Trying to remove malware "Bocamonitor" but Spybot doesn't see it

[Beachplum]

Trying to remove malware "Bocamonitor" but Spybot doesn't see it. Uninstall doesn't work. How can I get Spybot to see it so I can get rid of it?

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:26-08-2015
Ran by Carolyn_2 (administrator) on HP15R263DX (26-08-2015 20:49:50)
Running from C:\Users\Carolyn_2\Downloads
Loaded Profiles: Carolyn_2 (Available Profiles: Carolyn_2)
Platform: Windows 10 Home (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Softex Inc.) C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\HP\HP System Event\HPWMISVC.exe
(Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
() C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe
(Microsoft Corporation) C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Hewlett-Packard Development Company, LP) C:\Program Files\HP\HP ENVY 4500 series\Bin\ScanToPCActivationApp.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Hewlett-Packard Development Company, LP) C:\Program Files\HP\HP ENVY 4500 series\Bin\HPNetworkCommunicatorCom.exe
(Microsoft Corporation) C:\Users\Carolyn_2\AppData\Local\Microsoft\OneDrive\OneDrive.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWelcome.exe
(Microsoft Corporation) C:\Windows\HelpPane.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8492800 2015-06-24] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1402624 2015-06-24] (Realtek Semiconductor)
HKLM\...\Run: [SimplePass] => C:\Program Files\Hewlett-Packard\SimplePass\ClientCore.exe [3962936 2014-03-28] (Hewlett-Packard)
HKLM\...\Run: [OPBHOBroker] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe [415288 2014-03-28] (Hewlett-Packard)
HKLM\...\Run: [OPBHOBrokerDesktop] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe [415288 2014-03-28] (Hewlett-Packard)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-08-13] (Apple Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3944136 2015-07-17] (Synaptics Incorporated)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-01-21] (Microsoft Corporation)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [39179912 2015-08-05] (Dropbox, Inc.)
HKLM-x32\...\Run: [HPMessageService] => C:\Program Files (x86)\HP\HP System Event\HPMSGSVC.exe [653576 2015-06-29] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4127488 2015-06-16] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-19\...\Run: [OneDriveSetup] => C:\Windows\SysWOW64\OneDriveSetup.exe [7805120 2015-07-10] (Microsoft Corporation)
HKU\S-1-5-20\...\Run: [OneDriveSetup] => C:\Windows\SysWOW64\OneDriveSetup.exe [7805120 2015-07-10] (Microsoft Corporation)
HKU\S-1-5-21-212272962-4250710869-947374074-1004\...\Run: [Amazon Music] => C:\Users\Carolyn_2\AppData\Local\Amazon Music\Amazon Music Helper.exe [5887808 2015-07-21] ()
HKU\S-1-5-21-212272962-4250710869-947374074-1004\...\Run: [GoogleChromeAutoLaunch_9A40F75D9FDB245F0FF38A928F712476] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [813896 2015-08-18] (Google Inc.)
HKU\S-1-5-21-212272962-4250710869-947374074-1004\...\Run: [HP ENVY 4500 series (NET)] => C:\Program Files\HP\HP ENVY 4500 series\Bin\ScanToPCActivationApp.exe [3487240 2014-07-21] (Hewlett-Packard Development Company, LP)
HKU\S-1-5-21-212272962-4250710869-947374074-1004\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
HKU\S-1-5-21-212272962-4250710869-947374074-1004\...\Run: [OneDrive] => C:\Users\Carolyn_2\AppData\Local\Microsoft\OneDrive\OneDrive.exe [404064 2015-08-21] (Microsoft Corporation)
HKU\S-1-5-21-212272962-4250710869-947374074-1004\...\Run: [OfficeSyncProcess] => C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [717696 2010-01-16] (Microsoft Corporation)
HKU\S-1-5-21-212272962-4250710869-947374074-1004\...\RunOnce: [Uninstall C:\Users\Carolyn_2\AppData\Local\Microsoft\OneDrive\17.3.5892.0626\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Carolyn_2\AppData\Local\Microsoft\OneDrive\17.3.5892.0626\amd64"
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-08-05] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-08-05] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-08-05] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-08-05] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-08-05] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-08-05] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-08-05] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-08-05] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.dll [2015-08-05] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.dll [2015-08-05] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.dll [2015-08-05] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.dll [2015-08-05] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.dll [2015-08-05] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.dll [2015-08-05] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.dll [2015-08-05] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.dll [2015-08-05] (Dropbox, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp13.msn.com
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Local Page = %11%\blank.htm
HKU\S-1-5-21-212272962-4250710869-947374074-1004\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.instapaper.com/
HKU\S-1-5-21-212272962-4250710869-947374074-1004\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp13.msn.com
SearchScopes: HKLM-x32 -> {1DEF3A9B-B839-4845-90E4-F0CA8CD00DD0} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-212272962-4250710869-947374074-1004 -> {1DEF3A9B-B839-4845-90E4-F0CA8CD00DD0} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2010-01-21] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-01-16] (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2010-01-21] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2010-01-16] (Microsoft Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2015-05-06] (Hewlett-Packard)
Winsock: Catalog9-x64 01 C:\Windows\system32\LavasoftTcpService64.dll [422400 2015-07-23] (Lavasoft Limited)
Winsock: Catalog9-x64 02 C:\Windows\system32\LavasoftTcpService64.dll [422400 2015-07-23] (Lavasoft Limited)
Winsock: Catalog9-x64 03 C:\Windows\system32\LavasoftTcpService64.dll [422400 2015-07-23] (Lavasoft Limited)
Winsock: Catalog9-x64 04 C:\Windows\system32\LavasoftTcpService64.dll [422400 2015-07-23] (Lavasoft Limited)
Winsock: Catalog9-x64 05 C:\Windows\system32\LavasoftTcpService64.dll [422400 2015-07-23] (Lavasoft Limited)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{0a893aeb-22e6-4667-bc4f-c6c118df5af7}: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1204144.dll [2013-09-05] (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-07-30] ()
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-06-19] ()
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-06-19] ()
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-01-10] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-23] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-23] (Google Inc.)

Chrome:
=======
CHR Profile: C:\Users\Carolyn_2\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Carolyn_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-07-23]
CHR Extension: (Google Docs) - C:\Users\Carolyn_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-07-23]
CHR Extension: (Google Drive) - C:\Users\Carolyn_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-07-23]
CHR Extension: (YouTube) - C:\Users\Carolyn_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-07-23]
CHR Extension: (Google Search) - C:\Users\Carolyn_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-07-23]
CHR Extension: (Google Sheets) - C:\Users\Carolyn_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-07-23]
CHR Extension: (Pin It Button) - C:\Users\Carolyn_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpdjojdkbbmdfjfahjcgigfpmkopogic [2015-07-23]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Carolyn_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-07-23]
CHR Extension: (Stop Autoplay for YouTube.) - C:\Users\Carolyn_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\lgdfnbpkmkkdhgidgcpdkgpdlfjcgnnh [2015-07-23]
CHR Extension: (Stop Autoplay for Youtube™ Extended) - C:\Users\Carolyn_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\nilnpbhnhmmjioijfgilcohbknkgfmpa [2015-07-23]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Carolyn_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-27]
CHR Extension: (Gmail) - C:\Users\Carolyn_2\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-07-23]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-05-29] (Apple Inc.)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [326144 2015-07-10] (Microsoft Corporation)
S3 CDPSvc; C:\Windows\System32\CDPSvc.dll [134144 2015-07-10] (Microsoft Corporation)
R2 CoreMessagingRegistrar; C:\Windows\system32\coremessaging.dll [808856 2015-08-21] (Microsoft Corporation)
R2 CoreMessagingRegistrar; C:\Windows\SysWOW64\coremessaging.dll [510976 2015-08-21] (Microsoft Corporation)
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [136048 2015-07-28] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [136048 2015-07-28] (Dropbox, Inc.)
S3 diagnosticshub.standardcollector.service; C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe [27136 2015-07-10] (Microsoft Corporation)
S3 DmEnrollmentSvc; C:\Windows\system32\Windows.Internal.Management.dll [267776 2015-07-10] (Microsoft Corporation)
S3 DmEnrollmentSvc; C:\Windows\SysWOW64\Windows.Internal.Management.dll [193024 2015-07-10] (Microsoft Corporation)
S3 embeddedmode; C:\Windows\System32\embeddedmodesvc.dll [87040 2015-07-10] (Microsoft Corporation)
S3 EntAppSvc; C:\Windows\system32\EnterpriseAppMgmtSvc.dll [275456 2015-07-10] (Microsoft Corporation)
R2 HPSupportSolutionsFrameworkService; c:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [24888 2015-07-26] (Hewlett-Packard Company)
R2 HPWMISVC; c:\Program Files (x86)\HP\HP System Event\HPWMISVC.exe [602888 2015-06-29] (Hewlett-Packard Development Company, L.P.)
S3 icssvc; C:\Windows\System32\tetheringservice.dll [148992 2015-08-11] (Microsoft Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [328608 2015-07-30] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-02] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-02] (Intel(R) Corporation)
S3 lfsvc; C:\Windows\SysWOW64\lfsvc.dll [22528 2015-07-10] (Microsoft Corporation)
R3 LicenseManager; C:\Windows\system32\LicenseManagerSvc.dll [21504 2015-07-10] (Microsoft Corporation)
S2 MapsBroker; C:\Windows\System32\moshost.dll [62464 2015-07-10] (Microsoft Corporation)
R2 omniserv; C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe [88064 2014-03-28] (Softex Inc.) [File not signed]
S2 OneSyncSvc; C:\Windows\System32\APHostService.dll [296960 2015-07-10] (Microsoft Corporation)
R2 OneSyncSvc_Session1; C:\WINDOWS\system32\svchost.exe [39856 2015-07-10] (Microsoft Corporation)
R2 OneSyncSvc_Session1; C:\WINDOWS\SysWOW64\svchost.exe [35176 2015-07-10] (Microsoft Corporation)
S3 PimIndexMaintenanceSvc; C:\Windows\System32\PimIndexMaintenance.dll [289280 2015-07-10] (Microsoft Corporation)
S3 PimIndexMaintenanceSvc_Session1; C:\WINDOWS\system32\svchost.exe [39856 2015-07-10] (Microsoft Corporation)
S3 PimIndexMaintenanceSvc_Session1; C:\WINDOWS\SysWOW64\svchost.exe [35176 2015-07-10] (Microsoft Corporation)
S3 RetailDemo; C:\Windows\system32\RDXService.dll [996352 2015-08-11] (Microsoft Corporation)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [389896 2014-04-14] ()
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [303360 2015-06-24] (Realtek Semiconductor)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1750712 2015-06-16] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2102496 2015-06-16] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [224712 2015-07-24] (Safer-Networking Ltd.)
S3 SensorDataService; C:\Windows\System32\SensorDataService.exe [1031680 2015-08-21] (Microsoft Corporation)
R3 StateRepository; C:\Windows\system32\windows.staterepository.dll [2674176 2015-07-10] (Microsoft Corporation)
R3 StateRepository; C:\Windows\SysWOW64\windows.staterepository.dll [2049024 2015-07-10] (Microsoft Corporation)
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [246472 2015-07-17] (Synaptics Incorporated)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5613328 2015-07-29] (TeamViewer GmbH)
S3 UnistoreSvc; C:\Windows\System32\unistore.dll [1203200 2015-08-21] (Microsoft Corporation)
S3 UnistoreSvc; C:\Windows\SysWOW64\unistore.dll [925696 2015-08-21] (Microsoft Corporation)
S3 UnistoreSvc_Session1; C:\WINDOWS\System32\svchost.exe [39856 2015-07-10] (Microsoft Corporation)
S3 UnistoreSvc_Session1; C:\WINDOWS\SysWOW64\svchost.exe [35176 2015-07-10] (Microsoft Corporation)
S3 UserDataSvc; C:\Windows\System32\userdataservice.dll [1420288 2015-07-29] (Microsoft Corporation)
S3 UserDataSvc_Session1; C:\WINDOWS\system32\svchost.exe [39856 2015-07-10] (Microsoft Corporation)
S3 UserDataSvc_Session1; C:\WINDOWS\SysWOW64\svchost.exe [35176 2015-07-10] (Microsoft Corporation)
S3 vmicvmsession; C:\Windows\System32\ICSvc.dll [506880 2015-07-10] (Microsoft Corporation)
S3 w3logsvc; C:\Windows\system32\inetsrv\w3logsvc.dll [84480 2015-08-21] (Microsoft Corporation)
S3 WalletService; C:\Windows\system32\WalletService.dll [504320 2015-07-10] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [362928 2015-07-10] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-07-10] (Microsoft Corporation)
S3 XblAuthManager; C:\Windows\System32\XblAuthManager.dll [918016 2015-07-10] (Microsoft Corporation)
S3 XblGameSave; C:\Windows\System32\XblGameSave.dll [1149440 2015-07-10] (Microsoft Corporation)
S3 XboxNetApiSvc; C:\Windows\system32\XboxNetApiSvc.dll [1019392 2015-07-10] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91912 2013-11-12] (CyberLink)
R3 CompositeBus; C:\Windows\System32\DriverStore\FileRepository\compositebus.inf_amd64_98334ba6e76853ba\CompositeBus.sys [39936 2015-07-10] (Microsoft Corporation)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3436896 2015-07-10] (QLogic Corporation)
R1 FileCrypt; C:\Windows\System32\drivers\filecrypt.sys [83968 2015-07-10] (Microsoft Corporation)
S3 genericusbfn; C:\Windows\System32\drivers\genericusbfn.sys [20992 2015-07-10] (Microsoft Corporation)
R3 GPIO; C:\Windows\System32\drivers\iaiogpioe.sys [31232 2013-11-11] (Intel Corporation)
R1 GpuEnergyDrv; C:\Windows\System32\drivers\gpuenergydrv.sys [8192 2015-07-10] (Microsoft Corporation)
S3 ibbus; C:\Windows\System32\drivers\ibbus.sys [424800 2015-07-10] (Mellanox)
S3 IoQos; C:\Windows\System32\drivers\ioqos.sys [26624 2015-07-10] (Microsoft Corporation)
S0 LSI_SAS3i; C:\Windows\System32\drivers\lsi_sas3i.sys [99168 2015-07-10] (Avago Technologies)
R0 MBI; C:\Windows\System32\drivers\MBI.sys [29464 2014-01-23] (Intel Corporation)
S3 mlx4_bus; C:\Windows\System32\drivers\mlx4_bus.sys [705376 2015-07-10] (Mellanox)
S3 ndfltr; C:\Windows\System32\drivers\ndfltr.sys [76128 2015-07-10] (Mellanox)
R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [310528 2015-06-05] (Realtek Semiconductor Corp.)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [3453144 2015-07-10] (Realtek Semiconductor Corporation )
R1 SDHookDriver; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHookDrv64.sys [65576 2015-06-16] (Safer-Networking Ltd.)
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [32496 2014-09-17] (Synaptics Incorporated)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [42696 2015-07-17] (Synaptics Incorporated)
R2 storqosflt; C:\Windows\System32\drivers\storqosflt.sys [61952 2015-07-10] (Microsoft Corporation)
R3 swenum; C:\Windows\System32\DriverStore\FileRepository\swenum.inf_amd64_2a699e44676b7781\swenum.sys [17760 2015-07-10] (Microsoft Corporation)
R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [88592 2014-01-15] (Intel Corporation)
S3 UcmCx0101; C:\Windows\System32\Drivers\UcmCx.sys [61952 2015-07-10] (Microsoft Corporation)
S3 UcmUcsi; C:\Windows\System32\drivers\UcmUcsi.sys [46080 2015-08-21] (Microsoft Corporation)
S3 UdeCx; C:\Windows\System32\drivers\udecx.sys [44032 2015-07-10] ()
R0 WindowsTrustedRT; C:\Windows\System32\drivers\WindowsTrustedRT.sys [106520 2015-07-10] (Microsoft Corporation)
R0 WindowsTrustedRTProxy; C:\Windows\System32\drivers\WindowsTrustedRTProxy.sys [17944 2015-07-10] (Microsoft Corporation)
S3 WinMad; C:\Windows\System32\drivers\winmad.sys [26976 2015-07-10] (Mellanox)
S3 WinVerbs; C:\Windows\System32\drivers\winverbs.sys [59232 2015-07-10] (Mellanox)
R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2013-07-22] (Hewlett-Packard Development Company, L.P.)
S3 xboxgip; C:\Windows\System32\drivers\xboxgip.sys [222720 2015-07-10] (Microsoft Corporation)
S3 xinputhid; C:\Windows\System32\drivers\xinputhid.sys [25600 2015-07-10] (Microsoft Corporation)
S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-08-26 20:49 - 2015-08-26 20:50 - 00026804 _____ C:\Users\Carolyn_2\Downloads\FRST.txt
2015-08-26 20:48 - 2015-08-26 20:49 - 00000000 ____D C:\FRST
2015-08-26 20:47 - 2015-08-26 20:48 - 02186752 _____ (Farbar) C:\Users\Carolyn_2\Downloads\FRST64.exe
2015-08-26 20:47 - 2015-08-26 20:47 - 02186752 _____ (Farbar) C:\Users\Carolyn_2\Downloads\FRST64 (1).exe
2015-08-26 20:42 - 2015-08-26 20:42 - 00016148 _____ C:\WINDOWS\system32\HP15R263DX_Carolyn_2_HistoryPrediction.bin
2015-08-26 20:37 - 2015-08-26 20:37 - 00000000 ____D C:\RegBackup
2015-08-26 20:35 - 2015-08-26 20:35 - 00002275 _____ C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
2015-08-26 20:35 - 2015-08-26 20:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2015-08-26 20:35 - 2015-08-26 20:35 - 00000000 ____D C:\Program Files (x86)\Tweaking.com
2015-08-26 20:34 - 2015-08-26 20:34 - 04687184 _____ (Tweaking.com) C:\Users\Carolyn_2\Downloads\tweaking.com_registry_backup_setup.exe
2015-08-26 19:54 - 2015-08-26 19:54 - 04257344 _____ (Reason Software Company Inc.) C:\Users\Carolyn_2\Downloads\reason-core-security-setup.exe
2015-08-26 19:03 - 2015-08-26 19:03 - 00000000 ____D C:\Users\Carolyn_2\AppData\Roaming\WildTangent
2015-08-26 19:02 - 2015-08-26 19:06 - 00000000 ____D C:\ProgramData\WildTangentUninstall153980
2015-08-25 08:39 - 2015-07-27 09:30 - 00450771 ____R C:\WINDOWS\system32\Drivers\etc\hosts.20150825-083915.backup
2015-08-24 16:03 - 2015-07-27 09:30 - 00450771 ____R C:\WINDOWS\system32\Drivers\etc\hosts.ccebak
2015-08-24 15:00 - 2015-08-24 15:00 - 00000000 ____D C:\Users\Carolyn_2\AppData\Roaming\TuneUp Software
2015-08-24 14:56 - 2015-08-26 19:33 - 00000082 _____ C:\WINDOWS\wininit.ini
2015-08-24 14:52 - 2015-08-24 14:52 - 24190976 _____ C:\Users\Carolyn_2\Downloads\lps-gb-vt-x86.msi
2015-08-24 14:29 - 2015-08-26 19:36 - 00000000 ____D C:\Users\Carolyn_2\AppData\Local\Comodo
2015-08-24 14:29 - 2015-08-26 19:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Comodo
2015-08-24 14:26 - 2015-08-26 19:21 - 00000000 ____D C:\ProgramData\Comodo
2015-08-24 14:24 - 2015-08-24 14:25 - 226558984 _____ (COMODO) C:\Users\Carolyn_2\Downloads\cispremium_installer.exe
2015-08-23 07:04 - 2015-08-23 07:05 - 00000000 ____D C:\Users\Carolyn_2\AppData\Roaming\CyberLink
2015-08-23 07:04 - 2015-08-23 07:04 - 00000000 ____D C:\Users\Carolyn_2\Documents\CyberLink
2015-08-23 07:04 - 2015-08-23 07:04 - 00000000 ____D C:\Users\Carolyn_2\AppData\Local\MediaShow
2015-08-21 12:34 - 2015-08-21 12:34 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2015-08-21 09:40 - 2015-08-21 09:58 - 00000000 ____D C:\Users\Carolyn_2\AppData\Local\MicrosoftEdge
2015-08-21 09:33 - 2015-08-13 00:33 - 24593408 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-08-21 09:33 - 2015-08-11 05:22 - 21875200 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2015-08-21 09:33 - 2015-08-02 22:18 - 08613200 _____ (Microsoft Corp.) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2015-08-21 09:33 - 2015-08-02 21:56 - 06878256 _____ (Microsoft Corp.) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2015-08-21 09:32 - 2015-08-13 00:23 - 02178560 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2015-08-21 09:32 - 2015-08-13 00:22 - 02093056 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidsvc.dll
2015-08-21 09:32 - 2015-08-13 00:17 - 01795072 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll
2015-08-21 09:32 - 2015-08-13 00:07 - 19323392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-08-21 09:32 - 2015-08-11 06:04 - 04532304 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2015-08-21 09:32 - 2015-08-11 06:04 - 02462648 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2015-08-21 09:32 - 2015-08-11 06:03 - 08021840 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2015-08-21 09:32 - 2015-08-11 05:57 - 03622256 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-08-21 09:32 - 2015-08-11 05:50 - 01643872 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2015-08-21 09:32 - 2015-08-11 05:40 - 04048808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2015-08-21 09:32 - 2015-08-11 05:40 - 02151208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2015-08-21 09:32 - 2015-08-11 05:31 - 02880032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-08-21 09:32 - 2015-08-11 05:23 - 16706560 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2015-08-21 09:32 - 2015-08-11 05:20 - 02224640 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkMobileSettings.dll
2015-08-21 09:32 - 2015-08-11 05:16 - 02416640 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2015-08-21 09:32 - 2015-08-11 05:11 - 02446336 _____ C:\WINDOWS\system32\InputService.dll
2015-08-21 09:32 - 2015-08-11 05:10 - 00778752 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll
2015-08-21 09:32 - 2015-08-11 05:06 - 07523328 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2015-08-21 09:32 - 2015-08-11 05:06 - 02662400 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll
2015-08-21 09:32 - 2015-08-11 05:05 - 03527168 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll
2015-08-21 09:32 - 2015-08-11 05:05 - 00996352 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXService.dll
2015-08-21 09:32 - 2015-08-11 05:03 - 02558976 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssrch.dll
2015-08-21 09:32 - 2015-08-11 05:02 - 03588096 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2015-08-21 09:32 - 2015-08-11 05:02 - 01890304 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2015-08-21 09:32 - 2015-08-11 04:57 - 13024768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2015-08-21 09:32 - 2015-08-11 04:51 - 01916928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2015-08-21 09:32 - 2015-08-11 04:49 - 00586752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll
2015-08-21 09:32 - 2015-08-11 04:45 - 18805760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2015-08-21 09:32 - 2015-08-11 04:45 - 01820672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll
2015-08-21 09:32 - 2015-08-11 04:43 - 02748416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll
2015-08-21 09:32 - 2015-08-11 04:40 - 01964544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssrch.dll
2015-08-21 09:32 - 2015-08-11 04:40 - 01593856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2015-08-21 09:32 - 2015-08-08 02:24 - 02415104 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2015-08-21 09:32 - 2015-08-08 02:24 - 01679360 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2015-08-21 09:32 - 2015-08-08 02:00 - 01985024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2015-08-21 09:32 - 2015-08-05 00:49 - 00783112 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll
2015-08-21 09:32 - 2015-08-05 00:29 - 00644128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll
2015-08-21 09:32 - 2015-08-04 23:47 - 01383424 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2015-08-21 09:32 - 2015-08-04 00:06 - 00583128 _____ (Microsoft Corporation) C:\WINDOWS\system32\mf.dll
2015-08-21 09:32 - 2015-08-03 22:59 - 01212416 _____ (Microsoft Corporation) C:\WINDOWS\system32\RemoteNaturalLanguage.dll
2015-08-21 09:32 - 2015-08-03 22:47 - 00898560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\RemoteNaturalLanguage.dll
2015-08-21 09:32 - 2015-08-02 22:19 - 00505696 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2015-08-21 09:32 - 2015-08-02 22:18 - 01983840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2015-08-21 09:32 - 2015-08-02 22:13 - 22322624 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2015-08-21 09:32 - 2015-08-02 21:50 - 20857848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2015-08-21 09:32 - 2015-08-02 21:24 - 00503808 _____ (Microsoft Corporation) C:\WINDOWS\system32\tileobjserver.dll
2015-08-21 09:32 - 2015-08-02 21:22 - 01601536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Speech.dll
2015-08-21 09:32 - 2015-08-02 21:22 - 01008640 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll
2015-08-21 09:32 - 2015-08-02 21:18 - 12503552 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-08-21 09:32 - 2015-08-02 21:18 - 03780096 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2015-08-21 09:32 - 2015-08-02 21:15 - 00595456 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll
2015-08-21 09:32 - 2015-08-02 21:14 - 00273920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll
2015-08-21 09:32 - 2015-08-02 21:14 - 00247808 _____ C:\WINDOWS\system32\facecredentialprovider.dll
2015-08-21 09:32 - 2015-08-02 21:12 - 00217088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VEEventDispatcher.dll
2015-08-21 09:32 - 2015-08-02 21:10 - 01162240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Speech.dll
2015-08-21 09:32 - 2015-08-02 21:03 - 00494592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LogonController.dll
2015-08-21 09:32 - 2015-08-02 21:01 - 11262464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-08-21 09:32 - 2015-07-30 02:24 - 01561872 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmde.dll
2015-08-21 09:32 - 2015-07-30 02:21 - 00816576 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll
2015-08-21 09:32 - 2015-07-30 02:17 - 01200400 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcrt4.dll
2015-08-21 09:32 - 2015-07-30 02:17 - 01025840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsrcsnk.dll
2015-08-21 09:32 - 2015-07-30 02:16 - 02147080 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d9.dll
2015-08-21 09:32 - 2015-07-30 02:09 - 01562968 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpmde.dll
2015-08-21 09:32 - 2015-07-30 02:06 - 01043872 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2015-08-21 09:32 - 2015-07-30 02:05 - 02498808 _____ C:\WINDOWS\system32\CoreUIComponents.dll
2015-08-21 09:32 - 2015-07-30 02:05 - 00501008 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2015-08-21 09:32 - 2015-07-30 02:04 - 01396064 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll
2015-08-21 09:32 - 2015-07-30 02:03 - 02116448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2015-08-21 09:32 - 2015-07-30 00:29 - 00705520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rpcrt4.dll
2015-08-21 09:32 - 2015-07-30 00:26 - 01867160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d9.dll
2015-08-21 09:32 - 2015-07-30 00:26 - 00877016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2015-08-21 09:32 - 2015-07-30 00:25 - 01356368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmde.dll
2015-08-21 09:32 - 2015-07-30 00:25 - 00713312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll
2015-08-21 09:32 - 2015-07-30 00:24 - 01769056 _____ C:\WINDOWS\SysWOW64\CoreUIComponents.dll
2015-08-21 09:32 - 2015-07-30 00:21 - 00962400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll
2015-08-21 09:32 - 2015-07-30 00:12 - 00287744 _____ (Microsoft Corporation) C:\WINDOWS\system32\provhandlers.dll
2015-08-21 09:32 - 2015-07-29 23:52 - 00859136 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll
2015-08-21 09:32 - 2015-07-29 23:52 - 00521216 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2015-08-21 09:32 - 2015-07-29 23:49 - 11557888 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2015-08-21 09:32 - 2015-07-29 23:46 - 02125312 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.appcore.dll
2015-08-21 09:32 - 2015-07-29 23:42 - 00518144 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationController.dll
2015-08-21 09:32 - 2015-07-29 23:41 - 00407040 _____ (Microsoft Corporation) C:\WINDOWS\system32\CredProvDataModel.dll
2015-08-21 09:32 - 2015-07-29 23:40 - 00846336 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpncore.dll
2015-08-21 09:32 - 2015-07-29 23:38 - 01420288 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataService.dll
2015-08-21 09:32 - 2015-07-29 23:34 - 00599552 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpnapps.dll
2015-08-21 09:32 - 2015-07-29 23:29 - 00654848 _____ (Microsoft Corporation) C:\WINDOWS\system32\PlayToManager.dll
2015-08-21 09:32 - 2015-07-29 23:15 - 09889792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2015-08-21 09:32 - 2015-07-29 23:04 - 01714176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.appcore.dll
2015-08-21 09:32 - 2015-07-29 23:04 - 00335360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredProvDataModel.dll
2015-08-21 09:32 - 2015-07-29 22:58 - 00497152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PlayToManager.dll
2015-08-21 09:31 - 2015-08-13 00:20 - 00414208 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentClient.dll
2015-08-21 09:31 - 2015-08-12 23:53 - 00311808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppXDeploymentClient.dll
2015-08-21 09:31 - 2015-08-11 06:04 - 01087296 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfplat.dll
2015-08-21 09:31 - 2015-08-11 06:03 - 00442208 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys
2015-08-21 09:31 - 2015-08-11 06:02 - 00554744 _____ (Microsoft Corporation) C:\WINDOWS\system32\directmanipulation.dll
2015-08-21 09:31 - 2015-08-11 06:02 - 00292856 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppHost.exe
2015-08-21 09:31 - 2015-08-11 06:02 - 00080720 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\stornvme.sys
2015-08-21 09:31 - 2015-08-11 05:52 - 00993104 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll
2015-08-21 09:31 - 2015-08-11 05:40 - 00918320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfplat.dll
2015-08-21 09:31 - 2015-08-11 05:38 - 00454000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\directmanipulation.dll
2015-08-21 09:31 - 2015-08-11 05:37 - 00243800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LockAppHost.exe
2015-08-21 09:31 - 2015-08-11 05:26 - 00845664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll
2015-08-21 09:31 - 2015-08-11 05:21 - 00148992 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringservice.dll
2015-08-21 09:31 - 2015-08-11 05:21 - 00052224 _____ (Microsoft Corporation) C:\WINDOWS\system32\tetheringclient.dll
2015-08-21 09:31 - 2015-08-11 05:20 - 00483328 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneDriveSettingSyncProvider.dll
2015-08-21 09:31 - 2015-08-11 05:19 - 00235520 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_Notifications.dll
2015-08-21 09:31 - 2015-08-11 05:18 - 00235008 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserMgrProxy.dll
2015-08-21 09:31 - 2015-08-11 05:14 - 00404480 _____ C:\WINDOWS\system32\diagtrack_wininternal.dll
2015-08-21 09:31 - 2015-08-11 05:13 - 00413184 _____ C:\WINDOWS\system32\diagtrack_win.dll
2015-08-21 09:31 - 2015-08-11 05:11 - 00553472 _____ (Microsoft Corporation) C:\WINDOWS\system32\GamePanel.exe
2015-08-21 09:31 - 2015-08-11 05:10 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2015-08-21 09:31 - 2015-08-11 05:10 - 00293376 _____ C:\WINDOWS\system32\TextInputFramework.dll
2015-08-21 09:31 - 2015-08-11 05:09 - 00032768 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuautoappupdate.dll
2015-08-21 09:31 - 2015-08-11 05:08 - 00893440 _____ (Microsoft Corporation) C:\WINDOWS\system32\MbaeApiPublic.dll
2015-08-21 09:31 - 2015-08-11 05:08 - 00563200 _____ (Microsoft Corporation) C:\WINDOWS\system32\MbaeApi.dll
2015-08-21 09:31 - 2015-08-11 05:07 - 01178112 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2015-08-21 09:31 - 2015-08-11 05:07 - 00593920 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll
2015-08-21 09:31 - 2015-08-11 05:07 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\system32\MbaeParserTask.exe
2015-08-21 09:31 - 2015-08-11 05:05 - 00342016 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationGeofences.dll
2015-08-21 09:31 - 2015-08-11 05:05 - 00269312 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationFramework.dll
2015-08-21 09:31 - 2015-08-11 05:05 - 00137216 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationPermissions.dll
2015-08-21 09:31 - 2015-08-11 05:05 - 00078848 _____ (Microsoft Corporation) C:\WINDOWS\system32\LocationFrameworkInternalPS.dll
2015-08-21 09:31 - 2015-08-11 05:02 - 00621056 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2015-08-21 09:31 - 2015-08-11 05:02 - 00186368 _____ (Microsoft Corporation) C:\WINDOWS\system32\cloudAP.dll
2015-08-21 09:31 - 2015-08-11 05:01 - 01334784 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIAutomationCore.dll
2015-08-21 09:31 - 2015-08-11 05:00 - 00336384 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchProtocolHost.exe
2015-08-21 09:31 - 2015-08-11 05:00 - 00274432 _____ (Microsoft Corporation) C:\WINDOWS\system32\syncutil.dll
2015-08-21 09:31 - 2015-08-11 04:59 - 01106432 _____ (Microsoft Corporation) C:\WINDOWS\system32\sysmain.dll
2015-08-21 09:31 - 2015-08-11 04:59 - 00642560 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdbui.dll
2015-08-21 09:31 - 2015-08-11 04:59 - 00123392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll
2015-08-21 09:31 - 2015-08-11 04:59 - 00042496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tetheringclient.dll
2015-08-21 09:31 - 2015-08-11 04:58 - 00372224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OneDriveSettingSyncProvider.dll
2015-08-21 09:31 - 2015-08-11 04:57 - 00159744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserMgrProxy.dll
2015-08-21 09:31 - 2015-08-11 04:51 - 01823232 _____ C:\WINDOWS\SysWOW64\InputService.dll
2015-08-21 09:31 - 2015-08-11 04:50 - 00420352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GamePanel.exe
2015-08-21 09:31 - 2015-08-11 04:50 - 00200704 _____ C:\WINDOWS\SysWOW64\TextInputFramework.dll
2015-08-21 09:31 - 2015-08-11 04:50 - 00131584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Core.TextInput.dll
2015-08-21 09:31 - 2015-08-11 04:49 - 00247808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2015-08-21 09:31 - 2015-08-11 04:48 - 00671232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MbaeApiPublic.dll
2015-08-21 09:31 - 2015-08-11 04:47 - 00448512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MbaeApi.dll
2015-08-21 09:31 - 2015-08-11 04:42 - 05454848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2015-08-21 09:31 - 2015-08-11 04:40 - 01112064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIAutomationCore.dll
2015-08-21 09:31 - 2015-08-11 04:39 - 00280576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchProtocolHost.exe
2015-08-21 09:31 - 2015-08-11 04:38 - 00162304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReInfo.dll
2015-08-21 09:31 - 2015-08-08 03:29 - 01822280 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2015-08-21 09:31 - 2015-08-08 03:19 - 00608936 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2015-08-21 09:31 - 2015-08-08 03:01 - 01533496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2015-08-21 09:31 - 2015-08-08 02:48 - 00539728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2015-08-21 09:31 - 2015-08-08 02:40 - 00365056 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2015-08-21 09:31 - 2015-08-08 02:15 - 00303104 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2015-08-21 09:31 - 2015-08-05 23:17 - 00237392 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdyboost.sys
2015-08-21 09:31 - 2015-08-05 23:17 - 00200528 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wof.sys
2015-08-21 09:31 - 2015-08-05 22:22 - 00685568 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdiWiFi.sys
2015-08-21 09:31 - 2015-08-05 00:00 - 00310784 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActionCenter.dll
2015-08-21 09:31 - 2015-08-04 23:54 - 01274880 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll
2015-08-21 09:31 - 2015-08-04 23:39 - 00261632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActionCenter.dll
2015-08-21 09:31 - 2015-08-04 00:07 - 00102752 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mountmgr.sys
2015-08-21 09:31 - 2015-08-04 00:06 - 00243248 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2015-08-21 09:31 - 2015-08-03 23:23 - 00078848 _____ (Microsoft Corporation) C:\WINDOWS\system32\VPNv2CSP.dll
2015-08-21 09:31 - 2015-08-02 22:32 - 00306688 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationObjFactory.dll
2015-08-21 09:31 - 2015-08-02 22:28 - 00268800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NotificationObjFactory.dll
2015-08-21 09:31 - 2015-08-02 22:19 - 00393568 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2015-08-21 09:31 - 2015-08-02 22:18 - 00594472 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Shell.Broker.dll
2015-08-21 09:31 - 2015-08-02 22:18 - 00046432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msgpiowin32.sys
2015-08-21 09:31 - 2015-08-02 22:17 - 00516960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2015-08-21 09:31 - 2015-08-02 22:17 - 00052264 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wpcfltr.sys
2015-08-21 09:31 - 2015-08-02 22:12 - 00801632 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWAHost.exe
2015-08-21 09:31 - 2015-08-02 21:49 - 00700256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWAHost.exe
2015-08-21 09:31 - 2015-08-02 21:31 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedStartModel.dll
2015-08-21 09:31 - 2015-08-02 21:30 - 00253952 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_UserAccount.dll
2015-08-21 09:31 - 2015-08-02 21:24 - 00282112 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEEventDispatcher.dll
2015-08-21 09:31 - 2015-08-02 21:24 - 00193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedStartModelShim.dll
2015-08-21 09:31 - 2015-08-02 21:23 - 00122880 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEDataLayerHelpers.dll
2015-08-21 09:31 - 2015-08-02 21:22 - 00317440 _____ (Microsoft Corporation) C:\WINDOWS\system32\configmanager2.dll
2015-08-21 09:31 - 2015-08-02 21:21 - 00179712 _____ (Microsoft Corporation) C:\WINDOWS\system32\coredpus.dll
2015-08-21 09:31 - 2015-08-02 21:19 - 00215040 _____ (Microsoft Corporation) C:\WINDOWS\system32\notepad.exe
2015-08-21 09:31 - 2015-08-02 21:19 - 00215040 _____ (Microsoft Corporation) C:\WINDOWS\notepad.exe
2015-08-21 09:31 - 2015-08-02 21:18 - 00162304 _____ (Microsoft Corporation) C:\WINDOWS\system32\SubscriptionMgr.dll
2015-08-21 09:31 - 2015-08-02 21:18 - 00120832 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkStatus.dll
2015-08-21 09:31 - 2015-08-02 21:15 - 01290752 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll
2015-08-21 09:31 - 2015-08-02 21:15 - 00573440 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Cortana.Desktop.dll
2015-08-21 09:31 - 2015-08-02 21:15 - 00384000 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppBroker.dll
2015-08-21 09:31 - 2015-08-02 21:15 - 00171520 _____ (Microsoft Corporation) C:\WINDOWS\system32\WinBioDataModel.dll
2015-08-21 09:31 - 2015-08-02 21:12 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VEDataLayerHelpers.dll
2015-08-21 09:31 - 2015-08-02 21:11 - 00814080 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctfuimanager.dll
2015-08-21 09:31 - 2015-08-02 21:06 - 00207872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\notepad.exe
2015-08-21 09:31 - 2015-08-02 21:02 - 00311808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LockAppBroker.dll
2015-08-21 09:31 - 2015-08-02 21:02 - 00195072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll
2015-08-21 09:31 - 2015-08-02 20:59 - 00752640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctfuimanager.dll
2015-08-21 09:31 - 2015-07-30 02:23 - 00527952 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2015-08-21 09:31 - 2015-07-30 02:15 - 00632168 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxgi.dll
2015-08-21 09:31 - 2015-07-30 02:14 - 00333168 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFPlay.dll
2015-08-21 09:31 - 2015-07-30 01:24 - 00252768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ContentDeliveryManager.Utilities.dll
2015-08-21 09:31 - 2015-07-30 00:24 - 00445240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2015-08-21 09:31 - 2015-07-30 00:24 - 00407616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2015-08-21 09:31 - 2015-07-30 00:24 - 00285632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFPlay.dll
2015-08-21 09:31 - 2015-07-30 00:22 - 00896144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsrcsnk.dll
2015-08-21 09:31 - 2015-07-30 00:22 - 00507696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxgi.dll
2015-08-21 09:31 - 2015-07-30 00:12 - 00268800 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll
2015-08-21 09:31 - 2015-07-30 00:09 - 00024576 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManagerShellext.exe
2015-08-21 09:31 - 2015-07-30 00:08 - 00494592 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll
2015-08-21 09:31 - 2015-07-30 00:08 - 00168960 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe
2015-08-21 09:31 - 2015-07-30 00:08 - 00055296 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe
2015-08-21 09:31 - 2015-07-29 23:59 - 00187904 _____ (Microsoft Corporation) C:\WINDOWS\system32\provisioningcsp.dll
2015-08-21 09:31 - 2015-07-29 23:52 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\ACPBackgroundManagerPolicy.dll
2015-08-21 09:31 - 2015-07-29 23:46 - 00487424 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmkvsrcsnk.dll
2015-08-21 09:31 - 2015-07-29 23:46 - 00204288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll
2015-08-21 09:31 - 2015-07-29 23:45 - 00195584 _____ (Microsoft Corporation) C:\WINDOWS\system32\fwpolicyiomgr.dll
2015-08-21 09:31 - 2015-07-29 23:45 - 00155136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tunnel.sys
2015-08-21 09:31 - 2015-07-29 23:44 - 00280064 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2015-08-21 09:31 - 2015-07-29 23:44 - 00229376 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorService.dll
2015-08-21 09:31 - 2015-07-29 23:44 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsNativeApi.V2.dll
2015-08-21 09:31 - 2015-07-29 23:44 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthhfenum.sys
2015-08-21 09:31 - 2015-07-29 23:44 - 00041984 _____ (Microsoft Corporation) C:\WINDOWS\system32\VoiceActivationManager.dll
2015-08-21 09:31 - 2015-07-29 23:41 - 00028672 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationControllerPS.dll
2015-08-21 09:31 - 2015-07-29 23:38 - 00080384 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxSysprep.dll
2015-08-21 09:31 - 2015-07-29 23:07 - 00163328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fwpolicyiomgr.dll
2015-08-21 09:31 - 2015-07-29 23:06 - 00373248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmkvsrcsnk.dll
2015-08-21 09:31 - 2015-07-29 23:06 - 00078336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SensorsNativeApi.V2.dll
2015-08-21 09:31 - 2015-07-29 23:06 - 00034816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VoiceActivationManager.dll
2015-08-21 09:31 - 2015-07-29 22:59 - 00473088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wpnapps.dll
2015-08-21 09:21 - 2015-08-21 09:21 - 00000000 ___HD C:\OneDriveTemp
2015-08-21 09:06 - 2015-08-21 09:06 - 00000000 ____D C:\Users\Carolyn_2\AppData\Local\NetworkTiles
2015-08-21 03:38 - 2015-08-21 01:19 - 00000000 ___DC C:\WINDOWS\Panther
2015-08-21 03:30 - 2015-08-21 03:30 - 00000000 ____D C:\Windows.old
2015-08-21 03:29 - 2015-08-21 03:29 - 14241792 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 12589056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 04791296 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 04760576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExplorerFrame.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 04398080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Search.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 04350464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 04169728 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIRibbon.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 03687936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 03579904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 03443200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIRibbon.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 03248640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 02646528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 01611264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 01411072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Editing.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 01201664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Cred.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 01168736 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys
2015-08-21 03:29 - 2015-08-21 03:29 - 01067520 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 01043968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Editing.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 01031680 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorDataService.exe
2015-08-21 03:29 - 2015-08-21 03:29 - 00980832 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2015-08-21 03:29 - 2015-08-21 03:29 - 00872448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntshrui.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00799232 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpccpl.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00798208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntshrui.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00754688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Cred.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00750592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comdlg32.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00670208 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieproxy.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00589312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\efscore.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00584704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIRibbonRes.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00584704 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Sensors.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00584704 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIRibbonRes.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00584544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wimgapi.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00569344 _____ (Microsoft Corporation) C:\WINDOWS\system32\MCRecvSrc.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00485888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BlockedShutdown.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00480256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MCRecvSrc.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00458752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\uxtheme.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00452608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchFolder.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00437248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Sensors.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00414720 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BioFeedback.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00356352 _____ (Microsoft Corporation) C:\WINDOWS\system32\stobject.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00322048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BlockedShutdown.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00322048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\stobject.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\ConhostV2.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00310784 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsApi.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00294912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieproxy.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00291840 _____ (Microsoft Corporation) C:\WINDOWS\system32\systemcpl.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00283648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BioFeedback.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00279552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\systemcpl.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00275456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcastdvr.exe
2015-08-21 03:29 - 2015-08-21 03:29 - 00251392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SensorsApi.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00181088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxAllUserStore.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00179712 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_SignInOptions.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00179200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\srumsvc.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00116736 _____ (Microsoft Corporation) C:\WINDOWS\system32\sendmail.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00104960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sendmail.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00097128 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcd.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00082616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcd.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00069120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\spbcd.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00058368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msiexec.exe
2015-08-21 03:29 - 2015-08-21 03:29 - 00056320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Cortana.PAL.Desktop.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00045568 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2015-08-21 03:29 - 2015-08-21 03:29 - 00032768 _____ (Microsoft Corporation) C:\WINDOWS\system32\calc.exe
2015-08-21 03:29 - 2015-08-21 03:29 - 00031232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\calc.exe
2015-08-21 03:28 - 2015-08-21 03:28 - 07569408 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 07051264 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 06488312 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 06305792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Search.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 06101504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 05118024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 05076480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingMaps.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 04611584 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 03362816 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 03248128 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 02741760 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 02606080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 02235904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 02207744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 02112512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 01773056 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 01602560 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 01591856 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 01521664 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActiveSyncProvider.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 01418240 _____ (Microsoft Corporation) C:\WINDOWS\system32\RecoveryDrive.exe
2015-08-21 03:28 - 2015-08-21 03:28 - 01417216 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 01380864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 01365072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 01294352 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2015-08-21 03:28 - 2015-08-21 03:28 - 01203200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Bluetooth.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 01203200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Unistore.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 01169408 _____ (Microsoft Corporation) C:\WINDOWS\system32\dosvc.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 01135312 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipUp.exe
2015-08-21 03:28 - 2015-08-21 03:28 - 01123400 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2015-08-21 03:28 - 2015-08-21 03:28 - 01101792 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 01061888 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 01018568 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2015-08-21 03:28 - 2015-08-21 03:28 - 00966424 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00934752 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\refsv1.sys
2015-08-21 03:28 - 2015-08-21 03:28 - 00925696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Unistore.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00902656 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchIndexer.exe
2015-08-21 03:28 - 2015-08-21 03:28 - 00869376 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapControlCore.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00858408 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2015-08-21 03:28 - 2015-08-21 03:28 - 00856064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ContactApis.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00855552 _____ (Microsoft Corporation) C:\WINDOWS\system32\winhttp.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00850432 _____ (Microsoft Corporation) C:\WINDOWS\system32\comdlg32.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00841728 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Import.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00832512 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsStore.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00828416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Bluetooth.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00823336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00808856 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00783872 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00762896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.appcore.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00752640 _____ (Microsoft Corporation) C:\WINDOWS\system32\efscore.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00712192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchIndexer.exe
2015-08-21 03:28 - 2015-08-21 03:28 - 00695136 _____ (Microsoft Corporation) C:\WINDOWS\system32\wimgapi.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00680448 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.Connectivity.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00679424 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppContracts.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00677888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00667136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winhttp.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00658568 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipSVC.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00630160 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00623616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ContactApis.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00607008 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00601344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2015-08-21 03:28 - 2015-08-21 03:28 - 00590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\MessagingDataModel2.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00589824 _____ (Microsoft Corporation) C:\WINDOWS\system32\uxtheme.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00578048 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2015-08-21 03:28 - 2015-08-21 03:28 - 00575488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Import.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00565088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\acpi.sys
2015-08-21 03:28 - 2015-08-21 03:28 - 00542720 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchFolder.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00521568 _____ (Microsoft Corporation) C:\WINDOWS\system32\wimserv.exe
2015-08-21 03:28 - 2015-08-21 03:28 - 00510976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00505344 _____ C:\WINDOWS\system32\EditionUpgradeManagerObj.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.Connectivity.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00498016 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbhub.sys
2015-08-21 03:28 - 2015-08-21 03:28 - 00465920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MessagingDataModel2.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00446976 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapConfiguration.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00441344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppContracts.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00430592 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcomapi.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00425824 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00421888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Bluetooth.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00416256 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcdedit.exe
2015-08-21 03:28 - 2015-08-21 03:28 - 00366592 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00359936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00343040 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00342528 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvr.exe
2015-08-21 03:28 - 2015-08-21 03:28 - 00335248 _____ (Microsoft Corporation) C:\WINDOWS\system32\wintrust.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00329728 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00328704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapConfiguration.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00325984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys
2015-08-21 03:28 - 2015-08-21 03:28 - 00303616 _____ (Microsoft Corporation) C:\WINDOWS\system32\MBMediaManager.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00296960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Internal.Bluetooth.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00290312 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininit.exe
2015-08-21 03:28 - 2015-08-21 03:28 - 00271872 _____ (Microsoft Corporation) C:\WINDOWS\system32\ConsoleLogon.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00265480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wintrust.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00263168 _____ (Microsoft Corporation) C:\WINDOWS\system32\DisplayManager.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00242176 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00232960 _____ (Microsoft Corporation) C:\WINDOWS\system32\DevicesFlowBroker.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00208736 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxAllUserStore.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00208384 _____ (Microsoft Corporation) C:\WINDOWS\system32\srumsvc.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00204288 _____ (Microsoft Corporation) C:\WINDOWS\system32\OmaDmAgent.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00193024 _____ (Microsoft Corporation) C:\WINDOWS\system32\EnterpriseModernAppMgmtCSP.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00191488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DisplayManager.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00190464 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReInfo.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00186880 _____ (Microsoft Corporation) C:\WINDOWS\system32\BootMenuUX.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00185856 _____ (Microsoft Corporation) C:\WINDOWS\system32\psmsrv.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00181760 _____ (Microsoft Corporation) C:\WINDOWS\system32\shutdownux.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00176640 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcdboot.exe
2015-08-21 03:28 - 2015-08-21 03:28 - 00169984 _____ (Microsoft Corporation) C:\WINDOWS\system32\storewuauth.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00167424 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_Privacy.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00151040 _____ (Microsoft Corporation) C:\WINDOWS\system32\TabSvc.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00150528 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
2015-08-21 03:28 - 2015-08-21 03:28 - 00137216 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEStoreEventHandlers.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00120832 _____ (Microsoft Corporation) C:\WINDOWS\system32\omadmclient.exe
2015-08-21 03:28 - 2015-08-21 03:28 - 00107520 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmapi.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00093696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmapi.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00084480 _____ (Microsoft Corporation) C:\WINDOWS\system32\spbcd.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\system32\setbcdlocale.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00068096 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Cortana.ProxyStub.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00067072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbser.sys
2015-08-21 03:28 - 2015-08-21 03:28 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\system32\msiexec.exe
2015-08-21 03:28 - 2015-08-21 03:28 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\unenrollhook.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00061280 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dam.sys
2015-08-21 03:28 - 2015-08-21 03:28 - 00060928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Cortana.OneCore.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00057856 _____ (Microsoft Corporation) C:\WINDOWS\system32\hmkd.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\system32\omadmprc.exe
2015-08-21 03:28 - 2015-08-21 03:28 - 00046080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\UcmUcsi.sys
2015-08-21 03:28 - 2015-08-21 03:28 - 00045056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hmkd.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00037376 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2015-08-21 03:28 - 2015-08-21 03:28 - 00032768 _____ C:\WINDOWS\system32\LicenseManagerApi.dll
2015-08-21 03:24 - 2015-08-21 03:24 - 00008192 _____ C:\WINDOWS\system32\config\userdiff
2015-08-21 03:21 - 2015-08-21 03:21 - 00000000 ____D C:\Program Files\Reference Assemblies
2015-08-21 03:21 - 2015-08-21 03:21 - 00000000 ____D C:\Program Files\MSBuild
2015-08-21 03:21 - 2015-08-21 03:21 - 00000000 ____D C:\Program Files (x86)\Reference Assemblies
2015-08-21 03:21 - 2015-08-21 03:21 - 00000000 ____D C:\inetpub
2015-08-21 03:21 - 2015-08-21 00:02 - 00000000 ____D C:\Program Files (x86)\MSBuild
2015-08-21 03:20 - 2015-06-17 22:10 - 01166520 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationNative_v0300.dll
2015-08-21 03:20 - 2015-06-17 22:10 - 00124112 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2015-08-21 03:20 - 2015-06-17 22:10 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe
2015-08-21 03:20 - 2015-05-30 01:07 - 00778936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationNative_v0300.dll
2015-08-21 03:20 - 2015-05-30 01:07 - 00102608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-08-21 03:20 - 2015-05-30 01:07 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe
2015-08-21 01:36 - 2015-08-25 08:37 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2015-08-21 01:36 - 2015-08-21 01:36 - 00001467 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2015-08-21 01:36 - 2015-08-21 01:36 - 00001455 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2015-08-21 01:36 - 2015-08-21 01:36 - 00000000 ____D C:\WINDOWS\System32\Tasks\Safer-Networking
2015-08-21 01:36 - 2015-08-21 01:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2015-08-21 01:36 - 2015-06-16 17:32 - 00020760 _____ (Safer-Networking Ltd.) C:\WINDOWS\system32\sdnclean64.exe
2015-08-21 01:29 - 2015-08-21 01:30 - 00002394 _____ C:\Users\Carolyn_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2015-08-21 01:26 - 2015-08-22 03:43 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-08-21 01:25 - 2015-08-21 01:25 - 00000000 ____D C:\ProgramData\Microsoft OneDrive
2015-08-21 01:22 - 2015-08-21 01:22 - 00000000 ____D C:\Users\Carolyn_2\AppData\Local\Publishers
2015-08-21 01:21 - 2015-08-21 01:23 - 00000000 ____D C:\Users\Carolyn_2\AppData\Local\Comms
2015-08-21 01:20 - 2015-08-21 01:20 - 00000451 _____ C:\WINDOWS\system32\{F33C3B9B-72AF-418A-B3FD-560646F7CDA2}.bat
2015-08-21 01:20 - 2015-08-21 01:20 - 00000020 ___SH C:\Users\Carolyn_2\ntuser.ini
2015-08-21 01:20 - 2015-08-21 01:20 - 00000000 ____D C:\Users\Carolyn_2\AppData\Local\TileDataLayer
2015-08-21 00:22 - 2015-08-21 00:22 - 00000000 __SHD C:\Recovery
2015-08-21 00:17 - 2015-08-21 00:17 - 00022744 _____ C:\WINDOWS\system32\emptyregdb.dat
2015-08-21 00:07 - 2015-08-21 00:07 - 00000000 ____D C:\Users\Default\AppData\Roaming\TuneUp Software
2015-08-21 00:07 - 2015-08-21 00:07 - 00000000 ____D C:\Users\Default User\AppData\Roaming\TuneUp Software
2015-08-21 00:04 - 2015-07-10 06:59 - 02718208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2015-08-21 00:00 - 2015-08-21 00:00 - 00000000 ____D C:\Users\Default\Documents\hp.system.package.metadata
2015-08-21 00:00 - 2015-08-21 00:00 - 00000000 ____D C:\Users\Default User\Documents\hp.system.package.metadata
2015-08-20 23:59 - 2015-08-20 23:59 - 00001519 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-08-20 23:50 - 2015-08-20 23:50 - 00000000 ____D C:\WINDOWS\system32\config\bbimigrate
2015-08-20 23:48 - 2015-08-22 03:36 - 00000000 ____D C:\Users\Carolyn_2
2015-08-20 23:48 - 2015-08-21 01:20 - 00000000 ___RD C:\Users\Carolyn_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-08-20 23:48 - 2015-07-10 07:04 - 00000000 __RSD C:\Users\Carolyn_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell
2015-08-20 23:48 - 2015-07-10 07:04 - 00000000 ___RD C:\Users\Carolyn_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-08-20 23:48 - 2015-07-10 07:04 - 00000000 ___RD C:\Users\Carolyn_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2015-08-20 23:48 - 2015-07-10 07:04 - 00000000 ____D C:\Users\Carolyn_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2015-08-20 23:46 - 2015-08-26 19:48 - 01280100 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-08-20 23:46 - 2015-08-20 23:50 - 00011587 _____ C:\WINDOWS\iis.log
2015-08-20 23:46 - 2015-08-20 23:46 - 00925184 _____ C:\WINDOWS\SysWOW64\PerfStringBackup.INI
2015-08-20 23:43 - 2015-08-20 23:43 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_Kernel_SynTP_01011.Wdf
2015-08-20 23:43 - 2015-08-20 23:43 - 00000000 ____D C:\WINDOWS\SysWOW64\sda
2015-08-20 23:43 - 2015-08-20 23:43 - 00000000 ____D C:\WINDOWS\SysWOW64\RTCOM
2015-08-20 23:43 - 2015-08-20 23:43 - 00000000 ____D C:\WINDOWS\system32\SRSLabs
2015-08-20 23:43 - 2015-08-20 23:43 - 00000000 ____D C:\Program Files\Realtek
2015-08-20 23:43 - 2015-08-20 23:43 - 00000000 ____D C:\Intel
2015-08-20 23:43 - 2015-07-30 22:45 - 00072688 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.DLL
2015-08-20 23:43 - 2015-07-30 22:45 - 00069104 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.DLL
2015-08-20 23:42 - 2015-08-20 23:51 - 00000000 ____D C:\Program Files\Intel
2015-08-20 23:42 - 2015-08-20 23:42 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_Kernel_Smb_driver_Intel_01011.Wdf
2015-08-20 23:42 - 2015-08-20 23:42 - 00000000 ____D C:\Program Files\Synaptics
2015-08-20 23:40 - 2015-08-20 23:40 - 00038075 _____ C:\WINDOWS\system32\NetSetupMig.log
2015-08-20 23:39 - 2015-08-26 19:40 - 00038160 _____ C:\WINDOWS\PFRO.log
2015-08-20 23:01 - 2015-08-21 00:18 - 00006611 _____ C:\WINDOWS\comsetup.log
2015-08-20 23:00 - 2015-08-21 00:21 - 00009528 _____ C:\WINDOWS\diagwrn.xml
2015-08-20 23:00 - 2015-08-21 00:21 - 00009528 _____ C:\WINDOWS\diagerr.xml
2015-08-20 08:48 - 2015-08-20 08:48 - 03173296 _____ ( ) C:\Users\Carolyn_2\Downloads\TuneUp_Remover.exe
2015-08-16 19:22 - 2015-08-21 00:02 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-08-13 20:59 - 2015-08-21 00:02 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-08-13 20:59 - 2015-08-13 20:59 - 00001772 _____ C:\Users\Public\Desktop\iTunes.lnk
2015-08-13 20:57 - 2015-08-13 20:59 - 00000000 ____D C:\Program Files\iTunes
2015-08-13 20:57 - 2015-08-13 20:57 - 00000000 ____D C:\Program Files\iPod
2015-08-13 20:57 - 2015-08-13 20:57 - 00000000 ____D C:\Program Files (x86)\iTunes
2015-08-13 08:51 - 2015-08-13 08:51 - 00002250 _____ C:\Users\Carolyn_2\Desktop\HP Support Assistant.lnk
2015-08-13 08:48 - 2015-08-13 08:48 - 00000000 ____D C:\ProgramData\{C6FA530F-BB98-4D9F-BA00-45FD0698077C}
2015-08-13 08:46 - 2015-08-13 08:46 - 39836392 _____ (Hewlett-Packard ) C:\Users\Carolyn_2\Downloads\sp71727 (1).exe
2015-08-13 08:45 - 2015-08-13 08:46 - 39836392 _____ (Hewlett-Packard ) C:\Users\Carolyn_2\Downloads\sp71727.exe
2015-08-13 08:17 - 2015-08-13 08:17 - 00000000 ____D C:\Users\Carolyn_2\AppData\Roaming\hpqLog
2015-08-11 12:37 - 2015-08-11 12:37 - 00029696 _____ C:\Users\Carolyn_2\Downloads\mozambique.wps
2015-08-11 12:37 - 2015-08-11 12:37 - 00029696 _____ C:\Users\Carolyn_2\Downloads\mozambique (1).wps
2015-08-09 20:53 - 2015-08-13 08:42 - 00000000 ____D C:\Program Files (x86)\BocaMonitor
2015-08-07 10:12 - 2015-08-07 10:12 - 00828356 _____ C:\Users\Carolyn_2\Downloads\IAPF (2).pages
2015-08-07 10:11 - 2015-08-07 10:11 - 00273024 _____ C:\Users\Carolyn_2\Downloads\Fwd_ flyer - carolynchichester@gmail.com - Gmail.html
2015-08-07 09:15 - 2015-08-07 09:15 - 00828356 _____ C:\Users\Carolyn_2\Downloads\IAPF.pages
2015-08-04 21:54 - 2015-08-04 21:54 - 00008746 _____ C:\Users\Carolyn_2\Desktop\New Microsoft Excel Worksheet.xlsx
2015-08-04 21:54 - 2015-08-04 21:54 - 00004544 _____ C:\Users\Carolyn_2\Desktop\New Journal Document.jnt
2015-08-04 21:54 - 2015-08-04 21:54 - 00000000 ___RD C:\Users\Carolyn_2\Documents\Notes
2015-08-04 08:54 - 2015-08-04 08:54 - 00000000 ____D C:\Users\Carolyn_2\AppData\Local\Evernote
2015-07-31 09:02 - 2015-07-31 10:13 - 00000000 ____D C:\Users\Carolyn_2\AppData\Local\LogMeIn Rescue Calling Card
2015-07-31 08:41 - 2015-08-26 19:48 - 00000000 ____D C:\Users\Carolyn_2\AppData\Roaming\DropboxOEM
2015-07-30 22:46 - 2015-07-30 22:46 - 12334064 _____ (Intel Corporation) C:\WINDOWS\system32\igd10iumd64.dll
2015-07-30 22:46 - 2015-07-30 22:46 - 11905424 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igd10iumd32.dll
2015-07-30 22:46 - 2015-07-30 22:46 - 11053040 _____ (Intel Corporation) C:\WINDOWS\system32\igdumdim64.dll
2015-07-30 22:46 - 2015-07-30 22:46 - 10574976 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdumdim32.dll
2015-07-30 22:46 - 2015-07-30 22:46 - 04636608 _____ (Intel Corporation) C:\WINDOWS\system32\igdusc64.dll
2015-07-30 22:46 - 2015-07-30 22:46 - 03668768 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdusc32.dll
2015-07-30 22:46 - 2015-07-30 22:46 - 01155984 _____ (Intel Corporation) C:\WINDOWS\system32\iglhsip64.dll
2015-07-30 22:46 - 2015-07-30 22:46 - 01151832 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\iglhsip32.dll
2015-07-30 22:46 - 2015-07-30 22:46 - 00467688 _____ (Intel Corporation) C:\WINDOWS\system32\igdmd64.dll
2015-07-30 22:46 - 2015-07-30 22:46 - 00378816 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdmd32.dll
2015-07-30 22:46 - 2015-07-30 22:46 - 00229648 _____ (Intel Corporation) C:\WINDOWS\system32\iglhcp64.dll
2015-07-30 22:46 - 2015-07-30 22:46 - 00199080 _____ (Intel Corporation) C:\WINDOWS\system32\igfxcmrt64.dll
2015-07-30 22:46 - 2015-07-30 22:46 - 00194352 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\iglhcp32.dll
2015-07-30 22:46 - 2015-07-30 22:46 - 00169352 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igfxcmrt32.dll
2015-07-30 22:46 - 2015-07-30 22:46 - 00040704 _____ (Intel Corporation) C:\WINDOWS\system32\igfxexps.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 22914032 _____ (Intel Corporation) C:\WINDOWS\system32\igdfcl64.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 17846768 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdfcl32.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 08528880 _____ (Intel Corporation) C:\WINDOWS\system32\ig7icd64.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 06512112 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\ig7icd32.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 04371872 _____ (Intel Corporation) C:\WINDOWS\system32\Gfxv4_0.exe
2015-07-30 22:45 - 2015-07-30 22:45 - 04368288 _____ (Intel Corporation) C:\WINDOWS\system32\Gfxv2_0.exe
2015-07-30 22:45 - 2015-07-30 22:45 - 04024368 _____ (Intel Corporation) C:\WINDOWS\system32\IntelWiDiAAC64.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 03797960 _____ (Intel Corporation) C:\WINDOWS\system32\Drivers\igdkmd64.sys
2015-07-30 22:45 - 2015-07-30 22:45 - 02508272 _____ (Intel Corporation) C:\WINDOWS\system32\IntelWiDiVAD64.exe
2015-07-30 22:45 - 2015-07-30 22:45 - 02035696 _____ (Intel Corporation) C:\WINDOWS\system32\igfxcmjit64.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 01994224 _____ (Intel Corporation) C:\WINDOWS\system32\igdrcl64.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 01793008 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdrcl32.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 01766896 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igfxcmjit32.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 01468976 _____ (Intel Corporation) C:\WINDOWS\system32\IntelWiDiSecureSourceFilter64.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00969120 _____ (Intel Corporation) C:\WINDOWS\system32\GfxUIEx.exe
2015-07-30 22:45 - 2015-07-30 22:45 - 00865328 _____ (Intel Corporation) C:\WINDOWS\system32\IntelWiDiWinNextAgent64.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00678896 _____ (Intel Corporation) C:\WINDOWS\system32\igfxDH.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00659504 _____ (Intel Corporation) C:\WINDOWS\system32\IntelWiDiAudioFilter64.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00632816 _____ (Intel Corporation) C:\WINDOWS\system32\MetroIntelGenericUIFramework.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00616496 _____ (Intel Corporation) C:\WINDOWS\system32\IntelWiDiMux64.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00555424 _____ (Intel Corporation) C:\WINDOWS\system32\DPTopologyApp.exe
2015-07-30 22:45 - 2015-07-30 22:45 - 00554912 _____ (Intel Corporation) C:\WINDOWS\system32\DPTopologyAppv2_0.exe
2015-07-30 22:45 - 2015-07-30 22:45 - 00540064 _____ (Intel Corporation) C:\WINDOWS\system32\igfxEM.exe
2015-07-30 22:45 - 2015-07-30 22:45 - 00443296 _____ (Intel Corporation) C:\WINDOWS\system32\IntelWiDiUMS64.exe
2015-07-30 22:45 - 2015-07-30 22:45 - 00409504 _____ (Intel Corporation) C:\WINDOWS\system32\CustomModeApp.exe
2015-07-30 22:45 - 2015-07-30 22:45 - 00408992 _____ (Intel Corporation) C:\WINDOWS\system32\CustomModeAppv2_0.exe
2015-07-30 22:45 - 2015-07-30 22:45 - 00393632 _____ (Intel Corporation) C:\WINDOWS\system32\igfxTray.exe
2015-07-30 22:45 - 2015-07-30 22:45 - 00392688 _____ (Intel Corporation) C:\WINDOWS\system32\igfxOSP.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00385520 _____ (Intel Corporation) C:\WINDOWS\system32\IntelOpenCL64.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00374256 _____ (Intel Corporation) C:\WINDOWS\system32\igdbcl64.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00357936 _____ (Intel Corporation) C:\WINDOWS\system32\IntelWiDiSilenceFilter64.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00329200 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igdbcl32.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00328608 _____ (Intel Corporation) C:\WINDOWS\system32\igfxCUIService.exe
2015-07-30 22:45 - 2015-07-30 22:45 - 00295408 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\IntelOpenCL32.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00290208 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\IntelCpHeciSvc.exe
2015-07-30 22:45 - 2015-07-30 22:45 - 00285168 _____ (Intel Corporation) C:\WINDOWS\system32\igfxDI.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00264176 _____ C:\WINDOWS\system32\igfxCPL.cpl
2015-07-30 22:45 - 2015-07-30 22:45 - 00261104 _____ (Intel Corporation) C:\WINDOWS\system32\igfxLHM.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00256928 _____ (Intel Corporation) C:\WINDOWS\system32\igfxHK.exe
2015-07-30 22:45 - 2015-07-30 22:45 - 00232944 _____ C:\WINDOWS\system32\igdde64.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00228848 _____ (Intel Corporation) C:\WINDOWS\system32\igfxDTCM.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00223792 _____ (Intel Corporation) C:\WINDOWS\system32\IntelWiDiUtils64.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00204192 _____ (Intel Corporation) C:\WINDOWS\system32\igfxext.exe
2015-07-30 22:45 - 2015-07-30 22:45 - 00194544 _____ C:\WINDOWS\SysWOW64\igdde32.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00193520 _____ (Intel Corporation) C:\WINDOWS\system32\igfx11cmrt64.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00191984 _____ (Intel Corporation) C:\WINDOWS\system32\igfxCoIn_v4252.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00191024 _____ (Intel Corporation) C:\WINDOWS\system32\IntelWiDiDDEAgent64.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00170992 _____ C:\WINDOWS\system32\igdail64.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00164256 _____ (Intel Corporation) C:\WINDOWS\system32\difx64.exe
2015-07-30 22:45 - 2015-07-30 22:45 - 00163824 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igfx11cmrt32.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00152560 _____ C:\WINDOWS\SysWOW64\igdail32.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00141872 _____ (Intel Corporation) C:\WINDOWS\system32\IntelWiDiMCUMD64.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00107568 _____ (Intel Corporation) C:\WINDOWS\system32\IntelWiDiLogServer64.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00102896 _____ C:\WINDOWS\system32\IccLibDll_x64.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00095216 _____ C:\WINDOWS\system32\igfxCUIServicePS.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00078320 _____ ( ) C:\WINDOWS\system32\igfxDHLibv2_0.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00072688 _____ (Khronos Group) C:\WINDOWS\system32\Intel_OpenCL_ICD64.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00069104 _____ (Khronos Group) C:\WINDOWS\SysWOW64\Intel_OpenCL_ICD32.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00068080 _____ ( ) C:\WINDOWS\system32\igfxDHLib.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00039408 _____ (Intel Corporation) C:\WINDOWS\SysWOW64\igfxexps32.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00019440 _____ ( ) C:\WINDOWS\system32\igfxDILib.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00018928 _____ ( ) C:\WINDOWS\system32\igfxEMLibv2_0.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00018928 _____ ( ) C:\WINDOWS\system32\igfxEMLib.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00018928 _____ ( ) C:\WINDOWS\system32\igfxDILibv2_0.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00013808 _____ ( ) C:\WINDOWS\system32\igfxLHMLibv2_0.dll
2015-07-30 22:45 - 2015-07-30 22:45 - 00013808 _____ ( ) C:\WINDOWS\system32\igfxLHMLib.dll
2015-07-30 11:26 - 2015-08-17 11:58 - 00000052 _____ C:\WINDOWS\SysWOW64\DOErrors.log
2015-07-30 11:26 - 2015-07-30 11:26 - 00000000 ____D C:\Users\Carolyn_2\AppData\Local\Hewlett-Packard
2015-07-29 10:41 - 2015-07-29 10:50 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2015-07-29 10:41 - 2015-07-29 10:41 - 00001062 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk
2015-07-29 10:41 - 2015-07-29 10:41 - 00001050 _____ C:\Users\Public\Desktop\TeamViewer 10.lnk
2015-07-29 10:41 - 2015-07-29 10:41 - 00000000 ____D C:\Users\Carolyn_2\AppData\Roaming\TeamViewer
2015-07-29 10:40 - 2015-07-29 10:40 - 08096648 _____ (TeamViewer GmbH) C:\Users\Carolyn_2\Downloads\TeamViewer_Setup_en-ckj.exe
2015-07-29 10:19 - 2015-07-29 10:20 - 115414256 _____ C:\Users\Carolyn_2\Downloads\EN4500_198 (2).exe
2015-07-29 10:18 - 2015-07-29 10:18 - 115414256 _____ C:\Users\Carolyn_2\Downloads\EN4500_198 (1).exe
2015-07-29 01:21 - 2015-07-28 17:52 - 00821920 _____ (Safer-Networking Ltd. ) C:\Users\Public\Desktop\Post Win10 Spybot-install.exe
2015-07-28 15:02 - 2015-07-28 15:02 - 00000000 ____D C:\Users\Carolyn_2\AppData\Local\GWX
2015-07-28 13:23 - 2015-08-25 14:33 - 00000000 ___RD C:\Users\Carolyn_2\Dropbox
2015-07-28 13:23 - 2015-08-24 17:59 - 00001249 _____ C:\Users\Carolyn_2\Desktop\Dropbox.lnk
2015-07-28 13:23 - 2015-08-09 23:37 - 00068608 ___SH C:\Users\Carolyn_2\Downloads\Thumbs.db
2015-07-28 13:16 - 2015-07-28 13:16 - 00000000 ____D C:\Users\Carolyn_2\AppData\Roaming\Dropbox
2015-07-28 13:16 - 2015-05-25 09:23 - 00036864 _____ (Microsoft Corporation) C:\WINDOWS\system32\UtcResources.dll
2015-07-28 13:15 - 2015-08-26 20:20 - 00000936 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job
2015-07-28 13:15 - 2015-08-26 19:42 - 00000932 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job
2015-07-28 13:15 - 2015-08-24 18:00 - 00000000 ____D C:\Users\Carolyn_2\AppData\Local\Dropbox
2015-07-28 13:15 - 2015-08-21 00:17 - 00004018 _____ C:\WINDOWS\System32\Tasks\DropboxUpdateTaskMachineUA
2015-07-28 13:15 - 2015-08-21 00:17 - 00003782 _____ C:\WINDOWS\System32\Tasks\DropboxUpdateTaskMachineCore
2015-07-28 13:15 - 2015-07-28 13:15 - 00660960 _____ (Dropbox, Inc.) C:\Users\Carolyn_2\Downloads\DropboxInstaller.exe
2015-07-28 13:15 - 2015-07-28 13:15 - 00000000 ____D C:\ProgramData\Dropbox
2015-07-28 11:02 - 2015-07-28 11:02 - 00312752 ____N (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgidsdrivera.sys
2015-07-27 11:21 - 2015-07-27 11:21 - 00560976 _____ (Safer-Networking Ltd. ) C:\Users\Carolyn_2\Downloads\spybot2-license (2).exe
2015-07-27 09:40 - 2015-07-27 09:40 - 00560976 _____ (Safer-Networking Ltd. ) C:\Users\Carolyn_2\Downloads\spybot2-license (1).exe
2015-07-27 09:39 - 2015-07-27 09:39 - 00560976 _____ (Safer-Networking Ltd. ) C:\Users\Carolyn_2\Downloads\spybot2-license.exe
2015-07-27 09:30 - 2013-08-22 09:25 - 00000824 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20150727-093059.backup

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-08-26 20:42 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\system32\sru
2015-08-26 19:48 - 2014-10-23 10:11 - 00000000 ____D C:\Program Files (x86)\Dropbox
2015-08-26 19:47 - 2015-07-23 09:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
2015-08-26 19:45 - 2015-07-23 11:29 - 00000000 ____D C:\Users\Carolyn_2\Documents\Youcam
2015-08-26 19:44 - 2015-07-23 11:48 - 00004162 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{0F5C8EAB-0DBD-444C-B5BC-498764A3C084}
2015-08-26 19:41 - 2015-07-23 09:20 - 00000924 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-08-26 19:41 - 2015-07-10 08:22 - 00000275 _____ C:\WINDOWS\WindowsUpdate.log
2015-08-26 19:40 - 2015-07-10 08:21 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-08-26 19:40 - 2015-07-10 05:05 - 00524288 ___SH C:\WINDOWS\system32\config\BBI
2015-08-26 19:30 - 2014-12-26 04:31 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-08-26 19:03 - 2014-12-26 04:31 - 00000000 ____D C:\ProgramData\WildTangent
2015-08-26 19:03 - 2014-12-26 04:31 - 00000000 ____D C:\Program Files (x86)\WildTangent Games
2015-08-26 15:32 - 2015-07-23 12:16 - 00000000 ____D C:\Users\Carolyn_2\Documents\spending plan
2015-08-26 09:19 - 2015-07-23 12:16 - 00000000 ___RD C:\Users\Carolyn_2\Documents\IAPF FUNDRAISER
2015-08-26 05:51 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-08-24 17:15 - 2015-07-23 12:13 - 00001331 _____ C:\Users\Carolyn_2\Desktop\Amazon Music.lnk
2015-08-24 17:15 - 2015-07-23 12:11 - 00002474 _____ C:\Users\Carolyn_2\Desktop\Kindle.lnk
2015-08-24 16:04 - 2015-07-23 12:47 - 00000000 ____D C:\ProgramData\MFAData
2015-08-24 16:01 - 2015-07-23 12:45 - 00000000 ____D C:\WINDOWS\AutoKMS
2015-08-24 15:00 - 2015-07-10 07:04 - 00000000 ___HD C:\WINDOWS\ELAMBKUP
2015-08-24 08:59 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\rescache
2015-08-24 08:39 - 2015-07-23 12:29 - 00000000 ____D C:\Users\Carolyn_2\AppData\Local\Microsoft Help
2015-08-23 07:05 - 2014-12-26 04:29 - 00000000 ____D C:\ProgramData\CyberLink
2015-08-23 07:04 - 2014-12-26 05:24 - 00000000 ____D C:\Users\Public\Documents\CyberLink
2015-08-23 07:04 - 2014-12-26 04:39 - 00000000 ____D C:\Users\Public\CyberLink
2015-08-22 20:37 - 2015-07-23 11:29 - 00000000 ____D C:\Users\Carolyn_2\AppData\Local\CyberLink
2015-08-22 03:40 - 2015-07-23 12:45 - 00003536 _____ C:\WINDOWS\System32\Tasks\AutoKMS
2015-08-22 03:35 - 2015-07-23 09:20 - 00002936 _____ C:\WINDOWS\SysWOW64\LavasoftTcpServiceOff.ini
2015-08-22 03:35 - 2015-07-23 09:20 - 00002936 _____ C:\WINDOWS\system32\LavasoftTcpServiceOff.ini
2015-08-22 03:35 - 2015-07-10 08:20 - 00358560 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-08-22 03:31 - 2015-07-10 07:04 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-08-22 03:31 - 2015-07-10 07:04 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-08-22 03:31 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2015-08-22 03:31 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\system32\oobe
2015-08-22 03:31 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\system32\appraiser
2015-08-22 03:31 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\Provisioning
2015-08-21 09:58 - 2015-07-23 11:28 - 00000000 ____D C:\Users\Carolyn_2\AppData\Local\Packages
2015-08-21 09:42 - 2015-07-10 06:55 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-08-21 09:34 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\system32\restore
2015-08-21 09:09 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\appcompat
2015-08-21 03:38 - 2015-07-10 07:04 - 00028672 _____ C:\WINDOWS\system32\config\BCD-Template
2015-08-21 03:30 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\SysWOW64\oobe
2015-08-21 03:30 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\system32\SystemResetPlatform
2015-08-21 03:30 - 2015-07-10 05:05 - 00000000 ____D C:\WINDOWS\SysWOW64\Dism
2015-08-21 03:30 - 2015-07-10 05:05 - 00000000 ____D C:\WINDOWS\system32\Dism
2015-08-21 03:21 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\SysWOW64\inetsrv
2015-08-21 03:21 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\system32\inetsrv
2015-08-21 03:20 - 2015-07-10 07:01 - 00168960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iisRtl.dll
2015-08-21 03:20 - 2015-07-10 07:01 - 00050688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\admwprox.dll
2015-08-21 03:20 - 2015-07-10 07:01 - 00026112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ahadmin.dll
2015-08-21 03:20 - 2015-07-10 07:01 - 00016896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iisreset.exe
2015-08-21 03:20 - 2015-07-10 07:01 - 00011264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wamregps.dll
2015-08-21 03:20 - 2015-07-10 07:01 - 00010240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iisrstap.dll
2015-08-21 03:20 - 2015-07-10 07:00 - 00202240 _____ (Microsoft Corporation) C:\WINDOWS\system32\iisRtl.dll
2015-08-21 03:20 - 2015-07-10 07:00 - 00055808 _____ (Microsoft Corporation) C:\WINDOWS\system32\admwprox.dll
2015-08-21 03:20 - 2015-07-10 07:00 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\system32\ahadmin.dll
2015-08-21 03:20 - 2015-07-10 07:00 - 00018432 _____ (Microsoft Corporation) C:\WINDOWS\system32\iisreset.exe
2015-08-21 03:20 - 2015-07-10 07:00 - 00015360 _____ (Microsoft Corporation) C:\WINDOWS\system32\wamregps.dll
2015-08-21 03:20 - 2015-07-10 07:00 - 00013312 _____ (Microsoft Corporation) C:\WINDOWS\system32\iisrstap.dll
2015-08-21 01:22 - 2015-07-10 07:04 - 00000000 ___RD C:\WINDOWS\PurchaseDialog
2015-08-21 01:22 - 2015-07-10 07:04 - 00000000 ___RD C:\WINDOWS\PrintDialog
2015-08-21 01:22 - 2015-07-10 07:04 - 00000000 ___RD C:\WINDOWS\MiracastView
2015-08-21 01:21 - 2015-07-10 07:04 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2015-08-21 01:20 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\system32\WinBioDatabase
2015-08-21 00:21 - 2015-07-10 08:20 - 00015742 _____ C:\WINDOWS\setupact.log
2015-08-21 00:19 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\Registration
2015-08-21 00:17 - 2015-07-26 21:19 - 00003738 _____ C:\WINDOWS\System32\Tasks\HPCustParticipation HP ENVY 4500 series
2015-08-21 00:17 - 2015-07-23 11:44 - 00003706 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-212272962-4250710869-947374074-1004
2015-08-21 00:17 - 2015-07-23 09:20 - 00004010 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2015-08-21 00:17 - 2015-07-23 09:20 - 00003774 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2015-08-21 00:17 - 2015-07-23 00:02 - 00003704 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-212272962-4250710869-947374074-1001
2015-08-21 00:17 - 2014-12-26 04:30 - 00003264 _____ C:\WINDOWS\System32\Tasks\YCMServiceAgent
2015-08-21 00:12 - 2015-07-10 07:04 - 00000000 __RHD C:\Users\Public\Libraries
2015-08-21 00:10 - 2015-07-23 12:53 - 00000000 ____D C:\Program Files\Common Files\AV
2015-08-21 00:02 - 2015-07-26 21:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2015-08-21 00:02 - 2015-07-23 12:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SharePoint
2015-08-21 00:02 - 2015-07-23 12:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2015-08-21 00:02 - 2015-07-23 09:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-08-21 00:02 - 2015-07-10 09:14 - 00000000 ____D C:\WINDOWS\ShellNew
2015-08-21 00:02 - 2015-07-10 05:05 - 00032768 ___SH C:\WINDOWS\system32\config\ELAM
2015-08-21 00:02 - 2014-12-26 04:30 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Communication and Chat
2015-08-21 00:02 - 2014-10-23 10:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Help and Support
2015-08-21 00:02 - 2014-10-23 10:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security and Protection
2015-08-21 00:02 - 2014-10-23 10:05 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Productivity and Tools
2015-08-21 00:00 - 2015-07-10 07:05 - 00004362 _____ C:\WINDOWS\DtcInstall.log
2015-08-21 00:00 - 2013-08-22 09:36 - 00000000 ____D C:\Users\Default.migrated
2015-08-20 23:54 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\SysWOW64\zh-HK
2015-08-20 23:54 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\SysWOW64\uk-UA
2015-08-20 23:54 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\SysWOW64\tr-TR
2015-08-20 23:54 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\SysWOW64\th-TH
2015-08-20 23:54 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\SysWOW64\sr-Latn-RS
2015-08-20 23:54 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\SysWOW64\sl-SI
2015-08-20 23:54 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\SysWOW64\sk-SK
2015-08-20 23:54 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\SysWOW64\ro-RO
2015-08-20 23:54 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\SysWOW64\lv-LV
2015-08-20 23:54 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\SysWOW64\lt-LT
2015-08-20 23:54 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\SysWOW64\hr-HR
2015-08-20 23:54 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\SysWOW64\he-IL
2015-08-20 23:54 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\SysWOW64\et-EE
2015-08-20 23:54 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\SysWOW64\en-GB
2015-08-20 23:54 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\SysWOW64\bg-BG
2015-08-20 23:54 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\SysWOW64\ar-SA
2015-08-20 23:54 - 2014-10-23 10:08 - 00000000 ____D C:\WINDOWS\SysWOW64\Adobe
2015-08-20 23:53 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\system32\zh-HK
2015-08-20 23:53 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\system32\uk-UA
2015-08-20 23:53 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\system32\tr-TR
2015-08-20 23:53 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\system32\th-TH
2015-08-20 23:53 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\system32\sr-Latn-RS
2015-08-20 23:53 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\system32\spool
2015-08-20 23:53 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\system32\sl-SI
2015-08-20 23:53 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\system32\sk-SK
2015-08-20 23:53 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\system32\ro-RO
2015-08-20 23:53 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\system32\NDF
2015-08-20 23:53 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\system32\lv-LV
2015-08-20 23:53 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\system32\lt-LT
2015-08-20 23:53 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\system32\InputMethod
2015-08-20 23:53 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\system32\hr-HR
2015-08-20 23:53 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\system32\he-IL
2015-08-20 23:53 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\system32\et-EE
2015-08-20 23:53 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\system32\en-GB
2015-08-20 23:53 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\system32\WindowsInternal.Inbox.Shared
2015-08-20 23:53 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\system32\WindowsInternal.Inbox.Media.Shared
2015-08-20 23:52 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\system32\bg-BG
2015-08-20 23:52 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\system32\ar-SA
2015-08-20 23:52 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\MediaViewer
2015-08-20 23:51 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\InputMethod
2015-08-20 23:51 - 2015-07-10 07:04 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2015-08-20 23:51 - 2014-10-23 10:01 - 00000000 ____D C:\Program Files (x86)\Hewlett-Packard
2015-08-20 23:51 - 2013-08-22 11:36 - 00000000 ____D C:\WINDOWS\ADFS
2015-08-20 23:50 - 2015-07-10 07:04 - 00000000 ____D C:\WINDOWS\system32\Recovery
2015-08-20 23:49 - 2015-07-23 13:05 - 00000000 ____D C:\Users\Carolyn_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon
2015-08-20 23:45 - 2015-07-10 05:05 - 00000000 ____D C:\WINDOWS\system32\Sysprep
2015-08-20 23:39 - 2015-07-10 05:05 - 00000000 __RHD C:\Users\Default
2015-08-20 23:09 - 2015-07-22 23:44 - 01361492 _____ C:\WINDOWS\WindowsUpdate (1).log
2015-08-20 23:01 - 2015-07-10 09:39 - 00000000 ___HD C:\$Windows.~BT
2015-08-20 16:26 - 2015-07-23 09:21 - 00002210 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-08-16 16:53 - 2015-07-26 22:24 - 00000000 ____D C:\Users\Carolyn_2\AppData\Local\Avg
2015-08-14 02:52 - 2015-07-25 19:44 - 00000000 ____D C:\WINDOWS\system32\MRT
2015-08-14 02:40 - 2015-07-25 19:44 - 132483416 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-08-14 02:37 - 2015-07-23 12:29 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-08-13 20:57 - 2015-07-23 12:46 - 00000000 ____D C:\ProgramData\Apple Computer
2015-08-13 20:57 - 2015-07-23 12:44 - 00000000 ____D C:\Program Files\Common Files\Apple
2015-08-13 08:58 - 2014-10-23 10:14 - 00000000 ____D C:\WINDOWS\System32\Tasks\Hewlett-Packard
2015-08-13 08:58 - 2014-10-23 10:12 - 00000000 ____D C:\ProgramData\Hewlett-Packard
2015-08-13 08:52 - 2014-10-23 10:06 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2015-08-13 08:46 - 2014-04-04 19:55 - 00000000 ____D C:\SWSetup
2015-08-09 20:53 - 2015-07-23 12:27 - 00000000 ____D C:\ProgramData\7d6e32ca000074d2
2015-08-08 14:40 - 2015-07-23 12:11 - 00000000 ____D C:\Users\Carolyn_2\Desktop\IAPF
2015-08-08 11:38 - 2015-07-10 07:06 - 00794088 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-08-08 11:38 - 2015-07-10 07:06 - 00179688 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-08-06 11:33 - 2015-07-26 21:18 - 00000000 ____D C:\Program Files (x86)\HP
2015-08-04 08:56 - 2015-07-23 12:11 - 00001938 _____ C:\Users\carolyn\Desktop\Windows Photo Gallery.lnk
2015-08-04 08:47 - 2015-07-23 11:48 - 00000000 __SHD C:\Users\Carolyn_2\AppData\Local\EmieUserList
2015-08-04 08:47 - 2015-07-23 11:48 - 00000000 __SHD C:\Users\Carolyn_2\AppData\Local\EmieSiteList
2015-07-28 12:15 - 2015-07-23 12:12 - 00026112 ___SH C:\Users\Carolyn_2\Desktop\Thumbs.db
2015-07-28 10:23 - 2015-07-23 11:28 - 00000000 ____D C:\Users\Carolyn_2\AppData\Local\VirtualStore
2015-07-27 10:18 - 2013-08-22 11:36 - 00000000 ___RD C:\WINDOWS\ToastData

==================== Files in the root of some directories =======

2015-07-26 21:18 - 2015-07-26 21:18 - 0000057 _____ () C:\ProgramData\Ament.ini

Some files in TEMP:
====================
C:\Users\Carolyn_2\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmprxspbc.dll


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-08-20 23:39

==================== End of FRST.txt ============================
Additional scan result of Farbar Recovery Scan Tool (x64) Version:26-08-2015
Ran by Carolyn_2 (2015-08-26 20:51:33)
Running from C:\Users\Carolyn_2\Downloads
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-212272962-4250710869-947374074-500 - Administrator - Disabled)
Carolyn_2 (S-1-5-21-212272962-4250710869-947374074-1004 - Administrator - Enabled) => C:\Users\Carolyn_2
DefaultAccount (S-1-5-21-212272962-4250710869-947374074-503 - Limited - Disabled)
Guest (S-1-5-21-212272962-4250710869-947374074-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-212272962-4250710869-947374074-1003 - Limited - Enabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Spybot - Search and Destroy (Enabled - Up to date) {1A0DDE8C-B4BA-EFDD-22A8-0F557C7985F0}
AS: Spybot - Search and Destroy (Enabled - Up to date) {A16C3F68-9280-E053-1818-342707FECF4D}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.4.144 - Adobe Systems, Inc.)
Amazon Kindle (HKU\S-1-5-21-212272962-4250710869-947374074-1004\...\Amazon Kindle) (Version: - Amazon)
Amazon Music (HKU\S-1-5-21-212272962-4250710869-947374074-1004\...\Amazon Amazon Music) (Version: 3.10.0.928 - Amazon Services LLC)
Apple Application Support (32-bit) (HKLM-x32\...\{7FE25256-B7C1-480D-B736-10A67A833AEA}) (Version: 3.2 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{B255D495-4734-4E9B-B4F5-96702FD4A7B9}) (Version: 3.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{5D61F006-168C-4B8B-B7FD-F113C10AE0E4}) (Version: 8.2.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
BocaMonitor (HKLM-x32\...\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{4519cfe8}) (Version: - Software Publisher) <==== ATTENTION
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{AF312B06-5C5C-468E-89B3-BE6DE2645722}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{0A4EF0E6-A912-4CDE-A7F3-6E56E7C13A2F}) (Version: 1.1.6 - Cisco Systems, Inc.)
CyberLink Media Suite 10 (HKLM-x32\...\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.8.4420 - CyberLink Corp.)
Cyberlink PhotoDirector (HKLM-x32\...\InstallShield_{5A454EC5-217A-42a5-8CE1-2DDEC4E70E01}) (Version: 5.0.3.5715 - CyberLink Corp.)
Cyberlink PhotoDirector (Version: 5.0.3.5715 - CyberLink Corp.) Hidden
CyberLink Power Media Player 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.5.4505 - CyberLink Corp.)
CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.8.4316 - CyberLink Corp.)
CyberLink PowerBackup 2.6 (HKLM-x32\...\InstallShield_{ADD5DB49-72CF-11D8-9D75-000129760D75}) (Version: 2.6.1.0903 - CyberLink Corp.)
CyberLink PowerDirector 12 (HKLM-x32\...\InstallShield_{E1646825-D391-42A0-93AA-27FA810DA093}) (Version: 12.0.2.3324 - CyberLink Corp.)
CyberLink PowerDirector 12 (Version: 12.0.2.3324 - CyberLink Corp.) Hidden
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 5.0.5.4523 - CyberLink Corp.)
DisableMSDefender (Version: 1.0.0 - Hewlett-Packard Company) Hidden
Dropbox (HKLM-x32\...\Dropbox) (Version: 3.8.6 - Dropbox, Inc.)
Dropbox Update Helper (x32 Version: 1.3.27.35 - Dropbox, Inc.) Hidden
Energy Star (HKLM\...\{465CA2B6-98AF-4E77-BE22-A908C34BB9EC}) (Version: 1.0.9 - Hewlett-Packard Company)
Foxit PhantomPDF (HKLM-x32\...\{89BF1D4D-1D62-451E-9496-B971BDE82720}) (Version: 6.0.33.715 - Foxit Corporation)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 44.0.2403.157 - Google Inc.)
Google Update Helper (x32 Version: 1.3.28.1 - Google Inc.) Hidden
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP Documentation (HKLM-x32\...\{EA7EA537-8F93-42A2-9384-66E7F049E6B0}) (Version: 1.4.0.0 - Hewlett-Packard)
HP ENVY 4500 series Basic Device Software (HKLM\...\{6915424E-704F-4F5D-9057-9C7B406B36DB}) (Version: 32.3.198.49673 - Hewlett-Packard Co.)
HP ENVY 4500 series Help (HKLM-x32\...\{95BECC50-22B4-4FCA-8A2E-BF77713E6D3A}) (Version: 30.0.0 - Hewlett Packard)
HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.7702 - HP)
HP Registration Service (HKLM\...\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.7745.4851 - Hewlett-Packard)
HP SimplePass (HKLM-x32\...\InstallShield_{314FAD12-F785-4471-BCE8-AB506642B9A1}) (Version: 8.01.11 - Hewlett-Packard)
HP Support Assistant (HKLM-x32\...\{61EB474B-67A6-47F4-B1B7-386851BAB3D0}) (Version: 8.0.29.6 - Hewlett-Packard Company)
HP Support Solutions Framework (HKLM-x32\...\{D7D5F438-26EF-45AB-AB89-C476FBCF8584}) (Version: 12.0.30.81 - Hewlett-Packard Company)
HP System Event Utility (HKLM-x32\...\{8B4EE87E-6D40-4C91-B5E8-0DC77DC412F1}) (Version: 1.4.1 - Hewlett-Packard Company)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HP Wireless Button Driver (HKLM-x32\...\{30B2D1D8-0A07-4B71-9553-0710C5D31E35}) (Version: 1.1.2.1 - Hewlett-Packard Company)
Inst5675 (Version: 8.01.11 - Softex Inc.) Hidden
Inst5676 (Version: 8.01.11 - Softex Inc.) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3958 - Intel Corporation)
Intel(R) Sideband Fabric Device Driver (HKLM-x32\...\C5A8BC6E-723A-4C0F-96E1-C426D1A4BCA9) (Version: 1.70.305.16316 - Intel Corporation)
Intel(R) Trusted Execution Engine (HKLM\...\{176E2755-0A17-42C6-88E2-192AB2131278}) (Version: 1.0.0.1064 - Intel Corporation)
iTunes (HKLM\...\{BFEAB774-C7DC-4032-B05A-DA5F7CB7B365}) (Version: 12.2.2.25 - Apple Inc.)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.4734.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Product Improvement Study for HP ENVY 4500 series (HKLM\...\{58139103-BACF-4BDC-B71C-955F9164ADA6}) (Version: 32.3.198.49673 - Hewlett-Packard Co.)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.9600.29082 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller All-In-One Windows Driver (HKLM-x32\...\{F7E7F0CB-AA41-4D5A-B6F2-8E6738EB063F}) (Version: 8.35.716.2014 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7535 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\...\{A5107464-AA9B-4177-8129-5FF2F42DD322}) (Version: 1.0.0.38 - REALTEK Semiconductor Corp.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.5.43 - Safer-Networking Ltd.)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 19.0.12.95 - Synaptics Incorporated)
TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.45471 - TeamViewer)
Tweaking.com - Registry Backup (HKLM-x32\...\Tweaking.com - Registry Backup) (Version: 3.2.0 - Tweaking.com)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-212272962-4250710869-947374074-1004_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InprocServer32 -> C:\Windows\system32\shell32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-212272962-4250710869-947374074-1004_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 -> C:\Users\Carolyn_2\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-212272962-4250710869-947374074-1004_Classes\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32 -> C:\Users\Carolyn_2\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-212272962-4250710869-947374074-1004_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 -> C:\Users\Carolyn_2\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-212272962-4250710869-947374074-1004_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-212272962-4250710869-947374074-1004_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 -> C:\Users\Carolyn_2\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-212272962-4250710869-947374074-1004_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Carolyn_2\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-212272962-4250710869-947374074-1004_Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32 -> C:\Users\Carolyn_2\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-212272962-4250710869-947374074-1004_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Carolyn_2\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-212272962-4250710869-947374074-1004_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Carolyn_2\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-212272962-4250710869-947374074-1004_Classes\CLSID\{E31EA727-12ED-4702-820C-4B6445F28E1A}\InprocServer32 -> C:\Windows\system32\shell32.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-212272962-4250710869-947374074-1004_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Carolyn_2\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-212272962-4250710869-947374074-1004_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Carolyn_2\AppData\Local\Microsoft\OneDrive\17.3.5930.0814\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points =========================

21-08-2015 09:34:10 Windows Update
24-08-2015 14:31:02 Installing COMODO Internet Security Premium
26-08-2015 18:50:46 Removed 7-Zip 9.20 (x64 edition)

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 09:25 - 2015-08-25 08:39 - 00450771 ____R C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123moviedownload.com

There are 1000 more lines.


==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {00EEBA9C-F9EF-4272-B793-C830FBADD359} - System32\Tasks\Microsoft\Windows\ApplicationData\DsSvcCleanup => C:\Windows\system32\dstokenclean.exe [2015-07-10] (Microsoft Corporation)
Task: {03B36647-1CA2-4EEB-A500-A70975EBAFC2} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2015-07-11] (Hewlett-Packard Company)
Task: {058F0C0C-326A-4704-82F7-2A7F980BDEE0} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2015-07-31] (Hewlett-Packard)
Task: {0CCA7916-2916-4F12-BD32-1E3BE31E1269} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Device-Join => C:\Windows\System32\dsregcmd.exe [2015-07-10] (Microsoft Corporation)
Task: {0DA58E52-FD2D-4A3E-88A6-D431AA25DD73} - System32\Tasks\Optimizer Pro Schedule => C:\Program Files (x86)\Optimizer Pro 3.99\OptProLauncher.exe <==== ATTENTION
Task: {0E3D74FB-71DE-402F-A6E4-DD1F604778EE} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {142EC38D-2172-4894-BD32-566F972BCDD8} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {19865544-CE08-40BE-8B8C-87C47681433D} - System32\Tasks\Microsoft\Windows\WindowsUpdate\sihboot => C:\Windows\System32\sihclient.exe [2015-07-10] (Microsoft Corporation)
Task: {1A7A0D75-67B4-4975-9B6C-73932967329E} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {1D6FF1DA-BD5C-40FB-9C53-4C757A16AADC} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2015-07-28] (Dropbox, Inc.)
Task: {1E105897-EC45-49C5-A347-E467A1A1AD57} - System32\Tasks\YCMServiceAgent => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [2014-09-23] (CyberLink Corp.)
Task: {2105522F-3EBD-4B06-A272-E0D1F83FA7A5} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-08-14] (Microsoft Corporation)
Task: {2A815F74-54BE-482E-AADF-711F098E55A6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_CN54B254SM05X4 => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2015-07-31] (Hewlett-Packard)
Task: {3F6E048D-6404-433B-8F5F-CFF4D89BF89E} - System32\Tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser => Rundll32.exe generaltel.dll,RunTelemetryW
Task: {41160EA0-208B-4C3E-B4DB-805BBABC6B93} - System32\Tasks\Microsoft\Windows\Feedback\Siuf\DmClient => C:\Windows\system32\dmclient.exe [2015-07-10] (Microsoft Corporation)
Task: {5C4F67BE-81BF-405C-A914-581A41F09014} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {679C4E60-56C0-4D4C-A151-0137CDE02CA3} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2015-07-28] (Dropbox, Inc.)
Task: {6E8BA798-AFE9-417C-A9E4-F93BD0A84527} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2015-07-11] (Hewlett-Packard Company)
Task: {6F994A7D-BF5E-4B7F-AFB8-CBFBF8BCA0BF} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2015-07-31] (Hewlett-Packard)
Task: {73551810-E5F4-433E-9494-0D00B55C855E} - System32\Tasks\Microsoft\Windows\Maps\MapsToastTask
Task: {78B77FA3-9D97-441D-97B6-68CEA40B4F74} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => Rundll32.exe generaltel.dll,RunTelemetry -maintenance
Task: {797A6BC8-0652-4F33-882F-9A16C413D750} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2015-06-16] (Safer-Networking Ltd.)
Task: {8169C5B0-8578-4475-BA01-3966FBEA8580} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {8A668CFB-141F-4217-AC0B-7A7B8B257B77} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {8DF84CB3-D8E0-4307-A35B-CA74E21786DB} - System32\Tasks\Microsoft\Windows\Clip\License Validation => C:\Windows\system32\ClipUp.exe [2015-08-21] (Microsoft Corporation)
Task: {A2167C38-B94D-4D14-8AEC-16069D00C8CF} - System32\Tasks\AutoKMS => C:\windows\AutoKMS\AutoKMS.exe
Task: {A5B6CD85-1B57-49B9-BA80-5D5D65F02826} - System32\Tasks\Microsoft\Windows\AppID\EDP Policy Manager
Task: {A854DF18-1EC0-4054-A75C-BB034F6EB326} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {AE790338-E08D-49DC-8618-748D358343D1} - System32\Tasks\Microsoft\Windows\RetailDemo\CleanupOfflineContent
Task: {B1297624-2648-4486-995A-2D701494F817} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2015-06-16] (Safer-Networking Ltd.)
Task: {B8AA2B18-DA11-4966-A9B6-FFBAA311AF5A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-07-23] (Google Inc.)
Task: {BA859CCD-740C-4AD2-A91E-69F2F6774972} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {C56AFFD3-06B8-4A16-AF7E-F7A6EB3FAE9E} - System32\Tasks\Microsoft\Windows\TPM\Tpm-HASCertRetr
Task: {C5EE2EA2-5312-4D1F-B9D0-41B18DF31B78} - System32\Tasks\Microsoft\Windows\WindowsUpdate\sih => C:\Windows\System32\sihclient.exe [2015-07-10] (Microsoft Corporation)
Task: {C7A236B2-12E1-46DC-9501-3B1B0209CC09} - System32\Tasks\Microsoft\Windows\Location\WindowsActionDialog => C:\Windows\System32\WindowsActionDialog.exe [2015-07-10] (Microsoft Corporation)
Task: {C99F7006-75A8-403D-91BB-D40606C25507} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Active Health Launcher => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2015-06-19] (Hewlett-Packard)
Task: {CCA01377-9C85-4425-9C7A-DEEA2B6D3239} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-07-23] (Google Inc.)
Task: {D62FDA05-1A17-4152-9B55-9B35F141567D} - System32\Tasks\Microsoft\Windows\SetupSQMTask => C:\WINDOWS\SYSTEM32\OOBE\SETUPSQM.EXE [2015-07-10] (Microsoft Corporation)
Task: {DA66C5B8-297B-45FB-B251-D726CAC07479} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {DEA50866-E34D-48D4-8426-C52A105C33C4} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {DFF722E7-48AD-4995-950E-5635FE635332} - System32\Tasks\HPCustParticipation HP ENVY 4500 series => C:\Program Files\HP\HP ENVY 4500 series\Bin\HPCustPartic.exe [2014-07-21] (Hewlett-Packard Development Company, LP)
Task: {E2E9CC52-67D9-4185-8E9A-F8F759E610AB} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {F043D6B1-6D92-49D6-98B6-09B039909992} - System32\Tasks\HPGenoobeReminder => C:\Program Files (x86)\Hewlett-Packard\HP Registration Service\HP GenOOBE\HPGenOOBE.exe [2014-05-15] ()
Task: {F13EE052-C2B6-4B1F-9980-C9E53B062D86} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {F5A82DAF-77FA-45C3-AAC8-88C217D53EF6} - System32\Tasks\Hewlett-Packard\HP Active Health\HP Active Health Scan (HPSA) => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2015-06-19] (Hewlett-Packard)
Task: {FAEBB038-AE73-4D02-B59A-320E30351F01} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2015-06-16] (Safer-Networking Ltd.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2015-08-21 03:28 - 2015-08-21 03:28 - 00032768 _____ () C:\WINDOWS\SYSTEM32\licensemanagerapi.dll
2014-03-28 16:31 - 2014-03-28 16:31 - 02110464 _____ () C:\Program Files\Hewlett-Packard\SimplePass\autheng.dll
2014-03-28 16:27 - 2014-03-28 16:27 - 00035328 _____ () C:\Program Files\Hewlett-Packard\SimplePass\ssplogon.dll
2014-03-28 16:27 - 2014-03-28 16:27 - 00055296 _____ () C:\Program Files\Hewlett-Packard\SimplePass\RandomPass.dll
2014-03-28 16:27 - 2014-03-28 16:27 - 00021504 _____ () C:\Program Files\Hewlett-Packard\SimplePass\cryptodll.dll
2014-03-28 16:48 - 2014-03-28 16:48 - 00367504 _____ () C:\Program Files\Hewlett-Packard\SimplePass\mstrpwd.dll
2014-03-28 16:48 - 2014-03-28 16:48 - 00712080 _____ () C:\Program Files\Hewlett-Packard\SimplePass\GraphicalPwd.dll
2015-05-15 16:26 - 2015-05-15 16:26 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-05-15 16:26 - 2015-05-15 16:26 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-08-21 09:31 - 2015-08-11 05:14 - 00404480 _____ () C:\WINDOWS\System32\diagtrack_wininternal.dll
2014-12-26 04:54 - 2014-04-14 22:59 - 00389896 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2015-08-21 09:32 - 2015-07-30 02:05 - 02498808 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2015-08-21 09:32 - 2015-07-30 02:05 - 02498808 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2010-01-09 20:17 - 2010-01-09 20:17 - 04254560 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2010-01-21 01:40 - 2010-01-21 01:40 - 08794464 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2014-03-28 16:36 - 2014-03-28 16:36 - 00065024 _____ () C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe
2015-07-10 06:59 - 2015-07-10 06:59 - 00429056 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2015-08-21 09:32 - 2015-08-02 21:11 - 06569472 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2015-07-10 07:00 - 2015-07-10 09:14 - 00471040 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2015-08-21 09:32 - 2015-08-11 04:58 - 01808384 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2015-08-21 09:32 - 2015-08-02 21:09 - 02274816 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2015-07-10 07:00 - 2015-07-10 09:14 - 00210432 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.ProxyStub.dll
2015-08-21 01:36 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-08-21 01:36 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-08-21 01:36 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-08-21 01:36 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2015-08-20 16:26 - 2015-08-18 01:23 - 01405768 _____ () C:\Program Files (x86)\Google\Chrome\Application\44.0.2403.157\libglesv2.dll
2015-08-20 16:26 - 2015-08-18 01:23 - 00081224 _____ () C:\Program Files (x86)\Google\Chrome\Application\44.0.2403.157\libegl.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\carolyn\OneDrive:ms-properties
AlternateDataStreams: C:\Users\Carolyn_2\Downloads\IMG_6983.JPG:$CmdZnID
AlternateDataStreams: C:\Users\Carolyn_2\Downloads\lps-gb-vt-x86.msi:$CmdZnID
AlternateDataStreams: C:\Users\Carolyn_2\Documents\Get Started with Dropbox.pdf:com.dropbox.attributes

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ahcache.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CoreMessagingRegistrar => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\StateRepository => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TileDataModelSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\UserManager => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Ahcache.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CoreMessagingRegistrar => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\StateRepository => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\TileDataModelSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\UserManager => ""="Service"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

There are 7868 more restricted sites.

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-212272962-4250710869-947374074-1004\Control Panel\Desktop\\Wallpaper -> C:\Users\Carolyn_2\Desktop\photos\2013-06-27 rhinos\rhino 20.JPG
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\StartupFolder: => "Start GeekBuddy.lnk"
HKLM\...\StartupApproved\Run: => "iTunesHelper"
HKLM\...\StartupApproved\Run: => "COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10}"
HKLM\...\StartupApproved\Run32: => "AVG_UI"
HKLM\...\StartupApproved\Run32: => "HP Software Update"
HKLM\...\StartupApproved\Run32: => "Dropbox"
HKLM\...\StartupApproved\Run32: => "tvncontrol"
HKU\S-1-5-21-212272962-4250710869-947374074-1004\...\StartupApproved\StartupFolder: => "EvernoteClipper.lnk"
HKU\S-1-5-21-212272962-4250710869-947374074-1004\...\StartupApproved\Run: => "Amazon Music"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{D291767B-21E4-4276-9E47-58A5A8F55326}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{EE1C4285-2F86-46D5-A55C-082C1E067EDD}] => (Allow) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
FirewallRules: [{538BBCD0-A47F-441B-B29B-9B5977F4F957}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{EEF737C6-2C90-41E3-8AE3-2F4E3D03CC29}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{AE200A9A-DA91-48AB-B3D6-1042DE0A6828}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{C5CA6FAB-455D-4B0E-8721-69618DD2BD66}] => (Allow) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPDeviceDetection3.exe
FirewallRules: [{86E10B2E-2CB4-4C63-9E01-7C7685717C95}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{337747F7-F739-4CC6-A60B-AD25718CE736}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{26674CED-5FDA-4B91-9D5B-F056E2C9C585}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{0F6871B2-5402-408E-BEC2-F9C1B70032BD}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{FAE7B903-FCB2-41EE-8D55-C527E1383684}] => (Allow) C:\Users\Carolyn_2\AppData\Local\Temp\7zS71CE\HPDiagnosticCoreUI.exe
FirewallRules: [{A0DECD08-AC31-4F3D-BC7F-562829397099}] => (Allow) C:\Users\Carolyn_2\AppData\Local\Temp\7zS71CE\HPDiagnosticCoreUI.exe
FirewallRules: [{01C02EB4-2224-486F-8241-FAFADD02AACA}] => (Allow) C:\Program Files\HP\HP ENVY 4500 series\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [{91575C5E-0D74-4924-93A8-13565E5E9C51}] => (Allow) LPort=5357
FirewallRules: [{AD3362E2-4225-47FA-B4C7-CE8702441ADD}] => (Allow) C:\Program Files\HP\HP ENVY 4500 series\Bin\DeviceSetup.exe
FirewallRules: [{DE6CE2E5-07A5-4A68-805B-24DB561D1CB5}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe
FirewallRules: [{17D43150-4FDF-4555-81C1-D178C4BA4791}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe
FirewallRules: [{B3D83B8A-2D89-43B4-9E13-03F63CD85DD2}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{B2E094A0-C5FD-4593-87CD-2DE3FA39431F}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{D0956F16-B694-4FEA-B748-11C69EC55F3F}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgdiagex.exe
FirewallRules: [{5CF5F8A9-C8BD-4FDC-81B3-2121EA5BC0D0}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgdiagex.exe
FirewallRules: [{23331FED-D81C-4197-90AC-9DFDDC222FD7}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe
FirewallRules: [{CD19F43F-E831-4774-93CE-3F4CB4D9C9A6}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe
FirewallRules: [UDP Query User{18346370-789A-40D3-934B-B0FA8075BC73}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe] => (Allow) C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
FirewallRules: [TCP Query User{D3717407-8A68-467E-91C3-C0B927299764}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe] => (Allow) C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
FirewallRules: [{E68C223C-1C76-449A-BDDA-A4B80B01F4A3}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\Movie\PowerDVD.exe
FirewallRules: [{8E08944E-7454-45F9-9C9A-FED557E689AA}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12ML.exe
FirewallRules: [{D3B7F767-7B28-4F2B-A44D-452D96F8FD5C}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
FirewallRules: [{179AA5FA-59B1-41EB-9AB4-F1051DC47734}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12.exe
FirewallRules: [{6A9FA474-B5AC-485A-91AC-09B91389381E}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{864196CA-5879-436B-84C8-D1EE64E273D0}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{DF7F4711-E2CC-40D5-B904-EE2A65CF4AD6}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{F2BAFC12-2CB7-48FE-87BF-DDCB18CF6FC4}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [TCP Query User{E3994952-A429-4E05-81FE-DF385991D37B}C:\program files (x86)\microsoft office\office14\groove.exe] => (Block) C:\program files (x86)\microsoft office\office14\groove.exe
FirewallRules: [UDP Query User{A0DD1E75-44B2-43EB-9358-AD16CC0C13F0}C:\program files (x86)\microsoft office\office14\groove.exe] => (Block) C:\program files (x86)\microsoft office\office14\groove.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (08/26/2015 07:40:04 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: HP15r263dx)
Description: Activation of app Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (08/26/2015 07:25:54 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program ShellExperienceHost.exe version 10.0.10240.16425 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

Process ID: 12b8

Start Time: 01d0e05681b59cb0

Termination Time: 4294967295

Application Path: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe

Report Id: c9c592d3-4c49-11e5-8272-d0bf9c5f0e82

Faulting package full name: Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy

Faulting package-relative application ID: App

Error: (08/26/2015 07:25:50 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: HP15r263dx)
Description: App Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy+App did not launch within its allotted time.

Error: (08/26/2015 07:25:32 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program ShellExperienceHost.exe version 10.0.10240.16425 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

Process ID: 142c

Start Time: 01d0e05675d3e907

Termination Time: 4294967295

Application Path: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe

Report Id: bd9f84e8-4c49-11e5-8272-d0bf9c5f0e82

Faulting package full name: Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy

Faulting package-relative application ID: App

Error: (08/26/2015 07:25:30 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: HP15r263dx)
Description: App Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy+App did not launch within its allotted time.

Error: (08/26/2015 07:25:11 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program ShellExperienceHost.exe version 10.0.10240.16425 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

Process ID: 1470

Start Time: 01d0e05669113914

Termination Time: 4294967295

Application Path: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe

Report Id: b0ebe2de-4c49-11e5-8272-d0bf9c5f0e82

Faulting package full name: Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy

Faulting package-relative application ID: App

Error: (08/26/2015 07:25:08 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: HP15r263dx)
Description: App Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy+App did not launch within its allotted time.

Error: (08/26/2015 07:24:49 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program ShellExperienceHost.exe version 10.0.10240.16425 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

Process ID: 1ac4

Start Time: 01d0e05623f6c9da

Termination Time: 4294967295

Application Path: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe

Report Id: a3951d9f-4c49-11e5-8272-d0bf9c5f0e82

Faulting package full name: Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy

Faulting package-relative application ID: App

Error: (08/26/2015 07:24:46 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: HP15r263dx)
Description: App Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy+App did not launch within its allotted time.

Error: (08/26/2015 07:22:36 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: HP15r263dx)
Description: App Microsoft.Windows.Cortana_1.4.8.176_neutral_neutral_cw5n1h2txyewy+CortanaUI did not launch within its allotted time.


System errors:
=============
Error: (08/26/2015 07:44:27 PM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)
Description: {784E29F4-5EBE-4279-9948-1E8FE941646D}

Error: (08/26/2015 07:43:25 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Client License Service (ClipSVC) service failed to start due to the following error:
%%1053

Error: (08/26/2015 07:43:25 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Client License Service (ClipSVC) service to connect.

Error: (08/26/2015 07:42:54 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Client License Service (ClipSVC) service failed to start due to the following error:
%%1053

Error: (08/26/2015 07:42:54 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Client License Service (ClipSVC) service to connect.

Error: (08/26/2015 07:42:20 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The IE Search Set service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

Error: (08/26/2015 07:40:04 PM) (Source: DCOM) (EventID: 10010) (User: HP15r263dx)
Description: CortanaUI.AppXd4tad4d57t4wtdbnnmb8v2xtzym8c1n8.mca

Error: (08/26/2015 07:40:03 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: The Sync Host_Session1 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.

Error: (08/26/2015 07:36:32 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYLOCAL SERVICES-1-5-19LocalHost (Using LRPC)UnavailableUnavailable

Error: (08/26/2015 07:36:32 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYLOCAL SERVICES-1-5-19LocalHost (Using LRPC)UnavailableUnavailable


Microsoft Office:
=========================
Error: (08/26/2015 07:40:04 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: HP15r263dx)
Description: Microsoft.Windows.Cortana_cw5n1h2txyewy!CortanaUI-2144927141

Error: (08/26/2015 07:25:54 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: ShellExperienceHost.exe10.0.10240.1642512b801d0e05681b59cb04294967295C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exec9c592d3-4c49-11e5-8272-d0bf9c5f0e82Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewyApp

Error: (08/26/2015 07:25:50 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: HP15r263dx)
Description: Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy+App

Error: (08/26/2015 07:25:32 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: ShellExperienceHost.exe10.0.10240.16425142c01d0e05675d3e9074294967295C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exebd9f84e8-4c49-11e5-8272-d0bf9c5f0e82Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewyApp

Error: (08/26/2015 07:25:30 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: HP15r263dx)
Description: Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy+App

Error: (08/26/2015 07:25:11 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: ShellExperienceHost.exe10.0.10240.16425147001d0e056691139144294967295C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeb0ebe2de-4c49-11e5-8272-d0bf9c5f0e82Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewyApp

Error: (08/26/2015 07:25:08 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: HP15r263dx)
Description: Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy+App

Error: (08/26/2015 07:24:49 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: ShellExperienceHost.exe10.0.10240.164251ac401d0e05623f6c9da4294967295C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exea3951d9f-4c49-11e5-8272-d0bf9c5f0e82Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewyApp

Error: (08/26/2015 07:24:46 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: HP15r263dx)
Description: Microsoft.Windows.ShellExperienceHost_10.0.10240.16384_neutral_neutral_cw5n1h2txyewy+App

Error: (08/26/2015 07:22:36 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: HP15r263dx)
Description: Microsoft.Windows.Cortana_1.4.8.176_neutral_neutral_cw5n1h2txyewy+CortanaUI


CodeIntegrity:
===================================
Date: 2015-08-26 20:48:05.006
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-08-26 20:34:46.781
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-08-26 20:18:14.070
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-08-26 19:58:04.575
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-08-26 19:48:04.614
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-08-26 19:44:15.218
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.

Date: 2015-08-26 19:43:40.755
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll that did not meet the Windows signing level requirements.

Date: 2015-08-26 19:43:40.720
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll that did not meet the Windows signing level requirements.

Date: 2015-08-26 19:43:40.686
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll that did not meet the Windows signing level requirements.

Date: 2015-08-26 19:31:48.072
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files (x86)\Spybot - Search & Destroy 2\SDHook64.dll because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Processor: Intel(R) Pentium(R) CPU N3540 @ 2.16GHz
Percentage of memory in use: 60%
Total physical RAM: 3982.27 MB
Available physical RAM: 1574.1 MB
Total Virtual: 5390.27 MB
Available Virtual: 2509.91 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:671.83 GB) (Free:596.44 GB) NTFS
Drive d: (RECOVERY) (Fixed) (Total:24.95 GB) (Free:2.78 GB) NTFS ==>[system with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 698.6 GB) (Disk ID: 11468A25)

Partition: GPT.

==================== End of Addition.txt ============================


aswMBR version 1.0.1.2252 Copyright(c) 2014 AVAST Software
Run date: 2015-08-26 20:58:54
-----------------------------
20:58:54.293 OS Version: Windows x64 6.2.9200
20:58:54.294 Number of processors: 4 586 0x3708
20:58:54.295 ComputerName: HP15R263DX UserName: Carolyn_2
20:58:55.303 Initialize success
20:58:55.303 VM: initialized successfully
20:58:55.303 VM: Intel CPU BiosDisabled
21:03:21.154 AVAST engine defs: 15082604
21:03:41.582 The log file has been saved successfully to "C:\Users\Carolyn_2\Desktop\aswMBR.txt"

[ken545]

:snwelcome:

You do have a bit going on, it looks like your hosts file is infected as well

You also have a marker in your log that suggests that Microsoft Office may not have a valid license key

Download CKScanner by askey127 from Here (http://downloads.malwareremoval.com/CKScanner.exe) & save it to your Desktop.

Doubleclick CKScanner.exe then click Search For Files
When the cursor hourglass disappears, click Save List To File
A message box will verify the file saved
Please Run this program only once
Double-click the CKFiles.txt icon on your desktop then copy/paste the contents in your next reply

[Beachplum]

CKScanner doesn't give me the option to save to desktop anywhere that I can see: right click, left click, double click

CKScanner "not responding" after several tries.

Then CKScanner comes up with:

"CKScanner 2.5 - Additional Secrity Risks - These are not necessarily bad
scanner sequence 3.RP.11.PLAAW0
-----EOF------ "

I left it up and will not run it again per your instructions.

[ken545]

You can try dragging CKScanner to the trash and download and run it again

What can you tell me about Microsoft Office ??

[Beachplum]

You can try dragging CKScanner to the trash and download and run it again

What can you tell me about Microsoft Office ??

Hi Ken545,
Tried CKScanner 6 times and same result. Maybe something is blocking it?

Don't know about Microsoft Office. I can try to find the guy who sold it to me, but please don't do anything to it, I am in the middle of a huge project. I'll sort it out.
Thank you.

[ken545]

Why would you buy Microsoft Office from SOME GUY instead of going to the Microsoft Store and purchasing it legally ?? If its a cracked copy its infected !!!

Run these at your own risk, its possible they can remove the file that activates this copy of Office, if Office was legit that file would not be installed



-AdwCleaner-by Xplode


Click on this link to download : ADWCleaner (http://www.bleepingcomputer.com/download/adwcleaner/) TO YOUR DESKTOP
Click on ONE of the Two Blue Download Now buttons That have a blue arrow beside them and save it to your desktop.
Use my link only, do not do a search for AdwCleaner as there is a bogus copy going around by scammers




Do not click on any links in the top Advertisment.


http://i24.photobucket.com/albums/c30/ken545/AdwCleaner4.201_zpsxrbk2llq.jpg (http://s24.photobucket.com/user/ken545/media/AdwCleaner4.201_zpsxrbk2llq.jpg.html)




Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Scan.
After the scan is complete click on "Clean"
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next reply.
You can find the logfile at C:\AdwCleaner[S1].txt as well.






===============================================================================






http://imageshack.us/a/img841/7292/thisisujrt.gif Please download Junkware Removal Tool (http://www.bleepingcomputer.com/download/junkware-removal-tool/) TO YOUR DESKTOP


Download the one from Bleeping Computer
Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.








===============================================================================


Download Malwarebytes' Anti-Malware (http://www.malwarebytes.org/mbam-download.php) TO YOUR DESKTOP




Windows XP : Double click on the icon to run it.
Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"




http://i24.photobucket.com/albums/c30/ken545/0841859c-1a35-4dbd-b41a-e720629e3e22_zpst0yckuua.png (http://s24.photobucket.com/user/ken545/media/0841859c-1a35-4dbd-b41a-e720629e3e22_zpst0yckuua.png.html)




On the Dashboard click on Update Now
Go to the Setting Tab
Under Setting go to Detection and Protection
Under PUP and PUM make sure both are set to show Treat Detections as Malware
Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
Then on the Dashboard click on Scan
Make sure to select THREAT SCAN
Then click on Scan
When the scan is finished and the log pops up...select Copy to Clipboard
Please paste the log back into this thread for review
Exit Malwarebytes

[Beachplum]

Why would you buy Microsoft Office from SOME GUY instead of going to the Microsoft Store and purchasing it legally ?? If its a cracked copy its infected !!!

Run these at your own risk, its possible they can remove the file that activates this copy of Office, if Office was legit that file would not be installed



-AdwCleaner-by Xplode


Click on this link to download : ADWCleaner (http://www.bleepingcomputer.com/download/adwcleaner/) TO YOUR DESKTOP
Click on ONE of the Two Blue Download Now buttons That have a blue arrow beside them and save it to your desktop.
Use my link only, do not do a search for AdwCleaner as there is a bogus copy going around by scammers




Do not click on any links in the top Advertisment.


http://i24.photobucket.com/albums/c30/ken545/AdwCleaner4.201_zpsxrbk2llq.jpg (http://s24.photobucket.com/user/ken545/media/AdwCleaner4.201_zpsxrbk2llq.jpg.html)




Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Scan.
After the scan is complete click on "Clean"
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next reply.
You can find the logfile at C:\AdwCleaner[S1].txt as well.






===============================================================================






http://imageshack.us/a/img841/7292/thisisujrt.gif Please download Junkware Removal Tool (http://www.bleepingcomputer.com/download/junkware-removal-tool/) TO YOUR DESKTOP


Download the one from Bleeping Computer
Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.








===============================================================================


Download Malwarebytes' Anti-Malware (http://www.malwarebytes.org/mbam-download.php) TO YOUR DESKTOP




Windows XP : Double click on the icon to run it.
Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"




http://i24.photobucket.com/albums/c30/ken545/0841859c-1a35-4dbd-b41a-e720629e3e22_zpst0yckuua.png (http://s24.photobucket.com/user/ken545/media/0841859c-1a35-4dbd-b41a-e720629e3e22_zpst0yckuua.png.html)




On the Dashboard click on Update Now
Go to the Setting Tab
Under Setting go to Detection and Protection
Under PUP and PUM make sure both are set to show Treat Detections as Malware
Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
Then on the Dashboard click on Scan
Make sure to select THREAT SCAN
Then click on Scan
When the scan is finished and the log pops up...select Copy to Clipboard
Please paste the log back into this thread for review
Exit Malwarebytes




I bought Microsoft Office from SOME GUY because he is the guy who moved my information from my old computer to my new computer. My old computer had Microsoft Office that did not have to be renewed at all. I asked him for this version and he said ok he would make sure I got that. Now you're telling me I don't have that? Is that what you're telling me? or I do not have an approved Microsoft Office at all?

I don't want to lose my Office information (I know, who does) as I am working on a large project. If you won't help without me disabling my Office, then I guess we part ways... I can't risk it..

[ken545]

Its hard to say what this guy has done but I would definitely get a hold of him and ask. You have a file on your system running as a task that bypasses the activation key for Office if its cracked

Run this quick fix, I did not include the questionable task so it wont effect Office from running, after the fix download and run Malwarebytes that i posted earlier, if it does find that file and removes it, it does not delete it , it just puts it in quarantine and we can restore it if need be


Your running FRST64 from your downloads folder, our tools and scanners work more efficiently when run from the Desktop in lieu of being buried in some folder, so go to your Downloads folder and look for FRST64, right click on it and select CUT, then come back to your Desktop and right click on a blank space and select PASTE, then we will have FRST64 exactly where we want it to be.





Open notepad , Go to Start --> All Programs --> Accessories --> Notepad.
Please copy the entire contents Inside of the code box below beginning with START and ending with END
(To do this highlight the contents of the box, right click on it and select copy. Right-click in the open notepad and select Paste).
Name the file Fixlist, Save it to your desktop where you have FRST/FRST64 or the fix wont work, . Then open up FRST/FRST64 and click on FIX (Not Scan) It won't take long, after your computer reboots you will find a FIXLOG.TXT on your desktop, post it please




Start
CloseProcesses:
CreateRestorePoint:
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
2015-08-25 08:39 - 2015-07-27 09:30 - 00450771 ____R C:\WINDOWS\system32\Drivers\etc\hosts.20150825-083915.backup
2015-08-24 16:03 - 2015-07-27 09:30 - 00450771 ____R C:\WINDOWS\system32\Drivers\etc\hosts.ccebak
2015-07-27 09:30 - 2013-08-22 09:25 - 00000824 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20150727-093059.backup
Task: {0DA58E52-FD2D-4A3E-88A6-D431AA25DD73} - System32\Tasks\Optimizer Pro Schedule => C:\Program Files (x86)\Optimizer Pro 3.99\OptProLauncher.exe <==== ATTENTION
2015-08-09 20:53 - 2015-08-13 08:42 - 00000000 ____D C:\Program Files (x86)\BocaMonitor
Hosts:
CMD: ipconfig /flushdns
EmptyTemp:
End



NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

[Beachplum]

Its hard to say what this guy has done but I would definitely get a hold of him and ask. You have a file on your system running as a task that bypasses the activation key for Office if its cracked

Run this quick fix, I did not include the questionable task so it wont effect Office from running, after the fix download and run Malwarebytes that i posted earlier, if it does find that file and removes it, it does not delete it , it just puts it in quarantine and we can restore it if need be


Your running FRST64 from your downloads folder, our tools and scanners work more efficiently when run from the Desktop in lieu of being buried in some folder, so go to your Downloads folder and look for FRST64, right click on it and select CUT, then come back to your Desktop and right click on a blank space and select PASTE, then we will have FRST64 exactly where we want it to be.





Open notepad , Go to Start --> All Programs --> Accessories --> Notepad.
Please copy the entire contents Inside of the code box below beginning with START and ending with END
(To do this highlight the contents of the box, right click on it and select copy. Right-click in the open notepad and select Paste).
Name the file Fixlist, Save it to your desktop where you have FRST/FRST64 or the fix wont work, . Then open up FRST/FRST64 and click on FIX (Not Scan) It won't take long, after your computer reboots you will find a FIXLOG.TXT on your desktop, post it please




Start
CloseProcesses:
CreateRestorePoint:
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
2015-08-25 08:39 - 2015-07-27 09:30 - 00450771 ____R C:\WINDOWS\system32\Drivers\etc\hosts.20150825-083915.backup
2015-08-24 16:03 - 2015-07-27 09:30 - 00450771 ____R C:\WINDOWS\system32\Drivers\etc\hosts.ccebak
2015-07-27 09:30 - 2013-08-22 09:25 - 00000824 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20150727-093059.backup
Task: {0DA58E52-FD2D-4A3E-88A6-D431AA25DD73} - System32\Tasks\Optimizer Pro Schedule => C:\Program Files (x86)\Optimizer Pro 3.99\OptProLauncher.exe <==== ATTENTION
2015-08-09 20:53 - 2015-08-13 08:42 - 00000000 ____D C:\Program Files (x86)\BocaMonitor
Hosts:
CMD: ipconfig /flushdns
EmptyTemp:
End



NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system



Here is the fixlog.txt

Fix result of Farbar Recovery Scan Tool (x64) Version:26-08-2015
Ran by Carolyn_2 (2015-08-28 13:58:26) Run:1
Running from C:\Users\Carolyn_2\Desktop
Loaded Profiles: Carolyn_2 (Available Profiles: Carolyn_2)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
CloseProcesses:
CreateRestorePoint:
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
2015-08-25 08:39 - 2015-07-27 09:30 - 00450771 ____R C:\WINDOWS\system32\Drivers\etc\hosts.20150825-083915.backup
2015-08-24 16:03 - 2015-07-27 09:30 - 00450771 ____R C:\WINDOWS\system32\Drivers\etc\hosts.ccebak
2015-07-27 09:30 - 2013-08-22 09:25 - 00000824 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20150727-093059.backup
Task: {0DA58E52-FD2D-4A3E-88A6-D431AA25DD73} - System32\Tasks\Optimizer Pro Schedule => C:\Program Files (x86)\Optimizer Pro 3.99\OptProLauncher.exe <==== ATTENTION
2015-08-09 20:53 - 2015-08-13 08:42 - 00000000 ____D C:\Program Files (x86)\BocaMonitor
Hosts:
CMD: ipconfig /flushdns
EmptyTemp:
End
*****************

Processes closed successfully.
Restore point was successfully created.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page => value removed successfully
C:\WINDOWS\system32\Drivers\etc\hosts.20150825-083915.backup => moved successfully
C:\WINDOWS\system32\Drivers\etc\hosts.ccebak => moved successfully
C:\WINDOWS\system32\Drivers\etc\hosts.20150727-093059.backup => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{0DA58E52-FD2D-4A3E-88A6-D431AA25DD73}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0DA58E52-FD2D-4A3E-88A6-D431AA25DD73}" => key removed successfully
C:\WINDOWS\System32\Tasks\Optimizer Pro Schedule => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Optimizer Pro Schedule => key not found.
C:\Program Files (x86)\BocaMonitor => moved successfully
Hosts restored successfully.

========= ipconfig /flushdns =========


Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========

EmptyTemp: => 805.5 MB temporary data Removed.


The system needed a reboot..

==== End of Fixlog 13:59:45 ====

[ken545]

Good, no need to quote what i said, go ahead and run Malwarebytes and lets see what it comes up with

[Beachplum]

Ran Malwarebytes but forgot to paste results before sending to quarantine. I got the impression nothing of significance was found. Tried to copy the quarantined items to post it but can't figure out how. 8 items: 1 folder, 2 files, 5 registry keys.
I can type it all out for you if you want.

Should I be buying Malwarebytes or will it interfere with Spybot?

BTW bocamonitor no longer shows up in Programs.

Does this mean my hosts file is fixed?

[ken545]

Good Morning,

Where you having a problem with BocoMonitor in all three browsers or just Internet Explorer ?

Yes we fixed the hosts file, FRST deleted the old and created a new one

There are a lot of good malware programs, just beware of the ones that offer a free download and scan but then wants you to purchase the program in order to remove what it found, both Spybot and Malwarebytes are not like that

The free version of Malwarebytes will not interfere with Spybot but if you decide to upgrade Malwarebytes to the Pro Version than you will have to disable the Tea Timer in Spybot

Here is how you can find and post the Malwarebytes log


http://i24.photobucket.com/albums/c30/ken545/MBAM%20Application_zps7zm0ftdm.png (http://s24.photobucket.com/user/ken545/media/MBAM%20Application_zps7zm0ftdm.png.html)


1. Open up Malwarebytes and you will be on the Dashboard
2. Click on the History Tab
3. Then click on Application Logs
4. Double click on the SCAN LOG (Not Protection Log ) you just ran
5. When it opens it will look like this





http://i24.photobucket.com/albums/c30/ken545/MBAM%20Export_zpsjbtttjun.jpg (http://s24.photobucket.com/user/ken545/media/MBAM%20Export_zpsjbtttjun.jpg.html)


6. Then click on Export
7. On the drop down list click on Copy to Clipboard
8. Then paste the log back into this thread

[Beachplum]

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 8/28/2015
Scan Time: 9:01 AM
Logfile:
Administrator: Yes

Version: 2.1.8.1057
Malware Database: v2015.08.28.02
Rootkit Database: v2015.08.16.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 10
CPU: x64
File System: NTFS
User: Carolyn_2

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 406206
Time Elapsed: 28 min, 30 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 5
PUP.Optional.OptimizerPro.C, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Optimizer Pro Schedule, Delete-on-Reboot, [54de6ca2d0bbac8ae8ff53cc6c97c63a],
PUP.Optional.SuperOptimizer.C, HKLM\SOFTWARE\WOW6432NODE\{6791A2F3-FC80-475C-A002-C014AF797E9C}, Quarantined, [5cd67896672496a05deac6e744c0a45c],
PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{4519cfe8}, Quarantined, [6cc6df2f7d0ebc7a6db088229f65bd43],
PUP.Optional.SuperOptimizer.C, HKU\S-1-5-18\SOFTWARE\APPDATALOW\{1146AC44-2F03-4431-B4FD-889BC837521F}, Quarantined, [f33f30dea5e669cd0b3acce17292a15f],
PUP.Optional.SuperOptimizer.C, HKU\S-1-5-21-212272962-4250710869-947374074-1004\SOFTWARE\APPDATALOW\{1146AC44-2F03-4431-B4FD-889BC837521F}, Quarantined, [0f23ba54d5b68ea853f25a53c341e818],

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 1
PUP.Optional.DealsAvenue.A, C:\Users\carolyn\AppData\Local\Temp\Deals Avenue, Quarantined, [50e27e906d1eab8b28fb839725de8d73],

Files: 2
PUP.Optional.OptimizerPro.C, C:\Windows\System32\Tasks\Optimizer Pro Schedule, Quarantined, [3ef4fe1038536fc7f7379f12cd376b95],
PUP.Optional.DealsAvenue.A, C:\Users\carolyn\AppData\Local\Temp\Deals Avenue\7za.exe, Quarantined, [50e27e906d1eab8b28fb839725de8d73],

Physical Sectors: 0
(No malicious items detected)


(end)

ANSWERS TO Qs:

The browser I use is Google Chrome.
The way I came about all this malware is I foolishly did exactly what you told me not to.... (you might as well get the full story, if not important, just ignore.
I downloaded Comodo since I heard it was so good :( and Geekbuddy
Problems immediately so I called help. They fussed around with my computer, found "problems", asked to take control of my computer -- said yes (!!!!).
Then asked me to buy hundreds of dollars of product, which I did purchase $39.95. and after more control of my computer,
then all of a sudden everything was "fixed".
Of course AFTER all this happened I found this highly suspicious, so I looked around and found BAD reviews of GeekBuddy and:
comodo, geek buddy, wild games (which I think is back), avast, and bocamonitor. Tried to delete all from startup and what was running, then uninstall.
bocamonitor would NOT uninstall. Tried to find it by running Spybot but couldn't find it, which is when I contacted you.

I have full home coverage with Spybot, paid for, and with which I am happy,
but don't know if it is running a firewall or if I should keep Microsoft Firewall on.

I had anti-virus AVG running, not important since I now have Spybot, but the guy told me to delete it so I did. Don't think that matters now...

PS I got my money back, although they were very tricky with that, demanding to know why, but I side-stepped that.

I hope I have answered all your Qs.

[ken545]

I believe you can uninstall GeekBuddy from Programs and Features in the Control Panel. Myself, I would never allow anyone and I mean anyone to take control of my computer. I had a friend a few months ago, this lady bought a refurbished Dell tower and I went over and set it up for her. There where so many things to do but I forgot to install Adobe Reader for her so she did it her own and when she Googled it she went to the first site that showed it ( which was not the Adobe website ) needless to say besides Adobe it installed other malware and I had to go back over and remove it.

I have been in computing since the days of Windows 95 and outside antivirus or antimalware program i never had any use for all the garbage that is hawked, system cleaners, registry cleaners, you dont need any of these things, everything you need is built into windows .

If you uninstalled Comodo it may have turned the Windows Firewall back on, if its off you need to turn it back on
Right click on the Start Button on the very bottom right and then click on Control Panel > Windows Firewall and if its off you can turn it back on

Windows 10 also has Windows Defender built in and from what i have been reading its quite adequate so you wont need a third party program like AVG, Norton etc

What I have on my system is Windows Defender, Windows Firewall turned on and also the Pro Version of Malwarebytes that blocks known bad sites, I also recently installed Malwarebytes Anti Exploit which is helpful in blocking the latest threats from Cryptolocker that encrypts your files that you will have to pay a ransom to get them back

You can remove temp files now and then because as they build up they tend to slow things down, you can use the built in one in windows

Right click on the Start button and click on Command Prompt and type in CLEANMGR and enter on your keyboard, just check mark Temporary Internet Files . Temp Files > Recycle bin and let it go

[Beachplum]

Geekbuddy is gone, I uninstalled all that junk, Comodo Geekbuddy, wildgames, avast, webcompanion lavasoft. stuff I didn't put on my computer...
except Bocamonitor wouldn't go. Now it's gone. Thanks for your help with this...

Definitely lesson learned!! Thanks for your patience.
Will install Malwarebytes Pro and AntiExploit.

However, running windows 10 and trying to turn on Windows Defender/ Firewall.

Keep getting pop-up that says:

"This app has been turned off and isn't monitoring your computer.
If you're using another app to check for malicious or unwanted software, use Security and Maintenance to check that app's status."

I can get to Windows Defender using "Search" function, but doesn't allow me to choose ON or OFF. Nothing is highlighted.
However if I go to Security and Maintenance, it tells me that Windows Firewall is actively protecting your PC. Just no option to turn it on/off.

OK cleaned up temporary files.

[Beachplum]

Found out how to turn on/off Windows Firewall
by looking in
Systems and Security.

Many thanks!!!

[Beachplum]

Do I need both Maywarebytes Premium and Anti-Exploit?? Can't tell from website and don't want to buy both if I don't have to...

[ken545]

Check this site for Windows Defender
http://www.tenforums.com/tutorials/5918-windows-defender-turn-off-windows-10-a.html

Malwarebytes Pro and Malwarebytes Anti Exploit are two different programs, Malwarebytes Pro, you can update the program, run scans, remove what it finds ( just like the free version ) but the Pro has a Protection Module that will block bad sites from loading.

Anti Exploit is different, no need to update, no scans to run, just sits in the background blocking malicious programs from loading

But the choice on both these programs are entirely up to you

[ken545]

Lets double check Chome and make sure all references to Bocomonitor are gone





Open Chrome
Click the Chrome menu http://i24.photobucket.com/albums/c30/ken545/Clipboard01_zps2e55f676.jpgon the browser toolbar.
Click on Settings
Then Manage Search Engines
Highlite Bocomonitor and select Delete
Then go to Other Search Engines and remove all you dont want






Click the Chrome menu http://i24.photobucket.com/albums/c30/ken545/Clipboard01_zps2e55f676.jpgon the browser toolbar.
Click on Settings
Open a specific page or set of pages.
Set Pages
Remove Bocomonitor
You can copy and paste the url from a page you like or if you have that page open select use current
OK your way out and close chome.
Reopen Chrome and make sure your start page is the one you want






Open Chrome
Click the Chrome menu http://i24.photobucket.com/albums/c30/ken545/Clipboard01_zps2e55f676.jpgon the browser toolbar.
Click on History
Click on Clear Browsing History
Check
1. Browsing History
2. Cookies and Site Plug Ins
3. Cached Images and Files
Then ok your way out and close Chrome






Open Chrome
Click the Chrome menu http://i24.photobucket.com/albums/c30/ken545/Clipboard01_zps2e55f676.jpgon the browser toolbar.
Then go to Settings > Show Advanced Settings
Then go to Privacy > Content Settings
Plug Ins > Manage Exceptions > Delete any reference to Bocomonitor
Pop Ups > Manage Exceptions > Remove any reference to Bocomonitor
Ok your way out and close Chome, then reopen it and see if Bocomonitor are gone from your pages

[Beachplum]

Followed all your directions.

Did not find Bocomonitor anywhere. Was that to be expected/hoped for?

Q: Under Manage Search Engines: Other Search Engines
I found lots. deleted most, but they included Netflix and Amazon, both of which I use regularly.
Should I delete them anyway? Result?

[ken545]

Did not find Bocomonitor anywhere. Was that to be expected/hoped for?
This was just a double check to make sure it was not hiding somewhere




Q: Under Manage Search Engines: Other Search Engines
I found lots. deleted most, but they included Netflix and Amazon, both of which I use regularly.
Should I delete them anyway? Result?
Nope, if there something you use and know is legit than just leave them be, just remove anything suspicious that you never heard of



Double click on AdwCleaner.exe to run the tool again.

Click on the Uninstall button.
Click Yes when asked are you sure you want to uninstall.
Both AdwCleaner.exe, its folder and all logs will be removed.






==========================================================




Please download DelFix (http://general-changelog-team.fr/en/downloads/finish/20-outils-de-xplode/9-delfix) and save the file to your Desktop.


http://i24.photobucket.com/albums/c30/ken545/DelFix_zps139e2ea1.jpg (http://s24.photobucket.com/user/ken545/media/DelFix_zps139e2ea1.jpg.html)




Windows XP Double Click DelFix.exe to run the program.
Windows Vista > Win 7 > Win 8 Right Click on DelFix.exe and select RUN AS ADMINISTRATOR
Checkmark " Remove Disinfection Tools"
Click the Run button




This will remove the specialised tools we used to clean your system. Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually






==========================================================








How did I get infected in the first place ?




WhattheTech (http://forums.whatthetech.com/index.php?showtopic=97186&quot;)
Grinler BleepingComputer (http://www.bleepingcomputer.com/tutorials/keep-your-computer-safe-online/)
GeeksTo Go (http://www.geekstogo.com/forum/index.php?autocom=custom&page=How_did_I)
Dslreports (http://www.dslreports.com/faq/10002)






Safe Surfn
Ken

[Beachplum]

I don't think I ever ran adwcleaner since I don't haave it on my desktop.
I couldn't figure out how to put it on my desktop, but here is the .txt file.


# AdwCleaner v5.004 - Logfile created 30/08/2015 at 11:26:47
# Updated 26/08/2015 by Xplode
# Database : 2015-08-30.1 [Server]
# Operating system : Windows 10 Home (x64)
# Username : Carolyn_2 - HP15R263DX
# Running from : C:\Users\Carolyn_2\Downloads\adwcleaner_5.004.exe
# Option : Cleaning
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****

[-] Folder Deleted : C:\ProgramData\7d6e32ca000074d2

***** [ Files ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****

[-] Key Deleted : HKLM\SOFTWARE\749ab3df-18db-468f-dd67-5ce2cdf20a0a
[-] Key Deleted : HKU\.DEFAULT\Software\Avg Secure Update
[-] Key Deleted : HKCU\Software\Avg Secure Update
[-] Key Deleted : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
[-] Key Deleted : HKLM\SOFTWARE\{12A61307-94CD-4F8E-94BC-918E511FAA81}
[!] Key Not Deleted : [x64] HKCU\Software\Avg Secure Update

***** [ Web browsers ] *****

[-] [C:\Users\Carolyn_2\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Startup_URLs] Deleted : hxxp://www.google.com/","hxxp://www.trovi.com/?gd=&ctid=CT3333531&octid=EB_ORIGINAL_CTID&ISID=M77FE2731-FC8C-4292-8FA6-25536FEA05A4&SearchSource=55&CUI=&UM=8&UP=SP9105F43C-CB01-4E14-A86B-B770B39465B1&SSPV=

*************************

:: Winsock settings cleared

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [1375 bytes] ##########

[Beachplum]

I can't figure out how to download these last two adwcleaner and delfix to my desktop.

Results:

# DelFix v1.011 - Logfile created 30/08/2015 at 11:44:22
# Updated 18/08/2015 by Xplode
# Username : Carolyn_2 - HP15R263DX
# Operating System : Windows 10 Home (64 bits)

~ Removing disinfection tools ...


########## - EOF - ##########

[ken545]

Your doing fine, my bad on AdwCleaner I had thought we ran it. Go ahead and run Junkware Removal and lets make sure its all gone. I was hesitant about running them as you stated you where in the middle of a project, adware cleaner ran fine



http://imageshack.us/a/img841/7292/thisisujrt.gif Please download Junkware Removal Tool (http://www.bleepingcomputer.com/download/junkware-removal-tool/) TO YOUR DESKTOP


Download the one from Bleeping Computer
Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

[Beachplum]

Can't figure out how to shut down my protection software exc windows firewall I can turn off.
Have Windows Defender and Spybot.

[Beachplum]

Yes, I am still in the middle of a project!

[ken545]

Just go ahead and run Junkware as is

[Beachplum]

Results:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.5.9 (08.27.2015:1)
OS: Windows 10 Home x64
Ran by Carolyn_2 on Sun 08/30/2015 at 14:48:40.48
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Tasks



~~~ Registry Values

Successfully deleted: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\GoogleChromeAutoLaunch_9A40F75D9FDB245F0FF38A928F712476



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Chrome

Successfully deleted: [Folder] C:\Users\Carolyn_2\Appdata\Local\Google\Chrome\User Data\Default\Extensions\gpdjojdkbbmdfjfahjcgigfpmkopogic

[C:\Users\Carolyn_2\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - default search provider reset

[C:\Users\Carolyn_2\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:
gpdjojdkbbmdfjfahjcgigfpmkopogic

[C:\Users\Carolyn_2\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset

[C:\Users\Carolyn_2\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
[
gpdjojdkbbmdfjfahjcgigfpmkopogic
]





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sun 08/30/2015 at 22:50:39.47
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[ken545]

Great

Lets run Delfix again to remove Junkware Removal and you will be good to go



http://imageshack.us/a/img841/7292/thisisujrt.gif Please download Junkware Removal Tool (http://www.bleepingcomputer.com/download/junkware-removal-tool/) TO YOUR DESKTOP


Download the one from Bleeping Computer
Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

[Beachplum]

# DelFix v1.011 - Logfile created 31/08/2015 at 09:47:37
# Updated 18/08/2015 by Xplode
# Username : Carolyn_2 - HP15R263DX
# Operating System : Windows 10 Home (64 bits)

~ Removing disinfection tools ...

Deleted : C:\Users\Carolyn_2\Desktop\JRT (2) - Shortcut.lnk
Deleted : C:\Users\Carolyn_2\Desktop\JRT.txt
Deleted : C:\Users\Carolyn_2\Downloads\JRT (1).exe
Deleted : C:\Users\Carolyn_2\Downloads\JRT (2).exe
Deleted : C:\Users\Carolyn_2\Downloads\JRT (3).exe
Deleted : C:\Users\Carolyn_2\Downloads\JRT.exe

########## - EOF - ##########

[ken545]

:rockon:


Take care my friend

Ken :)

[Beachplum]

Yipes!!! don't go quite yet.

Last things I promise::

I think I remember you saying that if I were to get the advanced version of Malwarebytes
that I should turn off *something* in my home version with antivirus Spybot, But I can't find it in this thread.

Would you repeat?

And what exactly should I do about the Office? Can I download a new version myself? and if I download a new version will it delete my work?

I guess that's it for questions.

[Beachplum]

And you take care too...

[ken545]

I dont know if you understand what Cracked/Keygen/Warez software is. Downloading a program that is cracked is downloaded illegally for free, Microsoft Office, a lot of the expensive Adobe products and a ton of others are prime targets for this. Normally you would have to use one of the torrents to download it but I see no trace of any torrents running on your system so I believe this was done by someone else

When we see this task running on a system it usually means that one of Microsoft's products are a cracked version and this task bypasses the activation key to let it run
Task: {A2167C38-B94D-4D14-8AEC-16069D00C8CF} - System32\Tasks\AutoKMS => C:\windows\AutoKMS\AutoKMS.exe

The thing to do is to get a hold of this guy that installed Office and demand that he makes it right, you can print this out and show him the task .



Spybot and the free version of Malwarebytes will work together but the teatimer in Spybot will interfere with the Pro Version of Malwarebytes so you decide to go Pro with Malwarebytes just disable the teatimer in Spybot

To disable TeaTimer and remove its startup entry:
Go into Spybot > Mode > Advanced Mode > Tools > Resident
Uncheck (if checked) the following:
Resident "TeaTimer" (Protection of over-all system settings) Active.


Hope this helps

[Beachplum]

Sorry for the delay - my cursor just went b-a-n-a-n-a-s on me.

Can't get into Spybot using what you gave me.

I am running Spybot 2 and AV2.5, if that helps.

There is no "mode", just option to go into "advanced mode" and then no option for tools or resident

If I can learn how to turn off TeaTimer I will be happy...


Re: office
I was hoping to do it myself by downloading correct copy from Microsoft? So far, not returning my calls. I do know where he works ;)

[Beachplum]

I found under Settings
Live Protection - Mode
option to uncheck
Scan programs before they start (deactivate live protection)

Is that teatimer?


Also, yes I think I understand now exactly what happened with Office.

[ken545]

Yes, that will disable the teatimer

Keep me posted on Office, it would be interesting to hear what this guy says. I will leave the thread open for you for a few days so you can post back

[Beachplum]

Yes I think it will come down to a matter of money. What I paid for , what I didn't.

[Beachplum]

You're the best!!! Many thanks ~ 000s of $$ of help in one forum. Don't think I don't appreciate it...

[ken545]

Your welcome

Like I said I will leave this thread open for you for a few days so post back if you need anything else