banshee
2016-07-06, 20:57
I got an email the other day from a guy who works for a company in Canada that believes my pc has been infected with Vawtrak/Pont trojan. He emailed me a list of usernames that he found in a file on a C&C server his company recently hacked. The usernames and associated websites are legit and match.
I have CIS installed and do a weekly scan.
I've scanned my pc with Spybot S&D including a rootscan and nothing seemed to stick out, but there was a lot of files in the rootkit scan.
I've scanned with MAB as well and I didn't see any mention of Vawtrak/Pony or Zeus.
Is there anything else I can do to be sure I'm either not infected or I got rid of the infection?
Thanks. This is on a Win7 pro machine.
Tashi,
I read the post and was in the process of downloading both programs (link to FRST is broken so had to find alternate source) and running them, but I work from home on another pc and I haven't had a chance to get back to the infected pc until now.
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 02-07-2016
Ran by Antec-179 (administrator) on PROGRAMMING (06-07-2016 13:37:09)
Running from C:\Users\Antec-179\Documents
Loaded Profiles: Antec-179 (Available Profiles: Antec-179)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
() C:\Windows\System32\nvwmi64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Schneider Electric) C:\Program Files (x86)\APC\PowerChute Personal Edition\mainserv.exe
() C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe
() C:\Program Files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe
() C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Dassault Systemes) C:\Program Files (x86)\Dassault Systemes\B22\intel_a\code\bin\CATSysDemon.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Dassault Systemes) C:\Program Files\Dassault Systemes\DS License Server\win_b64\code\bin\DSLicSrv.exe
(Aladdin Knowledge Systems Ltd.) C:\Windows\SysWOW64\nhsrvice.exe
(SafeNet Inc.) C:\Windows\System32\hasplms.exe
(Aladdin Knowledge Systems Ltd.) C:\Windows\SysWOW64\HLS32SVC.EXE
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(3Dconnexion) C:\Program Files\3Dconnexion\3DxWare\3DxWinCore64\Mgl3DCtlrRPCService.exe
() C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin\rpdsvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Schneider Electric) C:\Program Files (x86)\APC\PowerChute Personal Edition\dataserv.exe
(WIBU-SYSTEMS AG) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
() C:\Windows\System32\nvwmi64.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cistray.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
(3Dconnexion, INC) C:\Program Files\3Dconnexion\3DxWare\3DxWinCore64\3DxService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(WIBU-SYSTEMS AG) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeterCC.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Lavasoft) C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
(Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
(Acronis International GmbH) C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\BusinessMessaging.exe
(3Dconnexion) C:\Program Files\3Dconnexion\3DxWare\3DxWinCore64\3dxpiemenus.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\LogiAppBroker.exe
(Microsoft Corporation) C:\Windows\System32\mstsc.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(CIMCO A/S) C:\CIMCO\CIMCOEdit7\CIMCOEdit.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_22_0_0_192.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_22_0_0_192.exe
(CNC Software, Inc.) C:\Program Files\mcamX9\MCLogr.exe
(CNC Software, Inc.) C:\Program Files\mcamX9\Mastercam.exe
(CNC Software, Inc.) C:\Program Files\mcamX9\Extensions\ToolManager.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe
(VMware, Inc.) C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.1\Internet Explorer\vmware-vmrc.exe
(VMware, Inc.) C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.1\Internet Explorer\vmware-vmrc.exe
(VMware, Inc.) C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.1\Internet Explorer\vmware-remotemks.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe
(Farbar) C:\Users\Antec-179\Documents\Farbar Recovery Scan Tool.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [3100440 2014-05-19] (Logitech, Inc.)
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [518424 2015-01-23] (Acronis)
HKLM\...\Run: [3DxWare Service] => C:\Program Files\3Dconnexion\3DxWare\3DxWinCore64\3DxService.exe [2160512 2015-12-10] (3Dconnexion, INC)
HKLM\...\Run: [nwiz] => C:\Program Files\NVIDIA Corporation\nview\nwiz.exe [2498368 2015-07-23] ()
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11545192 2015-06-24] (Realtek Semiconductor)
HKLM\...\Run: [COMODO Internet Security] => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [1610936 2016-06-16] (COMODO)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [Display] => C:\Program Files (x86)\APC\PowerChute Personal Edition\DataCollectionLauncher.exe [284024 2012-01-24] (Schneider Electric)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-04-30] (Intel Corporation)
HKLM-x32\...\Run: [Ad-Aware Browsing Protection] => C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [558672 2013-09-11] (Lavasoft)
HKLM-x32\...\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [7805824 2015-01-23] (Acronis)
HKLM-x32\...\Run: [AcronisTibMounterMonitor] => C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [1102192 2015-01-23] (Acronis International GmbH)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596504 2016-05-16] (Oracle Corporation)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2016-06-28] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [Malwarebytes Anti-Malware] => C:\Program Files (x86)\Malwarebytes Anti-Malware\BusinessMessaging.exe [3219456 2016-06-29] (Malwarebytes)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKLM\...\Policies\Explorer\Run: [HVJOGX] => C:\Windows\SysWOW64\asferror3.exe
HKLM\...\Policies\Explorer: [HideSCAHealth] 1
HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8810200 2016-06-29] (Piriform Ltd)
HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\Policies\Explorer: [HideSCAHealth] 1
HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\Policies\Explorer: [NoTaskGrouping] 1
HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\MountPoints2: {f2330861-6b98-11e5-beff-f46d049c0ec4} - L:\DTVP_Launcher.exe
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll => No File
AppInit_DLLs-x32: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll => No File
AppInit_DLLs-x32: c:\windows\syswow64\guard32.dll => c:\windows\syswow64\guard32.dll [626288 2016-06-15] (COMODO)
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2016-05-17] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2016-05-17] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2016-05-17] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [AcronisSyncError] -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2013-10-01] ()
ShellIconOverlayIdentifiers: [AcronisSyncInProgress] -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2013-10-01] ()
ShellIconOverlayIdentifiers: [AcronisSyncOk] -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2013-10-01] ()
ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\APC UPS Status.lnk [2012-05-09]
ShortcutTarget: APC UPS Status.lnk -> C:\Program Files (x86)\APC\PowerChute Personal Edition\Display.exe (Schneider Electric)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\CodeMeter Control Center.lnk [2016-02-22]
ShortcutTarget: CodeMeter Control Center.lnk -> C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeterCC.exe (WIBU-SYSTEMS AG)
BootExecute: autocheck autochk * sdnclean64.exe
GroupPolicyScripts: Restriction <======= ATTENTION
GroupPolicyScripts\User: Restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\..\Interfaces\{26B5BF47-054C-40BC-9B2D-12AE95F2EB2B}: [NameServer] 192.168.1.23,24.92.226.12
Tcpip\..\Interfaces\{DB7AA593-DC47-443E-8A20-0FCE582526C0}: [NameServer] 192.168.1.4
Tcpip\..\Interfaces\{DB7AA593-DC47-443E-8A20-0FCE582526C0}: [DhcpNameServer] 192.168.1.180
Internet Explorer:
==================
HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000 -> DefaultScope {8EEAC88A-079B-4b2c-80C1-7836F79EB40A} URL = hxxp://us.search.yahoo.com/search?p={searchTerms}&fr=chr-comodo
SearchScopes: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000 -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL =
SearchScopes: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000 -> {8EEAC88A-079B-4b2c-80C1-7836F79EB40A} URL = hxxp://us.search.yahoo.com/search?p={searchTerms}&fr=chr-comodo
BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin64.dll [2015-06-17] (RealDownloader)
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll [2016-05-17] (Microsoft Corporation)
BHO: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll [2014-05-19] (Logitech, Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2016-04-12] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2016-05-17] (Microsoft Corporation)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2015-06-17] (RealDownloader)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\OCHelper.dll [2016-05-17] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\ssv.dll [2016-05-16] (Oracle Corporation)
BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll [2010-10-27] (Atheros Commnucations)
BHO-x32: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll [2014-05-19] (Logitech, Inc.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\URLREDIR.DLL [2016-04-12] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\GROOVEEX.DLL [2016-05-17] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\jp2ssv.dll [2016-05-16] (Oracle Corporation)
Toolbar: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
DPF: HKLM-x32 {0D41B8C5-2599-4893-8183-00195EC8D5F9} hxxp://support.asus.com/select/asusTek_sys_ctrl3.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2016-04-19] (Microsoft Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\MSOSB.DLL [2016-04-19] (Microsoft Corporation)
FireFox:
========
FF ProfilePath: C:\Users\Antec-179\AppData\Roaming\Mozilla\Firefox\Profiles\ptey35xx.default-1402568974972
FF DefaultSearchEngine: Google
FF DefaultSearchEngine.US: Google
FF Homepage: hxxp://news.yahoo.com/us/
FF NetworkProxy: "type", 4
FF Plugin: @3ds.com/3dxml -> C:\Program Files\Dassault Systemes\3D XML Player\win_b64\code\bin\NP3DXMLPlugin.dll [2012-10-30] ()
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_22_0_0_192.dll [2016-06-21] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-10-08] (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [No File]
FF Plugin-x32: @3ds.com/3dxml -> C:\Program Files\Dassault Systemes\3D XML Player\win_b64\code\bin32\NP3DXMLPlugin.dll [2011-12-19] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_22_0_0_192.dll [2016-06-21] ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-04-15] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-04-15] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-04-15] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-04-15] (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\dtplugin\npDeployJava1.dll [2016-05-16] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\plugin2\npjp2.dll [2016-05-16] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-11-03] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\NPSPWRAP.DLL [2015-10-08] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-07-22] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-07-22] (NVIDIA Corporation)
FF Plugin-x32: @real.com/nppl3260;version=18.0.1.9 -> c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll [2015-07-06] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=18.0.1.9 -> c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll [2015-07-06] (RealTimes)
FF Plugin-x32: @vmware.com/client-support,version=5.1.0.00000 -> C:\Program Files (x86)\VMware\Client Integration Plug-in 5.1\ClientSupportTools\np-vmware-client-support.dll [2015-08-08] (VMware, Inc.)
FF Plugin-x32: @vmware.com/vmrc,version=2.5.0.00000 -> C:\Program Files (x86)\Common Files\VMware\VMware VMRC Plug-in\Firefox\np-vmware-vmrc.dll [2014-06-20] (VMware, Inc.)
FF Plugin-x32: @vmware.com/vmrc,version=5.1.0.00000 -> C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.1\Firefox\np-vmware-vmrc.dll [2014-11-19] (VMware, Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-05-27] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3303728595-2053281234-2614305378-1000: @citrixonline.com/appdetectorplugin -> C:\Users\Antec-179\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2014-04-09] (Citrix Online)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2016-05-27] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Antec-179\AppData\Roaming\mozilla\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Users\Antec-179\AppData\Roaming\mozilla\plugins\nppdf32.dll [2013-05-11] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Antec-179\AppData\Roaming\mozilla\plugins\nppl3260.dll [2013-06-25] (RealNetworks, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Antec-179\AppData\Roaming\mozilla\plugins\nprpplugin.dll [2013-06-25] (RealPlayer)
FF SearchPlugin: C:\Users\Antec-179\AppData\Roaming\Mozilla\Firefox\Profiles\ptey35xx.default-1402568974972\searchplugins\support-home-page-search.xml [2015-05-16]
FF Extension: NoUn Buttons - C:\Users\Antec-179\AppData\Roaming\Mozilla\Firefox\Profiles\ptey35xx.default-1402568974972\extensions\{99f30549-35d4-11d9-8a2a-396c6e707e82}.xpi [2016-04-28]
FF Extension: ShowIP - C:\Users\Antec-179\AppData\Roaming\Mozilla\Firefox\Profiles\ptey35xx.default-1402568974972\extensions\{3e9bb2a7-62ca-4efa-a4e6-f6f6168a652d}.xpi [2016-04-28]
FF Extension: FireFTP - C:\Users\Antec-179\AppData\Roaming\Mozilla\Firefox\Profiles\ptey35xx.default-1402568974972\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f} [2016-06-22]
FF Extension: IP Address and Domain Information - C:\Users\Antec-179\AppData\Roaming\Mozilla\Firefox\Profiles\ptey35xx.default-1402568974972\Extensions\jid0-jJRRRBMgoShUhb07IvnxTBAl29w@jetpack.xpi [2016-01-11]
FF Extension: Toolbar Buttons - C:\Users\Antec-179\AppData\Roaming\Mozilla\Firefox\Profiles\ptey35xx.default-1402568974972\Extensions\{03B08592-E5B4-45ff-A0BE-C1D975458688}.xpi [2016-04-27]
FF Extension: Password Exporter - C:\Users\Antec-179\AppData\Roaming\Mozilla\Firefox\Profiles\ptey35xx.default-1402568974972\Extensions\{B17C1C5A-04B1-11DB-9804-B622A1EF5492}.xpi [2016-04-05]
FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext => not found
FF HKLM-x32\...\Firefox\Extensions: [ocr@babylon.com] - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\ocr@babylon.com => not found
FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2014-10-01] [not signed]
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 APC Data Service; C:\Program Files (x86)\APC\PowerChute Personal Edition\dataserv.exe [21880 2012-01-24] (Schneider Electric)
R2 APC UPS Service; C:\Program Files (x86)\APC\PowerChute Personal Edition\mainserv.exe [705912 2012-01-24] (Schneider Electric)
R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe [918144 2010-11-03] ()
R2 asHmComSvc; C:\Program Files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe [915584 2010-12-02] ()
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe [586880 2010-10-21] ()
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [52896 2010-10-27] (Atheros Commnucations) [File not signed]
R2 BBDemon; C:\Program Files (x86)\Dassault Systemes\B22\intel_a\code\bin\CATSysDemon.exe [38400 2011-07-29] (Dassault Systemes) [File not signed]
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [3009776 2016-06-22] (Microsoft Corporation)
R2 CmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [5817712 2016-06-16] (COMODO)
R3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [2271928 2016-06-16] (COMODO)
R2 DS License Server; C:\Program Files\Dassault Systemes\DS License Server\win_b64\code\bin\DSLicSrv.exe [888320 2012-09-01] (Dassault Systemes) [File not signed]
R2 HASP Loader; C:\Windows\SysWOW64\nhsrvice.exe [249856 2015-10-05] (Aladdin Knowledge Systems Ltd.) [File not signed]
R2 hasplms; C:\Windows\system32\hasplms.exe [4665168 2015-10-13] (SafeNet Inc.)
R2 HLServer; C:\Windows\SysWOW64\HLS32SVC.EXE [327680 2015-10-13] (Aladdin Knowledge Systems Ltd.) [File not signed]
R2 Mgl3DCtlrRPCService; C:\Program Files\3Dconnexion\3DxWare\3DxWinCore64\Mgl3DCtlrRPCService.exe [57856 2015-12-10] (3Dconnexion) [File not signed]
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
R2 NVWMI; C:\Windows\system32\nvwmi64.exe [3165000 2015-07-23] ()
R2 RealPlayerUpdateSvc; C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe [31856 2015-07-06] ()
R2 RealTimes Desktop Service; c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe [1115224 2015-07-06] (RealNetworks, Inc.)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2016-06-28] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2016-06-28] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2016-06-28] (Safer-Networking Ltd.)
S4 vmware-converter-agent; C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter-a.exe [479824 2013-04-09] (VMware, Inc.)
S4 vmware-converter-server; C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter.exe [479824 2013-04-09] (VMware, Inc.)
S4 vmware-converter-worker; C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter.exe [479824 2013-04-09] (VMware, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 Sentinel RMS License Manager; "C:\Program Files\CGTech\VERICUT 7.2.3\windows64\license\lservnt.exe" [X]
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 3dxhid; C:\Windows\System32\DRIVERS\3dxhid.sys [39184 2015-08-04] (3Dconnexion SAM)
S3 AiCharger; C:\Windows\SysWow64\drivers\AiCharger.sys [14848 2012-03-22] (ASUSTek Computer Inc.)
R3 akshasp; C:\Windows\System32\DRIVERS\akshasp.sys [77912 2015-10-13] (SafeNet Inc.)
R3 akshhl; C:\Windows\System32\DRIVERS\akshhl.sys [81368 2015-10-13] (SafeNet Inc.)
R3 aksusb; C:\Windows\System32\DRIVERS\aksusb.sys [322560 2015-10-13] (SafeNet Inc.)
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()
R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [14464 2010-08-03] ()
S3 bmdrvr; C:\Windows\SysWow64\drivers\bmdrvr.sys [75344 2013-02-22] (VMware, Inc.)
R1 cmderd; C:\Windows\System32\DRIVERS\cmderd.sys [31648 2016-06-15] (COMODO)
R1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [829600 2016-06-15] (COMODO)
R1 cmdHlp; C:\Windows\System32\DRIVERS\cmdhlp.sys [56472 2016-06-15] (COMODO)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R0 FTOIIs; C:\Windows\System32\DRIVERS\FTOIIs.sys [229968 2009-11-24] (Promise Technology, Inc.)
R2 Hardlock; C:\Windows\system32\drivers\hardlock.sys [350552 2015-10-13] (SafeNet Inc.)
R1 inspect; C:\Windows\System32\DRIVERS\inspect.sys [116248 2016-06-15] (COMODO)
R3 KMJHidMini; C:\Windows\System32\DRIVERS\3dxkmj.sys [18944 2015-01-26] (3Dconnextion Inc.)
R3 KMJShim; C:\Windows\System32\DRIVERS\3dxshim.sys [7168 2015-01-26] (3Dconnextion Inc.)
R1 LUMDriver; C:\Windows\system32\drivers\LUMDriver.sys [24848 2008-01-02] (IBM)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1120032 2015-01-23] (Acronis International GmbH)
R0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [198432 2015-01-23] (Acronis International GmbH)
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2013-03-18] (Apple, Inc.) [File not signed]
R0 vidsflt; C:\Windows\System32\DRIVERS\vidsflt.sys [117024 2015-01-23] (Acronis International GmbH)
R2 vstor2-mntapi20-shared; C:\Windows\SysWow64\drivers\vstor2-mntapi20-shared.sys [33872 2013-02-22] (VMware, Inc.)
S3 lmimirr; system32\DRIVERS\lmimirr.sys [X]
S3 vdbus; system32\DRIVERS\vdbus.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-07-06 13:37 - 2016-07-06 13:37 - 00033930 _____ C:\Users\Antec-179\Documents\FRST.txt
2016-07-06 13:34 - 2016-07-06 13:37 - 00000000 ____D C:\FRST
2016-07-06 13:31 - 2016-07-06 13:31 - 05198336 _____ (AVAST Software) C:\Users\Antec-179\Downloads\aswMBR.exe
2016-07-06 13:30 - 2016-07-06 13:34 - 02390016 _____ (Farbar) C:\Users\Antec-179\Documents\Farbar Recovery Scan Tool.exe
2016-07-06 07:37 - 2016-07-06 07:37 - 00000000 ____D C:\Users\Antec-179\Documents\ProcAlyzer Dumps
2016-06-30 14:03 - 2016-06-30 14:03 - 00000000 ____D C:\Users\Antec-179\AppData\Local\MachiningCloud_GmbH
2016-06-30 14:01 - 2016-06-30 14:01 - 00002085 _____ C:\Users\Public\Desktop\Kennametal.lnk
2016-06-30 14:01 - 2016-06-30 14:01 - 00000004 ____H C:\ProgramData\cm-lock
2016-06-30 14:01 - 2016-06-30 14:01 - 00000000 ____D C:\Users\Antec-179\AppData\Roaming\MachiningCloud
2016-06-30 14:01 - 2016-06-30 14:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NOVO-Kennametal
2016-06-30 14:01 - 2016-06-30 14:01 - 00000000 ____D C:\ProgramData\MachiningCloud
2016-06-30 14:01 - 2016-06-30 14:01 - 00000000 ____D C:\Program Files (x86)\NOVO-Kennametal
2016-06-30 13:53 - 2016-06-30 14:01 - 00000000 ___HD C:\ProgramData\{297E00E8-70AA-4641-BCFE-A906A2FCFB0E}
2016-06-30 13:53 - 2016-06-30 14:00 - 00000000 ____D C:\Users\Antec-179\AppData\Local\IIIQF
2016-06-30 13:53 - 2016-06-30 13:53 - 09715712 _____ C:\Users\Antec-179\Downloads\NOVO-Kennametal_2.3.1.120_Production_Setup.msi
2016-06-29 11:58 - 2016-06-29 11:58 - 00195659 _____ C:\Users\Antec-179\Desktop\CNC Systems.pdf
2016-06-29 08:19 - 2016-06-29 08:19 - 06995720 _____ (Piriform Ltd) C:\Users\Antec-179\Downloads\ccsetup519.exe
2016-06-28 17:00 - 2016-06-28 17:00 - 00000000 ____D C:\Program Files\Common Files\AV
2016-06-28 16:57 - 2016-06-28 16:57 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2016-06-28 16:57 - 2016-06-28 16:57 - 00001395 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2016-06-28 16:57 - 2016-06-28 16:57 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2016-06-28 16:55 - 2016-06-28 16:57 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\Antec-179\Downloads\spybot-2.4.exe
2016-06-28 16:31 - 2016-06-28 16:31 - 00015292 _____ C:\Users\Antec-179\Desktop\BBPrecise.xlsx
2016-06-28 15:59 - 2016-06-28 15:59 - 00295163 _____ C:\Users\Antec-179\Desktop\5606428.mcx-9
2016-06-28 11:33 - 2016-06-28 11:33 - 01200863 _____ C:\Users\Antec-179\Downloads\FAPT_LADDER_V06.1.rar
2016-06-27 10:29 - 2016-06-27 10:29 - 00013011 _____ C:\Users\Antec-179\Desktop\Fanuc motor.xlsx
2016-06-24 15:04 - 2016-06-27 06:12 - 149858063 _____ C:\Users\Antec-179\Documents\TEST.Z2G
2016-06-24 08:22 - 2016-06-24 08:22 - 00776583 _____ C:\Users\Antec-179\Desktop\QA-001-006-A0 Instructions for Remove & Install Spindle Motor.pdf
2016-06-21 08:46 - 2016-06-21 08:54 - 00030720 _____ C:\Users\Antec-179\Desktop\Copy of Credit Card Process Form 2015.xls
2016-06-20 16:28 - 2016-06-20 16:28 - 00098475 _____ C:\Users\Antec-179\Desktop\Blankn po for CNC Systems.pdf
2016-06-20 16:23 - 2016-06-20 16:23 - 00097260 _____ C:\Users\Antec-179\Desktop\JB order agreement.pdf
2016-06-16 06:19 - 2016-06-16 06:19 - 00373649 _____ C:\Users\Antec-179\Desktop\coach clinic.pdf
2016-06-10 09:19 - 2016-06-10 14:56 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-06-09 14:19 - 2016-06-09 14:18 - 00075582 _____ C:\Users\Antec-179\Desktop\TRI-20 B-BAR.pdf
2016-06-07 14:48 - 2016-06-07 14:48 - 00296137 _____ C:\Users\Antec-179\Desktop\Extracted pages from TRI-21.pdf
2016-06-07 06:08 - 2016-06-07 06:08 - 00000000 ____D C:\Users\Antec-179\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2016-06-06 10:41 - 2016-06-06 10:40 - 00651214 _____ C:\Users\Antec-179\Desktop\Extracted pages from TRI-20.pdf
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2089-02-18 15:52 - 2012-04-13 09:48 - 00131488 _____ C:\Users\Antec-179\Documents\PMC-RB.LAD
2016-07-06 13:32 - 2016-03-23 07:05 - 00077336 _____ C:\Windows\system32\Drivers\fvstore.dat
2016-07-06 13:30 - 2016-02-22 07:42 - 01474832 _____ C:\Windows\system32\Drivers\sfi.dat
2016-07-06 10:53 - 2013-08-12 08:47 - 00000000 ____D C:\Users\Antec-179\AppData\Roaming\VMware
2016-07-06 08:52 - 2014-02-12 11:44 - 00000000 ____D C:\Users\Antec-179\AppData\Roaming\Mastercam
2016-07-06 08:52 - 2013-01-30 08:00 - 00000103 _____ C:\Windows\mwMSimApp.INI
2016-07-06 08:52 - 2012-04-13 16:07 - 00000000 ____D C:\Users\Antec-179\AppData\Local\CrashDumps
2016-07-06 08:41 - 2014-07-18 10:24 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-07-05 15:05 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\inf
2016-07-05 10:51 - 2012-04-14 09:27 - 00000000 ____D C:\Users\Antec-179\Desktop\email
2016-07-05 07:03 - 2015-10-13 13:32 - 00000104 _____ C:\Windows\system32\config\netlogon.ftl
2016-07-05 06:14 - 2014-12-15 14:12 - 00000000 ____D C:\ProgramData\Ad-Aware Browsing Protection
2016-07-01 18:01 - 2009-07-14 00:45 - 00032096 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-07-01 18:01 - 2009-07-14 00:45 - 00032096 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-07-01 11:26 - 2009-07-14 01:13 - 00905800 _____ C:\Windows\system32\PerfStringBackup.INI
2016-07-01 08:23 - 2015-06-01 07:23 - 00000642 _____ C:\Windows\Tasks\G2MUploadTask-S-1-5-21-3303728595-2053281234-2614305378-1000.job
2016-07-01 08:23 - 2014-06-06 11:44 - 00000546 _____ C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-3303728595-2053281234-2614305378-1000.job
2016-06-30 14:00 - 2015-10-01 06:33 - 00000012 _____ C:\Windows\SysWOW64\haspaddr.dat
2016-06-30 14:00 - 2014-07-18 10:23 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-06-30 14:00 - 2012-05-18 09:38 - 00030374 _____ C:\Windows\SysWOW64\PCPELog.txt
2016-06-30 14:00 - 2012-04-10 15:09 - 00000000 ____D C:\ProgramData\NVIDIA
2016-06-30 14:00 - 2009-07-14 01:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-06-30 14:00 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\schemas
2016-06-30 13:56 - 2012-04-11 15:10 - 00880828 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2016-06-29 07:27 - 2014-07-18 10:23 - 00140672 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-06-29 07:27 - 2014-07-18 10:23 - 00064896 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-06-29 07:27 - 2014-07-18 10:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-06-29 07:27 - 2013-04-12 13:34 - 00027008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-06-29 06:02 - 2009-07-13 22:34 - 00452975 ____R C:\Windows\system32\Drivers\etc\hosts.20160629-081738.backup
2016-06-29 06:00 - 2013-04-12 14:48 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2016-06-28 16:57 - 2013-04-12 14:49 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2016-06-22 08:05 - 2014-09-29 06:42 - 00000000 ____D C:\Users\Antec-179\Desktop\Programming tips
2016-06-22 06:25 - 2016-05-27 05:47 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2016-06-22 06:24 - 2015-10-08 16:08 - 00000000 ____D C:\Program Files\Microsoft Office 15
2016-06-21 15:27 - 2014-12-02 11:17 - 00000000 ___RD C:\Users\Antec-179\Dropbox
2016-06-21 06:07 - 2014-06-13 06:23 - 00000000 ____D C:\Users\Antec-179\AppData\Local\Adobe
2016-06-21 06:06 - 2012-04-10 15:07 - 00796352 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-06-21 06:06 - 2012-04-10 15:07 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-06-20 16:28 - 2012-04-14 09:27 - 00000000 ____D C:\Users\Antec-179\Desktop\QUOTES-PO'S
2016-06-16 16:30 - 2014-12-02 11:15 - 00000000 ____D C:\Users\Antec-179\AppData\Roaming\Dropbox
2016-06-16 16:29 - 2015-10-20 13:39 - 00000000 ____D C:\Users\Antec-179\AppData\Local\Dropbox
2016-06-15 02:12 - 2015-11-18 18:14 - 00829600 _____ (COMODO) C:\Windows\system32\Drivers\cmdguard.sys
2016-06-15 02:12 - 2015-11-18 18:14 - 00031648 _____ (COMODO) C:\Windows\system32\Drivers\cmderd.sys
2016-06-15 02:12 - 2015-08-05 01:31 - 00116248 _____ (COMODO) C:\Windows\system32\Drivers\inspect.sys
2016-06-15 02:12 - 2015-08-05 01:31 - 00056472 _____ (COMODO) C:\Windows\system32\Drivers\cmdhlp.sys
2016-06-15 02:08 - 2015-09-03 12:52 - 00793104 _____ (COMODO) C:\Windows\system32\guard64.dll
2016-06-15 02:08 - 2015-09-03 12:52 - 00626288 _____ (COMODO) C:\Windows\SysWOW64\guard32.dll
2016-06-15 02:08 - 2015-08-05 01:29 - 00051800 _____ (COMODO) C:\Windows\system32\cmdcsr.dll
2016-06-15 02:04 - 2015-08-05 01:28 - 00365752 _____ (COMODO) C:\Windows\system32\cmdvrt64.dll
2016-06-15 02:02 - 2015-08-05 01:28 - 00051896 _____ (COMODO) C:\Windows\system32\cmdkbd64.dll
2016-06-15 01:58 - 2015-08-05 01:27 - 00296120 _____ (COMODO) C:\Windows\SysWOW64\cmdvrt32.dll
2016-06-15 01:56 - 2015-08-05 01:26 - 00046776 _____ (COMODO) C:\Windows\SysWOW64\cmdkbd32.dll
2016-06-13 15:36 - 2014-06-02 16:44 - 00000000 ____D C:\new website files
2016-06-10 16:31 - 2013-07-08 09:01 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-06-09 14:19 - 2012-05-25 06:17 - 00000000 ____D C:\Users\Antec-179\AppData\Local\CutePDF Writer
2016-06-06 06:22 - 2015-07-07 16:27 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
==================== Files in the root of some directories =======
2015-02-04 11:45 - 2015-02-04 11:45 - 0000121 _____ () C:\Users\Antec-179\AppData\Roaming\default.rss
2013-10-29 09:27 - 2014-02-24 07:27 - 0000177 _____ () C:\Users\Antec-179\AppData\Roaming\WB.CFG
2014-01-28 07:27 - 2014-01-28 07:27 - 0000005 _____ () C:\Users\Antec-179\AppData\Roaming\WBPU-TTL.DAT
2014-01-20 09:55 - 2014-05-13 06:14 - 0003584 _____ () C:\Users\Antec-179\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-05-30 08:43 - 2016-03-15 06:38 - 0000600 _____ () C:\Users\Antec-179\AppData\Local\PUTTY.RND
2012-04-17 16:36 - 2015-01-06 17:25 - 0007635 _____ () C:\Users\Antec-179\AppData\Local\Resmon.ResmonCfg
2016-06-30 14:01 - 2016-06-30 14:01 - 0000004 ____H () C:\ProgramData\cm-lock
Files to move or delete:
====================
C:\Users\Antec-179\.vmrc_plugin_ovftool_settings.js
C:\Users\Antec-179\en_res.dll
C:\Users\Antec-179\es_res.dll
C:\Users\Antec-179\fr_res.dll
C:\Users\Antec-179\grm_res.dll
C:\Users\Antec-179\it_res.dll
C:\Users\Antec-179\jp_res.dll
C:\Users\Antec-179\mfc80u.dll
C:\Users\Antec-179\msvcr80.dll
C:\Users\Antec-179\PCPE Setup.exe
C:\Users\Antec-179\pt_res.dll
C:\Users\Antec-179\ResourceReader.dll
C:\Users\Antec-179\ru_res.dll
C:\Users\Antec-179\zh_res.dll
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2016-06-27 00:50
==================== End of FRST.txt ============================
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-07-2016
Ran by Antec-179 (2016-07-06 13:37:22)
Running from C:\Users\Antec-179\Documents
Windows 7 Professional Service Pack 1 (X64) (2012-04-10 18:50:05)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-3303728595-2053281234-2614305378-500 - Administrator - Disabled)
Antec-179 (S-1-5-21-3303728595-2053281234-2614305378-1000 - Administrator - Enabled) => C:\Users\Antec-179
Guest (S-1-5-21-3303728595-2053281234-2614305378-501 - Administrator - Enabled)
___VMware_Conv_SA___ (S-1-5-21-3303728595-2053281234-2614305378-1009 - Administrator - Enabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AV: COMODO Antivirus (Enabled - Up to date) {D0CC7563-ABD2-DEBE-138E-FDD553335AF2}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Comodo Defense+ (Enabled - Up to date) {6BAD9487-8DE8-D130-293E-C6A728B4104F}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
FW: COMODO Firewall (Enabled) {E8F7F446-E1BD-DFE6-38D1-54E0ADE01D89}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
3D XML Player (HKLM\...\{52FDBE6F-53FE-47C5-8D49-6366555D7056}) (Version: 12.36.12304 - Dassault Systemes)
3Dconnexion 3DxWare 10 (64-bit) (HKLM-x32\...\{BAFCA6AC-8B37-405B-B57E-C1D45DE70ACC}) (Version: 10.3.0 - 3Dconnexion)
3Dconnexion 3DxWinCore (Version: 17.3.0.12346 - 3Dconnexion) Hidden
3Dconnexion Add-In for AutoCAD (Version: 5.1.0 - 3Dconnexion) Hidden
3Dconnexion Add-In for Inventor 11 - 2016 (Version: 2.1.1 - 3Dconnexion) Hidden
3Dconnexion Add-In for Solid Edge V18 - ST8 (Version: 3.3.0 - 3Dconnexion) Hidden
3Dconnexion Add-In for SOLIDWORKS 2005 - 2016 (Version: 3.3.0 - 3Dconnexion) Hidden
3Dconnexion Add-On for XSI v5.0 - 2015 (Version: 3.0.3 - 3Dconnexion) Hidden
3Dconnexion Collage (x32 Version: 1.3.0 - 3Dconnexion) Hidden
3Dconnexion Extension for SketchUp (Version: 4.2.1 - 3Dconnexion) Hidden
3Dconnexion LCD Applets for SpacePilot Pro (Version: 1.3.3 - 3Dconnexion) Hidden
3Dconnexion Plug-In for 3ds Max 2008 - 2016 (Version: 6.1.2 - 3Dconnexion) Hidden
3Dconnexion Plug-in for Acrobat 3D (x32 Version: 1.4.0 - 3Dconnexion) Hidden
3Dconnexion Plug-In for Maya v8.5 - 2016 (Version: 5.1.1 - 3Dconnexion) Hidden
3Dconnexion Plug-In for NX v4.0 - v11.0 (Version: 3.3.0 - 3Dconnexion) Hidden
3Dconnexion Plug-In for Photoshop CS3 - CS6 and CC (Version: 2.4.0 - 3Dconnexion) Hidden
3Dconnexion Plug-In for Pro/ENGINEER Wildfire 3.0 - Creo 3.0 (Version: 2.2.4 - 3Dconnexion) Hidden
3Dconnexion Trainer (x32 Version: 3.2.3 - 3Dconnexion) Hidden
3Dconnexion Viewer and Assembly Demo (x32 Version: 0.9.0.0 - 3Dconnexion) Hidden
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Acronis True Image 2014 (HKLM-x32\...\{5858B1D6-8056-471C-8A29-6A1765BBC0BE}) (Version: 17.0.4515 - Acronis)
Ad-Aware Browsing Protection (HKLM-x32\...\Ad-Aware Browsing Protection) (Version: 1.0.1.110 - Lavasoft)
Adobe Acrobat Reader DC MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}) (Version: 15.016.20045 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.4.0.2710 - Adobe Systems Incorporated)
Adobe Flash Player 12 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 12.0.0.70 - Adobe Systems Incorporated)
Adobe Flash Player 22 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 22.0.0.192 - Adobe Systems Incorporated)
Advertising Center (x32 Version: 0.0.0.2 - Nero AG) Hidden
Aladdin DiagnostiX 1.10 (HKLM-x32\...\Aladdin DiagnostiX 1.10) (Version: - )
Aladdin Monitor 1.4.2 (HKLM-x32\...\Aladdin Monitor 1.4.2) (Version: - )
Bluetooth Win7 Suite (64) (HKLM\...\{230D1595-57DA-4933-8C4E-375797EBB7E1}) (Version: 7.2.0.40 - Atheros Communications)
BOINC (HKLM\...\{AA72DFB8-BA38-49C9-B5A4-A95FD62641F8}) (Version: 7.0.28 - Space Sciences Laboratory, U.C. Berkeley)
CCleaner (HKLM\...\CCleaner) (Version: 5.19 - Piriform)
CIMCO Edit V7 (HKLM-x32\...\CIMCO Edit V7) (Version: 7.55.07 - CIMCO A/S)
Citrix Online Launcher (HKLM-x32\...\{DB014C85-A264-4BCA-A66F-6DD1FCF8EC36}) (Version: 1.0.335 - Citrix)
cncCoder (HKLM-x32\...\cncCoder_is1) (Version: 4.1 - Axis Controls Ltd)
CodeMeter Runtime Kit v4.50c (HKLM\...\{D2ABD3EE-94BD-48BB-A6C6-E4FFDA64001E}) (Version: 4.50.906.503 - WIBU-SYSTEMS AG)
COMODO Internet Security Premium (HKLM\...\{04833277-EE61-4251-9273-0CF86C0FE710}) (Version: 8.2.0.4792 - COMODO Security Solutions Inc.)
CutePDF Writer 2.8 (HKLM\...\CutePDF Writer Installation) (Version: - )
Dassault Systemes Software Prerequisites x86-x64 (HKLM\...\{CF1EB598-B424-436A-B15F-B763846BA970}) (Version: 8.1.3 - Dassault Systemes)
Dassault Systemes Software VC10 Prerequisites x86-x64 (HKLM\...\{7C534131-6431-4ECB-9069-525CB5F75CC8}) (Version: 10.1.1 - Dassault Systemes)
Dassault Systemes Software VC9 Prerequisites x86-x64 (HKLM\...\{F2F2DEA7-36AB-4E13-907C-D8BDE775EF97}) (Version: 9.1.2 - Dassault Systemes)
Dassault Systemes Software Version 5-6 Release 2012 (B22) (HKLM\...\Dassault Systemes B22_0) (Version: - )
Dropbox (HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\Dropbox) (Version: 4.4.29 - Dropbox, Inc.)
DS License Server (HKLM\...\{A224E59D-BEA4-43CE-98A9-A08AC73C33D3}) (Version: 6.214.02470 - Dassault Systemes)
eDrawings 2015 x64 (HKLM\...\{84177FAE-7ADD-474F-92A9-0085D6AFCBDC}) (Version: 15.3.0030 - Dassault Systèmes SolidWorks Corp)
eReg (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
Extended Asian Language font pack for Adobe Reader XI (HKLM-x32\...\{AC76BA86-7AD7-2530-0000-A00000000004}) (Version: 11.0.0 - Adobe Systems Incorporated)
Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 7.3.4.311 - Foxit Software Inc.)
Garmin Communicator Plugin x64 (HKLM\...\{550331CC-C34B-494F-BCDA-37CE4EF6E924}) (Version: 4.0.3 - Garmin Ltd or its subsidiaries)
Garmin Lifetime Updater (HKLM-x32\...\{9AAD03E8-4F65-4DE2-8F6C-1B079C0C8521}) (Version: 2.1.11 - Garmin)
GoToMeeting 7.20.0.5174 (HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\GoToMeeting) (Version: 7.20.0.5174 - CitrixOnline)
GWizardE (x32 Version: 0.4.0 - CNCCookbook, Inc.) Hidden
HASP License Manager (HKLM-x32\...\HASP License Manager) (Version: - )
HaspX (HKLM\...\{32c229e8-ea25-41bd-95bd-00650b385a5f}.sdb) (Version: - )
ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden
InspectionXpert GDT Font Installer (HKLM-x32\...\{C8605789-934D-47B3-9CE6-AE880CBC6033}) (Version: 1.1.0.0 - InspectionXpert)
InspectionXpert OnDemand x64 (HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\ea66fb5ec48b6827) (Version: 5.3.2.1115 - InspectionXpert OnDemand x64)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.2.1410 - Intel Corporation)
Intel(R) Network Connections 18.7.28.0 (HKLM\...\PROSetDX) (Version: 18.7.28.0 - Intel)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.5.0.1026 - Intel Corporation)
Intel® Trusted Connect Service Client (HKLM\...\{09536BA1-E498-4CC3-B834-D884A67D7E34}) (Version: 1.23.605.1 - Intel Corporation)
Intel® Watchdog Timer Driver (Intel® WDT) (HKLM-x32\...\{3FD0C489-0F02-481a-A3E1-9754CD396761}) (Version: - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.32 - Irfan Skiljan)
Java 8 Update 91 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218091F0}) (Version: 8.0.910.14 - Oracle Corporation)
K-Lite Codec Pack 7.0.0 (Standard) (HKLM-x32\...\KLiteCodecPack_is1) (Version: 7.0.0 - )
Logitech SetPoint 6.65 (HKLM\...\sp6) (Version: 6.65.62 - Logitech)
Logitech Unifying Software 2.50 (HKLM\...\Logitech Unifying) (Version: 2.50.25 - Logitech)
Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
marvell 91xx driver (HKLM-x32\...\MagniDriver) (Version: 1.0.0.1045 - Marvell)
Mastercam Licensing Installer (HKLM\...\{56D9A6A3-5D54-44F6-9C26-4956B2337387}) (Version: 18.0.11898.0 - CNC Software, Inc.)
Mastercam X7 (x32 Version: 16.0.5.5 - CNC Software, Inc.) Hidden
Mastercam X7 (x32 Version: 2.00.2000 - CNC Software, Inc.) Hidden
Mastercam X9 (Arc MultiEdit AddOn) (HKLM\...\{3BA84FAD-D8A5-45ED-BE0B-B2C772678E7D}) (Version: 18.0.5.27 - CNC Software, Inc.)
Mastercam X9 (HKLM-x32\...\Mastercam X9) (Version: 18.0.11898.0 - CNC Software, Inc.)
Mastercam X9 (LevelSetsVisibility AddOn) (HKLM\...\{8624C0D9-C433-4919-846F-421A2BABB264}) (Version: 17.0.0.1 - CNC Software, Inc.)
Mastercam X9 (Pts2Arcs AddOn) (HKLM\...\{4A205CFB-E234-444A-8E3A-EA4D87700C38}) (Version: 18.0.1.1 - CNC Software, Inc.)
Mastercam X9 (ScriptLinker AddOn) (HKLM\...\{FB60C5AB-AFE7-4776-85D4-709DACDA3D2B}) (Version: 18.0.2.5 - CNC Software, Inc.)
Mastercam X9 (SortCircles AddOn) (HKLM\...\{8C118E97-89DB-4E9A-8134-D8A495471B28}) (Version: 18.0.1.4 - CNC Software, Inc.)
Mastercam X9 (Version: 18.0.18466.0 - CNC Software, Inc.) Hidden
Mastercam X9 (vHelix AddOn) (HKLM\...\{3D897DA6-26E2-409C-AA81-88CF2A1B8519}) (Version: 18.0.1.2 - CNC Software, Inc.)
Mastercam X9 (zSpiral AddOn) (HKLM\...\{F3EBA408-ECCE-43AA-A3D2-7C148CB66859}) (Version: 18.0.1.6 - CNC Software, Inc.)
Menu Templates - Pack 1 (x32 Version: 9.6.0.0 - Nero AG) Hidden
Menu Templates - Starter Kit (x32 Version: 9.6.0.0 - Nero AG) Hidden
Microsoft .NET Framework 4.6.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft Help Viewer 1.0 (HKLM\...\Microsoft Help Viewer 1.0) (Version: 1.0.30319 - Microsoft Corporation)
Microsoft Help Viewer 2.0 (HKLM-x32\...\Microsoft Help Viewer 2.0) (Version: 2.0.50727 - Microsoft Corporation)
Microsoft Office 365 ProPlus - en-us (HKLM\...\O365ProPlusRetail - en-us) (Version: 15.0.4833.1001 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Sync Framework Runtime v1.0 SP1 (x64) (HKLM\...\{8438EC02-B8A9-462D-AC72-1B521349C001}) (Version: 1.0.3010.0 - Microsoft Corporation)
Microsoft Sync Framework SDK v1.0 SP1 (HKLM-x32\...\{0E3DFC64-CC49-4BE2-8C9C-58EF129675DB}) (Version: 1.0.3010.0 - Microsoft Corporation)
Microsoft Sync Framework Services v1.0 SP1 (x64) (HKLM\...\{034106B5-54B7-467F-B477-5B7DBB492624}) (Version: 1.0.3010.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual F# 2.0 Runtime (HKLM-x32\...\{729A3000-BC8A-3B74-BA5D-5068FE12D70C}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual J# 2.0 Redistributable Package - SE (x64) (HKLM\...\Microsoft Visual J# 2.0 Redistributable Package - SE (x64)) (Version: - Microsoft Corporation)
Movie Templates - Starter Kit (x32 Version: 9.6.0.0 - Nero AG) Hidden
Mozilla Firefox 47.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 47.0 (x86 en-US)) (Version: 47.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 47.0.0.5999 - Mozilla)
Mozilla Thunderbird 31.2.0 (x86 en-US) (HKLM-x32\...\Mozilla Thunderbird 31.2.0 (x86 en-US)) (Version: 31.2.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
Nero 9 Essentials (HKLM-x32\...\{0e8d6e9b-e4f1-4881-9d4b-e471e2e10310}) (Version: - Nero AG)
NOVO-Kennametal (HKLM-x32\...\NOVO-Kennametal) (Version: 2.3.1.120 - Machining Cloud GmbH)
NOVO-Kennametal (x32 Version: 2.3.1.120 - Machining Cloud GmbH) Hidden
NVIDIA 3D Vision Controller Driver 352.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 352.65 - NVIDIA Corporation)
NVIDIA 3D Vision Driver 353.62 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 353.62 - NVIDIA Corporation)
NVIDIA Graphics Driver 353.62 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 353.62 - NVIDIA Corporation)
NVIDIA HD Audio Driver 1.3.34.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.34.3 - NVIDIA Corporation)
NVIDIA nView 146.33 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView) (Version: 146.33 - NVIDIA Corporation)
NVIDIA WMI 2.22.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVWMI) (Version: 2.22.0 - NVIDIA Corporation)
Office 15 Click-to-Run Extensibility Component (Version: 15.0.4833.1001 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4833.1001 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (Version: 15.0.4833.1001 - Microsoft Corporation) Hidden
OpenOffice 4.1.1 (HKLM-x32\...\{9395F41D-0F80-432E-9A59-B8E477E7E163}) (Version: 4.11.9775 - Apache Software Foundation)
PowerChute Personal Edition 3.0.2 (HKLM-x32\...\{8ED262EE-FC73-47A9-BB86-D92223246881}) (Version: 3.0.2 - Schneider Electric)
Prerequisites for SSDT (HKLM-x32\...\{9169C939-ED01-446A-BD0C-29873BAF4E48}) (Version: 11.0.2100.60 - Microsoft Corporation)
PuTTY release 0.64 (HKLM-x32\...\PuTTY_is1) (Version: 0.64 - Simon Tatham)
RealDownloader (x32 Version: 18.0.1.10 - RealNetworks, Inc.) Hidden
RealDownloader (x32 Version: 18.0.1.9 - RealNetworks) Hidden
RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0 - RealNetworks, Inc) Hidden
Realtek Ethernet Controller Driver For Windows 7 (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.21.531.2010 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6235 - Realtek Semiconductor Corp.)
RealTimes (RealPlayer) (HKLM-x32\...\RealPlayer 18.0) (Version: 18.0.1 - RealNetworks)
RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) Hidden
Recuva (HKLM\...\Recuva) (Version: 1.43 - Piriform)
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.0.32.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.32.0 - Renesas Electronics Corporation) Hidden
SDFormatter (HKLM-x32\...\{179324FF-7B16-4BA8-9836-055CAAEE4F08}) (Version: 4.0.0 - SD Association)
Sentinel Runtime (HKLM-x32\...\{2A414CBE-CDF3-48C6-A91B-D3D4522F8EB5}) (Version: 6.60.1.36770 - SafeNet Inc.)
SolidWorks eDrawings 2013 x64 (HKLM\...\{E59710B0-0A5A-4956-8496-D7EE0532D4A9}) (Version: 13.3.111 - Dassault Systèmes SolidWorks Corp)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
TurboCAD Professional 15 (HKLM-x32\...\{2BC3CCC0-1149-424F-AF73-4D0C5C053033}) (Version: 15.1 - IMSIDesign)
Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)
Update for (KB2504637) (HKLM-x32\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}.KB2504637) (Version: 1 - Microsoft Corporation)
UpdateService (x32 Version: 1.0.0 - RealNetworks, Inc.) Hidden
USB Disk Storage Format Tool 5.1 (HKLM\...\USB Disk Storage Format Tool_is1) (Version: - Authorsoft Corporation)
VBA (3821b) (x32 Version: 6.01.00.1234 - Microsoft Corporation) Hidden
VC_CRT_x64 (Version: 1.02.0000 - Intel Corporation) Hidden
Video Downloader (x32 Version: 1.0.0 - RealNetworks) Hidden
VMware Client Integration Plug-in 5.1.0 (HKLM-x32\...\{17B9AB5C-356D-4B28-BEB9-A15AF12C36F0}) (Version: 5.1.0.2968519 - VMware, Inc.)
VMware vCenter Converter Standalone (HKLM-x32\...\{17C3235A-A4B9-44ED-8794-54D8408F9733}) (Version: 5.1.0.1087880 - VMware, Inc.)
VMware vSphere Client 5.0 (HKLM-x32\...\{04805AB6-F757-496A-8D56-37A0FC5FF6F3}) (Version: 5.0.0.44739 - VMware, Inc.)
VMware vSphere Client 5.1 (HKLM-x32\...\{09DC364B-A77A-49A0-972B-E43F0DACC5E3}) (Version: 5.1.0.6443 - VMware, Inc.)
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
Zip Extractor Packages (HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\Zip Extractor Packages) (Version: - ) <==== ATTENTION
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Program Files (x86)\Citrix\GoToMeeting\1350\G2MOutlookAddin64.dll (Citrix Online, a division of Citrix Systems, Inc.)
CustomCLSID: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {1D1028CD-8825-41E7-A8DF-5B3219DD76BB} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => c:\Program Files\Microsoft IntelliPoint\IPoint.exe
Task: {1E4BA4DD-AE08-4AB9-91C4-76EB68716404} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2016-06-22] (Microsoft Corporation)
Task: {1F72E2A6-2CCA-436B-A693-525FA0AB60DC} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2016-05-27] (Microsoft Corporation)
Task: {4FAB8542-E4F9-41B0-A22D-1EAABBE85DB6} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2016-06-28] (Safer-Networking Ltd.)
Task: {52F552CB-706A-4A2D-B5BB-BB70C604A49A} - System32\Tasks\G2MUpdateTask-S-1-5-21-3303728595-2053281234-2614305378-1000 => C:\Program Files (x86)\Citrix\GoToMeeting\1440\g2mupdate.exe [2014-06-16] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {5A23D24F-0DA5-4F50-BCD8-6AC5AF078470} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2016-06-28] (Safer-Networking Ltd.)
Task: {626609C7-53BA-4187-A588-D582EF1BD0DA} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2016-06-22] (Microsoft Corporation)
Task: {6B1F246C-F2C0-46D1-98CF-30447B07FAA4} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2016-06-28] (Safer-Networking Ltd.)
Task: {713F67E6-E86E-4DCD-BDA2-D8EFFBD13401} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-3303728595-2053281234-2614305378-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe [2015-07-06] (RealNetworks, Inc.)
Task: {738FD452-3659-44F7-9BEE-7634A0207B66} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx64\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2016-05-27] (Microsoft Corporation)
Task: {83C72957-0E7B-494B-910B-0C4EC57E02FF} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3303728595-2053281234-2614305378-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2015-07-06] (RealNetworks, Inc.)
Task: {8E43596F-6CA7-40C6-96F5-2283BDEABCD7} - System32\Tasks\3DconnexionCreateProcess_3DxService.exe => C:\Program Files\3Dconnexion\3DxWare\3DxWinCore64\3DxService.exe [2015-12-10] (3Dconnexion, INC)
Task: {9D93756F-BADF-4D08-81DF-89EDED6027A6} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2016-06-29] (Piriform Ltd)
Task: {A8067182-96C8-48CB-B422-5E9CC8C51AF7} - System32\Tasks\COMODO\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2016-06-16] (COMODO)
Task: {A933E935-7FDD-4B67-A8F5-35BD961F8874} - System32\Tasks\RealDownloader Update Check => C:\Program Files (x86)\RealNetworks\RealDownloader\downloader2.exe [2015-07-06] ()
Task: {ABC220CE-A0C6-449C-9EBC-3BF64DEB9CB0} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-3303728595-2053281234-2614305378-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2015-07-06] (RealNetworks, Inc.)
Task: {ACBFA9C1-38E3-4F24-A461-3B9992CAF0D4} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-05-11] (Adobe Systems Incorporated)
Task: {B9589194-DD6A-42CB-9404-159E6B0C758A} - System32\Tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2016-06-16] (COMODO)
Task: {D7573B29-4D2E-4CBD-AFEF-E3486BA5EE87} - System32\Tasks\COMODO\COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [2016-06-16] (COMODO)
Task: {E64ECC22-6B54-4EFA-8FA3-13B3B7D36181} - System32\Tasks\COMODO\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2016-06-16] (COMODO)
Task: {F7ABAB27-5CA5-4FB8-99B6-6510EAE30B0F} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2016-05-27] (Microsoft Corporation)
Task: {FC0B6857-65B0-4874-9FA5-E0291486805E} - System32\Tasks\COMODO\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2016-06-16] (COMODO)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3303728595-2053281234-2614305378-1000Core.job => C:\Users\Antec-179\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-3303728595-2053281234-2614305378-1000.job => C:\Program Files (x86)\Citrix\GoToMeeting\5174\g2mupdate.exe
Task: C:\Windows\Tasks\G2MUploadTask-S-1-5-21-3303728595-2053281234-2614305378-1000.job => C:\Program Files (x86)\Citrix\GoToMeeting\5174\g2mupload.exe
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
==================== Loaded Modules (Whitelisted) ==============
2015-08-05 11:41 - 2015-07-23 00:06 - 03165000 _____ () C:\Windows\system32\nvwmi64.exe
2012-05-25 06:16 - 2012-03-11 14:56 - 00086608 _____ () C:\Windows\System32\cpwmon64.dll
2013-10-23 11:15 - 2010-11-03 17:30 - 00918144 ____N () C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe
2013-10-23 11:15 - 2010-12-02 10:15 - 00915584 _____ () C:\Program Files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe
2013-10-23 11:15 - 2010-10-21 17:52 - 00586880 _____ () C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe
2015-10-08 16:08 - 2016-04-19 19:26 - 00114888 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2015-06-17 03:25 - 2015-07-06 05:52 - 00031856 _____ () C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe
2015-08-05 11:41 - 2015-07-22 21:31 - 00116368 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-01-08 23:02 - 2016-03-16 06:25 - 00073912 _____ () C:\Program Files\COMODO\COMODO Internet Security\scanners\smart.cav
2015-11-02 08:23 - 2015-09-01 12:04 - 08901184 _____ () C:\Program Files\Microsoft Office 15\root\Office15\1033\GrooveIntlResource.dll
2015-08-05 11:41 - 2015-07-23 00:06 - 02441360 _____ () C:\Program Files\NVIDIA Corporation\nview\nview64.dll
2010-07-15 00:44 - 2010-07-15 00:44 - 00020032 _____ () C:\Program Files\Unlocker\UnlockerCOM.dll
2013-10-01 11:26 - 2013-10-01 11:26 - 02810968 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll
2015-12-10 19:24 - 2015-12-10 19:24 - 00038912 _____ () C:\Windows\system32\SPWINI.dll
2015-12-11 02:46 - 2015-12-11 02:46 - 00600064 _____ () C:\Program Files\mcamX9\UICtrls.dll
2015-05-15 08:57 - 2015-05-15 08:57 - 00332800 _____ () C:\Program Files\mcamX9\glew64.dll
2015-05-15 11:18 - 2015-05-15 11:18 - 00331776 _____ () C:\Program Files\mcamX9\interfacial14.dll
2015-12-11 04:21 - 2015-12-11 04:21 - 79611392 _____ () C:\Program Files\mcamX9\CHOOKS\5AXMSURF.DLL
2015-05-15 11:18 - 2015-05-15 11:18 - 02606592 _____ () C:\Program Files\mcamX9\RESOURCES\5AXUI_RES.DLL
2015-05-15 09:02 - 2015-05-15 09:02 - 13650944 _____ () C:\Program Files\mcamX9\mwsimutil.dll
2015-05-15 09:02 - 2015-05-15 09:02 - 02975232 _____ () C:\Program Files\mcamX9\MultiXPost.dll
2015-12-11 04:21 - 2015-12-11 04:21 - 23245824 _____ () C:\Program Files\mcamX9\CHOOKS\MACHSIM.DLL
2015-12-11 04:21 - 2015-12-11 04:21 - 07638016 _____ () C:\Program Files\mcamX9\MXPUI.dll
2015-12-11 04:21 - 2015-12-11 04:21 - 32381952 _____ () C:\Program Files\mcamX9\mwMSimApp.dll
2015-12-11 04:20 - 2015-12-11 04:20 - 01330688 _____ () C:\Program Files\mcamX9\mwCustomStreamService.dll
2015-05-15 08:58 - 2015-05-15 08:58 - 02486784 _____ () C:\Program Files\mcamX9\NLib.dll
2015-05-18 17:27 - 2015-05-18 17:27 - 00087552 _____ () C:\Program Files\mcamX9\CHOOKS\SORTCIRCLES.DLL
2015-05-18 17:27 - 2015-05-18 17:27 - 00031744 _____ () C:\Program Files\mcamX9\Resources\SortCirclesRes.dll
2015-12-11 04:21 - 2015-12-11 04:21 - 02903040 _____ () C:\Program Files\mcamX9\mwUbvsProxy.dll
2015-12-11 04:20 - 2015-12-11 04:20 - 20108288 _____ () C:\Program Files\mcamX9\mwSimStreamManager.dll
2015-12-11 04:20 - 2015-12-11 04:20 - 24689152 _____ () C:\Program Files\mcamX9\mwMSimDefGUI.dll
2015-05-15 11:18 - 2015-05-15 11:18 - 00057856 _____ () C:\Program Files\mcamX9\Resources\5axmsurf_res.dll
2015-05-15 11:18 - 2015-05-15 11:18 - 05112832 _____ () C:\Program Files\mcamX9\Resources\mwMachSim_res.dll
2015-12-11 04:21 - 2015-12-11 04:21 - 13470720 _____ () C:\Program Files\mcamX9\mwVerifier.dll
2015-12-11 04:21 - 2015-12-11 04:21 - 01744896 _____ () C:\Program Files\mcamX9\mwVerifierGUI.dll
2015-05-15 11:18 - 2015-05-15 11:18 - 00015360 _____ () C:\Program Files\mcamX9\Resources\mwVerifierGUI_res.dll
2015-05-15 08:57 - 2015-05-15 08:57 - 00332800 _____ () C:\Program Files\mcamX9\EXTENSIONS\glew64.dll
2016-06-30 14:40 - 2016-06-30 14:40 - 00048640 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_64\Trackerbird.Tracker\08fce3efdb4855cfee03c4760afd744e\Trackerbird.Tracker.ni.dll
2013-10-23 11:15 - 2016-06-30 14:00 - 00023040 _____ () C:\Program Files (x86)\ASUS\AXSP\1.00.13\PEbiosinterface32.dll
2013-10-23 11:15 - 2010-06-29 10:58 - 00104448 ____N () C:\Program Files (x86)\ASUS\AXSP\1.00.13\ATKEX.dll
2015-06-17 03:24 - 2015-06-17 03:24 - 00035976 _____ () C:\Program Files (x86)\Real\UpdateService\DL2UpdatePlugin.dll
2015-06-17 03:24 - 2015-06-17 03:24 - 00039560 _____ () C:\Program Files (x86)\Real\UpdateService\RealDownloaderUpdatePlugin.dll
2015-06-17 03:24 - 2015-06-17 03:24 - 00037528 _____ () C:\Program Files (x86)\Real\UpdateService\VideoDLUpdatePlugin.dll
2016-06-28 16:57 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2016-06-28 16:57 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2016-06-28 16:57 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2016-06-28 16:57 - 2016-06-28 16:57 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2016-06-28 16:57 - 2016-06-28 16:57 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2015-06-03 10:41 - 2015-06-03 10:41 - 00172544 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\caaa0003d6df6f1e5791726812a4e66d\IsdiInterop.ni.dll
2013-10-23 11:18 - 2011-04-30 00:28 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2013-11-22 14:03 - 2013-11-22 14:03 - 00028024 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\thread_pool.dll
2013-11-22 14:06 - 2013-11-22 14:06 - 00420160 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\ulxmlrpcpp.dll
2015-08-05 11:41 - 2015-07-23 00:06 - 02000200 _____ () C:\Program Files\NVIDIA Corporation\nview\nview.dll
2013-11-22 14:03 - 2013-11-22 14:03 - 00036672 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\qt_icontray_ex.dll
2014-11-10 13:51 - 2014-11-10 13:51 - 03339376 _____ () C:\Program Files (x86)\Mozilla Thunderbird\mozjs.dll
2014-11-10 13:51 - 2014-11-10 13:51 - 00158832 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll
2014-11-10 13:51 - 2014-11-10 13:51 - 00023152 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll
2015-11-02 08:23 - 2015-09-01 08:25 - 08901184 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2014-12-01 14:02 - 2015-06-02 08:58 - 00082272 _____ () C:\CIMCO\CIMCOEdit7\DLL\Localization.dll
2014-12-01 14:02 - 2015-06-02 08:58 - 00987136 _____ () C:\CIMCO\CIMCOEdit7\libxml2.dll
2014-12-01 14:02 - 2015-06-02 08:58 - 00077824 _____ () C:\CIMCO\CIMCOEdit7\zlib1.dll
2014-12-01 14:02 - 2015-06-02 08:58 - 00700768 _____ () C:\CIMCO\CIMCOEdit7\DLL\CycleMacro.DLL
2014-12-01 14:02 - 2015-06-02 08:58 - 02621792 _____ () C:\CIMCO\CIMCOEdit7\DLL\InspectDll.DLL
2014-12-01 14:02 - 2015-06-02 08:58 - 00233824 _____ () C:\CIMCO\CIMCOEdit7\dll\ncfilter_fanuc.dll
2016-06-21 06:06 - 2016-06-21 06:06 - 19455168 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_22_0_0_192.dll
2015-09-15 05:00 - 2015-09-15 05:00 - 00032472 _____ () C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\5.1\VpxClient.SSPI.dll
2012-07-18 13:00 - 2012-07-18 13:00 - 00022168 _____ () C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\5.1\AxInterop.VMwareRemoteConsoleTypeLib.dll
2012-07-13 18:33 - 2012-07-13 18:33 - 01222656 ____R () C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.1\Internet Explorer\libxml2.dll
2012-07-13 18:33 - 2012-07-13 18:33 - 00637952 ____R () C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.1\Internet Explorer\glibmm-2.4.dll
2012-07-13 18:33 - 2012-07-13 18:33 - 00322560 ____R () C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.1\Internet Explorer\libcurl.dll
2012-07-13 18:33 - 2012-07-13 18:33 - 00310784 ____R () C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.1\Internet Explorer\libldap_r.dll
2012-07-13 18:33 - 2012-07-13 18:33 - 00137728 ____R () C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.1\Internet Explorer\liblber.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\Windows:nlsPreferences [386]
AlternateDataStreams: C:\Windows\RtlExUpd.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\Setup1.exe:$CmdTcID [130]
AlternateDataStreams: C:\Windows\ST6UNST.EXE:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\AERTAC64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\AERTAR64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\akshhl31.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\akshhl32.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\akshsp52.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\aksllmtp.exe:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\aksusb4.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\DTSBassEnhancementDLL64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\DTSBoostDLL64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\DTSGainCompensatorDLL64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\DTSGFXAPO64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\DTSGFXAPONS64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\DTSLFXAPO64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\DTSLimiterDLL64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\DTSNeoPCDLL64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\DTSS2HeadphoneDLL64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\DTSS2SpeakerDLL64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\DTSSymmetryDLL64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\DTSVoiceClarityDLL64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\FMAPO64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\hasplms.exe:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\MaxxAudioAPO20.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\MaxxAudioAPO30.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\MaxxAudioEQ.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\MaxxAudioRealtek.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\MaxxVolumeSDAPO.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\MRT.exe:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\poqexec.exe:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\R4EEA64A.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\R4EED64A.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\R4EEG64A.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\R4EEL64A.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\R4EEP64A.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\RCoInst64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\RP3DAA64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\RP3DHT64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\RTCOM64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\RTEED64A.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\RTEEG64A.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\RTEEL64A.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\RTEEP64A.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\RtkApi64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\RtkCfg64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\RtlCPAPI64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\RtPgEx64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\RTSnMg64.cpl:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\sdnclean64.exe:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\SFAPO64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\SFCOM64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\SFNHK64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\SFSS_APO.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\SRSHP64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\SRSTSH64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\SRSTSX64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\SRSWOW64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\WavesGUILib.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\FlashPlayerApp.exe:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\HLS32SVC.EXE:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\MBI.OCX:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\MSCOMM32.OCX:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\MSJET35.DLL:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\MSJINT35.DLL:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\MSJTER35.DLL:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\MSRD2X35.DLL:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\MSREPL35.DLL:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\nhsrvice.exe:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\poqexec.exe:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\SFCOM.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\TABCTL32.OCX:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\UNWISE.EXE:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\VB5DB.DLL:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\vcomp100.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\3dxhid.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\3dxkmj.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\3dxshim.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\afcdp.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\aksclass.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\aksdf.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\akshasp.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\akshhl.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\aksusb.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\fltsrv.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\hardlock.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\mbam.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\mbamchameleon.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\mwac.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\RTKVHD64.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\snapman.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\tdrpman.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\tib.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\tib_mounter.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\usbser.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\vididr.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\vidsflt.sys:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Desktop\13332980_1165453150164082_4473727524324176454_n.jpg:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Desktop\3D printer test cube hollow_cube.stl:com.dropbox.attributes [168]
AlternateDataStreams: C:\Users\Antec-179\Desktop\AddressTransfertoMyUPS.dat:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Desktop\AddressTransfertoMyUPS.dat:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Desktop\BBPrecise.xlsx:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Desktop\dsrfix.zip:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Desktop\dsrfix.zip:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Desktop\GCode_Print_Simulator.zip:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Desktop\GCode_Print_Simulator.zip:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Desktop\gpovault.msi:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Desktop\MANUALS1.zip:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Desktop\SL-300 TEO12072 instruction manual.pdf:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Desktop\SL-300 TEO12072 instruction manual.pdf:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\9200.16384.WIN8_RTM.120725-1247_X64FRE_SERVER_EVAL_EN-US-HRM_SSS_X64FREE_EN-US_DV5.ISO:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\9200.16384.WIN8_RTM.120725-1247_X64FRE_SERVER_EVAL_EN-US-HRM_SSS_X64FREE_EN-US_DV5.ISO:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\acronis true image.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\acronis true image.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\Androscoggin.zip:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\Androscoggin.zip:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\aswMBR.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\aswMBR.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\avast_business_antivirus_setup_online.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\avast_business_antivirus_setup_online.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\ccsetup510.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\ccsetup510.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\ccsetup519.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\ccsetup519.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\diagnostix.zip:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\diagnostix.zip:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\eDrawingsAllX64.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\eDrawingsAllX64.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\fapt-ladder.zip:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\fapt-ladder.zip:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\FAPT_LADDER_V06.1.rar:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\FAPT_LADDER_V06.1.rar:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\importexporttools-3.2.4-sm+tb.xpi:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\importexporttools-3.2.4-sm+tb.xpi:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\InCDReader-5.9.4.0.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\InCDReader-5.9.4.0.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\InplotSetup.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\InplotSetup.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\InspectionXpert for PDF 4.0.3.20 x86 English 1404011112.man:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\IXOnDemand.application:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\IXOnDemand.application:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\jxpiinstall.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\jxpiinstall.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\LTspiceIV.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\LTspiceIV.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\MBRSAVER.COM:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\NCPlot_v232.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\NCPlot_v232.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\NCPlot_v233.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\NOVO-Kennametal_2.3.1.120_Production_Setup.msi:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\NOVO-Kennametal_2.3.1.120_Production_Setup.msi:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\putty-0.64-installer.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\putty-0.64-installer.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\SErase.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\setup-network-utilities.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\setup-network-utilities.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\Setup.X64.en-us_O365ProPlusRetail_1ae3c758-7f61-4e51-a64d-0839f346c18d_TX_PR_.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\Setup.X64.en-us_O365ProPlusRetail_1ae3c758-7f61-4e51-a64d-0839f346c18d_TX_PR_.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\spybot-2.4.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\spybot-2.4.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\tornoscnceditorsetup.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\tornoscnceditorsetup.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\uTorrent.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\uTorrent.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\WS17_0_21_0_ENU.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\WS17_0_21_0_ENU.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Documents\Farbar Recovery Scan Tool.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Documents\Farbar Recovery Scan Tool.exe:$CmdZnID [26]
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com (http://www.008k.com)
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com (http://www.00hq.com)
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com (http://www.0scan.com)
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com (http://www.1-2005-search.com)
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com (http://www.1-domains-registrations.com)
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com (http://www.1000gratisproben.com)
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com (http://www.1001namen.com)
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com (http://www.100sexlinks.com)
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com (http://www.10sek.com)
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info (http://www.123fporn.info)
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com (http://www.123haustiereundmehr.com)
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com (http://www.123moviedownload.com)
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com (http://www.123simsen.com)
There are 7907 more sites.
IE trusted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\sharepoint.com -> hxxps://bbprecise.sharepoint.com
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\008k.com -> www.008k.com (http://www.008k.com)
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\00hq.com -> www.00hq.com (http://www.00hq.com)
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\0scan.com -> www.0scan.com (http://www.0scan.com)
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\1-2005-search.com -> www.1-2005-search.com (http://www.1-2005-search.com)
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\1-domains-registrations.com -> www.1-domains-registrations.com (http://www.1-domains-registrations.com)
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\1000gratisproben.com -> www.1000gratisproben.com (http://www.1000gratisproben.com)
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\1001namen.com -> www.1001namen.com (http://www.1001namen.com)
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\100sexlinks.com -> www.100sexlinks.com (http://www.100sexlinks.com)
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\10sek.com -> www.10sek.com (http://www.10sek.com)
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\123fporn.info -> www.123fporn.info (http://www.123fporn.info)
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\123haustiereundmehr.com -> www.123haustiereundmehr.com (http://www.123haustiereundmehr.com)
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\123moviedownload.com -> www.123moviedownload.com (http://www.123moviedownload.com)
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\123simsen.com -> www.123simsen.com (http://www.123simsen.com)
There are 7907 more sites.
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-13 22:34 - 2016-06-29 08:17 - 00452975 ____R C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 www.007guard.com (http://www.007guard.com)
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com (http://www.008k.com)
127.0.0.1 008k.com
127.0.0.1 www.00hq.com (http://www.00hq.com)
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com (http://www.032439.com)
127.0.0.1 032439.com
127.0.0.1 www.0scan.com (http://www.0scan.com)
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com (http://www.1000gratisproben.com)
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com (http://www.1001namen.com)
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com (http://www.100888290cs.com)
127.0.0.1 www.100sexlinks.com (http://www.100sexlinks.com)
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com (http://www.10sek.com)
127.0.0.1 www.1-2005-search.com (http://www.1-2005-search.com)
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info (http://www.123fporn.info)
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com (http://www.123haustiereundmehr.com)
127.0.0.1 123moviedownload.com
127.0.0.1 www.123moviedownload.com (http://www.123moviedownload.com)
There are 15540 more lines.
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Antec-179\Desktop\Personal\rsz_nashftball.jpg
DNS Servers: 192.168.1.23 - 24.92.226.12
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 0) (EnableLUA: 0)
mpsdrv => Firewall Service is not running.
MpsSvc => Firewall Service is not running.
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\Services: vmware-converter-agent => 2
MSCONFIG\Services: vmware-converter-server => 2
MSCONFIG\Services: vmware-converter-worker => 2
MSCONFIG\startupreg: CCleaner Monitoring => "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
MSCONFIG\startupreg: Dropbox Update => "C:\Users\Antec-179\AppData\Local\Dropbox\Update\DropboxUpdate.exe" /c
MSCONFIG\startupreg: nwiz => C:\Program Files\NVIDIA Corporation\nview\nwiz.exe /installquiet
MSCONFIG\startupreg: TkBellExe => "C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe" -osboot
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{7749D332-C928-4444-8098-DE57A3BCBF9B}] => (Allow) LPort=9089
FirewallRules: [{9B033970-E1AB-422A-87E1-3C09DE6DD5A6}] => (Allow) LPort=3395
FirewallRules: [{1F0D189E-E20F-4961-A489-2C2EC78AEA92}] => (Allow) C:\CIMCO\CIMCOEdit7\CIMCOEdit.exe
FirewallRules: [{E0CBBF73-31CF-4C8B-BA9E-20E7BC1601FC}] => (Allow) C:\CIMCO\CIMCOEdit7\CIMCOEdit.exe
FirewallRules: [{CB37E634-4BD8-4A2D-8800-D459DA0666EE}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{F5C8EA35-206D-4705-A04F-5D693E417AFC}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{9B5AE0D4-5BBD-41C3-8D5A-6EA39036E3F2}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{39102ABE-D087-40B5-9D1D-7572A40A7871}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{7BFC2BC1-879C-461A-A204-C72E47D63988}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{41DB6149-AA5F-4D46-B90F-394A0DBABD92}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{F03936F6-5BA6-4A7E-83FA-49EB087D1DCA}] => (Allow) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
FirewallRules: [{3D58D475-1B2B-4B27-B2D8-56354B1AA014}] => (Allow) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
FirewallRules: [{7CC536DE-C8B6-4FFF-8D6D-EE1C6CC5A5A7}] => (Allow) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
FirewallRules: [{1BB73F1C-53EA-42B3-8263-C4BA15CA52E6}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{9806D8E0-41FF-4DDC-A26A-BE203D845B2C}] => (Allow) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
FirewallRules: [{608A024D-2001-44D7-B770-2B36BC4D6759}] => (Allow) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
FirewallRules: [{061DAD20-E1F4-46E5-BC50-E94BA4C4C748}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{DCADD1A1-CFEE-49A3-9E22-A6F2092ECF83}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{74FDA5C9-7548-4C8A-8641-E474E9EC225E}] => (Allow) C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{9EEF2EF1-59E6-4E50-9FE0-4180DD5A296E}] => (Allow) C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{F859C70C-604C-4A0B-8CC7-76C159B67572}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{0133C8A3-AB4B-443D-87A0-EAFBA10B942D}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{A354DF0D-E1E3-4F63-B6CA-6F4627234439}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{CC37E4CB-5FA3-46CD-9D82-07DF67FE73F8}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{C4C999CB-AEC9-48F9-9972-EE45A9C976ED}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{3391BB63-2133-4D21-8794-FD147B8823EA}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{C80B1F70-6D29-488E-8FCF-0F15FF704BDF}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{30BBC01A-5B3A-49B8-A577-21386ADE799E}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{1B9D2262-82AF-4CC1-987D-BE7D8E30FCF8}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{B601AC9A-40A3-4E14-88BA-9FED5361435F}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{485E424D-2516-4BD3-BA35-24CADE7E25A1}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{3996974B-2F63-4F0A-8D8E-9DF97536092D}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{BE502E6C-AF34-4A0A-AA9B-51131420BA4B}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{55AF4832-2A6B-45C4-9D9E-D2BE7030D903}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{FFE576A7-FCD7-4A6F-8F2E-CCAB4D707E26}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{62F98FA0-C506-46E0-BF20-CC0B925942DF}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{C6E3A07B-5E5E-4B66-9838-9A97AC489A6B}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{403BB92B-F965-45A1-B504-1BCBF1238BE9}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{8FE83476-0663-4F46-AE71-2BAC8CEEB241}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{6AD5D8B5-36F5-41CA-82D3-DD393F75B7B5}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{00FE78D9-DCE6-427B-9FC9-8537CA37FDB7}] => (Allow) c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe
FirewallRules: [{1ABAB4AF-0D35-4924-8385-F94A3188D00F}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{00B25920-16D3-4AF6-85EF-DD026A8613C0}] => (Allow) LPort=475
FirewallRules: [{05B3D61C-FFA9-4B3F-A942-E686C972C203}] => (Allow) LPort=475
FirewallRules: [{D8E101B1-1D1A-43D6-8D66-96C7B805C0C5}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{476E0522-45BA-498A-95CC-49649A6B4BAD}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe
FirewallRules: [{A864883C-1C32-43FA-AA69-DA71C5DC2585}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe
FirewallRules: [{17DE9D5C-B349-4B1D-A532-8B5AB5ED3DA7}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{DB7CBC90-FC2B-4ADD-A4BC-EB1C7092AFD5}] => (Allow) C:\CIMCO\CIMCOEdit7\CIMCOEdit.exe
FirewallRules: [{C2B205E1-2822-4CC1-99B6-4A264A7384E7}] => (Allow) C:\CIMCO\CIMCOEdit7\CIMCOEdit.exe
FirewallRules: [{84D47C17-6AF5-4AA4-9807-10D7B6031CEE}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{EE00092B-00A7-40BE-86EB-6DB571E60462}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{D07FB123-3D5A-404D-8337-59833DF892D3}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe
FirewallRules: [{63AE9A03-66F2-4C77-9338-DB0A3F7E8CBF}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe
DomainProfile\AuthorizedApplications: [C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe] => Enabled:CodeMeter Runtime Server
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe] => Enabled:CodeMeter Runtime Server
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service
==================== Restore Points =========================
18-06-2016 00:00:06 Scheduled Checkpoint
26-06-2016 00:00:06 Scheduled Checkpoint
30-06-2016 13:53:28 Installed NOVO-Kennametal
Check "winmgmt" service or repair WMI.
==================== Faulty Device Manager Devices =============
Name: Bluetooth Peripheral Device
Description: Bluetooth Peripheral Device
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Intel(R) 82579V Gigabit Network Connection
Description: Intel(R) 82579V Gigabit Network Connection
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Intel
Service: e1cexpress
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (07/06/2016 01:13:54 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80004005
Error: (07/06/2016 08:52:20 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mastercam.exe, version: 18.0.18466.0, time stamp: 0x566a747f
Faulting module name: Interfacial28.dll, version: 2015.1.20.0, time stamp: 0x54bf2be5
Exception code: 0xc0000005
Fault offset: 0x0000000000041b56
Faulting process id: 0x860
Faulting application start time: 0xmastercam.exe0
Faulting application path: mastercam.exe1
Faulting module path: mastercam.exe2
Report Id: mastercam.exe3
Error: (07/06/2016 08:52:19 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: mastercam.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: exception code c0000005, exception address 0000000003CC1B56
Error: (07/06/2016 08:49:05 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mastercam.exe, version: 18.0.18466.0, time stamp: 0x566a747f
Faulting module name: Interfacial28.dll, version: 2015.1.20.0, time stamp: 0x54bf2be5
Exception code: 0xc0000005
Fault offset: 0x0000000000041b56
Faulting process id: 0x2a4c
Faulting application start time: 0xmastercam.exe0
Faulting application path: mastercam.exe1
Faulting module path: mastercam.exe2
Report Id: mastercam.exe3
Error: (07/06/2016 08:49:05 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: mastercam.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: exception code c0000005, exception address 0000000003CC1B56
Error: (07/06/2016 08:48:12 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mastercam.exe, version: 18.0.18466.0, time stamp: 0x566a747f
Faulting module name: Interfacial28.dll, version: 2015.1.20.0, time stamp: 0x54bf2be5
Exception code: 0xc0000005
Fault offset: 0x0000000000041b56
Faulting process id: 0x704
Faulting application start time: 0xmastercam.exe0
Faulting application path: mastercam.exe1
Faulting module path: mastercam.exe2
Report Id: mastercam.exe3
Error: (07/06/2016 08:48:11 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: mastercam.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: exception code c0000005, exception address 0000000003CC1B56
Error: (07/06/2016 08:35:50 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mastercam.exe, version: 18.0.18466.0, time stamp: 0x566a747f
Faulting module name: Interfacial28.dll, version: 2015.1.20.0, time stamp: 0x54bf2be5
Exception code: 0xc0000005
Fault offset: 0x0000000000041b56
Faulting process id: 0x2b8c
Faulting application start time: 0xmastercam.exe0
Faulting application path: mastercam.exe1
Faulting module path: mastercam.exe2
Report Id: mastercam.exe3
Error: (07/06/2016 08:35:49 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: mastercam.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: exception code c0000005, exception address 0000000003CC1B56
Error: (07/05/2016 06:21:04 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80004005
System errors:
=============
Error: (07/06/2016 07:50:08 AM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: The Windows Connect Now - Config Registrar service terminated with service-specific error %%-2147024662 = More data is available.
.
Error: (07/05/2016 02:10:40 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.223.2916.0
Update Source: %NT AUTHORITY59
Update Stage: 4.6.0305.00
Source Path: 4.6.0305.01
Signature Type: %NT AUTHORITY602
Update Type: %NT AUTHORITY604
User: NT AUTHORITY\SYSTEM
Current Engine Version: %NT AUTHORITY605
Previous Engine Version: %NT AUTHORITY606
Error code: %NT AUTHORITY607
Error description: %NT AUTHORITY608
Error: (07/04/2016 02:10:43 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.223.2916.0
Update Source: %NT AUTHORITY59
Update Stage: 4.6.0305.00
Source Path: 4.6.0305.01
Signature Type: %NT AUTHORITY602
Update Type: %NT AUTHORITY604
User: NT AUTHORITY\SYSTEM
Current Engine Version: %NT AUTHORITY605
Previous Engine Version: %NT AUTHORITY606
Error code: %NT AUTHORITY607
Error description: %NT AUTHORITY608
Error: (07/04/2016 02:10:42 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.223.2916.0
Update Source: %NT AUTHORITY59
Update Stage: 4.6.0305.00
Source Path: 4.6.0305.01
Signature Type: %NT AUTHORITY602
Update Type: %NT AUTHORITY604
User: NT AUTHORITY\SYSTEM
Current Engine Version: %NT AUTHORITY605
Previous Engine Version: %NT AUTHORITY606
Error code: %NT AUTHORITY607
Error description: %NT AUTHORITY608
Error: (07/03/2016 02:10:47 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.223.2916.0
Update Source: %NT AUTHORITY59
Update Stage: 4.6.0305.00
Source Path: 4.6.0305.01
Signature Type: %NT AUTHORITY602
Update Type: %NT AUTHORITY604
User: NT AUTHORITY\SYSTEM
Current Engine Version: %NT AUTHORITY605
Previous Engine Version: %NT AUTHORITY606
Error code: %NT AUTHORITY607
Error description: %NT AUTHORITY608
Error: (07/03/2016 02:10:43 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.223.2916.0
Update Source: %NT AUTHORITY59
Update Stage: 4.6.0305.00
Source Path: 4.6.0305.01
Signature Type: %NT AUTHORITY602
Update Type: %NT AUTHORITY604
User: NT AUTHORITY\SYSTEM
Current Engine Version: %NT AUTHORITY605
Previous Engine Version: %NT AUTHORITY606
Error code: %NT AUTHORITY607
Error description: %NT AUTHORITY608
Error: (07/03/2016 01:52:12 AM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.223.2916.0
Update Source: %NT AUTHORITY59
Update Stage: 4.6.0305.00
Source Path: 4.6.0305.01
Signature Type: %NT AUTHORITY602
Update Type: %NT AUTHORITY604
User: NT AUTHORITY\SYSTEM
Current Engine Version: %NT AUTHORITY605
Previous Engine Version: %NT AUTHORITY606
Error code: %NT AUTHORITY607
Error description: %NT AUTHORITY608
Error: (07/02/2016 02:10:45 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.223.2916.0
Update Source: %NT AUTHORITY59
Update Stage: 4.6.0305.00
Source Path: 4.6.0305.01
Signature Type: %NT AUTHORITY602
Update Type: %NT AUTHORITY604
User: NT AUTHORITY\SYSTEM
Current Engine Version: %NT AUTHORITY605
Previous Engine Version: %NT AUTHORITY606
Error code: %NT AUTHORITY607
Error description: %NT AUTHORITY608
Error: (07/02/2016 02:10:44 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.223.2916.0
Update Source: %NT AUTHORITY59
Update Stage: 4.6.0305.00
Source Path: 4.6.0305.01
Signature Type: %NT AUTHORITY602
Update Type: %NT AUTHORITY604
User: NT AUTHORITY\SYSTEM
Current Engine Version: %NT AUTHORITY605
Previous Engine Version: %NT AUTHORITY606
Error code: %NT AUTHORITY607
Error description: %NT AUTHORITY608
Error: (07/01/2016 02:10:46 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.223.2916.0
Update Source: %NT AUTHORITY59
Update Stage: 4.6.0305.00
Source Path: 4.6.0305.01
Signature Type: %NT AUTHORITY602
Update Type: %NT AUTHORITY604
User: NT AUTHORITY\SYSTEM
Current Engine Version: %NT AUTHORITY605
Previous Engine Version: %NT AUTHORITY606
Error code: %NT AUTHORITY607
Error description: %NT AUTHORITY608
CodeIntegrity:
===================================
Date: 2015-09-08 08:30:07.795
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
Date: 2014-10-01 13:55:43.831
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\LMouFilt.Sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2014-10-01 13:55:43.799
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\LMouFilt.Sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2014-10-01 13:55:39.351
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\LHidFilt.Sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2014-10-01 13:55:39.317
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\LHidFilt.Sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2014-10-01 13:55:39.274
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\LHidFilt.Sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2014-10-01 13:55:39.242
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\LHidFilt.Sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2014-10-01 13:55:37.142
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\LHidFilt.Sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2014-10-01 13:55:37.110
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\LHidFilt.Sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2014-10-01 13:55:37.069
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\LHidFilt.Sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-2700K CPU @ 3.50GHz
Percentage of memory in use: 31%
Total physical RAM: 16360.81 MB
Available physical RAM: 11145.08 MB
Total Virtual: 42088.8 MB
Available Virtual: 35220.4 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:238.37 GB) (Free:109.39 GB) NTFS
Drive d: (HS-450i) (CDROM) (Total:0.03 GB) (Free:0 GB) CDFS
Drive e: (Backup Drive) (Fixed) (Total:465.76 GB) (Free:343.5 GB) NTFS
Drive f: (Mastercam files) (Fixed) (Total:148.96 GB) (Free:109.13 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 238.5 GB) (Disk ID: CEB70E52)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=238.4 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 465.8 GB) (Disk ID: 295E5F9A)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)
========================================================
Disk: 2 (MBR Code: Windows XP) (Size: 149 GB) (Disk ID: 41AB2316)
Partition 1: (Not Active) - (Size=55 MB) - (Type=DE)
Partition 2: (Not Active) - (Size=149 GB) - (Type=07 NTFS)
==================== End of Addition.txt ============================
aswMBR version 1.0.1.2252 Copyright(c) 2014 AVAST Software
Run date: 2016-07-06 14:15:51
-----------------------------
14:15:51.249 OS Version: Windows x64 6.1.7601 Service Pack 1
14:15:51.249 Number of processors: 8 586 0x2A07
14:15:51.249 ComputerName: PROGRAMMING UserName: Antec-179
14:15:51.762 Initialize success
14:15:51.815 VM: initialized successfully
14:15:51.816 VM: Intel CPU supported
14:16:00.813 VM: supported disk I/O iaStor.sys
14:20:51.157 AVAST engine defs: 16070601
14:22:16.611 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
14:22:16.613 Disk 0 Vendor: OCZ-OCTA 1.13 Size: 244198MB BusType: 3
14:22:16.614 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IAAStorageDevice-2
14:22:16.615 Disk 1 Vendor: ST350041 JC4B Size: 476940MB BusType: 3
14:22:16.617 Disk 2 \Device\Harddisk2\DR2 -> \Device\Ide\IAAStorageDevice-3
14:22:16.619 Disk 2 Vendor: ST316081 4.AD Size: 152587MB BusType: 3
14:22:16.629 VM: Disk 0 MBR read successfully
14:22:16.631 Disk 0 MBR scan
14:22:16.652 Disk 0 Windows 7 default MBR code
14:22:16.655 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048
14:22:16.658 Disk 0 default boot code
14:22:16.676 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 244096 MB offset 206848
14:22:16.718 Disk 0 scanning C:\Windows\system32\drivers
14:22:24.215 Service scanning
14:22:42.313 Modules scanning
14:22:42.319 Disk 0 trace - called modules:
14:22:42.323 ntoskrnl.exe CLASSPNP.SYS disk.sys vidsflt.sys iaStor.sys hal.dll
14:22:42.328 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800f8b7790]
14:22:42.331 3 CLASSPNP.SYS[fffff8800216e43f] -> nt!IofCallDriver -> [0xfffffa800f7b9e00]
14:22:42.336 5 vidsflt.sys[fffff88000dc35f1] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa800cf4b050]
14:22:42.800 AVAST engine scan C:\Windows
14:22:44.931 AVAST engine scan C:\Windows\system32
14:25:28.595 AVAST engine scan C:\Windows\system32\drivers
14:25:40.343 AVAST engine scan C:\Users\Antec-179
14:35:21.307 AVAST engine scan C:\ProgramData
14:44:20.248 Disk 0 statistics 5321785/0/18 @ 6.49 MB/s
14:44:20.251 Scan finished successfully
14:44:54.576 Disk 0 MBR has been saved successfully to "C:\Users\Antec-179\Documents\MBR.dat"
14:44:54.595 The log file has been saved successfully to "C:\Users\Antec-179\Documents\aswMBR.txt"
Thanks.
I have CIS installed and do a weekly scan.
I've scanned my pc with Spybot S&D including a rootscan and nothing seemed to stick out, but there was a lot of files in the rootkit scan.
I've scanned with MAB as well and I didn't see any mention of Vawtrak/Pony or Zeus.
Is there anything else I can do to be sure I'm either not infected or I got rid of the infection?
Thanks. This is on a Win7 pro machine.
Tashi,
I read the post and was in the process of downloading both programs (link to FRST is broken so had to find alternate source) and running them, but I work from home on another pc and I haven't had a chance to get back to the infected pc until now.
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 02-07-2016
Ran by Antec-179 (administrator) on PROGRAMMING (06-07-2016 13:37:09)
Running from C:\Users\Antec-179\Documents
Loaded Profiles: Antec-179 (Available Profiles: Antec-179)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
() C:\Windows\System32\nvwmi64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Schneider Electric) C:\Program Files (x86)\APC\PowerChute Personal Edition\mainserv.exe
() C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe
() C:\Program Files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe
() C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Dassault Systemes) C:\Program Files (x86)\Dassault Systemes\B22\intel_a\code\bin\CATSysDemon.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Dassault Systemes) C:\Program Files\Dassault Systemes\DS License Server\win_b64\code\bin\DSLicSrv.exe
(Aladdin Knowledge Systems Ltd.) C:\Windows\SysWOW64\nhsrvice.exe
(SafeNet Inc.) C:\Windows\System32\hasplms.exe
(Aladdin Knowledge Systems Ltd.) C:\Windows\SysWOW64\HLS32SVC.EXE
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(3Dconnexion) C:\Program Files\3Dconnexion\3DxWare\3DxWinCore64\Mgl3DCtlrRPCService.exe
() C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin\rpdsvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Schneider Electric) C:\Program Files (x86)\APC\PowerChute Personal Edition\dataserv.exe
(WIBU-SYSTEMS AG) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
() C:\Windows\System32\nvwmi64.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cistray.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
(3Dconnexion, INC) C:\Program Files\3Dconnexion\3DxWare\3DxWinCore64\3DxService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(WIBU-SYSTEMS AG) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeterCC.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Lavasoft) C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
(Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
(Acronis International GmbH) C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\BusinessMessaging.exe
(3Dconnexion) C:\Program Files\3Dconnexion\3DxWare\3DxWinCore64\3dxpiemenus.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\LogiAppBroker.exe
(Microsoft Corporation) C:\Windows\System32\mstsc.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(CIMCO A/S) C:\CIMCO\CIMCOEdit7\CIMCOEdit.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_22_0_0_192.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_22_0_0_192.exe
(CNC Software, Inc.) C:\Program Files\mcamX9\MCLogr.exe
(CNC Software, Inc.) C:\Program Files\mcamX9\Mastercam.exe
(CNC Software, Inc.) C:\Program Files\mcamX9\Extensions\ToolManager.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\Launcher\VpxClient.exe
(VMware, Inc.) C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.1\Internet Explorer\vmware-vmrc.exe
(VMware, Inc.) C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.1\Internet Explorer\vmware-vmrc.exe
(VMware, Inc.) C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.1\Internet Explorer\vmware-remotemks.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe
(Farbar) C:\Users\Antec-179\Documents\Farbar Recovery Scan Tool.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [3100440 2014-05-19] (Logitech, Inc.)
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [518424 2015-01-23] (Acronis)
HKLM\...\Run: [3DxWare Service] => C:\Program Files\3Dconnexion\3DxWare\3DxWinCore64\3DxService.exe [2160512 2015-12-10] (3Dconnexion, INC)
HKLM\...\Run: [nwiz] => C:\Program Files\NVIDIA Corporation\nview\nwiz.exe [2498368 2015-07-23] ()
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11545192 2015-06-24] (Realtek Semiconductor)
HKLM\...\Run: [COMODO Internet Security] => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [1610936 2016-06-16] (COMODO)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [Display] => C:\Program Files (x86)\APC\PowerChute Personal Edition\DataCollectionLauncher.exe [284024 2012-01-24] (Schneider Electric)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-04-30] (Intel Corporation)
HKLM-x32\...\Run: [Ad-Aware Browsing Protection] => C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [558672 2013-09-11] (Lavasoft)
HKLM-x32\...\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [7805824 2015-01-23] (Acronis)
HKLM-x32\...\Run: [AcronisTibMounterMonitor] => C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [1102192 2015-01-23] (Acronis International GmbH)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596504 2016-05-16] (Oracle Corporation)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2016-06-28] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [Malwarebytes Anti-Malware] => C:\Program Files (x86)\Malwarebytes Anti-Malware\BusinessMessaging.exe [3219456 2016-06-29] (Malwarebytes)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKLM\...\Policies\Explorer\Run: [HVJOGX] => C:\Windows\SysWOW64\asferror3.exe
HKLM\...\Policies\Explorer: [HideSCAHealth] 1
HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8810200 2016-06-29] (Piriform Ltd)
HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\Policies\Explorer: [HideSCAHealth] 1
HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\Policies\Explorer: [NoTaskGrouping] 1
HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\MountPoints2: {f2330861-6b98-11e5-beff-f46d049c0ec4} - L:\DTVP_Launcher.exe
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll => No File
AppInit_DLLs-x32: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll => No File
AppInit_DLLs-x32: c:\windows\syswow64\guard32.dll => c:\windows\syswow64\guard32.dll [626288 2016-06-15] (COMODO)
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2016-05-17] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2016-05-17] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2016-05-17] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [AcronisSyncError] -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2013-10-01] ()
ShellIconOverlayIdentifiers: [AcronisSyncInProgress] -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2013-10-01] ()
ShellIconOverlayIdentifiers: [AcronisSyncOk] -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2013-10-01] ()
ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-05-31] (Dropbox, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\APC UPS Status.lnk [2012-05-09]
ShortcutTarget: APC UPS Status.lnk -> C:\Program Files (x86)\APC\PowerChute Personal Edition\Display.exe (Schneider Electric)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\CodeMeter Control Center.lnk [2016-02-22]
ShortcutTarget: CodeMeter Control Center.lnk -> C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeterCC.exe (WIBU-SYSTEMS AG)
BootExecute: autocheck autochk * sdnclean64.exe
GroupPolicyScripts: Restriction <======= ATTENTION
GroupPolicyScripts\User: Restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\..\Interfaces\{26B5BF47-054C-40BC-9B2D-12AE95F2EB2B}: [NameServer] 192.168.1.23,24.92.226.12
Tcpip\..\Interfaces\{DB7AA593-DC47-443E-8A20-0FCE582526C0}: [NameServer] 192.168.1.4
Tcpip\..\Interfaces\{DB7AA593-DC47-443E-8A20-0FCE582526C0}: [DhcpNameServer] 192.168.1.180
Internet Explorer:
==================
HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000 -> DefaultScope {8EEAC88A-079B-4b2c-80C1-7836F79EB40A} URL = hxxp://us.search.yahoo.com/search?p={searchTerms}&fr=chr-comodo
SearchScopes: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000 -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL =
SearchScopes: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000 -> {8EEAC88A-079B-4b2c-80C1-7836F79EB40A} URL = hxxp://us.search.yahoo.com/search?p={searchTerms}&fr=chr-comodo
BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin64.dll [2015-06-17] (RealDownloader)
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll [2016-05-17] (Microsoft Corporation)
BHO: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll [2014-05-19] (Logitech, Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2016-04-12] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2016-05-17] (Microsoft Corporation)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2015-06-17] (RealDownloader)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\OCHelper.dll [2016-05-17] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\ssv.dll [2016-05-16] (Oracle Corporation)
BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll [2010-10-27] (Atheros Commnucations)
BHO-x32: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll [2014-05-19] (Logitech, Inc.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\URLREDIR.DLL [2016-04-12] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\GROOVEEX.DLL [2016-05-17] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\jp2ssv.dll [2016-05-16] (Oracle Corporation)
Toolbar: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
DPF: HKLM-x32 {0D41B8C5-2599-4893-8183-00195EC8D5F9} hxxp://support.asus.com/select/asusTek_sys_ctrl3.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2016-04-19] (Microsoft Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\MSOSB.DLL [2016-04-19] (Microsoft Corporation)
FireFox:
========
FF ProfilePath: C:\Users\Antec-179\AppData\Roaming\Mozilla\Firefox\Profiles\ptey35xx.default-1402568974972
FF DefaultSearchEngine: Google
FF DefaultSearchEngine.US: Google
FF Homepage: hxxp://news.yahoo.com/us/
FF NetworkProxy: "type", 4
FF Plugin: @3ds.com/3dxml -> C:\Program Files\Dassault Systemes\3D XML Player\win_b64\code\bin\NP3DXMLPlugin.dll [2012-10-30] ()
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_22_0_0_192.dll [2016-06-21] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-10-08] (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [No File]
FF Plugin-x32: @3ds.com/3dxml -> C:\Program Files\Dassault Systemes\3D XML Player\win_b64\code\bin32\NP3DXMLPlugin.dll [2011-12-19] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_22_0_0_192.dll [2016-06-21] ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-04-15] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-04-15] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-04-15] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2016-04-15] (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\dtplugin\npDeployJava1.dll [2016-05-16] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\plugin2\npjp2.dll [2016-05-16] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-11-03] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\NPSPWRAP.DLL [2015-10-08] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-07-22] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-07-22] (NVIDIA Corporation)
FF Plugin-x32: @real.com/nppl3260;version=18.0.1.9 -> c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll [2015-07-06] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=18.0.1.9 -> c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll [2015-07-06] (RealTimes)
FF Plugin-x32: @vmware.com/client-support,version=5.1.0.00000 -> C:\Program Files (x86)\VMware\Client Integration Plug-in 5.1\ClientSupportTools\np-vmware-client-support.dll [2015-08-08] (VMware, Inc.)
FF Plugin-x32: @vmware.com/vmrc,version=2.5.0.00000 -> C:\Program Files (x86)\Common Files\VMware\VMware VMRC Plug-in\Firefox\np-vmware-vmrc.dll [2014-06-20] (VMware, Inc.)
FF Plugin-x32: @vmware.com/vmrc,version=5.1.0.00000 -> C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.1\Firefox\np-vmware-vmrc.dll [2014-11-19] (VMware, Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-05-27] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3303728595-2053281234-2614305378-1000: @citrixonline.com/appdetectorplugin -> C:\Users\Antec-179\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2014-04-09] (Citrix Online)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2016-05-27] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Antec-179\AppData\Roaming\mozilla\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Users\Antec-179\AppData\Roaming\mozilla\plugins\nppdf32.dll [2013-05-11] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Antec-179\AppData\Roaming\mozilla\plugins\nppl3260.dll [2013-06-25] (RealNetworks, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Antec-179\AppData\Roaming\mozilla\plugins\nprpplugin.dll [2013-06-25] (RealPlayer)
FF SearchPlugin: C:\Users\Antec-179\AppData\Roaming\Mozilla\Firefox\Profiles\ptey35xx.default-1402568974972\searchplugins\support-home-page-search.xml [2015-05-16]
FF Extension: NoUn Buttons - C:\Users\Antec-179\AppData\Roaming\Mozilla\Firefox\Profiles\ptey35xx.default-1402568974972\extensions\{99f30549-35d4-11d9-8a2a-396c6e707e82}.xpi [2016-04-28]
FF Extension: ShowIP - C:\Users\Antec-179\AppData\Roaming\Mozilla\Firefox\Profiles\ptey35xx.default-1402568974972\extensions\{3e9bb2a7-62ca-4efa-a4e6-f6f6168a652d}.xpi [2016-04-28]
FF Extension: FireFTP - C:\Users\Antec-179\AppData\Roaming\Mozilla\Firefox\Profiles\ptey35xx.default-1402568974972\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f} [2016-06-22]
FF Extension: IP Address and Domain Information - C:\Users\Antec-179\AppData\Roaming\Mozilla\Firefox\Profiles\ptey35xx.default-1402568974972\Extensions\jid0-jJRRRBMgoShUhb07IvnxTBAl29w@jetpack.xpi [2016-01-11]
FF Extension: Toolbar Buttons - C:\Users\Antec-179\AppData\Roaming\Mozilla\Firefox\Profiles\ptey35xx.default-1402568974972\Extensions\{03B08592-E5B4-45ff-A0BE-C1D975458688}.xpi [2016-04-27]
FF Extension: Password Exporter - C:\Users\Antec-179\AppData\Roaming\Mozilla\Firefox\Profiles\ptey35xx.default-1402568974972\Extensions\{B17C1C5A-04B1-11DB-9804-B622A1EF5492}.xpi [2016-04-05]
FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext => not found
FF HKLM-x32\...\Firefox\Extensions: [ocr@babylon.com] - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\ocr@babylon.com => not found
FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2014-10-01] [not signed]
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 APC Data Service; C:\Program Files (x86)\APC\PowerChute Personal Edition\dataserv.exe [21880 2012-01-24] (Schneider Electric)
R2 APC UPS Service; C:\Program Files (x86)\APC\PowerChute Personal Edition\mainserv.exe [705912 2012-01-24] (Schneider Electric)
R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe [918144 2010-11-03] ()
R2 asHmComSvc; C:\Program Files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe [915584 2010-12-02] ()
R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe [586880 2010-10-21] ()
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [52896 2010-10-27] (Atheros Commnucations) [File not signed]
R2 BBDemon; C:\Program Files (x86)\Dassault Systemes\B22\intel_a\code\bin\CATSysDemon.exe [38400 2011-07-29] (Dassault Systemes) [File not signed]
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [3009776 2016-06-22] (Microsoft Corporation)
R2 CmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [5817712 2016-06-16] (COMODO)
R3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [2271928 2016-06-16] (COMODO)
R2 DS License Server; C:\Program Files\Dassault Systemes\DS License Server\win_b64\code\bin\DSLicSrv.exe [888320 2012-09-01] (Dassault Systemes) [File not signed]
R2 HASP Loader; C:\Windows\SysWOW64\nhsrvice.exe [249856 2015-10-05] (Aladdin Knowledge Systems Ltd.) [File not signed]
R2 hasplms; C:\Windows\system32\hasplms.exe [4665168 2015-10-13] (SafeNet Inc.)
R2 HLServer; C:\Windows\SysWOW64\HLS32SVC.EXE [327680 2015-10-13] (Aladdin Knowledge Systems Ltd.) [File not signed]
R2 Mgl3DCtlrRPCService; C:\Program Files\3Dconnexion\3DxWare\3DxWinCore64\Mgl3DCtlrRPCService.exe [57856 2015-12-10] (3Dconnexion) [File not signed]
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
R2 NVWMI; C:\Windows\system32\nvwmi64.exe [3165000 2015-07-23] ()
R2 RealPlayerUpdateSvc; C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe [31856 2015-07-06] ()
R2 RealTimes Desktop Service; c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe [1115224 2015-07-06] (RealNetworks, Inc.)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2016-06-28] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2016-06-28] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2016-06-28] (Safer-Networking Ltd.)
S4 vmware-converter-agent; C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter-a.exe [479824 2013-04-09] (VMware, Inc.)
S4 vmware-converter-server; C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter.exe [479824 2013-04-09] (VMware, Inc.)
S4 vmware-converter-worker; C:\Program Files (x86)\VMware\VMware vCenter Converter Standalone\vmware-converter.exe [479824 2013-04-09] (VMware, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 Sentinel RMS License Manager; "C:\Program Files\CGTech\VERICUT 7.2.3\windows64\license\lservnt.exe" [X]
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 3dxhid; C:\Windows\System32\DRIVERS\3dxhid.sys [39184 2015-08-04] (3Dconnexion SAM)
S3 AiCharger; C:\Windows\SysWow64\drivers\AiCharger.sys [14848 2012-03-22] (ASUSTek Computer Inc.)
R3 akshasp; C:\Windows\System32\DRIVERS\akshasp.sys [77912 2015-10-13] (SafeNet Inc.)
R3 akshhl; C:\Windows\System32\DRIVERS\akshhl.sys [81368 2015-10-13] (SafeNet Inc.)
R3 aksusb; C:\Windows\System32\DRIVERS\aksusb.sys [322560 2015-10-13] (SafeNet Inc.)
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-25] ()
R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [14464 2010-08-03] ()
S3 bmdrvr; C:\Windows\SysWow64\drivers\bmdrvr.sys [75344 2013-02-22] (VMware, Inc.)
R1 cmderd; C:\Windows\System32\DRIVERS\cmderd.sys [31648 2016-06-15] (COMODO)
R1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [829600 2016-06-15] (COMODO)
R1 cmdHlp; C:\Windows\System32\DRIVERS\cmdhlp.sys [56472 2016-06-15] (COMODO)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R0 FTOIIs; C:\Windows\System32\DRIVERS\FTOIIs.sys [229968 2009-11-24] (Promise Technology, Inc.)
R2 Hardlock; C:\Windows\system32\drivers\hardlock.sys [350552 2015-10-13] (SafeNet Inc.)
R1 inspect; C:\Windows\System32\DRIVERS\inspect.sys [116248 2016-06-15] (COMODO)
R3 KMJHidMini; C:\Windows\System32\DRIVERS\3dxkmj.sys [18944 2015-01-26] (3Dconnextion Inc.)
R3 KMJShim; C:\Windows\System32\DRIVERS\3dxshim.sys [7168 2015-01-26] (3Dconnextion Inc.)
R1 LUMDriver; C:\Windows\system32\drivers\LUMDriver.sys [24848 2008-01-02] (IBM)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1120032 2015-01-23] (Acronis International GmbH)
R0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [198432 2015-01-23] (Acronis International GmbH)
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2013-03-18] (Apple, Inc.) [File not signed]
R0 vidsflt; C:\Windows\System32\DRIVERS\vidsflt.sys [117024 2015-01-23] (Acronis International GmbH)
R2 vstor2-mntapi20-shared; C:\Windows\SysWow64\drivers\vstor2-mntapi20-shared.sys [33872 2013-02-22] (VMware, Inc.)
S3 lmimirr; system32\DRIVERS\lmimirr.sys [X]
S3 vdbus; system32\DRIVERS\vdbus.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-07-06 13:37 - 2016-07-06 13:37 - 00033930 _____ C:\Users\Antec-179\Documents\FRST.txt
2016-07-06 13:34 - 2016-07-06 13:37 - 00000000 ____D C:\FRST
2016-07-06 13:31 - 2016-07-06 13:31 - 05198336 _____ (AVAST Software) C:\Users\Antec-179\Downloads\aswMBR.exe
2016-07-06 13:30 - 2016-07-06 13:34 - 02390016 _____ (Farbar) C:\Users\Antec-179\Documents\Farbar Recovery Scan Tool.exe
2016-07-06 07:37 - 2016-07-06 07:37 - 00000000 ____D C:\Users\Antec-179\Documents\ProcAlyzer Dumps
2016-06-30 14:03 - 2016-06-30 14:03 - 00000000 ____D C:\Users\Antec-179\AppData\Local\MachiningCloud_GmbH
2016-06-30 14:01 - 2016-06-30 14:01 - 00002085 _____ C:\Users\Public\Desktop\Kennametal.lnk
2016-06-30 14:01 - 2016-06-30 14:01 - 00000004 ____H C:\ProgramData\cm-lock
2016-06-30 14:01 - 2016-06-30 14:01 - 00000000 ____D C:\Users\Antec-179\AppData\Roaming\MachiningCloud
2016-06-30 14:01 - 2016-06-30 14:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NOVO-Kennametal
2016-06-30 14:01 - 2016-06-30 14:01 - 00000000 ____D C:\ProgramData\MachiningCloud
2016-06-30 14:01 - 2016-06-30 14:01 - 00000000 ____D C:\Program Files (x86)\NOVO-Kennametal
2016-06-30 13:53 - 2016-06-30 14:01 - 00000000 ___HD C:\ProgramData\{297E00E8-70AA-4641-BCFE-A906A2FCFB0E}
2016-06-30 13:53 - 2016-06-30 14:00 - 00000000 ____D C:\Users\Antec-179\AppData\Local\IIIQF
2016-06-30 13:53 - 2016-06-30 13:53 - 09715712 _____ C:\Users\Antec-179\Downloads\NOVO-Kennametal_2.3.1.120_Production_Setup.msi
2016-06-29 11:58 - 2016-06-29 11:58 - 00195659 _____ C:\Users\Antec-179\Desktop\CNC Systems.pdf
2016-06-29 08:19 - 2016-06-29 08:19 - 06995720 _____ (Piriform Ltd) C:\Users\Antec-179\Downloads\ccsetup519.exe
2016-06-28 17:00 - 2016-06-28 17:00 - 00000000 ____D C:\Program Files\Common Files\AV
2016-06-28 16:57 - 2016-06-28 16:57 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2016-06-28 16:57 - 2016-06-28 16:57 - 00001395 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2016-06-28 16:57 - 2016-06-28 16:57 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2016-06-28 16:55 - 2016-06-28 16:57 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\Antec-179\Downloads\spybot-2.4.exe
2016-06-28 16:31 - 2016-06-28 16:31 - 00015292 _____ C:\Users\Antec-179\Desktop\BBPrecise.xlsx
2016-06-28 15:59 - 2016-06-28 15:59 - 00295163 _____ C:\Users\Antec-179\Desktop\5606428.mcx-9
2016-06-28 11:33 - 2016-06-28 11:33 - 01200863 _____ C:\Users\Antec-179\Downloads\FAPT_LADDER_V06.1.rar
2016-06-27 10:29 - 2016-06-27 10:29 - 00013011 _____ C:\Users\Antec-179\Desktop\Fanuc motor.xlsx
2016-06-24 15:04 - 2016-06-27 06:12 - 149858063 _____ C:\Users\Antec-179\Documents\TEST.Z2G
2016-06-24 08:22 - 2016-06-24 08:22 - 00776583 _____ C:\Users\Antec-179\Desktop\QA-001-006-A0 Instructions for Remove & Install Spindle Motor.pdf
2016-06-21 08:46 - 2016-06-21 08:54 - 00030720 _____ C:\Users\Antec-179\Desktop\Copy of Credit Card Process Form 2015.xls
2016-06-20 16:28 - 2016-06-20 16:28 - 00098475 _____ C:\Users\Antec-179\Desktop\Blankn po for CNC Systems.pdf
2016-06-20 16:23 - 2016-06-20 16:23 - 00097260 _____ C:\Users\Antec-179\Desktop\JB order agreement.pdf
2016-06-16 06:19 - 2016-06-16 06:19 - 00373649 _____ C:\Users\Antec-179\Desktop\coach clinic.pdf
2016-06-10 09:19 - 2016-06-10 14:56 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-06-09 14:19 - 2016-06-09 14:18 - 00075582 _____ C:\Users\Antec-179\Desktop\TRI-20 B-BAR.pdf
2016-06-07 14:48 - 2016-06-07 14:48 - 00296137 _____ C:\Users\Antec-179\Desktop\Extracted pages from TRI-21.pdf
2016-06-07 06:08 - 2016-06-07 06:08 - 00000000 ____D C:\Users\Antec-179\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2016-06-06 10:41 - 2016-06-06 10:40 - 00651214 _____ C:\Users\Antec-179\Desktop\Extracted pages from TRI-20.pdf
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2089-02-18 15:52 - 2012-04-13 09:48 - 00131488 _____ C:\Users\Antec-179\Documents\PMC-RB.LAD
2016-07-06 13:32 - 2016-03-23 07:05 - 00077336 _____ C:\Windows\system32\Drivers\fvstore.dat
2016-07-06 13:30 - 2016-02-22 07:42 - 01474832 _____ C:\Windows\system32\Drivers\sfi.dat
2016-07-06 10:53 - 2013-08-12 08:47 - 00000000 ____D C:\Users\Antec-179\AppData\Roaming\VMware
2016-07-06 08:52 - 2014-02-12 11:44 - 00000000 ____D C:\Users\Antec-179\AppData\Roaming\Mastercam
2016-07-06 08:52 - 2013-01-30 08:00 - 00000103 _____ C:\Windows\mwMSimApp.INI
2016-07-06 08:52 - 2012-04-13 16:07 - 00000000 ____D C:\Users\Antec-179\AppData\Local\CrashDumps
2016-07-06 08:41 - 2014-07-18 10:24 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-07-05 15:05 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\inf
2016-07-05 10:51 - 2012-04-14 09:27 - 00000000 ____D C:\Users\Antec-179\Desktop\email
2016-07-05 07:03 - 2015-10-13 13:32 - 00000104 _____ C:\Windows\system32\config\netlogon.ftl
2016-07-05 06:14 - 2014-12-15 14:12 - 00000000 ____D C:\ProgramData\Ad-Aware Browsing Protection
2016-07-01 18:01 - 2009-07-14 00:45 - 00032096 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-07-01 18:01 - 2009-07-14 00:45 - 00032096 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-07-01 11:26 - 2009-07-14 01:13 - 00905800 _____ C:\Windows\system32\PerfStringBackup.INI
2016-07-01 08:23 - 2015-06-01 07:23 - 00000642 _____ C:\Windows\Tasks\G2MUploadTask-S-1-5-21-3303728595-2053281234-2614305378-1000.job
2016-07-01 08:23 - 2014-06-06 11:44 - 00000546 _____ C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-3303728595-2053281234-2614305378-1000.job
2016-06-30 14:00 - 2015-10-01 06:33 - 00000012 _____ C:\Windows\SysWOW64\haspaddr.dat
2016-06-30 14:00 - 2014-07-18 10:23 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-06-30 14:00 - 2012-05-18 09:38 - 00030374 _____ C:\Windows\SysWOW64\PCPELog.txt
2016-06-30 14:00 - 2012-04-10 15:09 - 00000000 ____D C:\ProgramData\NVIDIA
2016-06-30 14:00 - 2009-07-14 01:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-06-30 14:00 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\schemas
2016-06-30 13:56 - 2012-04-11 15:10 - 00880828 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2016-06-29 07:27 - 2014-07-18 10:23 - 00140672 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-06-29 07:27 - 2014-07-18 10:23 - 00064896 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-06-29 07:27 - 2014-07-18 10:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-06-29 07:27 - 2013-04-12 13:34 - 00027008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-06-29 06:02 - 2009-07-13 22:34 - 00452975 ____R C:\Windows\system32\Drivers\etc\hosts.20160629-081738.backup
2016-06-29 06:00 - 2013-04-12 14:48 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2016-06-28 16:57 - 2013-04-12 14:49 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2016-06-22 08:05 - 2014-09-29 06:42 - 00000000 ____D C:\Users\Antec-179\Desktop\Programming tips
2016-06-22 06:25 - 2016-05-27 05:47 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2016-06-22 06:24 - 2015-10-08 16:08 - 00000000 ____D C:\Program Files\Microsoft Office 15
2016-06-21 15:27 - 2014-12-02 11:17 - 00000000 ___RD C:\Users\Antec-179\Dropbox
2016-06-21 06:07 - 2014-06-13 06:23 - 00000000 ____D C:\Users\Antec-179\AppData\Local\Adobe
2016-06-21 06:06 - 2012-04-10 15:07 - 00796352 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-06-21 06:06 - 2012-04-10 15:07 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-06-20 16:28 - 2012-04-14 09:27 - 00000000 ____D C:\Users\Antec-179\Desktop\QUOTES-PO'S
2016-06-16 16:30 - 2014-12-02 11:15 - 00000000 ____D C:\Users\Antec-179\AppData\Roaming\Dropbox
2016-06-16 16:29 - 2015-10-20 13:39 - 00000000 ____D C:\Users\Antec-179\AppData\Local\Dropbox
2016-06-15 02:12 - 2015-11-18 18:14 - 00829600 _____ (COMODO) C:\Windows\system32\Drivers\cmdguard.sys
2016-06-15 02:12 - 2015-11-18 18:14 - 00031648 _____ (COMODO) C:\Windows\system32\Drivers\cmderd.sys
2016-06-15 02:12 - 2015-08-05 01:31 - 00116248 _____ (COMODO) C:\Windows\system32\Drivers\inspect.sys
2016-06-15 02:12 - 2015-08-05 01:31 - 00056472 _____ (COMODO) C:\Windows\system32\Drivers\cmdhlp.sys
2016-06-15 02:08 - 2015-09-03 12:52 - 00793104 _____ (COMODO) C:\Windows\system32\guard64.dll
2016-06-15 02:08 - 2015-09-03 12:52 - 00626288 _____ (COMODO) C:\Windows\SysWOW64\guard32.dll
2016-06-15 02:08 - 2015-08-05 01:29 - 00051800 _____ (COMODO) C:\Windows\system32\cmdcsr.dll
2016-06-15 02:04 - 2015-08-05 01:28 - 00365752 _____ (COMODO) C:\Windows\system32\cmdvrt64.dll
2016-06-15 02:02 - 2015-08-05 01:28 - 00051896 _____ (COMODO) C:\Windows\system32\cmdkbd64.dll
2016-06-15 01:58 - 2015-08-05 01:27 - 00296120 _____ (COMODO) C:\Windows\SysWOW64\cmdvrt32.dll
2016-06-15 01:56 - 2015-08-05 01:26 - 00046776 _____ (COMODO) C:\Windows\SysWOW64\cmdkbd32.dll
2016-06-13 15:36 - 2014-06-02 16:44 - 00000000 ____D C:\new website files
2016-06-10 16:31 - 2013-07-08 09:01 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-06-09 14:19 - 2012-05-25 06:17 - 00000000 ____D C:\Users\Antec-179\AppData\Local\CutePDF Writer
2016-06-06 06:22 - 2015-07-07 16:27 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
==================== Files in the root of some directories =======
2015-02-04 11:45 - 2015-02-04 11:45 - 0000121 _____ () C:\Users\Antec-179\AppData\Roaming\default.rss
2013-10-29 09:27 - 2014-02-24 07:27 - 0000177 _____ () C:\Users\Antec-179\AppData\Roaming\WB.CFG
2014-01-28 07:27 - 2014-01-28 07:27 - 0000005 _____ () C:\Users\Antec-179\AppData\Roaming\WBPU-TTL.DAT
2014-01-20 09:55 - 2014-05-13 06:14 - 0003584 _____ () C:\Users\Antec-179\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-05-30 08:43 - 2016-03-15 06:38 - 0000600 _____ () C:\Users\Antec-179\AppData\Local\PUTTY.RND
2012-04-17 16:36 - 2015-01-06 17:25 - 0007635 _____ () C:\Users\Antec-179\AppData\Local\Resmon.ResmonCfg
2016-06-30 14:01 - 2016-06-30 14:01 - 0000004 ____H () C:\ProgramData\cm-lock
Files to move or delete:
====================
C:\Users\Antec-179\.vmrc_plugin_ovftool_settings.js
C:\Users\Antec-179\en_res.dll
C:\Users\Antec-179\es_res.dll
C:\Users\Antec-179\fr_res.dll
C:\Users\Antec-179\grm_res.dll
C:\Users\Antec-179\it_res.dll
C:\Users\Antec-179\jp_res.dll
C:\Users\Antec-179\mfc80u.dll
C:\Users\Antec-179\msvcr80.dll
C:\Users\Antec-179\PCPE Setup.exe
C:\Users\Antec-179\pt_res.dll
C:\Users\Antec-179\ResourceReader.dll
C:\Users\Antec-179\ru_res.dll
C:\Users\Antec-179\zh_res.dll
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2016-06-27 00:50
==================== End of FRST.txt ============================
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-07-2016
Ran by Antec-179 (2016-07-06 13:37:22)
Running from C:\Users\Antec-179\Documents
Windows 7 Professional Service Pack 1 (X64) (2012-04-10 18:50:05)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-3303728595-2053281234-2614305378-500 - Administrator - Disabled)
Antec-179 (S-1-5-21-3303728595-2053281234-2614305378-1000 - Administrator - Enabled) => C:\Users\Antec-179
Guest (S-1-5-21-3303728595-2053281234-2614305378-501 - Administrator - Enabled)
___VMware_Conv_SA___ (S-1-5-21-3303728595-2053281234-2614305378-1009 - Administrator - Enabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AV: COMODO Antivirus (Enabled - Up to date) {D0CC7563-ABD2-DEBE-138E-FDD553335AF2}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Comodo Defense+ (Enabled - Up to date) {6BAD9487-8DE8-D130-293E-C6A728B4104F}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
FW: COMODO Firewall (Enabled) {E8F7F446-E1BD-DFE6-38D1-54E0ADE01D89}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
3D XML Player (HKLM\...\{52FDBE6F-53FE-47C5-8D49-6366555D7056}) (Version: 12.36.12304 - Dassault Systemes)
3Dconnexion 3DxWare 10 (64-bit) (HKLM-x32\...\{BAFCA6AC-8B37-405B-B57E-C1D45DE70ACC}) (Version: 10.3.0 - 3Dconnexion)
3Dconnexion 3DxWinCore (Version: 17.3.0.12346 - 3Dconnexion) Hidden
3Dconnexion Add-In for AutoCAD (Version: 5.1.0 - 3Dconnexion) Hidden
3Dconnexion Add-In for Inventor 11 - 2016 (Version: 2.1.1 - 3Dconnexion) Hidden
3Dconnexion Add-In for Solid Edge V18 - ST8 (Version: 3.3.0 - 3Dconnexion) Hidden
3Dconnexion Add-In for SOLIDWORKS 2005 - 2016 (Version: 3.3.0 - 3Dconnexion) Hidden
3Dconnexion Add-On for XSI v5.0 - 2015 (Version: 3.0.3 - 3Dconnexion) Hidden
3Dconnexion Collage (x32 Version: 1.3.0 - 3Dconnexion) Hidden
3Dconnexion Extension for SketchUp (Version: 4.2.1 - 3Dconnexion) Hidden
3Dconnexion LCD Applets for SpacePilot Pro (Version: 1.3.3 - 3Dconnexion) Hidden
3Dconnexion Plug-In for 3ds Max 2008 - 2016 (Version: 6.1.2 - 3Dconnexion) Hidden
3Dconnexion Plug-in for Acrobat 3D (x32 Version: 1.4.0 - 3Dconnexion) Hidden
3Dconnexion Plug-In for Maya v8.5 - 2016 (Version: 5.1.1 - 3Dconnexion) Hidden
3Dconnexion Plug-In for NX v4.0 - v11.0 (Version: 3.3.0 - 3Dconnexion) Hidden
3Dconnexion Plug-In for Photoshop CS3 - CS6 and CC (Version: 2.4.0 - 3Dconnexion) Hidden
3Dconnexion Plug-In for Pro/ENGINEER Wildfire 3.0 - Creo 3.0 (Version: 2.2.4 - 3Dconnexion) Hidden
3Dconnexion Trainer (x32 Version: 3.2.3 - 3Dconnexion) Hidden
3Dconnexion Viewer and Assembly Demo (x32 Version: 0.9.0.0 - 3Dconnexion) Hidden
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Acronis True Image 2014 (HKLM-x32\...\{5858B1D6-8056-471C-8A29-6A1765BBC0BE}) (Version: 17.0.4515 - Acronis)
Ad-Aware Browsing Protection (HKLM-x32\...\Ad-Aware Browsing Protection) (Version: 1.0.1.110 - Lavasoft)
Adobe Acrobat Reader DC MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}) (Version: 15.016.20045 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.4.0.2710 - Adobe Systems Incorporated)
Adobe Flash Player 12 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 12.0.0.70 - Adobe Systems Incorporated)
Adobe Flash Player 22 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 22.0.0.192 - Adobe Systems Incorporated)
Advertising Center (x32 Version: 0.0.0.2 - Nero AG) Hidden
Aladdin DiagnostiX 1.10 (HKLM-x32\...\Aladdin DiagnostiX 1.10) (Version: - )
Aladdin Monitor 1.4.2 (HKLM-x32\...\Aladdin Monitor 1.4.2) (Version: - )
Bluetooth Win7 Suite (64) (HKLM\...\{230D1595-57DA-4933-8C4E-375797EBB7E1}) (Version: 7.2.0.40 - Atheros Communications)
BOINC (HKLM\...\{AA72DFB8-BA38-49C9-B5A4-A95FD62641F8}) (Version: 7.0.28 - Space Sciences Laboratory, U.C. Berkeley)
CCleaner (HKLM\...\CCleaner) (Version: 5.19 - Piriform)
CIMCO Edit V7 (HKLM-x32\...\CIMCO Edit V7) (Version: 7.55.07 - CIMCO A/S)
Citrix Online Launcher (HKLM-x32\...\{DB014C85-A264-4BCA-A66F-6DD1FCF8EC36}) (Version: 1.0.335 - Citrix)
cncCoder (HKLM-x32\...\cncCoder_is1) (Version: 4.1 - Axis Controls Ltd)
CodeMeter Runtime Kit v4.50c (HKLM\...\{D2ABD3EE-94BD-48BB-A6C6-E4FFDA64001E}) (Version: 4.50.906.503 - WIBU-SYSTEMS AG)
COMODO Internet Security Premium (HKLM\...\{04833277-EE61-4251-9273-0CF86C0FE710}) (Version: 8.2.0.4792 - COMODO Security Solutions Inc.)
CutePDF Writer 2.8 (HKLM\...\CutePDF Writer Installation) (Version: - )
Dassault Systemes Software Prerequisites x86-x64 (HKLM\...\{CF1EB598-B424-436A-B15F-B763846BA970}) (Version: 8.1.3 - Dassault Systemes)
Dassault Systemes Software VC10 Prerequisites x86-x64 (HKLM\...\{7C534131-6431-4ECB-9069-525CB5F75CC8}) (Version: 10.1.1 - Dassault Systemes)
Dassault Systemes Software VC9 Prerequisites x86-x64 (HKLM\...\{F2F2DEA7-36AB-4E13-907C-D8BDE775EF97}) (Version: 9.1.2 - Dassault Systemes)
Dassault Systemes Software Version 5-6 Release 2012 (B22) (HKLM\...\Dassault Systemes B22_0) (Version: - )
Dropbox (HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\Dropbox) (Version: 4.4.29 - Dropbox, Inc.)
DS License Server (HKLM\...\{A224E59D-BEA4-43CE-98A9-A08AC73C33D3}) (Version: 6.214.02470 - Dassault Systemes)
eDrawings 2015 x64 (HKLM\...\{84177FAE-7ADD-474F-92A9-0085D6AFCBDC}) (Version: 15.3.0030 - Dassault Systèmes SolidWorks Corp)
eReg (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
Extended Asian Language font pack for Adobe Reader XI (HKLM-x32\...\{AC76BA86-7AD7-2530-0000-A00000000004}) (Version: 11.0.0 - Adobe Systems Incorporated)
Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 7.3.4.311 - Foxit Software Inc.)
Garmin Communicator Plugin x64 (HKLM\...\{550331CC-C34B-494F-BCDA-37CE4EF6E924}) (Version: 4.0.3 - Garmin Ltd or its subsidiaries)
Garmin Lifetime Updater (HKLM-x32\...\{9AAD03E8-4F65-4DE2-8F6C-1B079C0C8521}) (Version: 2.1.11 - Garmin)
GoToMeeting 7.20.0.5174 (HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\GoToMeeting) (Version: 7.20.0.5174 - CitrixOnline)
GWizardE (x32 Version: 0.4.0 - CNCCookbook, Inc.) Hidden
HASP License Manager (HKLM-x32\...\HASP License Manager) (Version: - )
HaspX (HKLM\...\{32c229e8-ea25-41bd-95bd-00650b385a5f}.sdb) (Version: - )
ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden
InspectionXpert GDT Font Installer (HKLM-x32\...\{C8605789-934D-47B3-9CE6-AE880CBC6033}) (Version: 1.1.0.0 - InspectionXpert)
InspectionXpert OnDemand x64 (HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\ea66fb5ec48b6827) (Version: 5.3.2.1115 - InspectionXpert OnDemand x64)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.2.1410 - Intel Corporation)
Intel(R) Network Connections 18.7.28.0 (HKLM\...\PROSetDX) (Version: 18.7.28.0 - Intel)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.5.0.1026 - Intel Corporation)
Intel® Trusted Connect Service Client (HKLM\...\{09536BA1-E498-4CC3-B834-D884A67D7E34}) (Version: 1.23.605.1 - Intel Corporation)
Intel® Watchdog Timer Driver (Intel® WDT) (HKLM-x32\...\{3FD0C489-0F02-481a-A3E1-9754CD396761}) (Version: - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.32 - Irfan Skiljan)
Java 8 Update 91 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218091F0}) (Version: 8.0.910.14 - Oracle Corporation)
K-Lite Codec Pack 7.0.0 (Standard) (HKLM-x32\...\KLiteCodecPack_is1) (Version: 7.0.0 - )
Logitech SetPoint 6.65 (HKLM\...\sp6) (Version: 6.65.62 - Logitech)
Logitech Unifying Software 2.50 (HKLM\...\Logitech Unifying) (Version: 2.50.25 - Logitech)
Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
marvell 91xx driver (HKLM-x32\...\MagniDriver) (Version: 1.0.0.1045 - Marvell)
Mastercam Licensing Installer (HKLM\...\{56D9A6A3-5D54-44F6-9C26-4956B2337387}) (Version: 18.0.11898.0 - CNC Software, Inc.)
Mastercam X7 (x32 Version: 16.0.5.5 - CNC Software, Inc.) Hidden
Mastercam X7 (x32 Version: 2.00.2000 - CNC Software, Inc.) Hidden
Mastercam X9 (Arc MultiEdit AddOn) (HKLM\...\{3BA84FAD-D8A5-45ED-BE0B-B2C772678E7D}) (Version: 18.0.5.27 - CNC Software, Inc.)
Mastercam X9 (HKLM-x32\...\Mastercam X9) (Version: 18.0.11898.0 - CNC Software, Inc.)
Mastercam X9 (LevelSetsVisibility AddOn) (HKLM\...\{8624C0D9-C433-4919-846F-421A2BABB264}) (Version: 17.0.0.1 - CNC Software, Inc.)
Mastercam X9 (Pts2Arcs AddOn) (HKLM\...\{4A205CFB-E234-444A-8E3A-EA4D87700C38}) (Version: 18.0.1.1 - CNC Software, Inc.)
Mastercam X9 (ScriptLinker AddOn) (HKLM\...\{FB60C5AB-AFE7-4776-85D4-709DACDA3D2B}) (Version: 18.0.2.5 - CNC Software, Inc.)
Mastercam X9 (SortCircles AddOn) (HKLM\...\{8C118E97-89DB-4E9A-8134-D8A495471B28}) (Version: 18.0.1.4 - CNC Software, Inc.)
Mastercam X9 (Version: 18.0.18466.0 - CNC Software, Inc.) Hidden
Mastercam X9 (vHelix AddOn) (HKLM\...\{3D897DA6-26E2-409C-AA81-88CF2A1B8519}) (Version: 18.0.1.2 - CNC Software, Inc.)
Mastercam X9 (zSpiral AddOn) (HKLM\...\{F3EBA408-ECCE-43AA-A3D2-7C148CB66859}) (Version: 18.0.1.6 - CNC Software, Inc.)
Menu Templates - Pack 1 (x32 Version: 9.6.0.0 - Nero AG) Hidden
Menu Templates - Starter Kit (x32 Version: 9.6.0.0 - Nero AG) Hidden
Microsoft .NET Framework 4.6.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft Help Viewer 1.0 (HKLM\...\Microsoft Help Viewer 1.0) (Version: 1.0.30319 - Microsoft Corporation)
Microsoft Help Viewer 2.0 (HKLM-x32\...\Microsoft Help Viewer 2.0) (Version: 2.0.50727 - Microsoft Corporation)
Microsoft Office 365 ProPlus - en-us (HKLM\...\O365ProPlusRetail - en-us) (Version: 15.0.4833.1001 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Sync Framework Runtime v1.0 SP1 (x64) (HKLM\...\{8438EC02-B8A9-462D-AC72-1B521349C001}) (Version: 1.0.3010.0 - Microsoft Corporation)
Microsoft Sync Framework SDK v1.0 SP1 (HKLM-x32\...\{0E3DFC64-CC49-4BE2-8C9C-58EF129675DB}) (Version: 1.0.3010.0 - Microsoft Corporation)
Microsoft Sync Framework Services v1.0 SP1 (x64) (HKLM\...\{034106B5-54B7-467F-B477-5B7DBB492624}) (Version: 1.0.3010.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual F# 2.0 Runtime (HKLM-x32\...\{729A3000-BC8A-3B74-BA5D-5068FE12D70C}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual J# 2.0 Redistributable Package - SE (x64) (HKLM\...\Microsoft Visual J# 2.0 Redistributable Package - SE (x64)) (Version: - Microsoft Corporation)
Movie Templates - Starter Kit (x32 Version: 9.6.0.0 - Nero AG) Hidden
Mozilla Firefox 47.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 47.0 (x86 en-US)) (Version: 47.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 47.0.0.5999 - Mozilla)
Mozilla Thunderbird 31.2.0 (x86 en-US) (HKLM-x32\...\Mozilla Thunderbird 31.2.0 (x86 en-US)) (Version: 31.2.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
Nero 9 Essentials (HKLM-x32\...\{0e8d6e9b-e4f1-4881-9d4b-e471e2e10310}) (Version: - Nero AG)
NOVO-Kennametal (HKLM-x32\...\NOVO-Kennametal) (Version: 2.3.1.120 - Machining Cloud GmbH)
NOVO-Kennametal (x32 Version: 2.3.1.120 - Machining Cloud GmbH) Hidden
NVIDIA 3D Vision Controller Driver 352.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 352.65 - NVIDIA Corporation)
NVIDIA 3D Vision Driver 353.62 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 353.62 - NVIDIA Corporation)
NVIDIA Graphics Driver 353.62 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 353.62 - NVIDIA Corporation)
NVIDIA HD Audio Driver 1.3.34.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.34.3 - NVIDIA Corporation)
NVIDIA nView 146.33 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView) (Version: 146.33 - NVIDIA Corporation)
NVIDIA WMI 2.22.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVWMI) (Version: 2.22.0 - NVIDIA Corporation)
Office 15 Click-to-Run Extensibility Component (Version: 15.0.4833.1001 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4833.1001 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (Version: 15.0.4833.1001 - Microsoft Corporation) Hidden
OpenOffice 4.1.1 (HKLM-x32\...\{9395F41D-0F80-432E-9A59-B8E477E7E163}) (Version: 4.11.9775 - Apache Software Foundation)
PowerChute Personal Edition 3.0.2 (HKLM-x32\...\{8ED262EE-FC73-47A9-BB86-D92223246881}) (Version: 3.0.2 - Schneider Electric)
Prerequisites for SSDT (HKLM-x32\...\{9169C939-ED01-446A-BD0C-29873BAF4E48}) (Version: 11.0.2100.60 - Microsoft Corporation)
PuTTY release 0.64 (HKLM-x32\...\PuTTY_is1) (Version: 0.64 - Simon Tatham)
RealDownloader (x32 Version: 18.0.1.10 - RealNetworks, Inc.) Hidden
RealDownloader (x32 Version: 18.0.1.9 - RealNetworks) Hidden
RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0 - RealNetworks, Inc) Hidden
Realtek Ethernet Controller Driver For Windows 7 (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.21.531.2010 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6235 - Realtek Semiconductor Corp.)
RealTimes (RealPlayer) (HKLM-x32\...\RealPlayer 18.0) (Version: 18.0.1 - RealNetworks)
RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) Hidden
Recuva (HKLM\...\Recuva) (Version: 1.43 - Piriform)
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.0.32.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.32.0 - Renesas Electronics Corporation) Hidden
SDFormatter (HKLM-x32\...\{179324FF-7B16-4BA8-9836-055CAAEE4F08}) (Version: 4.0.0 - SD Association)
Sentinel Runtime (HKLM-x32\...\{2A414CBE-CDF3-48C6-A91B-D3D4522F8EB5}) (Version: 6.60.1.36770 - SafeNet Inc.)
SolidWorks eDrawings 2013 x64 (HKLM\...\{E59710B0-0A5A-4956-8496-D7EE0532D4A9}) (Version: 13.3.111 - Dassault Systèmes SolidWorks Corp)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
TurboCAD Professional 15 (HKLM-x32\...\{2BC3CCC0-1149-424F-AF73-4D0C5C053033}) (Version: 15.1 - IMSIDesign)
Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)
Update for (KB2504637) (HKLM-x32\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}.KB2504637) (Version: 1 - Microsoft Corporation)
UpdateService (x32 Version: 1.0.0 - RealNetworks, Inc.) Hidden
USB Disk Storage Format Tool 5.1 (HKLM\...\USB Disk Storage Format Tool_is1) (Version: - Authorsoft Corporation)
VBA (3821b) (x32 Version: 6.01.00.1234 - Microsoft Corporation) Hidden
VC_CRT_x64 (Version: 1.02.0000 - Intel Corporation) Hidden
Video Downloader (x32 Version: 1.0.0 - RealNetworks) Hidden
VMware Client Integration Plug-in 5.1.0 (HKLM-x32\...\{17B9AB5C-356D-4B28-BEB9-A15AF12C36F0}) (Version: 5.1.0.2968519 - VMware, Inc.)
VMware vCenter Converter Standalone (HKLM-x32\...\{17C3235A-A4B9-44ED-8794-54D8408F9733}) (Version: 5.1.0.1087880 - VMware, Inc.)
VMware vSphere Client 5.0 (HKLM-x32\...\{04805AB6-F757-496A-8D56-37A0FC5FF6F3}) (Version: 5.0.0.44739 - VMware, Inc.)
VMware vSphere Client 5.1 (HKLM-x32\...\{09DC364B-A77A-49A0-972B-E43F0DACC5E3}) (Version: 5.1.0.6443 - VMware, Inc.)
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
Zip Extractor Packages (HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\Zip Extractor Packages) (Version: - ) <==== ATTENTION
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Program Files (x86)\Citrix\GoToMeeting\1350\G2MOutlookAddin64.dll (Citrix Online, a division of Citrix Systems, Inc.)
CustomCLSID: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000_Classes\CLSID\{FBC9D74C-AF55-4309-9FB2-C426E071637F}\InprocServer32 -> C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll (Dropbox, Inc.)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {1D1028CD-8825-41E7-A8DF-5B3219DD76BB} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => c:\Program Files\Microsoft IntelliPoint\IPoint.exe
Task: {1E4BA4DD-AE08-4AB9-91C4-76EB68716404} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2016-06-22] (Microsoft Corporation)
Task: {1F72E2A6-2CCA-436B-A693-525FA0AB60DC} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2016-05-27] (Microsoft Corporation)
Task: {4FAB8542-E4F9-41B0-A22D-1EAABBE85DB6} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2016-06-28] (Safer-Networking Ltd.)
Task: {52F552CB-706A-4A2D-B5BB-BB70C604A49A} - System32\Tasks\G2MUpdateTask-S-1-5-21-3303728595-2053281234-2614305378-1000 => C:\Program Files (x86)\Citrix\GoToMeeting\1440\g2mupdate.exe [2014-06-16] (Citrix Online, a division of Citrix Systems, Inc.)
Task: {5A23D24F-0DA5-4F50-BCD8-6AC5AF078470} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2016-06-28] (Safer-Networking Ltd.)
Task: {626609C7-53BA-4187-A588-D582EF1BD0DA} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2016-06-22] (Microsoft Corporation)
Task: {6B1F246C-F2C0-46D1-98CF-30447B07FAA4} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2016-06-28] (Safer-Networking Ltd.)
Task: {713F67E6-E86E-4DCD-BDA2-D8EFFBD13401} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-3303728595-2053281234-2614305378-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe [2015-07-06] (RealNetworks, Inc.)
Task: {738FD452-3659-44F7-9BEE-7634A0207B66} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx64\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2016-05-27] (Microsoft Corporation)
Task: {83C72957-0E7B-494B-910B-0C4EC57E02FF} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3303728595-2053281234-2614305378-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2015-07-06] (RealNetworks, Inc.)
Task: {8E43596F-6CA7-40C6-96F5-2283BDEABCD7} - System32\Tasks\3DconnexionCreateProcess_3DxService.exe => C:\Program Files\3Dconnexion\3DxWare\3DxWinCore64\3DxService.exe [2015-12-10] (3Dconnexion, INC)
Task: {9D93756F-BADF-4D08-81DF-89EDED6027A6} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2016-06-29] (Piriform Ltd)
Task: {A8067182-96C8-48CB-B422-5E9CC8C51AF7} - System32\Tasks\COMODO\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2016-06-16] (COMODO)
Task: {A933E935-7FDD-4B67-A8F5-35BD961F8874} - System32\Tasks\RealDownloader Update Check => C:\Program Files (x86)\RealNetworks\RealDownloader\downloader2.exe [2015-07-06] ()
Task: {ABC220CE-A0C6-449C-9EBC-3BF64DEB9CB0} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-3303728595-2053281234-2614305378-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2015-07-06] (RealNetworks, Inc.)
Task: {ACBFA9C1-38E3-4F24-A461-3B9992CAF0D4} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-05-11] (Adobe Systems Incorporated)
Task: {B9589194-DD6A-42CB-9404-159E6B0C758A} - System32\Tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2016-06-16] (COMODO)
Task: {D7573B29-4D2E-4CBD-AFEF-E3486BA5EE87} - System32\Tasks\COMODO\COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [2016-06-16] (COMODO)
Task: {E64ECC22-6B54-4EFA-8FA3-13B3B7D36181} - System32\Tasks\COMODO\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2016-06-16] (COMODO)
Task: {F7ABAB27-5CA5-4FB8-99B6-6510EAE30B0F} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2016-05-27] (Microsoft Corporation)
Task: {FC0B6857-65B0-4874-9FA5-E0291486805E} - System32\Tasks\COMODO\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2016-06-16] (COMODO)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3303728595-2053281234-2614305378-1000Core.job => C:\Users\Antec-179\AppData\Local\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-3303728595-2053281234-2614305378-1000.job => C:\Program Files (x86)\Citrix\GoToMeeting\5174\g2mupdate.exe
Task: C:\Windows\Tasks\G2MUploadTask-S-1-5-21-3303728595-2053281234-2614305378-1000.job => C:\Program Files (x86)\Citrix\GoToMeeting\5174\g2mupload.exe
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
==================== Loaded Modules (Whitelisted) ==============
2015-08-05 11:41 - 2015-07-23 00:06 - 03165000 _____ () C:\Windows\system32\nvwmi64.exe
2012-05-25 06:16 - 2012-03-11 14:56 - 00086608 _____ () C:\Windows\System32\cpwmon64.dll
2013-10-23 11:15 - 2010-11-03 17:30 - 00918144 ____N () C:\Program Files (x86)\ASUS\AXSP\1.00.13\atkexComSvc.exe
2013-10-23 11:15 - 2010-12-02 10:15 - 00915584 _____ () C:\Program Files (x86)\ASUS\AAHM\1.00.13\aaHMSvc.exe
2013-10-23 11:15 - 2010-10-21 17:52 - 00586880 _____ () C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe
2015-10-08 16:08 - 2016-04-19 19:26 - 00114888 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2015-06-17 03:25 - 2015-07-06 05:52 - 00031856 _____ () C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe
2015-08-05 11:41 - 2015-07-22 21:31 - 00116368 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-01-08 23:02 - 2016-03-16 06:25 - 00073912 _____ () C:\Program Files\COMODO\COMODO Internet Security\scanners\smart.cav
2015-11-02 08:23 - 2015-09-01 12:04 - 08901184 _____ () C:\Program Files\Microsoft Office 15\root\Office15\1033\GrooveIntlResource.dll
2015-08-05 11:41 - 2015-07-23 00:06 - 02441360 _____ () C:\Program Files\NVIDIA Corporation\nview\nview64.dll
2010-07-15 00:44 - 2010-07-15 00:44 - 00020032 _____ () C:\Program Files\Unlocker\UnlockerCOM.dll
2013-10-01 11:26 - 2013-10-01 11:26 - 02810968 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll
2015-12-10 19:24 - 2015-12-10 19:24 - 00038912 _____ () C:\Windows\system32\SPWINI.dll
2015-12-11 02:46 - 2015-12-11 02:46 - 00600064 _____ () C:\Program Files\mcamX9\UICtrls.dll
2015-05-15 08:57 - 2015-05-15 08:57 - 00332800 _____ () C:\Program Files\mcamX9\glew64.dll
2015-05-15 11:18 - 2015-05-15 11:18 - 00331776 _____ () C:\Program Files\mcamX9\interfacial14.dll
2015-12-11 04:21 - 2015-12-11 04:21 - 79611392 _____ () C:\Program Files\mcamX9\CHOOKS\5AXMSURF.DLL
2015-05-15 11:18 - 2015-05-15 11:18 - 02606592 _____ () C:\Program Files\mcamX9\RESOURCES\5AXUI_RES.DLL
2015-05-15 09:02 - 2015-05-15 09:02 - 13650944 _____ () C:\Program Files\mcamX9\mwsimutil.dll
2015-05-15 09:02 - 2015-05-15 09:02 - 02975232 _____ () C:\Program Files\mcamX9\MultiXPost.dll
2015-12-11 04:21 - 2015-12-11 04:21 - 23245824 _____ () C:\Program Files\mcamX9\CHOOKS\MACHSIM.DLL
2015-12-11 04:21 - 2015-12-11 04:21 - 07638016 _____ () C:\Program Files\mcamX9\MXPUI.dll
2015-12-11 04:21 - 2015-12-11 04:21 - 32381952 _____ () C:\Program Files\mcamX9\mwMSimApp.dll
2015-12-11 04:20 - 2015-12-11 04:20 - 01330688 _____ () C:\Program Files\mcamX9\mwCustomStreamService.dll
2015-05-15 08:58 - 2015-05-15 08:58 - 02486784 _____ () C:\Program Files\mcamX9\NLib.dll
2015-05-18 17:27 - 2015-05-18 17:27 - 00087552 _____ () C:\Program Files\mcamX9\CHOOKS\SORTCIRCLES.DLL
2015-05-18 17:27 - 2015-05-18 17:27 - 00031744 _____ () C:\Program Files\mcamX9\Resources\SortCirclesRes.dll
2015-12-11 04:21 - 2015-12-11 04:21 - 02903040 _____ () C:\Program Files\mcamX9\mwUbvsProxy.dll
2015-12-11 04:20 - 2015-12-11 04:20 - 20108288 _____ () C:\Program Files\mcamX9\mwSimStreamManager.dll
2015-12-11 04:20 - 2015-12-11 04:20 - 24689152 _____ () C:\Program Files\mcamX9\mwMSimDefGUI.dll
2015-05-15 11:18 - 2015-05-15 11:18 - 00057856 _____ () C:\Program Files\mcamX9\Resources\5axmsurf_res.dll
2015-05-15 11:18 - 2015-05-15 11:18 - 05112832 _____ () C:\Program Files\mcamX9\Resources\mwMachSim_res.dll
2015-12-11 04:21 - 2015-12-11 04:21 - 13470720 _____ () C:\Program Files\mcamX9\mwVerifier.dll
2015-12-11 04:21 - 2015-12-11 04:21 - 01744896 _____ () C:\Program Files\mcamX9\mwVerifierGUI.dll
2015-05-15 11:18 - 2015-05-15 11:18 - 00015360 _____ () C:\Program Files\mcamX9\Resources\mwVerifierGUI_res.dll
2015-05-15 08:57 - 2015-05-15 08:57 - 00332800 _____ () C:\Program Files\mcamX9\EXTENSIONS\glew64.dll
2016-06-30 14:40 - 2016-06-30 14:40 - 00048640 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_64\Trackerbird.Tracker\08fce3efdb4855cfee03c4760afd744e\Trackerbird.Tracker.ni.dll
2013-10-23 11:15 - 2016-06-30 14:00 - 00023040 _____ () C:\Program Files (x86)\ASUS\AXSP\1.00.13\PEbiosinterface32.dll
2013-10-23 11:15 - 2010-06-29 10:58 - 00104448 ____N () C:\Program Files (x86)\ASUS\AXSP\1.00.13\ATKEX.dll
2015-06-17 03:24 - 2015-06-17 03:24 - 00035976 _____ () C:\Program Files (x86)\Real\UpdateService\DL2UpdatePlugin.dll
2015-06-17 03:24 - 2015-06-17 03:24 - 00039560 _____ () C:\Program Files (x86)\Real\UpdateService\RealDownloaderUpdatePlugin.dll
2015-06-17 03:24 - 2015-06-17 03:24 - 00037528 _____ () C:\Program Files (x86)\Real\UpdateService\VideoDLUpdatePlugin.dll
2016-06-28 16:57 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2016-06-28 16:57 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2016-06-28 16:57 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2016-06-28 16:57 - 2016-06-28 16:57 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2016-06-28 16:57 - 2016-06-28 16:57 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2015-06-03 10:41 - 2015-06-03 10:41 - 00172544 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\caaa0003d6df6f1e5791726812a4e66d\IsdiInterop.ni.dll
2013-10-23 11:18 - 2011-04-30 00:28 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2013-11-22 14:03 - 2013-11-22 14:03 - 00028024 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\thread_pool.dll
2013-11-22 14:06 - 2013-11-22 14:06 - 00420160 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\ulxmlrpcpp.dll
2015-08-05 11:41 - 2015-07-23 00:06 - 02000200 _____ () C:\Program Files\NVIDIA Corporation\nview\nview.dll
2013-11-22 14:03 - 2013-11-22 14:03 - 00036672 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\qt_icontray_ex.dll
2014-11-10 13:51 - 2014-11-10 13:51 - 03339376 _____ () C:\Program Files (x86)\Mozilla Thunderbird\mozjs.dll
2014-11-10 13:51 - 2014-11-10 13:51 - 00158832 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll
2014-11-10 13:51 - 2014-11-10 13:51 - 00023152 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll
2015-11-02 08:23 - 2015-09-01 08:25 - 08901184 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2014-12-01 14:02 - 2015-06-02 08:58 - 00082272 _____ () C:\CIMCO\CIMCOEdit7\DLL\Localization.dll
2014-12-01 14:02 - 2015-06-02 08:58 - 00987136 _____ () C:\CIMCO\CIMCOEdit7\libxml2.dll
2014-12-01 14:02 - 2015-06-02 08:58 - 00077824 _____ () C:\CIMCO\CIMCOEdit7\zlib1.dll
2014-12-01 14:02 - 2015-06-02 08:58 - 00700768 _____ () C:\CIMCO\CIMCOEdit7\DLL\CycleMacro.DLL
2014-12-01 14:02 - 2015-06-02 08:58 - 02621792 _____ () C:\CIMCO\CIMCOEdit7\DLL\InspectDll.DLL
2014-12-01 14:02 - 2015-06-02 08:58 - 00233824 _____ () C:\CIMCO\CIMCOEdit7\dll\ncfilter_fanuc.dll
2016-06-21 06:06 - 2016-06-21 06:06 - 19455168 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_22_0_0_192.dll
2015-09-15 05:00 - 2015-09-15 05:00 - 00032472 _____ () C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\5.1\VpxClient.SSPI.dll
2012-07-18 13:00 - 2012-07-18 13:00 - 00022168 _____ () C:\Program Files (x86)\VMware\Infrastructure\Virtual Infrastructure Client\5.1\AxInterop.VMwareRemoteConsoleTypeLib.dll
2012-07-13 18:33 - 2012-07-13 18:33 - 01222656 ____R () C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.1\Internet Explorer\libxml2.dll
2012-07-13 18:33 - 2012-07-13 18:33 - 00637952 ____R () C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.1\Internet Explorer\glibmm-2.4.dll
2012-07-13 18:33 - 2012-07-13 18:33 - 00322560 ____R () C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.1\Internet Explorer\libcurl.dll
2012-07-13 18:33 - 2012-07-13 18:33 - 00310784 ____R () C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.1\Internet Explorer\libldap_r.dll
2012-07-13 18:33 - 2012-07-13 18:33 - 00137728 ____R () C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.1\Internet Explorer\liblber.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\Windows:nlsPreferences [386]
AlternateDataStreams: C:\Windows\RtlExUpd.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\Setup1.exe:$CmdTcID [130]
AlternateDataStreams: C:\Windows\ST6UNST.EXE:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\AERTAC64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\AERTAR64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\akshhl31.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\akshhl32.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\akshsp52.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\aksllmtp.exe:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\aksusb4.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\DTSBassEnhancementDLL64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\DTSBoostDLL64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\DTSGainCompensatorDLL64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\DTSGFXAPO64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\DTSGFXAPONS64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\DTSLFXAPO64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\DTSLimiterDLL64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\DTSNeoPCDLL64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\DTSS2HeadphoneDLL64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\DTSS2SpeakerDLL64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\DTSSymmetryDLL64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\DTSVoiceClarityDLL64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\FMAPO64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\hasplms.exe:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\MaxxAudioAPO20.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\MaxxAudioAPO30.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\MaxxAudioEQ.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\MaxxAudioRealtek.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\MaxxVolumeSDAPO.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\MRT.exe:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\poqexec.exe:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\R4EEA64A.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\R4EED64A.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\R4EEG64A.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\R4EEL64A.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\R4EEP64A.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\RCoInst64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\RP3DAA64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\RP3DHT64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\RTCOM64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\RTEED64A.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\RTEEG64A.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\RTEEL64A.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\RTEEP64A.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\RtkApi64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\RtkCfg64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\RtlCPAPI64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\RtPgEx64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\RTSnMg64.cpl:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\sdnclean64.exe:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\SFAPO64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\SFCOM64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\SFNHK64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\SFSS_APO.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\SRSHP64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\SRSTSH64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\SRSTSX64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\SRSWOW64.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\WavesGUILib.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\FlashPlayerApp.exe:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\HLS32SVC.EXE:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\MBI.OCX:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\MSCOMM32.OCX:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\MSJET35.DLL:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\MSJINT35.DLL:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\MSJTER35.DLL:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\MSRD2X35.DLL:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\MSREPL35.DLL:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\nhsrvice.exe:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\poqexec.exe:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\SFCOM.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\TABCTL32.OCX:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\UNWISE.EXE:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\VB5DB.DLL:$CmdTcID [130]
AlternateDataStreams: C:\Windows\SysWOW64\vcomp100.dll:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\3dxhid.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\3dxkmj.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\3dxshim.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\afcdp.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\aksclass.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\aksdf.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\akshasp.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\akshhl.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\aksusb.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\fltsrv.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\hardlock.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\mbam.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\mbamchameleon.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\mwac.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\RTKVHD64.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\snapman.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\tdrpman.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\tib.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\tib_mounter.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\usbser.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\vididr.sys:$CmdTcID [130]
AlternateDataStreams: C:\Windows\system32\Drivers\vidsflt.sys:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Desktop\13332980_1165453150164082_4473727524324176454_n.jpg:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Desktop\3D printer test cube hollow_cube.stl:com.dropbox.attributes [168]
AlternateDataStreams: C:\Users\Antec-179\Desktop\AddressTransfertoMyUPS.dat:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Desktop\AddressTransfertoMyUPS.dat:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Desktop\BBPrecise.xlsx:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Desktop\dsrfix.zip:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Desktop\dsrfix.zip:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Desktop\GCode_Print_Simulator.zip:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Desktop\GCode_Print_Simulator.zip:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Desktop\gpovault.msi:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Desktop\MANUALS1.zip:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Desktop\SL-300 TEO12072 instruction manual.pdf:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Desktop\SL-300 TEO12072 instruction manual.pdf:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\9200.16384.WIN8_RTM.120725-1247_X64FRE_SERVER_EVAL_EN-US-HRM_SSS_X64FREE_EN-US_DV5.ISO:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\9200.16384.WIN8_RTM.120725-1247_X64FRE_SERVER_EVAL_EN-US-HRM_SSS_X64FREE_EN-US_DV5.ISO:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\acronis true image.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\acronis true image.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\Androscoggin.zip:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\Androscoggin.zip:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\aswMBR.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\aswMBR.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\avast_business_antivirus_setup_online.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\avast_business_antivirus_setup_online.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\ccsetup510.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\ccsetup510.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\ccsetup519.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\ccsetup519.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\diagnostix.zip:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\diagnostix.zip:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\eDrawingsAllX64.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\eDrawingsAllX64.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\fapt-ladder.zip:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\fapt-ladder.zip:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\FAPT_LADDER_V06.1.rar:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\FAPT_LADDER_V06.1.rar:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\importexporttools-3.2.4-sm+tb.xpi:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\importexporttools-3.2.4-sm+tb.xpi:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\InCDReader-5.9.4.0.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\InCDReader-5.9.4.0.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\InplotSetup.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\InplotSetup.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\InspectionXpert for PDF 4.0.3.20 x86 English 1404011112.man:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\IXOnDemand.application:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\IXOnDemand.application:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\jxpiinstall.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\jxpiinstall.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\LTspiceIV.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\LTspiceIV.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\MBRSAVER.COM:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\NCPlot_v232.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\NCPlot_v232.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\NCPlot_v233.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\NOVO-Kennametal_2.3.1.120_Production_Setup.msi:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\NOVO-Kennametal_2.3.1.120_Production_Setup.msi:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\putty-0.64-installer.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\putty-0.64-installer.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\SErase.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\setup-network-utilities.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\setup-network-utilities.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\Setup.X64.en-us_O365ProPlusRetail_1ae3c758-7f61-4e51-a64d-0839f346c18d_TX_PR_.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\Setup.X64.en-us_O365ProPlusRetail_1ae3c758-7f61-4e51-a64d-0839f346c18d_TX_PR_.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\spybot-2.4.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\spybot-2.4.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\tornoscnceditorsetup.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\tornoscnceditorsetup.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\uTorrent.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\uTorrent.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Downloads\WS17_0_21_0_ENU.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Downloads\WS17_0_21_0_ENU.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\Antec-179\Documents\Farbar Recovery Scan Tool.exe:$CmdTcID [130]
AlternateDataStreams: C:\Users\Antec-179\Documents\Farbar Recovery Scan Tool.exe:$CmdZnID [26]
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com (http://www.008k.com)
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com (http://www.00hq.com)
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com (http://www.0scan.com)
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com (http://www.1-2005-search.com)
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com (http://www.1-domains-registrations.com)
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com (http://www.1000gratisproben.com)
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com (http://www.1001namen.com)
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com (http://www.100sexlinks.com)
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com (http://www.10sek.com)
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info (http://www.123fporn.info)
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com (http://www.123haustiereundmehr.com)
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com (http://www.123moviedownload.com)
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com (http://www.123simsen.com)
There are 7907 more sites.
IE trusted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\sharepoint.com -> hxxps://bbprecise.sharepoint.com
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\008k.com -> www.008k.com (http://www.008k.com)
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\00hq.com -> www.00hq.com (http://www.00hq.com)
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\0scan.com -> www.0scan.com (http://www.0scan.com)
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\1-2005-search.com -> www.1-2005-search.com (http://www.1-2005-search.com)
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\1-domains-registrations.com -> www.1-domains-registrations.com (http://www.1-domains-registrations.com)
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\1000gratisproben.com -> www.1000gratisproben.com (http://www.1000gratisproben.com)
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\1001namen.com -> www.1001namen.com (http://www.1001namen.com)
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\100sexlinks.com -> www.100sexlinks.com (http://www.100sexlinks.com)
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\10sek.com -> www.10sek.com (http://www.10sek.com)
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\123fporn.info -> www.123fporn.info (http://www.123fporn.info)
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\123haustiereundmehr.com -> www.123haustiereundmehr.com (http://www.123haustiereundmehr.com)
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\123moviedownload.com -> www.123moviedownload.com (http://www.123moviedownload.com)
IE restricted site: HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\...\123simsen.com -> www.123simsen.com (http://www.123simsen.com)
There are 7907 more sites.
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-13 22:34 - 2016-06-29 08:17 - 00452975 ____R C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 www.007guard.com (http://www.007guard.com)
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com (http://www.008k.com)
127.0.0.1 008k.com
127.0.0.1 www.00hq.com (http://www.00hq.com)
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com (http://www.032439.com)
127.0.0.1 032439.com
127.0.0.1 www.0scan.com (http://www.0scan.com)
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com (http://www.1000gratisproben.com)
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com (http://www.1001namen.com)
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com (http://www.100888290cs.com)
127.0.0.1 www.100sexlinks.com (http://www.100sexlinks.com)
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com (http://www.10sek.com)
127.0.0.1 www.1-2005-search.com (http://www.1-2005-search.com)
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info (http://www.123fporn.info)
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com (http://www.123haustiereundmehr.com)
127.0.0.1 123moviedownload.com
127.0.0.1 www.123moviedownload.com (http://www.123moviedownload.com)
There are 15540 more lines.
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-3303728595-2053281234-2614305378-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Antec-179\Desktop\Personal\rsz_nashftball.jpg
DNS Servers: 192.168.1.23 - 24.92.226.12
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 0) (EnableLUA: 0)
mpsdrv => Firewall Service is not running.
MpsSvc => Firewall Service is not running.
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\Services: vmware-converter-agent => 2
MSCONFIG\Services: vmware-converter-server => 2
MSCONFIG\Services: vmware-converter-worker => 2
MSCONFIG\startupreg: CCleaner Monitoring => "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
MSCONFIG\startupreg: Dropbox Update => "C:\Users\Antec-179\AppData\Local\Dropbox\Update\DropboxUpdate.exe" /c
MSCONFIG\startupreg: nwiz => C:\Program Files\NVIDIA Corporation\nview\nwiz.exe /installquiet
MSCONFIG\startupreg: TkBellExe => "C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe" -osboot
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{7749D332-C928-4444-8098-DE57A3BCBF9B}] => (Allow) LPort=9089
FirewallRules: [{9B033970-E1AB-422A-87E1-3C09DE6DD5A6}] => (Allow) LPort=3395
FirewallRules: [{1F0D189E-E20F-4961-A489-2C2EC78AEA92}] => (Allow) C:\CIMCO\CIMCOEdit7\CIMCOEdit.exe
FirewallRules: [{E0CBBF73-31CF-4C8B-BA9E-20E7BC1601FC}] => (Allow) C:\CIMCO\CIMCOEdit7\CIMCOEdit.exe
FirewallRules: [{CB37E634-4BD8-4A2D-8800-D459DA0666EE}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{F5C8EA35-206D-4705-A04F-5D693E417AFC}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{9B5AE0D4-5BBD-41C3-8D5A-6EA39036E3F2}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{39102ABE-D087-40B5-9D1D-7572A40A7871}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{7BFC2BC1-879C-461A-A204-C72E47D63988}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{41DB6149-AA5F-4D46-B90F-394A0DBABD92}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{F03936F6-5BA6-4A7E-83FA-49EB087D1DCA}] => (Allow) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
FirewallRules: [{3D58D475-1B2B-4B27-B2D8-56354B1AA014}] => (Allow) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
FirewallRules: [{7CC536DE-C8B6-4FFF-8D6D-EE1C6CC5A5A7}] => (Allow) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
FirewallRules: [{1BB73F1C-53EA-42B3-8263-C4BA15CA52E6}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{9806D8E0-41FF-4DDC-A26A-BE203D845B2C}] => (Allow) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
FirewallRules: [{608A024D-2001-44D7-B770-2B36BC4D6759}] => (Allow) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
FirewallRules: [{061DAD20-E1F4-46E5-BC50-E94BA4C4C748}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{DCADD1A1-CFEE-49A3-9E22-A6F2092ECF83}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{74FDA5C9-7548-4C8A-8641-E474E9EC225E}] => (Allow) C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{9EEF2EF1-59E6-4E50-9FE0-4180DD5A296E}] => (Allow) C:\Users\Antec-179\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{F859C70C-604C-4A0B-8CC7-76C159B67572}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{0133C8A3-AB4B-443D-87A0-EAFBA10B942D}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{A354DF0D-E1E3-4F63-B6CA-6F4627234439}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{CC37E4CB-5FA3-46CD-9D82-07DF67FE73F8}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{C4C999CB-AEC9-48F9-9972-EE45A9C976ED}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{3391BB63-2133-4D21-8794-FD147B8823EA}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{C80B1F70-6D29-488E-8FCF-0F15FF704BDF}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{30BBC01A-5B3A-49B8-A577-21386ADE799E}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{1B9D2262-82AF-4CC1-987D-BE7D8E30FCF8}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{B601AC9A-40A3-4E14-88BA-9FED5361435F}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{485E424D-2516-4BD3-BA35-24CADE7E25A1}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{3996974B-2F63-4F0A-8D8E-9DF97536092D}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{BE502E6C-AF34-4A0A-AA9B-51131420BA4B}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{55AF4832-2A6B-45C4-9D9E-D2BE7030D903}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{FFE576A7-FCD7-4A6F-8F2E-CCAB4D707E26}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{62F98FA0-C506-46E0-BF20-CC0B925942DF}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{C6E3A07B-5E5E-4B66-9838-9A97AC489A6B}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{403BB92B-F965-45A1-B504-1BCBF1238BE9}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{8FE83476-0663-4F46-AE71-2BAC8CEEB241}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{6AD5D8B5-36F5-41CA-82D3-DD393F75B7B5}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{00FE78D9-DCE6-427B-9FC9-8537CA37FDB7}] => (Allow) c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe
FirewallRules: [{1ABAB4AF-0D35-4924-8385-F94A3188D00F}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{00B25920-16D3-4AF6-85EF-DD026A8613C0}] => (Allow) LPort=475
FirewallRules: [{05B3D61C-FFA9-4B3F-A942-E686C972C203}] => (Allow) LPort=475
FirewallRules: [{D8E101B1-1D1A-43D6-8D66-96C7B805C0C5}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{476E0522-45BA-498A-95CC-49649A6B4BAD}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe
FirewallRules: [{A864883C-1C32-43FA-AA69-DA71C5DC2585}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe
FirewallRules: [{17DE9D5C-B349-4B1D-A532-8B5AB5ED3DA7}] => (Allow) C:\Windows\system32\hasplms.exe
FirewallRules: [{DB7CBC90-FC2B-4ADD-A4BC-EB1C7092AFD5}] => (Allow) C:\CIMCO\CIMCOEdit7\CIMCOEdit.exe
FirewallRules: [{C2B205E1-2822-4CC1-99B6-4A264A7384E7}] => (Allow) C:\CIMCO\CIMCOEdit7\CIMCOEdit.exe
FirewallRules: [{84D47C17-6AF5-4AA4-9807-10D7B6031CEE}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{EE00092B-00A7-40BE-86EB-6DB571E60462}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{D07FB123-3D5A-404D-8337-59833DF892D3}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe
FirewallRules: [{63AE9A03-66F2-4C77-9338-DB0A3F7E8CBF}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe
DomainProfile\AuthorizedApplications: [C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe] => Enabled:CodeMeter Runtime Server
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe] => Enabled:CodeMeter Runtime Server
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service
==================== Restore Points =========================
18-06-2016 00:00:06 Scheduled Checkpoint
26-06-2016 00:00:06 Scheduled Checkpoint
30-06-2016 13:53:28 Installed NOVO-Kennametal
Check "winmgmt" service or repair WMI.
==================== Faulty Device Manager Devices =============
Name: Bluetooth Peripheral Device
Description: Bluetooth Peripheral Device
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Intel(R) 82579V Gigabit Network Connection
Description: Intel(R) 82579V Gigabit Network Connection
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Intel
Service: e1cexpress
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (07/06/2016 01:13:54 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80004005
Error: (07/06/2016 08:52:20 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mastercam.exe, version: 18.0.18466.0, time stamp: 0x566a747f
Faulting module name: Interfacial28.dll, version: 2015.1.20.0, time stamp: 0x54bf2be5
Exception code: 0xc0000005
Fault offset: 0x0000000000041b56
Faulting process id: 0x860
Faulting application start time: 0xmastercam.exe0
Faulting application path: mastercam.exe1
Faulting module path: mastercam.exe2
Report Id: mastercam.exe3
Error: (07/06/2016 08:52:19 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: mastercam.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: exception code c0000005, exception address 0000000003CC1B56
Error: (07/06/2016 08:49:05 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mastercam.exe, version: 18.0.18466.0, time stamp: 0x566a747f
Faulting module name: Interfacial28.dll, version: 2015.1.20.0, time stamp: 0x54bf2be5
Exception code: 0xc0000005
Fault offset: 0x0000000000041b56
Faulting process id: 0x2a4c
Faulting application start time: 0xmastercam.exe0
Faulting application path: mastercam.exe1
Faulting module path: mastercam.exe2
Report Id: mastercam.exe3
Error: (07/06/2016 08:49:05 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: mastercam.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: exception code c0000005, exception address 0000000003CC1B56
Error: (07/06/2016 08:48:12 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mastercam.exe, version: 18.0.18466.0, time stamp: 0x566a747f
Faulting module name: Interfacial28.dll, version: 2015.1.20.0, time stamp: 0x54bf2be5
Exception code: 0xc0000005
Fault offset: 0x0000000000041b56
Faulting process id: 0x704
Faulting application start time: 0xmastercam.exe0
Faulting application path: mastercam.exe1
Faulting module path: mastercam.exe2
Report Id: mastercam.exe3
Error: (07/06/2016 08:48:11 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: mastercam.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: exception code c0000005, exception address 0000000003CC1B56
Error: (07/06/2016 08:35:50 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mastercam.exe, version: 18.0.18466.0, time stamp: 0x566a747f
Faulting module name: Interfacial28.dll, version: 2015.1.20.0, time stamp: 0x54bf2be5
Exception code: 0xc0000005
Fault offset: 0x0000000000041b56
Faulting process id: 0x2b8c
Faulting application start time: 0xmastercam.exe0
Faulting application path: mastercam.exe1
Faulting module path: mastercam.exe2
Report Id: mastercam.exe3
Error: (07/06/2016 08:35:49 AM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: mastercam.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: exception code c0000005, exception address 0000000003CC1B56
Error: (07/05/2016 06:21:04 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80004005
System errors:
=============
Error: (07/06/2016 07:50:08 AM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: The Windows Connect Now - Config Registrar service terminated with service-specific error %%-2147024662 = More data is available.
.
Error: (07/05/2016 02:10:40 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.223.2916.0
Update Source: %NT AUTHORITY59
Update Stage: 4.6.0305.00
Source Path: 4.6.0305.01
Signature Type: %NT AUTHORITY602
Update Type: %NT AUTHORITY604
User: NT AUTHORITY\SYSTEM
Current Engine Version: %NT AUTHORITY605
Previous Engine Version: %NT AUTHORITY606
Error code: %NT AUTHORITY607
Error description: %NT AUTHORITY608
Error: (07/04/2016 02:10:43 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.223.2916.0
Update Source: %NT AUTHORITY59
Update Stage: 4.6.0305.00
Source Path: 4.6.0305.01
Signature Type: %NT AUTHORITY602
Update Type: %NT AUTHORITY604
User: NT AUTHORITY\SYSTEM
Current Engine Version: %NT AUTHORITY605
Previous Engine Version: %NT AUTHORITY606
Error code: %NT AUTHORITY607
Error description: %NT AUTHORITY608
Error: (07/04/2016 02:10:42 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.223.2916.0
Update Source: %NT AUTHORITY59
Update Stage: 4.6.0305.00
Source Path: 4.6.0305.01
Signature Type: %NT AUTHORITY602
Update Type: %NT AUTHORITY604
User: NT AUTHORITY\SYSTEM
Current Engine Version: %NT AUTHORITY605
Previous Engine Version: %NT AUTHORITY606
Error code: %NT AUTHORITY607
Error description: %NT AUTHORITY608
Error: (07/03/2016 02:10:47 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.223.2916.0
Update Source: %NT AUTHORITY59
Update Stage: 4.6.0305.00
Source Path: 4.6.0305.01
Signature Type: %NT AUTHORITY602
Update Type: %NT AUTHORITY604
User: NT AUTHORITY\SYSTEM
Current Engine Version: %NT AUTHORITY605
Previous Engine Version: %NT AUTHORITY606
Error code: %NT AUTHORITY607
Error description: %NT AUTHORITY608
Error: (07/03/2016 02:10:43 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.223.2916.0
Update Source: %NT AUTHORITY59
Update Stage: 4.6.0305.00
Source Path: 4.6.0305.01
Signature Type: %NT AUTHORITY602
Update Type: %NT AUTHORITY604
User: NT AUTHORITY\SYSTEM
Current Engine Version: %NT AUTHORITY605
Previous Engine Version: %NT AUTHORITY606
Error code: %NT AUTHORITY607
Error description: %NT AUTHORITY608
Error: (07/03/2016 01:52:12 AM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.223.2916.0
Update Source: %NT AUTHORITY59
Update Stage: 4.6.0305.00
Source Path: 4.6.0305.01
Signature Type: %NT AUTHORITY602
Update Type: %NT AUTHORITY604
User: NT AUTHORITY\SYSTEM
Current Engine Version: %NT AUTHORITY605
Previous Engine Version: %NT AUTHORITY606
Error code: %NT AUTHORITY607
Error description: %NT AUTHORITY608
Error: (07/02/2016 02:10:45 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.223.2916.0
Update Source: %NT AUTHORITY59
Update Stage: 4.6.0305.00
Source Path: 4.6.0305.01
Signature Type: %NT AUTHORITY602
Update Type: %NT AUTHORITY604
User: NT AUTHORITY\SYSTEM
Current Engine Version: %NT AUTHORITY605
Previous Engine Version: %NT AUTHORITY606
Error code: %NT AUTHORITY607
Error description: %NT AUTHORITY608
Error: (07/02/2016 02:10:44 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.223.2916.0
Update Source: %NT AUTHORITY59
Update Stage: 4.6.0305.00
Source Path: 4.6.0305.01
Signature Type: %NT AUTHORITY602
Update Type: %NT AUTHORITY604
User: NT AUTHORITY\SYSTEM
Current Engine Version: %NT AUTHORITY605
Previous Engine Version: %NT AUTHORITY606
Error code: %NT AUTHORITY607
Error description: %NT AUTHORITY608
Error: (07/01/2016 02:10:46 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: %NT AUTHORITY60 has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.223.2916.0
Update Source: %NT AUTHORITY59
Update Stage: 4.6.0305.00
Source Path: 4.6.0305.01
Signature Type: %NT AUTHORITY602
Update Type: %NT AUTHORITY604
User: NT AUTHORITY\SYSTEM
Current Engine Version: %NT AUTHORITY605
Previous Engine Version: %NT AUTHORITY606
Error code: %NT AUTHORITY607
Error description: %NT AUTHORITY608
CodeIntegrity:
===================================
Date: 2015-09-08 08:30:07.795
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\guard64.dll because the set of per-page image hashes could not be found on the system.
Date: 2014-10-01 13:55:43.831
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\LMouFilt.Sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2014-10-01 13:55:43.799
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\LMouFilt.Sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2014-10-01 13:55:39.351
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\LHidFilt.Sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2014-10-01 13:55:39.317
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\LHidFilt.Sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2014-10-01 13:55:39.274
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\LHidFilt.Sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2014-10-01 13:55:39.242
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\LHidFilt.Sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2014-10-01 13:55:37.142
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\LHidFilt.Sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2014-10-01 13:55:37.110
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\LHidFilt.Sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Date: 2014-10-01 13:55:37.069
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\LHidFilt.Sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-2700K CPU @ 3.50GHz
Percentage of memory in use: 31%
Total physical RAM: 16360.81 MB
Available physical RAM: 11145.08 MB
Total Virtual: 42088.8 MB
Available Virtual: 35220.4 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:238.37 GB) (Free:109.39 GB) NTFS
Drive d: (HS-450i) (CDROM) (Total:0.03 GB) (Free:0 GB) CDFS
Drive e: (Backup Drive) (Fixed) (Total:465.76 GB) (Free:343.5 GB) NTFS
Drive f: (Mastercam files) (Fixed) (Total:148.96 GB) (Free:109.13 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 238.5 GB) (Disk ID: CEB70E52)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=238.4 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 465.8 GB) (Disk ID: 295E5F9A)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)
========================================================
Disk: 2 (MBR Code: Windows XP) (Size: 149 GB) (Disk ID: 41AB2316)
Partition 1: (Not Active) - (Size=55 MB) - (Type=DE)
Partition 2: (Not Active) - (Size=149 GB) - (Type=07 NTFS)
==================== End of Addition.txt ============================
aswMBR version 1.0.1.2252 Copyright(c) 2014 AVAST Software
Run date: 2016-07-06 14:15:51
-----------------------------
14:15:51.249 OS Version: Windows x64 6.1.7601 Service Pack 1
14:15:51.249 Number of processors: 8 586 0x2A07
14:15:51.249 ComputerName: PROGRAMMING UserName: Antec-179
14:15:51.762 Initialize success
14:15:51.815 VM: initialized successfully
14:15:51.816 VM: Intel CPU supported
14:16:00.813 VM: supported disk I/O iaStor.sys
14:20:51.157 AVAST engine defs: 16070601
14:22:16.611 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
14:22:16.613 Disk 0 Vendor: OCZ-OCTA 1.13 Size: 244198MB BusType: 3
14:22:16.614 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IAAStorageDevice-2
14:22:16.615 Disk 1 Vendor: ST350041 JC4B Size: 476940MB BusType: 3
14:22:16.617 Disk 2 \Device\Harddisk2\DR2 -> \Device\Ide\IAAStorageDevice-3
14:22:16.619 Disk 2 Vendor: ST316081 4.AD Size: 152587MB BusType: 3
14:22:16.629 VM: Disk 0 MBR read successfully
14:22:16.631 Disk 0 MBR scan
14:22:16.652 Disk 0 Windows 7 default MBR code
14:22:16.655 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048
14:22:16.658 Disk 0 default boot code
14:22:16.676 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 244096 MB offset 206848
14:22:16.718 Disk 0 scanning C:\Windows\system32\drivers
14:22:24.215 Service scanning
14:22:42.313 Modules scanning
14:22:42.319 Disk 0 trace - called modules:
14:22:42.323 ntoskrnl.exe CLASSPNP.SYS disk.sys vidsflt.sys iaStor.sys hal.dll
14:22:42.328 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800f8b7790]
14:22:42.331 3 CLASSPNP.SYS[fffff8800216e43f] -> nt!IofCallDriver -> [0xfffffa800f7b9e00]
14:22:42.336 5 vidsflt.sys[fffff88000dc35f1] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa800cf4b050]
14:22:42.800 AVAST engine scan C:\Windows
14:22:44.931 AVAST engine scan C:\Windows\system32
14:25:28.595 AVAST engine scan C:\Windows\system32\drivers
14:25:40.343 AVAST engine scan C:\Users\Antec-179
14:35:21.307 AVAST engine scan C:\ProgramData
14:44:20.248 Disk 0 statistics 5321785/0/18 @ 6.49 MB/s
14:44:20.251 Scan finished successfully
14:44:54.576 Disk 0 MBR has been saved successfully to "C:\Users\Antec-179\Documents\MBR.dat"
14:44:54.595 The log file has been saved successfully to "C:\Users\Antec-179\Documents\aswMBR.txt"
Thanks.