View Full Version : Removal of s.yimg.com
I need assistance Please with the removal of s.yimg.com, which is affecting everything on my PC it appeared first some 10 days ago on the bottom LH corner of Yahoo7, as of this moment I cannot access a full page of Yahoo of any description and access to Yahoo mail is the same symptoms. Any help would be most appreciated.
Regards
Nigel Stockley
Hello Bobby06,
Please see the FAQ which includes instructions in post #2 on how to provide the logs from Farbar Recovery Scan Tool and aswMBR, which are the logs used in the preliminary analysis.
http://forums.spybot.info/showthread.php?t=288
Once you provide the logs in this topic I will remove my post and merge yours, unless a helper responds beforehand. :)
Best regards.
aswMBR version 1.0.1.2252 Copyright(c) 2014 AVAST Software
Run date: 2016-12-02 22:17:34
-----------------------------
22:17:34.939 OS Version: Windows x64 6.2.9200
22:17:34.939 Number of processors: 2 586 0x4C03
22:17:34.941 ComputerName: DESKTOP-G99A7OK UserName: stock
22:17:39.343 Initialize success
22:17:39.368 VM: initialized successfully
22:17:39.376 VM: Intel CPU BiosDisabled
22:17:49.101 AVAST engine defs: 16120100
22:18:14.122 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000024
22:18:14.126 Disk 0 Vendor: Size: 0MB BusType: 0
22:18:14.230 Disk 0 MBR read successfully
22:18:14.237 Disk 0 MBR scan
22:18:14.281 Disk 0 unknown MBR code
22:18:14.289 Disk 0 MBR hidden
22:18:14.305 Disk 0 Partition 1 00 EE GPT 2097151 MB offset 1
22:18:14.345 Disk 0 scanning C:\WINDOWS\system32\drivers
22:18:34.777 Service scanning
22:19:08.003 Modules scanning
22:19:08.070 Disk 0 trace - called modules:
22:19:08.137
22:19:10.261 AVAST engine scan C:\WINDOWS
22:19:18.647 AVAST engine scan C:\WINDOWS\system32
22:24:52.536 AVAST engine scan C:\WINDOWS\system32\drivers
22:25:47.562 AVAST engine scan C:\Users\stockScan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 30-11-2016
Ran by stock (administrator) on DESKTOP-G99A7OK (02-12-2016 22:02:47)
Running from C:\Users\stock\Downloads
Loaded Profiles: stock (Available Profiles: stock)
Platform: Windows 10 Home Version 1607 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Hola Networks Ltd.) C:\Program Files\Hola\app\hola_updater.exe
(Intel(R) Corporation) C:\Program Files\Intel\BCA\pabeSvc64.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Hola Networks Ltd.) C:\Program Files\Hola\app\hola_svc.exe
(McAfee, Inc.) C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(HP Inc.) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\TXE Components\DAL\jhi_service.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler.exe
(McAfee, Inc.) C:\Program Files\TrueKey\McTkSchedulerService.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler64.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Security Assist\isa.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Hola Networks Ltd.) C:\Program Files\Hola\app\hola.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Logitech Inc.) C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe
() C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWelcome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ====================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8790264 2016-03-29] (Realtek Semiconductor)
HKLM\...\Run: [BtServer] => C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe [229592 2015-07-10] (Realtek Semiconductor Corporation)
HKLM\...\Run: [hola] => C:\Program Files\Hola\app\hola.exe [2166376 2016-10-18] (Hola Networks Ltd.) <===== ATTENTION
HKLM-x32\...\Run: [PowerDVD14Agent] => C:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14Agent.exe [795336 2015-10-01] (CyberLink Corp.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [9103976 2016-12-01] (AVAST Software)
HKLM-x32\...\Run: [BingDesktop] => C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe [2372800 2014-11-26] (Microsoft Corp.)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-09-22] (Oracle Corporation)
HKLM-x32\...\Run: [LWS] => C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [204136 2012-09-13] (Logitech Inc.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [5915776 2016-03-21] (Safer-Networking Ltd.)
HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\RunOnce: [Uninstall C:\Users\stock\AppData\Local\Microsoft\OneDrive\17.3.6390.0509_1\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\stock\AppData\Local\Microsoft\OneDrive\17.3.6390.0509_1\amd64"
HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\windows\WLXPGSS.SCR [322248 2014-03-31] (Microsoft Corporation)
Lsa: [Notification Packages] scecli C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2016-08-31] (AVAST Software)
Startup: C:\Users\stock\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Product Registration.lnk [2016-12-01]
ShortcutTarget: Logitech . Product Registration.lnk -> C:\Program Files (x86)\Logitech\Ereg\eReg.exe (Leader Technologies/Logitech)
Startup: C:\Users\stock\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - .lnk [2016-10-19]
ShortcutTarget: Monitor Ink Alerts - .lnk -> C:\Program Files\HP\HP Deskjet 1510 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
Startup: C:\Users\stock\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Deskjet 1510 series.lnk [2016-12-02]
ShortcutTarget: Monitor Ink Alerts - HP Deskjet 1510 series.lnk -> C:\Program Files\HP\HP Deskjet 1510 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{6a084aa0-8bc4-4012-b8f2-586389011ba5}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{c7f68307-655d-41b7-b9cc-15d172cda5aa}: [DhcpNameServer] 192.168.0.1
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://hp15-comm.msn.com/?pc=HRTE
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp15-comm.msn.com/?pc=HRTE
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://hp15-comm.msn.com/?pc=HRTE
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp15-comm.msn.com/?pc=HRTE
HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/en-au/?ocid=U143DHP&pfr=1
HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp15-comm.msn.com/?pc=HRTE
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2016-07-21] (HP Inc.)
BHO-x32: True Key Helper -> {0F4B8786-5502-4803-8EBC-F652A1153BB6} -> C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll [2016-07-15] (Intel Security)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\ssv.dll [2016-10-26] (Oracle Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2015-07-02] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\jp2ssv.dll [2016-10-26] (Oracle Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2016-07-21] (HP Inc.)
Toolbar: HKLM-x32 - True Key - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll [2016-07-15] (Intel Security)
Toolbar: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Edge:
======
Edge Extension: (Adblock Plus) -> 10_EyeoGmbHAdblockPlus_d55gg7py3s0m0 => C:\Program Files\WindowsApps\EyeoGmbH.AdblockPlus_0.9.9.0_neutral__d55gg7py3s0m0 [2016-12-01]
FireFox:
========
FF ProfilePath: C:\Users\stock\AppData\Roaming\Mozilla\Firefox\Profiles\whawyrn4.default-1478817956913 [2016-12-02]
FF Homepage: Mozilla\Firefox\Profiles\whawyrn4.default-1478817956913 -> hxxps://au.yahoo.com/#
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: (Avast Online Security) - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-12-01]
FF HKLM\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF Extension: (Avast SafePrice) - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2016-12-01]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF HKLM-x32\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_23_0_0_207.dll [2016-11-09] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWoW64\Macromed\Flash\NPSWF32_23_0_0_207.dll [2016-11-09] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.56 -> C:\Program Files (x86)\Intel\TXE Components\IPT\npIntelWebAPIIPT.dll [2014-07-02] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\TXE Components\IPT\npIntelWebAPIUpdater.dll [2014-07-02] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.111.2 -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\dtplugin\npDeployJava1.dll [2016-10-26] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.111.2 -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\plugin2\npjp2.dll [2016-10-26] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-29] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-29] (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll [2016-08-01] ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-10-01] (Adobe Systems Inc.)
Chrome:
=======
CHR HomePage: Default -> nine.com.au/
CHR Profile: C:\Users\stock\AppData\Local\Google\Chrome\User Data\Default [2016-12-02]
CHR Extension: (Google Docs) - C:\Users\stock\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-12-02]
CHR Extension: (Google Drive) - C:\Users\stock\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-12-02]
CHR Extension: (YouTube) - C:\Users\stock\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-12-02]
CHR Extension: (X-notifier (for Gmail™,Hotmail,Yahoo,AOL...)) - C:\Users\stock\AppData\Local\Google\Chrome\User Data\Default\Extensions\cdfjbkbddpfnoplfhceolpopfoepleco [2016-12-02]
CHR Extension: (Adblock Plus) - C:\Users\stock\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-12-02]
CHR Extension: (Nine.com.au - Homepage & Bookmarks) - C:\Users\stock\AppData\Local\Google\Chrome\User Data\Default\Extensions\efeejpljhmnlmccjklepacdpmjgmhieg [2016-12-02]
CHR Extension: (Avast SafePrice) - C:\Users\stock\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2016-12-02]
CHR Extension: (Radioplayer) - C:\Users\stock\AppData\Local\Google\Chrome\User Data\Default\Extensions\fcppdfelojakeahklfgkjegnpbgndoch [2016-12-02]
CHR Extension: (Google Docs Offline) - C:\Users\stock\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-12-02]
CHR Extension: (Unlimited Free VPN - Hola) - C:\Users\stock\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio [2016-12-02]
CHR Extension: (Avast Online Security) - C:\Users\stock\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2016-12-02]
CHR Extension: (Chrome Web Store Payments) - C:\Users\stock\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-12-02]
CHR Extension: (Gmail) - C:\Users\stock\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-12-02]
CHR Extension: (Chrome Media Router) - C:\Users\stock\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-12-02]
CHR HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [fkkcgfbgohboipdhliafmacjnhjbhmim] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <not found>
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [197128 2016-08-31] (AVAST Software)
S2 BingDesktopUpdate; C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [173248 2014-11-26] (Microsoft Corp.)
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-05] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-05] (Dropbox, Inc.)
S2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [350064 2016-08-01] (WildTangent)
R2 hola_svc; C:\Program Files\Hola\app\hola_svc.exe [5622376 2016-10-18] (Hola Networks Ltd.) <==== ATTENTION
R2 hola_updater; C:\Program Files\Hola\app\hola_updater.exe [5622376 2016-10-18] (Hola Networks Ltd.) <==== ATTENTION
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [29728 2016-08-15] (HP Inc.)
R2 igfxCUIService2.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [353896 2015-12-02] (Intel Corporation)
R3 Intel(R) Security Assist; C:\Program Files (x86)\Intel\Intel(R) Security Assist\isa.exe [335872 2015-05-20] (Intel Corporation) [File not signed]
R2 IntelBCAsvc; C:\Program Files\Intel\BCA\pabeSvc64.exe [3026584 2016-05-06] (Intel(R) Corporation)
S2 isaHelperSvc; C:\Program Files (x86)\Intel\Intel(R) Security Assist\isaHelperService.exe [7680 2015-05-20] () [File not signed]
R2 jhi_service; C:\Program Files (x86)\Intel\TXE Components\DAL\jhi_service.exe [174368 2015-04-22] (Intel Corporation)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [389896 2014-04-15] ()
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [316152 2016-03-29] (Realtek Semiconductor)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [4088608 2016-09-21] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [235984 2016-11-24] (Safer-Networking Ltd.)
R2 TrueKey; C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe [908256 2016-07-22] (McAfee, Inc.)
R2 TrueKeyScheduler; C:\Program Files\TrueKey\McTkSchedulerService.exe [15736 2016-07-22] (McAfee, Inc.)
S3 TrueKeyServiceHelper; C:\Program Files\TrueKey\McAfee.TrueKey.ServiceHelper.exe [86864 2016-07-22] (McAfee, Inc.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 aswHwid; C:\WINDOWS\system32\drivers\aswHwid.sys [37656 2016-08-31] (AVAST Software)
R1 aswKbd; C:\WINDOWS\system32\drivers\aswKbd.sys [37144 2016-08-31] (AVAST Software)
R2 aswMonFlt; C:\WINDOWS\system32\drivers\aswMonFlt.sys [108816 2016-08-31] (AVAST Software)
R1 aswRdr; C:\WINDOWS\system32\drivers\aswRdr2.sys [103064 2016-08-31] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [74544 2016-08-31] (AVAST Software)
R1 aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [969184 2016-10-26] (AVAST Software)
R1 aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [513632 2016-10-26] (AVAST Software)
R2 aswStm; C:\WINDOWS\system32\drivers\aswStm.sys [163416 2016-08-31] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [293352 2016-10-26] (AVAST Software)
R3 igfxLP; C:\WINDOWS\system32\DRIVERS\igdkmd64lp.sys [7279504 2015-12-02] (Intel Corporation)
S3 mfencbdc; C:\WINDOWS\System32\DRIVERS\mfencbdc.sys [543488 2016-02-10] (McAfee, Inc.)
S3 mfencrk; C:\WINDOWS\System32\DRIVERS\mfencrk.sys [109480 2016-02-10] (McAfee, Inc.)
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [886528 2015-06-03] (Realtek )
R3 RtkBtFilter; C:\WINDOWS\system32\DRIVERS\RtkBtfilter.sys [709376 2016-03-16] (Realtek Semiconductor Corporation)
R3 RTSUER; C:\WINDOWS\system32\Drivers\RtsUer.sys [402136 2015-05-28] (Realsil Semiconductor Corporation)
R3 RTWlanE; C:\WINDOWS\System32\drivers\rtwlane.sys [5144064 2016-07-16] (Realtek Semiconductor Corporation )
U1 staport; C:\Windows\System32\Drivers\staport.sys [44952 2016-10-26] ()
R3 TXEIx64; C:\WINDOWS\System32\drivers\TXEIx64.sys [146200 2015-12-02] (Intel Corporation)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-12-02 22:02 - 2016-12-02 22:03 - 00021649 _____ C:\Users\stock\Downloads\FRST.txt
2016-12-02 21:59 - 2016-12-02 22:02 - 00000000 ____D C:\FRST
2016-12-02 21:59 - 2016-12-02 21:59 - 02411520 _____ (Farbar) C:\Users\stock\Downloads\FRST64.exe
2016-12-02 21:55 - 2016-12-02 21:55 - 00002319 _____ C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
2016-12-02 21:55 - 2016-12-02 21:55 - 00000207 _____ C:\WINDOWS\tweaking.com-regbackup-DESKTOP-G99A7OK-Windows-10-Home-(64-bit).dat
2016-12-02 21:55 - 2016-12-02 21:55 - 00000000 ____D C:\RegBackup
2016-12-02 21:55 - 2016-12-02 21:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2016-12-02 21:55 - 2016-12-02 21:55 - 00000000 ____D C:\Program Files (x86)\Tweaking.com
2016-12-02 21:54 - 2016-12-02 21:55 - 00017987 _____ C:\WINDOWS\Tweaking.com - Registry Backup Setup Log.txt
2016-12-02 21:52 - 2016-12-02 21:54 - 05766144 _____ (Tweaking.com) C:\Users\stock\Downloads\tweaking.com_registry_backup_setup.exe
2016-12-02 18:32 - 2016-12-02 18:32 - 00000000 ___HD C:\OneDriveTemp
2016-12-02 11:58 - 2016-11-10 20:13 - 00453396 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20161202-115818.backup
2016-12-02 09:17 - 2016-12-02 09:17 - 00002355 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-12-02 09:17 - 2016-12-02 09:17 - 00002343 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-12-02 09:14 - 2016-12-02 09:14 - 01065376 _____ (Google Inc.) C:\Users\stock\Downloads\ChromeSetup (1).exe
2016-12-01 22:07 - 2016-12-01 22:07 - 00044952 _____ () C:\WINDOWS\system32\Drivers\staport.sys.148059403967102
2016-12-01 22:06 - 2016-10-26 10:15 - 00969184 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw932E.tmp
2016-12-01 22:06 - 2016-10-26 10:15 - 00513632 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw93A0.tmp
2016-12-01 22:06 - 2016-10-26 10:15 - 00293352 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw96AE.tmp
2016-12-01 22:06 - 2016-08-31 07:35 - 00391496 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2016-12-01 22:06 - 2016-08-31 07:35 - 00163416 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw96BF.tmp
2016-12-01 22:06 - 2016-08-31 07:35 - 00108816 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw938E.tmp
2016-12-01 22:06 - 2016-08-31 07:35 - 00103064 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw936D.tmp
2016-12-01 22:06 - 2016-08-31 07:35 - 00074544 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw938F.tmp
2016-12-01 22:06 - 2016-08-31 07:35 - 00037656 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw937E.tmp
2016-12-01 22:06 - 2016-08-31 07:34 - 00037144 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw9252.tmp
2016-12-01 22:03 - 2016-12-01 22:03 - 00000000 ____D C:\WINDOWS\Panther
2016-12-01 21:16 - 2016-12-01 21:16 - 00659732 _____ C:\Users\stock\OneDrive\Documents\cc_20161201_211606.reg
2016-12-01 21:14 - 2016-12-01 21:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2016-11-26 08:58 - 2016-11-26 08:58 - 00000000 ____D C:\$SysReset
2016-11-24 18:18 - 2016-11-24 18:18 - 03278250 _____ C:\Users\stock\Downloads\236902298.pdf
2016-11-16 20:48 - 2016-12-01 21:21 - 00000000 ____D C:\Users\stock\AppData\LocalLow\Mozilla
2016-11-11 08:54 - 2016-11-11 08:55 - 00243520 _____ C:\Users\stock\Downloads\Firefox Setup Stub 49.0.2.exe
2016-11-10 20:13 - 2016-10-31 21:13 - 00453346 ____R C:\WINDOWS\system32\Drivers\etc\hosts.20161110-201325.backup
2016-11-10 19:56 - 2016-11-10 19:56 - 00000308 _____ C:\WINDOWS\wininit.ini
2016-11-10 08:04 - 2016-11-10 08:04 - 00000000 ____D C:\Users\stock\AppData\Local\AVAST Software
2016-11-10 07:55 - 2016-11-02 21:22 - 01570672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2016-11-10 07:55 - 2016-11-02 21:22 - 00601712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll
2016-11-10 07:55 - 2016-11-02 21:12 - 00341344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2016-11-10 07:55 - 2016-11-02 21:09 - 02257104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2016-11-10 07:55 - 2016-11-02 21:08 - 00602464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupEngine.dll
2016-11-10 07:55 - 2016-11-02 21:08 - 00111968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupApi.dll
2016-11-10 07:55 - 2016-11-02 21:05 - 20969928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2016-11-10 07:55 - 2016-11-02 21:05 - 06657176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2016-11-10 07:55 - 2016-11-02 21:05 - 03892352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2016-11-10 07:55 - 2016-11-02 21:05 - 00951904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll
2016-11-10 07:55 - 2016-11-02 21:04 - 00596832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comctl32.dll
2016-11-10 07:55 - 2016-11-02 21:01 - 01425000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d9.dll
2016-11-10 07:55 - 2016-11-02 21:01 - 01263856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2016-11-10 07:55 - 2016-11-02 21:01 - 00276832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\input.dll
2016-11-10 07:55 - 2016-11-02 20:50 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LaunchWinApp.exe
2016-11-10 07:55 - 2016-11-02 20:49 - 00147968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32k.sys
2016-11-10 07:55 - 2016-11-02 20:48 - 00095232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TSpkg.dll
2016-11-10 07:55 - 2016-11-02 20:48 - 00081408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2016-11-10 07:55 - 2016-11-02 20:47 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BlockedShutdown.dll
2016-11-10 07:55 - 2016-11-02 20:47 - 00047104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Shell.Search.UriHandler.dll
2016-11-10 07:55 - 2016-11-02 20:46 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininetlui.dll
2016-11-10 07:55 - 2016-11-02 20:45 - 00253952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BioFeedback.dll
2016-11-10 07:55 - 2016-11-02 20:45 - 00182784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsensorgroup.dll
2016-11-10 07:55 - 2016-11-02 20:44 - 00180224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe
2016-11-10 07:55 - 2016-11-02 20:44 - 00089088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AuthExt.dll
2016-11-10 07:55 - 2016-11-02 20:43 - 00731136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d8.dll
2016-11-10 07:55 - 2016-11-02 20:43 - 00557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StoreAgent.dll
2016-11-10 07:55 - 2016-11-02 20:43 - 00198144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FSClient.dll
2016-11-10 07:55 - 2016-11-02 20:42 - 00866816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Cred.dll
2016-11-10 07:55 - 2016-11-02 20:42 - 00632832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sud.dll
2016-11-10 07:55 - 2016-11-02 20:42 - 00549376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActionCenterCPL.dll
2016-11-10 07:55 - 2016-11-02 20:42 - 00506880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DevicePairing.dll
2016-11-10 07:55 - 2016-11-02 20:42 - 00306176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieproxy.dll
2016-11-10 07:55 - 2016-11-02 20:42 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgentUserBroker.exe
2016-11-10 07:55 - 2016-11-02 20:41 - 00635904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2016-11-10 07:55 - 2016-11-02 20:40 - 00548352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ddraw.dll
2016-11-10 07:55 - 2016-11-02 20:40 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\indexeddbserver.dll
2016-11-10 07:55 - 2016-11-02 20:39 - 00465920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LockAppBroker.dll
2016-11-10 07:55 - 2016-11-02 20:39 - 00348672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\zipfldr.dll
2016-11-10 07:55 - 2016-11-02 20:39 - 00236544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIAnimation.dll
2016-11-10 07:55 - 2016-11-02 20:38 - 00760832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\appwiz.cpl
2016-11-10 07:55 - 2016-11-02 20:37 - 19415040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2016-11-10 07:55 - 2016-11-02 20:36 - 07626752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2016-11-10 07:55 - 2016-11-02 20:35 - 00336896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msinfo32.exe
2016-11-10 07:55 - 2016-11-02 20:33 - 12349952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2016-11-10 07:55 - 2016-11-02 20:33 - 03307520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2016-11-10 07:55 - 2016-11-02 20:31 - 01228288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usercpl.dll
2016-11-10 07:55 - 2016-11-02 20:31 - 00090624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll
2016-11-10 07:55 - 2016-11-02 20:30 - 12175360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2016-11-10 07:55 - 2016-11-02 20:29 - 07469056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2016-11-10 07:55 - 2016-11-02 20:29 - 03666432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2016-11-10 07:55 - 2016-11-02 20:29 - 00884224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2016-11-10 07:55 - 2016-11-02 20:29 - 00122368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NPSM.dll
2016-11-10 07:55 - 2016-11-02 20:28 - 06044160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2016-11-10 07:55 - 2016-11-02 20:28 - 00807424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.OnlineId.dll
2016-11-10 07:55 - 2016-11-02 20:28 - 00079360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\asycfilt.dll
2016-11-10 07:55 - 2016-11-02 20:27 - 02458112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\themecpl.dll
2016-11-10 07:55 - 2016-11-02 20:27 - 00580608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hgcpl.dll
2016-11-10 07:55 - 2016-11-02 20:27 - 00422400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.dll
2016-11-10 07:55 - 2016-11-02 20:26 - 02747392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll
2016-11-10 07:55 - 2016-11-02 20:26 - 01880576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll
2016-11-10 07:55 - 2016-11-02 20:26 - 01595392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2016-11-10 07:55 - 2016-11-02 20:26 - 01509376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2016-11-10 07:55 - 2016-11-02 20:26 - 00912896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comdlg32.dll
2016-11-10 07:55 - 2016-11-02 20:26 - 00798208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2016-11-10 07:55 - 2016-11-02 20:26 - 00712192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Search.dll
2016-11-10 07:55 - 2016-11-02 20:26 - 00358912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\stobject.dll
2016-11-10 07:55 - 2016-11-02 20:25 - 02998272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2016-11-10 07:55 - 2016-11-02 20:25 - 02256384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2016-11-10 07:55 - 2016-11-02 20:25 - 01556480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll
2016-11-10 07:55 - 2016-11-02 20:25 - 00772608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntshrui.dll
2016-11-10 07:55 - 2016-11-02 20:23 - 03106304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstsc.exe
2016-11-10 07:55 - 2016-11-02 20:23 - 02356736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVidCtl.dll
2016-11-10 07:55 - 2016-08-02 14:30 - 00822784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
2016-11-10 07:54 - 2016-11-02 22:01 - 00484584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2016-11-10 07:54 - 2016-11-02 22:01 - 00315744 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2016-11-10 07:54 - 2016-11-02 21:10 - 02323728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll
2016-11-10 07:54 - 2016-11-02 21:08 - 00576408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2016-11-10 07:54 - 2016-11-02 21:08 - 00186424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\weretw.dll
2016-11-10 07:54 - 2016-11-02 21:05 - 00959112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2016-11-10 07:54 - 2016-11-02 21:04 - 04312248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2016-11-10 07:54 - 2016-11-02 21:01 - 01415744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2016-11-10 07:54 - 2016-11-02 21:01 - 00545936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2016-11-10 07:54 - 2016-11-02 20:49 - 00037376 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2016-11-10 07:54 - 2016-11-02 20:48 - 00032768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\efsext.dll
2016-11-10 07:54 - 2016-11-02 20:47 - 00156672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BcastDVRHelper.dll
2016-11-10 07:54 - 2016-11-02 20:46 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppCapture.dll
2016-11-10 07:54 - 2016-11-02 20:45 - 00492032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcastdvr.exe
2016-11-10 07:54 - 2016-11-02 20:44 - 00231936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll
2016-11-10 07:54 - 2016-11-02 20:43 - 00270336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2016-11-10 07:54 - 2016-11-02 20:43 - 00126464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2016-11-10 07:54 - 2016-11-02 20:42 - 00202752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.HumanInterfaceDevice.dll
2016-11-10 07:54 - 2016-11-02 20:40 - 00896512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontext.dll
2016-11-10 07:54 - 2016-11-02 20:36 - 19415552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2016-11-10 07:54 - 2016-11-02 20:36 - 00063488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ErrorDetailsUpdate.dll
2016-11-10 07:54 - 2016-11-02 20:31 - 03196416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdp.dll
2016-11-10 07:54 - 2016-11-02 20:30 - 00134144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ErrorDetails.dll
2016-11-10 07:54 - 2016-11-02 20:29 - 01247232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll
2016-11-10 07:54 - 2016-11-02 20:28 - 04423680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll
2016-11-10 07:54 - 2016-11-02 20:28 - 00109568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\chartv.dll
2016-11-10 07:54 - 2016-11-02 20:26 - 02484736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gameux.dll
2016-11-10 07:54 - 2016-11-02 20:23 - 00199680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GlobCollationHost.dll
2016-11-10 07:54 - 2016-11-02 19:11 - 00788624 _____ C:\WINDOWS\SysWOW64\locale.nls
2016-11-10 07:54 - 2016-11-02 19:11 - 00788624 _____ C:\WINDOWS\system32\locale.nls
2016-11-10 07:52 - 2016-11-02 20:23 - 02104320 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidsvc.dll
2016-11-10 07:51 - 2016-11-02 21:20 - 00378720 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2016-11-10 07:51 - 2016-11-02 21:14 - 07816544 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2016-11-10 07:51 - 2016-11-02 21:13 - 01883784 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2016-11-10 07:51 - 2016-11-02 21:13 - 00773720 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll
2016-11-10 07:51 - 2016-11-02 21:13 - 00423776 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifitask.exe
2016-11-10 07:51 - 2016-11-02 21:12 - 02255712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2016-11-10 07:51 - 2016-11-02 21:12 - 00376672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys
2016-11-10 07:51 - 2016-11-02 21:05 - 00405856 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2016-11-10 07:51 - 2016-11-02 21:04 - 02678056 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll
2016-11-10 07:51 - 2016-11-02 21:03 - 02750936 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2016-11-10 07:51 - 2016-11-02 21:02 - 00848736 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupEngine.dll
2016-11-10 07:51 - 2016-11-02 21:02 - 00682816 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2016-11-10 07:51 - 2016-11-02 21:02 - 00238056 _____ (Microsoft Corporation) C:\WINDOWS\system32\weretw.dll
2016-11-10 07:51 - 2016-11-02 21:02 - 00148832 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupApi.dll
2016-11-10 07:51 - 2016-11-02 21:01 - 00092512 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2016-11-10 07:51 - 2016-11-02 21:00 - 22223968 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2016-11-10 07:51 - 2016-11-02 21:00 - 08156080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2016-11-10 07:51 - 2016-11-02 21:00 - 04130432 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2016-11-10 07:51 - 2016-11-02 21:00 - 01274712 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2016-11-10 07:51 - 2016-11-02 21:00 - 01061968 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll
2016-11-10 07:51 - 2016-11-02 20:59 - 04673304 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2016-11-10 07:51 - 2016-11-02 20:56 - 01609920 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d9.dll
2016-11-10 07:51 - 2016-11-02 20:56 - 01572768 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2016-11-10 07:51 - 2016-11-02 20:56 - 01418312 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2016-11-10 07:51 - 2016-11-02 20:56 - 00628552 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2016-11-10 07:51 - 2016-11-02 20:56 - 00322912 _____ (Microsoft Corporation) C:\WINDOWS\system32\input.dll
2016-11-10 07:51 - 2016-11-02 20:55 - 00048992 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\iorate.sys
2016-11-10 07:51 - 2016-11-02 20:38 - 22563840 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2016-11-10 07:51 - 2016-11-02 20:34 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\system32\microsoft-windows-system-events.dll
2016-11-10 07:51 - 2016-11-02 20:34 - 00043008 _____ (Microsoft Corporation) C:\WINDOWS\system32\LaunchWinApp.exe
2016-11-10 07:51 - 2016-11-02 20:33 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2016-11-10 07:51 - 2016-11-02 20:32 - 00045056 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2016-11-10 07:51 - 2016-11-02 20:32 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\system32\efsext.dll
2016-11-10 07:51 - 2016-11-02 20:31 - 00226304 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcTok.exe
2016-11-10 07:51 - 2016-11-02 20:31 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSpkg.dll
2016-11-10 07:51 - 2016-11-02 20:31 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininetlui.dll
2016-11-10 07:51 - 2016-11-02 20:30 - 09131008 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2016-11-10 07:51 - 2016-11-02 20:30 - 00635904 _____ (Microsoft Corporation) C:\WINDOWS\system32\FlightSettings.dll
2016-11-10 07:51 - 2016-11-02 20:30 - 00567296 _____ (Microsoft Corporation) C:\WINDOWS\system32\DevicePairing.dll
2016-11-10 07:51 - 2016-11-02 20:30 - 00363520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BioFeedback.dll
2016-11-10 07:51 - 2016-11-02 20:30 - 00321536 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2016-11-10 07:51 - 2016-11-02 20:30 - 00109056 _____ (Microsoft Corporation) C:\WINDOWS\system32\dab.dll
2016-11-10 07:51 - 2016-11-02 20:30 - 00058880 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Shell.Search.UriHandler.dll
2016-11-10 07:51 - 2016-11-02 20:29 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BlockedShutdown.dll
2016-11-10 07:51 - 2016-11-02 20:29 - 00336896 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkBindingEngineMigPlugin.dll
2016-11-10 07:51 - 2016-11-02 20:29 - 00314880 _____ (Microsoft Corporation) C:\WINDOWS\system32\FSClient.dll
2016-11-10 07:51 - 2016-11-02 20:29 - 00296960 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsensorgroup.dll
2016-11-10 07:51 - 2016-11-02 20:29 - 00276992 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2016-11-10 07:51 - 2016-11-02 20:29 - 00211968 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe
2016-11-10 07:51 - 2016-11-02 20:29 - 00139264 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2016-11-10 07:51 - 2016-11-02 20:28 - 00748544 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll
2016-11-10 07:51 - 2016-11-02 20:28 - 00690176 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieproxy.dll
2016-11-10 07:51 - 2016-11-02 20:28 - 00566784 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActionCenterCPL.dll
2016-11-10 07:51 - 2016-11-02 20:28 - 00432128 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpAXHolder.dll
2016-11-10 07:51 - 2016-11-02 20:28 - 00411136 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCenter.dll
2016-11-10 07:51 - 2016-11-02 20:28 - 00321024 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkUXBroker.dll
2016-11-10 07:51 - 2016-11-02 20:28 - 00279552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.HumanInterfaceDevice.dll
2016-11-10 07:51 - 2016-11-02 20:28 - 00274432 _____ (Microsoft Corporation) C:\WINDOWS\system32\ListSvc.dll
2016-11-10 07:51 - 2016-11-02 20:28 - 00260608 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgentUserBroker.exe
2016-11-10 07:51 - 2016-11-02 20:28 - 00252928 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll
2016-11-10 07:51 - 2016-11-02 20:28 - 00240640 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkDesktopSettings.dll
2016-11-10 07:51 - 2016-11-02 20:28 - 00115200 _____ (Microsoft Corporation) C:\WINDOWS\system32\IdCtrls.dll
2016-11-10 07:51 - 2016-11-02 20:28 - 00088576 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2016-11-10 07:51 - 2016-11-02 20:27 - 23677952 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2016-11-10 07:51 - 2016-11-02 20:27 - 01388544 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Cred.dll
2016-11-10 07:51 - 2016-11-02 20:27 - 00631296 _____ (Microsoft Corporation) C:\WINDOWS\system32\WlanMediaManager.dll
2016-11-10 07:51 - 2016-11-02 20:27 - 00545792 _____ (Microsoft Corporation) C:\WINDOWS\system32\timedate.cpl
2016-11-10 07:51 - 2016-11-02 20:27 - 00495104 _____ (Microsoft Corporation) C:\WINDOWS\system32\DataSenseHandlers.dll
2016-11-10 07:51 - 2016-11-02 20:27 - 00261632 _____ (Microsoft Corporation) C:\WINDOWS\system32\indexeddbserver.dll
2016-11-10 07:51 - 2016-11-02 20:26 - 00579072 _____ (Microsoft Corporation) C:\WINDOWS\system32\ddraw.dll
2016-11-10 07:51 - 2016-11-02 20:26 - 00388608 _____ (Microsoft Corporation) C:\WINDOWS\system32\zipfldr.dll
2016-11-10 07:51 - 2016-11-02 20:26 - 00278016 _____ (Microsoft Corporation) C:\WINDOWS\system32\netplwiz.dll
2016-11-10 07:51 - 2016-11-02 20:26 - 00273920 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIAnimation.dll
2016-11-10 07:51 - 2016-11-02 20:26 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll
2016-11-10 07:51 - 2016-11-02 20:25 - 00655872 _____ (Microsoft Corporation) C:\WINDOWS\system32\sud.dll
2016-11-10 07:51 - 2016-11-02 20:25 - 00541696 _____ (Microsoft Corporation) C:\WINDOWS\system32\ipnathlp.dll
2016-11-10 07:51 - 2016-11-02 20:25 - 00496128 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettings.UserAccountsHandlers.dll
2016-11-10 07:51 - 2016-11-02 20:24 - 03778560 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2016-11-10 07:51 - 2016-11-02 20:24 - 00940032 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontext.dll
2016-11-10 07:51 - 2016-11-02 20:22 - 13441024 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
2016-11-10 07:51 - 2016-11-02 20:22 - 13081600 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2016-11-10 07:51 - 2016-11-02 20:22 - 04749312 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2016-11-10 07:51 - 2016-11-02 20:22 - 00369664 _____ (Microsoft Corporation) C:\WINDOWS\system32\msinfo32.exe
2016-11-10 07:51 - 2016-11-02 20:21 - 05111296 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdp.dll
2016-11-10 07:51 - 2016-11-02 20:19 - 08127488 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2016-11-10 07:51 - 2016-11-02 20:19 - 08075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2016-11-10 07:51 - 2016-11-02 20:19 - 01586176 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll
2016-11-10 07:51 - 2016-11-02 20:19 - 00981504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.OnlineId.dll
2016-11-10 07:51 - 2016-11-02 20:19 - 00805888 _____ (Microsoft Corporation) C:\WINDOWS\system32\FrameServer.dll
2016-11-10 07:51 - 2016-11-02 20:19 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\NPSM.dll
2016-11-10 07:51 - 2016-11-02 20:19 - 00130560 _____ (Microsoft Corporation) C:\WINDOWS\system32\chartv.dll
2016-11-10 07:51 - 2016-11-02 20:19 - 00089088 _____ (Microsoft Corporation) C:\WINDOWS\system32\asycfilt.dll
2016-11-10 07:51 - 2016-11-02 20:18 - 00991232 _____ (Microsoft Corporation) C:\WINDOWS\system32\comdlg32.dll
2016-11-10 07:51 - 2016-11-02 20:18 - 00836608 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcRefreshTask.dll
2016-11-10 07:51 - 2016-11-02 20:18 - 00243712 _____ (Microsoft Corporation) C:\WINDOWS\system32\shdocvw.dll
2016-11-10 07:51 - 2016-11-02 20:17 - 04746752 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2016-11-10 07:51 - 2016-11-02 20:17 - 01282048 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2016-11-10 07:51 - 2016-11-02 20:17 - 00982528 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2016-11-10 07:51 - 2016-11-02 20:17 - 00909824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Search.dll
2016-11-10 07:51 - 2016-11-02 20:17 - 00389632 _____ (Microsoft Corporation) C:\WINDOWS\system32\stobject.dll
2016-11-10 07:51 - 2016-11-02 20:16 - 04148736 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2016-11-10 07:51 - 2016-11-02 20:16 - 03400192 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncCenter.dll
2016-11-10 07:51 - 2016-11-02 20:16 - 03133440 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll
2016-11-10 07:51 - 2016-11-02 20:16 - 02688512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll
2016-11-10 07:51 - 2016-11-02 20:16 - 02669056 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2016-11-10 07:51 - 2016-11-02 20:16 - 02512384 _____ (Microsoft Corporation) C:\WINDOWS\system32\themecpl.dll
2016-11-10 07:51 - 2016-11-02 20:16 - 01779712 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2016-11-10 07:51 - 2016-11-02 20:16 - 01637888 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2016-11-10 07:51 - 2016-11-02 20:16 - 01490944 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2016-11-10 07:51 - 2016-11-02 20:16 - 01359360 _____ (Microsoft Corporation) C:\WINDOWS\system32\usercpl.dll
2016-11-10 07:51 - 2016-11-02 20:16 - 00629248 _____ (Microsoft Corporation) C:\WINDOWS\system32\hgcpl.dll
2016-11-10 07:51 - 2016-11-02 20:16 - 00579072 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppBroker.dll
2016-11-10 07:51 - 2016-11-02 20:16 - 00308736 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActionCenter.dll
2016-11-10 07:51 - 2016-11-02 20:16 - 00265728 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupSvc.dll
2016-11-10 07:51 - 2016-11-02 20:15 - 04708864 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExplorerFrame.dll
2016-11-10 07:51 - 2016-11-02 20:15 - 03616768 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2016-11-10 07:51 - 2016-11-02 20:15 - 02611200 _____ (Microsoft Corporation) C:\WINDOWS\system32\gameux.dll
2016-11-10 07:51 - 2016-11-02 20:15 - 01513472 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2016-11-10 07:51 - 2016-11-02 20:15 - 01348608 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll
2016-11-10 07:51 - 2016-11-02 20:15 - 00842240 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntshrui.dll
2016-11-10 07:51 - 2016-11-02 20:15 - 00483328 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.dll
2016-11-10 07:51 - 2016-11-02 20:14 - 01726976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll
2016-11-10 07:51 - 2016-11-02 20:13 - 03496960 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVidCtl.dll
2016-11-10 07:51 - 2016-11-02 20:13 - 03299840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstsc.exe
2016-11-10 07:51 - 2016-11-02 20:13 - 00322048 _____ (Microsoft Corporation) C:\WINDOWS\system32\GlobCollationHost.dll
2016-11-10 07:51 - 2016-11-02 18:20 - 00446896 _____ C:\WINDOWS\system32\ApnDatabase.xml
2016-11-10 07:50 - 2016-11-02 21:20 - 00590960 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2016-11-10 07:50 - 2016-11-02 21:15 - 01051112 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2016-11-10 07:50 - 2016-11-02 21:15 - 00894096 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2016-11-10 07:50 - 2016-11-02 21:13 - 01354320 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2016-11-10 07:50 - 2016-11-02 21:13 - 01173496 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2016-11-10 07:50 - 2016-11-02 21:03 - 00714592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2016-11-10 07:50 - 2016-11-02 21:00 - 00534096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2016-11-10 07:50 - 2016-11-02 20:31 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\system32\BcastDVRHelper.dll
2016-11-10 07:50 - 2016-11-02 20:31 - 00170496 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppCapture.dll
2016-11-10 07:50 - 2016-11-02 20:31 - 00159232 _____ (Microsoft Corporation) C:\WINDOWS\system32\ACPBackgroundManagerPolicy.dll
2016-11-10 07:50 - 2016-11-02 20:31 - 00097792 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll
2016-11-10 07:50 - 2016-11-02 20:28 - 00324608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll
2016-11-10 07:50 - 2016-11-02 20:27 - 00605184 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvr.exe
2016-11-10 07:50 - 2016-11-02 20:25 - 00956416 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2016-11-10 07:50 - 2016-11-02 20:23 - 00101888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bowser.sys
2016-11-10 07:50 - 2016-11-02 20:23 - 00072704 _____ (Microsoft Corporation) C:\WINDOWS\system32\ErrorDetailsUpdate.dll
2016-11-10 07:50 - 2016-11-02 20:22 - 00337920 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2016-11-10 07:50 - 2016-11-02 20:21 - 00942080 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2016-11-10 07:50 - 2016-11-02 20:20 - 02273792 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2016-11-10 07:50 - 2016-11-02 20:20 - 00167936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ErrorDetails.dll
2016-11-10 07:50 - 2016-11-02 20:18 - 01690112 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2016-11-10 07:50 - 2016-11-02 20:17 - 00828416 _____ (Microsoft Corporation) C:\WINDOWS\system32\appwiz.cpl
2016-11-10 07:50 - 2016-11-02 20:16 - 00881664 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2016-11-10 07:50 - 2016-11-02 20:16 - 00770560 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll
2016-11-09 23:20 - 2016-12-02 18:35 - 00000000 ____D C:\ProgramData\Skype
2016-11-09 23:17 - 2016-11-09 23:19 - 43760768 _____ (Skype Technologies S.A.) C:\Users\stock\Downloads\SkypeSetupFull.exe
2016-11-09 20:11 - 2016-11-09 20:11 - 00000000 ____D C:\Users\stock\AppData\Local\Logitech® Webcam Software
2016-11-09 20:08 - 2016-11-09 20:08 - 00000000 ____D C:\ProgramData\LogiShrd
2016-11-09 20:07 - 2016-11-09 20:07 - 00000000 ____D C:\Users\stock\AppData\Roaming\Leadertech
2016-11-09 20:06 - 2016-11-09 20:06 - 00001720 _____ C:\Users\Public\Desktop\Logitech Webcam Software .lnk
2016-11-09 20:03 - 2016-12-01 21:59 - 00000000 ____D C:\Program Files\Common Files\logishrd
2016-11-09 20:03 - 2016-11-09 20:05 - 74520472 _____ (Logitech, Inc.) C:\Users\stock\Downloads\lws280.exe
2016-11-08 20:24 - 2003-03-18 22:20 - 01060864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFC71.dll
2016-11-08 20:24 - 2003-03-18 21:44 - 00057344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFC71ENU.DLL
2016-11-08 20:24 - 2003-03-18 21:14 - 00499712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcp71.dll
2016-11-08 20:24 - 2003-02-21 05:42 - 00348160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcr71.dll
2016-11-08 20:24 - 1999-04-23 22:22 - 00933888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFC413aa.rra
2016-11-08 20:17 - 1999-04-23 22:22 - 00933888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFC4b6d1.rra
2016-11-08 20:15 - 2016-11-08 20:15 - 00000268 _____ C:\WINDOWS\_delis32.ini
2016-11-08 20:15 - 1998-10-29 17:45 - 00306688 _____ (InstallShield Software Corporation) C:\WINDOWS\IsUninst.exe
2016-11-08 20:08 - 2016-11-08 20:08 - 00000000 ____D C:\Users\stock\AppData\Local\Logitech-LS
2016-11-08 10:32 - 2016-12-01 21:59 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech
2016-11-08 10:32 - 2003-05-02 14:14 - 00466944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\capicom.dll
2016-11-08 10:31 - 2016-11-09 22:37 - 00000000 ____D C:\Program Files (x86)\Logitech
2016-11-08 10:31 - 2003-03-18 22:12 - 01047552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFC71u.dll
2016-11-08 10:31 - 2003-03-18 21:44 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFC71DEU.DLL
2016-11-08 10:31 - 2003-03-18 21:44 - 00061440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFC71ITA.DLL
2016-11-08 10:31 - 2003-03-18 21:44 - 00061440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFC71ESP.DLL
2016-11-08 10:31 - 2003-03-18 21:44 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFC71KOR.DLL
2016-11-08 10:31 - 2003-03-18 21:44 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFC71JPN.DLL
2016-11-08 10:31 - 2003-03-18 21:44 - 00045056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFC71CHT.DLL
2016-11-08 10:31 - 2003-03-18 21:44 - 00040960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFC71CHS.DLL
2016-11-08 10:31 - 2003-03-18 20:05 - 00089088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\atl71.dll
2016-11-08 10:31 - 1999-04-23 22:22 - 00933888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFC41b03.rra
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-12-02 19:54 - 2016-08-08 17:26 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2016-12-02 18:59 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\system32\NDF
2016-12-02 18:39 - 2016-07-16 21:47 - 00000000 ___HD C:\Program Files\WindowsApps
2016-12-02 18:39 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-12-02 18:35 - 2016-08-23 08:50 - 00000000 ____D C:\Users\stock\AppData\Roaming\Skype
2016-12-02 18:32 - 2016-05-21 15:41 - 00000000 ___RD C:\Users\stock\OneDrive
2016-12-02 18:31 - 2016-08-08 17:28 - 00000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2016-12-02 18:31 - 2016-05-21 15:36 - 00000000 __SHD C:\Users\stock\IntelGraphicsProfiles
2016-12-02 12:10 - 2016-08-08 17:33 - 00000000 ____D C:\Users\stock
2016-12-02 10:46 - 2016-05-21 15:53 - 00000000 ____D C:\Users\stock\AppData\Local\Google
2016-12-02 10:43 - 2016-08-08 17:51 - 00003982 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player PPAPI Notifier
2016-12-02 10:43 - 2016-05-27 10:13 - 00000892 _____ C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job
2016-12-02 10:43 - 2016-05-22 08:49 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2016-12-02 10:42 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed
2016-12-02 10:42 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\system32\Macromed
2016-12-02 10:38 - 2016-05-24 07:46 - 00000000 ____D C:\Users\stock\AppData\Local\ElevatedDiagnostics
2016-12-02 09:48 - 2016-05-21 15:36 - 00000000 ____D C:\Users\stock\AppData\Local\Packages
2016-12-02 09:16 - 2016-05-21 15:53 - 00000000 ____D C:\Program Files (x86)\Google
2016-12-02 09:01 - 2016-05-29 09:11 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2016-12-02 08:35 - 2016-05-24 21:13 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2016-12-02 08:00 - 2016-07-16 21:45 - 00000000 ____D C:\WINDOWS\INF
2016-12-01 22:22 - 2016-08-08 17:51 - 00004020 _____ C:\WINDOWS\System32\Tasks\SafeZone scheduled Autoupdate 1463815370
2016-12-01 22:21 - 2016-05-21 17:22 - 00001095 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast SafeZone Browser.lnk
2016-12-01 22:09 - 2016-08-08 17:32 - 01926810 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-12-01 22:08 - 2016-05-21 17:15 - 00001986 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast Free Antivirus.lnk
2016-12-01 22:08 - 2016-05-21 17:15 - 00001974 _____ C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2016-12-01 22:07 - 2016-08-08 17:51 - 00004008 _____ C:\WINDOWS\System32\Tasks\DropboxUpdateTaskMachineUA
2016-12-01 22:07 - 2016-08-08 17:51 - 00004004 _____ C:\WINDOWS\System32\Tasks\avast! Emergency Update
2016-12-01 22:07 - 2016-08-08 17:51 - 00003776 _____ C:\WINDOWS\System32\Tasks\DropboxUpdateTaskMachineCore
2016-12-01 22:07 - 2016-01-19 14:05 - 00000948 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job
2016-12-01 22:07 - 2016-01-19 14:05 - 00000944 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job
2016-12-01 22:03 - 2016-08-08 17:51 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-12-01 22:01 - 2016-07-16 21:47 - 00000000 ___SD C:\WINDOWS\system32\Nui
2016-12-01 22:01 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2016-12-01 22:01 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\system32\migwiz
2016-12-01 22:01 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\system32\icsxml
2016-12-01 22:01 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\L2Schemas
2016-12-01 22:01 - 2016-01-19 14:01 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2016-12-01 22:00 - 2016-08-08 17:51 - 00000000 ____D C:\WINDOWS\System32\Tasks\Hewlett-Packard
2016-12-01 22:00 - 2016-08-01 18:26 - 00000000 ____D C:\Users\stock\AppData\Roaming\WildTangent
2016-12-01 22:00 - 2016-07-16 21:47 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2016-12-01 22:00 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\rescache
2016-12-01 22:00 - 2016-07-16 16:04 - 00000000 ____D C:\WINDOWS\system32\Sysprep
2016-12-01 21:59 - 2016-07-30 18:19 - 00000000 ____D C:\Program Files\TrueKey
2016-12-01 21:59 - 2016-05-24 21:13 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2016-12-01 21:59 - 2016-05-23 10:00 - 00000000 ____D C:\Program Files\Google
2016-12-01 21:59 - 2016-01-19 14:01 - 00000000 ____D C:\Program Files (x86)\WildGames
2016-12-01 21:59 - 2016-01-19 14:00 - 00000000 ____D C:\ProgramData\WildTangent
2016-12-01 21:59 - 2016-01-19 14:00 - 00000000 ____D C:\Program Files (x86)\WildTangent Games
2016-12-01 21:46 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\registration
2016-12-01 21:38 - 2016-07-30 18:31 - 00000000 ____D C:\Users\stock\AppData\Local\tkdata
2016-12-01 21:33 - 2016-05-21 16:15 - 00000000 ____D C:\Users\stock\AppData\Local\Mozilla
2016-12-01 21:18 - 2016-05-25 22:24 - 00000000 ____D C:\Users\stock\Tracing
2016-11-27 08:00 - 2016-05-21 15:38 - 00000000 ____D C:\Users\stock\AppData\Local\Publishers
2016-11-24 21:11 - 2016-05-22 08:48 - 00000000 ____D C:\Users\stock\AppData\Local\Adobe
2016-11-14 08:56 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2016-11-11 08:15 - 2015-11-04 12:11 - 00000000 __RHD C:\Users\Public\AccountPictures
2016-11-11 08:08 - 2016-08-08 17:26 - 00214896 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2016-11-11 08:08 - 2016-06-01 09:34 - 00000364 _____ C:\WINDOWS\Tasks\HPCeeScheduleForstock.job
2016-11-10 21:45 - 2016-07-16 16:04 - 12058624 _____ C:\WINDOWS\system32\config\BBI
2016-11-10 21:43 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\system32\oobe
2016-11-10 21:43 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\ShellExperiences
2016-11-10 21:43 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\bcastdvr
2016-11-10 20:56 - 2016-07-16 21:36 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-11-10 20:43 - 2016-05-21 16:21 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-11-10 20:34 - 2016-05-21 16:21 - 141011376 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-11-10 19:27 - 2016-08-08 17:51 - 00003256 _____ C:\WINDOWS\System32\Tasks\HPCeeScheduleForstock
2016-11-10 07:49 - 2016-07-16 16:04 - 00032768 _____ C:\WINDOWS\system32\config\ELAM
2016-11-09 22:55 - 2016-08-08 17:51 - 00004562 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2016-11-08 11:13 - 2016-05-21 15:36 - 00000000 ____D C:\Users\stock\AppData\Local\VirtualStore
2016-11-08 10:31 - 2016-01-19 13:39 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2016-11-06 20:21 - 2016-07-30 18:18 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
==================== Files in the root of some directories =======
2016-05-21 15:36 - 2016-05-28 20:28 - 0037849 _____ () C:\Users\stock\AppData\Local\BTServer.log
2016-07-31 17:44 - 2016-07-31 17:44 - 0000057 _____ () C:\ProgramData\Ament.ini
Files to move or delete:
====================
C:\Program Files\Hola\app\hola.exe
Some files in TEMP:
====================
C:\Users\stock\AppData\Local\Temp\{BE5A9AF0-2DD0-4789-9FB9-D59C6AC46193}-55.0.2883.75_chrome_installer.exe
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2016-12-02 10:38
==================== End of FRST.txt ============================
22:30:00.307 Disk 0 MBR has been saved successfully to "C:\Users\stock\Downloads\MBR.dat"
22:30:00.329 The log file has been saved successfully to "C:\Users\stock\Downloads\aswMBR.txt"
Hi
When Farbar Recovery Scan Tool was first run it should had produced an Addition.txt
Can you locate this please and copy and paste it in your next reply.
Sorry about the missing file, I think this is it.Additional scan result of Farbar Recovery Scan Tool (x64) Version: 30-11-2016
Ran by stock (02-12-2016 22:05:04)
Running from C:\Users\stock\Downloads
Windows 10 Home Version 1607 (X64) (2016-08-08 08:00:22)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-1283020984-1161487079-2240348159-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1283020984-1161487079-2240348159-503 - Limited - Disabled)
Guest (S-1-5-21-1283020984-1161487079-2240348159-501 - Limited - Disabled)
stock (S-1-5-21-1283020984-1161487079-2240348159-1001 - Administrator - Enabled) => C:\Users\stock
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Avast Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Spybot - Search and Destroy (Enabled - Up to date) {A16C3F68-9280-E053-1818-342707FECF4D}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Disabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: Avast Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
12 Labours of Hercules III: Girl Power (x32 Version: 3.0.2.118 - WildTangent) Hidden
Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.020.20042 - Adobe Systems Incorporated)
Adobe Flash Player 23 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 23.0.0.207 - Adobe Systems Incorporated)
Adobe Flash Player 23 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 23.0.0.207 - Adobe Systems Incorporated)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 12.3.2280 - AVAST Software)
Azkend 2: The World Beneath (x32 Version: 2.2.0.98 - WildTangent) Hidden
BBC iPlayer Downloads (HKLM-x32\...\{148784F3-3B6E-4DFA-B7A1-3400B277DAF3}) (Version: 1.14.2 - BBC)
Bing Desktop (HKLM-x32\...\{7D095455-D971-4D4C-9EFD-9AF6A6584F3A}) (Version: 1.4.167.0 - Microsoft Corporation)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Building the Great Wall of China Collector's Edition (x32 Version: 3.0.2.48 - WildTangent) Hidden
CameraHelperMsi (x32 Version: 13.51.815.0 - Logitech) Hidden
Coyote The Outlander (x32 Version: 3.0.2.59 - WildTangent) Hidden
CyberLink PhotoDirector (HKLM-x32\...\InstallShield_{5A454EC5-217A-42a5-8CE1-2DDEC4E70E01}) (Version: 5.0.6.7006 - CyberLink Corp.)
CyberLink PhotoDirector (Version: 5.0.6.7006 - CyberLink Corp.) Hidden
CyberLink Power Media Player 14 (HKLM-x32\...\{32C8E300-BDB4-4398-92C2-E9B7D8A233DB}) (Version: 14.0.2.5801 - CyberLink Corp.)
CyberLink PowerDirector 12 (HKLM-x32\...\InstallShield_{E1646825-D391-42A0-93AA-27FA810DA093}) (Version: 12.0.5.4614 - CyberLink Corp.)
CyberLink PowerDirector 12 (Version: 12.0.5.4614 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Delicious: Emily's Wonder Wedding Premium Edition (x32 Version: 3.0.2.59 - WildTangent) Hidden
Dropbox 25 GB (HKLM-x32\...\{736A97C6-8766-3699-84A9-71736C5E0CE3}) (Version: 3.1.11.0 - Dropbox, Inc.)
Dropbox Update Helper (x32 Version: 1.3.59.1 - Dropbox, Inc.) Hidden
Energy Star (HKLM\...\{5CB22648-35F8-41BC-9C35-1E41FE6E12A5}) (Version: 1.1.1 - HP Inc.)
Entwined: The Perfect Murder (x32 Version: 3.0.2.59 - WildTangent) Hidden
erLT (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
Evernote v. 5.8.13 (HKLM-x32\...\{A229420E-204B-11E5-B844-0050569584E9}) (Version: 5.8.13.8152 - Evernote Corp.)
Family Vacation 2: Road Trip (x32 Version: 3.0.2.59 - WildTangent) Hidden
Foxtel GO (HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\Foxtel GO 1.84) (Version: 1.84 - Foxtel)
Foxtel GO (x32 Version: 1.84 - Foxtel) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 55.0.2883.75 - Google Inc.)
Google Update Helper (x32 Version: 1.3.31.5 - Google Inc.) Hidden
Hola™ 1.17.142 - Better Internet (HKLM\...\Hola) (Version: 1.17.142 - Hola Networks Ltd.) <==== ATTENTION
Home Makeover (x32 Version: 3.0.2.59 - WildTangent) Hidden
HP Deskjet 1510 series Basic Device Software (HKLM\...\{D17E60E8-478A-4D4A-8147-21D481B5CA55}) (Version: 32.2.188.47710 - Hewlett-Packard Co.)
HP Deskjet 1510 series Help (HKLM-x32\...\{2E25FCEB-EFCB-4696-AA01-D3CBAC721831}) (Version: 30.0.0 - Hewlett Packard)
HP Documentation (HKLM\...\HP_Documentation) (Version: 1.0.0.1 - HP)
HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.7702 - HP)
HP Registration Service (HKLM\...\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.8318.5320 - Hewlett-Packard)
HP Support Assistant (HKLM-x32\...\{79C54A05-F146-4EA0-8A70-D4EFE6181E52}) (Version: 8.3.34.7 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\...\{76272057-98E0-4DC4-AAC3-10C546C47195}) (Version: 14.00.0000 - Hewlett-Packard)
HP Support Solutions Framework (HKLM-x32\...\{55065080-504F-43BB-BE00-36B80D7D39A5}) (Version: 12.5.32.37 - Hewlett-Packard Company)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HP Welcome (HKLM\...\HPWelcome) (Version: 1.0 - HP Inc.)
IGT Slots: Paradise Garden (x32 Version: 3.0.2.59 - WildTangent) Hidden
Imperial Island: Birth of an Empire (x32 Version: 3.0.2.59 - WildTangent) Hidden
Insane Cold: Back to the Ice Age (x32 Version: 3.0.2.59 - WildTangent) Hidden
Intel Security True Key (HKLM\...\TrueKey) (Version: 4.4.135.1 - Intel Security)
Intel(R) Chipset Device Software (x32 Version: 10.1.1.11 - Intel(R) Corporation) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.4320 - Intel Corporation)
Intel(R) Trusted Execution Engine (HKLM\...\{176E2755-0A17-42C6-88E2-192AB2131278}) (Version: 2.0.0.1094 - Intel Corporation)
Intel® Security Assist (HKLM-x32\...\{4B230374-6475-4A73-BA6E-41015E9C5013}) (Version: 1.0.0.532 - Intel Corporation)
Java 8 Update 111 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180111F0}) (Version: 8.0.1110.14 - Oracle Corporation)
Jewel Match Snowscapes (x32 Version: 3.0.2.118 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Living Legends: Frozen Beauty Collector's Edition (x32 Version: 3.0.2.59 - WildTangent) Hidden
Logitech Webcam Software (HKLM-x32\...\{D40EB009-0499-459c-A8AF-C9C110766215}) (Version: 2.80 - Logitech Inc.)
Lost Lands: Dark Overlord Collector's Edition (x32 Version: 3.0.2.59 - WildTangent) Hidden
Lost Souls: Timeless Fables Collector's Edition (x32 Version: 3.0.2.59 - WildTangent) Hidden
Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Manor Memoirs Collector's Edition (x32 Version: 3.0.2.59 - WildTangent) Hidden
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4693.1005 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50901.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mystery Expedition: Prisoners of Ice (x32 Version: 3.0.2.59 - WildTangent) Hidden
NavDesk 7.50 (HKLM-x32\...\{AB756389-9A03-44f3-ABAF-3699C01B4868}-Navman-7.50) (Version: 7.50.0112.135 - Navman Technology NZ Limited)
Plagiarii (x32 Version: 3.0.2.59 - WildTangent) Hidden
Polar Bowler 1st Frame (x32 Version: 3.0.2.59 - WildTangent) Hidden
Product Improvement Study for HP Deskjet 1510 series (HKLM\...\{35DB2630-846E-47C5-AF84-9D6AC3629F55}) (Version: 32.2.188.47710 - Hewlett-Packard Co.)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.10125.31214 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.1.505.2015 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7673 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\...\{A5107464-AA9B-4177-8129-5FF2F42DD322}) (Version: 1.0.0.64 - REALTEK Semiconductor Corp.)
Runefall (x32 Version: 3.0.2.126 - WildTangent) Hidden
SafeZone Stable 1.51.2220.62 (x32 Version: 1.51.2220.62 - Avast Software) Hidden
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
Tweaking.com - Registry Backup (HKLM-x32\...\Tweaking.com - Registry Backup) (Version: 3.5.3 - Tweaking.com)
Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
WildTangent Games App for HP (x32 Version: 4.0.11.16 - WildTangent) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {02C481A7-4DD3-4FC7-A575-3E4CC513625D} - System32\Tasks\HPCustParticipation HP Deskjet 1510 series => C:\Program Files\HP\HP Deskjet 1510 series\Bin\HPCustPartic.exe [2014-03-06] (Hewlett-Packard Co.)
Task: {043950DF-1A89-441B-813F-15FD09DD6152} - System32\Tasks\HPCeeScheduleForstock => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2015-06-17] (Hewlett-Packard)
Task: {38C2450B-861C-4437-BE70-3FA7502266B3} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2016-08-31] (AVAST Software)
Task: {473B63E6-731B-4FDB-9724-4AFDDBF07E78} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2016-08-23] (HP Inc.)
Task: {5206F88A-EA64-48CE-A1FF-3F4AA000E557} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-10-21] (Adobe Systems Incorporated)
Task: {5BC25A7F-F4B6-40E8-A330-F671F7CD1092} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-05-21] (Google Inc.)
Task: {6971802E-193D-40F5-B760-91F18CD4DF59} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1283020984-1161487079-2240348159-1001UA => C:\Users\stock\AppData\Local\Google\Update\GoogleUpdate.exe
Task: {73152C4E-C1ED-4621-A4FF-BE86F15EAA61} - System32\Tasks\Hewlett-Packard\HP Active Health\HP Active Health Scan (HPSA) => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2016-08-18] (HP Inc.)
Task: {84777A26-7B5B-49C3-A6FC-AABC84FE1D03} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2016-03-21] (Safer-Networking Ltd.)
Task: {95530B3B-DB61-4DE5-A489-281D9A5B9224} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater - Resources => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2016-08-03] (HP Inc.)
Task: {973433E0-8FC3-4F5B-B11F-582236FA86D4} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-12-02] (Adobe Systems Incorporated)
Task: {9E6F5CF6-1547-41E4-A9E8-1634C8443593} - System32\Tasks\SafeZone scheduled Autoupdate 1463815370 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2016-09-06] (Avast Software)
Task: {AA399E49-1FF3-433C-8C37-18D16B4E32E4} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-11-05] (Dropbox, Inc.)
Task: {AD9C3733-96B3-4782-A642-189D87DE5CEA} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2016-08-23] (HP Inc.)
Task: {BBB07AC2-6511-4217-B643-A91B56314544} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-11-05] (Dropbox, Inc.)
Task: {C06DBA5B-E337-4955-BA0C-D342BB14F07C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-05-21] (Google Inc.)
Task: {C12619B3-ACB2-403B-9D5F-75B9279447DD} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2016-08-03] (HP Inc.)
Task: {D32AE5A1-10DB-4569-AEB6-7576668C1854} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2016-03-21] (Safer-Networking Ltd.)
Task: {D5440922-C589-40DB-9291-34382FF44EB5} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
Task: {DE6200AB-9F8E-4EFF-A4A0-0E72575F2D8B} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\WINDOWS\SysWoW64\Macromed\Flash\FlashUtil32_23_0_0_207_pepper.exe [2016-12-02] (Adobe Systems Incorporated)
Task: {F1EDFFB8-E127-472F-8A33-DDDE109F479D} - System32\Tasks\DropboxOEM => C:\Program Files (x86)\Dropbox\DropboxOEM\DropboxOEM.exe [2016-04-04] ()
Task: {F63F535D-388B-459D-9180-EB2336C23A8C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSFReport.exe [2016-05-09] (Hewlett-Packard)
Task: {FAE3CA76-723F-48C5-91FB-06CCEA91962F} - System32\Tasks\{ADF7D1CB-5E6C-4A5F-8BDA-8BEFE61A2899} => pcalua.exe -a E:\install.exe -d E:\
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job => C:\WINDOWS\SysWoW64\Macromed\Flash\FlashUtil32_23_0_0_207_pepper.exe
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\HPCeeScheduleForstock.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
ShortcutWithArgument: C:\Users\stock\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\45a4b0557a8c430b\Radioplayer.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=fcppdfelojakeahklfgkjegnpbgndoch
==================== Loaded Modules (Whitelisted) ==============
2016-01-19 13:55 - 2014-04-15 12:59 - 00389896 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2016-07-16 21:42 - 2016-07-16 21:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-09-30 08:37 - 2016-09-16 03:25 - 02681200 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2016-09-30 08:37 - 2016-09-16 03:25 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-09-30 08:37 - 2016-09-16 03:25 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll
2016-08-23 08:51 - 2016-08-23 08:51 - 01864384 _____ () C:\Users\stock\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\amd64\ClientTelemetry.dll
2016-09-14 17:28 - 2016-09-07 14:56 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2016-11-10 07:51 - 2016-11-02 20:30 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 00264040 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
2016-11-10 07:50 - 2016-11-02 20:15 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2016-11-10 07:50 - 2016-11-02 20:21 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2016-11-10 07:51 - 2016-11-02 20:14 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2016-11-10 07:50 - 2016-11-02 20:15 - 01033216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2016-11-10 07:50 - 2016-11-02 20:16 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2016-11-10 07:51 - 2016-11-02 20:17 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2016-12-02 09:17 - 2016-12-01 12:11 - 02418280 _____ () C:\Program Files (x86)\Google\Chrome\Application\55.0.2883.75\libglesv2.dll
2016-12-02 09:17 - 2016-12-01 12:11 - 00105064 _____ () C:\Program Files (x86)\Google\Chrome\Application\55.0.2883.75\libegl.dll
2016-08-31 07:34 - 2016-08-31 07:34 - 00169064 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2016-08-31 07:34 - 2016-08-31 07:34 - 00482928 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2016-12-01 22:10 - 2016-12-01 22:10 - 03129808 _____ () C:\Program Files\AVAST Software\Avast\defs\16120100\algo.dll
2016-05-24 21:13 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2016-05-24 21:13 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2016-05-24 21:13 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2016-05-24 21:13 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2016-05-24 21:13 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2016-08-23 08:50 - 2016-08-23 08:50 - 01383616 _____ () C:\Users\stock\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\ClientTelemetry.dll
2016-08-23 08:51 - 2016-08-23 08:51 - 00118976 _____ () C:\Users\stock\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\FileSyncViews.dll
2016-07-01 08:51 - 2016-07-01 08:51 - 48936448 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 02144104 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtCore4.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 00341352 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtXml4.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 07955304 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtGui4.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 00028008 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QGif4.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 00127336 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QJpeg4.dll
2012-09-13 00:39 - 2012-09-13 00:39 - 00336232 _____ () C:\Program Files (x86)\Common Files\logishrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com
There are 7916 more sites.
IE trusted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\hola.org -> hxxp://hola.org
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\123simsen.com -> www.123simsen.com
There are 7916 more sites.
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2015-10-30 17:24 - 2016-12-02 11:58 - 00453396 ____R C:\WINDOWS\system32\Drivers\etc\hosts
0.0.0.1 mssplus.mcafee.com127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123haustiereundmehr.com
127.0.0.1 123moviedownload.com
127.0.0.1 www.123moviedownload.com
There are 15557 more lines.
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\stock\AppData\Local\Microsoft\BingDesktop\themes\2016-12-02.jpg
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
HKLM\...\StartupApproved\Run: => "BtServer"
HKLM\...\StartupApproved\Run32: => "PowerDVD14Agent"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [vm-monitoring-nb-session] => LPort=139
FirewallRules: [{F3CA351F-895D-4EF5-8C73-D14E0B9BBEC1}] => C:\Users\stock\AppData\Local\Temp\7zS54DE\hppiw.exe
FirewallRules: [{95C6C0F3-8F85-450F-A7F4-32BCD1130593}] => C:\Users\stock\AppData\Local\Temp\7zS54DE\hppiw.exe
FirewallRules: [{58AF624F-3BE2-4CDD-8A96-E5238DA93E84}] => C:\Users\stock\AppData\Local\Temp\7zS1776\HPDiagnosticCoreUI.exe
FirewallRules: [{C70B6F8D-EAF4-48B0-944C-1FB6824329C1}] => C:\Users\stock\AppData\Local\Temp\7zS1776\HPDiagnosticCoreUI.exe
FirewallRules: [{15085010-F520-4F4B-B30E-1A5DB6BFCF71}] => C:\Users\stock\AppData\Local\Temp\7zS021F\HPDiagnosticCoreUI.exe
FirewallRules: [{1DA69DA6-65F5-4A63-8165-A78FDDE0C787}] => C:\Users\stock\AppData\Local\Temp\7zS021F\HPDiagnosticCoreUI.exe
FirewallRules: [{87D9F119-42EB-46DC-93DB-51FB58CD97C8}] => C:\Program Files\HP\HP Deskjet 1510 series\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [{4DC30DC6-2C01-496D-B2F2-496DEF84F794}] => C:\Program Files\HP\HP Deskjet 1510 series\Bin\USBSetup.exe
FirewallRules: [{D69D7CC6-51DF-481C-99F7-F496C64B40FF}] => C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{87B9F87E-DEC1-441E-8DC7-CC03C83472EC}] => LPort=1900
FirewallRules: [{8D3D48D6-B731-46E6-ABD6-8062A054125E}] => LPort=2869
FirewallRules: [{71CCCF05-5BD6-4803-A259-E882DF1402B2}] => C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{302B4349-795B-47FD-B4CD-5ACAA0E68341}] => C:\Program Files (x86)\CyberLink\PowerDVD14\Movie\PowerDVD Cinema\PowerDVDCinema.exe
FirewallRules: [{9E145408-7440-4920-9370-1825A92435D4}] => C:\Program Files (x86)\CyberLink\PowerDVD14\Movie\PowerDVDMovie.exe
FirewallRules: [{DF8F0C10-1615-4022-A054-0D517ACA7A21}] => C:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14Agent.exe
FirewallRules: [{DCA196B5-C594-43BA-AA56-77FA1D2D12BD}] => C:\Program Files (x86)\CyberLink\PowerDVD14\Kernel\DMS\CLMSServerPDVD14.exe
FirewallRules: [{6A24C025-AF5B-4FE4-83FF-A7371BF893EE}] => C:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD.exe
FirewallRules: [{C52035F1-DDC7-4B70-BEB6-90891FE64966}] => c:\Program Files\CyberLink\PowerDirector12\PDR10.EXE
FirewallRules: [{7E3F1E80-BA38-40BF-9696-69692ABCBA2F}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{0CBE1825-F870-481F-8921-EBCB842B4884}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{2C4F3196-E21A-4F0B-BB3B-16725B29BD5B}] => C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{75B0F717-57E5-4FA9-9203-E21814CBDF22}] => C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{0EF3BD16-8466-4FD8-9574-01B8D5BACA5B}] => C:\Users\stock\AppData\Local\Temp\7zS0E0F\HPDiagnosticCoreUI.exe
FirewallRules: [{D1691CDB-B1BA-4703-8467-260B3AD6AD03}] => C:\Users\stock\AppData\Local\Temp\7zS0E0F\HPDiagnosticCoreUI.exe
FirewallRules: [{3E2F86CD-A6FA-458F-97CF-119C78EC5F59}] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service
==================== Restore Points =========================
01-12-2016 21:22:53 Restore Operation
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (12/02/2016 09:56:37 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "c:\program files\cyberlink\photodirector\kernel\ces\CES_AudioCacheAgent.exe.Manifest".
Dependent Assembly PDR.X,type="win32",version="1.0.0.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.
Error: (12/02/2016 09:56:36 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "c:\program files\cyberlink\photodirector\kernel\ces\CES_CacheAgent.exe.Manifest".
Dependent Assembly PDR.X,type="win32",version="1.0.0.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.
Error: (12/02/2016 07:26:30 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1594
Error: (12/02/2016 07:26:30 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1594
Error: (12/02/2016 07:26:30 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (12/02/2016 06:34:16 PM) (Source: HP Active Health) (EventID: 88) (User: )
Description: -- SECURITY WARNING -- ActiveHealthProperties.ini has been tampered with, resetting it
Error: (12/02/2016 12:10:52 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 9031
Error: (12/02/2016 12:10:52 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 9031
Error: (12/02/2016 12:10:52 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (12/02/2016 12:10:51 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 7516
System errors:
=============
Error: (12/02/2016 07:58:02 PM) (Source: DCOM) (EventID: 10016) (User: DESKTOP-G99A7OK)
Description: The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
and APPID
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
to the user DESKTOP-G99A7OK\stock SID (S-1-5-21-1283020984-1161487079-2240348159-1001) from address LocalHost (Using LRPC) running in the application container Microsoft.MicrosoftSolitaireCollection_3.12.11142.0_x64__8wekyb3d8bbwe SID (S-1-15-2-1985198343-3186790915-4047221937-1969271670-3792558349-1325541827-400269725). This security permission can be modified using the Component Services administrative tool.
Error: (12/02/2016 07:55:02 PM) (Source: Tcpip) (EventID: 4199) (User: )
Description: The system detected an address conflict for IP address 192.168.0.2 with the system
having network hardware address 00-1E-64-07-0E-8C. Network operations on this system may
be disrupted as a result.
Error: (12/02/2016 07:14:55 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (12/02/2016 06:31:49 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
and APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (12/02/2016 12:08:46 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (12/02/2016 10:53:59 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (12/02/2016 08:32:57 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (12/02/2016 08:15:12 AM) (Source: DCOM) (EventID: 10001) (User: DESKTOP-G99A7OK)
Description: Unable to start a DCOM Server: App.AppX85gcbw533amccd2rr8qswxymhfj649t2.mca as Unavailable/Unavailable. The error:
"15616"
Happened while starting this command:
"C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.9.251.0_x64__kzf8qxf38zg5c\SkypeHost.exe" -ServerName:SkypeHost.ServerServer
Error: (12/02/2016 08:10:03 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80073d02: Microsoft Solitaire Collection.
Error: (12/02/2016 07:33:37 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
and APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
==================== Memory info ===========================
Processor: Intel(R) Celeron(R) CPU N3050 @ 1.60GHz
Percentage of memory in use: 59%
Total physical RAM: 4017.36 MB
Available physical RAM: 1625 MB
Total Virtual: 5103.7 MB
Available Virtual: 1993.09 MB
==================== Drives ================================
Drive c: (Windows) (Fixed) (Total:912.03 GB) (Free:839.05 GB) NTFS
Drive d: (Recovery Image) (Fixed) (Total:18.2 GB) (Free:2.32 GB) NTFS ==>[system with boot components (obtained from drive)]
==================== MBR & Partition Table ==================
==================== End of Addition.txt ============================
Hola™ 1.17.142 - Better Internet <== needs to be uninstalled.
http://www.isthisfilesafe.com/company/Hola%20Networks%20Ltd._details.aspx
~~~~~~~~~~~~`
Running from C:\Users\stock\Downloads
It's best we move Farbar's to desktop.
Please go to your downloads folder, locate Farbar Recovery Scan Tool, right click and select CUT
Go to an open spot on your desktop, right click and select PASTE
You should now have Farbar Recovery Scan Tool on your desktop.
Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)
https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG
start
CreateRestorePoint:
CloseProcesses:
HKLM\...\Run: [hola] => C:\Program Files\Hola\app\hola.exe [2166376 2016-10-18] (Hola Networks Ltd.) <===== ATTENTION
HKLM-x32\...\Run: [] => [X]
Toolbar: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
R2 hola_svc; C:\Program Files\Hola\app\hola_svc.exe [5622376 2016-10-18] (Hola Networks Ltd.) <==== ATTENTION
R2 hola_updater; C:\Program Files\Hola\app\hola_updater.exe [5622376 2016-10-18] (Hola Networks Ltd.) <==== ATTENTION
C:\Program Files\Hola\app\hola_svc.exe
C:\Program Files\Hola\app\hola_updater.exe
C:\Program Files\Hola\app\hola.exe
C:\Users\stock\AppData\Local\Temp\{BE5A9AF0-2DD0-4789-9FB9-D59C6AC46193}-55.0.2883.75_chrome_installer.exe
ShortcutWithArgument: C:\Users\stock\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\45a4b0557a8c430b\Radioplayer.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=fcppdfelojakeahklfgkjegnpbgndoch
EmptyTemp:
Hosts:
End
Open FRST/FRST64 and press the > Fix < button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
~~~~~~~~~~~~~~~~`
http://i.imgur.com/BY4dvz9.png AdwCleaner
Please download AdwCleaner (http://www.bleepingcomputer.com/download/adwcleaner/dl/125/) and save the file to your Desktop.
In order to use AdwCleaner, you have to agree the Eula:
Right-click AdwCleaner.exe and select http://i.imgur.com/AVOiBNU.jpg Run as administrator to run the programme.
Follow the prompts.
Click http://i.imgur.com/A49sxPr.png Scan.
Upon completion, click http://i.imgur.com/6cyn5v5.png Logfile. A log (AdwCleaner[S1].txt) will open. Briefly check the log for anything you know to be legitimate.
Return to AdwCleaner. Ensure anything you know to be legitimate does not have a checkmark under the corresponding tab.
Click http://i.imgur.com/MqHawIb.png Clean.
Follow the prompts and allow your computer to reboot.
After the reboot, a log (AdwCleaner[C1].txt) will open. Copy the contents of the log and paste in your next reply.
-- File and folder backups are made for items removed using this programme. Should a legitimate file or folder be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the item. Please do not overly concern yourself with the contents of AdwCleaner[C1].txt.
~~~~
Please download Junkware Removal Tool (http://www.bleepingcomputer.com/download/junkware-removal-tool/)
or from here http://downloads.malwarebytes.org/file/jrt
to your desktop.
Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.
~~~
please post
Fixlog.txt
AdwCleaner[C1].txt
JRT.txt
Hi, thanks for all the help so far, I'm having a problem getting the FRST64.exe and FRST.txt to enter the Notepad, all items are on desktop but cut and paste also copy and paste do not appear to work , I can however drag and drop both FRST64.exe and FRST.txt into Notepad, but will that be OK also how I've been unable to rename the Notepad as fixlist.txt. Sorry!
# AdwCleaner v6.040 - Logfile created 03/12/2016 at 20:20:31
# Updated on 02/12/2016 by Malwarebytes
# Database : 2016-12-02.1 [Server]
# Operating System : Windows 10 Home (X64)
# Username : stock - DESKTOP-G99A7OK
# Running from : C:\Users\stock\Downloads\AdwCleaner.exe
# Mode: Clean
# Support : https://www.malwarebytes.com/support
***** [ Services ] *****
***** [ Folders ] *****
[-] Folder deleted: C:\Users\stock\AppData\Roaming\Hola
[-] Folder deleted: C:\Program Files\Hola
***** [ Files ] *****
***** [ DLL ] *****
***** [ WMI ] *****
***** [ Shortcuts ] *****
***** [ Scheduled Tasks ] *****
***** [ Registry ] *****
[-] Key deleted: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\Software\Classes\AppXrh6feys59dqfzsv9p3s9p6aep0hwtb23
[#] Key deleted on reboot: HKCU\Software\Classes\AppXrh6feys59dqfzsv9p3s9p6aep0hwtb23
[-] Key deleted: HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho
[-] Key deleted: HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho.1
[#] Key deleted on reboot: [x64] HKCU\Software\Classes\AppXrh6feys59dqfzsv9p3s9p6aep0hwtb23
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho.1
[-] Key deleted: HKU\.DEFAULT\Software\Hola
[#] Key deleted on reboot: HKU\S-1-5-18\Software\Hola
[-] Key deleted: [x64] HKLM\SOFTWARE\Hola
***** [ Web browsers ] *****
*************************
:: "Tracing" keys deleted
:: Winsock settings cleared
*************************
C:\AdwCleaner\AdwCleaner[C0].txt - [1587 Bytes] - [03/12/2016 20:20:31]
C:\AdwCleaner\AdwCleaner[S0].txt - [1818 Bytes] - [03/12/2016 20:15:37]
########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [1733 Bytes] ##########
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.9 (09.30.2016)
Operating System: Windows 10 Home x64
Ran by stock (Administrator) on Sat 03/12/2016 at 20:41:39.72
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
File System: 4
Successfully deleted: C:\Users\stock\AppData\Local\{3B925AA3-A13A-4822-9DEA-5DB87B631D64} (Empty Folder)
Successfully deleted: C:\Users\stock\AppData\Local\{3E5DEA14-7B0D-45A7-8B30-9F37901E75E2} (Empty Folder)
Successfully deleted: C:\Users\stock\AppData\Local\{8F31BED1-686C-488F-9A45-DF1EB4CEF7E1} (Empty Folder)
Successfully deleted: C:\WINDOWS\wininit.ini (File)
Registry: 0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sat 03/12/2016 at 20:49:40.20
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Hi, thanks for all the help so far, I'm having a problem getting the FRST64.exe and FRST.txt to enter the Notepad, all items are on desktop but cut and paste also copy and paste do not appear to work , I can however drag and drop both FRST64.exe and FRST.txt into Notepad, but will that be OK also how I've been unable to rename the Notepad as fixlist.txt. Sorry!
I don't think drag and drop to Notepad will work, of course you can try but it will probably error out.
Can you open a new blank Notepad?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Let's update and run a new scan with Malwarebytes Anti-Malware
Open Malwarebytes Anti-Malware
On the Dashboard click on Update Now
Go to the Setting Tab
Under Setting go to Detection and Protection
Under PUP and PUM make sure both are set to show Treat Detections as Malware
Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
Then on the Dashboard click on Scan
Make sure to select THREAT SCAN
Then click on Scan
Note: You may see the following message, "Could not load DDA driver". Click Yes, allow your PC to reboot and continue afterwards.
If threats are detected, click Remove Selected. If you are prompted to reboot, click Yes.
Upon completion of the scan (or after the reboot), click the History tab.
Click Application Logs, followed by the first Scan Log.
Click Export, followed by Copy to Clipboard. Paste the log in your next reply.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Please download Emsisoft Emergency Kit (http://dl.emsisoft.com/EmsisoftEmergencyKit.exe) and save it to your desktop.
Double click on the EmsisoftEmergencyKit file you downloaded to extract its contents and create a shortcut on the desktop.
Leave all settings as they are and click the Extract button at the bottom.
A folder named EEK will be created in the root of the drive (usually c:\).
After extraction please double-click on the new Start Emsisoft Emergency Kit icon on your desktop.
The first time you launch it, Emsisoft Emergency Kit will recommend that you allow it to download updates.
Please click Yes so that it downloads the latest database updates.
When the update process is complete, a new button will appear in the lower-left corner that says Back. Click on this button to return to the Overview screen.
Click on Scan to be taken to the scan options.
If you are asked if you want the scanner to scan for Potentially Unwanted Programs, then click Yes.
Click on the Malware Scan button to start the scan.
When the scan is completed click the Quarantine selected objects button. Note, this option is only available if malicious objects were detected during the scan.
When the threats have been quarantined, click the View report button in the lower-right corner, and the scan log will be opened in Notepad.
Please save the log in Notepad on your desktop, and copy it to your next reply.
When you close Emsisoft Emergency Kit, it will give you an option to sign up for a newsletter. This is optional, and is not necessary for the malware removal process.
~~~~~~~~~
Hi Juliet, The Malwarebytes checks were carried out as per your info the scan ran and found no threats, (I had in fact ran and quarantined some threats 2 days ago on Malwarebytes) now in Application Logs I have ticked the first scan box and I am offered to options Delete/Delete All as far as I can see there is no options to export and post to you.
Hi Juliet, I've downloaded the Emsisoft Emergency kit to desktop and it updated itself but there appears to be no back button in the bottom LH corner??
Hi Juliet, Yes I can download a new notepad as regards the getting FRST.exe and FRST.txt to enter , I still unable to copy/cut and paste from desktop to the new notepad, drag and drop will appear to work and show in the newly formed notepad but seems unable to be exported and posted on this tread.
let's try to use a shortcut
Hold down Ctrl and press C to copy. Right-click the item's destination and choose Paste.
Try clearing the Copy/Paste Cache. This is for the creation of a shortcut. But should work. Clear Clipboard shortcut - Create in Windows 10 - Windows 10 Forums (http://www.tenforums.com/tutorials/4326-clear-clipboard-shortcut-create-windows-10-a.html)
Hi Juliet you say lets create a shortcut, for "what" I'm completely lost as to what you are trying to achieve. I've tried push Ctrl and C for a shortcut but FRST.exe and FRST.txt are already on the Desktop, I did however get FRST.txt into a Notepad ,I right clicked and there was nothing about sending to destination, I clicked "select all' but was unable to send it anywhere.
I did however get FRST.txt into a Notepad
Ok
Did you set it or place it next to Farbar Recovery Scan Tool
https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG
Open FRST/FRST64 and press the > Fix < button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
Yes they are right next to one another on my desktop.
Open FRST/FRST64 and press the > Fix < button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
Nothing seems to be working for me regards FRST ,so what if I remove all the previous FRST downloads from my Desktop, and start again with a fresh FRST download?.
Nothing seems to be working for me regards FRST ,so what if I remove all the previous FRST downloads from my Desktop, and start again with a fresh FRST download?.
We'll try this
- Save ALL Tools to your Desktop-
All tools that I have you download should be placed on the desktop unless otherwise stated. If you are familiar with how to save files to the desktop then you can skip this step.
Since you are continuing with this step then I assume you are unfamiliar with saving files to your desktop. As a result it's easiest if you configure your browser(s) to download any tools to the desktop by default. Please use the appropriate instructions below depending on the browser you are using.
https://dl.dropboxusercontent.com/u/6063925/GeeksToGo/Icons/Chrome.JPGGoogle Chrome - Click the "Customize and control Google Chrome" button in the upper right-corner of the browser.https://dl.dropboxusercontent.com/u/6063925/GeeksToGo/Chrome/Settings.JPG Choose Settings. at the bottom of the screen click the
"Show advanced settings..." link. Scroll down to find the Downloads section and click the Change... button. Select your desktop and click OK.
https://dl.dropboxusercontent.com/u/6063925/GeeksToGo/Icons/Firefox.JPGMozilla Firefox - Click the "Open Menu" button in the upper right-corner of the browser. https://dl.dropboxusercontent.com/u/6063925/GeeksToGo/Firefox/Settings.JPG Choose Options. In the downloads section, click the Browse button, click on the Desktop folder
and the click the "Select Folder" button. Click OK to get out of the Options menu.
https://dl.dropboxusercontent.com/u/6063925/GeeksToGo/Icons/IE.jpgInternet Explorer - Click the Tools menu in the upper right-corner of the browser. https://dl.dropboxusercontent.com/u/6063925/GeeksToGo/IE/Tools.JPG Select View downloads. Select the Options link in the lower left of the window. Click Browse and
select the Desktop and then choose the Select Folder button. Click OK to get out of the download options screen and then click Close to get out of the View Downloads screen.
NOTE: IE8 Does not support changing download locations in this manner. You will need to download the tool(s) to the default folder, usually Downloads, then copy them to the desktop.
~~~
FRST (Farbar Recovery Scan Tool) should be on desktop, right click on that and send it to the recycle bin.
Now we'll download a fresh version.
~~~~
Please download Farbar Recovery Scan Tool (x32) (http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/) or Farbar Recovery Scan Tool (x64) (http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/) and save the file to your Desktop.
Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.
Don't run it now I just want the tool ready, we'll place the fixlist.txt next to it then click on the FIX button to run it.
Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)
https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG
start
CreateRestorePoint:
CloseProcesses:
HKLM\...\Run: [hola] => C:\Program Files\Hola\app\hola.exe [2166376 2016-10-18] (Hola Networks Ltd.) <===== ATTENTION
HKLM-x32\...\Run: [] => [X]
Toolbar: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
R2 hola_svc; C:\Program Files\Hola\app\hola_svc.exe [5622376 2016-10-18] (Hola Networks Ltd.) <==== ATTENTION
R2 hola_updater; C:\Program Files\Hola\app\hola_updater.exe [5622376 2016-10-18] (Hola Networks Ltd.) <==== ATTENTION
C:\Program Files\Hola\app\hola_svc.exe
C:\Program Files\Hola\app\hola_updater.exe
C:\Program Files\Hola\app\hola.exe
C:\Users\stock\AppData\Local\Temp\{BE5A9AF0-2DD0-4789-9FB9-D59C6AC46193}-55.0.2883.75_chrome_installer.exe
ShortcutWithArgument: C:\Users\stock\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\45a4b0557a8c430b\Radioplayer.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=fcppdfelojakeahklfgkjegnpbgndoch
EmptyTemp:
Hosts:
End
Open FRST/FRST64 and press the > Fix < button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
Hi Juliet I'm even more confused than before I selected Mozilla for my downloads and followed the instructions exactly until I got to "Select Folder" where it said now click OK, but where is the OK button there was no sign of it on my page ?.
First, let's check Firefox and make sure you have the most current version.
Open Firefox, next click on the https://dl.dropboxusercontent.com/u/6063925/GeeksToGo/Firefox/Settings.JPG upper right corner.
scroll all the way down to where you see a question mark, click on that, then next scroll down the window that opens and click on About Firefox.
This will show you if you need to update.
Open Mozilla Firefox again - Click the "Open Menu" button in the upper right-corner of the browser. https://dl.dropboxusercontent.com/u/6063925/GeeksToGo/Firefox/Settings.JPG Choose Options.
Next you should be on the General page
scroll down to Downloads click the button Save files to
then click on the Browse button and then locate Desktop.
Then you can close out of that window and all downloads/files should be saved to desktop
Hi Juliet Now I have Mozilla Updated to Version 50.0.2 and downloads are selected to go to desktop, the FRST.exe is showing on desktop. The previous FRST attempts are in the Recycle bin and its been emptied. I've noticed as a matter of interest that if you remove Adblock devices (Which I did have installed notably Adblock Plus,Adblock Ultimate
and Adguard) and of any persuasion from Mozilla on Yahoo7 homepage the "Connected to s.yimg.com" on the bottom LH corner disappears. What now please?
/in
Update to my last message Re Adblock devices and there influence on removal of s.yimg.com, Please disregard as my observations were based on the first logon on the day where everything appeared back to normal so being adventurous I decided to add Adblock (I tried all of them) and thats where the trouble reappeared, now the wheel keeps circyling top LH corner and "Connected to s.yimg.com" come and goes . Thanks for all your help thus far!.
I nownotice
Were you able to run the fixlist.txt?
~~~
Adblock Plus, Once you have installed it, click on it and choose Filter Preferences. At the bottom
UNcheck Allow Some Non-intrusive Advertising.
~~
there should be an option to also remove acceptable ads - make sure you tell it you don't want any ads.
https://adblockplus.org/en/acceptable-ads
Hi Juliet Regards the Adblock plus I found the box and unticked it for "allow some unobtrusive advertising" and on saying that I've just gone back there and found its been reticked by something or someone.I have now ran the FRST and its produced two (2) Notepads i.e FRST.txt and Additial.txt ,they are with tool FRST64.exe in close proximity on my desktop. What do I do now to achieve a fixlist.txt?.
Please download Emsisoft Emergency Kit (http://dl.emsisoft.com/EmsisoftEmergencyKit.exe) and save it to your desktop.
Double click on the EmsisoftEmergencyKit file you downloaded to extract its contents and create a shortcut on the desktop.
Leave all settings as they are and click the Extract button at the bottom.
A folder named EEK will be created in the root of the drive (usually c:\).
After extraction please double-click on the new Start Emsisoft Emergency Kit icon on your desktop.
The first time you launch it, Emsisoft Emergency Kit will recommend that you allow it to download updates.
Please click Yes so that it downloads the latest database updates.
When the update process is complete, a new button will appear in the lower-left corner that says Back. Click on this button to return to the Overview screen.
Click on Scan to be taken to the scan options.
If you are asked if you want the scanner to scan for Potentially Unwanted Programs, then click Yes.
Click on the Malware Scan button to start the scan.
When the scan is completed click the Quarantine selected objects button. Note, this option is only available if malicious objects were detected during the scan.
When the threats have been quarantined, click the View report button in the lower-right corner, and the scan log will be opened in Notepad.
Please save the log in Notepad on your desktop, and copy it to your next reply.
When you close Emsisoft Emergency Kit, it will give you an option to sign up for a newsletter. This is optional, and is not necessary for the malware removal process.
Hi Juliet I have downloaded the Emsisoft Emergency Kit which I installed and left a download named Start Emergency Kit Scanner.exe in downloads C:Drive which I cut and pasted to Desktop under Emsisoft Emergency Kit, So now I have Both the Emsisoft Kit and Scanner one upon the other on Desktop however when I click on the Emergency Scanner I get window "User Account Control" asking "Do you want to allow changes to your device", I have clicked "Yes" unfortunately nothing happens. I have done this several times and waited but still nothing appear to occur ?
Something went wrong somewhere.
Download Zemana AntiMalware (https://www.zemana.com/Download/AntiMalware/Setup/Free/Zemana.AntiMalware.Setup.exe):
open the program and without changing any options, press Scan
after the scan is finished, if threats are detected press Next to remove them
Note: If restart is required to finish the cleaning process, you should click Reboot. If reboot isn't required, please restart your computer manually.
open Zemana AntiMalware again and locate the latest report
please paste the contents into your reply.
========================
Zemana AntiMalware 2.70.2.25 (Installed)
-------------------------------------------------------
Scan Result : Completed
Scan Date : 2016/12/8
Operating System : Windows 10 64-bit
Processor : 2X Intel(R) Celeron(R) CPU N3050 @ 1.60GHz
BIOS Mode : UEFI
CUID : 126E4C4E5146E54B7E6DA6
Scan Type : System Scan
Duration : 9m 6s
Scanned Objects : 66566
Detected Objects : 2
Excluded Objects : 0
Read Level : SCSI
Auto Upload : Enabled
Detect All Extensions : Disabled
Scan Documents : Disabled
Domain Info : WORKGROUP,0,2
Detected Objects
-------------------------------------------------------
Chrome Shortcut
Status : Scanned
Object : --app-id=fcppdfelojakeahklfgkjegnpbgndoch
MD5 : -
Publisher : -
Size : -
Version : -
Detection : Suspicious Browser Setting
Cleaning Action : Repair
Related Objects :
Browser Setting - Chrome Shortcut
Yahoo Mail Hide Ad Panel
Status : Scanned
Object : %appdata%\mozilla\firefox\profiles\whawyrn4.default-1478817956913\extensions\{c37bac34-849a-4d28-be41-549b2c76c64e}.xpi
MD5 : 2EF76B682455C93E9672540E1B6CDAA2
Publisher : -
Size : 22014
Version : -
Detection : PUA.FirefoxExt!Gr
Cleaning Action : Repair
Related Objects :
Browser Extension - Yahoo Mail Hide Ad Panel
File - %appdata%\mozilla\firefox\profiles\whawyrn4.default-1478817956913\extensions\{c37bac34-849a-4d28-be41-549b2c76c64e}.xpi
Cleaning Result
-------------------------------------------------------
Cleaned : 2
Reported as safe : 0
Failed : 0
it appears to have taken out 2 items related to Yahoo
Extension ID: {c37bac34-849a-4d28-be41-549b2c76c64e}. Name: Yahoo Mail Hide Ad Panel.
How is the computer now?
Hi Juliet Much, Much better so far no sign of the dreaded "Connected to s.yimg.com". Thanks for all your help!
You don't know how glad I am to hear this.
I think we're ready to remove tools and quarantine folders?
Hi Juliet It (s.yimg.com) came back again on my Desktop first thing this morning only on Yahoo7 which is my home page, however if I disable Adblock plus, it works normally. Unfortunately it has now appeared on Laptop so last night I downloaded and ran Zemana AntiMalware on the laptop it found a heap of stuff associated with Google Chrome and some trojans all of which it cleaned/quarantined but no mention of the dreaded s.yimg.com. So with your permission I'd like to run all the treads "Removal of s.yimg.com on my laptop, what do reckon?
Hi Juliet Do you want me to go ahead and remove all the tools and files I/We have created on Desktop?
s.yimg is actually part of Yahoo, s.yimg.com is a domain owned and operated by Yahoo, Yahoo Mail phone app
When using AdBlock it's blocking part of Yahoo as designed but, it's actually not malicious.
https://www.bleepingcomputer.com/forums/t/575540/what-is-yimgcom/
For the computer we just worked on
Please download DelFix (http://general-changelog-team.fr/en/downloads/finish/20-outils-de-xplode/9-delfix) or from Here (http://www.bleepingcomputer.com/download/delfix/) and save the file to your Desktop.
Double-click DelFix.exe to run the programme.
Place a checkmark next to the following items:
Activate UAC
Remove disinfection tools
Click the Run button.
-- This will remove the specialized tools we used to disinfect your system.
Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).
****************
~~~~~
For the other computer....
Unfortunately it has now appeared on Laptop so last night I downloaded and ran Zemana AntiMalware on the laptop it found a heap of stuff associated with Google Chrome and some trojans all of which it cleaned/quarantined but no mention of the dreaded s.yimg.com. So with your permission I'd like to run all the treads "Removal of s.yimg.com on my laptop, what do reckon?
Now, for your Laptop
Make sure you set downloads to install on desktop
http://i.imgur.com/xlK5Hdb.png Farbar Recovery Scan Tool (FRST) Scan
Please download Farbar Recovery Scan Tool (x32) (http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/) or Farbar Recovery Scan Tool (x64) (http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/) and save the file to your Desktop.
Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.
Right-Click FRST.exe / FRST64.exe and select http://i.imgur.com/AVOiBNU.jpg Run as administrator to run the programme.
Click Yes to the disclaimer.
Ensure the Addition.txt box is checked.
Click the Scan button and let the programme run.
Upon completion, click OK, then OK on the Addition.txt pop up screen.
Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply.
Hi Juliet Here is the FRST txt'sScan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 07-12-2016
Ran by Nigel (administrator) on AVRILANDNIGENOT (10-12-2016 11:31:18)
Running from C:\Users\Nigel\Downloads
Loaded Profiles: Nigel (Available Profiles: Nigel & DefaultAppPool)
Platform: Windows 10 Home Version 1607 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\BCA\pabeSvc64.exe
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(McAfee, Inc.) C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler64.exe
(McAfee, Inc.) C:\Program Files\TrueKey\McTkSchedulerService.exe
(Zemana Ltd.) C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(AlcorMicro Co., Ltd.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
() C:\Windows\PLFSetI.exe
(Zemana Ltd.) C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe
(© 2015 Microsoft Corporation) C:\Users\Nigel\AppData\Local\Microsoft\BingSvc\BingSvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Google, Inc) C:\Users\Nigel\AppData\Local\Programs\Google\Google Photos Backup\Google Photos Backup.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.11.427\SSScheduler.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.EXE
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe
() C:\Program Files (x86)\Hostless Modem\Telstra USB+Wi-Fi\CheckNDISPort_df.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.9.261.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
==================== Registry (Whitelisted) ====================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13885696 2015-06-24] (Realtek Semiconductor)
HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)
HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [320000 2009-04-09] (AlcorMicro Co., Ltd.)
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [828960 2009-08-06] (Acer Incorporated)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2012-06-29] ()
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3935912 2015-08-06] (Synaptics Incorporated)
HKLM\...\Run: [ZAM] => C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe [13915888 2016-11-22] (Zemana Ltd.)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [825864 2009-08-17] (Dritek System Inc.)
HKLM-x32\...\Run: [RemoteControl8] => C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe [91432 2009-04-16] (CyberLink Corp.)
HKLM-x32\...\Run: [PDVD8LanguageShortcut] => C:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe [50472 2009-04-16] (CyberLink Corp.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [CheckNDISPort_df] => C:\Program Files (x86)\Hostless Modem\Telstra USB+Wi-Fi\CheckNDISPort_df.exe [442696 2012-09-21] ()
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4127488 2015-06-16] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [BingDesktop] => C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe [2369248 2015-07-21] (Microsoft Corp.)
HKLM-x32\...\Run: [AvgUi] => "C:\Program Files (x86)\AVG\Framework\Common\avguirnx.exe" /lps=fmw
HKLM-x32\...\Run: [OV3_Monitor] => C:\Program Files (x86)\OLYMPUS\OLYMPUS Viewer 3\FirstStart.exe [40472 2015-11-04] (Olympus Corporation)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [9080768 2016-11-24] (AVAST Software)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-09-22] (Oracle Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\Run: [BingSvc] => C:\Users\Nigel\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2015-11-12] (© 2015 Microsoft Corporation)
HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [5915776 2016-03-21] (Safer-Networking Ltd.)
HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\Run: [OV3_Monitor] => C:\Program Files (x86)\OLYMPUS\OLYMPUS Viewer 3\OV3Monitor.exe [415768 2015-11-04] (Olympus Corporation)
HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\Run: [Google Update] => C:\Users\Nigel\AppData\Local\Google\Update\GoogleUpdate.exe [153752 2016-09-11] (Google Inc.)
HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\Run: [Google Photos Backup] => C:\Users\Nigel\AppData\Local\Programs\Google\Google Photos Backup\Google Photos Backup.exe [3790936 2016-04-09] (Google, Inc)
HKU\S-1-5-21-4116000945-235673462-3313673197-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\WLXPGSS.SCR [322248 2014-03-31] (Microsoft Corporation)
Lsa: [Notification Packages] scecli C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => No File
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => No File
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2016-09-11] (AVAST Software)
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Acer VCM.lnk [2009-08-20]
ShortcutTarget: Acer VCM.lnk -> C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe (Acer Incorporated)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2016-11-29]
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.427\SSScheduler.exe (McAfee, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{2FCE2750-CD22-4D0C-9D14-BF5F0D1E1AAB}: [DhcpNameServer] 192.168.9.1 192.168.9.1
Tcpip\..\Interfaces\{8243e958-5c29-4b35-8ed2-7cc9b2f4df69}: [NameServer] 61.8.0.113,210.23.129.34
Tcpip\..\Interfaces\{8243e958-5c29-4b35-8ed2-7cc9b2f4df69}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{B7E4C052-531B-4694-9DA1-86D220B0682C}: [DhcpNameServer] 192.168.0.1 192.168.0.1
Tcpip\..\Interfaces\{D6888746-2980-4D8F-B4E2-20FB33893D3B}: [DhcpNameServer] 192.168.9.1 192.168.9.1
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\S-1-5-21-4116000945-235673462-3313673197-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/en-au/?ocid=U143DHP&pfr=1
SearchScopes: HKLM-x32 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKLM-x32 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKU\S-1-5-21-4116000945-235673462-3313673197-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=U313DF&PC=U313&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-4116000945-235673462-3313673197-1000 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKU\S-1-5-21-4116000945-235673462-3313673197-1000 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
BHO: Expat Shield Class -> {3706EE7C-3CAD-445D-8A43-03EBC3B75908} -> No File
BHO: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus64.dll [2015-09-22] (Eyeo GmbH)
BHO-x32: True Key Helper -> {0F4B8786-5502-4803-8EBC-F652A1153BB6} -> C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll [2016-07-15] (Intel Security)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\ssv.dll [2016-12-02] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\jp2ssv.dll [2016-12-02] (Oracle Corporation)
BHO-x32: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll [2015-09-22] (Eyeo GmbH)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Toolbar: HKLM-x32 - True Key - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll [2016-07-15] (Intel Security)
Toolbar: HKU\S-1-5-21-4116000945-235673462-3313673197-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKU\S-1-5-21-4116000945-235673462-3313673197-1000 -> No Name - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2016-09-23] (Skype Technologies)
FireFox:
========
FF DefaultProfile: z69ot8oc.default
FF ProfilePath: C:\Users\Nigel\AppData\Roaming\TomTom\HOME\Profiles\z9a5dup9.default [2015-08-10]
FF Extension: (Emulator) - C:\Users\Nigel\AppData\Roaming\TomTom\HOME\Profiles\z9a5dup9.default\Extensions\Navcore.9.430.890926@tomtom.com [2012-10-08] [not signed]
FF Extension: (Emulator) - C:\Users\Nigel\AppData\Roaming\TomTom\HOME\Profiles\z9a5dup9.default\Extensions\Navcore.9.510.1234792@tomtom.com [2014-06-12] [not signed]
FF Extension: (No Name) - C:\Program Files (x86)\TomTom HOME 2\xul\extensions\MapShare-status@tomtom.com [not found]
FF ProfilePath: C:\Users\Nigel\AppData\Roaming\Mozilla\Firefox\Profiles\z69ot8oc.default [2016-12-10]
FF Homepage: Mozilla\Firefox\Profiles\z69ot8oc.default -> hxxp://www.msn.com/?pc=U143&ocid=U143DHP&osmkt=en-au
hxxps://au.yahoo.com/#
FF Extension: (Adblock Plus) - C:\Users\Nigel\AppData\Roaming\Mozilla\Firefox\Profiles\z69ot8oc.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-12-07]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: (Avast Online Security) - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-09-11]
FF HKLM\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF Extension: (Avast SafePrice) - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2016-09-11]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF HKLM-x32\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_23_0_0_207.dll [2016-11-26] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWoW64\Macromed\Flash\NPSWF32_23_0_0_207.dll [2016-11-26] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2016-10-06] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.111.2 -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\dtplugin\npDeployJava1.dll [2016-12-02] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.111.2 -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\plugin2\npjp2.dll [2016-12-02] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-30] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-30] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-10-01] (Adobe Systems Inc.)
FF Plugin HKU\.DEFAULT: @hola.org/FlashPlayer -> C:\Users\Nigel\AppData\Local\Hola\firefox_hola\app\flash\NPSWF32_18_0_0_232.dll [2015-11-09] ()
FF Plugin HKU\.DEFAULT: @hola.org/vlc -> C:\Users\Nigel\AppData\Local\Hola\firefox_hola\app\vlc\npvlc.dll [2015-11-09] (Hola)
FF Plugin HKU\S-1-5-21-4116000945-235673462-3313673197-1000: @hola.org/FlashPlayer -> C:\Users\Nigel\AppData\Local\Hola\firefox_hola\app\flash\NPSWF32_18_0_0_232.dll [2015-11-09] ()
FF Plugin HKU\S-1-5-21-4116000945-235673462-3313673197-1000: @hola.org/vlc -> C:\Users\Nigel\AppData\Local\Hola\firefox_hola\app\vlc\npvlc.dll [2015-11-09] (Hola)
FF Plugin HKU\S-1-5-21-4116000945-235673462-3313673197-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Nigel\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [No File]
FF Plugin HKU\S-1-5-21-4116000945-235673462-3313673197-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Nigel\AppData\Local\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-09-11] (Google Inc.)
FF Plugin HKU\S-1-5-21-4116000945-235673462-3313673197-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Nigel\AppData\Local\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-09-11] (Google Inc.)
FF Plugin HKU\S-1-5-21-4116000945-235673462-3313673197-1000: SkypePlugin -> C:\Users\Nigel\AppData\Local\SkypePlugin\7.26.0.48\npGatewayNpapi.dll [2016-09-22] (Skype Technologies S.A.)
FF Plugin HKU\S-1-5-21-4116000945-235673462-3313673197-1000: SkypePlugin64 -> C:\Users\Nigel\AppData\Local\SkypePlugin\7.26.0.48\npGatewayNpapi-x64.dll [2016-09-22] (Skype Technologies S.A.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2016-10-01] (Adobe Systems Inc.)
Chrome:
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> msn.com/?pc=__PARAM__&ocid=__PARAM__DHP&osmkt=en-us
CHR StartupUrls: Default -> "hxxp://www.nine.com.au/"
CHR DefaultSearchKeyword: Default -> google.com.au_
CHR Profile: C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default [2016-12-10]
CHR Extension: (TV) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\beobeededemalmllhkmnkinmfembdimh [2015-11-26]
CHR Extension: (YouTube) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-25]
CHR Extension: (X-notifier (for Gmail™,Hotmail,Yahoo,AOL...)) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\cdfjbkbddpfnoplfhceolpopfoepleco [2016-11-25]
CHR Extension: (Adblock Plus) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-11-28]
CHR Extension: (Google Search) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-25]
CHR Extension: (Fahrenheit Celsius) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejfdmibdakgahpjamigfcdlogfcilohl [2016-09-03]
CHR Extension: (Avast SafePrice) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2016-11-16]
CHR Extension: (Radioplayer) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\fcppdfelojakeahklfgkjegnpbgndoch [2015-11-25]
CHR Extension: (Google Sheets) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-11-25]
CHR Extension: (TV - Voozy.tv) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\flnepcgaapadgbmfkmacafjiejjhbipm [2015-11-25]
CHR Extension: (Quick Javascript Switcher) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\geddoclleiomckbhadiaipdggiiccfje [2016-01-09]
CHR Extension: (Google Docs Offline) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-17]
CHR Extension: (Avast Online Security) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2016-11-12]
CHR Extension: (Google Maps) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\lneaknkopdijkpnocmklfnjbeapigfbh [2015-11-25]
CHR Extension: (Office Online) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndjpnladcallmjemlbaebfadecfhkepb [2016-10-13]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-10]
CHR Extension: (Hola - Unlimited Proxy VPN) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\opalpjjboefohnelaemnhdhlceibbcgl [2016-01-20]
CHR Extension: (Gmail) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-11-25]
CHR Extension: (Chrome Media Router) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-10-15]
CHR HKU\S-1-5-21-4116000945-235673462-3313673197-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Nigel\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx <not found>
CHR HKU\S-1-5-21-4116000945-235673462-3313673197-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [fcfenmboojpjinhpgggodefccipikbpd] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-4116000945-235673462-3313673197-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [197128 2016-09-11] (AVAST Software)
R2 BcmBtRSupport; C:\WINDOWS\system32\BtwRSupportService.exe [2255064 2015-10-20] (Broadcom Corporation.)
S2 BingDesktopUpdate; C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [173792 2015-07-21] (Microsoft Corp.)
R2 IntelBCAsvc; C:\Program Files\Intel\BCA\pabeSvc64.exe [3026584 2016-05-06] (Intel(R) Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.427\McCHSvc.exe [329480 2016-10-13] (McAfee, Inc.)
R2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [253952 2009-07-10] (Acer Incorporated) [File not signed]
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1750712 2015-06-16] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [4088608 2016-09-21] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [235984 2016-11-24] (Safer-Networking Ltd.)
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [237736 2015-08-06] (Synaptics Incorporated)
R2 TrueKey; C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe [908256 2016-07-22] (McAfee, Inc.)
R2 TrueKeyScheduler; C:\Program Files\TrueKey\McTkSchedulerService.exe [15736 2016-07-22] (McAfee, Inc.)
S3 TrueKeyServiceHelper; C:\Program Files\TrueKey\McAfee.TrueKey.ServiceHelper.exe [86864 2016-07-22] (McAfee, Inc.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)
R2 ZAMSvc; C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe [13915888 2016-11-22] (Zemana Ltd.)
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 aswHwid; C:\WINDOWS\system32\drivers\aswHwid.sys [37656 2016-09-11] (AVAST Software)
R1 aswKbd; C:\WINDOWS\system32\drivers\aswKbd.sys [37144 2016-09-11] (AVAST Software)
R2 aswMonFlt; C:\WINDOWS\system32\drivers\aswMonFlt.sys [108816 2016-09-11] (AVAST Software)
R1 aswRdr; C:\WINDOWS\system32\drivers\aswRdr2.sys [103064 2016-09-11] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [74544 2016-09-11] (AVAST Software)
R1 aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [969184 2016-09-17] (AVAST Software)
R1 aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [513632 2016-09-27] (AVAST Software)
R2 aswStm; C:\WINDOWS\system32\drivers\aswStm.sys [163416 2016-09-11] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [293352 2016-11-01] (AVAST Software)
R3 bcbtums; C:\WINDOWS\system32\drivers\bcbtums.sys [170712 2015-10-20] (Broadcom Corporation.)
S1 HssDRV6; C:\WINDOWS\System32\DRIVERS\hssdrv6.sys [44648 2015-06-04] (AnchorFree Inc.)
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
S3 NETw1v64; C:\WINDOWS\System32\DRIVERS\NETw1v64.sys [7058432 2009-07-20] (Intel Corporation) [File not signed]
R3 SmbDrvI; C:\WINDOWS\system32\DRIVERS\Smb_driver_Intel.sys [33960 2015-08-06] (Synaptics Incorporated)
S3 taphss6; C:\WINDOWS\System32\drivers\taphss6.sys [42088 2015-06-04] (Anchorfree Inc.)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
R1 ZAM; C:\WINDOWS\System32\drivers\zam64.sys [203680 2016-12-08] (Zemana Ltd.)
R1 ZAM_Guard; C:\WINDOWS\System32\drivers\zamguard64.sys [203680 2016-12-08] (Zemana Ltd.)
U3 idsvc; no ImagePath
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-12-10 11:31 - 2016-12-10 11:33 - 00027997 _____ C:\Users\Nigel\Downloads\FRST.txt
2016-12-10 11:24 - 2016-12-10 11:31 - 00000000 ____D C:\FRST
2016-12-10 11:22 - 2016-12-10 11:23 - 02420224 _____ (Farbar) C:\Users\Nigel\Downloads\FRST64.exe
2016-12-10 11:20 - 2016-12-10 11:21 - 01761792 _____ (Farbar) C:\Users\Nigel\Desktop\FRST.exe
2016-12-10 10:34 - 2016-12-10 10:37 - 02559864 _____ (Microsoft Corporation) C:\Users\Nigel\Downloads\DefaultPack (4).EXE
2016-12-10 10:21 - 2016-12-10 10:21 - 00000000 ___RD C:\Users\Nigel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD 8
2016-12-08 21:18 - 2016-12-10 11:32 - 00174629 _____ C:\WINDOWS\ZAM.krnl.trace
2016-12-08 21:18 - 2016-12-10 11:32 - 00162511 _____ C:\WINDOWS\ZAM_Guard.krnl.trace
2016-12-08 21:18 - 2016-12-08 21:18 - 00203680 _____ (Zemana Ltd.) C:\WINDOWS\system32\Drivers\zamguard64.sys
2016-12-08 21:18 - 2016-12-08 21:18 - 00203680 _____ (Zemana Ltd.) C:\WINDOWS\system32\Drivers\zam64.sys
2016-12-08 21:18 - 2016-12-08 21:18 - 00001221 _____ C:\Users\Public\Desktop\Zemana AntiMalware.lnk
2016-12-08 21:18 - 2016-12-08 21:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zemana AntiMalware
2016-12-08 21:18 - 2016-12-08 21:18 - 00000000 ____D C:\Program Files (x86)\Zemana AntiMalware
2016-12-08 21:17 - 2016-12-08 21:17 - 00000000 ____D C:\Users\Nigel\AppData\Local\Zemana
2016-12-08 21:16 - 2016-12-08 21:17 - 05431336 _____ ( ) C:\Users\Nigel\Downloads\Zemana.AntiMalware.Setup(1).exe
2016-12-08 21:10 - 2016-12-08 21:11 - 05431336 _____ ( ) C:\Users\Nigel\Downloads\Zemana.AntiMalware.Setup.exe
2016-12-07 10:48 - 2016-12-07 10:48 - 00001232 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-12-07 10:48 - 2016-12-07 10:48 - 00001220 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2016-12-07 10:48 - 2016-12-07 10:48 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-12-07 10:40 - 2016-12-07 10:40 - 00243552 _____ C:\Users\Nigel\Downloads\Firefox Setup Stub 50.0.2 (2).exe
2016-12-07 10:31 - 2016-12-07 10:31 - 00243552 _____ C:\Users\Nigel\Downloads\Firefox Setup Stub 50.0.2 (1).exe
2016-12-07 10:20 - 2016-12-07 10:20 - 00243552 _____ C:\Users\Nigel\Downloads\Firefox Setup Stub 50.0.2.exe
2016-12-02 22:18 - 2016-11-29 10:34 - 00452469 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20161202-221826.backup
2016-12-02 11:47 - 2016-12-02 11:48 - 00737344 _____ (Oracle Corporation) C:\Users\Nigel\Downloads\JavaSetup8u111 (4).exe
2016-12-02 11:46 - 2016-12-02 11:47 - 00737344 _____ (Oracle Corporation) C:\Users\Nigel\Downloads\JavaSetup8u111 (3).exe
2016-12-02 11:32 - 2016-12-02 11:32 - 00737344 _____ (Oracle Corporation) C:\Users\Nigel\Downloads\JavaSetup8u111 (2).exe
2016-12-02 11:31 - 2016-12-02 11:31 - 00737344 _____ (Oracle Corporation) C:\Users\Nigel\Downloads\JavaSetup8u111 (1).exe
2016-12-02 11:30 - 2016-12-02 11:31 - 00737344 _____ (Oracle Corporation) C:\Users\Nigel\Downloads\JavaSetup8u111.exe
2016-11-29 10:34 - 2016-11-29 10:34 - 00002013 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2016-11-29 10:34 - 2016-11-29 10:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
2016-11-29 10:33 - 2016-11-29 10:34 - 00000000 ____D C:\Program Files\McAfee Security Scan
2016-11-27 11:12 - 2016-11-27 11:12 - 00002348 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-11-27 11:12 - 2016-11-27 11:12 - 00002336 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-11-27 11:10 - 2016-11-27 11:10 - 01065376 _____ (Google Inc.) C:\Users\Nigel\Downloads\ChromeSetup (9).exe
2016-11-27 10:57 - 2016-11-27 10:57 - 01065376 _____ (Google Inc.) C:\Users\Nigel\Downloads\ChromeSetup (8).exe
2016-11-26 14:30 - 2016-12-10 11:13 - 00000000 ____D C:\Users\Nigel\AppData\LocalLow\Mozilla
2016-11-26 14:29 - 2016-12-07 10:48 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-11-21 11:38 - 2016-11-21 11:38 - 00002225 _____ C:\Users\Public\Desktop\Google Earth.lnk
2016-11-21 11:37 - 2016-11-21 11:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
2016-11-20 20:44 - 2016-11-02 22:01 - 00315744 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2016-11-20 20:44 - 2016-11-02 21:13 - 00773720 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll
2016-11-20 20:44 - 2016-11-02 21:12 - 00376672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys
2016-11-20 20:44 - 2016-11-02 21:10 - 02323728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll
2016-11-20 20:44 - 2016-11-02 21:09 - 02257104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2016-11-20 20:44 - 2016-11-02 21:08 - 00576408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2016-11-20 20:44 - 2016-11-02 21:08 - 00186424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\weretw.dll
2016-11-20 20:44 - 2016-11-02 21:05 - 00959112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2016-11-20 20:44 - 2016-11-02 21:02 - 00682816 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2016-11-20 20:44 - 2016-11-02 21:02 - 00238056 _____ (Microsoft Corporation) C:\WINDOWS\system32\weretw.dll
2016-11-20 20:44 - 2016-11-02 21:01 - 01263856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2016-11-20 20:44 - 2016-11-02 21:01 - 00545936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2016-11-20 20:44 - 2016-11-02 21:00 - 08156080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2016-11-20 20:44 - 2016-11-02 21:00 - 01274712 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2016-11-20 20:44 - 2016-11-02 20:49 - 00037376 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2016-11-20 20:44 - 2016-11-02 20:47 - 00047104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Shell.Search.UriHandler.dll
2016-11-20 20:44 - 2016-11-02 20:46 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininetlui.dll
2016-11-20 20:44 - 2016-11-02 20:39 - 00348672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\zipfldr.dll
2016-11-20 20:44 - 2016-11-02 20:33 - 12349952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2016-11-20 20:44 - 2016-11-02 20:33 - 03307520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2016-11-20 20:44 - 2016-11-02 20:31 - 00226304 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcTok.exe
2016-11-20 20:44 - 2016-11-02 20:31 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSpkg.dll
2016-11-20 20:44 - 2016-11-02 20:30 - 00109056 _____ (Microsoft Corporation) C:\WINDOWS\system32\dab.dll
2016-11-20 20:44 - 2016-11-02 20:30 - 00058880 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Shell.Search.UriHandler.dll
2016-11-20 20:44 - 2016-11-02 20:29 - 00884224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2016-11-20 20:44 - 2016-11-02 20:29 - 00336896 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkBindingEngineMigPlugin.dll
2016-11-20 20:44 - 2016-11-02 20:29 - 00122368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NPSM.dll
2016-11-20 20:44 - 2016-11-02 20:28 - 04423680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll
2016-11-20 20:44 - 2016-11-02 20:28 - 00566784 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActionCenterCPL.dll
2016-11-20 20:44 - 2016-11-02 20:28 - 00432128 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpAXHolder.dll
2016-11-20 20:44 - 2016-11-02 20:28 - 00252928 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll
2016-11-20 20:44 - 2016-11-02 20:28 - 00109568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\chartv.dll
2016-11-20 20:44 - 2016-11-02 20:27 - 01388544 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Cred.dll
2016-11-20 20:44 - 2016-11-02 20:26 - 00712192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Search.dll
2016-11-20 20:44 - 2016-11-02 20:26 - 00579072 _____ (Microsoft Corporation) C:\WINDOWS\system32\ddraw.dll
2016-11-20 20:44 - 2016-11-02 20:26 - 00278016 _____ (Microsoft Corporation) C:\WINDOWS\system32\netplwiz.dll
2016-11-20 20:44 - 2016-11-02 20:23 - 00101888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bowser.sys
2016-11-20 20:44 - 2016-11-02 20:22 - 13441024 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
2016-11-20 20:44 - 2016-11-02 20:22 - 00369664 _____ (Microsoft Corporation) C:\WINDOWS\system32\msinfo32.exe
2016-11-20 20:44 - 2016-11-02 20:19 - 00089088 _____ (Microsoft Corporation) C:\WINDOWS\system32\asycfilt.dll
2016-11-20 20:44 - 2016-11-02 20:18 - 00836608 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcRefreshTask.dll
2016-11-20 20:44 - 2016-11-02 20:17 - 00909824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Search.dll
2016-11-20 20:44 - 2016-11-02 20:16 - 01359360 _____ (Microsoft Corporation) C:\WINDOWS\system32\usercpl.dll
2016-11-20 20:44 - 2016-11-02 20:16 - 00308736 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActionCenter.dll
2016-11-20 20:44 - 2016-11-02 18:20 - 00446896 _____ C:\WINDOWS\system32\ApnDatabase.xml
2016-11-20 20:43 - 2016-11-02 22:01 - 00484584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2016-11-20 20:43 - 2016-11-02 21:22 - 01570672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2016-11-20 20:43 - 2016-11-02 21:20 - 00590960 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2016-11-20 20:43 - 2016-11-02 21:13 - 01883784 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2016-11-20 20:43 - 2016-11-02 21:12 - 02255712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2016-11-20 20:43 - 2016-11-02 21:12 - 00341344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2016-11-20 20:43 - 2016-11-02 21:05 - 06657176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2016-11-20 20:43 - 2016-11-02 21:05 - 03892352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2016-11-20 20:43 - 2016-11-02 21:05 - 00951904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll
2016-11-20 20:43 - 2016-11-02 21:05 - 00405856 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2016-11-20 20:43 - 2016-11-02 21:04 - 04312248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2016-11-20 20:43 - 2016-11-02 21:03 - 00714592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2016-11-20 20:43 - 2016-11-02 21:00 - 00534096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2016-11-20 20:43 - 2016-11-02 20:59 - 04673304 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2016-11-20 20:43 - 2016-11-02 20:50 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LaunchWinApp.exe
2016-11-20 20:43 - 2016-11-02 20:49 - 00147968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32k.sys
2016-11-20 20:43 - 2016-11-02 20:44 - 00180224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe
2016-11-20 20:43 - 2016-11-02 20:44 - 00089088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AuthExt.dll
2016-11-20 20:43 - 2016-11-02 20:43 - 00557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StoreAgent.dll
2016-11-20 20:43 - 2016-11-02 20:42 - 00632832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sud.dll
2016-11-20 20:43 - 2016-11-02 20:42 - 00506880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DevicePairing.dll
2016-11-20 20:43 - 2016-11-02 20:42 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgentUserBroker.exe
2016-11-20 20:43 - 2016-11-02 20:40 - 00896512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontext.dll
2016-11-20 20:43 - 2016-11-02 20:38 - 22563840 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2016-11-20 20:43 - 2016-11-02 20:38 - 00760832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\appwiz.cpl
2016-11-20 20:43 - 2016-11-02 20:36 - 07626752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2016-11-20 20:43 - 2016-11-02 20:34 - 00043008 _____ (Microsoft Corporation) C:\WINDOWS\system32\LaunchWinApp.exe
2016-11-20 20:43 - 2016-11-02 20:32 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\system32\efsext.dll
2016-11-20 20:43 - 2016-11-02 20:31 - 01228288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usercpl.dll
2016-11-20 20:43 - 2016-11-02 20:31 - 00097792 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll
2016-11-20 20:43 - 2016-11-02 20:30 - 09131008 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2016-11-20 20:43 - 2016-11-02 20:30 - 00567296 _____ (Microsoft Corporation) C:\WINDOWS\system32\DevicePairing.dll
2016-11-20 20:43 - 2016-11-02 20:29 - 07469056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2016-11-20 20:43 - 2016-11-02 20:28 - 00411136 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCenter.dll
2016-11-20 20:43 - 2016-11-02 20:28 - 00324608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll
2016-11-20 20:43 - 2016-11-02 20:28 - 00274432 _____ (Microsoft Corporation) C:\WINDOWS\system32\ListSvc.dll
2016-11-20 20:43 - 2016-11-02 20:28 - 00240640 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkDesktopSettings.dll
2016-11-20 20:43 - 2016-11-02 20:28 - 00115200 _____ (Microsoft Corporation) C:\WINDOWS\system32\IdCtrls.dll
2016-11-20 20:43 - 2016-11-02 20:27 - 23677952 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2016-11-20 20:43 - 2016-11-02 20:27 - 02458112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\themecpl.dll
2016-11-20 20:43 - 2016-11-02 20:27 - 00631296 _____ (Microsoft Corporation) C:\WINDOWS\system32\WlanMediaManager.dll
2016-11-20 20:43 - 2016-11-02 20:27 - 00580608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hgcpl.dll
2016-11-20 20:43 - 2016-11-02 20:27 - 00545792 _____ (Microsoft Corporation) C:\WINDOWS\system32\timedate.cpl
2016-11-20 20:43 - 2016-11-02 20:27 - 00495104 _____ (Microsoft Corporation) C:\WINDOWS\system32\DataSenseHandlers.dll
2016-11-20 20:43 - 2016-11-02 20:27 - 00422400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.dll
2016-11-20 20:43 - 2016-11-02 20:26 - 02747392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll
2016-11-20 20:43 - 2016-11-02 20:26 - 02484736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gameux.dll
2016-11-20 20:43 - 2016-11-02 20:26 - 00912896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comdlg32.dll
2016-11-20 20:43 - 2016-11-02 20:26 - 00388608 _____ (Microsoft Corporation) C:\WINDOWS\system32\zipfldr.dll
2016-11-20 20:43 - 2016-11-02 20:26 - 00358912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\stobject.dll
2016-11-20 20:43 - 2016-11-02 20:26 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll
2016-11-20 20:43 - 2016-11-02 20:25 - 02998272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2016-11-20 20:43 - 2016-11-02 20:25 - 01556480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll
2016-11-20 20:43 - 2016-11-02 20:25 - 00655872 _____ (Microsoft Corporation) C:\WINDOWS\system32\sud.dll
2016-11-20 20:43 - 2016-11-02 20:25 - 00496128 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettings.UserAccountsHandlers.dll
2016-11-20 20:43 - 2016-11-02 20:24 - 00940032 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontext.dll
2016-11-20 20:43 - 2016-11-02 20:23 - 03106304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstsc.exe
2016-11-20 20:43 - 2016-11-02 20:23 - 02104320 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidsvc.dll
2016-11-20 20:43 - 2016-11-02 20:22 - 04749312 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2016-11-20 20:43 - 2016-11-02 20:22 - 00337920 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2016-11-20 20:43 - 2016-11-02 20:21 - 00942080 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2016-11-20 20:43 - 2016-11-02 20:19 - 00981504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.OnlineId.dll
2016-11-20 20:43 - 2016-11-02 20:19 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\NPSM.dll
2016-11-20 20:43 - 2016-11-02 20:19 - 00130560 _____ (Microsoft Corporation) C:\WINDOWS\system32\chartv.dll
2016-11-20 20:43 - 2016-11-02 20:18 - 00991232 _____ (Microsoft Corporation) C:\WINDOWS\system32\comdlg32.dll
2016-11-20 20:43 - 2016-11-02 20:17 - 01282048 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2016-11-20 20:43 - 2016-11-02 20:17 - 00828416 _____ (Microsoft Corporation) C:\WINDOWS\system32\appwiz.cpl
2016-11-20 20:43 - 2016-11-02 20:17 - 00389632 _____ (Microsoft Corporation) C:\WINDOWS\system32\stobject.dll
2016-11-20 20:43 - 2016-11-02 20:16 - 03400192 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncCenter.dll
2016-11-20 20:43 - 2016-11-02 20:16 - 03133440 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll
2016-11-20 20:43 - 2016-11-02 20:16 - 02512384 _____ (Microsoft Corporation) C:\WINDOWS\system32\themecpl.dll
2016-11-20 20:43 - 2016-11-02 20:16 - 00881664 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2016-11-20 20:43 - 2016-11-02 20:16 - 00629248 _____ (Microsoft Corporation) C:\WINDOWS\system32\hgcpl.dll
2016-11-20 20:43 - 2016-11-02 20:15 - 02611200 _____ (Microsoft Corporation) C:\WINDOWS\system32\gameux.dll
2016-11-20 20:43 - 2016-11-02 20:15 - 00483328 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.dll
2016-11-20 20:43 - 2016-11-02 20:14 - 01726976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll
2016-11-20 20:42 - 2016-11-02 21:22 - 00601712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll
2016-11-20 20:42 - 2016-11-02 21:13 - 00423776 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifitask.exe
2016-11-20 20:42 - 2016-11-02 21:08 - 00602464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupEngine.dll
2016-11-20 20:42 - 2016-11-02 21:08 - 00111968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupApi.dll
2016-11-20 20:42 - 2016-11-02 21:03 - 02750936 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2016-11-20 20:42 - 2016-11-02 21:01 - 01425000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d9.dll
2016-11-20 20:42 - 2016-11-02 21:01 - 01415744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2016-11-20 20:42 - 2016-11-02 21:01 - 00276832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\input.dll
2016-11-20 20:42 - 2016-11-02 21:00 - 22223968 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2016-11-20 20:42 - 2016-11-02 20:48 - 00095232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TSpkg.dll
2016-11-20 20:42 - 2016-11-02 20:43 - 00270336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2016-11-20 20:42 - 2016-11-02 20:42 - 00549376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActionCenterCPL.dll
2016-11-20 20:42 - 2016-11-02 20:42 - 00306176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieproxy.dll
2016-11-20 20:42 - 2016-11-02 20:40 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\indexeddbserver.dll
2016-11-20 20:42 - 2016-11-02 20:39 - 00465920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LockAppBroker.dll
2016-11-20 20:42 - 2016-11-02 20:39 - 00236544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIAnimation.dll
2016-11-20 20:42 - 2016-11-02 20:37 - 19415040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2016-11-20 20:42 - 2016-11-02 20:36 - 19415552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2016-11-20 20:42 - 2016-11-02 20:31 - 03196416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdp.dll
2016-11-20 20:42 - 2016-11-02 20:31 - 00159232 _____ (Microsoft Corporation) C:\WINDOWS\system32\ACPBackgroundManagerPolicy.dll
2016-11-20 20:42 - 2016-11-02 20:31 - 00090624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll
2016-11-20 20:42 - 2016-11-02 20:30 - 12175360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2016-11-20 20:42 - 2016-11-02 20:30 - 00363520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BioFeedback.dll
2016-11-20 20:42 - 2016-11-02 20:30 - 00321536 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2016-11-20 20:42 - 2016-11-02 20:29 - 03666432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2016-11-20 20:42 - 2016-11-02 20:29 - 01247232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll
2016-11-20 20:42 - 2016-11-02 20:29 - 00296960 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsensorgroup.dll
2016-11-20 20:42 - 2016-11-02 20:28 - 06044160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2016-11-20 20:42 - 2016-11-02 20:28 - 00807424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.OnlineId.dll
2016-11-20 20:42 - 2016-11-02 20:28 - 00690176 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieproxy.dll
2016-11-20 20:42 - 2016-11-02 20:28 - 00279552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.HumanInterfaceDevice.dll
2016-11-20 20:42 - 2016-11-02 20:28 - 00079360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\asycfilt.dll
2016-11-20 20:42 - 2016-11-02 20:27 - 00605184 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvr.exe
2016-11-20 20:42 - 2016-11-02 20:27 - 00261632 _____ (Microsoft Corporation) C:\WINDOWS\system32\indexeddbserver.dll
2016-11-20 20:42 - 2016-11-02 20:26 - 01509376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2016-11-20 20:42 - 2016-11-02 20:25 - 00956416 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2016-11-20 20:42 - 2016-11-02 20:23 - 00072704 _____ (Microsoft Corporation) C:\WINDOWS\system32\ErrorDetailsUpdate.dll
2016-11-20 20:42 - 2016-11-02 20:22 - 13081600 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2016-11-20 20:42 - 2016-11-02 20:21 - 05111296 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdp.dll
2016-11-20 20:42 - 2016-11-02 20:20 - 02273792 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2016-11-20 20:42 - 2016-11-02 20:19 - 08127488 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2016-11-20 20:42 - 2016-11-02 20:19 - 08075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2016-11-20 20:42 - 2016-11-02 20:19 - 01586176 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll
2016-11-20 20:42 - 2016-11-02 20:19 - 00805888 _____ (Microsoft Corporation) C:\WINDOWS\system32\FrameServer.dll
2016-11-20 20:42 - 2016-11-02 20:18 - 01690112 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2016-11-20 20:42 - 2016-11-02 20:17 - 04746752 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2016-11-20 20:42 - 2016-11-02 20:17 - 00982528 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2016-11-20 20:42 - 2016-11-02 20:16 - 02688512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll
2016-11-20 20:42 - 2016-11-02 20:16 - 02669056 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2016-11-20 20:42 - 2016-11-02 20:16 - 01779712 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2016-11-20 20:42 - 2016-11-02 20:16 - 01637888 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2016-11-20 20:42 - 2016-11-02 20:16 - 00770560 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll
2016-11-20 20:42 - 2016-11-02 20:16 - 00579072 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppBroker.dll
2016-11-20 20:42 - 2016-11-02 20:15 - 04708864 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExplorerFrame.dll
2016-11-20 20:42 - 2016-11-02 20:15 - 01513472 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2016-11-20 20:42 - 2016-11-02 20:15 - 01348608 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll
2016-11-20 20:42 - 2016-11-02 20:15 - 00842240 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntshrui.dll
2016-11-20 20:42 - 2016-11-02 20:13 - 03496960 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVidCtl.dll
2016-11-20 20:42 - 2016-11-02 20:13 - 03299840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstsc.exe
2016-11-20 20:41 - 2016-11-02 21:20 - 00378720 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2016-11-20 20:41 - 2016-11-02 21:15 - 01051112 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2016-11-20 20:41 - 2016-11-02 21:15 - 00894096 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2016-11-20 20:41 - 2016-11-02 21:14 - 07816544 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2016-11-20 20:41 - 2016-11-02 21:13 - 01354320 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2016-11-20 20:41 - 2016-11-02 21:13 - 01173496 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2016-11-20 20:41 - 2016-11-02 21:05 - 20969928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2016-11-20 20:41 - 2016-11-02 21:04 - 02678056 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll
2016-11-20 20:41 - 2016-11-02 21:04 - 00596832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comctl32.dll
2016-11-20 20:41 - 2016-11-02 21:02 - 00848736 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupEngine.dll
2016-11-20 20:41 - 2016-11-02 21:02 - 00148832 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupApi.dll
2016-11-20 20:41 - 2016-11-02 21:01 - 00092512 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2016-11-20 20:41 - 2016-11-02 21:00 - 04130432 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2016-11-20 20:41 - 2016-11-02 21:00 - 01061968 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll
2016-11-20 20:41 - 2016-11-02 20:56 - 01609920 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d9.dll
2016-11-20 20:41 - 2016-11-02 20:56 - 01572768 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2016-11-20 20:41 - 2016-11-02 20:56 - 01418312 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2016-11-20 20:41 - 2016-11-02 20:56 - 00628552 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2016-11-20 20:41 - 2016-11-02 20:56 - 00322912 _____ (Microsoft Corporation) C:\WINDOWS\system32\input.dll
2016-11-20 20:41 - 2016-11-02 20:55 - 00048992 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\iorate.sys
2016-11-20 20:41 - 2016-11-02 20:48 - 00081408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2016-11-20 20:41 - 2016-11-02 20:48 - 00032768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\efsext.dll
2016-11-20 20:41 - 2016-11-02 20:47 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BlockedShutdown.dll
2016-11-20 20:41 - 2016-11-02 20:47 - 00156672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BcastDVRHelper.dll
2016-11-20 20:41 - 2016-11-02 20:46 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppCapture.dll
2016-11-20 20:41 - 2016-11-02 20:45 - 00492032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcastdvr.exe
2016-11-20 20:41 - 2016-11-02 20:45 - 00253952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BioFeedback.dll
2016-11-20 20:41 - 2016-11-02 20:45 - 00182784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsensorgroup.dll
2016-11-20 20:41 - 2016-11-02 20:44 - 00231936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll
2016-11-20 20:41 - 2016-11-02 20:43 - 00731136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d8.dll
2016-11-20 20:41 - 2016-11-02 20:43 - 00198144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FSClient.dll
2016-11-20 20:41 - 2016-11-02 20:43 - 00126464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2016-11-20 20:41 - 2016-11-02 20:42 - 00866816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Cred.dll
2016-11-20 20:41 - 2016-11-02 20:42 - 00202752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.HumanInterfaceDevice.dll
2016-11-20 20:41 - 2016-11-02 20:41 - 00635904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2016-11-20 20:41 - 2016-11-02 20:40 - 00548352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ddraw.dll
2016-11-20 20:41 - 2016-11-02 20:36 - 00063488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ErrorDetailsUpdate.dll
2016-11-20 20:41 - 2016-11-02 20:35 - 00336896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msinfo32.exe
2016-11-20 20:41 - 2016-11-02 20:34 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\system32\microsoft-windows-system-events.dll
2016-11-20 20:41 - 2016-11-02 20:33 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2016-11-20 20:41 - 2016-11-02 20:32 - 00045056 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2016-11-20 20:41 - 2016-11-02 20:31 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\system32\BcastDVRHelper.dll
2016-11-20 20:41 - 2016-11-02 20:31 - 00170496 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppCapture.dll
2016-11-20 20:41 - 2016-11-02 20:31 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininetlui.dll
2016-11-20 20:41 - 2016-11-02 20:30 - 00635904 _____ (Microsoft Corporation) C:\WINDOWS\system32\FlightSettings.dll
2016-11-20 20:41 - 2016-11-02 20:30 - 00134144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ErrorDetails.dll
2016-11-20 20:41 - 2016-11-02 20:29 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BlockedShutdown.dll
2016-11-20 20:41 - 2016-11-02 20:29 - 00314880 _____ (Microsoft Corporation) C:\WINDOWS\system32\FSClient.dll
2016-11-20 20:41 - 2016-11-02 20:29 - 00276992 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2016-11-20 20:41 - 2016-11-02 20:29 - 00211968 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe
2016-11-20 20:41 - 2016-11-02 20:29 - 00139264 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2016-11-20 20:41 - 2016-11-02 20:28 - 00748544 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll
2016-11-20 20:41 - 2016-11-02 20:28 - 00321024 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkUXBroker.dll
2016-11-20 20:41 - 2016-11-02 20:28 - 00260608 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgentUserBroker.exe
2016-11-20 20:41 - 2016-11-02 20:28 - 00088576 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2016-11-20 20:41 - 2016-11-02 20:26 - 01880576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll
2016-11-20 20:41 - 2016-11-02 20:26 - 01595392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2016-11-20 20:41 - 2016-11-02 20:26 - 00798208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2016-11-20 20:41 - 2016-11-02 20:26 - 00273920 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIAnimation.dll
2016-11-20 20:41 - 2016-11-02 20:25 - 02256384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2016-11-20 20:41 - 2016-11-02 20:25 - 00772608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntshrui.dll
2016-11-20 20:41 - 2016-11-02 20:25 - 00541696 _____ (Microsoft Corporation) C:\WINDOWS\system32\ipnathlp.dll
2016-11-20 20:41 - 2016-11-02 20:24 - 03778560 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2016-11-20 20:41 - 2016-11-02 20:23 - 02356736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVidCtl.dll
2016-11-20 20:41 - 2016-11-02 20:23 - 00199680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GlobCollationHost.dll
2016-11-20 20:41 - 2016-11-02 20:20 - 00167936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ErrorDetails.dll
2016-11-20 20:41 - 2016-11-02 20:18 - 00243712 _____ (Microsoft Corporation) C:\WINDOWS\system32\shdocvw.dll
2016-11-20 20:41 - 2016-11-02 20:16 - 04148736 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2016-11-20 20:41 - 2016-11-02 20:16 - 01490944 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2016-11-20 20:41 - 2016-11-02 20:16 - 00265728 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupSvc.dll
2016-11-20 20:41 - 2016-11-02 20:15 - 03616768 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2016-11-20 20:41 - 2016-11-02 20:13 - 00322048 _____ (Microsoft Corporation) C:\WINDOWS\system32\GlobCollationHost.dll
2016-11-20 20:41 - 2016-11-02 19:11 - 00788624 _____ C:\WINDOWS\SysWOW64\locale.nls
2016-11-20 20:41 - 2016-11-02 19:11 - 00788624 _____ C:\WINDOWS\system32\locale.nls
2016-11-20 20:41 - 2016-08-02 14:30 - 00822784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-12-10 10:39 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-12-10 10:38 - 2016-07-16 21:47 - 00000000 ___HD C:\Program Files\WindowsApps
2016-12-08 21:48 - 2015-07-28 18:59 - 00000258 __RSH C:\ProgramData\ntuser.pol
2016-12-08 21:18 - 2016-10-04 23:08 - 00000000 ____D C:\Users\Nigel
2016-12-05 10:31 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\system32\NDF
2016-12-04 10:55 - 2016-10-05 00:18 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-12-04 10:55 - 2016-10-04 22:58 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2016-12-03 11:25 - 2016-04-09 09:42 - 00000892 _____ C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job
2016-12-03 11:25 - 2013-06-01 16:31 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2016-12-03 11:20 - 2016-07-16 21:45 - 00000000 ____D C:\WINDOWS\INF
2016-12-02 19:05 - 2014-05-22 21:30 - 00000000 ____D C:\Users\Nigel\AppData\Local\Packages
2016-12-02 18:40 - 2015-08-06 21:12 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2016-12-02 12:16 - 2016-04-21 08:42 - 00000000 ____D C:\Users\Nigel\AppData\Local\tkdata
2016-12-02 12:13 - 2013-09-22 18:38 - 00000000 ____D C:\ProgramData\Oracle
2016-12-02 12:12 - 2014-10-17 17:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2016-12-02 12:12 - 2013-09-22 18:36 - 00000000 ____D C:\Program Files (x86)\Java
2016-12-02 12:00 - 2016-05-03 21:28 - 00097856 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2016-12-02 11:40 - 2014-06-19 09:35 - 00000000 ____D C:\Users\Nigel\AppData\Local\Adobe
2016-12-02 11:39 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed
2016-12-02 11:39 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\system32\Macromed
2016-11-30 21:12 - 2016-10-05 16:49 - 00000000 ____D C:\Windows.old
2016-11-30 20:38 - 2015-09-08 09:10 - 00000000 ____D C:\Users\Public\Downloads\Maps
2016-11-30 10:57 - 2013-04-29 21:06 - 00000000 ____D C:\ProgramData\Yahoo!
2016-11-30 10:57 - 2013-04-29 21:00 - 00000000 ____D C:\Program Files (x86)\Yahoo!
2016-11-27 10:31 - 2015-08-06 09:48 - 00000000 ____D C:\Users\Nigel\AppData\Local\Publishers
2016-11-26 20:01 - 2012-11-06 14:38 - 00003326 _____ C:\WINDOWS\wininit.ini
2016-11-26 16:29 - 2014-06-23 21:53 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2016-11-24 10:47 - 2015-08-06 09:44 - 00000000 __RHD C:\Users\Public\AccountPictures
2016-11-24 10:42 - 2016-10-04 22:58 - 00267136 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2016-11-24 10:40 - 2016-07-16 16:04 - 00786432 _____ C:\WINDOWS\system32\config\BBI
2016-11-24 10:38 - 2016-07-16 21:47 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2016-11-24 10:38 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2016-11-24 10:38 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\system32\oobe
2016-11-24 10:38 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\system32\migwiz
2016-11-24 10:38 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\ShellExperiences
2016-11-24 10:38 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\bcastdvr
2016-11-24 10:32 - 2016-10-05 00:18 - 00004018 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player PPAPI Notifier
2016-11-23 22:33 - 2013-08-14 08:38 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-11-23 22:13 - 2012-06-29 11:45 - 141011376 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-11-23 22:10 - 2016-07-16 21:36 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-11-23 11:32 - 2012-08-29 09:48 - 00000000 ____D C:\Users\Nigel\AppData\Roaming\Skype
2016-11-23 11:17 - 2012-08-29 09:47 - 00000000 ____D C:\ProgramData\Skype
2016-11-23 11:16 - 2014-06-06 21:08 - 00000000 ___RD C:\Program Files (x86)\Skype
2016-11-21 11:37 - 2009-08-20 15:38 - 00000000 ____D C:\Program Files (x86)\Google
2016-11-21 11:20 - 2012-06-29 12:47 - 00000000 ____D C:\Users\Nigel\AppData\Local\Google
2016-11-16 11:42 - 2016-10-04 23:06 - 01103758 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-11-15 21:38 - 2016-01-20 16:22 - 00000000 ___HD C:\WINDOWS\AxInstSV
2016-11-11 10:16 - 2016-02-28 20:38 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-11-11 10:13 - 2016-10-05 00:18 - 00004562 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
==================== Files in the root of some directories =======
2014-05-22 11:41 - 2014-05-22 11:41 - 6103040 _____ () C:\Program Files (x86)\GUT2D95.tmp
2015-02-05 15:23 - 2015-02-05 15:23 - 6103040 _____ () C:\Program Files (x86)\GUT7CBF.tmp
2014-09-15 21:59 - 2014-09-15 22:04 - 6010880 _____ () C:\Program Files (x86)\GUT7DD7.tmp
2009-08-20 15:17 - 2009-02-11 05:23 - 0192484 _____ () C:\Program Files (x86)\Common Files\Acer GameZone online.ico
2015-09-25 20:59 - 2015-09-25 21:00 - 0013088 _____ () C:\Users\Nigel\AppData\Local\HWVendorDetection.log
2014-12-12 19:02 - 2014-12-12 19:14 - 0006089 _____ () C:\Users\Nigel\AppData\Local\MyWinLockerInstaller.txt-20141212.log
2015-08-16 22:21 - 2015-08-16 22:21 - 0000017 _____ () C:\Users\Nigel\AppData\Local\resmon.resmoncfg
2014-02-03 18:09 - 2014-02-03 17:55 - 0104448 _____ () C:\Users\Nigel\AppData\Local\Web Data
2015-10-19 18:42 - 2015-10-19 18:42 - 0000000 _____ () C:\Users\Nigel\AppData\Local\{76C6879A-3328-4562-ACF0-045591FB2DF0}
2016-09-08 21:11 - 2016-09-08 21:11 - 0000000 _____ () C:\Users\Nigel\AppData\Local\{B24D55FB-15A9-4F27-9676-79376512B41F}
2016-10-04 23:02 - 2016-10-04 23:02 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2014-07-24 21:17 - 2014-07-24 21:17 - 0000282 _____ () C:\ProgramData\fontcacheev1.dat
2009-08-20 15:17 - 2009-07-18 11:57 - 0036136 _____ (Oberon Media) C:\ProgramData\FullRemove.exe
Files to move or delete:
====================
C:\ProgramData\fontcacheev1.dat
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2016-11-30 21:11
==================== End of FRST.txt ============================Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-12-2016
Ran by Nigel (10-12-2016 11:36:19)
Running from C:\Users\Nigel\Downloads
Windows 10 Home Version 1607 (X64) (2016-10-04 14:27:41)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-4116000945-235673462-3313673197-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-4116000945-235673462-3313673197-503 - Limited - Disabled)
Guest (S-1-5-21-4116000945-235673462-3313673197-501 - Limited - Disabled)
Nigel (S-1-5-21-4116000945-235673462-3313673197-1000 - Administrator - Enabled) => C:\Users\Nigel
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Avast Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Spybot - Search and Destroy (Disabled - Out of date) {A16C3F68-9280-E053-1818-342707FECF4D}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avast Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Acer Crystal Eye webcam Ver:1.1.95.714 (HKLM-x32\...\{D0ACE89D-EC7F-470F-80BE-4C98ED366B32}) (Version: 1.1.95.714 - Chicony Electronics Co.,Ltd.)
Acer ePower Management (HKLM-x32\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 4.05.3002 - Acer Incorporated)
Acer eRecovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3002 - Acer Incorporated)
Acer GameZone Console (HKLM-x32\...\{8ed9688e-4f79-4308-91ca-f1c37ca142b4}_is1) (Version: 5.1.0.2 - Oberon Media, Inc.)
Acer GridVista (HKLM-x32\...\GridVista) (Version: 3.01.0730 - Acer Inc.)
Acer ScreenSaver (HKLM-x32\...\Acer Screensaver) (Version: 1.06.0804 - Acer Incorporated)
Acer Updater (HKLM-x32\...\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.01.3014 - Acer Incorporated)
Acer VCM (HKLM-x32\...\{047F790A-7A2A-4B6A-AD02-38092BA63DAC}) (Version: 4.05.3000 - Acer Incorporated)
Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adblock Plus for IE (32-bit and 64-bit) (HKLM\...\{0F347A49-E36C-4639-8D2E-003AD408B8B2}) (Version: 1.5 - Eyeo GmbH)
Adblock Plus for IE (HKLM-x32\...\{fd97d1e2-368a-4cd9-af63-8eeff938044a}) (Version: 1.1 - )
Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.020.20042 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 23.0.0.257 - Adobe Systems Incorporated)
Adobe Flash Player 23 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 23.0.0.207 - Adobe Systems Incorporated)
Adobe Flash Player 23 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 23.0.0.207 - Adobe Systems Incorporated)
Alcor Micro USB Card Reader (HKLM-x32\...\InstallShield_{5A22D889-FBDD-4AE8-86EC-089D45FC133E}) (Version: 1.2.17.05001 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (x32 Version: 1.2.17.05001 - Alcor Micro Corp.) Hidden
Alice Greenfingers (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}) (Version: - Oberon Media)
Amazonia (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11273477}) (Version: - Oberon Media)
Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{2EF5D87E-B7BD-458F-8428-E4D0B8B4E65C}) (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 12.3.2280 - AVAST Software)
Bing Bar (HKLM-x32\...\{449CE12D-E2C7-4B97-B19E-55D163EA9435}) (Version: 7.0.619.0 - Microsoft Corporation)
Bing Desktop (HKLM-x32\...\{7D095455-D971-4D4C-9EFD-9AF6A6584F3A}) (Version: 1.3.475.0 - Microsoft Corporation)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Chicken Invaders 2 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110209593}) (Version: - Oberon Media)
Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
CyberLink PowerDVD 8 (HKLM-x32\...\InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}) (Version: 8.1.2815o.50 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dairy Dash (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115053100}) (Version: - Oberon Media)
Dream Day First Home (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113832110}) (Version: - Oberon Media)
eSobi v2 (HKLM-x32\...\InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}) (Version: 2.0.4.000274 - esobi Inc.)
eSobi v2 (x32 Version: 2.0.4.000274 - esobi Inc.) Hidden
Facebook Video Calling 1.2.0.287 (HKLM-x32\...\{B92C5909-1D37-4C51-8397-A28BB28E5DC3}) (Version: 1.2.287 - Skype Limited)
Farm Frenzy 2 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11531173}) (Version: - Oberon Media)
Foxtel GO (HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\Foxtel GO 1.84) (Version: 1.84 - Foxtel)
Foxtel GO (x32 Version: 1.84 - Foxtel) Hidden
Free FreeCell Solitaire 2016 v3.1 (HKLM-x32\...\Free FreeCell Solitaire_is1) (Version: - TreeCardGames)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 54.0.2840.99 - Google Inc.)
Google Earth (HKLM-x32\...\{A0C18B96-AB79-46BD-8321-6FA83E6D25B9}) (Version: 7.1.7.2606 - Google)
Google Photos Backup (HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\Google Photos Backup) (Version: 1.1.2.13 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.31.5 - Google Inc.) Hidden
Granny In Paradise (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110551697}) (Version: - Oberon Media)
Heroes of Hellas (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113786380}) (Version: - Oberon Media)
Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3001 - Acer Incorporated)
Intel Security True Key (HKLM\...\TrueKey) (Version: 4.4.135.1 - Intel Security)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1892 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - Intel Corporation)
Java 8 Update 111 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180111F0}) (Version: 8.0.1110.14 - Oracle Corporation)
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Launch Manager (HKLM-x32\...\LManager) (Version: 3.0.02 - Acer Inc.)
Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.11.427.2 - McAfee, Inc.)
Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\...\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM-x32\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50901.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Works (HKLM-x32\...\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}) (Version: 9.7.0621 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 50.0.2 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 50.0.2 (x86 en-US)) (Version: 50.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 50.0.2 - Mozilla)
MSXML 4.0 SP2 Parser and SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
NavDesk 7.50 (HKLM-x32\...\{AB756389-9A03-44f3-ABAF-3699C01B4868}-Navman-7.50) (Version: 7.50.0112.135 - Navman Technology NZ Limited)
OLYMPUS Digital Camera Updater (HKLM-x32\...\{392427E9-9FA4-4CD2-99EB-FD53A12BDCDA}) (Version: 1.2.1 - Olympus Corporation)
OLYMPUS Viewer 3 (HKLM-x32\...\{0CE3A5C0-9544-4CE0-8AFD-8562CD9E5913}) (Version: 2.0.0 - Olympus Corporation)
Radioplayer (HKLM-x32\...\com.radioplayer.launcher.radioplayerlauncher) (Version: 1.2.386 - UK Radioplayer Ltd)
Radioplayer (x32 Version: 1.2.386 - UK Radioplayer Ltd) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7535 - Realtek Semiconductor Corp.)
SafeZone Stable 1.51.2220.62 (x32 Version: 1.51.2220.62 - Avast Software) Hidden
Skype Click to Call (HKLM-x32\...\{873F8E7C-10E6-449F-BD7E-5FBA7C8E1C9B}) (Version: 8.5.0.9167 - Microsoft Corporation)
Skype Web Plugin (HKLM-x32\...\{DF6DC2FB-6783-4340-8B98-401CB656AD3A}) (Version: 7.26.0.48 - Skype Technologies S.A.)
Skype™ 7.30 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.30.105 - Skype Technologies S.A.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.5.43 - Safer-Networking Ltd.)
Star Defender 4 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-114803710}) (Version: - Oberon Media)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 19.0.13.0 - Synaptics Incorporated)
Telstra USB+Wi-Fi Hostless Modem (HKLM-x32\...\{AEFF9E60-3E93-41EE-9895-311F7D1C5FFD}) (Version: 1.0.0.2 - ZTE Corporation)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
Welcome Center (HKLM-x32\...\Acer Welcome Center) (Version: 1.00.3005 - Acer Incorporated)
Windows Driver Package - OLYMPUS IMAGING CORP. Camera Communication Driver Package (09/09/2009 1.0.0.0) (HKLM\...\2C1C2F29FADF39F533CEEE67B90F07A5306A4BDB) (Version: 09/09/2009 1.0.0.0 - OLYMPUS IMAGING CORP.)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
Windows Phone app for desktop (HKLM-x32\...\{5F71448B-88EB-4357-9A98-8658D4C49C48}) (Version: 1.1.2726.0 - Microsoft Corporation)
Zemana AntiMalware (HKLM-x32\...\{8F0CD7D1-42F3-4195-95CD-833578D45057}_is1) (Version: 2.70.25 - Zemana Ltd.)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-4116000945-235673462-3313673197-1000_Classes\CLSID\{59B55F04-DE14-4BB8-92FF-C4A22EF2E5F4}\InprocServer32 -> C:\Users\Nigel\AppData\Local\Google\Update\1.3.31.5\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4116000945-235673462-3313673197-1000_Classes\CLSID\{BB384F15-7676-403E-B797-1F9D935525A3}\InprocServer32 -> C:\Users\Nigel\AppData\Local\SkypePlugin\7.26.0.48\GatewayActiveX-x64.dll (Skype Technologies S.A.)
CustomCLSID: HKU\S-1-5-21-4116000945-235673462-3313673197-1000_Classes\CLSID\{CBF9CD8C-2714-4F36-B76A-43E6C7547BC2}\localserver32 -> C:\Users\Nigel\AppData\Local\SkypePlugin\7.26.0.48\EdgeCalling.exe (Skype Technologies S.A.)
CustomCLSID: HKU\S-1-5-21-4116000945-235673462-3313673197-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Nigel\AppData\Local\Google\Update\1.3.31.5\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4116000945-235673462-3313673197-1000_Classes\CLSID\{EE77E2C8-7CCF-4449-AC4D-C885C28FAEA2}\localserver32 -> C:\Users\Nigel\AppData\Local\SkypePlugin\7.26.0.48\GatewayVersion-x64.exe (Skype Technologies S.A.)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {01159DE2-A011-4764-98F3-346CB60699E4} - System32\Tasks\{D7654395-BFA9-4959-B8B1-44BD951EFB86} => C:\Program Files (x86)\BBC iPlayer Desktop\BBC iPlayer Desktop.exe
Task: {0AD379C5-5504-43E6-A142-8F50E0E3D24C} - System32\Tasks\{4BE954A3-3C41-4AB0-AC89-E19A30EB9F15} => pcalua.exe -a "C:\Program Files\Hola\app\hola_setup.exe" -c --remove-hola --no-rmt-conf --hola-cr
Task: {0EC964F6-DAB6-4CBE-974C-E984A1E77D89} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\WINDOWS\ehome\mcupdate.exe
Task: {0F0DC27D-9F40-4E52-8BF2-2AA4C8A4BDAD} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {11D36760-7600-4937-9B3A-73CF7DC51AF7} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {1383606C-BC21-4B80-98A7-C5E01E568454} - \{49E65517-C6FF-4662-926A-722036CEACED} -> No File <==== ATTENTION
Task: {14271593-BC2C-4235-8C85-52EA6D45277F} - System32\Tasks\Java Platform SE Auto Updater => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2016-09-22] (Oracle Corporation)
Task: {17B7ADFC-F0C7-4A13-A09F-26840081CD9A} - System32\Tasks\{FCA8B98D-7B6E-4847-AA86-EAD1A463EB8F} => pcalua.exe -a "C:\Program Files\Hola\app\hola_setup.exe" -c --remove-hola --no-rmt-conf --hola-cr
Task: {19A5EFD8-8733-4600-AC14-7018D37E0B1E} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {1AF5BABE-EAFF-41AC-BB6C-4B8E94219134} - System32\Tasks\Puohxiilsri => C:\ProgramData\Puohxiilsri\1.0.4.1\hanuxlin.exe
Task: {1DB3DD4E-A51F-4B7C-98D8-31843575334C} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {1E96951C-B31C-4BCD-BE5A-3295B4DD9410} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {24ABF28E-6BB4-48FF-8938-31AA7803021F} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {2BC317B3-78C6-4ABA-A446-C5200C67E770} - System32\Tasks\{D6CF8AC5-F6E3-4AE0-BF96-ABF7F4C423B2} => pcalua.exe -a C:\Users\Nigel\Downloads\AdobeAIRInstaller(1).exe -d C:\Users\Nigel\Downloads
Task: {2C08F93E-4D64-4926-9F70-779510E5F131} - \{3BCAB8DD-A9A8-467A-9DF8-252117296EF5} -> No File <==== ATTENTION
Task: {2CB922F1-4434-4FE8-9261-4B096CB1A94C} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4116000945-235673462-3313673197-1000UA => C:\Users\Nigel\AppData\Local\Google\Update\GoogleUpdate.exe [2016-09-11] (Google Inc.)
Task: {2FCFC2B7-80A2-4360-96DD-3AF9EC600FA7} - System32\Tasks\{FA2DFFBA-D8D9-43BE-8798-6320337ECC10} => C:\Program Files (x86)\Expat Shield\bin\openvpntray.exe
Task: {2FD8C111-4C6B-455F-8CCD-1846C1CAB2A8} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)
Task: {30E8AB6A-CDA6-4108-9940-D6058DA5E3CF} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {317C3EBB-645E-452F-B40C-A2081F55861E} - System32\Tasks\{C9EAA295-3EC7-4043-B759-AD03F0D4F849} => C:\Program Files (x86)\Google\Google Earth\client\googleearth.exe [2016-10-06] (Google)
Task: {31FDA94E-6044-4C4F-9373-BB0358CD1D96} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\WINDOWS\ehome\MCUpdate.exe
Task: {382C7A2E-A0F8-4ECE-989C-D527979AB83C} - System32\Tasks\SafeZone scheduled Autoupdate 1460846800 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2016-09-06] (Avast Software)
Task: {3C9B9881-3C6A-4575-A3FB-5ABCF44C3A4B} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {4415D626-BBDD-4E3F-8B25-94E5A9A7CE74} - System32\Tasks\{DC92A6B2-BF5A-4D6A-ACDE-685C9D2C8033} => pcalua.exe -a C:\Users\Nigel\Downloads\AdobeAIRInstaller(2).exe -d C:\Users\Nigel\Downloads
Task: {47D465D4-873F-4CAC-8364-8A93745A96A8} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2016-03-21] (Safer-Networking Ltd.)
Task: {49D324DC-C170-41BA-A9FE-29AB6185D368} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2016-11-23] (Microsoft Corporation)
Task: {4BD39ABF-CD59-4689-8A96-9D3075E58E72} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {57759F43-E8BD-403C-B4E9-04221655B39B} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {5AD5A731-ACC5-4A85-BB0E-E14B5EB5BC40} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {64AAAF77-2283-490B-A64A-FA5F7C4BC0DE} - System32\Tasks\Recovery Management\Burn Notification => C:\Program Files\Acer\Acer eRecovery Management\NotificationCenter\Notification.exe [2009-07-10] (Acer)
Task: {6601D78C-E2BA-475F-A625-6A4CFD4DD470} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\WINDOWS\ehome\ehrec.exe
Task: {7DE9E188-85DC-4372-A019-0FD548E04907} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\WINDOWS\ehome\ehrec.exe
Task: {806FABEF-ECCE-4DB5-81BE-C56D648F5466} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {876B424C-AB44-433A-8C1F-D83FB8F1331E} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\WINDOWS\SysWoW64\Macromed\Flash\FlashUtil32_23_0_0_207_pepper.exe [2016-12-02] (Adobe Systems Incorporated)
Task: {8951E175-2CFB-4385-AED6-C503308B4852} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {8B3EDE07-409A-4578-962A-7B68D3E4CDFC} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {8E0CF9E7-08BC-4F5F-97CC-A1B32032561F} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {8E3CC729-4E96-490A-B927-16B4ABDCEA5A} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2016-03-21] (Safer-Networking Ltd.)
Task: {904486BF-59C1-4236-900C-079FC2BE8051} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {9646E692-C19C-46BF-8D5A-3BAF46F7B27D} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-10-21] (Adobe Systems Incorporated)
Task: {9849B8C7-8F74-4D4D-A8A4-74E814A05DE7} - System32\Tasks\avastBCLRestartS-1-5-21-4116000945-235673462-3313673197-1000 => Chrome.exe
Task: {9B206781-8799-47F6-AFED-FE4F4788E851} - System32\Tasks\{BB110E67-98B9-4BBA-A79C-13A8C150DB91} => Firefox.exe
Task: {A0EFBC9D-4493-45EA-91F2-FADF220EEE2B} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\WINDOWS\ehome\mcupdate.exe
Task: {A37AB1E6-5D39-44DF-89F0-E331B58C68A8} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-31] (Google Inc.)
Task: {AA191788-5067-4364-8E02-D592A650CB85} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {AB7F661F-4B3B-403F-BD46-B7B14F74B4AD} - System32\Tasks\{BB7CBED7-C704-4865-80F9-D7034E5EB1CE} => pcalua.exe -a C:\Users\Nigel\AppData\Roaming\webssearches\UninstallManager.exe -c -ptid=slbnew <==== ATTENTION
Task: {AB8D459A-9DF3-4165-8B86-405730A3E3AF} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {ABD943F4-1266-443F-BF02-653F006F58C1} - \{5E281035-07E3-4953-9823-2E84881987F6} -> No File <==== ATTENTION
Task: {B49D5260-6EB7-4231-99E3-869BE5A8FD7E} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2015-06-16] (Safer-Networking Ltd.)
Task: {B6F5E4F0-B8F9-44BB-BD67-0478C4EB57C5} - \{02776CF1-FDD5-44F5-8243-916C10FDFA96} -> No File <==== ATTENTION
Task: {BCB89F73-A162-4BB0-8AC8-D72E9CABBC09} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-12-02] (Adobe Systems Incorporated)
Task: {C158FFE0-D94D-4701-823E-597676B40860} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {C4A9CC96-9392-44B1-9585-987DA1BA6EAE} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {CDE97BA4-71B7-42DC-84CD-0C0BA144AB96} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {D03A3632-7F4C-44FE-ACBD-F9FD15CBE069} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4116000945-235673462-3313673197-1000Core => C:\Users\Nigel\AppData\Local\Google\Update\GoogleUpdate.exe [2016-09-11] (Google Inc.)
Task: {D0FD3BCE-A299-411E-A85E-1A19F66E216B} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {D790A0D6-F182-4B61-867F-52C033DE4BB2} - System32\Tasks\{F461A16A-7BA2-4D69-A610-19EB24634E71} => pcalua.exe -a "C:\Users\Nigel\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K7GZ4M1E\AdobeAIRInstaller.exe" -d C:\Users\Nigel\Desktop
Task: {DC233075-1CF9-4946-9E15-2E240EBF50F1} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {DEDED0B7-06E5-4744-B1E9-078BC5FEC328} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {E33473C9-4870-4013-BE3E-6C5A0F72E8E9} - \{2413066B-5A68-422E-B866-0F489CA77B20} -> No File <==== ATTENTION
Task: {E6EBA970-2BB1-4617-9C99-18D11502BADF} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-31] (Google Inc.)
Task: {E8A98060-3BD9-4DB3-BD94-E087B74AE633} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2016-09-11] (AVAST Software)
Task: {EE0EBC6F-4E44-49CC-A1FE-89A2B2C21B68} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {F6B6409E-DB2D-481D-94C0-8E9B48E315BA} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {FADB0856-9332-4BEE-83E4-90BEEF2FA6C9} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {FC449D2B-AB91-463F-925F-EB33227FBD07} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {FD404129-1E1B-493F-9589-55905E70BD7B} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\WINDOWS\ehome\ehPrivJob.exe
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job => C:\WINDOWS\SysWoW64\Macromed\Flash\FlashUtil32_23_0_0_207_pepper.exe
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-4116000945-235673462-3313673197-1000Core.job => C:\Users\Nigel\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-4116000945-235673462-3313673197-1000UA.job => C:\Users\Nigel\AppData\Local\Google\Update\GoogleUpdate.exe
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
ShortcutWithArgument: C:\Users\Public\Desktop\Telstra USB+Wi-Fi.lnk -> C:\Program Files (x86)\Hostless Modem\Telstra USB+Wi-Fi\LaunchWebUI.exe () -> hxxp://m.home
==================== Loaded Modules (Whitelisted) ==============
2016-07-16 21:42 - 2016-07-16 21:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-10-05 16:40 - 2016-10-05 16:40 - 02681200 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2016-10-05 16:40 - 2016-10-05 16:40 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-10-05 16:40 - 2016-10-05 16:40 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll
2016-12-08 21:18 - 2016-12-08 21:18 - 00152944 _____ () C:\Program Files (x86)\Zemana AntiMalware\ZAMShellExt64.dll
2016-10-05 16:41 - 2016-10-05 16:41 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2016-11-20 20:43 - 2016-11-02 20:30 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2016-11-20 20:42 - 2016-11-02 20:21 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2016-11-20 20:42 - 2016-11-02 20:15 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2016-11-20 20:41 - 2016-11-02 20:14 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2016-11-20 20:42 - 2016-11-02 20:15 - 01033216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2016-11-20 20:42 - 2016-11-02 20:16 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2016-11-20 20:42 - 2016-11-02 20:17 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2012-06-29 09:36 - 2012-06-29 09:35 - 00200704 _____ () C:\Windows\PLFSetI.exe
2013-06-12 14:44 - 2012-09-21 00:16 - 00442696 _____ () C:\Program Files (x86)\Hostless Modem\Telstra USB+Wi-Fi\CheckNDISPort_df.exe
2016-11-25 11:12 - 2016-11-25 11:23 - 00072192 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.9.261.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2016-11-25 11:12 - 2016-11-25 11:23 - 00178688 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.9.261.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2016-11-25 11:12 - 2016-11-25 11:23 - 41609728 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.9.261.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2016-09-11 17:43 - 2016-09-11 17:43 - 00169064 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2016-09-11 17:43 - 2016-09-11 17:43 - 00482928 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2016-12-07 10:18 - 2016-12-07 10:18 - 03067392 _____ () C:\Program Files\AVAST Software\Avast\defs\16120600\algo.dll
2016-12-10 10:25 - 2016-12-10 10:25 - 03067904 _____ () C:\Program Files\AVAST Software\Avast\defs\16120901\algo.dll
2012-08-27 21:33 - 2012-08-27 21:33 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2012-08-27 21:33 - 2012-08-27 21:33 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2015-08-07 21:35 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-08-07 21:35 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2016-01-30 16:57 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2016-01-30 16:57 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2016-04-09 08:35 - 2016-04-09 08:35 - 03481600 _____ () C:\Users\Nigel\AppData\Local\Programs\Google\Google Photos Backup\gpuploader_i18n.dll
2016-06-27 21:02 - 2016-06-27 21:02 - 48936448 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\ProgramData\Temp:1D32EC29 [129]
AlternateDataStreams: C:\ProgramData\Temp:373E1720 [118]
AlternateDataStreams: C:\ProgramData\Temp:93DE1838 [133]
AlternateDataStreams: C:\Users\Nigel\AppData\Roaming\Microsoft\Windows\Start Menu\ninemsn Homepage - Hotmail, Messenger, News, Sport & More.website:DESTICON_favicon-1545051169 [8574]
AlternateDataStreams: C:\Users\Nigel\AppData\Roaming\Microsoft\Windows\Start Menu\ninemsn Homepage - Hotmail, Messenger, News, Sport & More.website:DESTICON_favicon-2129689956 [8574]
AlternateDataStreams: C:\Users\Nigel\AppData\Roaming\Microsoft\Windows\Start Menu\ninemsn Homepage - Hotmail, Messenger, News, Sport & More.website:DESTICON_favicon-309781297 [8574]
AlternateDataStreams: C:\Users\Nigel\AppData\Roaming\Microsoft\Windows\Start Menu\ninemsn Homepage - Hotmail, Messenger, News, Sport & More.website:DESTICON_favicon-571293185 [8574]
AlternateDataStreams: C:\Users\Nigel\AppData\Roaming\Microsoft\Windows\Start Menu\ninemsn Homepage - Hotmail, Messenger, News, Sport & More.website:DESTICON_favicon730968612 [8574]
AlternateDataStreams: C:\Users\Nigel\AppData\Roaming\Microsoft\Windows\Start Menu\ninemsn Homepage - Outlook.com, News, Sport & More.website:DESTICON_favicon-1545051169 [8574]
AlternateDataStreams: C:\Users\Nigel\AppData\Roaming\Microsoft\Windows\Start Menu\ninemsn Homepage - Outlook.com, News, Sport & More.website:DESTICON_favicon-2129689956 [8574]
AlternateDataStreams: C:\Users\Nigel\AppData\Roaming\Microsoft\Windows\Start Menu\ninemsn Homepage - Outlook.com, News, Sport & More.website:DESTICON_favicon-309781297 [8574]
AlternateDataStreams: C:\Users\Nigel\AppData\Roaming\Microsoft\Windows\Start Menu\ninemsn Homepage - Outlook.com, News, Sport & More.website:DESTICON_favicon-571293185 [8574]
AlternateDataStreams: C:\Users\Nigel\AppData\Roaming\Microsoft\Windows\Start Menu\ninemsn Homepage - Outlook.com, News, Sport & More.website:DESTICON_favicon730968612 [8574]
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com
There are 7916 more sites.
IE trusted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\hola.org -> hxxp://hola.org
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\123simsen.com -> www.123simsen.com
There are 7917 more sites.
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 12:34 - 2016-12-02 22:18 - 00452572 ____R C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123haustiereundmehr.com
127.0.0.1 123moviedownload.com
127.0.0.1 www.123moviedownload.com
There are 15557 more lines.
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-4116000945-235673462-3313673197-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Nigel\AppData\Local\Microsoft\BingDesktop\themes\2016-12-08.jpg
DNS Servers: 61.8.0.113 - 210.23.129.34
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
HKLM\...\StartupApproved\Run: => "HotKeysCmds"
HKLM\...\StartupApproved\Run: => "Persistence"
HKLM\...\StartupApproved\Run: => "IgfxTray"
HKLM\...\StartupApproved\Run: => "Skytel"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [vm-monitoring-nb-session] => LPort=139
FirewallRules: [MSMQ-In-TCP] => %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-TCP] => %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-In-UDP] => %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-UDP] => %systemroot%\system32\mqsvc.exe
FirewallRules: [WCF-NetTcpActivator-In-TCP-64bit] => LPort=808
FirewallRules: [UDP Query User{8F34EEC7-E63E-4B49-B2AF-DC3C67076642}C:\users\nigel\appdata\local\skypeplugin\pluginhost.exe] => C:\users\nigel\appdata\local\skypeplugin\pluginhost.exe
FirewallRules: [TCP Query User{65926A33-230C-4D7E-A28E-269A1867A51F}C:\users\nigel\appdata\local\skypeplugin\pluginhost.exe] => C:\users\nigel\appdata\local\skypeplugin\pluginhost.exe
FirewallRules: [UDP Query User{EC5BC0AB-F029-4B4D-BD66-12D61BB5F3B8}C:\users\nigel\appdata\local\skypeplugin\7.7.0.219\pluginhost.exe] => C:\users\nigel\appdata\local\skypeplugin\7.7.0.219\pluginhost.exe
FirewallRules: [TCP Query User{A5C6454D-A0EE-4569-B882-35595A9453D4}C:\users\nigel\appdata\local\skypeplugin\7.7.0.219\pluginhost.exe] => C:\users\nigel\appdata\local\skypeplugin\7.7.0.219\pluginhost.exe
FirewallRules: [{683B65AB-56E4-447F-B7A8-86D1ED229CEB}] => C:\Program Files (x86)\AVG\Av\avgemca.exe
FirewallRules: [{1F29FF03-6B1D-4660-B61A-ABDAA716BB7D}] => C:\Program Files (x86)\AVG\Av\avgemca.exe
FirewallRules: [{946D736C-B128-4015-95D3-66F39AEDBD3A}] => C:\Program Files (x86)\AVG\Av\avgdiagex.exe
FirewallRules: [{6528F923-5A39-42CB-B01D-B8EC8B795BB9}] => C:\Program Files (x86)\AVG\Av\avgdiagex.exe
FirewallRules: [{9A6F95D4-C45E-454A-A7D8-A88511D43024}] => C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [UDP Query User{02A8529B-F575-4C62-9C46-0B6E748CDB5A}C:\users\nigel\appdata\roaming\macromedia\flash player\www.macromedia.com\bin\octoshape\octoshape.exe] => C:\users\nigel\appdata\roaming\macromedia\flash player\www.macromedia.com\bin\octoshape\octoshape.exe
FirewallRules: [TCP Query User{87833F89-E06B-4147-B61A-D9AE1E20A5B4}C:\users\nigel\appdata\roaming\macromedia\flash player\www.macromedia.com\bin\octoshape\octoshape.exe] => C:\users\nigel\appdata\roaming\macromedia\flash player\www.macromedia.com\bin\octoshape\octoshape.exe
FirewallRules: [{BF7D3625-0E52-48E9-961B-CA77A02910E8}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{54ED9DD8-3F7F-4C5E-8A8B-F1464F7A714E}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{D22D2F2A-F3FA-4555-ACF3-4A58CC5BD5D4}] => C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{DACDEDAE-BDCB-4458-8C56-C21FEEAA3797}] => C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{728C5889-C206-4ED8-9CB2-D23F2907B958}] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe
FirewallRules: [UDP Query User{06933D3E-C1CC-4811-B2FC-8873B7F646AF}C:\program files\internet explorer\iexplore.exe] => C:\program files\internet explorer\iexplore.exe
FirewallRules: [TCP Query User{3BFCEDD6-0786-41E5-AAB8-E816036E418E}C:\program files\internet explorer\iexplore.exe] => C:\program files\internet explorer\iexplore.exe
FirewallRules: [{3185065B-D60C-4CF3-B9B8-51D65AC08DBE}] => svchost.exe
FirewallRules: [{57B97727-0854-464C-97FF-479654710C31}] => C:\Program Files (x86)\Acer\Acer VCM\VC.exe
FirewallRules: [{529A50E4-29EA-4F12-BEBE-ECE64B25EA61}] => C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe
FirewallRules: [{7379F072-F05F-4157-A7F0-C9A787CD3393}] => C:\Program Files (x86)\CyberLink\PowerDVD8\PowerDVD8.EXE
FirewallRules: [{3F33DB1F-0C12-4B32-A76C-F44A380B3672}] => C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{84890AA7-CD24-46E2-A9F3-982316250600}] => LPort=2869
FirewallRules: [{1224F7D3-4CB4-4DA6-BA0F-C8FC9A12AFB0}] => LPort=1900
FirewallRules: [{91F96A73-4A41-4072-8B8F-468AFE5CF17E}] => C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{A4D878C4-5107-4FE7-9980-812A329EC42A}] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{44A92B06-327E-4296-80D1-3F7F6DE4A6B4}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{FF53FEC6-39F5-4F55-ADBB-3FF25A70A365}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service
==================== Restore Points =========================
20-11-2016 20:49:18 Windows Update
23-11-2016 22:10:14 Windows Update
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (12/09/2016 11:53:35 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 15484
Error: (12/09/2016 11:53:35 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 15484
Error: (12/09/2016 11:53:35 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (12/09/2016 10:28:18 AM) (Source: Windows Search Service) (EventID: 3104) (User: )
Description: Enumerating user sessions to generate filter pools failed.
Details:
(HRESULT : 0x80040210) (0x80040210)
Error: (12/09/2016 10:28:02 AM) (Source: Windows Search Service) (EventID: 3104) (User: )
Description: Enumerating user sessions to generate filter pools failed.
Details:
(HRESULT : 0x80040210) (0x80040210)
Error: (12/09/2016 10:28:02 AM) (Source: Windows Search Service) (EventID: 3104) (User: )
Description: Enumerating user sessions to generate filter pools failed.
Details:
(HRESULT : 0x80040210) (0x80040210)
Error: (12/09/2016 09:52:50 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 15625
Error: (12/09/2016 09:52:50 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 15625
Error: (12/09/2016 09:52:50 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (12/09/2016 09:11:44 AM) (Source: SideBySide) (EventID: 9) (User: )
Description: Activation context generation failed for "c:\program files (x86)\spybot - search & destroy 2\Tools.dll".Error in manifest or policy file "c:\program files (x86)\spybot - search & destroy 2\Tools.dll" on line 2.
The manifest file root element must be assembly.
System errors:
=============
Error: (12/10/2016 10:20:19 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (12/10/2016 10:20:19 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (12/10/2016 10:20:16 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
and APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (12/09/2016 10:29:03 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (12/09/2016 10:29:03 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (12/09/2016 10:29:03 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
and APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (12/09/2016 09:07:52 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (12/09/2016 09:07:52 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (12/09/2016 09:07:50 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
and APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (12/09/2016 09:05:34 AM) (Source: Tcpip) (EventID: 4199) (User: )
Description: The system detected an address conflict for IP address 192.168.0.2 with the system
having network hardware address A8-A7-95-8E-C1-91. Network operations on this system may
be disrupted as a result.
==================== Memory info ===========================
Processor: Genuine Intel(R) CPU U4100 @ 1.30GHz
Percentage of memory in use: 80%
Total physical RAM: 1978.91 MB
Available physical RAM: 381 MB
Total Virtual: 3962.91 MB
Available Virtual: 1655.95 MB
==================== Drives ================================
Drive c: (Acer) (Fixed) (Total:220.79 GB) (Free:106.42 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: E4578272)
Partition 1: (Not Active) - (Size=12 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=220.8 GB) - (Type=07 NTFS)
==================== End of Addition.txt ============================
Hi Juliet just to touch base with you the last report was FRST scans for my Laptop, I ran DELFIX as suggested by you on my Desktop to get rid of all the downloads and manually deleted what was left so the Desktop is all good Well done!. What was your opinion of the Laptops first FRST scans?
Hi Juliet just to touch base with you the last report was FRST scans for my Laptop, I ran DELFIX as suggested by you on my Desktop to get rid of all the downloads and manually deleted what was left so the Desktop is all good Well done!. What was your opinion of the Laptops first FRST scans?
So far it appears to be more of a tidy-up, since some tools were run and I do not see the logs from those scans I have no idea what was removed.
Can you give me information as to what this might be?
C:\ProgramData\Puohxiilsri\1.0.4.1\hanuxlin.exe
~~~
Running from C:\Users\Nigel\Downloads
It's best we move Farbar's to desktop.
Please go to your downloads folder, locate Farbar Recovery Scan Tool, right click and select CUT
Go to an open spot on your desktop, right click and select PASTE
You should now have Farbar Recovery Scan Tool on your desktop.
Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)
https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG
start
CreateRestorePoint:
CloseProcesses:
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => No File
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => No File
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
SearchScopes: HKLM-x32 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
BHO: Expat Shield Class -> {3706EE7C-3CAD-445D-8A43-03EBC3B75908} -> No File
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Toolbar: HKU\S-1-5-21-4116000945-235673462-3313673197-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKU\S-1-5-21-4116000945-235673462-3313673197-1000 -> No Name - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - No File
FF Extension: (No Name) - C:\Program Files (x86)\TomTom HOME 2\xul\extensions\MapShare-status@tomtom.com [not found]
CHR HKU\S-1-5-21-4116000945-235673462-3313673197-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Nigel\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx <not found>
C:\ProgramData\fontcacheev1.dat
Task: {0AD379C5-5504-43E6-A142-8F50E0E3D24C} - System32\Tasks\{4BE954A3-3C41-4AB0-AC89-E19A30EB9F15} => pcalua.exe -a "C:\Program Files\Hola\app\hola_setup.exe" -c --remove-hola --no-rmt-conf --hola-cr
Task: {0F0DC27D-9F40-4E52-8BF2-2AA4C8A4BDAD} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {1383606C-BC21-4B80-98A7-C5E01E568454} - \{49E65517-C6FF-4662-926A-722036CEACED} -> No File <==== ATTENTION
Task: {17B7ADFC-F0C7-4A13-A09F-26840081CD9A} - System32\Tasks\{FCA8B98D-7B6E-4847-AA86-EAD1A463EB8F} => pcalua.exe -a "C:\Program Files\Hola\app\hola_setup.exe" -c --remove-hola --no-rmt-conf --hola-cr
Task: {1DB3DD4E-A51F-4B7C-98D8-31843575334C} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {2C08F93E-4D64-4926-9F70-779510E5F131} - \{3BCAB8DD-A9A8-467A-9DF8-252117296EF5} -> No File <==== ATTENTION
Task: {3C9B9881-3C6A-4575-A3FB-5ABCF44C3A4B} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {57759F43-E8BD-403C-B4E9-04221655B39B} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {5AD5A731-ACC5-4A85-BB0E-E14B5EB5BC40} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {8951E175-2CFB-4385-AED6-C503308B4852} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {8B3EDE07-409A-4578-962A-7B68D3E4CDFC} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {AA191788-5067-4364-8E02-D592A650CB85} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {AB7F661F-4B3B-403F-BD46-B7B14F74B4AD} - System32\Tasks\{BB7CBED7-C704-4865-80F9-D7034E5EB1CE} => pcalua.exe -a C:\Users\Nigel\AppData\Roaming\webssearches\UninstallManager.exe -c -ptid=slbnew <==== ATTENTION
Task: {AB8D459A-9DF3-4165-8B86-405730A3E3AF} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {ABD943F4-1266-443F-BF02-653F006F58C1} - \{5E281035-07E3-4953-9823-2E84881987F6} -> No File <==== ATTENTION
Task: {B6F5E4F0-B8F9-44BB-BD67-0478C4EB57C5} - \{02776CF1-FDD5-44F5-8243-916C10FDFA96} -> No File <==== ATTENTION
Task: {E33473C9-4870-4013-BE3E-6C5A0F72E8E9} - \{2413066B-5A68-422E-B866-0F489CA77B20} -> No File <==== ATTENTION
Task: {EE0EBC6F-4E44-49CC-A1FE-89A2B2C21B68} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {FC449D2B-AB91-463F-925F-EB33227FBD07} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
ShortcutWithArgument: C:\Users\Public\Desktop\Telstra USB+Wi-Fi.lnk -> C:\Program Files (x86)\Hostless Modem\Telstra USB+Wi-Fi\LaunchWebUI.exe () -> hxxp://m.home
AlternateDataStreams: C:\ProgramData\Temp:1D32EC29 [129]
AlternateDataStreams: C:\ProgramData\Temp:373E1720 [118]
AlternateDataStreams: C:\ProgramData\Temp:93DE1838 [133]
IE trusted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\hola.org -> hxxp://hola.org
EmptyTemp:
Hosts:
End
Open FRST/FRST64 and press the > Fix < button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
~~~~~~~~~~~~~~~
http://i.imgur.com/BY4dvz9.png AdwCleaner
Please download AdwCleaner (http://www.bleepingcomputer.com/download/adwcleaner/dl/125/) and save the file to your Desktop.
In order to use AdwCleaner, you have to agree the Eula:
Right-click AdwCleaner.exe and select http://i.imgur.com/AVOiBNU.jpg Run as administrator to run the programme.
Follow the prompts.
Click http://i.imgur.com/A49sxPr.png Scan.
Upon completion, click http://i.imgur.com/6cyn5v5.png Logfile. A log (AdwCleaner[S1].txt) will open. Briefly check the log for anything you know to be legitimate.
Return to AdwCleaner. Ensure anything you know to be legitimate does not have a checkmark under the corresponding tab.
Click http://i.imgur.com/MqHawIb.png Clean.
Follow the prompts and allow your computer to reboot.
After the reboot, a log (AdwCleaner[C1].txt) will open. Copy the contents of the log and paste in your next reply.
-- File and folder backups are made for items removed using this programme. Should a legitimate file or folder be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the item. Please do not overly concern yourself with the contents of AdwCleaner[C1].txt.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Please download Junkware Removal Tool (http://www.bleepingcomputer.com/download/junkware-removal-tool/)
or from here http://downloads.malwarebytes.org/file/jrt
to your desktop.
Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.
~~~
please post
Fixlog.txt
AdwCleaner[C1].txt
JRT.txt
Hi Juliet I have no idea what C:\ProgramData\Puohxiilsri\1.0.4.1\hanuxlin.exe is and google is no help either. Now for the FRST scans I have them on desktop I managed to make fixlist.txt which I found in Documents and have made shortcut to desktop , but I'm lost on how to "Fix" you mention a quote box but I'm sorry I dont understand what you mean?. Sorry
Hi Juliet I have no idea what C:\ProgramData\Puohxiilsri\1.0.4.1\hanuxlin.exe is and google is no help either. Now for the FRST scans I have them on desktop I managed to make fixlist.txt which I found in Documents and have made shortcut to desktop , but I'm lost on how to "Fix" you mention a quote box but I'm sorry I dont understand what you mean?. Sorry
Copy and paste the below (beginning with start) should be saved as fixlist.txt , Please open Notepad save it to the Desktop as fixlist.txt
Both should be on desktop, then open Farbar Recovery Scan Tool, look for and click on the FIX button and it should carry out the script that was created.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG
start
CreateRestorePoint:
CloseProcesses:
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => No File
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => No File
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
SearchScopes: HKLM-x32 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
BHO: Expat Shield Class -> {3706EE7C-3CAD-445D-8A43-03EBC3B75908} -> No File
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Toolbar: HKU\S-1-5-21-4116000945-235673462-3313673197-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKU\S-1-5-21-4116000945-235673462-3313673197-1000 -> No Name - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - No File
FF Extension: (No Name) - C:\Program Files (x86)\TomTom HOME 2\xul\extensions\MapShare-status@tomtom.com [not found]
CHR HKU\S-1-5-21-4116000945-235673462-3313673197-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Nigel\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx <not found>
C:\ProgramData\fontcacheev1.dat
Task: {0AD379C5-5504-43E6-A142-8F50E0E3D24C} - System32\Tasks\{4BE954A3-3C41-4AB0-AC89-E19A30EB9F15} => pcalua.exe -a "C:\Program Files\Hola\app\hola_setup.exe" -c --remove-hola --no-rmt-conf --hola-cr
Task: {0F0DC27D-9F40-4E52-8BF2-2AA4C8A4BDAD} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {1383606C-BC21-4B80-98A7-C5E01E568454} - \{49E65517-C6FF-4662-926A-722036CEACED} -> No File <==== ATTENTION
Task: {17B7ADFC-F0C7-4A13-A09F-26840081CD9A} - System32\Tasks\{FCA8B98D-7B6E-4847-AA86-EAD1A463EB8F} => pcalua.exe -a "C:\Program Files\Hola\app\hola_setup.exe" -c --remove-hola --no-rmt-conf --hola-cr
Task: {1DB3DD4E-A51F-4B7C-98D8-31843575334C} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {2C08F93E-4D64-4926-9F70-779510E5F131} - \{3BCAB8DD-A9A8-467A-9DF8-252117296EF5} -> No File <==== ATTENTION
Task: {3C9B9881-3C6A-4575-A3FB-5ABCF44C3A4B} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {57759F43-E8BD-403C-B4E9-04221655B39B} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {5AD5A731-ACC5-4A85-BB0E-E14B5EB5BC40} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {8951E175-2CFB-4385-AED6-C503308B4852} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {8B3EDE07-409A-4578-962A-7B68D3E4CDFC} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {AA191788-5067-4364-8E02-D592A650CB85} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {AB7F661F-4B3B-403F-BD46-B7B14F74B4AD} - System32\Tasks\{BB7CBED7-C704-4865-80F9-D7034E5EB1CE} => pcalua.exe -a C:\Users\Nigel\AppData\Roaming\webssearches\UninstallManager.exe -c -ptid=slbnew <==== ATTENTION
Task: {AB8D459A-9DF3-4165-8B86-405730A3E3AF} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {ABD943F4-1266-443F-BF02-653F006F58C1} - \{5E281035-07E3-4953-9823-2E84881987F6} -> No File <==== ATTENTION
Task: {B6F5E4F0-B8F9-44BB-BD67-0478C4EB57C5} - \{02776CF1-FDD5-44F5-8243-916C10FDFA96} -> No File <==== ATTENTION
Task: {E33473C9-4870-4013-BE3E-6C5A0F72E8E9} - \{2413066B-5A68-422E-B866-0F489CA77B20} -> No File <==== ATTENTION
Task: {EE0EBC6F-4E44-49CC-A1FE-89A2B2C21B68} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {FC449D2B-AB91-463F-925F-EB33227FBD07} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
ShortcutWithArgument: C:\Users\Public\Desktop\Telstra USB+Wi-Fi.lnk -> C:\Program Files (x86)\Hostless Modem\Telstra USB+Wi-Fi\LaunchWebUI.exe () -> hxxp://m.home
AlternateDataStreams: C:\ProgramData\Temp:1D32EC29 [129]
AlternateDataStreams: C:\ProgramData\Temp:373E1720 [118]
AlternateDataStreams: C:\ProgramData\Temp:93DE1838 [133]
IE trusted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\hola.org -> hxxp://hola.org
EmptyTemp:
Hosts:
End
~~
[color=#0000FF]Please go to one of the below sites to scan the following files:
Virus Total (Recommended) (http://www.virustotal.com/)
jotti.org (http://virusscan.jotti.org/)
VirScan (http://virscan.org/)
click on Browse, and upload the following file for analysis:
C:\ProgramData\Puohxiilsri\1.0.4.1\hanuxlin.exe
Then click Submit. Allow the file to be scanned, and then please copy and paste the results link (for Virus Total) here for me to see.
If it says already scanned -- click "reanalyze now"
Please post the results in your next reply.
Ok so now I have FRST64.exe and fixlist.txt both on desktop when I go to "fix" on the tool it says it cant find fixlist.txt.
Does the setup appear as it is in the picture?
https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG
Hi Juliet I have no idea what C:\ProgramData\Puohxiilsri\1.0.4.1\hanuxlin.exe is and google is no help either. Now for the FRST scans I have them on desktop I managed to make fixlist.txt which I found in Documents and have made shortcut to desktop , but I'm lost on how to "Fix" you mention a quote box but I'm sorry I dont understand what you mean?. Sorry
This might be the problem.
When you located FRST in your downloads folder, did you right click on and that and use the Send To Desktop button?
If thats the case it wont work.
When you copied and paste the fixlist I created it should not have gone to documents, it should had been saved to desktop.
- Save ALL Tools to your Desktop-
All tools that I have you download should be placed on the desktop unless otherwise stated. If you are familiar with how to save files to the desktop then you can skip this step.
https://dl.dropboxusercontent.com/u/6063925/GeeksToGo/Icons/Chrome.JPGGoogle Chrome - Click the "Customize and control Google Chrome" button in the upper right-corner of the browser.https://dl.dropboxusercontent.com/u/6063925/GeeksToGo/Chrome/Settings.JPG Choose Settings. at the bottom of the screen click the
"Show advanced settings..." link. Scroll down to find the Downloads section and click the Change... button. Select your desktop and click OK.
https://dl.dropboxusercontent.com/u/6063925/GeeksToGo/Icons/Firefox.JPGMozilla Firefox - Click the "Open Menu" button in the upper right-corner of the browser. https://dl.dropboxusercontent.com/u/6063925/GeeksToGo/Firefox/Settings.JPG Choose Options. In the downloads section, click the Browse button, click on the Desktop folder
and the click the "Select Folder" button. Click OK to get out of the Options menu.
If you want, we can put that on hold for a bit.
Please do have C:\ProgramData\Puohxiilsri\1.0.4.1\hanuxlin.exe scanned at Virus Total as previously requested.
Also,
please run the AdwCleaner and JRT tool.
No the FRST set up does not appear as in the picture.
Community
Statistics
Documentation
FAQ
About
Join our community
Sign in
English
VirusTotal
File not found
The file you are looking for is not in our database.
Take me back to the main page Try another search
Blog | Twitter | contact@virustotal.com | Google groups | ToS | Privacy policy
There appears to be no record of a file C:\ProgramData\Puohxiilsri\1.0.4.1\hanuxlin.exe on my laptop as I tried Jotti.org and Virscan (They asked for a file and there was none to be found).
# AdwCleaner v6.040 - Logfile created 12/12/2016 at 08:55:39
# Updated on 02/12/2016 by Malwarebytes
# Database : 2016-12-11.2 [Server]
# Operating System : Windows 10 Home (X64)
# Username : Nigel - AVRILANDNIGENOT
# Running from : C:\Users\Nigel\Desktop\AdwCleaner.exe
# Mode: Clean
# Support : https://www.malwarebytes.com/support
***** [ Services ] *****
***** [ Folders ] *****
[-] Folder deleted: C:\Users\Nigel\AppData\Local\Hola
[-] Folder deleted: C:\Users\Nigel\AppData\LocalLow\Simple Adblock
[-] Folder deleted: C:\Users\Nigel\AppData\Roaming\Hola
[-] Folder deleted: C:\Program Files\Hola
[-] Folder deleted: C:\Program Files\Enigma Software Group
[-] Folder deleted: C:\extensions
***** [ Files ] *****
***** [ DLL ] *****
***** [ WMI ] *****
***** [ Shortcuts ] *****
***** [ Scheduled Tasks ] *****
[-] Task deleted: {BB7CBED7-C704-4865-80F9-D7034E5EB1CE}
***** [ Registry ] *****
[-] Key deleted: HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\ExpatSrv
[#] Key deleted on reboot: [x64] HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\ExpatSrv
[-] Key deleted: HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\ExpatWd
[#] Key deleted on reboot: [x64] HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\ExpatWd
[-] Key deleted: HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho
[-] Key deleted: HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar
[-] Key deleted: HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\YBrowserToolbar.YBrowserToolbar.1
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\{7375D127-3955-4654-8E7D-1949A7A9C902}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{D879A501-50A7-BEFC-A4C5-32DC6E0CB208}
[-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{F5A29F21-B121-48A0-A317-737AF8BB106A}
[-] Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3706EE7C-3CAD-445D-8A43-03EBC3B75908}
[-] Value deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}]
[-] Key deleted: HKU\.DEFAULT\Software\Hola
[-] Key deleted: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\Software\eSupport.com
[-] Key deleted: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\Software\Hola
[-] Key deleted: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\Software\Microsoft\Tinstalls
[-] Key deleted: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\Software\UpdateStar
[-] Key deleted: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\Software\Yahoo\Companion
[-] Key deleted: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\Software\Yahoo\YFriendsBar
[-] Key deleted: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\Software\AppDataLow\Software\Tbccint
[-] Key deleted: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\Software\AppDataLow\Software\TbccintSearchScopes
[-] Key deleted: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\Software\AppDataLow\Software\Yahoo\Companion
[-] Key deleted: HKCU\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-4116000945-235673462-3313673197-1000\Software\ExpatShield
[#] Key deleted on reboot: HKU\S-1-5-18\Software\Hola
[#] Key deleted on reboot: HKCU\Software\eSupport.com
[#] Key deleted on reboot: HKCU\Software\Hola
[#] Key deleted on reboot: HKCU\Software\Microsoft\Tinstalls
[#] Key deleted on reboot: HKCU\Software\UpdateStar
[#] Key deleted on reboot: HKCU\Software\Yahoo\Companion
[#] Key deleted on reboot: HKCU\Software\Yahoo\YFriendsBar
[#] Key deleted on reboot: HKCU\Software\AppDataLow\Software\Tbccint
[#] Key deleted on reboot: HKCU\Software\AppDataLow\Software\TbccintSearchScopes
[#] Key deleted on reboot: HKCU\Software\AppDataLow\Software\Yahoo\Companion
[-] Key deleted: HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
[-] Key deleted: HKLM\SOFTWARE\Yahoo\Companion
[-] Key deleted: HKLM\SOFTWARE\MaxPower
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EE171732-BEB4-4576-887D-CB62727F01CA}
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-4116000945-235673462-3313673197-1000\Software\ExpatShield
[#] Key deleted on reboot: [x64] HKCU\Software\eSupport.com
[#] Key deleted on reboot: [x64] HKCU\Software\Hola
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Tinstalls
[#] Key deleted on reboot: [x64] HKCU\Software\UpdateStar
[#] Key deleted on reboot: [x64] HKCU\Software\Yahoo\Companion
[#] Key deleted on reboot: [x64] HKCU\Software\Yahoo\YFriendsBar
[#] Key deleted on reboot: [x64] HKCU\Software\AppDataLow\Software\Tbccint
[#] Key deleted on reboot: [x64] HKCU\Software\AppDataLow\Software\TbccintSearchScopes
[#] Key deleted on reboot: [x64] HKCU\Software\AppDataLow\Software\Yahoo\Companion
[-] Key deleted: [x64] HKLM\SOFTWARE\Hola
[-] Key deleted: [x64] HKLM\SOFTWARE\EnigmaSoftwareGroup
[-] Key deleted: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\st.chatango.com
[-] Key deleted: HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\st.chatango.com
[#] Key deleted on reboot: [x64] HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\st.chatango.com
[#] Key deleted on reboot: [x64] HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\st.chatango.com
[-] Value deleted: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run [hola]
[-] Key deleted: HKCU\Software\MozillaPlugins\@hola.org/FlashPlayer
[-] Key deleted: HKCU\Software\MozillaPlugins\@hola.org/vlc
[-] Key deleted: HKCU\Software\Google\Chrome\Extensions\fcfenmboojpjinhpgggodefccipikbpd
[#] Key deleted on reboot: [x64] HKCU\Software\Google\Chrome\Extensions\fcfenmboojpjinhpgggodefccipikbpd
***** [ Web browsers ] *****
[-] [C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: mysearch.avg.com
[-] [C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: search.yahoo.com
[-] [C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: search.conduit.com
[-] [C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: us.yhs4.search.yahoo.com
[-] [C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: sweet-page.com
[-] [C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: sweet-page
[-] [C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: fcfenmboojpjinhpgggodefccipikbpd
*************************
:: "Tracing" keys deleted
:: Winsock settings cleared
*************************
C:\AdwCleaner\AdwCleaner[C0].txt - [7528 Bytes] - [12/12/2016 08:55:39]
C:\AdwCleaner\AdwCleaner[S0].txt - [7472 Bytes] - [11/12/2016 11:53:17]
C:\AdwCleaner\AdwCleaner[S1].txt - [7272 Bytes] - [12/12/2016 08:51:06]
########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [7747 Bytes] ##########
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.9 (09.30.2016)
Operating System: Windows 10 Home x64
Ran by Nigel (Administrator) on 12-Dec-16 at 9:24:49.80
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
File System: 0
Registry: 0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 12-Dec-16 at 9:34:39.29
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
There appears to be no record of a file C:\ProgramData\Puohxiilsri\1.0.4.1\hanuxlin.exe on my laptop as
It was listed as a task. Possible the related files/folders for this could be gone but, if we can get FRST to run we can take it out.
Task: {1AF5BABE-EAFF-41AC-BB6C-4B8E94219134} - System32\Tasks\Puohxiilsri => C:\ProgramData\Puohxiilsri\1.0.4.1\hanuxlin.exe
No the FRST set up does not appear as in the picture
We'll start this over.
- Save ALL Tools to your Desktop-
All tools that I have you download should be placed on the desktop unless otherwise stated. If you are familiar with how to save files to the desktop then you can skip this step.
https://dl.dropboxusercontent.com/u/6063925/GeeksToGo/Icons/Chrome.JPGGoogle Chrome - Click the "Customize and control Google Chrome" button in the upper right-corner of the browser.https://dl.dropboxusercontent.com/u/6063925/GeeksToGo/Chrome/Settings.JPG Choose Settings. at the bottom of the screen click the
"Show advanced settings..." link. Scroll down to find the Downloads section and click the Change... button. Select your desktop and click OK.
https://dl.dropboxusercontent.com/u/6063925/GeeksToGo/Icons/Firefox.JPGMozilla Firefox - Click the "Open Menu" button in the upper right-corner of the browser. https://dl.dropboxusercontent.com/u/6063925/GeeksToGo/Firefox/Settings.JPG Choose Options. In the downloads section, click the Browse button, click on the Desktop folder
and the click the "Select Folder" button. Click OK to get out of the Options menu.
~~
Navigate to your downloads folder
C:\Users\Nigel\Downloads, locate Farbar Recovery Scan Tool, right click on that and select delete.
With the browser set to download to desktop we can continue.
Now, we'll just download a fresh version and run the FIX tool.
Please download Farbar Recovery Scan Tool (x32) (http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/) or Farbar Recovery Scan Tool (x64) (http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/) and save the file to your Desktop.
Once it's on desktop, don't run the tool we'll just direct the FIX to run the tool.
Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)
https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG
start
CreateRestorePoint:
CloseProcesses:
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => No File
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => No File
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
SearchScopes: HKLM-x32 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
BHO: Expat Shield Class -> {3706EE7C-3CAD-445D-8A43-03EBC3B75908} -> No File
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Toolbar: HKU\S-1-5-21-4116000945-235673462-3313673197-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKU\S-1-5-21-4116000945-235673462-3313673197-1000 -> No Name - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - No File
FF Extension: (No Name) - C:\Program Files (x86)\TomTom HOME 2\xul\extensions\MapShare-status@tomtom.com [not found]
CHR HKU\S-1-5-21-4116000945-235673462-3313673197-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Nigel\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx <not found>
C:\ProgramData\fontcacheev1.dat
Task: {0AD379C5-5504-43E6-A142-8F50E0E3D24C} - System32\Tasks\{4BE954A3-3C41-4AB0-AC89-E19A30EB9F15} => pcalua.exe -a "C:\Program Files\Hola\app\hola_setup.exe" -c --remove-hola --no-rmt-conf --hola-cr
Task: {0F0DC27D-9F40-4E52-8BF2-2AA4C8A4BDAD} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {1383606C-BC21-4B80-98A7-C5E01E568454} - \{49E65517-C6FF-4662-926A-722036CEACED} -> No File <==== ATTENTION
Task: {17B7ADFC-F0C7-4A13-A09F-26840081CD9A} - System32\Tasks\{FCA8B98D-7B6E-4847-AA86-EAD1A463EB8F} => pcalua.exe -a "C:\Program Files\Hola\app\hola_setup.exe" -c --remove-hola --no-rmt-conf --hola-cr
Task: {1DB3DD4E-A51F-4B7C-98D8-31843575334C} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {2C08F93E-4D64-4926-9F70-779510E5F131} - \{3BCAB8DD-A9A8-467A-9DF8-252117296EF5} -> No File <==== ATTENTION
Task: {3C9B9881-3C6A-4575-A3FB-5ABCF44C3A4B} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {57759F43-E8BD-403C-B4E9-04221655B39B} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {5AD5A731-ACC5-4A85-BB0E-E14B5EB5BC40} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {8951E175-2CFB-4385-AED6-C503308B4852} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {8B3EDE07-409A-4578-962A-7B68D3E4CDFC} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {AA191788-5067-4364-8E02-D592A650CB85} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {AB7F661F-4B3B-403F-BD46-B7B14F74B4AD} - System32\Tasks\{BB7CBED7-C704-4865-80F9-D7034E5EB1CE} => pcalua.exe -a C:\Users\Nigel\AppData\Roaming\webssearches\UninstallManager.exe -c -ptid=slbnew <==== ATTENTION
Task: {AB8D459A-9DF3-4165-8B86-405730A3E3AF} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {ABD943F4-1266-443F-BF02-653F006F58C1} - \{5E281035-07E3-4953-9823-2E84881987F6} -> No File <==== ATTENTION
Task: {B6F5E4F0-B8F9-44BB-BD67-0478C4EB57C5} - \{02776CF1-FDD5-44F5-8243-916C10FDFA96} -> No File <==== ATTENTION
Task: {E33473C9-4870-4013-BE3E-6C5A0F72E8E9} - \{2413066B-5A68-422E-B866-0F489CA77B20} -> No File <==== ATTENTION
Task: {EE0EBC6F-4E44-49CC-A1FE-89A2B2C21B68} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {FC449D2B-AB91-463F-925F-EB33227FBD07} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
ShortcutWithArgument: C:\Users\Public\Desktop\Telstra USB+Wi-Fi.lnk -> C:\Program Files (x86)\Hostless Modem\Telstra USB+Wi-Fi\LaunchWebUI.exe () -> hxxp://m.home
Task: {1AF5BABE-EAFF-41AC-BB6C-4B8E94219134} - System32\Tasks\Puohxiilsri => C:\ProgramData\Puohxiilsri\1.0.4.1\hanuxlin.exe
AlternateDataStreams: C:\ProgramData\Temp:1D32EC29 [129]
AlternateDataStreams: C:\ProgramData\Temp:373E1720 [118]
AlternateDataStreams: C:\ProgramData\Temp:93DE1838 [133]
IE trusted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\hola.org -> hxxp://hola.org
EmptyTemp:
Hosts:
End
Open FRST/FRST64 and press the > Fix < button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
Juliet all my Firefox downloads are and were as per your previous message and the box is ticked to download to desktop . Now I have deleted FRST64.exe and Fixlist.exe from C:\Users\Nigel\Downloads as you suggested and have now got FRST64(1) on the desktop as you also suggested , now when I click "Fix" on the tool I get the following message, "No fixlist.txt found. The fixlist.txt should be in the same folder/directory the tool is located".
It's possible the error is in the way Notepad was saved.
Let's move on
Please download Emsisoft Emergency Kit (http://dl.emsisoft.com/EmsisoftEmergencyKit.exe) and save it to your desktop.
Double click on the EmsisoftEmergencyKit file you downloaded to extract its contents and create a shortcut on the desktop.
Leave all settings as they are and click the Extract button at the bottom.
A folder named EEK will be created in the root of the drive (usually c:\).
After extraction please double-click on the new Start Emsisoft Emergency Kit icon on your desktop.
The first time you launch it, Emsisoft Emergency Kit will recommend that you allow it to download updates.
Please click Yes so that it downloads the latest database updates.
When the update process is complete, a new button will appear in the lower-left corner that says Back. Click on this button to return to the Overview screen.
Click on Scan to be taken to the scan options.
If you are asked if you want the scanner to scan for Potentially Unwanted Programs, then click Yes.
Click on the Malware Scan button to start the scan.
When the scan is completed click the Quarantine selected objects button. Note, this option is only available if malicious objects were detected during the scan.
When the threats have been quarantined, click the View report button in the lower-right corner, and the scan log will be opened in Notepad.
Please save the log in Notepad on your desktop, and copy it to your next reply.
When you close Emsisoft Emergency Kit, it will give you an option to sign up for a newsletter. This is optional, and is not necessary for the malware removal process.
Please post this log when finished.
How is your computer now?
Hi Juliet Emsisoft does not appear to have found anything untoward.
Emsisoft Emergency Kit - Version 12.0
Last update: 13-Dec-16 9:04:47 AM
User account: AVRILANDNIGENOT\Nigel
Computer name: AVRILANDNIGENOT
OS version: Windows 10x64
Scan settings:
Scan type: Malware Scan
Objects: Rootkits, Memory, Traces, Files
Detect PUPs: On
Scan archives: Off
ADS Scan: On
File extension filter: Off
Direct disk access: Off
Scan start: 13-Dec-16 9:06:41 AM
Scanned 36735
Found 0
Scan end: 13-Dec-16 10:33:19 AM
Scan time: 1:26:38
Sorry Juliet I forgot to tell you how my Laptop is performing its the same with "Connected to s.yimg.com" still there in the bottom LH corner of Yahoo7, in fact it comes in on all pages with the word Yahoo in the title. What it does is it slows the page trying to load and when something finally appears it is incomplete and the wheel in the top LH corner never stops rotating.
If AdBlock were disabled does it still try to load?
Remember, owned and operated by Yahoo (not malicious), by using Adblock it stops this extension from completely loading.
If you have Zemana.AntiMalware on your computer, please delete it so we can get an updated version.
Download Zemana AntiMalware (https://www.zemana.com/Download/AntiMalware/Setup/Free/Zemana.AntiMalware.Setup.exe):
open the program and without changing any options, press Scan
after the scan is finished, if threats are detected press Next to remove them
Note: If restart is required to finish the cleaning process, you should click Reboot. If reboot isn't required, please restart your computer manually.
open Zemana AntiMalware again and locate the latest report
please paste the contents into your reply.
========================
Juliet
You wont belief this but its working fine now on Firefox, I ran Zemana but it found nothing then it became a pest and kept loading and running scans every time I logged on so I uninstalled the program but it was still present in downloads so I deleted them and noticed that Zemana was finally gone from my installed programs. Whats happened I dont know and cant explain but I have installed Adblock Ultimate and its still working fine. I'll send this and go and check Chrome out so will report later.
Juliet,
I have checked Chrome out ,and I went there it went to Google.com page and when I went to change it to my homepage (Nine.com.au) , there was a Gear shaped icon it said something had changed the settings so I reset to my preference (Nine.com.au) now its working fine.
Good golly, glad to hear thats over.
Let's remove tools and quarantine folders now.
Please download DelFix (http://general-changelog-team.fr/en/downloads/finish/20-outils-de-xplode/9-delfix) or from Here (http://www.bleepingcomputer.com/download/delfix/) and save the file to your Desktop.
Double-click DelFix.exe to run the programme.
Place a checkmark next to the following items:
Activate UAC
Remove disinfection tools
Click the Run button.
-- This will remove the specialized tools we used to disinfect your system.
Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).
**********************
Juliet,
Finally the dreaded s.yimg.com has gone. I downloaded and ran Delfix which cleaned up everything bar Emsisoft so I deleted manually. No everything is back to normal.
Thank you so much for all your time and effort. May I wish you and Spybot a very Merry Christmas and a Happy New Year!.
Glad to hear all is well with you, wishing you a Merry Christmas and a Happy New Year too. :present:
Glad we could help. :)
Since this issue appears resolved ... this Topic is closed.