View Full Version : Loud Computer, fan running all the time
gigglepot
2016-09-18, 04:05
Hello, a few months back my computer was running really loud, all the time, no break or change in fan speed. Spybot helped me try everything to fix it and still no luck, except at the very end I was told to run my Windows Updates, turns out I had a ton of them, so I ran them all and the super loud fan stopped running, you can hardly hear my computer on! I was thrilled. Except it's happening again and this time my Windows Important Updates are all up to date, nothing to update. So I ran the following........SpyBot, MalwareBytes, AdwCleaner, SuperAntiSpyware and Spyware Blaster. Nothing helped. Please help. I don't know what to try next.
Please download Farbar Recovery Scan Tool (x32) (http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/) or Farbar Recovery Scan Tool (x64) (http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/) and save the file to your Desktop.
Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.
Right-Click FRST.exe / FRST64.exe and select http://i.imgur.com/AVOiBNU.jpg Run as administrator to run the programme.
Click Yes to the disclaimer.
Ensure the Addition.txt box is checked.
Click the Scan button and let the programme run.
Upon completion, click OK, then OK on the Addition.txt pop up screen.
Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply.
gigglepot
2016-09-18, 14:43
Hi Juliet, thanks for helping me.
Here is the FRST log:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 17-09-2016
Ran by Owner (administrator) on OWNER-HP (18-09-2016 06:33:41)
Running from C:\Users\Owner\Desktop
Loaded Profiles: Owner (Available Profiles: Owner)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 9 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AMD) C:\Windows\System32\atieclxx.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Windows (R) Win 7 DDK provider) C:\Windows\System32\DbxSvc.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler64.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe
(LeapFrog Enterprises, Inc.) C:\Program Files (x86)\LeapFrog\LeapFrog Connect\CommandService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe
(Guillemot Corporation) C:\Program Files (x86)\Thrustmaster\TARGET\TmService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
(Pelmorex Media Inc.) C:\Users\Owner\AppData\Local\TheWeatherNetwork\WeatherEye\WeatherEye.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Mail\wlmail.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [hpsysdrv] => c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [9107616 2016-09-12] (AVAST Software)
HKLM-x32\...\Run: [PDF Complete] => C:\Program Files (x86)\PDF Complete\pdfsty.exe
HKLM-x32\...\Run: [StartCCC] => c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [102400 2010-05-11] (Advanced Micro Devices, Inc.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\Run: [WeatherEye] => C:\Users\Owner\AppData\Local\TheWeatherNetwork\WeatherEye\WeatherEye.exe [309104 2010-09-21] (Pelmorex Media Inc.)
HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2857248 2016-08-23] (Valve Corporation)
HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\MountPoints2: F - F:\DisneySplash.exe
HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\MountPoints2: {2e587596-fbf0-11e5-ba25-6431503ceaa3} - F:\startme.exe
HKU\S-1-5-18\...\RunOnce: [iCloud] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloud.exe [60688 2015-10-21] (Apple Inc.)
ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-07-29] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-07-29] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-07-29] (Google)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2016-08-29] (AVAST Software)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 64.59.135.148 64.59.128.114
Tcpip\..\Interfaces\{853F1832-EF79-4946-9A19-0123FAFCABB6}: [DhcpNameServer] 64.59.135.148 64.59.128.114
Internet Explorer:
==================
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://ca.yahoo.com?fr=hp-avast&type=avastbcl
HKU\S-1-5-21-179166284-1700762968-3849658672-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxps://ca.yahoo.com?fr=hp-avast&type=avastbcl
HKU\S-1-5-21-179166284-1700762968-3849658672-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://ca.msn.com/
HKU\S-1-5-21-179166284-1700762968-3849658672-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://ca.yahoo.com?fr=hp-avast&type=avastbcl
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2016-08-29] (AVAST Software)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll [2009-01-26] (Safer Networking Limited)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\ssv.dll [2016-07-03] (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-08-29] (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\jp2ssv.dll [2016-07-03] (Oracle Corporation)
DPF: HKLM-x32 {149E45D8-163E-4189-86FC-45022AB2B6C9} file:///C:/Program%20Files%20(x86)/Plants%20vs.%20Zombies/Images/stg_drm.ocx
DPF: HKLM-x32 {BEA7310D-06C4-4339-A784-DC3804819809} hxxp://www.photolab.ca/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab
DPF: HKLM-x32 {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///C:/Program%20Files%20(x86)/Plants%20vs.%20Zombies/Images/armhelper.ocx
Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-07-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-07-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-07-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-07-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-07-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-07-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-07-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-07-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-07-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-07-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-07-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-07-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-07-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-07-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-07-27] (Citrix Systems, Inc.)
Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-07-27] (Citrix Systems, Inc.)
FireFox:
========
FF ProfilePath: C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\oeo7drnr.default-1460249555612
FF Homepage: hxxp://www.kijiji.ca/h-calgary/1700199
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_23_0_0_162.dll [2016-09-13] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_23_0_0_162.dll [2016-09-13] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-10-08] ()
FF Plugin-x32: @Citrix.com/npican -> C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll [2012-07-27] (Citrix Systems, Inc.)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2014-01-06] (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\dtplugin\npDeployJava1.dll [2016-07-03] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\plugin2\npjp2.dll [2016-07-03] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-06-30] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-179166284-1700762968-3849658672-1000: @nsroblox.roblox.com/launcher -> C:\Users\Owner\AppData\Local\Roblox\Versions\version-ea857a546aae4b0e\\NPRobloxProxy.dll [2013-01-01] ( ROBLOX Corporation)
FF Plugin HKU\S-1-5-21-179166284-1700762968-3849658672-1000: @nsroblox.roblox.com/launcher64 -> C:\Users\Owner\AppData\Local\Roblox\Versions\version-ea857a546aae4b0e\\NPRobloxProxy64.dll [2013-01-01] ( ROBLOX Corporation)
FF Plugin HKU\S-1-5-21-179166284-1700762968-3849658672-1000: sony.com/MediaGoDetector -> C:\Program Files (x86)\Sony\Media Go\npMediaGoDetector.dll [2015-11-20] (Sony Network Entertainment International LLC)
FF Extension: (leethax.net extension) - C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\oeo7drnr.default-1460249555612\extensions\leethax@leethax.net.xpi [2016-05-11]
FF Extension: (Bitdefender QuickScan) - C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\oeo7drnr.default-1460249555612\extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2016-06-27]
FF Extension: (Greasemonkey) - C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\oeo7drnr.default-1460249555612\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2016-08-20]
FF Extension: (New Tab Override (browser.newtab.url replacement)) - C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\oeo7drnr.default-1460249555612\Extensions\newtaboverride@agenedia.com.xpi [2016-06-29]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: (Avast Online Security) - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-08-29]
FF HKLM\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF Extension: (Avast SafePrice) - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2016-08-29]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF HKLM-x32\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
Chrome:
=======
CHR HomePage: Default -> hxxp://www.kijiji.ca/
CHR StartupUrls: Default -> "hxxp://calgary.kijiji.ca/"
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\50.0.2661.87\PepperFlash\pepflashplayer.dll => No File
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\50.0.2661.87\ppGoogleNaClPluginChrome.dll => No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\50.0.2661.87\pdf.dll => No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll => No File
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll => No File
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll => No File
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Citrix ICA Client) - C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll (Citrix Systems, Inc.)
CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll => No File
CHR Plugin: (Java(TM) Platform SE 7 U21) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll => No File
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll => No File
CHR Plugin: (Windows Live? Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Roblox Launcher Plugin) - C:\Users\Owner\AppData\Local\Roblox\Versions\version-1a23fdbca04d4954\\NPRobloxProxy.dll => No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll => No File
CHR Profile: C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default [2016-08-11]
CHR Extension: (Google Drive) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-04-14]
CHR Extension: (Google Docs Offline) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-04-14]
CHR Extension: (Avast Online Security) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2016-04-14]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-09]
CHR HKU\S-1-5-21-179166284-1700762968-3849658672-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Owner\AppData\Local\Google\Drive\user_default\apdfllckaahabafndbhieahigkjlhalf_live.crx [2016-01-30]
CHR HKU\S-1-5-21-179166284-1700762968-3849658672-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <not found>
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-08-13] (SUPERAntiSpyware.com)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-10-07] (Apple Inc.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [197128 2016-08-29] (AVAST Software)
S3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.) [File not signed]
R2 DbxSvc; C:\Windows\system32\DbxSvc.exe [42792 2016-09-12] (Windows (R) Win 7 DDK provider)
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89352 2014-09-15] (Hewlett-Packard Company)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
R2 LightScribeService; c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2010-11-22] (Hewlett-Packard Company) [File not signed]
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [754784 2016-01-08] (DEVGURU Co., LTD.)
R2 TmWinService; C:\Program Files (x86)\Thrustmaster\TARGET\TmService.exe [304640 2011-03-04] (Guillemot Corporation) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)
S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [X]
S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [X]
S3 WsDrvInst; "C:\Program Files (x86)\Wondershare\Dr.Fone for Android\DriverInstall.exe" [X]
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [37656 2016-08-29] (AVAST Software)
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [37144 2016-08-29] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [108816 2016-08-29] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [103064 2016-08-29] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [74544 2016-08-29] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [969184 2016-09-13] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [513496 2016-08-29] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [163416 2016-08-29] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [292704 2016-08-29] (AVAST Software)
S3 dg_ssudbus; C:\Windows\System32\DRIVERS\ssudbus.sys [130688 2016-07-22] (Samsung Electronics Co., Ltd.)
S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
S3 FlyUsb; C:\Windows\System32\DRIVERS\FlyUsb.sys [24576 2015-06-04] (LeapFrog)
S3 ggsomc; C:\Windows\System32\DRIVERS\ggsomc.sys [30424 2016-09-10] (Sony Mobile Communications)
S3 SaiH0464; C:\Windows\System32\DRIVERS\SaiH0464.sys [178432 2008-03-31] (Saitek)
R3 SaiMini; C:\Windows\System32\DRIVERS\SaiMini.sys [25120 2013-04-30] (Saitek)
R3 SaiNtBus; C:\Windows\System32\drivers\SaiBus.sys [52640 2013-04-30] (Saitek)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 ssudmdm; C:\Windows\System32\DRIVERS\ssudmdm.sys [164992 2016-07-22] (Samsung Electronics Co., Ltd.)
R3 TmBusEn; C:\Windows\System32\DRIVERS\TmBusEn.sys [30208 2011-01-26] (Guillemot Corporation)
R3 TmBusEn; C:\Windows\SysWOW64\DRIVERS\TmBusEn.sys [30208 2011-01-26] (Guillemot Corporation)
S3 TmFilter; C:\Windows\System32\DRIVERS\TmFilter.sys [24576 2011-01-26] (Guillemot Corporation)
S3 TmFilter; C:\Windows\SysWOW64\DRIVERS\TmFilter.sys [24576 2011-01-26] (Guillemot Corporation)
S3 TmHid; C:\Windows\System32\DRIVERS\TmHid.sys [24704 2011-01-26] (Guillemot Corporation)
S3 TmHid; C:\Windows\SysWOW64\DRIVERS\TmHid.sys [24704 2011-01-26] (Guillemot Corporation)
S3 dbx; system32\DRIVERS\dbx.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-09-18 06:33 - 2016-09-18 06:35 - 00026520 _____ C:\Users\Owner\Desktop\FRST.txt
2016-09-18 06:33 - 2016-09-18 06:33 - 02399232 _____ (Farbar) C:\Users\Owner\Desktop\FRST64.exe
2016-09-18 06:33 - 2016-09-18 06:33 - 00000000 ____D C:\FRST
2016-09-17 19:19 - 2016-09-17 19:20 - 00000000 ____D C:\Users\Owner\AppData\Local\{44EBC9BE-50EB-456F-A420-DAF9668C2F71}
2016-09-17 12:22 - 2016-09-17 12:24 - 00000000 ____D C:\AdwCleaner
2016-09-17 12:21 - 2016-09-17 12:22 - 03861056 _____ C:\Users\Owner\Desktop\AdwCleaner.exe
2016-09-17 07:19 - 2016-09-17 07:19 - 00000000 ____D C:\Users\Owner\AppData\Local\{3B5BBF45-B4A9-4E93-83CF-D76D0B374CEE}
2016-09-16 10:49 - 2016-09-16 10:49 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_ggsomc_01009.Wdf
2016-09-16 10:49 - 2016-09-16 10:49 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_ggflt_01009.Wdf
2016-09-16 09:39 - 2016-09-16 09:40 - 00000000 ____D C:\Users\Owner\AppData\Local\{A44E8D0E-E8C6-4294-B2C6-B8163E95DF57}
2016-09-15 21:39 - 2016-09-15 21:39 - 00000000 ____D C:\Users\Owner\AppData\Local\{6D0E66CC-288B-4FC8-9379-FF2B759CECC4}
2016-09-15 20:10 - 2016-09-15 20:10 - 00001109 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2016-09-15 20:03 - 2016-09-15 20:09 - 44497776 _____ C:\Users\Owner\Desktop\Firefox Setup 46.0.1.exe
2016-09-15 09:38 - 2016-09-15 09:39 - 00000000 ____D C:\Users\Owner\AppData\Local\{7740A674-CE9B-45D2-B4AD-6E3DFACC0F43}
2016-09-14 21:38 - 2016-09-14 21:38 - 00000000 ____D C:\Users\Owner\AppData\Local\{3E5A5AE4-EC79-4EBB-A526-34E11C171248}
2016-09-14 09:38 - 2016-09-14 09:38 - 00000000 ____D C:\Users\Owner\AppData\Local\{6C13D7C4-2646-4E1C-9BE5-9498A0C320ED}
2016-09-13 21:37 - 2016-09-13 21:37 - 00000000 ____D C:\Users\Owner\AppData\Local\{19101583-86C2-4400-B515-86D04B87FC68}
2016-09-13 09:37 - 2016-09-13 09:37 - 00000000 ____D C:\Users\Owner\AppData\Local\{2CC9B5A5-7100-49D6-9CDB-AE9CFFEA0D3B}
2016-09-12 21:37 - 2016-09-12 21:37 - 00000000 ____D C:\Users\Owner\AppData\Local\{D0D28D77-92CD-4A4F-BCF2-F67D1CF15786}
2016-09-12 09:36 - 2016-09-12 09:36 - 00000000 ____D C:\Users\Owner\AppData\Local\{4E31553C-510F-4E64-BAE6-51F9033F7E28}
2016-09-12 07:11 - 2016-09-12 07:11 - 00042792 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\DbxSvc.exe
2016-09-12 07:05 - 2016-09-12 07:05 - 00073840 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\dbx-stable.sys
2016-09-12 07:05 - 2016-09-12 07:05 - 00073840 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\dbx-dev.sys
2016-09-12 07:05 - 2016-09-12 07:05 - 00073840 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\dbx-canary.sys
2016-09-11 21:36 - 2016-09-11 21:36 - 00000000 ____D C:\Users\Owner\AppData\Local\{2B2BE6D9-7FC0-4DBF-BA68-DEE4CE5994A5}
2016-09-11 09:34 - 2016-09-11 09:34 - 00000000 ____D C:\Users\Owner\AppData\Local\{9C9276F2-651C-4DB9-9537-823704317027}
2016-09-10 21:33 - 2016-09-10 21:33 - 00000000 ____D C:\Users\Owner\AppData\Local\{56339C22-97B4-4B9A-88EA-73795DD53D8A}
2016-09-10 16:23 - 2016-09-10 16:23 - 00030424 _____ (Sony Mobile Communications) C:\Windows\system32\Drivers\ggsomc.sys
2016-09-10 16:23 - 2016-09-10 16:23 - 00016088 _____ (Sony Mobile Communications) C:\Windows\system32\Drivers\ggflt.sys
2016-09-10 16:21 - 2016-09-10 16:21 - 00000000 ____D C:\ProgramData\Sony Mobile
2016-09-10 16:21 - 2016-09-10 16:21 - 00000000 ____D C:\Program Files (x86)\Sony Mobile
2016-09-10 09:32 - 2016-09-10 09:33 - 00000000 ____D C:\Users\Owner\AppData\Local\{B3285994-9C48-47E2-A9AE-1BC9AA212BA4}
2016-09-09 21:31 - 2016-09-09 21:32 - 00000000 ____D C:\Users\Owner\AppData\Local\{DE14F04F-CC81-410E-99AA-736E40953E1D}
2016-09-09 09:30 - 2016-09-09 09:31 - 00000000 ____D C:\Users\Owner\AppData\Local\{69D22C83-FEA3-4E2C-B8CF-B9B23E9E219D}
2016-09-08 21:29 - 2016-09-08 21:30 - 00000000 ____D C:\Users\Owner\AppData\Local\{A9D03064-40C5-4D07-A5F3-8F967D97D69D}
2016-09-08 09:29 - 2016-09-08 09:29 - 00000000 ____D C:\Users\Owner\AppData\Local\{450913BA-3524-438A-B1CE-A81F0677704D}
2016-09-07 21:28 - 2016-09-07 21:29 - 00000000 ____D C:\Users\Owner\AppData\Local\{BAFC6672-4E75-4294-AB9B-20E6B6C20F51}
2016-09-07 09:28 - 2016-09-07 09:28 - 00000000 ____D C:\Users\Owner\AppData\Local\{3F1B9554-A1A3-484E-BEFA-D7E9FF06A55B}
2016-09-06 21:28 - 2016-09-06 21:28 - 00000000 ____D C:\Users\Owner\AppData\Local\{7756E88A-474B-467B-AD08-561DAC6CE6BE}
2016-09-06 09:53 - 2016-09-17 11:05 - 00002661 _____ C:\Users\Public\Desktop\Xperia Companion.lnk
2016-09-06 09:27 - 2016-09-06 09:27 - 00000000 ____D C:\Users\Owner\AppData\Local\{96E6027E-D180-47C4-8A17-2E19E20F3509}
2016-09-05 21:27 - 2016-09-05 21:27 - 00000000 ____D C:\Users\Owner\AppData\Local\{B7D8870A-3E85-472B-A940-E2679FD02BAE}
2016-09-05 09:26 - 2016-09-05 09:27 - 00000000 ____D C:\Users\Owner\AppData\Local\{A4E9CFF9-2687-4394-A72B-55D72C1F90FF}
2016-09-04 21:26 - 2016-09-04 21:26 - 00000000 ____D C:\Users\Owner\AppData\Local\{D9CFB0E8-78FB-4630-AF75-5245370F263F}
2016-09-04 09:26 - 2016-09-04 09:26 - 00000000 ____D C:\Users\Owner\AppData\Local\{BD99D952-4E7F-451D-89D7-190CB323CAF8}
2016-09-03 21:25 - 2016-09-03 21:25 - 00000000 ____D C:\Users\Owner\AppData\Local\{592B3716-50A8-4A06-B6D7-A9298B5E7A75}
2016-09-03 09:25 - 2016-09-03 09:25 - 00000000 ____D C:\Users\Owner\AppData\Local\{A69F61A1-E7E0-44FB-A8FB-1894354A5C41}
2016-09-02 21:25 - 2016-09-02 21:25 - 00000000 ____D C:\Users\Owner\AppData\Local\{34F408D0-F070-4CF2-BE03-7F3724468A64}
2016-09-02 09:24 - 2016-09-02 09:24 - 00000000 ____D C:\Users\Owner\AppData\Local\{E21C2ABE-B10C-4E28-A065-60D93DB48DB5}
2016-09-01 21:23 - 2016-09-01 21:23 - 00000000 ____D C:\Users\Owner\AppData\Local\{2AAB15C5-6C3A-44FF-A92E-324B0AF65061}
2016-09-01 09:22 - 2016-09-01 09:23 - 00000000 ____D C:\Users\Owner\AppData\Local\{02C0208C-DC4A-4E64-9885-5F69DE8D4ACB}
2016-08-31 21:22 - 2016-08-31 21:22 - 00000000 ____D C:\Users\Owner\AppData\Local\{393D2E20-7CA5-498C-AE5E-17124BA47E74}
2016-08-31 09:22 - 2016-08-31 09:22 - 00000000 ____D C:\Users\Owner\AppData\Local\{15650557-DAB6-4106-AE26-96BF2C9B766F}
2016-08-30 21:21 - 2016-08-30 21:21 - 00000000 ____D C:\Users\Owner\AppData\Local\{5FFC0A48-23A0-45AE-B1B7-959C8346A41C}
2016-08-30 09:21 - 2016-08-30 09:21 - 00000000 ____D C:\Users\Owner\AppData\Local\{6CBEAB9D-4298-4C72-989E-138343196661}
2016-08-30 07:08 - 2016-08-30 07:08 - 00003890 _____ C:\Windows\System32\Tasks\SafeZone scheduled Autoupdate 1465907730
2016-08-29 21:20 - 2016-08-29 21:20 - 00000000 ____D C:\Users\Owner\AppData\Local\{BE8D6866-64A0-4475-8004-296292B2F672}
2016-08-29 12:58 - 2016-08-29 12:58 - 00391496 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2016-08-29 12:58 - 2016-08-29 12:58 - 00053208 _____ (AVAST Software) C:\Windows\avastSS.scr
2016-08-29 09:19 - 2016-08-29 09:19 - 00000000 ____D C:\Users\Owner\AppData\Local\{C7102ACF-66D4-44E1-B238-19E8EF520DAC}
2016-08-28 21:18 - 2016-08-28 21:18 - 00000000 ____D C:\Users\Owner\AppData\Local\{E8714771-FC90-48FD-BDC2-894CD1DA07B4}
2016-08-28 09:17 - 2016-08-28 09:17 - 00000000 ____D C:\Users\Owner\AppData\Local\{451D6863-3E29-468D-BFCF-A218468E96F3}
2016-08-27 21:16 - 2016-08-27 21:16 - 00000000 ____D C:\Users\Owner\AppData\Local\{E2DA54C4-EE95-4292-B7B1-B5635FADFBBB}
2016-08-27 09:15 - 2016-08-27 09:15 - 00000000 ____D C:\Users\Owner\AppData\Local\{D852B7B9-91A3-4166-A4A5-59E7071CECB4}
2016-08-26 21:14 - 2016-08-26 21:14 - 00000000 ____D C:\Users\Owner\AppData\Local\{CD54E28A-EC0D-4F24-8246-D4771D3E6506}
2016-08-26 09:13 - 2016-08-26 09:13 - 00000000 ____D C:\Users\Owner\AppData\Local\{FB8D576D-1C37-4E7C-BBD4-BB742F516DAD}
2016-08-25 21:12 - 2016-08-25 21:12 - 00000000 ____D C:\Users\Owner\AppData\Local\{10DA4172-1302-45F1-8FF2-65802F4D9C96}
2016-08-25 09:11 - 2016-08-25 09:11 - 00000000 ____D C:\Users\Owner\AppData\Local\{7AA7BF82-C882-4117-8410-E180934DC606}
2016-08-24 21:10 - 2016-08-24 21:10 - 00000000 ____D C:\Users\Owner\AppData\Local\{ECB36ED5-32AC-4694-8F42-08E5370C9704}
2016-08-24 09:09 - 2016-08-24 09:09 - 00000000 ____D C:\Users\Owner\AppData\Local\{D3EB4F18-7793-49F8-94A4-D946022DA016}
2016-08-23 21:08 - 2016-08-23 21:08 - 00000000 ____D C:\Users\Owner\AppData\Local\{1A16FA20-D639-4593-9CC0-1EA244324396}
2016-08-23 09:07 - 2016-08-23 09:08 - 00000000 ____D C:\Users\Owner\AppData\Local\{354A0E43-9AB4-476D-93AA-EBFB00D09A74}
2016-08-22 21:06 - 2016-08-22 21:06 - 00000000 ____D C:\Users\Owner\AppData\Local\{ECF51D14-71D4-4A1F-B262-B03B4937B322}
2016-08-22 09:06 - 2016-08-22 09:06 - 00000000 ____D C:\Users\Owner\AppData\Local\{6C0C9DB4-BC94-4776-82C0-D4C1CDF467EC}
2016-08-21 21:05 - 2016-08-21 21:06 - 00000000 ____D C:\Users\Owner\AppData\Local\{29A5629C-FC94-40E3-A568-A3E6954EEE5A}
2016-08-21 09:04 - 2016-08-21 09:04 - 00000000 ____D C:\Users\Owner\AppData\Local\{36BB4B10-9A7B-499D-9890-B03DC677B242}
2016-08-21 07:14 - 2008-10-15 06:22 - 05631312 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_40.dll
2016-08-21 07:14 - 2008-10-15 06:22 - 02605920 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_40.dll
2016-08-21 07:14 - 2008-10-15 06:22 - 00519000 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_40.dll
2016-08-20 22:12 - 2016-08-20 22:12 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Warner Bros. Interactive Entertainment
2016-08-20 21:03 - 2016-08-20 21:04 - 00000000 ____D C:\Users\Owner\AppData\Local\{3C8F344C-507B-42FF-88C7-CC84DE6B78E0}
2016-08-20 20:01 - 2016-08-20 20:01 - 00000222 _____ C:\Users\Owner\Desktop\LEGO Worlds.url
2016-08-20 20:01 - 2016-08-20 20:01 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2016-08-20 19:59 - 2016-08-20 19:59 - 00000000 ____D C:\Users\Owner\AppData\Local\Steam
2016-08-20 19:39 - 2016-09-18 06:20 - 00000000 ____D C:\Program Files (x86)\Steam
2016-08-20 19:39 - 2016-08-20 19:39 - 01446792 _____ C:\Users\Owner\Desktop\SteamSetup.exe
2016-08-20 19:39 - 2016-08-20 19:39 - 00000925 _____ C:\Users\Public\Desktop\Steam.lnk
2016-08-20 19:39 - 2016-08-20 19:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2016-08-20 09:03 - 2016-08-20 09:03 - 00000000 ____D C:\Users\Owner\AppData\Local\{88232FE4-EFAF-4B36-9215-5C94E1553916}
2016-08-19 21:02 - 2016-08-19 21:02 - 00000000 ____D C:\Users\Owner\AppData\Local\{CFC3688F-B90B-4320-BA98-FE15EC5A47AE}
2016-08-19 09:02 - 2016-08-19 09:02 - 00000000 ____D C:\Users\Owner\AppData\Local\{D9486B45-BC14-4423-A0D5-A9C674E127E6}
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-09-18 06:29 - 2009-07-13 22:45 - 00018736 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-09-18 06:29 - 2009-07-13 22:45 - 00018736 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-09-18 06:22 - 2015-11-16 07:24 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-09-18 06:20 - 2011-05-12 13:16 - 00000000 ____D C:\Users\Owner\AppData\Local\VirtualStore
2016-09-18 06:19 - 2014-09-08 11:32 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-09-18 06:19 - 2009-07-13 23:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-09-17 19:56 - 2014-09-08 11:32 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-09-17 12:52 - 2011-05-12 13:22 - 00003926 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{BF401F47-875B-4406-9B0C-8E70A5A1480F}
2016-09-17 12:26 - 2014-06-17 14:33 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
2016-09-17 12:22 - 2011-03-14 16:11 - 00000000 ____D C:\ProgramData\Temp
2016-09-17 12:20 - 2014-06-17 14:03 - 00000000 ____D C:\Program Files (x86)\SpywareBlaster
2016-09-17 12:17 - 2016-04-12 06:28 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-09-17 11:04 - 2011-06-04 16:13 - 00000000 ____D C:\Users\Owner\AppData\Local\CrashDumps
2016-09-17 10:38 - 2015-05-22 11:42 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-09-17 09:31 - 2013-03-26 20:18 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Roblox
2016-09-16 18:08 - 2011-05-15 17:36 - 00000000 ____D C:\Users\Owner\AppData\Roaming\HpUpdate
2016-09-16 18:08 - 2011-05-15 17:36 - 00000000 ____D C:\Users\Owner\AppData\Roaming\HP Support Assistant
2016-09-16 17:59 - 2014-09-08 11:38 - 00002157 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-09-16 15:38 - 2012-09-04 16:09 - 00000000 ____D C:\Users\Owner\AppData\Roaming\.minecraft
2016-09-16 11:16 - 2011-05-22 07:01 - 00000000 ____D C:\Users\Owner\Documents\Lillian
2016-09-16 10:44 - 2009-07-13 21:20 - 00000000 ____D C:\Windows\inf
2016-09-16 09:30 - 2016-04-06 09:36 - 15516672 _____ C:\Users\Owner\AppData\Local\pcc.exe
2016-09-15 20:13 - 2016-01-30 20:41 - 00000000 ____D C:\Program Files (x86)\Dropbox
2016-09-15 20:13 - 2013-11-14 07:59 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-09-15 20:10 - 2013-11-14 07:59 - 00001121 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-09-15 20:04 - 2011-05-17 15:16 - 00000000 ____D C:\Users\Owner\AppData\Roaming\vlc
2016-09-15 18:49 - 2016-01-29 19:48 - 00003186 _____ C:\Windows\System32\Tasks\HPCeeScheduleForOwner
2016-09-15 18:49 - 2016-01-29 19:48 - 00000332 _____ C:\Windows\Tasks\HPCeeScheduleForOwner.job
2016-09-15 16:59 - 2014-12-25 08:11 - 00004476 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2016-09-14 22:18 - 2016-06-30 19:49 - 17983233 ____H C:\Users\Owner\AppData\Local\IconCache.db.backup
2016-09-13 10:22 - 2015-11-16 07:24 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2016-09-13 10:22 - 2012-07-11 07:42 - 00000000 ____D C:\Windows\system32\Macromed
2016-09-13 10:22 - 2012-05-14 06:53 - 00796352 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-09-13 10:22 - 2011-08-06 07:47 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-09-13 10:22 - 2011-03-14 16:02 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2016-09-13 06:11 - 2011-05-15 23:54 - 00969184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2016-09-12 10:34 - 2011-05-12 13:07 - 00000000 ____D C:\Users\Owner
2016-09-10 16:21 - 2016-06-29 10:48 - 00000000 ____D C:\Users\Owner\.oracle_jre_usage
2016-09-06 20:29 - 2016-01-30 20:54 - 00000000 ___RD C:\Users\Owner\Dropbox
2016-09-06 09:53 - 2016-04-06 10:02 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
2016-09-06 09:53 - 2016-04-06 10:02 - 00000000 ____D C:\Program Files (x86)\Sony
2016-09-06 09:53 - 2016-04-06 09:59 - 00000000 ____D C:\ProgramData\Package Cache
2016-09-06 09:34 - 2009-07-13 23:13 - 00783464 _____ C:\Windows\system32\PerfStringBackup.INI
2016-08-29 12:59 - 2015-04-24 06:19 - 00003922 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2016-08-29 12:58 - 2016-06-14 06:27 - 00037144 _____ (AVAST Software) C:\Windows\system32\Drivers\aswKbd.sys
2016-08-29 12:58 - 2014-04-23 10:41 - 00037656 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2016-08-29 12:58 - 2013-12-23 07:00 - 00163416 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2016-08-29 12:58 - 2013-03-07 07:33 - 00292704 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
2016-08-29 12:58 - 2013-03-07 07:33 - 00074544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2016-08-29 12:58 - 2012-02-24 07:44 - 00103064 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2016-08-29 12:58 - 2011-05-15 23:54 - 00513496 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2016-08-29 12:58 - 2011-05-15 23:54 - 00108816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2016-08-20 19:39 - 2011-05-16 16:00 - 00000000 ____D C:\Users\Owner\Documents\Vuze Downloads
2016-08-20 19:39 - 2011-05-16 15:53 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Azureus
2016-08-20 12:25 - 2011-06-13 06:25 - 00003218 _____ C:\Windows\System32\Tasks\HPCeeScheduleForOWNER-HP$
2016-08-20 12:25 - 2011-06-13 06:25 - 00000342 _____ C:\Windows\Tasks\HPCeeScheduleForOWNER-HP$.job
2016-08-19 15:30 - 2016-08-18 15:23 - 00000000 _____ C:\Windows\SysWOW64\last.dump
2016-08-19 08:06 - 2016-01-30 20:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
==================== Files in the root of some directories =======
2011-06-24 14:38 - 2011-09-23 14:24 - 0001854 _____ () C:\Users\Owner\AppData\Roaming\GhostObjGAFix.xml
2012-04-12 15:00 - 2014-06-06 10:41 - 0122368 _____ () C:\Users\Owner\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2016-04-06 09:36 - 2016-09-16 09:30 - 15516672 _____ () C:\Users\Owner\AppData\Local\pcc.exe
2013-01-07 10:09 - 2013-01-07 10:09 - 0002145 _____ () C:\Users\Owner\AppData\Local\recently-used.xbel
2011-05-20 22:49 - 2011-05-20 22:49 - 0000017 _____ () C:\Users\Owner\AppData\Local\resmon.resmoncfg
2011-05-16 06:54 - 2011-05-23 15:36 - 0000691 _____ () C:\ProgramData\hpzinstall.log
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2016-08-26 08:33
==================== End of FRST.txt ============================
And here is the Addition.txt log:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-09-2016
Ran by Owner (18-09-2016 06:36:05)
Running from C:\Users\Owner\Desktop
Windows 7 Home Premium Service Pack 1 (X64) (2011-05-12 19:07:51)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-179166284-1700762968-3849658672-500 - Administrator - Disabled)
Guest (S-1-5-21-179166284-1700762968-3849658672-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-179166284-1700762968-3849658672-1002 - Limited - Enabled)
Owner (S-1-5-21-179166284-1700762968-3849658672-1000 - Administrator - Enabled) => C:\Users\Owner
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avast Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: Avast Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
µTorrent (HKLM-x32\...\uTorrent) (Version: 2.2.1 - )
7-Zip 9.22 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0922-000001000000}) (Version: 9.22.00.0 - Igor Pavlov)
Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.017.20053 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.7.0.1530 - Adobe Systems Incorporated)
Adobe Flash Player 23 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 23.0.0.162 - Adobe Systems Incorporated)
Adobe Flash Player 23 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 23.0.0.162 - Adobe Systems Incorporated)
Apple Application Support (32-bit) (HKLM-x32\...\{649A1FD9-5892-46AD-8DF0-C4A43FF61CB7}) (Version: 4.1 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{0DE0A178-AC7B-4650-806C-CF226DE03766}) (Version: 4.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{3540181E-340A-4E7A-B409-31663472B2F7}) (Version: 9.1.0.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)
ATI Catalyst Install Manager (HKLM\...\{7C7A5A92-046C-A38C-AE0F-8F9CCA0F67A8}) (Version: 3.0.774.0 - ATI Technologies, Inc.)
Avast Free Antivirus (HKLM-x32\...\avast) (Version: 12.3.2280 - AVAST Software)
Avidemux 2.5 (HKLM-x32\...\Avidemux 2.5) (Version: 2.5.4.6714 - )
Bing Rewards Client Installer (x32 Version: 16.0.345.0 - Microsoft Corporation) Hidden
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
Brother MFL-Pro Suite MFC-J615W (HKLM-x32\...\{7FB6B1B7-075B-4B7F-BEB6-97584F73C7B5}) (Version: 1.0.4.0 - Brother Industries, Ltd.)
CanoScan Toolbox Ver4.9 (HKLM-x32\...\{CA9BCD4D-B782-4637-8F1F-F9A328D3C244}) (Version: - )
ccc-core-static (x32 Version: 2010.0511.2153.37435 - ATI) Hidden
Citrix Receiver (HKLM-x32\...\CitrixOnlinePluginPackWeb) (Version: 13.3.0.55 - Citrix Systems, Inc.)
Compaq Setup Manager (HKLM-x32\...\{AE856388-AFAD-4753-81DF-D96B19D0A17C}) (Version: 1.0.12844.3519 - Hewlett-Packard Company)
Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
CyberLink DVD Suite Deluxe (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 7.0.3210 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dora Backpack (HKLM-x32\...\{D859D35F-E947-4F2A-8591-C76A4D116178}) (Version: - )
Drome Racers (HKLM-x32\...\{EC1DCD6C-3AE0-42CE-8EAA-6886CC4400DC}) (Version: - )
DVD Flick 1.3.0.7 (HKLM-x32\...\DVD Flick_is1) (Version: 1.3.0.7 - Dennis Meuwissen)
FastStone Image Viewer 4.5 (HKLM-x32\...\FastStone Image Viewer) (Version: 4.5 - FastStone Soft)
Five Nights at Freddy's DEMO (HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\Five Nights at Freddy's DEMO) (Version: - )
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 53.0.2785.116 - Google Inc.)
Google Drive (HKLM-x32\...\{459CE109-4E46-4340-92BC-054642BC3BC2}) (Version: 1.31.2873.2758 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.31.5 - Google Inc.) Hidden
Google+ Auto Backup (HKLM-x32\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google)
Hewlett-Packard ACLM.NET v1.1.1.0 (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
HP Odometer (HKLM-x32\...\{B8AC1A89-FFD1-4F97-8051-E505A160F562}) (Version: 2.10.0000 - Hewlett-Packard)
HP Setup (HKLM-x32\...\{53469506-A37E-4314-A9D9-38724EC23A75}) (Version: 8.4.4400.3525 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\...\{CA43FE4F-9FF2-4AD7-88F0-CC3BAC17B226}) (Version: 6.0.5.4 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\...\{7F2A11F4-EAE8-4325-83EC-E3E99F85169E}) (Version: 10.1.1000 - Hewlett-Packard)
HP Support Solutions Framework (HKLM-x32\...\{44157EB3-D8D0-4BB1-B0F5-AD2C38814ED1}) (Version: 11.51.0027 - Hewlett-Packard Company)
HP Update (HKLM-x32\...\{DE77FE3F-A33D-499A-87AD-5FC406617B40}) (Version: 5.002.003.003 - Hewlett-Packard)
HP Vision Hardware Diagnostics (HKLM\...\{D79A02E9-6713-4335-9668-AAC7474C0C0E}) (Version: 2.1.6.0 - Hewlett-Packard)
iCloud (HKLM\...\{B33C558F-772F-4308-A059-390FBF9BAAAE}) (Version: 5.0.2.61 - Apple Inc.)
iTunes (HKLM\...\{E690A491-702F-4DEC-9977-C015D1DBB57C}) (Version: 12.3.1.23 - Apple Inc.)
Java 8 Update 91 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218091F0}) (Version: 8.0.910.15 - Oracle Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
KMSpico v9.2.2 RC (HKLM\...\KMSpico_is1) (Version: 9.2.2 RC - )
LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.3130 - CyberLink Corp.)
LabelPrint (x32 Version: 2.5.3130 - CyberLink Corp.) Hidden
LeapFrog Connect (HKLM-x32\...\UPCShell) (Version: 7.0.7.20035 - LeapFrog)
LeapFrog Connect (x32 Version: 7.0.7.20035 - LeapFrog) Hidden
LeapFrog Tag Plugin (x32 Version: 7.0.6.19846 - LeapFrog) Hidden
LEGO Star Wars (HKLM-x32\...\InstallShield_{E914A24F-2412-4374-B420-86D21D6D444A}) (Version: 1.00.0000 - Giant)
LEGO Star Wars (x32 Version: 1.00.0000 - Giant) Hidden
LEGO Star Wars II (HKLM-x32\...\InstallShield_{578FA426-47C0-4A3F-98A4-01ACD26B7556}) (Version: 1.00.0000 - LucasArts)
LEGO Star Wars II (x32 Version: 1.00.0000 - LucasArts) Hidden
LEGO® Batman™ (HKLM-x32\...\InstallShield_{398AB469-77FC-4935-820B-D419388C0A6A}) (Version: 1.00.0000 - Warner Bros. Interactive Entertainment)
LEGO® Batman™ (x32 Version: 1.00.0000 - Warner Bros. Interactive Entertainment) Hidden
LEGO® Indiana Jones™ 2 (x32 Version: 1.00.0000 - LucasArts) Hidden
LEGO® Indiana Jones™ 2: The Adventure Continues (HKLM-x32\...\InstallShield_{11192AA7-FBE3-4150-9667-EE7279CCC769}) (Version: 1.00.0000 - LucasArts)
LEGO® Star Wars™ III: The Clone Wars™ (HKLM-x32\...\{6C0A6B81-0D00-453F-B220-E1F7931B3C2A}) (Version: 1.0.0.0 - LucasArts)
LEGO® Worlds (HKLM\...\Steam App 332310) (Version: - TT Games)
LightScribe System Software (HKLM-x32\...\{FD7F0DB8-0E96-4D64-AD4D-9B5A936AF2A8}) (Version: 1.18.20.1 - LightScribe)
Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Media Go (HKLM-x32\...\{65256C0D-3FE7-4D2E-BB3E-53F1175481C8}) (Version: 3.0.403 - Sony)
Media Go Network Downloader (HKLM-x32\...\{C52148B9-19E0-433A-9422-3451B1BEE20F}) (Version: 1.6.01.0 - Sony)
Media Go Video Playback Engine 2.20.101.05210 (HKLM-x32\...\{78D0E870-B5F7-8AE8-35DC-18060AAD9C7A}) (Version: 2.20.101.05210 - Sony)
Microsoft .NET Framework 4.6.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.6.01055 - Microsoft Corporation)
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Click-to-Run 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Starter 2010 - English (HKLM-x32\...\{90140011-0066-0409-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office XP Professional with FrontPage (HKLM-x32\...\{90280409-6000-11D3-8CFE-0050048383C9}) (Version: 10.0.6626.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23026 (HKLM-x32\...\{74d0e5db-b326-4dae-a6b2-445b9de1836e}) (Version: 14.0.23026.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Minecraft (HKLM-x32\...\{02BAAFC5-4E16-42E6-A9F6-8DDE0B7ED3B8}) (Version: 1.0.0.0 - Mojang)
Mozilla Firefox 46.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 46.0.1 (x86 en-US)) (Version: 46.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 46.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
NHL® 09 (HKLM-x32\...\{F2B5A2A7-2DF9-4361-8BD5-362714528B51}) (Version: 2.0.1.0 - Electronic Arts)
Online Plug-in (x32 Version: 13.3.0.55 - Citrix Systems, Inc.) Hidden
Paint.NET v3.5.10 (HKLM\...\{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}) (Version: 3.60.0 - dotPDN LLC)
PaperPort Image Printer 64-bit (HKLM\...\{ABA4FAF1-6389-45F9-92CE-3914A4E5C471}) (Version: 1.00.0000 - Nuance Communications, Inc.)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
PlayReady PC Runtime x86 (HKLM-x32\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)
Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.4329 - CyberLink Corp.)
Power2Go (x32 Version: 6.1.4329 - CyberLink Corp.) Hidden
PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 8.0.3129 - CyberLink Corp.)
PowerDirector (x32 Version: 8.0.3129 - CyberLink Corp.) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6196 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 5.5.3219 - CyberLink Corp.) Hidden
ROBLOX Player for Owner (HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\{373B1718-8CC5-4567-8EE2-9033AD08A680}) (Version: - ROBLOX Corporation)
ROBLOX Studio for Owner (HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\{2922D6F1-2865-4EFA-97A9-94EEAB3AFA14}) (Version: - ROBLOX Corporation)
SafeZone Stable 1.51.2220.53 (x32 Version: 1.51.2220.53 - Avast Software) Hidden
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.5.2.13021_10 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.5.2.13021_10 - Samsung Electronics Co., Ltd.) Hidden
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.15072.2 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.15072.2 - Samsung Electronics Co., Ltd.) Hidden
Samsung Story Album Viewer (HKLM-x32\...\InstallShield_{698BBAD8-B116-495D-B879-0F07A533E57F}) (Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.)
Samsung Story Album Viewer (x32 Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.) Hidden
Samsung USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.59.0 - Samsung Electronics Co., Ltd.)
ScanSoft PaperPort 11 (HKLM-x32\...\{02570AE0-BEE0-4A6C-BE3F-D806E9F2EA17}) (Version: 11.2.0000 - Nuance Communications, Inc.)
Self-service Plug-in (x32 Version: 3.3.0.27839 - Citrix Systems, Inc.) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Shareaza (x32 Version: 8.0.0.123534 - Discordia, LTD) Hidden
Smart Technology Programming Software 7.0.27.13 (HKLM\...\{BD90BC1C-115D-47E1-B85C-07AE182C3AB8}) (Version: 7.0.27.13 - Mad Catz)
Sony Mobile Update Engine (HKLM-x32\...\Update Engine) (Version: 2.16.12.201608221014 - Sony Mobile Communications Inc.)
SoulSeek 157 NS 13e (HKLM-x32\...\Soulseek2) (Version: - )
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
SpywareBlaster 5.0 (HKLM-x32\...\SpywareBlaster_is1) (Version: 5.0.0 - BrightFort LLC)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
StudioTax 2011 (HKLM\...\{85FD0263-98BB-4B0E-990C-A31094DE8DDE}) (Version: 7.0.4.0 - BHOK IT Consulting)
StudioTax 2012 (HKLM-x32\...\{FD31CD68-1D2F-4F9C-8ACB-9A7806D53D3B}) (Version: 8.0.5.2 - BHOK IT Consulting)
StudioTax 2013 (HKLM-x32\...\{3F525B18-4DA5-447A-97E5-8F00EA9DF4B1}) (Version: 9.1.8.2 - BHOK IT Consulting)
StudioTax 2014 (HKLM-x32\...\{F4A42DCD-CE34-4D3F-B328-BDC81CF50737}) (Version: 10.0.7.0 - BHOK IT Consulting)
StudioTax 2015 (HKLM-x32\...\{D4ED4657-36AF-443C-8274-AEA66D8A6317}) (Version: 11.0.8.6 - BHOK IT Consulting)
SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 5.7.1026 - SUPERAntiSpyware.com)
System Scheduler 4.23 (HKLM-x32\...\Windows Scheduler_is1) (Version: - Splinterware Software Solutions)
Thrustmaster TARGET (HKLM-x32\...\{8036A569-CA02-4D33-A7E9-E9BC8A482E91}) (Version: 2.0.10.0 - Thrustmaster)
Toy Story 3 (HKLM-x32\...\{AAFD160A-2333-40D8-AA25-42D1989CA0F2}) (Version: 1.00.0000 - Disney Interactive Studios)
Tweaking.com - Registry Backup (HKLM-x32\...\Tweaking.com - Registry Backup) (Version: 3.4.1 - Tweaking.com)
Use the entry named LeapFrog Connect to uninstall (LeapFrog Tag Plugin) (HKLM-x32\...\TagPlugin) (Version: 7.0.6.19846 - LeapFrog)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.1 - VideoLAN)
Vuze (HKLM-x32\...\8461-7759-5462-8226) (Version: 5.6.2.0 - Azureus Software, Inc.)
War Thunder CDK 0.1 (HKLM-x32\...\{ed8deea4-29fe-1932-9612-e2122d8a62d9}}_is1) (Version: - Gaijin Entertainment)
War Thunder Launcher 1.0.1.278 (HKLM-x32\...\{ed8deea4-29fa-3932-9612-e2122d8a62d9}}_is1) (Version: - 2013 Gaijin Entertainment Corporation)
War Thunder Launcher 1.0.1.340 (HKLM-x32\...\{abc8eea4-29fa-3932-9612-e2122d8a62d9}}_is1) (Version: - Gaijin Entertainment)
WeatherEye (HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\WeatherEye) (Version: - )
Windows Driver Package - LeapFrog (FlyUsb) USB (11/05/2008 1.1.1.0) (HKLM\...\781745E87AFF80C0C1388CFF79D19ECAB2E9BB47) (Version: 11/05/2008 1.1.1.0 - LeapFrog)
Windows Driver Package - Leapfrog (Leapfrog-USBLAN) Net (09/10/2009 02.03.05.012) (HKLM\...\8F14F2ECEDE68D26EA515B48DC25B39103C4FE8D) (Version: 09/10/2009 02.03.05.012 - Leapfrog)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
WinRAR 5.11 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH)
WinRAR 5.11 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH)
Xperia Companion (HKLM-x32\...\{8f4f39fa-087f-4e5c-84f3-1433ac7389e9}) (Version: 1.2.8.0 - Sony)
Xperia Companion (x32 Version: 1.2.8.0 - Sony) Hidden
yuPlay client 0.7.50 (HKLM-x32\...\yuPlay клиент_is1) (Version: - )
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {037E3E9F-FF34-40FB-BFD2-25CC5B2EFA9C} - System32\Tasks\SafeZone scheduled Autoupdate 1465907730 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2016-08-09] (Avast Software)
Task: {0FE7318E-4885-42C4-93E3-FB734E63E4E0} - System32\Tasks\HPCeeScheduleForOWNER-HP$ => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13] (Hewlett-Packard)
Task: {11D2342F-839E-48E3-9AD7-A5763372DFCE} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {1229D5C6-2C31-45A5-A77F-872758277322} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
Task: {16E260E2-3C55-4817-B513-96F247AF4450} - System32\Tasks\{DC3699EB-8B75-4644-AAEF-06F2728982ED} => pcalua.exe -a "C:\Users\Owner\Documents\Lillian\Nick's Stuff\Saitek_Cyborg_Evo_SD6_32.exe" -d "C:\Users\Owner\Documents\Lillian\Nick's Stuff"
Task: {1C0D8719-CA60-4A76-A976-EC85FC47EAC5} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
Task: {2EF2F4D7-6FAB-489C-BB4D-D22154387F11} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-09-13] (Adobe Systems Incorporated)
Task: {3D812D1B-A978-4A78-BF49-361B915FC140} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2016-06-03] (AVAST Software)
Task: {5518C77C-1BE8-4B27-975B-F7C8675C0729} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {64BF764D-B178-4D83-9A47-9CC348E19F17} - System32\Tasks\HPCeeScheduleForOwner => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13] (Hewlett-Packard)
Task: {8922745A-B80F-4AD0-A5A3-71E78518093B} - System32\Tasks\{7F85E32C-7D35-4958-B03F-BBAEF0CBC775} => pcalua.exe -a "C:\Users\Owner\Documents\Lillian\Nick's Stuff\Saitek_Cyborg_Evo_SD6_64.exe" -d "C:\Users\Owner\Documents\Lillian\Nick's Stuff"
Task: {8A2B4C85-7287-4463-9AE1-B5439A79026F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-06-21] (Hewlett-Packard Company)
Task: {9C9157B1-4249-47A0-BCE7-7E76C8CE1510} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPSFMessenger\HPSFMsgr.exe [2011-06-21] (Hewlett-Packard Company)
Task: {A2046887-4841-44D4-8FE6-9E6E7CCE795A} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater\HPSFUpdater.exe [2011-06-14] (Hewlett-Packard)
Task: {A449C73B-4565-4F8F-943C-0C5CFEFBC971} - System32\Tasks\{787706EA-A8A6-446E-BDFD-AC04640298DC} => pcalua.exe -a "C:\Program Files (x86)\Registry Helper\uninst.exe"
Task: {B819D107-2890-46A6-923E-872F90D94F20} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-08-27] (Apple Inc.)
Task: {BCCAF77B-676F-4503-9124-452B84F74C89} - System32\Tasks\{8C85E8B1-A460-4EED-8DAC-C757387E1D2D} => pcalua.exe -a E:\SETUP.EXE -d E:\ -c -AutoRun
Task: {C258BB7D-E898-4D19-9E91-E318E67FBCD0} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
Task: {CC86B01E-CE0A-4E21-A91A-759BB6BA026B} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-06-21] (Hewlett-Packard Company)
Task: {F1FF4C19-ED0D-4035-B119-4E2F39823BB4} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-09-08] (Adobe Systems Incorporated)
Task: {F6762DFA-B52E-47A6-A4A7-4E4C8E8B540E} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2016-08-29] (AVAST Software)
Task: {FC0A2883-58B4-4B24-8468-2652A26F0B2E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Total Care Tune-Up => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPTuneUp.exe [2011-03-22] (Hewlett-Packard Company)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForOWNER-HP$.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
Task: C:\Windows\Tasks\HPCeeScheduleForOwner.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
Shortcut: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Network Shortcuts\My Web Sites on MSN\target.lnk -> hxxp://www.msnusers.com
==================== Loaded Modules (Whitelisted) ==============
2015-02-13 04:20 - 2015-02-13 04:20 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-10-13 05:45 - 2015-10-13 05:45 - 01328912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-20 15:23 - 2010-10-20 15:23 - 08801632 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2009-06-08 17:45 - 2009-06-08 17:45 - 00098304 ____R () c:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2011-03-14 16:10 - 2011-03-14 16:10 - 00270336 _____ () C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2016-08-29 12:58 - 2016-08-29 12:58 - 00169064 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2016-09-18 06:20 - 2016-09-18 06:20 - 03086136 _____ () C:\Program Files\AVAST Software\Avast\defs\16091800\algo.dll
2016-08-29 12:58 - 2016-08-29 12:58 - 00482928 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2015-05-14 13:02 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-05-14 13:02 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-05-14 13:02 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-05-14 13:02 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2015-05-14 13:02 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2016-08-20 19:58 - 2016-08-08 17:27 - 00785920 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2016-08-20 19:58 - 2015-07-01 16:06 - 04962816 _____ () C:\Program Files (x86)\Steam\v8.dll
2016-08-20 19:58 - 2015-07-01 16:06 - 01556992 _____ () C:\Program Files (x86)\Steam\icui18n.dll
2016-08-20 19:58 - 2015-07-01 16:06 - 01187840 _____ () C:\Program Files (x86)\Steam\icuuc.dll
2016-08-20 19:58 - 2016-08-23 13:33 - 02321184 _____ () C:\Program Files (x86)\Steam\video.dll
2016-08-20 19:58 - 2016-01-27 01:49 - 02549760 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll
2016-08-20 19:58 - 2016-01-27 01:49 - 00442880 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll
2016-08-20 19:58 - 2016-01-27 01:49 - 00491008 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll
2016-08-20 19:58 - 2016-01-27 01:49 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll
2016-08-20 19:58 - 2016-01-27 01:49 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll
2016-08-20 19:58 - 2016-08-23 13:33 - 00835360 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2016-08-20 19:58 - 2016-07-04 16:17 - 00266560 _____ () C:\Program Files (x86)\Steam\openvr_api.dll
2016-06-29 16:11 - 2016-06-29 16:11 - 48936448 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2016-08-20 19:58 - 2016-08-04 14:56 - 49825056 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll
2016-09-13 10:22 - 2016-09-13 10:22 - 19588800 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_23_0_0_162.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\ProgramData\Temp:5C321E34 [119]
AlternateDataStreams: C:\Users\Owner\Downloads:Shareaza.GUID [16]
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\008k.com -> 008k.com
IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\00hq.com -> 00hq.com
IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\0190-dialers.com -> 0190-dialers.com
IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\01i.info -> 01i.info
IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com
IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\0411dd.com -> 0411dd.com
IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\0511zfhl.com -> 0511zfhl.com
IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\05p.com -> 05p.com
IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\0632qyw.com -> 0632qyw.com
IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com
IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com
IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com
IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\0calories.net -> 0calories.net
IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\0cj.net -> 0cj.net
IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\0scan.com -> 0scan.com
IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\1-britney-spears-nude.com -> 1-britney-spears-nude.com
IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\1-domains-registrations.com -> 1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\1-se.com -> 1-se.com
IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\1001movie.com -> 1001movie.com
There are 6091 more sites.
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-13 20:34 - 2016-06-30 19:45 - 00000035 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-179166284-1700762968-3849658672-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 64.59.135.148 - 64.59.128.114
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\startupreg: Akamai NetSession Interface => "C:\Users\Owner\AppData\Local\Akamai\netsession_win.exe"
MSCONFIG\startupreg: ApplePhotoStreams => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: BrStsMon00 => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe /AUTORUN
MSCONFIG\startupreg: CitrixReceiver => "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citrix\Receiver Updater.lnk"
MSCONFIG\startupreg: ConnectionCenter => "C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" /startup
MSCONFIG\startupreg: ControlCenter3 => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe /autorun
MSCONFIG\startupreg: Dropbox => "C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" /systemstartup
MSCONFIG\startupreg: GoogleDriveSync => "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart
MSCONFIG\startupreg: iCloudDrive => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe
MSCONFIG\startupreg: iCloudServices => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
MSCONFIG\startupreg: IndexSearch => "C:\Program Files (x86)\ScanSoft\PaperPort\IndexSearch.exe"
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: KiesPDLR.exe => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe Run
MSCONFIG\startupreg: KiesPreload => C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload
MSCONFIG\startupreg: KiesTrayAgent => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
MSCONFIG\startupreg: Monitor => "C:\Program Files (x86)\LeapFrog\LeapFrog Connect\Monitor.exe"
MSCONFIG\startupreg: Norton Online Backup => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
MSCONFIG\startupreg: PaperPort PTD => "C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe"
MSCONFIG\startupreg: PPort11reminder => "C:\Program Files (x86)\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini"
MSCONFIG\startupreg: ProfilerU => C:\Program Files\SmartTechnology\Software\ProfilerU.exe
MSCONFIG\startupreg: SaiMfd => C:\Program Files\SmartTechnology\Software\SaiMfd.exe
MSCONFIG\startupreg: SDTray => "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
MSCONFIG\startupreg: SpybotSD TeaTimer => C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
MSCONFIG\startupreg: SSBkgdUpdate => "C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
MSCONFIG\startupreg: SUPERAntiSpyware => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
MSCONFIG\startupreg: XperiaCompanionAgent => "C:\Program Files (x86)\Sony\Xperia Companion\XperiaCompanionAgent.exe"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{16467055-0A06-4B08-B61F-9DE42788DAD8}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDirector\PDR8.EXE
FirewallRules: [{2EBA5488-FA5F-4FFE-9810-A60F1B44FD7D}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{FCF8FCE5-E6D2-4F9F-B47E-1532B3F3FFB9}] => (Allow) LPort=2869
FirewallRules: [{24263477-6EF3-402F-AE43-F9CD8CB45D85}] => (Allow) LPort=1900
FirewallRules: [{B9C9DF76-EF62-47DF-8DFB-5A6DE0DE80ED}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{13EB4188-C29B-40D3-8F11-46D708CB7236}] => (Allow) C:\Program Files (x86)\uTorrent\uTorrent.exe
FirewallRules: [{E7146E26-B002-435D-8D24-195587E8ED9F}] => (Allow) C:\Program Files (x86)\uTorrent\uTorrent.exe
FirewallRules: [TCP Query User{01EDB30A-24ED-4B0E-800E-7055527A3B20}C:\program files (x86)\java\jre6\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre6\bin\javaw.exe
FirewallRules: [UDP Query User{EFC2BCB0-E996-4868-9EFE-3254FCD32F5C}C:\program files (x86)\java\jre6\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre6\bin\javaw.exe
FirewallRules: [{11C8BEDA-8ABC-4F90-AE1A-511AE0F55291}] => (Allow) C:\Program Files (x86)\WinMX Music\WinMX Music.exe
FirewallRules: [{C448FDCC-80E1-4057-ABE0-710B5FA1343D}] => (Allow) C:\Program Files (x86)\WinMX Music\WinMX Music.exe
FirewallRules: [{40911C0D-BD8E-4F56-8828-B215A7B9179A}] => (Allow) C:\Program Files (x86)\WinMX Music\WinMX Music.exe
FirewallRules: [{C548D574-4C9A-4522-B803-186915733595}] => (Allow) C:\Program Files (x86)\WinMX Music\WinMX Music.exe
FirewallRules: [{7122594F-D635-4D46-AA08-2165ED451E67}] => (Allow) C:\Program Files (x86)\Ares Galaxy Professional\Ares Galaxy Professional.exe
FirewallRules: [{174F363F-F7C0-4F07-922F-84A5A6A691D7}] => (Allow) C:\Program Files (x86)\Ares Galaxy Professional\Ares Galaxy Professional.exe
FirewallRules: [TCP Query User{CC88F561-E8A6-4FD1-82FA-10E7F359F88B}C:\program files (x86)\luckywire\luckywire.exe] => (Allow) C:\program files (x86)\luckywire\luckywire.exe
FirewallRules: [UDP Query User{DD2FAD5B-3F81-4772-92C8-B3F9CE4DE016}C:\program files (x86)\luckywire\luckywire.exe] => (Allow) C:\program files (x86)\luckywire\luckywire.exe
FirewallRules: [TCP Query User{D5E10871-07D1-48E8-ABF8-801957270CE4}C:\program files (x86)\soulseekns\slsk.exe] => (Allow) C:\program files (x86)\soulseekns\slsk.exe
FirewallRules: [UDP Query User{543BF0B9-50DE-4A51-ADAF-42127F5D2E1C}C:\program files (x86)\soulseekns\slsk.exe] => (Allow) C:\program files (x86)\soulseekns\slsk.exe
FirewallRules: [{2DD217DC-2AFA-4D68-B2CF-ADA1F2364264}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{743E506E-3E3F-4827-8076-9AA0040C5414}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{CAFD9837-95E4-469D-A7E8-06ABA46063DE}] => (Allow) C:\Program Files (x86)\Ubisoft\Tom Clancy's H.A.W.X\HAWX.exe
FirewallRules: [{0FAEB502-E14D-4939-A6A8-244D5350F547}] => (Allow) C:\Program Files (x86)\Ubisoft\Tom Clancy's H.A.W.X\HAWX.exe
FirewallRules: [{673ECEFF-6EFD-4A09-998B-9888503B1492}] => (Allow) C:\Program Files (x86)\Ubisoft\Tom Clancy's H.A.W.X\HAWX_dx10.exe
FirewallRules: [{CFE403B5-C691-4DAE-BF52-12F340194F64}] => (Allow) C:\Program Files (x86)\Ubisoft\Tom Clancy's H.A.W.X\HAWX_dx10.exe
FirewallRules: [{1E9B59DF-C948-4266-945C-5AE93937C9EE}] => (Allow) C:\Users\Owner\AppData\Local\Akamai\netsession_win.exe
FirewallRules: [{0203E568-A224-47A6-89F8-112F71BCB211}] => (Allow) C:\Users\Owner\AppData\Local\Akamai\netsession_win.exe
FirewallRules: [TCP Query User{EA856CC0-C507-4E96-9579-0B129CD6273E}C:\users\owner\documents\vuze downloads\heroes over europe\heroes over europe\heroes2.exe] => (Block) C:\users\owner\documents\vuze downloads\heroes over europe\heroes over europe\heroes2.exe
FirewallRules: [UDP Query User{60DAFC93-C5F2-47EE-8694-E2A7C74D374F}C:\users\owner\documents\vuze downloads\heroes over europe\heroes over europe\heroes2.exe] => (Block) C:\users\owner\documents\vuze downloads\heroes over europe\heroes over europe\heroes2.exe
FirewallRules: [{3BC2ED6C-1E1B-4B88-842C-AF7EDF3BA584}] => (Allow) C:\Program Files (x86)\Vuze\Azureus.exe
FirewallRules: [{32595600-4DD5-464A-A818-DFD17D2C8EAE}] => (Allow) C:\Program Files (x86)\Vuze\Azureus.exe
FirewallRules: [TCP Query User{77D4987A-AC25-428B-9ACB-1CBF920AD48E}C:\users\owner\appdata\local\akamai\netsession_win.exe] => (Block) C:\users\owner\appdata\local\akamai\netsession_win.exe
FirewallRules: [UDP Query User{3511D6F4-DBE3-464F-94E6-A0F3E56238FC}C:\users\owner\appdata\local\akamai\netsession_win.exe] => (Block) C:\users\owner\appdata\local\akamai\netsession_win.exe
FirewallRules: [TCP Query User{8D75B86D-1E4D-4D6B-B334-E3D3763E2B42}C:\program files (x86)\soulseekns\slsk.exe] => (Allow) C:\program files (x86)\soulseekns\slsk.exe
FirewallRules: [UDP Query User{2B620B09-DBA9-490C-ACAE-A16901A87CE4}C:\program files (x86)\soulseekns\slsk.exe] => (Allow) C:\program files (x86)\soulseekns\slsk.exe
FirewallRules: [{97B68B06-CAB6-44EF-A0D7-407195AAABAA}] => (Allow) C:\Program Files (x86)\Shareaza Applications\Shareaza\Shareaza.exe
FirewallRules: [{5672826E-EA20-47EA-A572-77EF2511987D}] => (Allow) C:\Program Files (x86)\Shareaza Applications\Shareaza\Shareaza.exe
FirewallRules: [{BEEC241A-BA90-4150-B594-576DD5CBB529}] => (Allow) C:\Program Files (x86)\Shareaza Applications\Shareaza\Shareaza.exe
FirewallRules: [{631A0E21-89D0-4057-A2E6-D6688596BBCB}] => (Allow) C:\Program Files (x86)\Shareaza Applications\Shareaza\Shareaza.exe
FirewallRules: [TCP Query User{71B9E913-DB94-46FE-8C11-6C5832797F75}C:\program files (x86)\luckywire\luckywire.exe] => (Allow) C:\program files (x86)\luckywire\luckywire.exe
FirewallRules: [UDP Query User{3FE532E0-2092-40B0-8EF3-514E06282FE3}C:\program files (x86)\luckywire\luckywire.exe] => (Allow) C:\program files (x86)\luckywire\luckywire.exe
FirewallRules: [TCP Query User{2007745D-6D9E-47E1-87C9-19DBEC9C972B}C:\users\owner\documents\vuze downloads\heroes over europe\heroes over europe\heroes2.exe] => (Block) C:\users\owner\documents\vuze downloads\heroes over europe\heroes over europe\heroes2.exe
FirewallRules: [UDP Query User{D71A3971-F5B8-4772-8D1D-5C8A37FD7FD7}C:\users\owner\documents\vuze downloads\heroes over europe\heroes over europe\heroes2.exe] => (Block) C:\users\owner\documents\vuze downloads\heroes over europe\heroes over europe\heroes2.exe
FirewallRules: [{3D1CE419-E3EE-4904-AF6A-ED10B7B63C5C}] => (Allow) C:\Program Files (x86)\FrostWire 5\FrostWire.exe
FirewallRules: [{38C9EE8C-B8C9-4D74-99D5-E4EEE31C9101}] => (Allow) C:\Program Files (x86)\FrostWire 5\FrostWire.exe
FirewallRules: [TCP Query User{515F347E-6B10-4FD3-B850-896F296377C4}C:\games\world_of_warplanes\worldofwarplanes.exe] => (Allow) C:\games\world_of_warplanes\worldofwarplanes.exe
FirewallRules: [UDP Query User{6EF7121F-2748-44DE-9934-09E9807783DF}C:\games\world_of_warplanes\worldofwarplanes.exe] => (Allow) C:\games\world_of_warplanes\worldofwarplanes.exe
FirewallRules: [{977796B3-1E02-45FE-B689-E0B474524668}] => (Allow) C:\Program Files (x86)\WarThunder\launcher.exe
FirewallRules: [{1A13A48E-5475-45B1-AC30-C2F323181F53}] => (Allow) C:\Program Files (x86)\WarThunder\launcher.exe
FirewallRules: [TCP Query User{5D2F1BFF-EFCA-4E39-8DC1-AC7FC6C8E549}C:\program files (x86)\warthunder\aces.exe] => (Block) C:\program files (x86)\warthunder\aces.exe
FirewallRules: [UDP Query User{A5ED236A-1D30-45B6-A387-9C7C8EC401DF}C:\program files (x86)\warthunder\aces.exe] => (Block) C:\program files (x86)\warthunder\aces.exe
FirewallRules: [TCP Query User{7BD76936-67B7-4D1C-A661-593CBC604C5E}C:\program files\shareaza\shareaza.exe] => (Allow) C:\program files\shareaza\shareaza.exe
FirewallRules: [UDP Query User{85081895-C77F-4E5F-8E89-A1561CB1F813}C:\program files\shareaza\shareaza.exe] => (Allow) C:\program files\shareaza\shareaza.exe
FirewallRules: [TCP Query User{AF5782F4-29C7-4328-82E4-9B169F800C61}C:\users\owner\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe] => (Block) C:\users\owner\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe
FirewallRules: [UDP Query User{DD128279-0910-48E0-9D6F-3530F804A54C}C:\users\owner\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe] => (Block) C:\users\owner\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe
FirewallRules: [{4A00BE5E-C4BB-406A-9C1C-111E498D2754}] => (Allow) C:\Program Files (x86)\WarThunderDev\launcher.exe
FirewallRules: [{74FD960D-0204-4EC6-9405-C928CDB27F6C}] => (Allow) C:\Program Files (x86)\WarThunderDev\launcher.exe
FirewallRules: [{5D3B0F77-681B-4BF6-973F-C855F16B443E}] => (Allow) C:\Program Files\KMSpico\KMSELDI.exe
FirewallRules: [{12AA15F5-BB5F-49CC-A3F0-7F131D82B4E5}] => (Allow) C:\Program Files\KMSpico\KMSELDI.exe
FirewallRules: [{05E88CCD-91BB-459B-91A2-8575DAB3D889}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{A0208C98-7633-4F97-9701-5138D1F50098}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{0543AA67-EFEF-48CB-A54A-E55248412302}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [{8D8977CB-FD86-48F0-B70D-630C93B72306}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
FirewallRules: [TCP Query User{6A4611D8-38C5-46C8-9677-D1F5EBB63634}C:\program files (x86)\warthunder\launcher.exe] => (Block) C:\program files (x86)\warthunder\launcher.exe
FirewallRules: [UDP Query User{D635811C-907C-4BA5-9BB7-A03D4B92C769}C:\program files (x86)\warthunder\launcher.exe] => (Block) C:\program files (x86)\warthunder\launcher.exe
FirewallRules: [TCP Query User{B0E16C88-EB41-40D8-9D3A-CB7A89C101E0}C:\program files (x86)\warthunder\aces.exe] => (Block) C:\program files (x86)\warthunder\aces.exe
FirewallRules: [UDP Query User{AE9A77FE-DE46-48D8-ACB6-966C08183A55}C:\program files (x86)\warthunder\aces.exe] => (Block) C:\program files (x86)\warthunder\aces.exe
FirewallRules: [TCP Query User{E38558DB-7354-4C79-8329-00D620FFA8F0}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre7\bin\javaw.exe
FirewallRules: [UDP Query User{58534CE6-32B2-4188-94B4-9694300709A7}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre7\bin\javaw.exe
FirewallRules: [{4CD324AF-862E-4619-8325-B26102F003FB}] => (Allow) C:\Users\Owner\AppData\Local\Temp\7zS6E55\HPDiagnosticCoreUI.exe
FirewallRules: [{CA65A48D-1C4E-4C60-8B60-5971AE48A3D7}] => (Allow) C:\Users\Owner\AppData\Local\Temp\7zS6E55\HPDiagnosticCoreUI.exe
FirewallRules: [TCP Query User{07FA16CF-8E53-46D0-8EF4-98F43854C6C3}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [UDP Query User{AC95E5A8-C4A2-40B8-B8FC-67652C4B46F0}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [TCP Query User{2D80C42C-041C-4225-B704-A2249D61814C}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Block) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [UDP Query User{07898DC9-9BC5-47AF-B6CC-C27D7C79420F}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Block) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [{60ABEBFC-BBD4-4A43-827E-463B00E4379D}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{C8DCF127-A930-44D0-854F-F4F36033C251}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{D45E0402-3769-444F-AD1E-B5FDC7D0D918}] => (Allow) E:\install\data\Disk1\setup.exe
FirewallRules: [{17ABD4EB-72AB-4552-A7E1-738AA045AA2A}] => (Allow) E:\install\data\Disk1\setup.exe
FirewallRules: [TCP Query User{A36C05D2-0977-453F-A653-AB2BCDD9D688}C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe
FirewallRules: [UDP Query User{6B5E252F-F1FA-4E6B-AF7A-0C0DE4BB37B1}C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe
FirewallRules: [TCP Query User{F1F0FA83-9FB5-4003-BAF1-54734BDE87A3}C:\games\world_of_tanks\wotlauncher.exe] => (Allow) C:\games\world_of_tanks\wotlauncher.exe
FirewallRules: [UDP Query User{045B515A-278C-41F9-99DF-E9D541FDAE7F}C:\games\world_of_tanks\wotlauncher.exe] => (Allow) C:\games\world_of_tanks\wotlauncher.exe
FirewallRules: [TCP Query User{4034B617-6B8D-4015-A932-8EB2E7B1BB19}C:\games\world_of_tanks\worldoftanks.exe] => (Allow) C:\games\world_of_tanks\worldoftanks.exe
FirewallRules: [UDP Query User{2D4BE10F-8FBB-4B4E-AEA7-9DA052168303}C:\games\world_of_tanks\worldoftanks.exe] => (Allow) C:\games\world_of_tanks\worldoftanks.exe
FirewallRules: [{9366515B-744A-488A-8DF6-DBA9E7CCC573}] => (Allow) LPort=1689
FirewallRules: [{BB916D80-4841-43B3-AB07-D1293D5F0B82}] => (Allow) C:\Program Files (x86)\Vuze\Azureus.exe
FirewallRules: [{EB2D3A8E-B730-4F88-AF3C-12D8E3082F96}] => (Allow) C:\Program Files (x86)\Vuze\Azureus.exe
FirewallRules: [{B880294E-D4BD-42BA-9DA5-2277E86966DC}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{301CDF90-CE68-473F-9BEF-E38DB843B7B6}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{48A21795-96F2-494A-901D-1D10223D04F6}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{DC590E6A-69AD-48B6-B836-06D68987EAE0}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{53C8BFB3-44B9-460F-A1A4-4B56DAAD797B}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{BA2135F6-3391-46EC-AF57-CD1565039942}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{E4006AF8-6EBB-4E93-9137-DAF3C2616420}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{20A8A227-51F6-41BD-BDB6-FAB90B83EC6D}C:\program files (x86)\sony\media go\mediago.exe] => (Block) C:\program files (x86)\sony\media go\mediago.exe
FirewallRules: [UDP Query User{E8CB7A32-53DA-4735-B88A-4F925B5CBD75}C:\program files (x86)\sony\media go\mediago.exe] => (Block) C:\program files (x86)\sony\media go\mediago.exe
FirewallRules: [{765C2B3C-2F60-48B9-8734-F350C2FF2DB0}] => (Allow) LPort=1688
FirewallRules: [{2300150D-3AA1-428A-8458-A27DFB895C59}] => (Allow) C:\Program Files (x86)\Gaijin\Wings of Prey\launcher.exe
FirewallRules: [{52BA9802-9554-4905-896A-BF7B4629D395}] => (Allow) C:\Program Files (x86)\Gaijin\Wings of Prey\launcher.exe
FirewallRules: [{8B176D70-5855-4EB9-9D94-6632FA4B9370}] => (Allow) C:\Program Files (x86)\Gaijin\Wings of Prey\acess.exe
FirewallRules: [{36776038-946C-4A26-AAEF-BF4BD4A97249}] => (Allow) C:\Program Files (x86)\Gaijin\Wings of Prey\acess.exe
FirewallRules: [TCP Query User{9F5BE4E0-ABE0-4A29-A254-341B6D8C2FEF}C:\program files (x86)\warthunder\win32\aces.exe] => (Allow) C:\program files (x86)\warthunder\win32\aces.exe
FirewallRules: [UDP Query User{F2114CC7-7210-4349-BC0E-8C975A3654DB}C:\program files (x86)\warthunder\win32\aces.exe] => (Allow) C:\program files (x86)\warthunder\win32\aces.exe
FirewallRules: [{FE7C76B9-6C16-45EC-B92D-766FD70BD4BB}] => (Allow) C:\Program Files (x86)\LeapFrog\LeapFrog Connect\LeapfrogConnect.exe
FirewallRules: [TCP Query User{BBB32AA5-54DC-4A3F-B0EE-885D285D6A11}C:\program files (x86)\java\jre1.8.0_91\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre1.8.0_91\bin\javaw.exe
FirewallRules: [UDP Query User{1F5A1764-5A00-48B1-9EB8-C8755FED0CA7}C:\program files (x86)\java\jre1.8.0_91\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre1.8.0_91\bin\javaw.exe
FirewallRules: [{32C003BE-F3EA-4D2D-BA0B-3911994E6608}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{90EF858C-4CCC-4B3F-BE72-C7A488248DA8}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{F3927768-1095-4994-9B65-9D3CF6F936C7}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{A2ABEE39-62DB-4A5E-8F2E-C6DAA3CE4E52}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{524E4D3D-3875-44C3-816B-31D2714C344B}] => (Allow) C:\Program Files (x86)\Sony\Xperia Companion\XperiaCompanion.exe
FirewallRules: [{92695654-98EE-4694-B775-D22240802ECD}] => (Allow) C:\Program Files (x86)\Sony Mobile\Update Engine\Sony Mobile Update Engine.exe
FirewallRules: [{97CADA1B-294D-45FF-889E-C08A4BC3A150}] => (Allow) C:\Program Files (x86)\Sony Mobile\Update Engine\Sony Mobile Update Engine.exe
FirewallRules: [{8AC136A1-6E7C-4F76-AE3F-D51889D844BC}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service
==================== Restore Points =========================
02-09-2016 07:33:57 HPSF Restore Point
04-09-2016 19:00:09 Windows Backup
06-09-2016 09:50:53 Xperia Companion
08-09-2016 09:08:25 Xperia Companion
10-09-2016 16:22:05 Installed Sony Mobile Drivers
11-09-2016 19:00:18 Windows Backup
12-09-2016 09:58:04 Xperia Companion
==================== Faulty Device Manager Devices =============
Name: Programmable Root Enumerator
Description: Programming Support
Class Guid: {678dcf40-e2e6-11d5-8cd5-e960089ea00a}
Manufacturer: Mad Catz
Service: SaiNtBus
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver
==================== Event log errors: =========================
Application errors:
==================
Error: (09/17/2016 11:04:43 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: XperiaCompanion.exe, version: 1.2.8.0, time stamp: 0x5746f2da
Faulting module name: XperiaCompanion.exe, version: 1.2.8.0, time stamp: 0x5746f2da
Exception code: 0xc0000005
Fault offset: 0x001d50f1
Faulting process id: 0xbb8
Faulting application start time: 0x01d211057418d6f4
Faulting application path: C:\Program Files (x86)\Sony\Xperia Companion\XperiaCompanion.exe
Faulting module path: C:\Program Files (x86)\Sony\Xperia Companion\XperiaCompanion.exe
Report Id: d39e966b-7cf8-11e6-85e7-6431503ceaa3
Error: (09/12/2016 12:17:45 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program Explorer.EXE version 6.1.7601.23418 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
Process ID: 5a0
Start Time: 01d20d1922061310
Termination Time: 499
Application Path: C:\Windows\Explorer.EXE
Report Id: 30e7f891-7915-11e6-a04f-6431503ceaa3
Error: (09/11/2016 11:38:10 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program explorer.exe version 6.1.7601.23418 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
Process ID: 1938
Start Time: 01d20c5301f1abd3
Termination Time: 61
Application Path: C:\Windows\explorer.exe
Report Id: 7fd35f4b-7846-11e6-9471-6431503ceaa3
Error: (09/11/2016 11:36:19 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program Explorer.EXE version 6.1.7601.23418 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
Process ID: 5c0
Start Time: 01d20c2cb299045c
Termination Time: 52
Application Path: C:\Windows\Explorer.EXE
Report Id: 3ce50f98-7846-11e6-9471-6431503ceaa3
Error: (09/06/2016 08:18:09 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program Explorer.EXE version 6.1.7601.23418 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
Process ID: 5a4
Start Time: 01d208ad696954c4
Termination Time: 31
Application Path: C:\Windows\Explorer.EXE
Report Id: 3cd1356b-74a1-11e6-8d84-6431503ceaa3
Error: (09/06/2016 09:29:24 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program Explorer.EXE version 6.1.7601.23418 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
Process ID: 5c4
Start Time: 01d208381443fd76
Termination Time: 1186
Application Path: C:\Windows\Explorer.EXE
Report Id: ac5b82f9-7446-11e6-b766-6431503ceaa3
Error: (08/28/2016 07:56:44 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: vlc.exe, version: 2.2.1.0, time stamp: 0x00000004
Faulting module name: libqt4_plugin.dll, version: 2.2.1.0, time stamp: 0x00020002
Exception code: 0x40000015
Fault offset: 0x007ca10a
Faulting process id: 0x1b18
Faulting application start time: 0x01d201988052abce
Faulting application path: C:\Program Files (x86)\VideoLAN\VLC\vlc.exe
Faulting module path: C:\Program Files (x86)\VideoLAN\VLC\plugins\gui\libqt4_plugin.dll
Report Id: d5768bbd-6d8b-11e6-ac50-6431503ceaa3
Error: (08/01/2016 07:53:01 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program javaw.exe version 8.0.910.15 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
Process ID: 12b0
Start Time: 01d1ec4070ae8b7d
Termination Time: 16
Application Path: C:\Program Files (x86)\Java\jre1.8.0_91\bin\javaw.exe
Report Id:
Error: (08/01/2016 07:22:15 AM) (Source: SsfService) (EventID: 0) (User: )
Description: Service cannot be started. The service process could not connect to the service controller
Error: (07/29/2016 01:36:24 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program javaw.exe version 8.0.910.15 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
Process ID: 188c
Start Time: 01d1e9cf3eb3d9ff
Termination Time: 78
Application Path: C:\Program Files (x86)\Java\jre1.8.0_91\bin\javaw.exe
Report Id: b01d17d1-55c3-11e6-b21a-6431503ceaa3
System errors:
=============
Error: (09/18/2016 06:23:09 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the LanmanServer service.
Error: (09/18/2016 06:20:24 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Service KMSELDI service failed to start due to the following error:
The system cannot find the file specified.
Error: (09/17/2016 12:27:35 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Service KMSELDI service failed to start due to the following error:
The system cannot find the file specified.
Error: (09/17/2016 07:23:49 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: The server {D085A4AB-CAB1-4729-9DF8-FCEEDDBD19E4} did not register with DCOM within the required timeout.
Error: (09/17/2016 07:14:20 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Service KMSELDI service failed to start due to the following error:
The system cannot find the file specified.
Error: (09/17/2016 07:14:12 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Spybot-S&D 2 Scanner Service service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.
Error: (09/17/2016 07:14:12 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Spybot-S&D 2 Scanner Service service to connect.
Error: (09/17/2016 07:13:26 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The HP Support Solutions Framework Service service failed to start due to the following error:
The service did not respond to the start or control request in a timely fashion.
Error: (09/17/2016 07:13:26 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the HP Support Solutions Framework Service service to connect.
Error: (09/16/2016 09:31:32 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: The server {D085A4AB-CAB1-4729-9DF8-FCEEDDBD19E4} did not register with DCOM within the required timeout.
CodeIntegrity:
===================================
Date: 2016-08-29 08:40:46.693
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\aswKbd.sys because the set of per-page image hashes could not be found on the system.
Date: 2016-08-29 08:40:46.225
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.
Date: 2016-08-28 07:47:43.566
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\aswKbd.sys because the set of per-page image hashes could not be found on the system.
Date: 2016-08-28 07:47:43.067
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.
Date: 2016-08-27 05:52:04.050
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\aswKbd.sys because the set of per-page image hashes could not be found on the system.
Date: 2016-08-27 05:52:03.847
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.
Date: 2016-08-26 07:01:36.860
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\aswKbd.sys because the set of per-page image hashes could not be found on the system.
Date: 2016-08-26 07:01:36.111
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.
Date: 2016-08-25 07:01:43.287
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\aswKbd.sys because the set of per-page image hashes could not be found on the system.
Date: 2016-08-25 07:01:42.663
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.
==================== Memory info ===========================
Processor: AMD Athlon(tm) II X2 245 Processor
Percentage of memory in use: 72%
Total physical RAM: 2815.29 MB
Available physical RAM: 787.13 MB
Total Virtual: 5628.75 MB
Available Virtual: 2868.68 MB
==================== Drives ================================
Drive c: (OS) (Fixed) (Total:686.49 GB) (Free:314.51 GB) NTFS
Drive d: (HP_RECOVERY) (Fixed) (Total:12.04 GB) (Free:1.44 GB) NTFS ==>[system with boot components (obtained from drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 698.6 GB) (Disk ID: CCC43D8D)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=686.5 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=12 GB) - (Type=07 NTFS)
==================== End of Addition.txt ============================
Not much showing.
KMSpico v9.2.2 RC <==need to uninstall this
Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)
https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG
start
CreateRestorePoint:
CloseProcesses:
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll => No File
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll => No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\50.0.2661.87\PepperFlash\pepflashplayer.dll => No File
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\50.0.2661.87\ppGoogleNaClPluginChrome.dll => No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\50.0.2661.87\pdf.dll => No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll => No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll => No File
CHR Plugin: (Java(TM) Platform SE 7 U21) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll => No File
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll => No File
CHR Plugin: (Roblox Launcher Plugin) - C:\Users\Owner\AppData\Local\Roblox\Versions\version-1a23fdbca04d4954\\NPRobloxProxy.dll => No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll => No File
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <not found>
S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [X]
S3 WsDrvInst; "C:\Program Files (x86)\Wondershare\Dr.Fone for Android\DriverInstall.exe" [X]
C:\Users\Owner\AppData\Roaming\GhostObjGAFix.xml
AlternateDataStreams: C:\ProgramData\Temp:5C321E34 [119]
AlternateDataStreams: C:\Users\Owner\Downloads:Shareaza.GUID [16]
CMD: ipconfig /flushdns
CMD: netsh winsock reset all
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
EmptyTemp:
Hosts:
End
Open FRST/FRST64 and press the > Fix < button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
~~~~~~~~~~~~~~~~~~~~~`
Let's update Malwarebytes Anti-Malware
On the Dashboard click on Update Now
Go to the Setting Tab
Under Setting go to Detection and Protection
Under PUP and PUM make sure both are set to show Treat Detections as Malware
Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
Then on the Dashboard click on Scan
Make sure to select THREAT SCAN
Then click on Scan
Note: You may see the following message, "Could not load DDA driver". Click Yes, allow your PC to reboot and continue afterwards.
If threats are detected, click Remove Selected. If you are prompted to reboot, click Yes.
Upon completion of the scan (or after the reboot), click the History tab.
Click Application Logs, followed by the first Scan Log.
Click Export, followed by Copy to Clipboard. Paste the log in your next reply.
~~~~~~~~~~~~~
Please post these 2 logs when finished.
gigglepot
2016-09-19, 20:31
Here is the Fixlog.txt:
Fix result of Farbar Recovery Scan Tool (x64) Version: 18-09-2016
Ran by Owner (19-09-2016 12:13:49) Run:1
Running from C:\Users\Owner\Desktop
Loaded Profiles: Owner & (Available Profiles: Owner)
Boot Mode: Normal
==============================================
fixlist content:
*****************
start
CreateRestorePoint:
CloseProcesses:
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll => No File
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll => No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\50.0.2661.87\PepperFlash\pepflashplayer.dll => No File
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\50.0.2661.87\ppGoogleNaClPluginChrome.dll => No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\50.0.2661.87\pdf.dll => No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll => No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll => No File
CHR Plugin: (Java(TM) Platform SE 7 U21) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll => No File
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll => No File
CHR Plugin: (Roblox Launcher Plugin) - C:\Users\Owner\AppData\Local\Roblox\Versions\version-1a23fdbca04d4954\\NPRobloxProxy.dll => No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll => No File
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <not found>
S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [X]
S3 WsDrvInst; "C:\Program Files (x86)\Wondershare\Dr.Fone for Android\DriverInstall.exe" [X]
C:\Users\Owner\AppData\Roaming\GhostObjGAFix.xml
AlternateDataStreams: C:\ProgramData\Temp:5C321E34 [119]
AlternateDataStreams: C:\Users\Owner\Downloads:Shareaza.GUID [16]
CMD: ipconfig /flushdns
CMD: netsh winsock reset all
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
EmptyTemp:
Hosts:
End
*****************
Restore point was successfully created.
Processes closed successfully.
C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll => not found.
C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll => not found.
C:\Program Files (x86)\Google\Chrome\Application\50.0.2661.87\PepperFlash\pepflashplayer.dll => not found.
C:\Program Files (x86)\Google\Chrome\Application\50.0.2661.87\ppGoogleNaClPluginChrome.dll => not found.
C:\Program Files (x86)\Google\Chrome\Application\50.0.2661.87\pdf.dll => not found.
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll => not found.
C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll => not found.
C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll => not found.
C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll => not found.
C:\Users\Owner\AppData\Local\Roblox\Versions\version-1a23fdbca04d4954\\NPRobloxProxy.dll => not found.
c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll => not found.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\gomekmidlodglbbmalcneegieacbdmki" => key removed successfully
Service KMSELDI => service removed successfully
WsDrvInst => service removed successfully
C:\Users\Owner\AppData\Roaming\GhostObjGAFix.xml => moved successfully
C:\ProgramData\Temp => ":5C321E34" ADS removed successfully.
"C:\Users\Owner\Downloads" => ":Shareaza.GUID" ADS not found.
========= ipconfig /flushdns =========
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
========= End of CMD: =========
========= netsh winsock reset all =========
Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.
========= End of CMD: =========
========= netsh int ipv4 reset =========
Reseting Interface, OK!
Restart the computer to complete this action.
========= End of CMD: =========
========= netsh int ipv6 reset =========
There's no user specified settings to be reset.
========= End of CMD: =========
========= reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========
The operation completed successfully.
========= End of Reg: =========
========= reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========
The operation completed successfully.
========= End of Reg: =========
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.
=========== EmptyTemp: ==========
BITS transfer queue => 8388608 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 22749874 B
Java, Flash, Steam htmlcache => 30422007 B
Windows/system/drivers => 1595146 B
Edge => 0 B
Chrome => 0 B
Firefox => 388724695 B
Opera => 0 B
Temp, IE cache, history, cookies, recent:
Default => 0 B
Public => 0 B
ProgramData => 0 B
systemprofile => 83525 B
systemprofile32 => 692 B
LocalService => 0 B
NetworkService => 21300 B
Owner => 139579550 B
RecycleBin => 1597377460 B
EmptyTemp: => 2 GB temporary data Removed.
================================
The system needed a reboot.
==== End of Fixlog 12:19:27 ====
gigglepot
2016-09-19, 21:06
I noticed that after running the "fix", it deleted all of my pinned files that I had on my Excel taskbar button at the bottom of my screen. I needed to put them all back on again (or the ones I could remember). I'm running MalwareBytes now.....
gigglepot
2016-09-19, 21:25
Here is the MalwareBytes log:
Malwarebytes Anti-Malware
www.malwarebytes.org
Scan Date: 09/19/2016
Scan Time: 12:32 PM
Logfile:
Administrator: Yes
Version: 2.2.1.1043
Malware Database: v2016.09.19.07
Rootkit Database: v2016.08.15.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Owner
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 401374
Time Elapsed: 37 min, 28 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
Processes: 0
(No malicious items detected)
Modules: 0
(No malicious items detected)
Registry Keys: 0
(No malicious items detected)
Registry Values: 0
(No malicious items detected)
Registry Data: 0
(No malicious items detected)
Folders: 0
(No malicious items detected)
Files: 0
(No malicious items detected)
Physical Sectors: 0
(No malicious items detected)
(end)
gigglepot
2016-09-19, 21:33
Before I wrote in for help I ran Malwarebytes, let me know if you want me to post that History Scan Log as well. There were a lot of PUP things deleted then.
Before I wrote in for help I ran Malwarebytes, let me know if you want me to post that History Scan Log as well. There were a lot of PUP things deleted then.
Don't think I need to see it but hold on to it.
Please download Emsisoft Emergency Kit (http://dl.emsisoft.com/EmsisoftEmergencyKit.exe) and save it to your desktop.
Double click on the EmsisoftEmergencyKit file you downloaded to extract its contents and create a shortcut on the desktop.
Leave all settings as they are and click the Extract button at the bottom.
A folder named EEK will be created in the root of the drive (usually c:\).
After extraction please double-click on the new Start Emsisoft Emergency Kit icon on your desktop.
The first time you launch it, Emsisoft Emergency Kit will recommend that you allow it to download updates.
Please click Yes so that it downloads the latest database updates.
When the update process is complete, a new button will appear in the lower-left corner that says Back. Click on this button to return to the Overview screen.
Click on Scan to be taken to the scan options.
If you are asked if you want the scanner to scan for Potentially Unwanted Programs, then click Yes.
Click on the Malware Scan button to start the scan.
When the scan is completed click the View report button in the lower-right corner, and the scan log will be opened in Notepad.
Please save the log in Notepad on your desktop, and copy it to your next reply.
When you close Emsisoft Emergency Kit, it will give you an option to sign up for a newsletter. This is optional, and is not necessary for the malware removal process.
gigglepot
2016-09-20, 05:02
Here is the EEK log:
Emsisoft Emergency Kit - Version 11.9
Last update: 09/19/2016 8:48:38 PM
User account: Owner-HP\Owner
Computer name: OWNER-HP
OS version: Windows 7x64 Service Pack 1
Scan settings:
Scan type: Malware Scan
Objects: Rootkits, Memory, Traces, Files
Detect PUPs: On
Scan archives: Off
ADS Scan: On
File extension filter: Off
Advanced caching: On
Direct disk access: Off
Scan start: 09/19/2016 8:50:34 PM
Key: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\AU__RASAPI32 detected: Application.Win32.InstallExt (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\AU__RASMANCS detected: Application.Win32.InstallExt (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\HPSF_TASKS_RASAPI32 detected: Application.Win32.InstallExt (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\HPSF_TASKS_RASMANCS detected: Application.Win32.InstallExt (A)
Scanned 83380
Found 4
Scan end: 09/19/2016 9:00:06 PM
Scan time: 0:09:32
If you still have AdwCleaner on your machine I want you to right click on that and delete it.
Now, we'll download an updated version.
http://i.imgur.com/BY4dvz9.png AdwCleaner
Please download AdwCleaner (http://www.bleepingcomputer.com/download/adwcleaner/dl/125/) and save the file to your Desktop.
In order to use AdwCleaner, you have to agree the Eula:
Right-click AdwCleaner.exe and select http://i.imgur.com/AVOiBNU.jpg Run as administrator to run the programme.
Follow the prompts.
Click http://i.imgur.com/A49sxPr.png Scan.
Upon completion, click http://i.imgur.com/6cyn5v5.png Logfile. A log (AdwCleaner[S1].txt) will open. Briefly check the log for anything you know to be legitimate.
Return to AdwCleaner. Ensure anything you know to be legitimate does not have a checkmark under the corresponding tab.
Click http://i.imgur.com/MqHawIb.png Clean.
Follow the prompts and allow your computer to reboot.
After the reboot, a log (AdwCleaner[C1].txt) will open. Copy the contents of the log and paste in your next reply.
-- File and folder backups are made for items removed using this programme. Should a legitimate file or folder be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the item. Please do not overly concern yourself with the contents of AdwCleaner[C1].txt.
~~~~~~~~~~~~``
Please download Junkware Removal Tool (http://www.bleepingcomputer.com/download/junkware-removal-tool/)
or from here http://downloads.malwarebytes.org/file/jrt
to your desktop.
Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.
~~~~
please post
AdwCleaner[C1].txt
JRT.txt
gigglepot
2016-09-21, 20:29
Hello, AdwCleaner said no threats were found so I didn't clean anything so I have no logfile to post.
Here is the JRT.txt file:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.7 (07.03.2016)
Operating System: Windows 7 Home Premium x64
Ran by Owner (Administrator) on 09/21/2016 at 12:23:14.87
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
File System: 179
Successfully deleted: C:\Users\Owner\AppData\Local\{0024214A-36E5-4A94-A20C-47295A076CC0} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{00383928-7F54-41CC-B20A-3A2F4B90ABB2} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{01BED247-0D35-4CD4-A409-398219A98D39} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{02C0208C-DC4A-4E64-9885-5F69DE8D4ACB} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{02D59D42-40A8-4127-9E80-1238CD0D4C71} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{03F66F04-E5A1-4656-8B29-980D702E3F7E} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{05D2D757-F9B2-452D-ADDD-F1C89BBB8FB2} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{09792F63-3AB1-49C5-8A11-E69EB6D635AE} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{0B3978DB-6B1C-40CF-9034-EF400ACB1E90} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{0E8485DE-814E-4223-B739-BDD64D294E91} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{0F87A75F-6790-45F7-ABC2-7236494D1096} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{0F973BF4-686F-4596-9DF7-F446738C5A59} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{10DA4172-1302-45F1-8FF2-65802F4D9C96} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{1253D278-C375-4838-A91A-19AF622982B8} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{12B65814-E28E-4C9F-A92F-1266950E4ED5} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{14B2B911-371B-464F-9265-54D67BD4297D} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{15650557-DAB6-4106-AE26-96BF2C9B766F} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{17180090-4748-428C-88F2-6A8CB40FF99B} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{19101583-86C2-4400-B515-86D04B87FC68} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{1A16FA20-D639-4593-9CC0-1EA244324396} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{1CE59A62-933D-4467-94CA-18249B7EEF48} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{22F3FD28-E42B-4826-9C1F-69DAACFFC445} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{23289978-FA55-42A3-8C4C-BA73274D9DE9} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{23A30A5F-C046-403C-A334-A241201DD9A1} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{2617093B-86CA-4C0E-9293-683C7A3D1C85} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{29A5629C-FC94-40E3-A568-A3E6954EEE5A} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{2AAB15C5-6C3A-44FF-A92E-324B0AF65061} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{2B2BE6D9-7FC0-4DBF-BA68-DEE4CE5994A5} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{2CC9B5A5-7100-49D6-9CDB-AE9CFFEA0D3B} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{2D3E38E7-2540-463B-A3DF-DF029B9A05B3} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{2E97C133-0D12-4CD9-8C98-1728B045DAFB} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{30467CA5-E064-489A-B8B8-FB84076DA719} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{31874524-9796-4C26-A2D7-2A702BE1EADB} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{3488A903-5908-4E32-B6D2-9B04B961C077} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{34F408D0-F070-4CF2-BE03-7F3724468A64} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{354A0E43-9AB4-476D-93AA-EBFB00D09A74} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{36BB4B10-9A7B-499D-9890-B03DC677B242} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{370DE1A6-2FFC-444F-9500-FA6FDA820B65} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{38B2B614-A410-4449-BEAE-8AB8B0D21109} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{38F29E6B-D396-4BB2-8FB5-8B35F75437E1} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{393D2E20-7CA5-498C-AE5E-17124BA47E74} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{3B5BBF45-B4A9-4E93-83CF-D76D0B374CEE} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{3C394D6F-FDC0-48ED-AA85-EE80CD6C1FEF} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{3C8F344C-507B-42FF-88C7-CC84DE6B78E0} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{3E5A5AE4-EC79-4EBB-A526-34E11C171248} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{3F1B9554-A1A3-484E-BEFA-D7E9FF06A55B} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{4113CD15-CA81-4603-BBA8-3D864EA14FA2} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{42B0CE1F-6D52-4DE8-9630-923960B1C7E7} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{432A514B-CEE6-489E-A247-DCCF9FA3B127} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{44EBC9BE-50EB-456F-A420-DAF9668C2F71} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{450913BA-3524-438A-B1CE-A81F0677704D} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{451D6863-3E29-468D-BFCF-A218468E96F3} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{45CA8250-E477-486D-87B6-3FC485693105} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{47AC2F62-0CDB-463F-9954-D795F5616824} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{4933E032-3DB2-4B6C-AE1A-FC9B2C0B8165} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{494538F5-DF63-40AE-8533-1356F0C89F29} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{4BB62456-066F-44D7-A21E-0E285907B3AC} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{4BBEF8F4-E8E3-4F0F-BE4D-BA8F3AC687C2} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{4E31553C-510F-4E64-BAE6-51F9033F7E28} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{4E8547C4-307C-4BC2-A12C-31EE18336106} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{540CD953-46A8-4331-BE12-3B3161DE1B7B} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{54F98F01-3A6F-43A3-A899-A9BA31DE9CF4} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{56339C22-97B4-4B9A-88EA-73795DD53D8A} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{56F81457-0BE0-4252-A722-D939D450ACDD} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{592B3716-50A8-4A06-B6D7-A9298B5E7A75} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{5FFC0A48-23A0-45AE-B1B7-959C8346A41C} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{60AC9276-931A-4A09-8DEE-615F042168F4} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{64314A86-47A2-43B3-8A8E-806A48B42A92} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{67568427-2CA6-4853-9270-6535D411AF9F} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{687C4B24-51C3-4128-8BD9-07EEB5947FA6} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{69D22C83-FEA3-4E2C-B8CF-B9B23E9E219D} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{6A4A81B2-E306-4853-A27E-E0097BE1E56B} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{6A615527-493B-4FCD-A7CC-6B82F484FF6F} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{6B696DB6-32C2-4E3B-BC75-B3328AAC3DAC} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{6C0C9DB4-BC94-4776-82C0-D4C1CDF467EC} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{6C13D7C4-2646-4E1C-9BE5-9498A0C320ED} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{6CBEAB9D-4298-4C72-989E-138343196661} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{6D0E66CC-288B-4FC8-9379-FF2B759CECC4} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{76295205-8D96-4AE3-97E2-09A90BDC2EC0} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{77253A9D-5834-4E9E-9BDB-9F67CB60346B} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{7740A674-CE9B-45D2-B4AD-6E3DFACC0F43} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{7756E88A-474B-467B-AD08-561DAC6CE6BE} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{789FC340-893E-4DB7-8F2E-B28C35952761} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{78B928BA-CCF3-4410-A38C-D90A05A3D7B6} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{7AA7BF82-C882-4117-8410-E180934DC606} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{7BCB7794-67A9-4F39-B57D-1C4FC5FC1A13} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{7E402C62-74C1-4A30-8C86-62452363F64B} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{8015EBB6-7485-4D73-A7B7-384CB9571010} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{8066EA23-0C42-450C-BABD-D77FCF5D672F} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{82E10964-0507-4AEA-95CB-79AB3662154B} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{86DFF790-B03C-4131-AFE8-5DFE4DAFBC40} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{87076E55-CE56-45AB-BCB8-92E10CA355AF} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{88232FE4-EFAF-4B36-9215-5C94E1553916} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{893201ED-CC0E-4730-8B19-394C2A89B272} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{8AE69126-6EF8-46B5-95EE-85F553E49F5C} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{8F0E5F80-D730-4E1D-BACD-DE325BC99A0D} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{931DB317-5CE3-4302-AA40-C849F4F5C895} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{96E6027E-D180-47C4-8A17-2E19E20F3509} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{9A67C17B-A3F4-4387-9B23-D1498792AB1E} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{9B70FDCE-EE96-4FC5-8247-C35CEE345BD8} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{9C9276F2-651C-4DB9-9537-823704317027} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{9D9A9DC5-1826-42CF-9558-68B66FF1EC2F} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{9F1EC469-5D2C-4F63-8083-292F7E09901A} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{A154F30A-F22F-4B3F-889F-409D5105D0CD} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{A1E0D21A-52ED-4825-9BD0-7BF314BB3345} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{A277E8DF-4E9A-4CC0-A6FD-0E74032971D6} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{A2C09A6F-65D4-4ED7-897E-5745642F0FBF} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{A40D67C4-D5D8-4D26-B6D3-604DEFA5FAD4} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{A44E8D0E-E8C6-4294-B2C6-B8163E95DF57} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{A4E9CFF9-2687-4394-A72B-55D72C1F90FF} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{A5CFAFC2-5EF8-4B4F-9FFC-742BEB3F2840} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{A69F61A1-E7E0-44FB-A8FB-1894354A5C41} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{A80A06AB-6741-4EA9-9269-750834906347} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{A9D03064-40C5-4D07-A5F3-8F967D97D69D} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{ADD143EE-2791-4C1C-B264-B85E4702A161} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{B18FB0F0-A529-462C-8F9E-72527AB8A188} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{B3285994-9C48-47E2-A9AE-1BC9AA212BA4} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{B3DC3C89-84D4-45CD-85E8-2DDEE2A2848F} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{B4A9CAD0-392D-4313-902C-0ECEE42CEF7C} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{B4EA534F-1DB8-4531-B49B-36E05D210D3C} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{B66481BE-76C7-43E6-A08A-0A737670D181} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{B7D8870A-3E85-472B-A940-E2679FD02BAE} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{B94EBC1F-6E9B-413F-BEEC-C4F96E828799} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{B970FF77-5985-49D0-B37C-F4DA112777CD} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{BAFC6672-4E75-4294-AB9B-20E6B6C20F51} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{BD99D952-4E7F-451D-89D7-190CB323CAF8} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{BE637D08-F731-4EB8-ACC4-180E32DF9ECB} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{BE8D6866-64A0-4475-8004-296292B2F672} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{C46CE9D3-4BBC-4032-B1A1-5A3E0491656F} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{C7102ACF-66D4-44E1-B238-19E8EF520DAC} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{CCE3E937-8142-4D7A-AE18-5E5FA96F54F3} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{CD54E28A-EC0D-4F24-8246-D4771D3E6506} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{CF121A3E-F163-4862-BC98-E2E8078383EA} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{CFC3688F-B90B-4320-BA98-FE15EC5A47AE} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{D0D28D77-92CD-4A4F-BCF2-F67D1CF15786} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{D2511BC2-94AC-4779-9BC6-41E5A3270912} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{D3EB4F18-7793-49F8-94A4-D946022DA016} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{D5151003-427A-478E-AC40-835E0F146E0B} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{D852B7B9-91A3-4166-A4A5-59E7071CECB4} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{D9486B45-BC14-4423-A0D5-A9C674E127E6} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{D9CFB0E8-78FB-4630-AF75-5245370F263F} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{DE14F04F-CC81-410E-99AA-736E40953E1D} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{E21C2ABE-B10C-4E28-A065-60D93DB48DB5} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{E2DA54C4-EE95-4292-B7B1-B5635FADFBBB} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{E649DA2F-F320-4FF5-8E07-AB66C018A562} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{E7ABFD80-FC8F-48B4-8915-798ED36885F3} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{E8714771-FC90-48FD-BDC2-894CD1DA07B4} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{EA78B8E2-0428-4484-95A6-507CF0F34A95} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{EBB2F966-6371-4026-A7F6-FFE22FDACA8F} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{EC0FD7C9-6DF1-4A91-A653-64817B4AE553} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{ECB36ED5-32AC-4694-8F42-08E5370C9704} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{ECF51D14-71D4-4A1F-B262-B03B4937B322} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{ED438FF1-363C-4DB2-B5F5-30A9E49D4BA7} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{F2C43C89-5FB0-4D8A-A333-147947BE9016} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{F405D9F6-64C6-4D9E-9B00-082DD73999A8} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{F4AB706A-B3CC-43EF-9A6B-3614F34FA0D1} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{F7F15DDE-3E95-4FE4-88E7-7D5228EC6802} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{F9A9C3C6-FFE9-47F4-9DF9-D3C783696F10} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{FA3E450D-DC37-4E00-8A00-749EFA93C0B1} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{FAF313A9-C2EF-4554-815E-D8FC4E76A699} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{FB8D576D-1C37-4E7C-BBD4-BB742F516DAD} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{FD074450-47B8-40AB-9395-102FD8AA8E46} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\{FEA7C6B6-D921-4E4F-9E39-558816752A44} (Empty Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2CL3Q1K0 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9GN9EHT1 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HYGJGI55 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\II043Z1K (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JNH3WV29 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MAESXXVS (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ULLWQU9G (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WAPJ8N9L (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2CL3Q1K0 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9GN9EHT1 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HYGJGI55 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\II043Z1K (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JNH3WV29 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MAESXXVS (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ULLWQU9G (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WAPJ8N9L (Temporary Internet Files Folder)
Registry: 0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 09/21/2016 at 12:27:31.59
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
If there are still pop ups related to a specific profile while using Firefox, I think we'll need to save bookmarks, uninstall, then reinstall.
How is your computer at the moment?
gigglepot
2016-09-22, 03:48
Computer is still running loud. For a few hours there I thought it was lower but I can't be sure. Still not quiet like it was a few weeks back.
Do you still have Emsisoft Emergency Kit on your desktop?
Let's run that again and allow it to delete/quarantine what it finds this time
Click on Scan to be taken to the scan options.
If you are asked if you want the scanner to scan for Potentially Unwanted Programs, then click Yes.
Click on the Malware Scan button to start the scan.
When the scan is completed click the Quarantine selected objects button. Note, this option is only available if malicious objects were detected during the scan.
When the threats have been quarantined, click the View report button in the lower-right corner, and the scan log will be opened in Notepad.
Please save the log in Notepad on your desktop, and copy it to your next reply.
When you close Emsisoft Emergency Kit, it will give you an option to sign up for a newsletter. This is optional, and is not necessary for the malware removal process.
gigglepot
2016-09-22, 15:13
Here is the scan from the Emisisoft:
Emsisoft Emergency Kit - Version 11.9
Last update: 09/19/2016 8:48:38 PM
User account: Owner-HP\Owner
Computer name: OWNER-HP
OS version: Windows 7x64 Service Pack 1
Scan settings:
Scan type: Malware Scan
Objects: Rootkits, Memory, Traces, Files
Detect PUPs: On
Scan archives: Off
ADS Scan: On
File extension filter: Off
Advanced caching: On
Direct disk access: Off
Scan start: 09/22/2016 6:17:41 AM
Key: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\AU__RASAPI32 detected: Application.Win32.InstallExt (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\AU__RASMANCS detected: Application.Win32.InstallExt (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\HPSF_TASKS_RASAPI32 detected: Application.Win32.InstallExt (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\HPSF_TASKS_RASMANCS detected: Application.Win32.InstallExt (A)
Scanned 84121
Found 4
Scan end: 09/22/2016 6:33:58 AM
Scan time: 0:16:17
Key: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\HPSF_TASKS_RASMANCS Application.Win32.InstallExt (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\HPSF_TASKS_RASAPI32 Application.Win32.InstallExt (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\AU__RASMANCS Application.Win32.InstallExt (A)
Key: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\AU__RASAPI32 Application.Win32.InstallExt (A)
Quarantined 4
Let's see if we can see whats causing the constant running or high CPU
Right click on the tool bar located at the bottom of the screen, let task manager open then, click on the small box that says
Show processes from all users.
Use the scroll bar and look at what might be causing or using a high amount of CPU.
From what we've done it doesn't appear to be malware related, not saying it's impossible I just don't see what it is.
gigglepot
2016-09-23, 04:02
The two biggest things that show on the processes is:
svchost.exe
System Idle Process
They are both around 50 CPU.
When mine did this, Microsoft was the culprit.
Have you checked manually for updates in the last couple of days?, do you have your computer set to update automatically?
~~~~~
This repair may take some hours !!!
Tweaking.com - Windows Repair All-In-One (Portable)
- Download Windows Repair All-In-One (Portable Version) from here (http://www.tweaking.com/content/page/windows_repair_all_in_one.html).
- Extract tweaking.com_windows_repair_aio.zip to your Desktop.
- Disable all your antivirus and antimalware software - see how to do that here (http://www.bleepingcomputer.com/forums/t/114351/how-to-temporarily-disable-your-anti-virus-firewall-and-anti-malware-programs/).
- Right click on https://i.imgur.com/QfBzvq1.png and select Run as Administrator (XP users just double click) to start Windows Repair All-In-One.
(Windows Vista/7/8 users: Accept UAC warning if it is enabled.)
- A window will appear. Click Step 2.
http://i.imgur.com/2f8o60N.png
- Click the Open Pre-Scan button, then click Start Scan. Wait for Windows Repair to finish scanning.
- Depending on which error Windows Repair found, click Repair Reparse Point or Repair Environment Variable accordingly. When the button changes to "Done!", click the close button to return to Windows Repair.
- Go to Step 3, then click Check in the See If Check Disk Is Needed.
- If Windows Repair stated that errors are found, click Open Check Disk At Next Boot. Choose (/R) Fixes errors on the disk also locate bad sectors and recovers readable information, then click Add To Next Boot. Reboot the computer to let Windows check the disk.
http://i.imgur.com/Ymy7crZ.png
- Go to Step 4, then click Do It.
http://i.imgur.com/zDtdN75.png
- Go to Step 5. Under System Restore click Create.
http://i.imgur.com/f7lEe1N.png
- Go to Repairs and click Open Repairs. Leave all checkmarks as they are, then click Start Repairs.
http://i.imgur.com/PGv2vtD.png
- By default Windows Repair All-In-One will create a "Logs" folder in its folder on the Desktop. Please post the contents of the log in your next reply.
gigglepot
2016-09-24, 05:08
These next steps look a little "scary". Before I begin, is there a chance this will mess things up on my computer? I do not have the original Windows disk, it came pre-installed on my computer. I'm a little worried to do these steps....
If you create a restore point first thats something you can revert back to if something should happen.
All the tool does is check for system errors and attempts to fix them if anything is found.
gigglepot
2016-09-26, 19:21
Well, you'll never believe this. My computer is silent again! And all I did was install the 16 Windows updates that just came up on my computer! They weren't there when we first started working on this issue and then on the weekend I got all these updates to do, I did them and poof, super loud computer is so quiet again, I can hardly hear it! Sigh.....sorry for all that work you went through, I guess maybe next time I should wait a month or so to see if updates become available? That's twice now that the updates fixed my loud computer issue.
Well, you'll never believe this. My computer is silent again! And all I did was install the 16 Windows updates that just came up on my computer! They weren't there when we first started working on this issue and then on the weekend I got all these updates to do, I did them and poof, super loud computer is so quiet again, I can hardly hear it! Sigh.....sorry for all that work you went through, I guess maybe next time I should wait a month or so to see if updates become available? That's twice now that the updates fixed my loud computer issue.
I suspected it was the behind the scene updates trying to download and install.
To avoid this:
Set the machine to Never check for updates (not recommended): This option disables Windows Update completely in Windows 8, 7, or Vista. When you choose this, Windows Update won't even check with Microsoft to see if important security patches are even available.
What you can do here is check once a month, see whats needed then do all updates you want at that time.
To turn on Automatic Updates yourself, follow these steps:
Click Start, type Windows update in the search box, and then click Windows Update in the Programs list.
In the left pane, click Change settings.
Select the option the you want.
~~~~
When ready to check for updates, click on the windows Orb, then all programs, then windows update.
Then from there click on check for updates.
Let's remove tools and quarantine folders.
DelFix
Please download DelFix (http://general-changelog-team.fr/en/downloads/finish/20-outils-de-xplode/9-delfix) or from Here (http://www.bleepingcomputer.com/download/delfix/) and save the file to your Desktop.
Double-click DelFix.exe to run the programme.
Place a checkmark next to the following items:
Activate UAC
Remove disinfection tools
Click the Run button.
-- This will remove the specialized tools we used to disinfect your system.
Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).
************************************
gigglepot
2016-09-27, 03:48
Here is the log that DelFix provided:
# DelFix v1.010 - Logfile created 26/09/2016 at 19:47:45
# Updated 26/04/2015 by Xplode
# Username : Owner - OWNER-HP
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
~ Activating UAC ... OK
~ Removing disinfection tools ...
Deleted : C:\FRST
Deleted : C:\AdwCleaner
Deleted : C:\Users\Owner\Desktop\FRST-OlderVersion
Deleted : C:\Users\Owner\Desktop\Addition.txt
Deleted : C:\Users\Owner\Desktop\AdwCleaner.exe
Deleted : C:\Users\Owner\Desktop\Fixlog.txt
Deleted : C:\Users\Owner\Desktop\FRST.txt
Deleted : C:\Users\Owner\Desktop\FRST64.exe
Deleted : C:\Users\Owner\Desktop\JRT.exe
Deleted : C:\Users\Owner\Desktop\JRT.txt
Deleted : HKLM\SOFTWARE\TrendMicro\Hijackthis
########## - EOF - ##########
Your good to go, safe surfing.
gigglepot
2016-09-27, 14:36
I originally thought that my problems were because I installed the latest version of Mozilla Firefox 47.0.1 because that's when my computer seemed to get so loud. So I downgraded to Firefox 46 but my loud computer persisted. Now that things are quiet again, should I upgrade to Firefox 47 again or wait?
Yes, patches to Firefox or any other browser are important.
gigglepot
2016-09-28, 14:29
Ok, I updated Firefox. Things are still running so quietly! Thank you so much for all the help you gave me!!!
Your very welcome, safe surfing http://i204.photobucket.com/albums/bb106/Juliet702/sparkle.gif
Glad we could help. :)http://i204.photobucket.com/albums/bb106/Juliet702/sparkle.gif
Since this issue appears resolved ... this Topic is closed.