:\Program Files\Toshiba\FlashCards\BlackPng.dll

2010-12-15 18:19 - 2010-12-15 18:19 - 00124320 _____ () C:\Program Files\Toshiba\TECO\MUIHelp.dll

2010-12-08 18:42 - 2010-12-08 18:42 - 00079264 _____ () C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll

2013-09-05 03:14 - 2013-09-05 03:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF

2010-10-20 18:45 - 2010-10-20 18:45 - 08801120 _____ () C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll

2015-08-13 16:33 - 2015-08-13 16:33 - 00117248 _____ () C:\Users\Scott Duncan\AppData\Local\Programs\Google\MusicManager\libaacdec.dll

2015-08-13 16:34 - 2015-08-13 16:34 - 00234496 _____ () C:\Users\Scott Duncan\AppData\Local\Programs\Google\MusicManager\libmpgdec.dll

2015-08-13 16:34 - 2015-08-13 16:34 - 00253440 _____ () C:\Users\Scott Duncan\AppData\Local\Programs\Google\MusicManager\libid3tag.dll

2015-08-13 16:33 - 2015-08-13 16:33 - 00344064 _____ () C:\Users\Scott Duncan\AppData\Local\Programs\Google\MusicManager\libaudioenc.dll

2015-10-02 06:08 - 2015-10-01 19:07 - 00166416 _____ () C:\Users\Scott Duncan\AppData\Roaming\Dropbox\bin\EnterpriseDataAdapter.dll

2015-10-16 05:59 - 2015-10-16 05:59 - 00071168 _____ () c:\Users\Scott Duncan\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp4ntzip.dll

2015-10-02 06:08 - 2015-09-23 19:07 - 00012800 _____ () C:\Users\Scott Duncan\AppData\Roaming\Dropbox\bin\QtQuick.2\qtquick2plugin.dll

2015-07-30 19:52 - 2015-09-23 19:07 - 00779776 _____ () C:\Users\Scott Duncan\AppData\Roaming\Dropbox\bin\QtQuick\Controls\qtquickcontrolsplugin.dll

2015-10-02 06:08 - 2015-09-23 19:07 - 00056320 _____ () C:\Users\Scott Duncan\AppData\Roaming\Dropbox\bin\QtQuick\Layouts\qquicklayoutsplugin.dll

2015-10-02 06:08 - 2015-09-23 19:07 - 00012288 _____ () C:\Users\Scott Duncan\AppData\Roaming\Dropbox\bin\QtQuick\Window.2\windowplugin.dll

2015-10-16 05:58 - 2015-10-16 05:58 - 00098816 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\win32api.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 00110080 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\pywintypes27.dll

2015-10-16 05:58 - 2015-10-16 05:58 - 00364544 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\pythoncom27.dll

2015-10-16 05:58 - 2015-10-16 05:58 - 00046080 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\_socket.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 01208320 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\_ssl.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 00320512 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\win32com.shell.shell.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 00776704 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\_hashlib.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 01176576 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\wx._core_.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 00806400 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\wx._gdi_.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 00816128 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\wx._windows_.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 01067008 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\wx._controls_.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 00733184 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\wx._misc_.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 00682496 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\pysqlite2._sqlite.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 00088064 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\_ctypes.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 00119808 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\win32file.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 00108544 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\win32security.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 00007168 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\hashobjs_ext.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 00070144 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\usb_ext.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 00167936 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\win32gui.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 00018432 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\win32event.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 00128512 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\_elementtree.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 00127488 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\pyexpat.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 00013824 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\common.time34.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 00036864 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\_psutil_windows.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 00038912 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\win32inet.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 00011264 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\win32crypt.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 00077312 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\wx._html2.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 00027136 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\_multiprocessing.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 00020480 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\_yappi.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 00035840 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\win32process.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 00686080 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\unicodedata.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 00123392 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\wx._wizard.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 00024064 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\win32pipe.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 00010240 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\select.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 00025600 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\win32pdh.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 00525640 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\windows._lib_cacheinvalidation.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 00017408 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\win32profile.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 00022528 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\win32ts.pyd

2015-10-16 05:58 - 2015-10-16 05:58 - 00078848 _____ () C:\Users\Scott Duncan\AppData\Local\Temp\_MEI50642\wx._animate.pyd

2015-07-02 23:31 - 2015-07-02 23:31 - 02287616 _____ () C:\Program Files (x86)\GoPro\Tools\Importer\gopro-lib-win-analytics.dll

2015-10-15 18:51 - 2015-10-08 20:53 - 01532744 _____ () C:\Program Files (x86)\Google\Chrome\Application\46.0.2490.71\libglesv2.dll

2015-10-15 18:51 - 2015-10-08 20:53 - 00081224 _____ () C:\Program Files (x86)\Google\Chrome\Application\46.0.2490.71\libegl.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2949255578-4130258502-838744892-1000\Control Panel\Desktop\\Wallpaper ->

HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper ->

HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\Control Panel\Desktop\\Wallpaper ->

HKU\S-1-5-21-2949255578-4130258502-838744892-1003\Control Panel\Desktop\\Wallpaper ->

HKU\S-1-5-21-2949255578-4130258502-838744892-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Control Panel\Desktop\\Wallpaper ->

HKU\S-1-5-21-2949255578-4130258502-838744892-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\Control Panel\Desktop\\Wallpaper ->

DNS Servers: 75.75.75.75 - 75.75.76.76

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run: => "SmartAudio"

HKLM\...\StartupApproved\Run32: => "APSDaemon"

HKLM\...\StartupApproved\Run32: => "ConnectionCenter"

HKLM\...\StartupApproved\Run32: => "ToshibaAppPlace"

HKLM\...\StartupApproved\Run32: => "WD Drive Unlocker"

HKLM\...\StartupApproved\Run32: => "DriveUtilitiesHelper"

HKU\S-1-5-21-2949255578-4130258502-838744892-1000\...\StartupApproved\Run: => "swg"

HKU\S-1-5-21-2949255578-4130258502-838744892-1000\...\StartupApproved\Run: => "HP Officejet Pro 8600 (NET)"

HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\StartupApproved\Run: => "swg"

HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\StartupApproved\Run: => "HP Officejet Pro 8600 (NET)"

HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\StartupApproved\Run: => "swg"

HKU\S-1-5-21-2949255578-4130258502-838744892-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\StartupApproved\Run: => "HP Officejet Pro 8600 (NET)"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139

FirewallRules: [MSMQ-In-TCP] => (Allow) %systemroot%\system32\mqsvc.exe

FirewallRules: [MSMQ-Out-TCP] => (Allow) %systemroot%\system32\mqsvc.exe

FirewallRules: [MSMQ-In-UDP] => (Allow) %systemroot%\system32\mqsvc.exe

FirewallRules: [MSMQ-Out-UDP] => (Allow) %systemroot%\system32\mqsvc.exe

FirewallRules: [WCF-NetTcpActivator-In-TCP-64bit] => (Allow) LPort=808

FirewallRules: [{4D94891D-F260-4C9C-91B6-29FF4B55A0EC}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{1833D2E8-E24B-4278-890E-D1A9180D486B}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [uDP Query User{57F66207-EA34-4913-A6BE-E9B75E41D2B0}C:\users\scott duncan\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\scott duncan\appdata\roaming\dropbox\bin\dropbox.exe

FirewallRules: [TCP Query User{23931166-4D36-48BC-9199-798382278800}C:\users\scott duncan\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\scott duncan\appdata\roaming\dropbox\bin\dropbox.exe

FirewallRules: [{E246CE8E-920F-4E72-A1E7-240BEE1219EC}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicatorCom.exe

FirewallRules: [{C4AF8B51-1EB2-439C-BBFD-10AA1E0ACBA8}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\Bin\HPNetworkCommunicator.exe

FirewallRules: [{705C0DE3-D3D6-4AD8-B15E-E3392EC208AB}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\Bin\DeviceSetup.exe

FirewallRules: [{DD2FDBC8-0511-44C7-B2F1-163F35AF16D3}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\bin\SendAFax.exe

FirewallRules: [{29098152-73DB-43A4-A44C-C02DEC6C31EB}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\bin\DigitalWizards.exe

FirewallRules: [{DBBA03FB-36E9-47A9-B0CE-5988317B738B}] => (Allow) C:\Program Files\HP\HP Officejet Pro 8600\bin\FaxApplications.exe

FirewallRules: [{4118A393-8F91-4B8E-9A37-DD54F5D3D092}] => (Allow) C:\Users\Scott Duncan\AppData\Roaming\Dropbox\bin\Dropbox.exe

FirewallRules: [{D4CECE6B-E86B-4B51-B0F2-CA59D1842B0A}] => (Allow) C:\Users\Scott Duncan\AppData\Roaming\Dropbox\bin\Dropbox.exe

FirewallRules: [{736A76F9-62CC-4CB3-AE5E-A3AA8ED0A535}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe

FirewallRules: [{5D281E46-50F4-482B-9E77-2F8F952F4CEE}] => (Allow) LPort=50000

FirewallRules: [{CD4BCF82-A317-4B36-9DF3-051D03922F00}] => (Allow) LPort=50000

FirewallRules: [uDP Query User{AD59F720-6010-4F14-B695-921B0C41299B}C:\program files (x86)\ibm\lotus\notes\framework\rcp\eclipse\plugins\com.ibm.rcp.base_6.2.0.200811140851\win32\x86\notes2.exe] => (Allow) C:\program files (x86)\ibm\lotus\notes\framework\rcp\eclipse\plugins\com.ibm.rcp.base_6.2.0.200811140851\win32\x86\notes2.exe

FirewallRules: [TCP Query User{F7F07284-B9A0-4FB6-A79A-8E6BCB836595}C:\program files (x86)\ibm\lotus\notes\framework\rcp\eclipse\plugins\com.ibm.rcp.base_6.2.0.200811140851\win32\x86\notes2.exe] => (Allow) C:\program files (x86)\ibm\lotus\notes\framework\rcp\eclipse\plugins\com.ibm.rcp.base_6.2.0.200811140851\win32\x86\notes2.exe

FirewallRules: [{05AF47DD-A232-4758-94F6-295340D3CF35}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{AF2E67E9-B43B-47D0-AE76-A9E4E4D0A707}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{B47D52ED-50AA-4E32-95C3-59F44911FA68}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{4695E2D0-1403-40C1-B7AD-333273AC312F}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{5ED5DD6E-4F49-4442-93C2-9FDB9AE71E8B}] => (Allow) C:\Program Files (x86)\Windows Live\Mesh\MOE.exe

FirewallRules: [{A8EC1910-CF30-4EE4-A9A4-22F93B4903E3}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe

FirewallRules: [{778199AE-F46F-4BE0-97E3-EB208E775586}] => (Allow) LPort=1900

FirewallRules: [{B52BD2BA-E574-4945-B387-47D4491A84CD}] => (Allow) LPort=2869

FirewallRules: [{F0971B9B-6C0D-48DC-9395-6A433215CD4E}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

FirewallRules: [{7B4DF43E-1B44-402F-B58B-27D838C965A1}] => (Allow) C:\Program Files\iTunes\iTunes.exe

FirewallRules: [{2E2D7BAC-F64F-4BD8-9FCB-5223A0912CD2}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:

==================

Error: (10/16/2015 05:57:05 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 25500766

Error: (10/16/2015 05:57:05 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 25500766

Error: (10/16/2015 05:57:05 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second

Error: (10/15/2015 09:35:09 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 14589406

Error: (10/15/2015 09:35:09 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 14589406

Error: (10/15/2015 09:35:09 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second

Error: (10/15/2015 09:35:08 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 14587953

Error: (10/15/2015 09:35:08 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 14587953

Error: (10/15/2015 09:35:08 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second

Error: (10/15/2015 09:35:06 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 14586094

System errors:

=============

Error: (10/16/2015 06:00:39 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The Software Protection service failed to start due to the following error:

%%1053

Error: (10/16/2015 06:00:39 AM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: A timeout was reached (30000 milliseconds) while waiting for the Software Protection service to connect.

Error: (10/16/2015 05:59:32 AM) (Source: DCOM) (EventID: 10016) (User: ScottDuncan-PC)

Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}ScottDuncan-PCScott DuncanS-1-5-21-2949255578-4130258502-838744892-1000LocalHost (Using LRPC)Microsoft.Windows.Cortana_1.4.8.176_neutral_neutral_cw5n1h2txyewyS-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742

Error: (10/16/2015 05:59:32 AM) (Source: DCOM) (EventID: 10016) (User: ScottDuncan-PC)

Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}ScottDuncan-PCScott DuncanS-1-5-21-2949255578-4130258502-838744892-1000LocalHost (Using LRPC)Microsoft.Windows.Cortana_1.4.8.176_neutral_neutral_cw5n1h2txyewyS-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742

Error: (10/16/2015 05:59:32 AM) (Source: DCOM) (EventID: 10016) (User: ScottDuncan-PC)

Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}ScottDuncan-PCScott DuncanS-1-5-21-2949255578-4130258502-838744892-1000LocalHost (Using LRPC)Microsoft.Windows.Cortana_1.4.8.176_neutral_neutral_cw5n1h2txyewyS-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742

Error: (10/16/2015 05:59:32 AM) (Source: DCOM) (EventID: 10016) (User: ScottDuncan-PC)

Description: machine-defaultLocalActivation{C2F03A33-21F5-47FA-B4BB-156362A2F239}{316CDED5-E4AE-4B15-9113-7055D84DCC97}ScottDuncan-PCScott DuncanS-1-5-21-2949255578-4130258502-838744892-1000LocalHost (Using LRPC)Microsoft.Windows.Cortana_1.4.8.176_neutral_neutral_cw5n1h2txyewyS-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742

Error: (10/15/2015 10:51:57 PM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The Sync Host_Session10 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.

Error: (10/15/2015 06:38:36 AM) (Source: DCOM) (EventID: 10010) (User: ScottDuncan-PC)

Description: CortanaUI.AppXd4tad4d57t4wtdbnnmb8v2xtzym8c1n8.mca

Error: (10/15/2015 06:38:35 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: The Sync Host_Session9 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.

Error: (10/15/2015 06:04:21 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: The Software Protection service failed to start due to the following error:

%%1053

CodeIntegrity:

===================================

Date: 2015-10-16 06:34:37.687

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\Citrix\system32\CtxSbxHook64.DLL because the set of per-page image hashes could not be found on the system.

Date: 2015-10-16 06:34:37.681

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\Citrix\system32\radeaphook64.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-10-16 06:21:57.718

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\Citrix\system32\CtxSbxHook64.DLL because the set of per-page image hashes could not be found on the system.

Date: 2015-10-16 06:21:57.714

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\Citrix\system32\radeaphook64.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-10-16 06:01:51.152

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\Citrix\system32\radeaphook64.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-10-15 22:35:42.445

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\Citrix\system32\CtxSbxHook64.DLL because the set of per-page image hashes could not be found on the system.

Date: 2015-10-15 22:35:42.435

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\Citrix\system32\radeaphook64.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-10-15 22:15:49.631

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\Citrix\system32\CtxSbxHook64.DLL because the set of per-page image hashes could not be found on the system.

Date: 2015-10-15 22:15:49.623

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\Citrix\system32\radeaphook64.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-10-15 19:35:52.033

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\Citrix\system32\CtxSbxHook64.DLL because the set of per-page image hashes could not be found on the system.

==================== Memory info ===========================

Processor: Intel® Pentium® CPU B940 @ 2.00GHz

Percentage of memory in use: 55%

Total physical RAM: 6091.86 MB

Available physical RAM: 2687.79 MB

Total Virtual: 12235.86 MB

Available Virtual: 8371.61 MB

==================== Drives ================================

Drive c: (TI106139W0E) (Fixed) (Total:449.79 GB) (Free:293.74 GB) NTFS ==>[system with boot components (obtained from drive)]

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 465.8 GB) (Disk ID: 4E59E2AF)

Partition 1: (Active) - (Size=1.5 GB) - (Type=27)

Partition 2: (Not Active) - (Size=449.8 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=792 MB) - (Type=27)

Partition 4: (Not Active) - (Size=13.7 GB) - (Type=17)

==================== End of Addition.txt ============================

TwinHeadedEagle · October 16, 2015

Do not paste the logs in your posts, attachments make my work easier. There is a More reply options button, that gives you Upload Files option below which you can use to attach your reports. Always attach reports from all tools.

RSD · October 16, 2015

Sorry, I had done that in the past. My bad.

Scott

FRST.txt

Addition.txt

TwinHeadedEagle · October 16, 2015

remove%20outdated.jpg Uninstall some programs

We need to uninstall some unwanted/unneeded programs.

Press the + R on your keyboard at the same time. Type appwiz.cpl and click OK.
Search there for each entry mentioned below, right-click the entry and click Uninstall one at a time

The list of programs to uninstall:

FileOpener Packages

After completing uninstalls, please manually reboot your machine!

Note: If you get the message like: An error occurred while trying to uninstall, just press Yes.

Note: If you are unable to uninstall all programs, please inform me, but continue with other steps.

Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

createsrpoint;autoclean;emptyclsid;emptyalltemp;ipconfig /flushdns >>"%temp%\log.txt";b

Right-click on icon and select Run as Administrator to start the tool.
Wait patiently until the main console will appear, it may take a minute or two.
In the main box please paste in the following script:
Make sure that Scan All Users option is checked.
Push Run Script and wait patiently. The scan may take a couple of minutes.
When the scan completes, a zoek-results logfile should open in notepad.
If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

RSD · October 17, 2015

Zoek.exe v5.0.0.1 Updated 15-October-2015

Tool run by Scott Duncan on Fri 10/16/2015 at 20:11:14.76.

Microsoft Windows 10 Home 10.0.10240 x64

Running in: Normal Mode Internet Access Detected

Launched: C:\Users\Scott Duncan\Downloads\zoek.exe [scan all users] [script inserted]

==== System Restore Info ======================

10/16/2015 8:15:15 PM Zoek.exe System Restore Point Created Successfully.

==== Empty Folders Check ======================

C:\PROGRA~2\Aimersoft deleted successfully

C:\PROGRA~2\GUM12FA.tmp deleted successfully

C:\PROGRA~2\GUM2CEF.tmp deleted successfully

C:\PROGRA~2\GUM7104.tmp deleted successfully

C:\PROGRA~2\GUM7CCE.tmp deleted successfully

C:\PROGRA~2\GUM8574.tmp deleted successfully

C:\PROGRA~2\GUM8CC.tmp deleted successfully

C:\PROGRA~2\GUMA71.tmp deleted successfully

C:\PROGRA~2\GUMAB7B.tmp deleted successfully

C:\PROGRA~2\GUMB27.tmp deleted successfully

C:\PROGRA~2\GUMCBA8.tmp deleted successfully

C:\PROGRA~2\ProDigital Software deleted successfully

C:\Program Files\ProDigital Software deleted successfully

C:\Program Files\Symantec deleted successfully

C:\PROGRA~3\Comms deleted successfully

C:\PROGRA~3\Malwarebytes' Anti-Malware (portable) deleted successfully

C:\PROGRA~3\Oracle deleted successfully

C:\PROGRA~3\SoftwareDistribution deleted successfully

C:\Users\Ctx_StreamingSvc\AppData\LocalLow deleted successfully

C:\Users\DefaultAppPool\AppData\LocalLow deleted successfully

C:\WINDOWS\serviceprofiles\networkservice\AppData\LocalLow deleted successfully

C:\Users\Scott Duncan\AppData\Local\EmieBrowserModeList deleted successfully

C:\Users\Scott Duncan\AppData\Local\EmieSiteList deleted successfully

C:\Users\Scott Duncan\AppData\Local\EmieUserList deleted successfully

C:\Users\Scott Duncan\AppData\Local\NetworkTiles deleted successfully

C:\WINDOWS\serviceprofiles\Localservice\AppData\Local\NetworkTiles deleted successfully

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-2949255578-4130258502-838744892-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6} deleted successfully

==== Deleting CLSID Registry Values ======================

==== Deleting Services ======================

==== Batch Command(s) Run By Tool======================

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

==== Deleting Files \ Folders ======================

C:\PROGRA~2\Aimersoft not found

C:\PROGRA~2\GUM12FA.tmp not found

C:\PROGRA~2\GUM2CEF.tmp not found

C:\PROGRA~2\GUM7104.tmp not found

C:\PROGRA~2\GUM7CCE.tmp not found

C:\PROGRA~2\GUM8574.tmp not found

C:\PROGRA~2\GUM8CC.tmp not found

C:\PROGRA~2\GUMA71.tmp not found

C:\PROGRA~2\GUMAB7B.tmp not found

C:\PROGRA~2\GUMB27.tmp not found

C:\PROGRA~2\GUMCBA8.tmp not found

C:\PROGRA~2\ProDigital Software not found

C:\PROGRA~3\Malwarebytes' Anti-Malware (portable) not found

C:\Users\Scott Duncan\AppData\Roaming\Smart Shooter deleted

C:\PROGRA~2\GUM46F1.tmp deleted

C:\found.000 deleted

C:\PROGRA~3\{93E26451-CD9A-43A5-A2FA-C42392EA4001} deleted

C:\PROGRA~3\Package Cache deleted

C:\Users\Scott Duncan\AppData\Local\Software deleted

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Toshiba Laptop Checkup deleted

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk deleted

"C:\WINDOWS\Syswow64\Windows.Devices.Midi.dll" not deleted

"C:\WINDOWS\Syswow64\Windows.Devices.WiFi.dll" not deleted

"C:\WINDOWS\Syswow64\Windows.Gaming.Input.dll" not deleted

"C:\WINDOWS\Syswow64\Windows.Media.FaceAnalysis.dll" not deleted

"C:\WINDOWS\Syswow64\Windows.Media.Import.dll" not deleted

"C:\WINDOWS\Syswow64\Windows.Media.MediaControl.dll" not deleted

"C:\WINDOWS\Syswow64\Windows.Media.Speech.dll" not deleted

"C:\WINDOWS\Syswow64\Windows.Media.Speech.UXRes.dll" not deleted

"C:\WINDOWS\Syswow64\Windows.Media.Streaming.ps.dll" not deleted

"C:\WINDOWS\Syswow64\Windows.Networking.Connectivity.dll" not deleted

"C:\WINDOWS\Syswow64\Windows.UI.Immersive.dll" not deleted

"C:\WINDOWS\Syswow64\Windows.UI.Input.Inking.dll" not deleted

"C:\WINDOWS\Syswow64\Windows.UI.Xaml.Maps.dll" not deleted

"C:\Users\Scott Duncan\AppData\Roaming\webex" deleted

"C:\Users\Scott Duncan\AppData\Roaming\smkits" deleted

==== Firefox Start and Search pages ======================

ProfilePath: C:\Users\SCOTTD~1\AppData\Roaming\Mozilla\Firefox\Profiles\y52dp84x.default-1399684827563

user_pref("browser.startup.homepage", "www.google.com");

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]

"{EBA722F5-038F-4CAF-9EE2-545A221628BC}"="C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_22.5.2.15\coFFPlgn" [10/16/2015 07:32 PM]

==== Firefox Extensions ======================

ProfilePath: C:\Users\SCOTTD~1\AppData\Roaming\Mozilla\Firefox\Profiles\y52dp84x.default-1399684827563

- LastPass - C:\Users\Scott Duncan\AppData\Roaming\Mozilla\Firefox\Profiles\y52dp84x.default-1399684827563\extensions\support@lastpass.com

- LastPass - %ProfilePath%\extensions\support@lastpass.com

ProfilePath: C:\Users\SCOTTD~1\AppData\Roaming\TomTom\HOME\Profiles\4fhhmaa3.default

- Map status indicator - C:\Program Files (x86)\TomTom HOME 2\xul\extensions\MapShare-status@tomtom.com

- TomTom HOME default theme - C:\Program Files (x86)\TomTom HOME 2\xul\extensions\baseTheme@tomtom.com

AppDir: C:\Program Files (x86)\Mozilla Firefox

- Skype Click to Call - %AppDir%\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

- Java Console - %AppDir%\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}

- Java Console - %AppDir%\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}

- Skype Click to Call - %AppDir%\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

- Skype Click to Call - %AppDir%\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi

==== Firefox Plugins ======================

Profilepath: C:\Users\Scott Duncan\AppData\Roaming\Mozilla\Firefox\Profiles\y52dp84x.default-1399684827563

7D127425BBE91DF37448A7F44C1DDA52 - C:\Users\Scott Duncan\AppData\Local\Google\Update\1.3.28.15\npGoogleUpdate3.dll - Google Update

E3B4EA121F7BDEB0F6366E2BA9608CB5 - C:\Users\Scott Duncan\AppData\Local\Citrix\Plugins\104\npappdetector.dll - Citrix Online Web Deployment Plugin 1.0.0.104

7DA18C02BD866A2D99533912DE0E3FDB - C:\Users\Scott Duncan\AppData\Roaming\Mozilla\plugins\npatgpc.dll - ActiveTouch General Plugin Container

==== Chromium Look ======================

Google Chrome Version: 46.0.2490.71

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions

cjabmdjcfcfdmffimndhafhblfmpjdpe - C:\Program Files (x86)\Norton Internet Security\Engine\22.5.4.24\Exts\Chrome.crx[09/23/2015 02:44 AM]

iikflkcanblccfahdhdonehdalibjnif - No path found[]

lifbcibllhkdhoafpjfnlhfpfgnpldfl - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx[10/12/2015 09:31 AM]

HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions

lmjegmlicamnimmfhcmpkclmigmmcbeh - No path found[]

Norton Security Toolbar - Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjabmdjcfcfdmffimndhafhblfmpjdpe

Logitech Smooth Scrolling - Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Extensions\dkpejdfnpdkhifgbancbammdijojoffk

LastPass - Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd

BBC Good Food - Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Extensions\jnkffnoliaheoidfeejcmnidkkgilkja

Mafia Wars Addon - Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Extensions\llfmkjppmncfcgdebajkjnopgodlcaoe

Google Drive App Launcher - Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh

Watch with MPV - Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdbllodbagceopopjfeohndifhjjkemc

==== Chromium Fix ======================

C:\Users\Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.azlyrics.com_0.localstorage deleted successfully

C:\Users\Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.azlyrics.com_0.localstorage-journal deleted successfully

C:\Users\Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.olark.com_0.localstorage deleted successfully

C:\Users\Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.olark.com_0.localstorage-journal deleted successfully

C:\Users\Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_c.betrad.com_0.localstorage deleted successfully

C:\Users\Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_c.betrad.com_0.localstorage-journal deleted successfully

C:\Users\Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_c.betrad.com_0.localstorage deleted successfully

C:\Users\Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_c.betrad.com_0.localstorage-journal deleted successfully

C:\Users\Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_partner.support.services.microsoft.com_0.localstorage deleted successfully

C:\Users\Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_partner.support.services.microsoft.com_0.localstorage-journal deleted successfully

C:\Users\Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.citysearch.com_0.localstorage deleted successfully

C:\Users\Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.citysearch.com_0.localstorage-journal deleted successfully

==== Set IE to Default ======================

Old Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="http://start.toshiba.com/"

New Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="http://start.toshiba.com/"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes

"DefaultScope"="{7ADFDB83-92F4-47BB-84C8-1EE956ABCBAD}"

{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"

{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02"

{67A2568C-7A0A-4EED-AECC-B5405DE63B64} Google Url="http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNP"

{7ADFDB83-92F4-47BB-84C8-1EE956ABCBAD} (www.google.com) Google Url="https://www.google.com/search?q={searchTerms}"

{B372E8AC-5789-48CE-83A5-5EF1EEB72CDB} Google Url="http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNF_enUS456"

{CD0DBE38-5D83-4061-BA5C-C1A7017210EA} Unknown Url="Not_Found"

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\{CD0DBE38-5D83-4061-BA5C-C1A7017210EA} deleted successfully

HKEY_USERS\S-1-5-21-2949255578-4130258502-838744892-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{CD0DBE38-5D83-4061-BA5C-C1A7017210EA} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{CD0DBE38-5D83-4061-BA5C-C1A7017210EA} deleted successfully

==== Deleting CLSID Registry Values ======================

==== Empty IE Cache ======================

C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\Scott Duncan\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully

C:\Users\Scott Duncan\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 emptied successfully

C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully

C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully

C:\WINDOWS\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully

C:\Users\Scott Duncan\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully

C:\Users\Scott Duncan\AppData\Local\Microsoft\Windows\INetCache\Low\IE emptied successfully

C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully

C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully

==== Empty FireFox Cache ======================

C:\Users\Scott Duncan\AppData\Local\Mozilla\Firefox\Profiles\y52dp84x.default-1399684827563\cache2 emptied successfully

==== Empty Chrome Cache ======================

C:\Users\Scott Duncan\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

No Flash Cache Found

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=171 folders=42 442602107 bytes)

==== Empty Temp Folders ======================

C:\WINDOWS\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\WINDOWS\Temp successfully emptied

C:\Users\SCOTTD~1\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\WINDOWS\Syswow64\Windows.Devices.Midi.dll" not deleted

"C:\WINDOWS\Syswow64\Windows.Devices.WiFi.dll" not deleted

"C:\WINDOWS\Syswow64\Windows.Gaming.Input.dll" not deleted

"C:\WINDOWS\Syswow64\Windows.Media.FaceAnalysis.dll" not deleted

"C:\WINDOWS\Syswow64\Windows.Media.Import.dll" not deleted

"C:\WINDOWS\Syswow64\Windows.Media.MediaControl.dll" not deleted

"C:\WINDOWS\Syswow64\Windows.Media.Speech.dll" not deleted

"C:\WINDOWS\Syswow64\Windows.Media.Speech.UXRes.dll" not deleted

"C:\WINDOWS\Syswow64\Windows.Media.Streaming.ps.dll" not deleted

"C:\WINDOWS\Syswow64\Windows.Networking.Connectivity.dll" not deleted

"C:\WINDOWS\Syswow64\Windows.UI.Immersive.dll" not deleted

"C:\WINDOWS\Syswow64\Windows.UI.Input.Inking.dll" not deleted

"C:\WINDOWS\Syswow64\Windows.UI.Xaml.Maps.dll" not deleted

==== EOF on Fri 10/16/2015 at 21:10:33.84 ======================

RSD · October 17, 2015

Sorry, forgot.

zoek-results.txt

TwinHeadedEagle · October 17, 2015

Good. How is your PC behaving now?

RSD · October 17, 2015

Seems to be fine, kind of. I've been on it only an hour or so and haven't seen the n1.smartyads Malwarebytes popup.

I am seeing a "Watch with MPV" extension removal while using Google Chrome. Is that possibly a separate issue? If so is there a quick fix regarding malware or something completely different?

Thank for your help.

TwinHeadedEagle · October 18, 2015

Yes, you can remove this extension manually.

RSD · October 18, 2015

I've looked into it, but seems the extension is a Firefox extension that tries to load/install on Google Chrome. Just not sure how to stop the pop up from happening. It doesn't seem to be changing the laptops performance, just an annoying pop up is all I'm noticing.

Hey, thanks for your help removing n1.smartyads. Seems to be gone, but then again I haven't been on much and it was always popping up randomly. We'll see though.

TwinHeadedEagle · October 19, 2015

Okay, let me know if you need more help.

RSD · October 19, 2015

Will do. Thanks!

RSD · October 20, 2015

Just got the n1.smartyads pop up off of B&H Photo's website. What next? Shoot, thought we had it.

TwinHeadedEagle · October 20, 2015

Please re-run 51a46ae42d560-malwarebytes_anti_malware. Malwarebytes' Anti-Malware.

Click the History tab.
Click Application Logs and click on the newest Protection Log.
At the bottom click Export and choose Text file.

Save the file to your desktop and attach it in your next reply.

RSD · October 21, 2015

Hope I got this correct. Let me know. Thank you!

MWB Protection Text File.txt

TwinHeadedEagle · October 21, 2015

Let's reinstall Google Chrome:

Uninstall Chrome

Export your bookmarks

https://support.google.com/chrome/answer/96816?hl=en

Close all Chrome windows and tabs.

Go to the Start menu > Control Panel.

Click Programs and Features.

Double-click Google Chrome.

Click Uninstall from the confirmation dialog. Delete your user profile information, like your browser preferences, bookmarks, and history, select the "Also delete your browsing data" checkbox.

Click Start, copy in search %LOCALAPPDATA%\ and remove folder Google

Download Chrome

https://www.google.com/intl/en/chrome/browser/desktop/

RSD · October 21, 2015

I'm using Windows 10, so I went to Start, Settings, System, Apps & Features, typed in Google and unistalled. Is that correct?

Then, with Windows 10 I no longer have a box to type in when I click start. Do I go to file manager to remove the folder? I was never offered to click or remover browser history, bookmarks, preferences. Not sure where to type in %LOCALAPPDATA%\

RSD · October 21, 2015

Ok, I found the seach. Sorry about that. I type in and see results in listed. It goes in alphabetical order, but won't let me scroll down to the google file. When I click on the to result it opens windows files explorer. (not sure I'm calling that correct) and I see the google file. I right click on it, select delete and it goes acts like it's going to delete. "are your sure?" all that business. Then, says it can't because the file is open in another program. I've shut down, rebooted, etc, but keep getting the same thing. Can't delete. What am I missing?

RSD · October 21, 2015

Does it have something to do with Google Drive or Docs?

RSD · October 22, 2015

Well, I'm really confused now. Since I didn't have Chrome, I moved over to Firefox which had some of the same favorite bookmarks. The n1.smartyads Malewarebytes warning popped up again. Does this tell you that it's in my favorites on both Chrome and Firefox or has been cross contaminated or whatever?

Still can't get the Chrome folder removed and Firefox is now popping up with the Malewarebyes warning. That's where we're at.

Thanks!

TwinHeadedEagle · October 22, 2015

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

Right-click on icon and select Run as Administrator to start the tool.
(XP users click run after receipt of Windows Security Warning - Open File).
Make sure that Addition and Shortcut.txt options are checked.
Press Scan button and wait.
The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content into your next reply.

Help removing n1.smartyads

Recommended Posts

Link to post

Share on other sites

Top Posters In This Topic

Popular Days

Top Posters In This Topic

Popular Days

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information