Something's Trying to Get Out 2

1 Attachment(s)

My earlier thread is closed.

I have not used this PC much since we finished that thread about 5 days ago.

Tonight I got a pop-up from K9 that it had blocked outgoing traffic of some sort. These are tough to catch because the behavior gets blocked, I see a pop-up, and then it goes away. You have to click them fast.

I clicked this one. I attached a screen capture of the K9 info screen that it took me to. I know nothing of the website listed, and certainly didn't try to go there (and I've barely clicked anything at all since I sat down here a few minutes ago).

Not finding much of anything to say it's actually malicious, which browser was loaded at that time?

Sometimes these come in as false positives. Not saying thats the case here but we'll do some searching.

Use your onboard antivirus to do a full scan.
If anything is found can you post the log from this?
~~~
Next

http://i.imgur.com/xlK5Hdb.png Farbar Recovery Scan Tool (FRST) Scan

Please download Farbar Recovery Scan Tool (x32) or Farbar Recovery Scan Tool (x64) andsave the file to your Desktop.
Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.
Right-Click FRST.exe / FRST64.exe and select http://i.imgur.com/AVOiBNU.jpg Run as administrator to run the programme.
Click Yes to the disclaimer.
Ensure the Addition.txt box is checked.
Click the Scan button and let the programme run.
Upon completion, click OK, then OK on the Addition.txt pop up screen.
Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply.

Will Get Back to You in 48 Hours

I was running 3 browsers at the time: Firefox, Chrome, and Opera. I will try and not have more than one open at a time for a while, and see if I can isolate these warnings to one of them.

********************************

I will run my antivirus and get back to you.

I will then run FRST. Do note that we don't have a log from this made after the last round of fixes, only from before.

The next two days are kind of crazy. No guarantee I will get this done before Thursday evening, but I'll try.

One More Thing

When you said this could be a false positive, do you think that this might be some sort of link to the outside that's activated by just browsing to a certain webpage? And it's caught by K9 because it is on their internal blacklist (or not on their whitelist)?

I guess what I'm wondering is could I be getting false positives from K9 due to passive rather than active behavior on my part?

Quote:

Originally Posted by BooBounder

When you said this could be a false positive, do you think that this might be some sort of link to the outside that's activated by just browsing to a certain webpage? And it's caught by K9 because it is on their internal blacklist (or not on their whitelist)?

I guess what I'm wondering is could I be getting false positives from K9 due to passive rather than active behavior on my part?

Quote:

I will then run FRST. Do note that we don't have a log from this made after the last round of fixes, only from before.

Yes, I would like to have a fresh log from FRST.

Heres my thoughts
You have an application on your computer that reaches out to connect for updates, could be by using an add-blocker could stop it from activating, could be a specific web site with an embedded url.....
Could be an old outdated list from K9, I just don't know.
If we run all new/fresh scans and we don't find anything, hate to admit being kinda lost about it.

Still Waiting

I have been running a full scan with Windows Defender. It is taking a long time. I'm being patient with it.

Has it found anything?

Let's also do this

http://i.imgur.com/xlK5Hdb.png Farbar Recovery Scan Tool (FRST) Scan

Please download Farbar Recovery Scan Tool (x32) or Farbar Recovery Scan Tool (x64) andsave the file to your Desktop.
Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.
Right-Click FRST.exe / FRST64.exe and select http://i.imgur.com/AVOiBNU.jpg Run as administrator to run the programme.
Click Yes to the disclaimer.
Ensure the Addition.txt box is checked.
Click the Scan button and let the programme run.
Upon completion, click OK, then OK on the Addition.txt pop up screen.
Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply.

Windows Defender Report

This was from a full rather than a quick scan.

I will let you take a look at this and reply before I run FRST.

I quarantined everything found (which is mostly on quite old stuff that is archived on this PC). Two threats were recommended for removal, but I did not do that yet. Please advise.

I was still having trouble with my PC running slow when Windows Defender finished (I did a quarantine and a reboot and it's much better). Anyway, so I used PowerShell to generate this log before the reboot, in case there was an underlying partial crash that prevented logging.

There's a few password hacking programs on there. This was mostly to help deal with a teenager that was getting into some trouble, and wouldn't open her accounts.

PS C:\windows\system32> get-mpthreatdetection

ActionSuccess : True
AdditionalActionsBitMask : 0
AMProductVersion : 4.18.1807.18075
CleaningActionID : 9
CurrentThreatExecutionStatusID : 0
DetectionID : {FFCF2916-1709-4BB7-A7A4-54A77BCBD458}
DetectionSourceTypeID : 1
DomainUser : 2012_Office\Dave
InitialDetectionTime : 8/25/2018 3:06:32 AM
LastThreatStatusChangeTime : 8/25/2018 3:06:32 AM
ProcessName : Unknown
RemediationTime :
Resources : {containerfile:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload
18-06-18\Utilities\Zip Files\dialupass.zip, file:_C:\Users\Dave\Downloads\Flashdrive
(Black) Offload 18-06-18\Utilities\dialupass\Dialupass.exe,
file:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload 18-06-18\Utilities\Zip
Files\dialupass.zip->Dialupass.exe,
regkey:_HKCU@S-1-5-21-4063716828-1680190529-1648852121-1000\software\NirSoft}
ThreatID : 2147663673
ThreatStatusErrorCode : 0
ThreatStatusID : 1
PSComputerName :

ActionSuccess : True
AdditionalActionsBitMask : 0
AMProductVersion : 4.18.1807.18075
CleaningActionID : 9
CurrentThreatExecutionStatusID : 0
DetectionID : {BEBC61E4-705E-47A6-8972-D972450F2381}
DetectionSourceTypeID : 1
DomainUser : 2012_Office\Dave
InitialDetectionTime : 8/25/2018 3:06:32 AM
LastThreatStatusChangeTime : 8/25/2018 3:06:32 AM
ProcessName : Unknown
RemediationTime :
Resources : {containerfile:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload
18-06-18\Utilities\Zip Files\webbrowserpassview.zip,
file:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload 18-06-18\Utilities\Zip
Files\webbrowserpassview.zip->WebBrowserPassView.exe}
ThreatID : 2147685165
ThreatStatusErrorCode : 0
ThreatStatusID : 1
PSComputerName :

ActionSuccess : True
AdditionalActionsBitMask : 0
AMProductVersion : 4.18.1807.18075
CleaningActionID : 9
CurrentThreatExecutionStatusID : 0
DetectionID : {2ADDF115-DF16-4BE9-A14E-337FFE58F316}
DetectionSourceTypeID : 1
DomainUser : 2012_Office\Dave
InitialDetectionTime : 8/25/2018 3:06:32 AM
LastThreatStatusChangeTime : 8/25/2018 3:06:32 AM
ProcessName : Unknown
RemediationTime :
Resources : {containerfile:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload
18-06-18\Utilities\Zip Files\pspv.zip, file:_C:\Users\Dave\Downloads\Flashdrive
(Black) Offload 18-06-18\Utilities\Zip Files\pspv.zip->pspv.exe}
ThreatID : 2147597639
ThreatStatusErrorCode : 0
ThreatStatusID : 1
PSComputerName :

ActionSuccess : True
AdditionalActionsBitMask : 0
AMProductVersion : 4.18.1807.18075
CleaningActionID : 9
CurrentThreatExecutionStatusID : 0
DetectionID : {F9B1D1D7-C118-4364-931C-8E43624E0F2E}
DetectionSourceTypeID : 1
DomainUser : 2012_Office\Dave
InitialDetectionTime : 8/25/2018 3:06:32 AM
LastThreatStatusChangeTime : 8/25/2018 3:06:32 AM
ProcessName : Unknown
RemediationTime :
Resources : {containerfile:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload
18-06-18\Utilities\Zip Files\netpass.zip, file:_C:\Users\Dave\Downloads\Flashdrive
(Black) Offload 18-06-18\Utilities\Zip Files\netpass.zip->netpass.exe}
ThreatID : 2147605535
ThreatStatusErrorCode : 0
ThreatStatusID : 1
PSComputerName :

ActionSuccess : True
AdditionalActionsBitMask : 0
AMProductVersion : 4.18.1807.18075
CleaningActionID : 2
CurrentThreatExecutionStatusID : 1
DetectionID : {8BAA532B-387C-4D59-BF6C-E948FF3E068C}
DetectionSourceTypeID : 3
DomainUser : 2012_Office\Office Administrator
InitialDetectionTime : 8/10/2018 1:35:25 PM
LastThreatStatusChangeTime : 8/10/2018 1:39:05 PM
ProcessName : C:\EEK\bin64\a2emergencykit.exe
RemediationTime : 8/10/2018 1:39:05 PM
Resources : {file:_C:\Users\Dave\Downloads\Installed\OrbitSetup4.1.18_20130502_1.exe}
ThreatID : 2147723143
ThreatStatusErrorCode : 0
ThreatStatusID : 3
PSComputerName :

ActionSuccess : True
AdditionalActionsBitMask : 0
AMProductVersion : 4.18.1807.18075
CleaningActionID : 9
CurrentThreatExecutionStatusID : 0
DetectionID : {062C127A-779B-42F6-BD11-D81D17B4181C}
DetectionSourceTypeID : 1
DomainUser : 2012_Office\Dave
InitialDetectionTime : 8/25/2018 3:06:32 AM
LastThreatStatusChangeTime : 8/25/2018 3:06:32 AM
ProcessName : Unknown
RemediationTime :
Resources : {file:_P:\Laptop Backup 14-04-06\Documents and Settings\Ben\My
Documents\Downloads\Java.exe}
ThreatID : 2147723656
ThreatStatusErrorCode : 0
ThreatStatusID : 1
PSComputerName :

ActionSuccess : True
AdditionalActionsBitMask : 0
AMProductVersion : 4.18.1807.18075
CleaningActionID : 9
CurrentThreatExecutionStatusID : 0
DetectionID : {08B65E84-DD70-407B-B1AC-48CF97905A80}
DetectionSourceTypeID : 1
DomainUser : 2012_Office\Dave
InitialDetectionTime : 8/25/2018 3:06:32 AM
LastThreatStatusChangeTime : 8/25/2018 3:06:32 AM
ProcessName : Unknown
RemediationTime :
Resources : {file:_P:\Old External Drive Back Up 14-04-06\Office Backup\My Documents\Zip
Files\Utilities\AutoHotkey104608_Install.exe}
ThreatID : 2147723143
ThreatStatusErrorCode : 0
ThreatStatusID : 1
PSComputerName :

ActionSuccess : True
AdditionalActionsBitMask : 0
AMProductVersion : 4.18.1807.18075
CleaningActionID : 9
CurrentThreatExecutionStatusID : 0
DetectionID : {A4B13D61-8E7A-47CE-B22F-01FB0502D061}
DetectionSourceTypeID : 1
DomainUser : 2012_Office\Dave
InitialDetectionTime : 8/25/2018 3:06:32 AM
LastThreatStatusChangeTime : 8/25/2018 3:06:32 AM
ProcessName : Unknown
RemediationTime :
Resources : {containerfile:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload
18-06-18\Utilities\Zip Files\mailpv.zip, file:_C:\Users\Dave\Downloads\Flashdrive
(Black) Offload 18-06-18\Utilities\Zip Files\mailpv.zip->mailpv.exe}
ThreatID : 2147571412
ThreatStatusErrorCode : 0
ThreatStatusID : 1
PSComputerName :

ActionSuccess : True
AdditionalActionsBitMask : 0
AMProductVersion : 4.18.1807.18075
CleaningActionID : 9
CurrentThreatExecutionStatusID : 0
DetectionID : {CDF1634A-3A17-4103-A2FC-9D74D0A77866}
DetectionSourceTypeID : 1
DomainUser : 2012_Office\Dave
InitialDetectionTime : 8/25/2018 3:06:32 AM
LastThreatStatusChangeTime : 8/25/2018 3:06:32 AM
ProcessName : Unknown
RemediationTime :
Resources : {containerfile:_C:\Users\Dave\Downloads\Installed\Format Factory\FFSetup3.0.1.exe,
file:_C:\Users\Dave\Downloads\Installed\Format
Factory\FFSetup3.0.1.exe->(nsis-6-v9fft.exe)}
ThreatID : 240791
ThreatStatusErrorCode : 0
ThreatStatusID : 1
PSComputerName :

ActionSuccess : True
AdditionalActionsBitMask : 0
AMProductVersion : 4.18.1807.18075
CleaningActionID : 9
CurrentThreatExecutionStatusID : 0
DetectionID : {24477645-C696-40F0-A57C-6390EA08DF41}
DetectionSourceTypeID : 1
DomainUser : 2012_Office\Dave
InitialDetectionTime : 8/25/2018 3:06:32 AM
LastThreatStatusChangeTime : 8/25/2018 3:06:32 AM
ProcessName : Unknown
RemediationTime :
Resources : {containerfile:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload
18-06-18\Utilities\Zip Files\wirelesskeyview.zip,
file:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload 18-06-18\Utilities\Zip
Files\wirelesskeyview.zip->WirelessKeyView.exe}
ThreatID : 2147657007
ThreatStatusErrorCode : 0
ThreatStatusID : 1
PSComputerName :

PS C:\windows\system32> get-mpthreat

CategoryID : 13
DidThreatExecute : False
IsActive : True
Resources : {containerfile:_C:\Users\Dave\Downloads\Installed\Format Factory\FFSetup3.0.1.exe,
file:_C:\Users\Dave\Downloads\Installed\Format Factory\FFSetup3.0.1.exe->(nsis-6-v9fft.exe)}
RollupStatus : 1
SchemaVersion : 1.0.0.0
SeverityID : 4
ThreatID : 240791
ThreatName : BrowserModifier:Win32/Beilextec
TypeID : 0
PSComputerName :

CategoryID : 34
DidThreatExecute : False
IsActive : True
Resources : {containerfile:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload 18-06-18\Utilities\Zip
Files\mailpv.zip, file:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload 18-06-18\Utilities\Zip
Files\mailpv.zip->mailpv.exe}
RollupStatus : 1
SchemaVersion : 1.0.0.0
SeverityID : 4
ThreatID : 2147571412
ThreatName : HackTool:Win32/Mailpassview
TypeID : 0
PSComputerName :

CategoryID : 34
DidThreatExecute : False
IsActive : True
Resources : {containerfile:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload 18-06-18\Utilities\Zip
Files\pspv.zip, file:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload 18-06-18\Utilities\Zip
Files\pspv.zip->pspv.exe}
RollupStatus : 1
SchemaVersion : 1.0.0.0
SeverityID : 4
ThreatID : 2147597639
ThreatName : HackTool:Win32/Passview
TypeID : 0
PSComputerName :

CategoryID : 34
DidThreatExecute : False
IsActive : True
Resources : {file:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload 18-06-18\Utilities\Zip
Files\netpass.zip->netpass.exe, containerfile:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload
18-06-18\Utilities\Zip Files\netpass.zip}
RollupStatus : 1
SchemaVersion : 1.0.0.0
SeverityID : 4
ThreatID : 2147605535
ThreatName : HackTool:Win32/Netpass
TypeID : 0
PSComputerName :

CategoryID : 34
DidThreatExecute : False
IsActive : True
Resources : {containerfile:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload 18-06-18\Utilities\Zip
Files\wirelesskeyview.zip, file:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload
18-06-18\Utilities\Zip Files\wirelesskeyview.zip->WirelessKeyView.exe}
RollupStatus : 1
SchemaVersion : 1.0.0.0
SeverityID : 4
ThreatID : 2147657007
ThreatName : HackTool:Win32/Wirekeyview
TypeID : 0
PSComputerName :

CategoryID : 34
DidThreatExecute : False
IsActive : True
Resources : {containerfile:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload 18-06-18\Utilities\Zip
Files\dialupass.zip, regkey:_HKCU@S-1-5-21-4063716828-1680190529-1648852121-1000\software\NirSoft,
file:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload 18-06-18\Utilities\Zip
Files\dialupass.zip->Dialupass.exe, file:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload
18-06-18\Utilities\dialupass\Dialupass.exe}
RollupStatus : 1
SchemaVersion : 1.0.0.0
SeverityID : 4
ThreatID : 2147663673
ThreatName : HackTool:Win32/Dialupas
TypeID : 0
PSComputerName :

CategoryID : 34
DidThreatExecute : False
IsActive : True
Resources : {containerfile:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload 18-06-18\Utilities\Zip
Files\webbrowserpassview.zip, file:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload
18-06-18\Utilities\Zip Files\webbrowserpassview.zip->WebBrowserPassView.exe}
RollupStatus : 1
SchemaVersion : 1.0.0.0
SeverityID : 4
ThreatID : 2147685165
ThreatName : HackTool:Win32/BrowserPassview
TypeID : 0
PSComputerName :

CategoryID : 8
DidThreatExecute : False
IsActive : True
Resources : {file:_C:\Users\Dave\Downloads\Installed\OrbitSetup4.1.18_20130502_1.exe, file:_P:\Old External
Drive Back Up 14-04-06\Office Backup\My Documents\Zip Files\Utilities\AutoHotkey104608_Install.exe}
RollupStatus : 1
SchemaVersion : 1.0.0.0
SeverityID : 5
ThreatID : 2147723143
ThreatName : Trojan:Win32/Bitrep.B
TypeID : 0
PSComputerName :

CategoryID : 8
DidThreatExecute : False
IsActive : True
Resources : {file:_P:\Laptop Backup 14-04-06\Documents and Settings\Ben\My Documents\Downloads\Java.exe}
RollupStatus : 1
SchemaVersion : 1.0.0.0
SeverityID : 5
ThreatID : 2147723656
ThreatName : Trojan:Win32/Fuerboos.E!cl
TypeID : 0
PSComputerName :

One More Thing

The two that are quarantined, but that Windows Defender wants to remove, are Bitrep.B and Beilextec. Should I remove them?

Let me show you what I've found

The 2 below files/folders if not deleted can be.
C:\Users\Dave\Downloads\Installed\OrbitSetup4.1.18_20130502_1.exe
P:\Laptop Backup 14-04-06\Documents and Settings\Ben\MyDocuments\Downloads\Java.exe

Quote:

There's a few password hacking programs on there. This was mostly to help deal with a teenager that was getting into some trouble, and wouldn't open her accounts.

And those programs you downloaded and installed are found.
some identify AutoHotKey as a hacking tool. If you installed this then leave it alone.
Resources : {file:_P:\Old External Drive Back Up 14-04-06\Office Backup\My Documents\Zip Files\Utilities\AutoHotkey104608_Install.exe}

Is considered a freeware hack tool that is used to display passwords for a number of email applications.This tool is used by hackers to hack other computers.
Resources : {containerfile:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload
18-06-18\Utilities\Zip Files\mailpv.zip, file:_C:\Users\Dave\Downloads\Flashdrive(Black) Offload 18-06-18\Utilities\Zip Files\mailpv.zip->mailpv.exe}

Let's remove the below. Research shows me other's had this and it was deleted.
C:\Users\Dave\Downloads\Installed\Format Factory\FFSetup3.0.1.exe

I find the below to be legit. Only thing that comes to mind, as well as with the other legit apps, adware/spyware downloaded along with it.
But it's not displaying any of that.
Resources : {containerfile:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload
18-06-18\Utilities\Zip Files\wirelesskeyview.zip,
file:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload 18-06-18\Utilities\Zip
Files\wirelesskeyview.zip->WirelessKeyView.exe}

The below utility is also used as a hacking tool. Can you see why it was flagged?
Hacktools can be used to patch or "crack" some software so it will run without a valid license or genuine product key.
Beware of running hacktools because they can be associated with malware or unwanted software.

Resources : {containerfile:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload 18-06-18\Utilities\Zip
Files\pspv.zip, file:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload 18-06-18\Utilities\Zip Files\pspv.zip->pspv.exe}

Heres the long story short
Nirsoft is and can be used to steal passwords. You are trying to access a PC by the sounds of it.
Nirsoft to access wifi passwords and windows credentials, even passwords from internet explorer, firefox and chrome.

Quote:

(I did a quarantine and a reboot and it's much better

Hope this is still ongoing?

Quote:

Windows Defender wants to remove, are Bitrep.B and Beilextec. Should I remove them?

I forgot this, Yes

Still Ongoing

Yes, this is still ongoing. I teach university and have a kid moving dorms 4 hours away. The first two weeks are kind of crazy. I will try to do the deletions and post a FRST log tonight.

Files Deleted, FRST Log Pasted

OK. Quarantined everything found by Windows Defender's long scan. Deleted some files as recommended. Did not reboot. Ran FRST. Two logs below.

It will probably be Friday before I am back to this PC for any additional rounds.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 23.08.2018
Ran by Office Administrator (administrator) on 2012_OFFICE (28-08-2018 22:45:23)
Running from C:\Users\Dave\Desktop
Loaded Profiles: Dave & Office Administrator (Available Profiles: Dave & Hope & Ben & Mary Jo & Office Administrator & Share_with_Office & Rich & Administrator & DefaultAppPool)
Platform: Windows 10 Home Version 1803 17134.228 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Edge)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic...ery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Blue Coat Systems, Inc.) C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(PaperCut Software International Pty Ltd) C:\Program Files (x86)\PaperCut Print Logger\pcpl.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
() C:\Program Files\Everything\Everything.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe
(Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1807.18075-0\MsMpEng.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1815.210.0_x64__kzf8qxf38zg5c\SkypeHost.exe
() C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18071.11811.0_x64__8wekyb3d8bbwe\Video.UI.exe
(Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1807.18075-0\NisSrv.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
() C:\Program Files\Everything\Everything.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(f.lux Software LLC) C:\Users\Dave\AppData\Local\FluxSoftware\Flux\flux.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Program Files\Google\Drive\googledrivesync.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Moonchild Productions) C:\Program Files\Pale Moon\palemoon.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(SlySoft, Inc.) C:\Program Files (x86)\SlySoft\CloneCD\CloneCDTray.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Users\Dave\Documents\My Program Files\AutoHotkey\Compiler\keywords.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera_crashreporter.exe
(Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
() C:\Program Files\Google\Drive\googledrivesync.exe
(Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\SeaPort.EXE
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
(Microsoft Corporation) C:\Windows\System32\browser_broker.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsStore_11807.1001.13.0_x64__8wekyb3d8bbwe\WinStore.App.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.10314.31700.0_x64__8wekyb3d8bbwe\Office16\OfficeHubTaskHost.exe
(Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1807.18075-0\MpCmdRun.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [638872 2018-04-11] (Microsoft Corporation)
HKLM\...\Run: [CanonSolutionMenu] => C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [767312 2009-09-04] (CANON INC.)
HKLM\...\Run: [Everything] => C:\Program Files\Everything\Everything.exe [1441792 2014-08-05] ()
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [298296 2018-07-06] (Apple Inc.)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [CloneCDTray] => C:\Program Files (x86)\SlySoft\CloneCD\CloneCDTray.exe [57344 2009-01-29] (SlySoft, Inc.)
HKLM-x32\...\Run: [ArcSoft Connection Service] => C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.)
HKLM-x32\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2109952 2014-10-07] (Dominik Reichl)
HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [1224704 2017-05-17] (Cisco Systems, Inc.)
HKLM\...\RunOnce: [*EmptyTemp] => cmd /c rd /q/s C:\FRST\Temp
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-19\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-11] (Microsoft Corporation)
HKU\S-1-5-20\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-11] (Microsoft Corporation)
HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\...\Run: [F.lux] => C:\Users\Dave\AppData\Local\FluxSoftware\Flux\flux.exe [1806344 2018-07-03] (f.lux Software LLC)
HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\...\Run: [GoogleChromeAutoLaunch_C62251D359A8F5B5CC8EADB510991ABB] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [1577816 2018-08-07] (Google Inc.)
HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\...\Run: [GoogleDriveSync] => C:\Program Files\Google\Drive\googledrivesync.exe [46281248 2018-05-30] ()
HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\...\Run: [AnyDVD] => C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVD.exe [109480 2014-11-08] (SlySoft, Inc.)
HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\...\Run: [Plex Media Server] => C:\Program Files (x86)\Plex\Plex Media Server\Plex Media Server.exe [5127304 2014-11-20] (Plex, Inc.)
HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\...\Run: [SynchronossPC] => C:\Program Files\Verizon\Verizon Cloud\VerizonCloud.exe [2862384 2016-10-10] ()
HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [67384 2018-06-26] (Apple Inc.)
HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-11] (Microsoft Corporation)
HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\...\RunOnce: [iCloud] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloud.exe [67384 2018-06-26] (Apple Inc.)
HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\...\Policies\Explorer: [NoChangeStartMenu] 0
HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\...\Policies\Explorer: [NoLogOff] 0
HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\SysWOW64\2017SC~1.SCR [3170336 2017-08-08] (Finalhit Ltd.)
ShellExecuteHooks: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL -> No File
ShellExecuteHooks-x32: Eudora's Shell Extension - {EDB0E980-90BD-11D4-8599-0008C7D3B6F8} - C:\Program Files (x86)\Eudora\EuShlExt.dll [86016 2005-08-09] (Qualcomm Inc.)
Startup: C:\Users\Dave\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\keywords - Shortcut.lnk [2012-07-31]
ShortcutTarget: keywords - Shortcut.lnk -> C:\Users\Dave\Documents\My Program Files\AutoHotkey\Compiler\keywords.exe ()
Startup: C:\Users\Dave\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk [2016-07-28]
ShortcutTarget: OneNote 2010 Screen Clipper and Launcher.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 74.211.15.210 74.211.15.211 24.56.178.102
Tcpip\..\Interfaces\{2e0767a7-1000-4233-b9a4-a7209860729f}: [DhcpNameServer] 74.211.15.210 74.211.15.211 24.56.178.102
Tcpip\..\Interfaces\{e41e13c2-fdb5-4a91-bf30-2f642af83cec}: [NameServer] 208.67.222.222,8.8.8.8
Tcpip\..\Interfaces\{e41e13c2-fdb5-4a91-bf30-2f642af83cec}: [DhcpNameServer] 74.211.15.210 74.211.15.211 24.56.178.102

Internet Explorer:
==================
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPDSK/1
HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL => No File
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Silverlight\Office14\URLREDIR.DLL => No File
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-03-01] (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll [2014-03-11] (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-03-01] (Oracle Corporation)
Toolbar: HKLM - No Name - {8dcb7100-df86-4384-8842-8fa844297b3f} - No File
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll [2014-03-11] (Microsoft Corporation.)
Toolbar: HKU\S-1-5-21-4063716828-1680190529-1648852121-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File

FireFox:
========
FF ProfilePath: C:\Users\Office Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\63hhxx68.default [2018-08-09]
FF Homepage: Mozilla\Firefox\Profiles\63hhxx68.default -> google.com
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_30_0_0_154.dll [2018-08-15] ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2012-06-21] (Tracker Software Products (Canada) Ltd.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\Program Files\Microsoft Silverlight\Office14\NPAUTHZ.DLL [No File]
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_30_0_0_154.dll [2018-08-15] ()
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2012-06-21] (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-03-01] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-03-01] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-16] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.7 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @wolfram.com/Mathematica -> C:\Program Files (x86)\Common Files\Wolfram Research\Browser\8.0.4.2609412\npmathplugin.dll [2011-10-03] (Wolfram Research, Inc.)
FF Plugin HKU\S-1-5-21-4063716828-1680190529-1648852121-1006: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2012-06-21] (Tracker Software Products (Canada) Ltd.)
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\defaults\pref\itms.js [2011-01-24]

Chrome:
=======
CHR DefaultProfile: Default
CHR StartupUrls: Default -> "hxxp://www.google.com"
CHR Profile: C:\Users\Office Administrator\AppData\Local\Google\Chrome\User Data\Default [2018-08-09]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Office Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-08-05]
CHR Extension: (Chrome Media Router) - C:\Users\Office Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-08-05]
CHR HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Dave\AppData\Local\Google\Drive\user_default\apdfllckaahabafndbhieahigkjlhalf_live.crx [2017-03-12]
CHR HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx

Opera:
=======
OPR Extension: (Pushbullet) - C:\Users\Office Administrator\AppData\Roaming\Opera Software\Opera Stable\Extensions\jacmgnhcnfdmjdkdlfndaccecdegacba [2015-03-01]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2018-07-05] (Apple Inc.)
R2 bckwfs; C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe [2122000 2012-02-13] (Blue Coat Systems, Inc.)
R2 Everything; C:\Program Files\Everything\Everything.exe [1441792 2014-08-05] () [File not signed]
S3 HPAuto; C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe [682040 2011-02-16] (Hewlett-Packard)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6541008 2018-05-03] (Malwarebytes)
R2 PCPrintLogger; C:\Program Files (x86)\PaperCut Print Logger\pcpl.exe [929792 2013-07-03] (PaperCut Software International Pty Ltd) [File not signed]
S4 ssh-agent; C:\WINDOWS\System32\OpenSSH\ssh-agent.exe [495616 2018-03-10] ()
R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [754784 2016-01-08] (DEVGURU Co., LTD.)
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1807.18075-0\NisSrv.exe [3905952 2018-07-31] (Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1807.18075-0\MsMpEng.exe [110944 2018-07-31] (Microsoft Corporation)
S3 WMPNetworkSvc; C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe [913408 2006-10-18] (Microsoft Corporation) [File not signed]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 AnyDVD; C:\WINDOWS\System32\Drivers\AnyDVD.sys [138664 2014-04-24] (SlySoft, Inc.)
R3 AnyDVD; C:\Windows\SysWOW64\Drivers\AnyDVD.sys [138664 2014-04-24] (SlySoft, Inc.)
R1 bckd; C:\WINDOWS\System32\drivers\bckd.sys [108304 2012-02-13] (Blue Coat Systems, Inc.)
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.)
R3 ElbyCDFL; C:\WINDOWS\System32\Drivers\ElbyCDFL.sys [40648 2007-02-15] (SlySoft, Inc.)
R3 ElbyCDFL; C:\Windows\SysWOW64\Drivers\ElbyCDFL.sys [40648 2007-02-15] (SlySoft, Inc.)
R0 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [253664 2018-08-10] (Malwarebytes)
R3 netr28x; C:\WINDOWS\System32\drivers\netr28x.sys [2537984 2018-04-11] (MediaTek Inc.)
S3 pmxdrv; C:\Windows\system32\drivers\pmxdrv.sys [31152 2011-08-19] ()
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [984032 2017-07-24] (Realtek )
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [165504 2016-09-05] (Samsung Electronics Co., Ltd.)
S3 vpnva; C:\WINDOWS\System32\drivers\vpnva64-6.sys [52592 2015-09-23] (Cisco Systems, Inc.)
S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [46584 2018-07-31] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [340008 2018-07-31] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [61992 2018-07-31] (Microsoft Corporation)
U3 idsvc; no ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-08-28 22:45 - 2018-08-28 22:45 - 000000000 ____D C:\Users\Dave\Desktop\FRST-OlderVersion
2018-08-28 22:44 - 2018-08-28 22:45 - 000000000 ____D C:\FRST
2018-08-26 10:27 - 2018-08-26 10:27 - 000015108 _____ C:\Users\Dave\Desktop\Windows Defender Log 18-08-25.txt
2018-08-25 10:56 - 2018-08-25 10:56 - 000250222 _____ C:\Users\Dave\Downloads\Green Pepper Genders Swiflie.pdf
2018-08-21 15:14 - 2018-08-21 15:23 - 000021274 _____ C:\Users\Dave\Downloads\Text Request Form Email Attachment, Tufte, for Fall 2018.xlsx
2018-08-20 00:49 - 2018-08-20 00:49 - 000671029 _____ C:\Users\Dave\Downloads\Holmes;JPE;74;'The Process of International Adjustments Under Conditions of Full Employment - A Keynesian View Revised'.pdf
2018-08-18 15:34 - 2018-08-18 15:35 - 000108701 _____ C:\Users\Dave\Downloads\Iron_County_School_District_Calendar_18-19_SUPER_HIGH_QUALITY.pdf
2018-08-18 11:03 - 2018-08-18 11:03 - 039982433 _____ (Moonchild Productions) C:\Users\Dave\Downloads\palemoon-28.0.0.win64.installer.exe
2018-08-15 23:11 - 2018-08-15 23:16 - 000000000 ____D C:\Users\Dave\Downloads\IDrive
2018-08-15 23:11 - 2018-08-15 23:11 - 002102584 _____ C:\Users\Dave\Downloads\IDrive.zip
2018-08-15 15:54 - 2018-08-15 15:54 - 000417741 _____ C:\Users\Dave\Downloads\Ben's 2018-9 FAFSA Confirmation.pdf
2018-08-15 15:52 - 2018-08-15 15:53 - 003080314 _____ C:\Users\Dave\Downloads\Ben's 2018-9 FAFSA.pdf
2018-08-15 01:04 - 2018-08-02 21:39 - 007519992 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2018-08-15 01:04 - 2018-08-02 21:25 - 006568784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2018-08-15 01:04 - 2018-08-02 21:23 - 025846784 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2018-08-15 01:04 - 2018-08-02 21:18 - 022714880 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2018-08-15 01:04 - 2018-07-14 00:46 - 023862784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Hydrogen.dll
2018-08-15 01:03 - 2018-08-03 02:39 - 021389368 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2018-08-15 01:03 - 2018-08-03 02:39 - 000790304 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2018-08-15 01:03 - 2018-08-03 02:25 - 000178176 _____ (Microsoft Corporation) C:\WINDOWS\system32\t2embed.dll
2018-08-15 01:03 - 2018-08-03 02:25 - 000123392 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontsub.dll
2018-08-15 01:03 - 2018-08-03 02:24 - 000099328 _____ (Microsoft Corporation) C:\WINDOWS\system32\hlink.dll
2018-08-15 01:03 - 2018-08-03 02:24 - 000066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\msiexec.exe
2018-08-15 01:03 - 2018-08-03 02:22 - 001127936 _____ (Microsoft Corporation) C:\WINDOWS\system32\nettrace.dll
2018-08-15 01:03 - 2018-08-03 02:21 - 001364992 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvruserservice.dll
2018-08-15 01:03 - 2018-08-03 02:21 - 001121792 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWorkspace.dll
2018-08-15 01:03 - 2018-08-03 02:21 - 000765440 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdh.dll
2018-08-15 01:03 - 2018-08-03 02:21 - 000391680 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2018-08-15 01:03 - 2018-08-03 02:20 - 004049408 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2018-08-15 01:03 - 2018-08-03 02:20 - 003652608 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2018-08-15 01:03 - 2018-08-03 02:20 - 000134144 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppc.dll
2018-08-15 01:03 - 2018-08-03 02:19 - 001661440 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2018-08-15 01:03 - 2018-08-03 01:45 - 000663128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2018-08-15 01:03 - 2018-08-03 01:43 - 020383720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2018-08-15 01:03 - 2018-08-03 01:33 - 000138752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\t2embed.dll
2018-08-15 01:03 - 2018-08-03 01:33 - 000098304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontsub.dll
2018-08-15 01:03 - 2018-08-03 01:32 - 000060416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msiexec.exe
2018-08-15 01:03 - 2018-08-03 01:30 - 000099840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hlink.dll
2018-08-15 01:03 - 2018-08-03 01:29 - 000621568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdh.dll
2018-08-15 01:03 - 2018-08-03 01:29 - 000343552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2018-08-15 01:03 - 2018-08-03 01:28 - 002895360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2018-08-15 01:03 - 2018-08-03 01:27 - 004050432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
2018-08-15 01:03 - 2018-08-03 01:27 - 001469952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2018-08-15 01:03 - 2018-08-02 23:41 - 001008640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.MixedRealityCapture.dll
2018-08-15 01:03 - 2018-08-02 22:49 - 000868864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.MixedRealityCapture.dll
2018-08-15 01:03 - 2018-08-02 21:47 - 001034624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplyTrustOffline.exe
2018-08-15 01:03 - 2018-08-02 21:47 - 000128920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\scmbus.sys
2018-08-15 01:03 - 2018-08-02 21:46 - 000272296 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave.dll
2018-08-15 01:03 - 2018-08-02 21:46 - 000269248 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave_secure.dll
2018-08-15 01:03 - 2018-08-02 21:41 - 000568600 _____ (Microsoft Corporation) C:\WINDOWS\system32\tcblaunch.exe
2018-08-15 01:03 - 2018-08-02 21:41 - 000077608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hvservice.sys
2018-08-15 01:03 - 2018-08-02 21:41 - 000061736 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvhostsvc.dll
2018-08-15 01:03 - 2018-08-02 21:40 - 001221048 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2018-08-15 01:03 - 2018-08-02 21:40 - 001064744 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2018-08-15 01:03 - 2018-08-02 21:40 - 001030952 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2018-08-15 01:03 - 2018-08-02 21:40 - 000566568 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2018-08-15 01:03 - 2018-08-02 21:40 - 000228136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Ucx01000.sys
2018-08-15 01:03 - 2018-08-02 21:40 - 000136488 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll
2018-08-15 01:03 - 2018-08-02 21:40 - 000072800 _____ (Microsoft Corporation) C:\WINDOWS\system32\wldp.dll
2018-08-15 01:03 - 2018-08-02 21:39 - 009091480 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2018-08-15 01:03 - 2018-08-02 21:39 - 007436120 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2018-08-15 01:03 - 2018-08-02 21:39 - 002829216 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2018-08-15 01:03 - 2018-08-02 21:39 - 001457136 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2018-08-15 01:03 - 2018-08-02 21:39 - 000709824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2018-08-15 01:03 - 2018-08-02 21:39 - 000692240 _____ (Microsoft Corporation) C:\WINDOWS\system32\StructuredQuery.dll
2018-08-15 01:03 - 2018-08-02 21:39 - 000170936 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2018-08-15 01:03 - 2018-08-02 21:39 - 000114080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmbus.sys
2018-08-15 01:03 - 2018-08-02 21:39 - 000075160 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vpci.sys
2018-08-15 01:03 - 2018-08-02 21:39 - 000031648 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\winhv.sys
2018-08-15 01:03 - 2018-08-02 21:38 - 002765440 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2018-08-15 01:03 - 2018-08-02 21:38 - 001945792 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2018-08-15 01:03 - 2018-08-02 21:38 - 001285536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys
2018-08-15 01:03 - 2018-08-02 21:38 - 001258288 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2018-08-15 01:03 - 2018-08-02 21:38 - 001140576 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2018-08-15 01:03 - 2018-08-02 21:38 - 001097648 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvproc.dll
2018-08-15 01:03 - 2018-08-02 21:38 - 000983016 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2018-08-15 01:03 - 2018-08-02 21:38 - 000885856 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2018-08-15 01:03 - 2018-08-02 21:38 - 000713368 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVideoDSP.dll
2018-08-15 01:03 - 2018-08-02 21:38 - 000604576 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe
2018-08-15 01:03 - 2018-08-02 21:38 - 000158720 _____ (Microsoft Corporation) C:\WINDOWS\system32\vertdll.dll
2018-08-15 01:03 - 2018-08-02 21:38 - 000115640 _____ (Microsoft Corporation) C:\WINDOWS\system32\kdnet.dll
2018-08-15 01:03 - 2018-08-02 21:27 - 000061032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wldp.dll
2018-08-15 01:03 - 2018-08-02 21:26 - 006043600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2018-08-15 01:03 - 2018-08-02 21:25 - 002255008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2018-08-15 01:03 - 2018-08-02 21:25 - 001622296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2018-08-15 01:03 - 2018-08-02 21:25 - 001131064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvproc.dll
2018-08-15 01:03 - 2018-08-02 21:25 - 000583120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVideoDSP.dll
2018-08-15 01:03 - 2018-08-02 21:25 - 000568568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2018-08-15 01:03 - 2018-08-02 21:25 - 000539168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StructuredQuery.dll
2018-08-15 01:03 - 2018-08-02 21:18 - 022007808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2018-08-15 01:03 - 2018-08-02 21:17 - 004380160 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeContent.dll
2018-08-15 01:03 - 2018-08-02 21:16 - 000144384 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll
2018-08-15 01:03 - 2018-08-02 21:15 - 008188928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2018-08-15 01:03 - 2018-08-02 21:15 - 000068096 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\winhvr.sys
2018-08-15 01:03 - 2018-08-02 21:14 - 004867584 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2018-08-15 01:03 - 2018-08-02 21:14 - 000514560 _____ (Microsoft Corporation) C:\WINDOWS\system32\nltest.exe
2018-08-15 01:03 - 2018-08-02 21:14 - 000209408 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXApplicabilityBlob.dll
2018-08-15 01:03 - 2018-08-02 21:14 - 000113664 _____ (Microsoft Corporation) C:\WINDOWS\system32\WaaSAssessment.dll
2018-08-15 01:03 - 2018-08-02 21:13 - 019404288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2018-08-15 01:03 - 2018-08-02 21:13 - 006661632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2018-08-15 01:03 - 2018-08-02 21:13 - 003395072 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2018-08-15 01:03 - 2018-08-02 21:13 - 000395776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Search.ProtocolHandler.MAPI2.dll
2018-08-15 01:03 - 2018-08-02 21:12 - 003392000 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll
2018-08-15 01:03 - 2018-08-02 21:12 - 002738688 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssrch.dll
2018-08-15 01:03 - 2018-08-02 21:12 - 000894464 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll
2018-08-15 01:03 - 2018-08-02 21:12 - 000761344 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
2018-08-15 01:03 - 2018-08-02 21:12 - 000726528 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2018-08-15 01:03 - 2018-08-02 21:12 - 000311296 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netbt.sys
2018-08-15 01:03 - 2018-08-02 21:11 - 007577088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2018-08-15 01:03 - 2018-08-02 21:11 - 003712000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2018-08-15 01:03 - 2018-08-02 21:11 - 002700288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll
2018-08-15 01:03 - 2018-08-02 21:11 - 002172928 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2018-08-15 01:03 - 2018-08-02 21:11 - 001708544 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSPhotography.dll
2018-08-15 01:03 - 2018-08-02 21:11 - 000983040 _____ (Microsoft Corporation) C:\WINDOWS\system32\wbiosrvc.dll
2018-08-15 01:03 - 2018-08-02 21:11 - 000898560 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebFilter.dll
2018-08-15 01:03 - 2018-08-02 21:11 - 000808448 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeManager.dll
2018-08-15 01:03 - 2018-08-02 21:10 - 001535488 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2018-08-15 01:03 - 2018-08-02 21:09 - 005776896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2018-08-15 01:03 - 2018-08-02 21:09 - 004615680 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2018-08-15 01:03 - 2018-08-02 21:09 - 001932288 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgeangle.dll
2018-08-15 01:03 - 2018-08-02 21:09 - 001854976 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll
2018-08-15 01:03 - 2018-08-02 21:09 - 001550848 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2018-08-15 01:03 - 2018-08-02 21:09 - 001395200 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2018-08-15 01:03 - 2018-08-02 21:09 - 001361408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSPhotography.dll
2018-08-15 01:03 - 2018-08-02 21:09 - 001057792 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchIndexer.exe
2018-08-15 01:03 - 2018-08-02 21:09 - 000916480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll
2018-08-15 01:03 - 2018-08-02 21:08 - 002258944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssrch.dll
2018-08-15 01:03 - 2018-08-02 21:08 - 002236928 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2018-08-15 01:03 - 2018-08-02 21:08 - 000796672 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssvp.dll
2018-08-15 01:03 - 2018-08-02 21:08 - 000776192 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2018-08-15 01:03 - 2018-08-02 21:08 - 000608768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EdgeManager.dll
2018-08-15 01:03 - 2018-08-02 21:08 - 000602112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll
2018-08-15 01:03 - 2018-08-02 21:08 - 000561152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2018-08-15 01:03 - 2018-08-02 21:08 - 000542208 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2018-08-15 01:03 - 2018-08-02 21:08 - 000406528 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchProtocolHost.exe
2018-08-15 01:03 - 2018-08-02 21:08 - 000331264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgeIso.dll
2018-08-15 01:03 - 2018-08-02 21:07 - 000578560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll
2018-08-15 01:03 - 2018-08-02 21:07 - 000505344 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgeIso.dll
2018-08-15 01:03 - 2018-08-02 21:07 - 000176640 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssph.dll
2018-08-15 01:03 - 2018-08-02 21:06 - 004191232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2018-08-15 01:03 - 2018-08-02 21:06 - 001000448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2018-08-15 01:03 - 2018-08-02 21:06 - 000856064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchIndexer.exe
2018-08-15 01:03 - 2018-08-02 21:06 - 000678400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll
2018-08-15 01:03 - 2018-08-02 21:06 - 000619520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WpcWebFilter.dll
2018-08-15 01:03 - 2018-08-02 21:06 - 000251904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll
2018-08-15 01:03 - 2018-08-02 21:05 - 000735744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssvp.dll
2018-08-15 01:03 - 2018-08-02 21:05 - 000669696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2018-08-15 01:03 - 2018-08-02 21:05 - 000534016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2018-08-15 01:03 - 2018-08-02 21:04 - 000345088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchProtocolHost.exe
2018-08-15 01:03 - 2018-07-14 18:58 - 000094112 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2018-08-15 01:03 - 2018-07-14 18:56 - 001523240 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2018-08-15 01:03 - 2018-07-14 18:44 - 006587392 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2018-08-15 01:03 - 2018-07-14 18:43 - 012710400 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2018-08-15 01:03 - 2018-07-14 18:42 - 008624128 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2018-08-15 01:03 - 2018-07-14 18:42 - 004708864 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.pcshell.dll
2018-08-15 01:03 - 2018-07-14 18:41 - 000169984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.XamlHost.dll
2018-08-15 01:03 - 2018-07-14 18:41 - 000075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProvSysprep.dll
2018-08-15 01:03 - 2018-07-14 18:39 - 001787392 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_health.dll
2018-08-15 01:03 - 2018-07-14 18:39 - 001605632 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2018-08-15 01:03 - 2018-07-14 18:38 - 002051584 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_fs.dll
2018-08-15 01:03 - 2018-07-14 18:38 - 001180160 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
2018-08-15 01:03 - 2018-07-14 18:38 - 001004032 _____ (Microsoft Corporation) C:\WINDOWS\system32\clusapi.dll
2018-08-15 01:03 - 2018-07-14 18:38 - 000615936 _____ (Microsoft Corporation) C:\WINDOWS\system32\resutils.dll
2018-08-15 01:03 - 2018-07-14 18:36 - 000091136 _____ (Microsoft Corporation) C:\WINDOWS\system32\mcbuilder.exe
2018-08-15 01:03 - 2018-07-14 17:28 - 001327424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2018-08-15 01:03 - 2018-07-14 17:18 - 005657600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2018-08-15 01:03 - 2018-07-14 17:17 - 011901440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2018-08-15 01:03 - 2018-07-14 17:15 - 007987712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2018-08-15 01:03 - 2018-07-14 17:14 - 000133632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.XamlHost.dll
2018-08-15 01:03 - 2018-07-14 17:13 - 001452544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_fs.dll
2018-08-15 01:03 - 2018-07-14 17:13 - 001308160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_health.dll
2018-08-15 01:03 - 2018-07-14 17:13 - 000775168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\clusapi.dll
2018-08-15 01:03 - 2018-07-14 17:13 - 000485376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\resutils.dll
2018-08-15 01:03 - 2018-07-14 17:11 - 000080384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mcbuilder.exe
2018-08-15 01:03 - 2018-07-14 00:42 - 019525632 _____ (Microsoft Corporation) C:\WINDOWS\system32\HologramCompositor.dll
2018-08-15 01:03 - 2018-07-13 22:37 - 000375712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys
2018-08-15 01:03 - 2018-07-13 22:37 - 000230304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tpm.sys
2018-08-15 01:03 - 2018-07-13 22:23 - 000760888 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecurityHealthService.exe
2018-08-15 01:03 - 2018-07-13 22:22 - 006813744 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2018-08-15 01:03 - 2018-07-13 22:22 - 001144664 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetcore.dll
2018-08-15 01:03 - 2018-07-13 22:22 - 000510392 _____ (Microsoft Corporation) C:\WINDOWS\system32\policymanager.dll
2018-08-15 01:03 - 2018-07-13 22:22 - 000203560 _____ (Microsoft Corporation) C:\WINDOWS\system32\rsaenh.dll
2018-08-15 01:03 - 2018-07-13 22:21 - 000722824 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2018-08-15 01:03 - 2018-07-13 22:21 - 000192920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\appid.sys
2018-08-15 01:03 - 2018-07-13 22:20 - 000184472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rsaenh.dll
2018-08-15 01:03 - 2018-07-13 22:19 - 002535032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2018-08-15 01:03 - 2018-07-13 22:19 - 001946752 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfplat.dll
2018-08-15 01:03 - 2018-07-13 22:19 - 000981920 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll
2018-08-15 01:03 - 2018-07-13 22:19 - 000636944 _____ (Microsoft Corporation) C:\WINDOWS\system32\services.exe
2018-08-15 01:03 - 2018-07-13 22:19 - 000483024 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase_enclave.dll
2018-08-15 01:03 - 2018-07-13 22:18 - 002563984 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2018-08-15 01:03 - 2018-07-13 22:18 - 002371416 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll
2018-08-15 01:03 - 2018-07-13 22:18 - 001017584 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase.dll
2018-08-15 01:03 - 2018-07-13 22:18 - 000930712 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWAHost.exe
2018-08-15 01:03 - 2018-07-13 22:18 - 000613176 _____ (Microsoft Corporation) C:\WINDOWS\system32\TextInputFramework.dll
2018-08-15 01:03 - 2018-07-13 22:18 - 000443216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\policymanager.dll
2018-08-15 01:03 - 2018-07-13 22:18 - 000376216 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fastfat.sys
2018-08-15 01:03 - 2018-07-13 22:17 - 006527056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2018-08-15 01:03 - 2018-07-13 22:17 - 002420632 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2018-08-15 01:03 - 2018-07-13 22:17 - 000743320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll
2018-08-15 01:03 - 2018-07-13 22:16 - 002331576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2vdec.dll
2018-08-15 01:03 - 2018-07-13 22:16 - 001143096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetcore.dll
2018-08-15 01:03 - 2018-07-13 22:16 - 000506728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TextInputFramework.dll
2018-08-15 01:03 - 2018-07-13 22:15 - 001559368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfplat.dll
2018-08-15 01:03 - 2018-07-13 22:15 - 001174552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ucrtbase.dll
2018-08-15 01:03 - 2018-07-13 22:15 - 000829856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWAHost.exe
2018-08-15 01:03 - 2018-07-13 22:01 - 006647296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingMaps.dll
2018-08-15 01:03 - 2018-07-13 21:59 - 009084928 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll
2018-08-15 01:03 - 2018-07-13 21:59 - 005883392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll
2018-08-15 01:03 - 2018-07-13 21:59 - 003553280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputService.dll
2018-08-15 01:03 - 2018-07-13 21:58 - 000094720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataTimeUtil.dll
2018-08-15 01:03 - 2018-07-13 21:57 - 007057920 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll
2018-08-15 01:03 - 2018-07-13 21:57 - 004331008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2018-08-15 01:03 - 2018-07-13 21:57 - 001295360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVPXENC.dll
2018-08-15 01:03 - 2018-07-13 21:57 - 000391168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\daxexec.dll
2018-08-15 01:03 - 2018-07-13 21:56 - 004559872 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2018-08-15 01:03 - 2018-07-13 21:56 - 002900992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2018-08-15 01:03 - 2018-07-13 21:56 - 002697216 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Controls.dll
2018-08-15 01:03 - 2018-07-13 21:56 - 002449408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapRouter.dll
2018-08-15 01:03 - 2018-07-13 21:56 - 001986560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapGeocoder.dll
2018-08-15 01:03 - 2018-07-13 21:56 - 001703936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Controls.dll
2018-08-15 01:03 - 2018-07-13 21:56 - 001558016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpserverbase.dll
2018-08-15 01:03 - 2018-07-13 21:56 - 000392704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapConfiguration.dll
2018-08-15 01:03 - 2018-07-13 21:56 - 000365568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpencom.dll
2018-08-15 01:03 - 2018-07-13 21:56 - 000257536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WiFiDisplay.dll
2018-08-15 01:03 - 2018-07-13 21:56 - 000118784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\raschap.dll
2018-08-15 01:03 - 2018-07-13 21:55 - 001627136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2018-08-15 01:03 - 2018-07-13 21:55 - 001124352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdprt.dll
2018-08-15 01:03 - 2018-07-13 21:55 - 000993792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.Vpn.dll
2018-08-15 01:03 - 2018-07-13 21:55 - 000458752 _____ (Microsoft Corporation) C:\WINDOWS\system32\cloudAP.dll
2018-08-15 01:03 - 2018-07-13 21:55 - 000414720 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cldflt.sys
2018-08-15 01:03 - 2018-07-13 21:55 - 000344576 _____ (Microsoft Corporation) C:\WINDOWS\system32\RasMediaManager.dll
2018-08-15 01:03 - 2018-07-13 21:55 - 000317440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dhcpcore.dll
2018-08-15 01:03 - 2018-07-13 21:55 - 000282624 _____ (Microsoft Corporation) C:\WINDOWS\system32\provops.dll
2018-08-15 01:03 - 2018-07-13 21:55 - 000227840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\winnat.sys
2018-08-15 01:03 - 2018-07-13 21:55 - 000208384 _____ (Microsoft Corporation) C:\WINDOWS\system32\provisioningcsp.dll
2018-08-15 01:03 - 2018-07-13 21:55 - 000147456 _____ (Microsoft Corporation) C:\WINDOWS\system32\datamarketsvc.dll
2018-08-15 01:03 - 2018-07-13 21:55 - 000119296 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataTimeUtil.dll
2018-08-15 01:03 - 2018-07-13 21:55 - 000062976 _____ (Microsoft Corporation) C:\WINDOWS\system32\EASPolicyManagerBrokerHost.exe
2018-08-15 01:03 - 2018-07-13 21:54 - 003319808 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2018-08-15 01:03 - 2018-07-13 21:54 - 002825728 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapGeocoder.dll
2018-08-15 01:03 - 2018-07-13 21:54 - 001627136 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2018-08-15 01:03 - 2018-07-13 21:54 - 001537024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActiveSyncProvider.dll
2018-08-15 01:03 - 2018-07-13 21:54 - 001307648 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVPXENC.dll
2018-08-15 01:03 - 2018-07-13 21:54 - 000898560 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
2018-08-15 01:03 - 2018-07-13 21:54 - 000729088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NMAA.dll
2018-08-15 01:03 - 2018-07-13 21:54 - 000603648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PCPKsp.dll
2018-08-15 01:03 - 2018-07-13 21:54 - 000530432 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapConfiguration.dll
2018-08-15 01:03 - 2018-07-13 21:54 - 000444416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dmenrollengine.dll
2018-08-15 01:03 - 2018-07-13 21:54 - 000409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpencom.dll
2018-08-15 01:03 - 2018-07-13 21:54 - 000392192 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll
2018-08-15 01:03 - 2018-07-13 21:54 - 000358400 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\exfat.sys
2018-08-15 01:03 - 2018-07-13 21:54 - 000352768 _____ (Microsoft Corporation) C:\WINDOWS\system32\dhcpcore.dll
2018-08-15 01:03 - 2018-07-13 21:54 - 000262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\PushToInstall.dll
2018-08-15 01:03 - 2018-07-13 21:54 - 000137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\raschap.dll
2018-08-15 01:03 - 2018-07-13 21:54 - 000014336 _____ (Microsoft Corporation) C:\WINDOWS\system32\EasPolicyManagerBrokerPS.dll
2018-08-15 01:03 - 2018-07-13 21:53 - 004770816 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputService.dll
2018-08-15 01:03 - 2018-07-13 21:53 - 003381248 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapRouter.dll
2018-08-15 01:03 - 2018-07-13 21:53 - 002368512 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebRuntimeManager.dll
2018-08-15 01:03 - 2018-07-13 21:53 - 001825792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.CloudStore.dll
2018-08-15 01:03 - 2018-07-13 21:53 - 001668096 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdprt.dll
2018-08-15 01:03 - 2018-07-13 21:53 - 000713216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingOnlineServices.dll
2018-08-15 01:03 - 2018-07-13 21:53 - 000705024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapControlCore.dll
2018-08-15 01:03 - 2018-07-13 21:53 - 000681984 _____ (Microsoft Corporation) C:\WINDOWS\system32\WFDSConMgrSvc.dll
2018-08-15 01:03 - 2018-07-13 21:53 - 000566272 _____ (Microsoft Corporation) C:\WINDOWS\system32\daxexec.dll
2018-08-15 01:03 - 2018-07-13 21:53 - 000450560 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneCoreCommonProxyStub.dll
2018-08-15 01:03 - 2018-07-13 21:53 - 000396800 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2018-08-15 01:03 - 2018-07-13 21:53 - 000220160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmregistration.dll
2018-08-15 01:03 - 2018-07-13 21:52 - 000972800 _____ (Microsoft Corporation) C:\WINDOWS\system32\sysmain.dll
2018-08-15 01:03 - 2018-07-13 21:52 - 000790528 _____ (Microsoft Corporation) C:\WINDOWS\system32\PCPKsp.dll
2018-08-15 01:03 - 2018-07-13 21:52 - 000755712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll
2018-08-15 01:03 - 2018-07-13 21:52 - 000506880 _____ (Microsoft Corporation) C:\WINDOWS\system32\netprofmsvc.dll
2018-08-15 01:03 - 2018-07-13 21:52 - 000311296 _____ (Microsoft Corporation) C:\WINDOWS\system32\WiFiDisplay.dll
2018-08-15 01:03 - 2018-07-13 21:51 - 003376640 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkMobileSettings.dll
2018-08-15 01:03 - 2018-07-13 21:51 - 002904576 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2018-08-15 01:03 - 2018-07-13 21:51 - 001804288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2018-08-15 01:03 - 2018-07-13 21:51 - 001747968 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpserverbase.dll
2018-08-15 01:03 - 2018-07-13 21:51 - 001304064 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.Vpn.dll
2018-08-15 01:03 - 2018-07-13 21:51 - 000491520 _____ (Microsoft Corporation) C:\WINDOWS\system32\defragsvc.dll
2018-08-15 01:03 - 2018-07-13 21:51 - 000466432 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll
2018-08-15 01:03 - 2018-07-13 21:50 - 001773056 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActiveSyncProvider.dll
2018-08-15 01:03 - 2018-07-13 21:50 - 001457664 _____ (Microsoft Corporation) C:\WINDOWS\system32\dosvc.dll
2018-08-15 01:03 - 2018-07-13 21:50 - 001359360 _____ (Microsoft Corporation) C:\WINDOWS\system32\lpasvc.dll
2018-08-15 01:03 - 2018-07-13 21:50 - 001225216 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsStore.dll
2018-08-15 01:03 - 2018-07-13 21:50 - 000949760 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll
2018-08-15 01:03 - 2018-07-13 21:50 - 000943616 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingOnlineServices.dll
2018-08-15 01:03 - 2018-07-13 21:50 - 000932352 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasmans.dll
2018-08-15 01:03 - 2018-07-13 21:50 - 000884224 _____ (Microsoft Corporation) C:\WINDOWS\system32\NMAA.dll
2018-08-15 01:03 - 2018-07-13 21:50 - 000522752 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmenrollengine.dll
2018-08-15 01:03 - 2018-07-13 21:49 - 000884736 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapControlCore.dll
2018-08-15 01:03 - 2018-07-12 22:30 - 002718624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2018-08-15 01:02 - 2018-08-03 02:24 - 000046592 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2018-08-15 01:02 - 2018-08-02 21:17 - 000010240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmgid.sys
2018-08-15 01:02 - 2018-08-02 21:16 - 000018432 _____ (Microsoft Corporation) C:\WINDOWS\system32\winshfhc.dll
2018-08-15 01:02 - 2018-08-02 21:13 - 000154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2018-08-15 01:02 - 2018-08-02 21:10 - 000015872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winshfhc.dll
2018-08-15 01:02 - 2018-08-02 21:08 - 000288768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Search.ProtocolHandler.MAPI2.dll
2018-08-15 01:02 - 2018-08-02 21:07 - 000115712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
2018-08-15 01:02 - 2018-08-02 19:54 - 000001312 _____ C:\WINDOWS\system32\tcbres.wim
2018-08-15 01:02 - 2018-07-14 18:44 - 000064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\iemigplugin.dll
2018-08-15 01:02 - 2018-07-13 21:58 - 000172544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\enrollmentapi.dll
2018-08-15 01:02 - 2018-07-13 21:58 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tzres.dll
2018-08-15 01:02 - 2018-07-13 21:56 - 000073728 _____ (Microsoft Corporation) C:\WINDOWS\system32\WFDSConMgr.dll
2018-08-15 01:02 - 2018-07-13 21:55 - 000582144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Core.TextInput.dll
2018-08-15 01:02 - 2018-07-13 21:55 - 000205312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OneCoreCommonProxyStub.dll
2018-08-15 01:02 - 2018-07-13 21:55 - 000204288 _____ (Microsoft Corporation) C:\WINDOWS\system32\enrollmentapi.dll
2018-08-15 01:02 - 2018-07-13 21:55 - 000185856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mdmregistration.dll
2018-08-15 01:02 - 2018-07-13 21:55 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\system32\tzres.dll
2018-08-15 01:02 - 2018-07-13 21:50 - 000401920 _____ (Microsoft Corporation) C:\WINDOWS\system32\rascustom.dll
2018-08-13 15:37 - 2018-08-13 15:37 - 000118284 _____ C:\Users\Office Administrator\Desktop\K9 Log 18-08-13.txt
2018-08-13 15:29 - 2018-08-13 15:30 - 000001301 _____ C:\DelFix.txt
2018-08-11 10:29 - 2018-08-11 10:29 - 007417040 _____ (Malwarebytes) C:\Users\Dave\Desktop\adwcleaner_7.2.2.exe
2018-08-10 14:23 - 2018-08-10 14:23 - 000013964 _____ C:\Users\Office Administrator\Desktop\Forensics_180810-142309.txt
2018-08-10 14:06 - 2018-08-10 14:06 - 000000000 ___HD C:\OneDriveTemp
2018-08-10 11:54 - 2018-08-10 11:54 - 000000000 ____D C:\ProgramData\Emsisoft
2018-08-10 11:52 - 2018-08-10 14:27 - 000000000 ____D C:\EEK
2018-08-10 11:50 - 2018-08-10 11:51 - 353335496 _____ C:\Users\Dave\Desktop\EmsisoftEmergencyKit.exe
2018-08-10 11:39 - 2018-08-10 11:49 - 000001415 _____ C:\Users\Dave\Desktop\180810 Malwarebytes Report.txt
2018-08-10 01:57 - 2018-08-10 01:57 - 000011774 _____ C:\Users\Office Administrator\Desktop\rk_AAF2.tmp.txt
2018-08-10 00:19 - 2018-08-10 00:19 - 000028272 _____ C:\WINDOWS\system32\Drivers\TrueSight.sys
2018-08-10 00:18 - 2018-08-10 11:40 - 000000000 ____D C:\ProgramData\RogueKiller
2018-08-10 00:18 - 2018-08-10 00:18 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller
2018-08-10 00:18 - 2018-08-10 00:18 - 000000000 ____D C:\Program Files\RogueKiller
2018-08-10 00:16 - 2018-08-10 00:17 - 036798240 _____ (Adlice Software ) C:\Users\Dave\Desktop\RogueKiller_setup.exe
2018-08-10 00:10 - 2018-08-10 00:10 - 000003156 _____ C:\WINDOWS\System32\Tasks\AdwCleaner_onReboot
2018-08-09 23:46 - 2018-08-09 23:49 - 000040530 _____ C:\Users\Dave\Desktop\Fixlog.txt
2018-08-09 10:44 - 2018-08-09 10:54 - 000000000 ____D C:\WINDOWS\Minidump
2018-08-09 10:38 - 2018-08-09 10:38 - 005198336 _____ (AVAST Software) C:\Users\Dave\Desktop\aswMBR.exe
2018-08-09 10:27 - 2018-08-09 10:29 - 000084822 _____ C:\Users\Dave\Desktop\Addition.txt
2018-08-09 10:24 - 2018-08-28 22:46 - 000024098 _____ C:\Users\Dave\Desktop\FRST.txt
2018-08-09 10:23 - 2018-08-28 22:45 - 002413056 _____ (Farbar) C:\Users\Dave\Desktop\FRST64.exe
2018-08-09 10:20 - 2018-08-09 10:20 - 000017999 _____ C:\WINDOWS\Tweaking.com - Registry Backup Setup Log.txt
2018-08-09 10:20 - 2018-08-09 10:20 - 000002314 _____ C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
2018-08-09 10:20 - 2018-08-09 10:20 - 000000207 _____ C:\WINDOWS\tweaking.com-regbackup-2012_OFFICE-Windows-10-Home-(64-bit).dat
2018-08-09 10:20 - 2018-08-09 10:20 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2018-08-09 10:20 - 2018-08-09 10:20 - 000000000 ____D C:\Program Files (x86)\Tweaking.com
2018-08-09 10:18 - 2018-08-09 10:18 - 005766144 _____ (Tweaking.com) C:\Users\Dave\Desktop\tweaking.com_registry_backup_setup.exe
2018-08-08 11:30 - 2018-08-08 11:31 - 000007794 _____ C:\Users\Dave\Downloads\Grateful Dead Releases by Date.txt
2018-08-06 13:26 - 2018-08-06 13:26 - 000428662 _____ C:\Users\Dave\Downloads\Know Your Vehicle.pdf

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-08-28 22:47 - 2018-04-11 17:38 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2018-08-28 22:31 - 2012-06-19 10:07 - 000000000 ____D C:\Users\Dave\AppData\Roaming\vlc
2018-08-28 22:19 - 2018-05-15 23:51 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2018-08-28 22:11 - 2018-05-16 00:43 - 000004158 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{CB1BE535-6F0F-4578-8662-9C0E1D1C3C7F}
2018-08-28 19:59 - 2013-08-02 00:48 - 000000000 ____D C:\Users\Dave\Downloads\Dave's Phone
2018-08-28 19:58 - 2018-01-25 00:57 - 000000000 ____D C:\Users\Dave\Downloads\Memes I Liked
2018-08-28 06:57 - 2018-04-11 17:30 - 000000000 ____D C:\WINDOWS\CbsTemp
2018-08-28 02:15 - 2018-04-11 17:38 - 000000000 ___HD C:\Program Files\WindowsApps
2018-08-28 02:15 - 2018-04-11 17:38 - 000000000 ____D C:\WINDOWS\AppReadiness
2018-08-26 11:04 - 2016-11-26 00:39 - 000000000 ____D C:\Users\Dave\AppData\LocalLow\Mozilla
2018-08-26 11:03 - 2015-03-01 12:24 - 000000000 ____D C:\Program Files (x86)\Opera
2018-08-26 11:01 - 2018-05-15 23:56 - 000968400 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2018-08-26 11:01 - 2018-04-11 17:36 - 000000000 ____D C:\WINDOWS\INF
2018-08-26 10:59 - 2016-07-23 22:49 - 000000000 ___RD C:\Users\Dave\OneDrive
2018-08-26 10:58 - 2012-06-28 14:05 - 000000000 ____D C:\Users\Dave\AppData\Local\CrashDumps
2018-08-26 10:54 - 2018-05-16 00:43 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2018-08-26 10:53 - 2018-04-11 15:04 - 001310720 _____ C:\WINDOWS\system32\config\BBI
2018-08-26 10:53 - 2015-08-03 11:34 - 000000000 ____D C:\Users\Dave\AppData\Roaming\Everything
2018-08-26 10:35 - 2018-04-11 17:38 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2018-08-19 12:41 - 2016-02-15 01:00 - 000000000 ____D C:\Users\Dave\Downloads\Podcasts
2018-08-18 11:04 - 2016-12-17 12:58 - 000000000 ____D C:\Program Files\Pale Moon
2018-08-18 11:04 - 2013-06-11 13:27 - 000000968 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pale Moon.lnk
2018-08-18 11:04 - 2013-06-11 13:27 - 000000956 _____ C:\Users\Public\Desktop\Pale Moon.lnk
2018-08-17 08:00 - 2014-12-11 00:49 - 000000000 ____D C:\Users\Dave\AppData\Roaming\KeePass
2018-08-15 17:34 - 2018-05-16 00:43 - 000004530 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player PPAPI Notifier
2018-08-15 17:34 - 2018-04-11 17:38 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
2018-08-15 17:34 - 2018-04-11 17:38 - 000000000 ____D C:\WINDOWS\system32\Macromed
2018-08-15 15:52 - 2016-06-10 11:22 - 000000000 ____D C:\Users\Dave\AppData\LocalLow\Temp
2018-08-15 13:00 - 2017-12-23 20:18 - 000000000 ___RD C:\Users\Dave\3D Objects
2018-08-15 13:00 - 2016-07-23 22:45 - 000000000 __RHD C:\Users\Public\AccountPictures
2018-08-15 12:59 - 2018-05-15 23:51 - 000453184 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\zu-ZA
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\yo-NG
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\xh-ZA
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\wo-SN
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\uz-Latn-UZ
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\tn-ZA
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\ti-ET
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\tg-Cyrl-TJ
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\sr-Cyrl-RS
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\sr-Cyrl-BA
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\sd-Arab-PK
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\rw-RW
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\quc-Latn-GT
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\pa-Arab-PK
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\nso-ZA
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\ku-Arab-IQ
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\ig-NG
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\ha-Latn-NG
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\chr-CHER-US
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\ca-ES-valencia
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\bs-Latn-BA
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\az-Latn-AZ
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\zu-ZA
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\yo-NG
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\xh-ZA
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\wo-SN
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\uz-Latn-UZ
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\tn-ZA
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\ti-ET
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\tg-Cyrl-TJ
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\sr-Cyrl-RS
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\sr-Cyrl-BA
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\sd-Arab-PK
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\rw-RW
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\quc-Latn-GT
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\pa-Arab-PK
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\nso-ZA
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\ku-Arab-IQ
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\ig-NG
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\ha-Latn-NG
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\chr-CHER-US
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\ca-ES-valencia
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\bs-Latn-BA
2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\az-Latn-AZ
2018-08-15 12:55 - 2018-04-11 17:38 - 000000000 ___SD C:\WINDOWS\SysWOW64\F12
2018-08-15 12:55 - 2018-04-11 17:38 - 000000000 ___SD C:\WINDOWS\system32\UNP
2018-08-15 12:55 - 2018-04-11 17:38 - 000000000 ___SD C:\WINDOWS\system32\F12
2018-08-15 12:55 - 2018-04-11 17:38 - 000000000 ___SD C:\WINDOWS\system32\DiagSvcs
2018-08-15 12:55 - 2018-04-11 17:38 - 000000000 ___RD C:\WINDOWS\PrintDialog
2018-08-15 12:55 - 2018-04-11 17:38 - 000000000 ___RD C:\Program Files\Windows Defender
2018-08-15 12:55 - 2018-04-11 17:38 - 000000000 ____D C:\WINDOWS\TextInput
2018-08-15 12:55 - 2018-04-11 17:38 - 000000000 ____D C:\WINDOWS\system32\ShellExperiences
2018-08-15 12:55 - 2018-04-11 17:38 - 000000000 ____D C:\WINDOWS\ShellExperiences
2018-08-15 12:55 - 2018-04-11 17:38 - 000000000 ____D C:\WINDOWS\bcastdvr
2018-08-15 12:55 - 2018-04-11 17:38 - 000000000 ____D C:\Program Files (x86)\Windows Defender
2018-08-15 12:54 - 2013-08-14 09:15 - 000000000 ____D C:\WINDOWS\system32\MRT
2018-08-15 01:34 - 2018-05-16 00:43 - 000004578 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player NPAPI Notifier
2018-08-15 01:17 - 2012-06-16 13:56 - 137343192 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2018-08-15 01:16 - 2009-07-13 20:34 - 000000478 _____ C:\WINDOWS\win.ini
2018-08-13 15:30 - 2007-11-24 23:54 - 000000000 ____D C:\Program Files (x86)\Trend Micro
2018-08-11 12:58 - 2018-05-16 00:43 - 000000000 ____D C:\WINDOWS\System32\Tasks\OfficeSoftwareProtectionPlatform
2018-08-10 14:00 - 2012-06-26 18:29 - 000000000 ____D C:\Users\Dave\Downloads\Installed
2018-08-10 11:41 - 2012-07-03 10:13 - 000000000 ____D C:\Program Files (x86)\SABnzbd
2018-08-10 01:42 - 2009-07-13 21:20 - 000000000 ___HD C:\WINDOWS\system32\GroupPolicy
2018-08-10 00:47 - 2018-05-16 00:43 - 000003368 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-4063716828-1680190529-1648852121-1000
2018-08-10 00:47 - 2018-05-16 00:01 - 000002409 _____ C:\Users\Dave\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2018-08-10 00:11 - 2018-07-16 11:34 - 000253664 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
2018-08-09 23:51 - 2014-11-18 23:12 - 000000008 __RSH C:\ProgramData\ntuser.pol
2018-08-09 23:50 - 2018-05-16 00:01 - 000000000 ____D C:\Users\Dave
2018-08-09 23:48 - 2016-10-20 23:14 - 000000000 ____D C:\Users\Ben\AppData\LocalLow\Temp
2018-08-09 23:46 - 2018-04-11 17:38 - 000000000 ____D C:\WINDOWS\SysWOW64\GroupPolicy
2018-08-09 23:45 - 2018-05-16 00:01 - 000000000 ____D C:\Users\Office Administrator
2018-08-09 11:24 - 2018-05-16 00:43 - 000003962 _____ C:\WINDOWS\System32\Tasks\Opera scheduled Autoupdate 1425234319
2018-08-09 11:24 - 2017-06-30 11:17 - 000001122 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera Browser.lnk
2018-08-09 10:54 - 2012-06-16 13:55 - 000394057 ____N C:\WINDOWS\Minidump\080918-44281-01.dmp
2018-08-09 10:44 - 2017-04-30 13:14 - 000000000 ____D C:\Program Files\Mozilla Firefox
2018-08-09 10:44 - 2012-06-20 13:19 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2018-08-09 10:44 - 2012-06-16 13:55 - 000847649 ____N C:\WINDOWS\Minidump\080918-48140-01.dmp
2018-08-09 10:05 - 2013-03-03 20:11 - 000001007 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2018-08-09 09:57 - 2018-06-29 12:48 - 000001307 _____ C:\Users\Dave\Desktop\Device Manager - Shortcut.lnk
2018-08-08 22:58 - 2012-06-29 00:10 - 000002303 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2018-08-08 11:32 - 2018-07-09 23:11 - 000001106 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++.lnk
2018-08-07 23:42 - 2016-05-13 18:01 - 000000000 ____D C:\Users\Dave\AppData\Roaming\GrabIt
2018-08-06 10:03 - 2015-08-08 17:19 - 000001414 _____ C:\Users\Dave\Desktop\Everything.exe - Shortcut.lnk
2018-08-06 09:19 - 2018-07-11 01:08 - 000836480 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2018-08-06 09:19 - 2018-07-11 01:08 - 000181120 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2018-08-02 14:26 - 2015-03-01 10:56 - 000000000 ____D C:\Users\Dave\AppData\Roaming\Apple Computer
2018-07-31 10:44 - 2018-07-10 20:14 - 000000000 ____D C:\ProgramData\Packages
2018-07-31 10:32 - 2018-02-27 22:40 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
2018-07-29 11:14 - 2012-08-19 10:49 - 000000000 ____D C:\Users\Dave\Downloads\Posted Cartoons

==================== Files in the root of some directories =======

2011-08-19 16:02 - 2011-06-09 17:44 - 000002792 _____ () C:\Program Files\HP SimplePass 2011
2009-04-20 23:51 - 2007-12-14 19:33 - 000262144 _____ (ZoneAlarm) C:\Program Files (x86)\Uninstall Spy Blocker.dll
2012-07-27 11:57 - 2012-07-27 11:57 - 000007859 _____ () C:\Users\Office Administrator\AppData\Roaming\pcouffin.cat
2012-07-27 11:57 - 2012-07-27 11:57 - 000001167 _____ () C:\Users\Office Administrator\AppData\Roaming\pcouffin.inf
2012-07-27 11:57 - 2012-07-27 11:57 - 000000034 _____ () C:\Users\Office Administrator\AppData\Roaming\pcouffin.log
2012-07-27 11:57 - 2012-07-27 11:57 - 000082816 _____ (VSO Software) C:\Users\Office Administrator\AppData\Roaming\pcouffin.sys
2012-10-13 19:45 - 2012-10-13 19:45 - 000000600 _____ () C:\Users\Office Administrator\AppData\Roaming\winscp.rnd

Some files in TEMP:
====================
2018-08-10 00:18 - 2018-07-06 01:25 - 001945784 _____ (Microsoft Corporation) C:\Users\Office Administrator\AppData\Local\Temp\dllnt_dump.dll

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2018-05-15 23:51

==================== End of FRST.txt ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23.08.2018
Ran by Office Administrator (28-08-2018 22:48:36)
Running from C:\Users\Dave\Desktop
Windows 10 Home Version 1803 17134.228 (X64) (2018-05-16 06:45:36)
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-4063716828-1680190529-1648852121-500 - Administrator - Disabled) => C:\Users\Administrator
Ben (S-1-5-21-4063716828-1680190529-1648852121-1004 - Limited - Enabled) => C:\Users\Ben
Dave (S-1-5-21-4063716828-1680190529-1648852121-1000 - Limited - Enabled) => C:\Users\Dave
DefaultAccount (S-1-5-21-4063716828-1680190529-1648852121-503 - Limited - Disabled)
Guest (S-1-5-21-4063716828-1680190529-1648852121-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-4063716828-1680190529-1648852121-1002 - Limited - Enabled)
Hope (S-1-5-21-4063716828-1680190529-1648852121-1003 - Limited - Enabled) => C:\Users\Hope
Mary Jo (S-1-5-21-4063716828-1680190529-1648852121-1005 - Limited - Enabled) => C:\Users\Mary Jo
Office Administrator (S-1-5-21-4063716828-1680190529-1648852121-1006 - Administrator - Enabled) => C:\Users\Office Administrator
Rich (S-1-5-21-4063716828-1680190529-1648852121-1008 - Limited - Enabled) => C:\Users\Rich
Share_with_Office (S-1-5-21-4063716828-1680190529-1648852121-1007 - Limited - Enabled) => C:\Users\Share_with_Office
WDAGUtilityAccount (S-1-5-21-4063716828-1680190529-1648852121-504 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKLM-x32\...\uTorrent) (Version: 3.2.0 - )
2017 Screen Saver (HKLM-x32\...\2017 Screen Saver_is1) (Version: - Access Analytic)
4K YouTube to MP3 3.3 (HKLM-x32\...\{35F6F72F-08F5-4885-8B69-7A3C6C1F038E}) (Version: 3.3.5.1797 - Open Media LLC)
802.11n Wireless LAN Card (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 3.01.18.0 - Ralink)
Adobe Digital Editions 2.0 (HKLM-x32\...\Adobe Digital Editions 2.0) (Version: 2.0 - Adobe Systems Incorporated)
Adobe Digital Editions 4.5 (HKLM-x32\...\Adobe Digital Editions 4.5) (Version: 4.5.4 - Adobe Systems Incorporated)
Adobe Flash Player 30 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 30.0.0.154 - Adobe Systems Incorporated)
Adobe Flash Player 30 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 30.0.0.154 - Adobe Systems Incorporated)
Amazon Kindle (HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\...\Amazon Kindle) (Version: 1.20.1.47037 - Amazon)
AnyDVD (HKLM-x32\...\AnyDVD) (Version: 7.5.3.0 - SlySoft)
Apple Application Support (32-bit) (HKLM-x32\...\{E5347310-C82F-4833-AA36-8D11E5A8A86A}) (Version: 6.6 - Apple Inc.)
Apple Application Support (64-bit) (HKLM\...\{D745E014-74DD-43A3-98DF-E7D38164B681}) (Version: 6.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{C29B636B-9015-4ED1-A12F-6375A337F23B}) (Version: 11.4.1.46 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{A30EA700-5515-48F0-88B0-9E99DC356B88}) (Version: 2.6.0.1 - Apple Inc.)
ArcSoft ShowBiz (HKLM-x32\...\{9D41D2EF-2D33-4CFD-8A3E-C7E6FCC3303B}) (Version: 3.5.13.64 - ArcSoft)
Asterisk Key 10.0 (HKLM-x32\...\asterisk key) (Version: - )
Audacity 2.0 (HKLM-x32\...\Audacity_is1) (Version: - Audacity Team)
AVIcodec (remove only) (HKLM-x32\...\AVIcodec) (Version: - )
Avidemux 2.6 (32-bit) (HKLM-x32\...\Avidemux 2.6) (Version: 2.6.1.8321 - )
AviSynth 2.5 (HKLM-x32\...\AviSynth) (Version: - )
Backup and Sync from Google (HKLM\...\{AEFBDB5B-899F-4AE6-B789-BA56A652A476}) (Version: 3.42.9858.3671 - Google, Inc.)
Bandicam (HKLM-x32\...\Bandicam) (Version: 2.1.1.731 - Bandisoft.com)
Bandisoft MPEG-1 Decoder (HKLM-x32\...\BandiMPEG1) (Version: - Bandisoft.com)
Beyond Compare 4.2.2 (HKLM\...\BeyondCompare4_is1) (Version: 4.2.2.22384 - Scooter Software)
Bing Bar (HKLM-x32\...\{3365E735-48A6-4194-9988-CE59AC5AE503}) (Version: 7.3.132.0 - Microsoft Corporation)
Blue Coat K9 Web Protection (HKLM\...\Blue Coat K9 Web Protection) (Version: 4.3.188 - Blue Coat Systems, Inc.)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
calibre (HKLM-x32\...\{D2DCF339-7EBC-4D88-B515-A504297796EA}) (Version: 3.6.0 - Kovid Goyal)
Canon MP Navigator EX 2.0 (HKLM-x32\...\MP Navigator EX 2.0) (Version: - )
Canon Utilities Solution Menu (HKLM-x32\...\CanonSolutionMenu) (Version: - )
CanoScan LiDE 200 Scanner Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ4807) (Version: - )
Cisco AnyConnect Secure Mobility Client (HKLM-x32\...\Cisco AnyConnect Secure Mobility Client) (Version: 4.4.03034 - Cisco Systems, Inc.)
Cisco AnyConnect Secure Mobility Client (HKLM-x32\...\{EB629A98-5E69-40E8-BA9E-C393899F959D}) (Version: 4.4.03034 - Cisco Systems, Inc.) Hidden
Cisco Connect (HKLM-x32\...\Cisco Connect) (Version: 1.4.12334.0 - Cisco Consumer Products LLC)
Cisco WebEx Meetings (HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\...\ActiveTouchMeetingClient) (Version: - Cisco WebEx LLC)
CloneCD (HKLM-x32\...\CloneCD) (Version: - SlySoft)
CloneDVD2 (HKLM-x32\...\CloneDVD2) (Version: 2.9.3.0 - Elaborate Bytes)
Coupon Printer for Windows (HKLM-x32\...\Coupon Printer for Windows5.0.0.1) (Version: 5.0.0.1 - Coupons.com Incorporated)
D3DX10 (HKLM-x32\...\{E09C4DB7-630C-4F06-A631-8EA7239923AF}) (Version: 15.4.2368.0902 - Microsoft) Hidden
DjVuLibre DjView 3.5.27+4.10.4 (HKLM-x32\...\DjVuLibre+DjView) (Version: 3.5.27+4.10.4 - DjVuZone)
Driver Install 64-Bit (HKLM-x32\...\{AA107568-1B58-407E-9867-D51F71C9F446}) (Version: 6.0.107.0 - China) Hidden
Driver Install 64-Bit (HKLM-x32\...\InstallShield_{AA107568-1B58-407E-9867-D51F71C9F446}) (Version: 6.0.107.0 - China)
EPubsoft Adobe PDF ePub DRM Removal 8.9.6 (HKLM-x32\...\{917CB2F3-7BAF-4E1E-9444-1241BF3D6B92}) (Version: 8.9.6 - EPUBSOFT)
Eudora (HKLM-x32\...\{FC40342A-B862-4F02-9B85-EBC13BE78AD1}) (Version: 7.0 - )
Everything 1.3.4.686 (x64) (HKLM\...\Everything) (Version: - )
Exact Audio Copy 1.0beta3 (HKLM-x32\...\Exact Audio Copy) (Version: 1.0beta3 - Andre Wiethoff)
EZ Grabber (HKLM-x32\...\{8543A572-5993-4101-BACC-C83884E183A4}) (Version: 2.00.0000 - EZ Grabber)
f.lux (HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\...\Flux) (Version: - f.lux Software LLC)
Family Tree Maker 2012 (HKLM-x32\...\{1CB0993B-1CD4-4A18-9C85-9732AFD9843F}) (Version: 21.0.452 - Ancestry.com, Inc.) Hidden
Family Tree Maker 2012 (HKLM-x32\...\Family Tree Maker 2012) (Version: 21.0.452 - Ancestry.com, Inc.)
FeedDemon (HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\...\FeedDemon_is1) (Version: 4.5.0.0 - NewsGator Technologies, Inc.)
Flash Decompiler Trillix (HKLM-x32\...\Flash Decompiler Trillix_is1) (Version: 5.3 - Eltima Software)
foobar2000 v1.3.10 (HKLM-x32\...\foobar2000) (Version: 1.3.10 - Peter Pawlowski)
FormatFactory 3.0.1 (HKLM-x32\...\FormatFactory) (Version: 3.0.1 - Free Time)
FREE EML File Viewer version v2.0 (HKLM-x32\...\{6B16A616-C931-4D4B-B1C5-E04F2D4DDD63}_is1) (Version: v2.0 - www.freeviewer.org)
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
Gmail Backup (HKLM-x32\...\gmailbackup) (Version: - )
GnuWin32: Wget-1.11.4-1 (HKLM-x32\...\Wget-1.11.4-1_is1) (Version: 1.11.4-1 - GnuWin32)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 68.0.3440.106 - Google Inc.)
Google Earth Plug-in (HKLM-x32\...\{57BB4801-61C8-4E74-9672-2160728A461E}) (Version: 7.1.5.1557 - Google)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.17 - Google Inc.) Hidden
Google Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.25.11 - Google Inc.) Hidden
GrabIt 1.7.3 Beta (build 1010) (HKLM-x32\...\GrabIt_is1) (Version: - Ilan Shemes)
HandBrake 0.9.6 (HKLM-x32\...\HandBrake) (Version: 0.9.6 - )
Huffyuv AVI lossless video codec - MultiThread (Remove Only) (HKLM-x32\...\HuffyuvcodecMT) (Version: - )
iCloud (HKLM\...\{82FCC407-A0E5-4B80-9241-5ABA78B61090}) (Version: 7.6.0.15 - Apple Inc.)
ImageMagick 6.8.9-5 Q8 (64-bit) (2014-07-15) (HKLM\...\ImageMagick 6.8.9 Q8 (64-bit)_is1) (Version: 6.8.9 - ImageMagick Studio LLC)
iMazing HEIC Converter version 1.0.5 (HKLM\...\{FA58AFA9-B210-409C-88F1-2A90D577C170}_is1) (Version: 1.0.5 - DigiDNA)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Identity Protection Technology 1.1.2.0 (HKLM-x32\...\{C01A86F5-56E7-101F-9BC9-E3F1025EB779}) (Version: 1.1.2.0 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2291 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.32 - Irfan Skiljan)
iTunes (HKLM\...\{36F365B3-05C2-455D-9D96-B73829DE046D}) (Version: 12.8.0.150 - Apple Inc.)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
JDownloader 0.9 (HKLM-x32\...\5513-1208-7298-9440) (Version: 0.9 - AppWork GmbH)
Junk Mail filter update (HKLM-x32\...\{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}) (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
KeePass Password Safe 2.28 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.28 - Dominik Reichl)
Lagarith Lossless Codec (1.3.27) (HKLM-x32\...\{F59AC46C-10C3-4023-882C-4212A92283B3}_is1) (Version: - )
Lame ACM MP3 Codec (HKLM-x32\...\LameACM) (Version: - )
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version: - )
Link Shell Extension (HKLM\...\HardlinkShellExt) (Version: 3.7.5.1 - Hermann Schinagl)
Malwarebytes version 3.5.1.2522 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.5.1.2522 - Malwarebytes)
MapWindow GIS (HKLM-x32\...\{0018DC60-E4CB-4884-81EC-52CF2BAF54EF}_is1) (Version: 4.8.8 - MapWindow GIS)
Mathematica Extras 8.0 (2609412) (HKLM\...\A-WIN-Extras 8.0.4 2609412_is1) (Version: 8.0.4 - Wolfram Research, Inc.)
MediaHuman YouTube to MP3 Converter version 3.9.8.10 (HKLM-x32\...\MediaHuman YouTube to MP3 Converter_is1) (Version: 3.9.8.10 - )
MediaInfo 0.7.67 (HKLM\...\MediaInfo) (Version: 0.7.67 - MediaArea.net)
MediaMonkey 4.1 (HKLM-x32\...\MediaMonkey_is1) (Version: 4.1 - Ventis Media Inc.)
Mesh Runtime (HKLM-x32\...\{8C6D6116-B724-4810-8F2D-D047E6B7D68E}) (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft Mathematics (HKLM-x32\...\{4D090F70-6F08-4B60-9357-A1DFD4458F09}) (Version: 4.0 - Microsoft Corporation)
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\...\OneDriveSetup.exe) (Version: 18.131.0701.0007 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\...\OneDriveSetup.exe) (Version: 17.3.6943.0625 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Sync Framework 2.0 Core Components (x64) ENU (HKLM\...\{8CCBEC22-D2DB-4DC9-A58A-E1A1F3A38C8A}) (Version: 2.0.1578.0 - Microsoft Corporation)
Microsoft Sync Framework 2.0 Provider Services (x64) ENU (HKLM\...\{03AC245F-4C64-425C-89CF-7783C1D3AB2C}) (Version: 2.0.1578.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 61.0.2 (x64 en-US) (HKLM\...\Mozilla Firefox 61.0.2 (x64 en-US)) (Version: 61.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 57.0 - Mozilla)
MP4Tools v3.1 (HKLM-x32\...\MP4Tools_is1) (Version: - )
MuseScore 2 (HKLM-x32\...\{703926DE-F24B-11E4-AA68-472FB664A5DC}) (Version: 2.0.1 - Werner Schweer and Others)
Neat Video v3.0 Demo plug-in for VirtualDub (32-bit) (HKLM-x32\...\Neat Video for VirtualDub (32-bit)_is1) (Version: - Neat Video team, ABSoft)
Network Stumbler 0.4.0 (remove only) (HKLM-x32\...\Network Stumbler) (Version: - )
NirSoft VideoCacheView (HKLM-x32\...\NirSoft VideoCacheView) (Version: - )
NLOGIT 4.0 (HKLM-x32\...\{162D8CCE-79C2-4587-A026-22B8D8B73015}) (Version: 04.00.0001 - Econometric Software, Inc.)
Notepad++ (32-bit x86) (HKLM-x32\...\Notepad++) (Version: 7.5.8 - Notepad++ Team)
NZBLeecher (HKLM-x32\...\NZBLeecher) (Version: - )
Open Live Writer (HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\...\OpenLiveWriter) (Version: 0.6.2 - Open Live Writer)
Opera Stable 54.0.2952.71 (HKLM-x32\...\Opera 54.0.2952.71) (Version: 54.0.2952.71 - Opera Software)
paint.net (HKLM\...\{E8FA8815-3817-4128-A814-E2EAC456ADF0}) (Version: 4.0.21 - dotPDN LLC)
Pale Moon 27.0.2 (x86 en-US) (HKLM-x32\...\Pale Moon 27.0.2 (x86 en-US)) (Version: 27.0.2 - Moonchild Productions)
Pale Moon 28.0.0 (x64 en-US) (HKLM\...\Pale Moon 28.0.0 (x64 en-US)) (Version: 28.0.0 - Moonchild Productions)
PaperCut Print Logger 1.10 (HKLM-x32\...\PaperCut Print Logger_is1) (Version: - PaperCut Software Int. Pty. Ltd.)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.4.1 - Frank Heindörfer, Philip Chinery)
PdfMerge (HKLM-x32\...\{1CD59184-5172-4899-BAE4-4F06D57B2004}) (Version: 1.19.0 - PdfMerge)
PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.203.0 - Tracker Software Products Ltd)
PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
PlayReady PC Runtime x86 (HKLM-x32\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)
Plex Media Server (HKLM-x32\...\{16eca963-68c5-4756-80f9-db9094a4d6f0}) (Version: 0.9.1104 - Plex, Inc.)
Plex Media Server (HKLM-x32\...\{A6BF4853-41E9-4DA1-AD81-4B16FEE938C2}) (Version: 0.9.1104 - Plex, Inc.) Hidden
POV-Ray for Windows v3.6.1c (HKLM-x32\...\POV-Ray for Windows v3.6) (Version: 3.6 - Persistence of Vision Raytracer Pty. Ltd.)
Power2Go (HKLM-x32\...\{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.5331 - CyberLink Corp.) Hidden
Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.5331 - CyberLink Corp.)
QuickPar 0.9 (HKLM-x32\...\QuickPar) (Version: 0.9 - Peter B. Clements)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6662 - Realtek Semiconductor Corp.)
Recovery Manager (HKLM-x32\...\{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}) (Version: 5.5.0.4320 - CyberLink Corp.) Hidden
Recuva (HKLM\...\Recuva) (Version: 1.53 - Piriform)
Respondus 4.0 Campus-Wide (HKLM-x32\...\{8DB14A0D-7D84-46B3-AEE4-D265729C78BD}) (Version: 4.00.0000 - Respondus, Inc.)
Respondus LockDown Browser 2 (HKLM-x32\...\{BBC7F69B-7A94-41E9-8A4B-B55A8D06431F}) (Version: 2.00.0000 - Respondus)
RogueKiller version 12.12.30.0 (HKLM\...\8B3D7924-ED89-486B-8322-E8594065D5CB_is1) (Version: 12.12.30.0 - Adlice Software)
Samsung USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.59.0 - Samsung Electronics Co., Ltd.)
screen-scraper Basic Edition (HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\...\5814-3494-4319-2342) (Version: 7.0 - ekiwi, LLC)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Smart Switch (HKLM-x32\...\{74FA5314-85C8-4E2A-907D-D9ECCCB770A7}) (Version: 4.1.16052.2 - Samsung Electronics Co., Ltd.) Hidden
Smart Switch (HKLM-x32\...\InstallShield_{74FA5314-85C8-4E2A-907D-D9ECCCB770A7}) (Version: 4.1.16052.2 - Samsung Electronics Co., Ltd.)
Snagit 12 (HKLM-x32\...\{B298CE4A-880B-4D6E-8987-2D8A616BF568}) (Version: 12.0.0 - TechSmith Corporation) Hidden
Snagit 12 (HKLM-x32\...\{bdac23f5-7943-42cf-ba56-4732fc20b6a7}) (Version: 12.0.0.1001 - TechSmith Corporation)
SyncToy 2.1 (x64) (HKLM\...\{88DAAF05-5A72-46D2-A7C5-C3759697E943}) (Version: 2.1.0 - Microsoft)
ThumbNailer (HKLM\...\{4FF14ED2-7B23-4EBF-A88B-CAE3590F9388}) (Version: 10.1.0.10 - Smaller Animals Software) Hidden
ThumbNailer 10 (HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\...\ThumbNailer 10.1.0.10) (Version: 10.1.0.10 - Smaller Animals Software)
TreeSize Free V2.7 (HKLM-x32\...\TreeSize Free_is1) (Version: 2.7 - JAM Software)
Tweaking.com - Registry Backup (HKLM-x32\...\Tweaking.com - Registry Backup) (Version: 3.5.3 - Tweaking.com)
Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\...\{DE083343-D24D-4495-919E-18C65EC0F289}) (Version: 2.8.0.0 - Microsoft Corporation)
Verizon Cloud (HKLM\...\Verizon Cloud) (Version: 16.1.8.13 - Verizon)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.4 - VideoLAN)
VSO Inspector 2.0.2 (HKLM-x32\...\VSO Inspector_is1) (Version: - VSO-Software SARL)
WD Link (HKLM-x32\...\WD Link) (Version: 1.00.03 - Western Digital)
WebP Codec for Windows 0.19 (HKLM\...\{9D2F4EB8-98AD-4C8B-A0C5-4C114B3F1287}) (Version: 0.19.9 - Google Inc)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Media Encoder 9 Series (HKLM-x32\...\Windows Media Encoder 9) (Version: - )
WinRAR 4.20 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
WinRAR 5.60 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.60.0 - win.rar GmbH)
WinSCP 5.1 (HKLM-x32\...\winscp3_is1) (Version: 5.1 - Martin Prikryl)
Wolfram CDF Player (M-WIN-D 8.0.4 2609533) (HKLM-x32\...\M-WIN-D 8.0.4 2609533_is1) (Version: 8.0.4 - Wolfram Research, Inc.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files\Google\Drive\googledrivesync64.dll [2018-05-30] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files\Google\Drive\googledrivesync64.dll [2018-05-30] (Google)
ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files\Google\Drive\googledrivesync64.dll [2018-05-30] (Google)
ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => -> No File
ShellIconOverlayIdentifiers: [ SncrOverlays (Blocked)] -> {C418E880-6280-4010-A888-FD76028E5511} => C:\Program Files\Verizon\Verizon Cloud\x64\Sncr.Overlays.dll [2016-10-10] (Synchronoss Technologies Inc.)
ShellIconOverlayIdentifiers: [ SncrOverlays (InSync)] -> {5F4A6070-DB92-4C56-A487-F3850430608F} => C:\Program Files\Verizon\Verizon Cloud\x64\Sncr.Overlays.dll [2016-10-10] (Synchronoss Technologies Inc.)
ShellIconOverlayIdentifiers: [ SncrOverlays (Pending)] -> {EE73A341-C788-4A6B-B1EF-DDBFC0F190B6} => C:\Program Files\Verizon\Verizon Cloud\x64\Sncr.Overlays.dll [2016-10-10] (Synchronoss Technologies Inc.)
ShellIconOverlayIdentifiers: [ SncrOverlays (Syncing)] -> {28CDCD88-B179-49D6-8B21-1A9AF9C0AE13} => C:\Program Files\Verizon\Verizon Cloud\x64\Sncr.Overlays.dll [2016-10-10] (Synchronoss Technologies Inc.)
ShellIconOverlayIdentifiers: [HardLinkMenu] -> {0A479751-02BC-11d3-A855-0004AC2568AA} => C:\Program Files\LinkShellExtension\HardlinkShellExt.dll [2013-08-23] (Hermann Schinagl)
ShellIconOverlayIdentifiers: [IconOverlayHardLink] -> {0A479751-02BC-11d3-A855-0004AC2568DD} => C:\Program Files\LinkShellExtension\HardlinkShellExt.dll [2013-08-23] (Hermann Schinagl)
ShellIconOverlayIdentifiers: [IconOverlaySymbolicLink] -> {0A479751-02BC-11d3-A855-0004AC2568EE} => C:\Program Files\LinkShellExtension\HardlinkShellExt.dll [2013-08-23] (Hermann Schinagl)
ShellIconOverlayIdentifiers-x32: [ SncrOverlays (Blocked)] -> {C418E880-6280-4010-A888-FD76028E5511} => C:\Program Files\Verizon\Verizon Cloud\x64\Sncr.Overlays.dll [2016-10-10] (Synchronoss Technologies Inc.)
ShellIconOverlayIdentifiers-x32: [ SncrOverlays (InSync)] -> {5F4A6070-DB92-4C56-A487-F3850430608F} => C:\Program Files\Verizon\Verizon Cloud\x64\Sncr.Overlays.dll [2016-10-10] (Synchronoss Technologies Inc.)
ShellIconOverlayIdentifiers-x32: [ SncrOverlays (Pending)] -> {EE73A341-C788-4A6B-B1EF-DDBFC0F190B6} => C:\Program Files\Verizon\Verizon Cloud\x64\Sncr.Overlays.dll [2016-10-10] (Synchronoss Technologies Inc.)
ShellIconOverlayIdentifiers-x32: [ SncrOverlays (Syncing)] -> {28CDCD88-B179-49D6-8B21-1A9AF9C0AE13} => C:\Program Files\Verizon\Verizon Cloud\x64\Sncr.Overlays.dll [2016-10-10] (Synchronoss Technologies Inc.)
ShellIconOverlayIdentifiers-x32: [HardLinkMenu] -> {0A479751-02BC-11d3-A855-0004AC2568AA} => C:\Program Files\LinkShellExtension\HardlinkShellExt.dll [2013-08-23] (Hermann Schinagl)
ShellIconOverlayIdentifiers-x32: [IconOverlayHardLink] -> {0A479751-02BC-11d3-A855-0004AC2568DD} => C:\Program Files\LinkShellExtension\HardlinkShellExt.dll [2013-08-23] (Hermann Schinagl)
ShellIconOverlayIdentifiers-x32: [IconOverlaySymbolicLink] -> {0A479751-02BC-11d3-A855-0004AC2568EE} => C:\Program Files\LinkShellExtension\HardlinkShellExt.dll [2013-08-23] (Hermann Schinagl)
ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} => C:\Program Files (x86)\Notepad++\NppShell_06.dll [2018-07-22] ()
ContextMenuHandlers1: [CirrusShellEx] -> {57FA2D12-D22D-490A-805A-5CB48E84F12A} => C:\My Program Files (x86)\Beyond Compare 4\BCShellEx64.dll [2017-05-18] (Scooter Software)
ContextMenuHandlers1: [GDContextMenu] -> {BB02B294-8425-42E5-983F-41A1FA970CD6} => C:\Program Files\Google\Drive\contextmenu64.dll [2018-05-30] (Google)
ContextMenuHandlers1: [HardLinkMenu] -> {0A479751-02BC-11d3-A855-0004AC2568AA} => C:\Program Files\LinkShellExtension\HardlinkShellExt.dll [2013-08-23] (Hermann Schinagl)
ContextMenuHandlers1: [Notepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} => C:\Program Files (x86)\Notepad++\NppShell_06.dll [2018-07-22] ()
ContextMenuHandlers1: [PhotoStreamsExt] -> {89D984B3-813B-406A-8298-118AFA3A22AE} => C:\Program Files\Common Files\Apple\Internet Services\ShellStreams64.dll [2018-06-26] (Apple Inc.)
ContextMenuHandlers1: [SnagItMainShellExt] -> {CF74B903-3389-469c-B3B6-0204D204FCBD} => C:\Program Files (x86)\TechSmith\Snagit 12\DLLx64\SnagitShellExt64.dll [2014-04-18] (TechSmith Corporation)
ContextMenuHandlers1: [VerizonCtxMenu] -> {8CA825D9-C7DB-4833-9901-E7400521CE04} => C:\Program Files\Verizon\Verizon Cloud\x64\Sncr.ContextMenus.dll [2016-10-10] (Synchronoss Technologies Inc.)
ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2018-06-24] (Alexander Roshal)
ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2018-06-24] (Alexander Roshal)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-05-03] (Malwarebytes)
ContextMenuHandlers4: [CirrusShellEx] -> {57FA2D12-D22D-490A-805A-5CB48E84F12A} => C:\My Program Files (x86)\Beyond Compare 4\BCShellEx64.dll [2017-05-18] (Scooter Software)
ContextMenuHandlers4: [GDContextMenu] -> {BB02B294-8425-42E5-983F-41A1FA970CD6} => C:\Program Files\Google\Drive\contextmenu64.dll [2018-05-30] (Google)
ContextMenuHandlers4: [RecuvaShellExt] -> {435E5DF5-2510-463C-B223-BDA47006D002} => C:\Program Files\Recuva\RecuvaShell64.dll [2016-06-06] (Piriform Ltd)
ContextMenuHandlers4: [SnagItMainShellExt] -> {CF74B903-3389-469c-B3B6-0204D204FCBD} => C:\Program Files (x86)\TechSmith\Snagit 12\DLLx64\SnagitShellExt64.dll [2014-04-18] (TechSmith Corporation)
ContextMenuHandlers4: [VerizonCtxMenu] -> {8CA825D9-C7DB-4833-9901-E7400521CE04} => C:\Program Files\Verizon\Verizon Cloud\x64\Sncr.ContextMenus.dll [2016-10-10] (Synchronoss Technologies Inc.)
ContextMenuHandlers5: [HardLinkMenu] -> {0A479751-02BC-11d3-A855-0004AC2568AA} => C:\Program Files\LinkShellExtension\HardlinkShellExt.dll [2013-08-23] (Hermann Schinagl)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => C:\WINDOWS\system32\igfxpph.dll [2017-03-09] (Intel Corporation)
ContextMenuHandlers5: [VerizonCtxMenu] -> {8CA825D9-C7DB-4833-9901-E7400521CE04} => C:\Program Files\Verizon\Verizon Cloud\x64\Sncr.ContextMenus.dll [2016-10-10] (Synchronoss Technologies Inc.)
ContextMenuHandlers6: [CirrusShellEx] -> {57FA2D12-D22D-490A-805A-5CB48E84F12A} => C:\My Program Files (x86)\Beyond Compare 4\BCShellEx64.dll [2017-05-18] (Scooter Software)
ContextMenuHandlers6: [HardLinkMenu] -> {0A479751-02BC-11d3-A855-0004AC2568AA} => C:\Program Files\LinkShellExtension\HardlinkShellExt.dll [2013-08-23] (Hermann Schinagl)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-05-03] (Malwarebytes)
ContextMenuHandlers6: [RecuvaShellExt] -> {435E5DF5-2510-463C-B223-BDA47006D002} => C:\Program Files\Recuva\RecuvaShell64.dll [2016-06-06] (Piriform Ltd)
ContextMenuHandlers6: [VerizonCtxMenu] -> {8CA825D9-C7DB-4833-9901-E7400521CE04} => C:\Program Files\Verizon\Verizon Cloud\x64\Sncr.ContextMenus.dll [2016-10-10] (Synchronoss Technologies Inc.)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2018-06-24] (Alexander Roshal)
ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2018-06-24] (Alexander Roshal)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {042937CB-5476-4C2A-8480-C5E036578E2B} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {22B36131-D912-447F-8E3A-93B96D768A49} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\WINDOWS\ehome\ehrec.exe
Task: {35A742C1-2971-4943-A2E3-29AD462FFAAC} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {3ACF76E4-F5DF-431C-BEA2-BE70CF85AE6D} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {3F0B4EA2-4D7B-4D23-876A-75BCC92FE9AF} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2018-08-15] (Adobe Systems Incorporated)
Task: {40916EEB-6F1E-4999-9E15-7F491478CD18} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)
Task: {442A0DF8-035C-4EC9-9586-E841BDA7E761} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1807.18075-0\MpCmdRun.exe [2018-07-31] (Microsoft Corporation)
Task: {448270B0-5154-498D-B24D-AE71E7DB5927} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {4BC2A2DA-AFD4-4150-A965-394C5A98BC48} - System32\Tasks\SetupManager => C:\Program Files (x86)\Hewlett-Packard\Setup Manager\toaster.exe
Task: {4EF9C94A-BEB8-4886-8EFB-6F8DC72DE967} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {53ABC437-1B0B-41C8-BFA8-0949927B2CAE} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {55FDF64B-3C5A-49F4-9EC4-597B575CA285} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {60C6872D-D8C5-4B88-8980-45D08F81447E} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {65B85F6F-35B3-4459-A179-28255D5B7B25} - System32\Tasks\Microsoft\Windows\HelloFace\FODCleanupTask => C:\WINDOWS\System32\WinBioPlugIns\FaceFodUninstaller.exe [2018-04-11] ()
Task: {66373DB8-4A8D-49A8-88A9-7AC45A9257AE} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\WINDOWS\ehome\MCUpdate.exe
Task: {6F313266-B64D-44AE-A7BB-DE6293968188} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\WINDOWS\ehome\mcupdate.exe
Task: {76028AB5-AC97-4F06-8327-7D5A47A19935} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {8019363D-BCAD-4773-B90D-F17D42075CBA} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {8D77A25D-FD6A-481A-B0D6-9678902CB9A5} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\WINDOWS\ehome\mcupdate.exe
Task: {962F44DF-9C5B-4695-A5B2-B3B13C819136} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1807.18075-0\MpCmdRun.exe [2018-07-31] (Microsoft Corporation)
Task: {97D57FBC-B035-440C-88E7-9E676CD64057} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {9EE88514-786B-4C6B-B761-AD00A3815399} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\WINDOWS\ehome\ehrec.exe
Task: {A1F811BD-AFE5-40CD-B189-BEC191A3CDD1} - System32\Tasks\Opera scheduled Autoupdate 1425234319 => C:\Program Files (x86)\Opera\launcher.exe [2018-08-06] (Opera Software)
Task: {AAAF2967-9FCF-4FE5-B8ED-82D0D1916F31} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1807.18075-0\MpCmdRun.exe [2018-07-31] (Microsoft Corporation)
Task: {ABE81196-0AAC-419A-993A-CA0F9FA7E738} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {B0783751-AFAE-4BFF-B02A-3C74BBADC98E} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {BB891099-3F04-45DA-8DFA-066AB33B0F7D} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {C0F395F2-9715-4314-A840-2E6C417F6A32} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {C1C94E11-56D4-42FD-B052-F12EAEB7E8A4} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)
Task: {C29AFA7A-269B-4DEC-95F3-09270AAEC4FB} - System32\Tasks\Adobe Flash Player NPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_30_0_0_154_Plugin.exe [2018-08-15] (Adobe Systems Incorporated)
Task: {C6429797-F491-4F5C-BD36-6AC08CF60D18} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {DC0B13A5-A3AF-44DB-A8AF-45ED1E90A3D1} - System32\Tasks\TechSmith Updater => C:\Program Files (x86)\Common Files\TechSmith Shared\Updater\TSCUpdClt.exe [2014-04-17] (TechSmith Corporation)
Task: {DD8F35AB-434A-41DE-9AD1-1257D3D4E48B} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2018-01-08] (Apple Inc.)
Task: {E40AF1E4-E26D-4DF8-BF69-C3737ACB46AC} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => c:\Program Files\Microsoft Security Client\MpCmdRun.exe
Task: {E4E1AB3F-C6DC-443F-A040-1F71DC7EA004} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1807.18075-0\MpCmdRun.exe [2018-07-31] (Microsoft Corporation)
Task: {EE44F1BC-3A65-4249-BBAC-F4DEB17CDF61} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {F2511BEE-366D-49C8-BB06-D1D74AAAE162} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {FE713D77-2EF1-4348-86DE-E0815C71AAD4} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_30_0_0_154_pepper.exe [2018-08-15] (Adobe Systems Incorporated)
Task: {FF39504A-D292-4D33-BB14-3944FA41D129} - System32\Tasks\AdwCleaner_onReboot => C:\Users\Dave\Desktop\AdwCleaner.exe

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

2018-01-05 00:14 - 2018-01-05 00:14 - 000088888 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2018-06-23 06:56 - 2018-06-23 06:56 - 001356088 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-08-03 10:45 - 2014-08-05 19:04 - 001441792 _____ () C:\Program Files\Everything\Everything.exe
2018-05-15 16:00 - 2018-07-16 11:34 - 002433744 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SelfProtectionSdk.dll
2013-08-05 00:15 - 2013-08-05 00:15 - 000070712 _____ () c:\windows\system32\bdmpega64.acm
2018-04-11 17:34 - 2018-04-11 17:34 - 000491744 _____ () C:\WINDOWS\SYSTEM32\inputhost.dll
2004-09-30 12:15 - 2004-09-30 12:15 - 000192000 _____ () C:\Program Files\LinkShellExtension\RockallDLL.dll
2018-04-11 17:34 - 2018-04-11 17:34 - 000472064 _____ () C:\Windows\ShellExperiences\TileControl.dll
2018-04-11 17:34 - 2018-04-11 17:34 - 002759168 _____ () C:\Windows\ShellComponents\TaskFlowUI.dll
2018-07-22 18:14 - 2018-07-22 18:14 - 000230064 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2018-08-15 01:03 - 2018-08-02 21:09 - 002185728 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2018-07-17 15:13 - 2018-07-17 15:13 - 000086528 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1815.210.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2018-07-17 15:13 - 2018-07-17 15:13 - 000195072 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1815.210.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2018-07-17 15:13 - 2018-07-17 15:14 - 022373888 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1815.210.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2018-07-17 15:13 - 2018-07-17 15:13 - 002610176 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1815.210.0_x64__kzf8qxf38zg5c\skypert.dll
2018-08-10 12:04 - 2018-08-10 12:04 - 035124224 _____ () C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18071.11811.0_x64__8wekyb3d8bbwe\Video.UI.exe
2018-08-10 12:04 - 2018-08-10 12:04 - 000290816 _____ () C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18071.11811.0_x64__8wekyb3d8bbwe\SharedUI.dll
2018-08-10 12:04 - 2018-08-10 12:04 - 006417408 _____ () C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18071.11811.0_x64__8wekyb3d8bbwe\EntCommon.dll
2017-09-25 22:50 - 2017-09-25 22:50 - 003553704 _____ () C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18071.11811.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll
2018-08-10 12:04 - 2018-08-10 12:04 - 009010176 _____ () C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18071.11811.0_x64__8wekyb3d8bbwe\EntPlat.dll
2017-03-09 02:16 - 2017-03-09 02:16 - 000112264 _____ () C:\Windows\System32\IccLibDll_x64.dll
2018-07-06 02:00 - 2018-07-06 02:00 - 000088888 _____ () C:\Program Files\iTunes\zlib1.dll
2018-07-06 02:00 - 2018-07-06 02:00 - 001356088 _____ () C:\Program Files\iTunes\libxml2.dll
2018-05-30 11:03 - 2018-05-30 11:03 - 046281248 _____ () C:\Program Files\Google\Drive\googledrivesync.exe
2018-08-08 22:58 - 2018-08-07 18:41 - 004855640 _____ () C:\Program Files (x86)\Google\Chrome\Application\68.0.3440.106\libglesv2.dll
2018-08-08 22:58 - 2018-08-07 18:41 - 000115544 _____ () C:\Program Files (x86)\Google\Chrome\Application\68.0.3440.106\libegl.dll
2011-12-22 11:10 - 2011-12-22 11:58 - 000207717 _____ () C:\Users\Dave\Documents\My Program Files\AutoHotkey\Compiler\keywords.exe
2018-08-26 10:57 - 2018-08-26 10:57 - 000113152 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\_ctypes.pyd
2018-08-26 10:57 - 2018-08-26 10:57 - 000080896 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\bz2.pyd
2018-08-26 10:57 - 2018-08-26 10:57 - 001585152 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\_hashlib.pyd
2018-08-26 10:58 - 2018-08-26 10:58 - 000128512 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\win32api.pyd
2018-08-26 10:57 - 2018-08-26 10:57 - 000137728 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\pywintypes27.dll
2018-08-26 10:57 - 2018-08-26 10:57 - 000548864 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\pythoncom27.dll
2018-08-26 10:58 - 2018-08-26 10:58 - 000689664 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\unicodedata.pyd
2018-08-26 10:58 - 2018-08-26 10:58 - 000438784 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\win32com.shell.shell.pyd
2018-08-26 10:58 - 2018-08-26 10:58 - 001489408 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\wx._core_.pyd
2018-08-26 10:58 - 2018-08-26 10:58 - 001007104 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\wx._gdi_.pyd
2018-08-26 10:58 - 2018-08-26 10:58 - 001039872 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\wx._windows_.pyd
2018-08-26 10:58 - 2018-08-26 10:58 - 001325056 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\wx._controls_.pyd
2018-08-26 10:58 - 2018-08-26 10:58 - 000916992 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\wx._misc_.pyd
2018-08-26 10:57 - 2018-08-26 10:57 - 001084416 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\pysqlite2._sqlite.pyd
2018-08-26 10:58 - 2018-08-26 10:58 - 000149504 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\win32file.pyd
2018-08-26 10:58 - 2018-08-26 10:58 - 000136192 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\win32security.pyd
2018-08-26 10:57 - 2018-08-26 10:57 - 000007680 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\hashobjs_ext.pyd
2018-08-26 10:57 - 2018-08-26 10:57 - 000020992 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\thumbnails_ext.pyd
2018-08-26 10:58 - 2018-08-26 10:58 - 000118784 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\usb_ext.pyd
2018-08-26 10:57 - 2018-08-26 10:57 - 000047616 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\_socket.pyd
2018-08-26 10:57 - 2018-08-26 10:57 - 002224640 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\_ssl.pyd
2018-08-26 10:57 - 2018-08-26 10:57 - 000014848 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\common.time34.pyd
2018-08-26 10:58 - 2018-08-26 10:58 - 000023040 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\win32event.pyd
2018-08-26 10:58 - 2018-08-26 10:58 - 000034304 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\windows.conditional.pyd
2018-08-26 10:58 - 2018-08-26 10:58 - 000020480 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\windows.winwrap.pyd
2018-08-26 10:58 - 2018-08-26 10:58 - 000110080 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\windows.volumes.pyd
2018-08-26 10:58 - 2018-08-26 10:58 - 000223232 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\win32gui.pyd
2018-08-26 10:57 - 2018-08-26 10:57 - 000173568 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\_elementtree.pyd
2018-08-26 10:57 - 2018-08-26 10:57 - 000169472 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\pyexpat.pyd
2018-08-26 10:58 - 2018-08-26 10:58 - 000048128 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\win32inet.pyd
2018-08-26 10:58 - 2018-08-26 10:58 - 000103424 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\wx._html2.pyd
2018-08-26 10:57 - 2018-08-26 10:57 - 000046080 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\_psutil_windows.pyd
2018-08-26 10:58 - 2018-08-26 10:58 - 000633272 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\windows._cacheinvalidation.pyd
2018-08-26 10:58 - 2018-08-26 10:58 - 000011776 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\win32crypt.pyd
2018-08-26 10:57 - 2018-08-26 10:57 - 000301568 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\PIL._imaging.pyd
2018-08-26 10:57 - 2018-08-26 10:57 - 000032256 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\_multiprocessing.pyd
2018-08-26 10:57 - 2018-08-26 10:57 - 005458944 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\cello.pyd
2018-08-26 10:57 - 2018-08-26 10:57 - 000026112 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\_yappi.pyd
2018-08-26 10:58 - 2018-08-26 10:58 - 000044032 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\win32process.pyd
2018-08-26 10:58 - 2018-08-26 10:58 - 000027648 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\win32pipe.pyd
2018-08-26 10:57 - 2018-08-26 10:57 - 000010752 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\select.pyd
2018-08-26 10:58 - 2018-08-26 10:58 - 000029696 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\win32pdh.pyd
2018-08-26 10:58 - 2018-08-26 10:58 - 000038400 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\windows.connectivity.pyd
2018-08-26 10:58 - 2018-08-26 10:58 - 000073216 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\windows.device_monitor.pyd
2018-08-26 10:58 - 2018-08-26 10:58 - 000020480 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\win32profile.pyd
2018-08-26 10:58 - 2018-08-26 10:58 - 000026624 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\win32ts.pyd
2018-08-17 07:40 - 2018-08-17 07:40 - 000479232 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
2018-08-17 07:40 - 2018-08-17 07:40 - 069226496 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\Microsoft.Photos.dll
2017-12-23 21:01 - 2017-12-23 21:02 - 002523136 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\UnityEngineDelegates.dll
2018-08-17 07:40 - 2018-08-17 07:40 - 000049664 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\RenderingPlugin.dll
2018-08-17 07:40 - 2018-08-17 07:40 - 003693568 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\MediaEngineCSWrapper.dll
2018-05-03 16:25 - 2018-05-03 16:26 - 000009216 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\ImagePipelineNative.dll
2018-08-17 07:40 - 2018-08-17 07:40 - 002280960 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\opencv_core320.dll
2018-08-17 07:40 - 2018-08-17 07:40 - 000035328 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\WinMLWrapper.UWP.dll
2018-04-04 16:58 - 2018-04-04 16:59 - 002283008 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\TrackingDLLUWP.dll
2018-08-17 07:40 - 2018-08-17 07:40 - 002480640 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\opencv_imgproc320.dll
2018-08-17 07:40 - 2018-08-17 07:40 - 014258688 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\PhotosApp.Windows.dll
2018-08-17 07:40 - 2018-08-17 07:40 - 003538944 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\MediaEngine.dll
2018-08-17 07:40 - 2018-08-17 07:40 - 002944512 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\AppCore.Windows.dll
2018-05-30 14:11 - 2018-05-30 14:12 - 000872448 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\RuntimeConfiguration.dll
2018-07-27 10:37 - 2018-07-27 10:38 - 004584960 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll
2018-07-31 10:40 - 2018-07-31 10:41 - 000199168 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_11807.1001.13.0_x64__8wekyb3d8bbwe\WinStore.Preview.dll
2018-07-31 10:39 - 2018-07-31 10:40 - 002447072 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_11807.1001.13.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll
2018-07-31 10:40 - 2018-07-31 10:41 - 007814144 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_11807.1001.13.0_x64__8wekyb3d8bbwe\WinStore.Entertainment.Mobile.dll
2018-07-10 20:13 - 2018-07-10 20:13 - 001922224 _____ () C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.10314.31700.0_x64__8wekyb3d8bbwe\Microsoft.Applications.Telemetry.Windows.dll
2017-05-17 06:16 - 2017-05-17 06:16 - 000073728 _____ () C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll
2018-08-09 11:23 - 2018-08-09 11:23 - 087838296 _____ () C:\Program Files (x86)\Opera\54.0.2952.71\opera_browser.dll
2004-09-30 11:09 - 2004-09-30 11:09 - 000155648 _____ () C:\Program Files\LinkShellExtension\32\RockallDLL.dll
2018-08-09 11:23 - 2018-08-09 11:23 - 003871320 _____ () C:\Program Files (x86)\Opera\54.0.2952.71\libglesv2.dll
2018-08-09 11:23 - 2018-08-09 11:23 - 000086616 _____ () C:\Program Files (x86)\Opera\54.0.2952.71\libegl.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 20:34 - 2018-08-26 10:58 - 000001707 _____ C:\WINDOWS\system32\Drivers\etc\hosts

127.0.0.1 localhost
216.239.32.20 www.google.ae # bck9
216.239.32.20 www.google.at # bck9
216.239.32.20 www.google.be # bck9
216.239.32.20 www.google.ca # bck9
216.239.32.20 www.google.ch # bck9
216.239.32.20 www.google.cl # bck9
216.239.32.20 www.google.co.il # bck9
216.239.32.20 www.google.co.in # bck9
216.239.32.20 www.google.co.jp # bck9
216.239.32.20 www.google.co.kr # bck9
216.239.32.20 www.google.co.nz # bck9
216.239.32.20 www.google.co.uk # bck9
216.239.32.20 www.google.co.ve # bck9
216.239.32.20 www.google.co.za # bck9
216.239.32.20 www.google.com # bck9
216.239.32.20 www.google.com.ar # bck9
216.239.32.20 www.google.com.au # bck9
216.239.32.20 www.google.com.br # bck9
216.239.32.20 www.google.com.co # bck9
216.239.32.20 www.google.com.gr # bck9
216.239.32.20 www.google.com.hk # bck9
216.239.32.20 www.google.com.mx # bck9
216.239.32.20 www.google.com.my # bck9
216.239.32.20 www.google.com.pe # bck9
216.239.32.20 www.google.com.ph # bck9
216.239.32.20 www.google.com.pk # bck9
216.239.32.20 www.google.com.sg # bck9
216.239.32.20 www.google.com.tr # bck9
216.239.32.20 www.google.com.tw # bck9

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Dave\Downloads\Wallpapers\Thomas Herbich\SMOKE_176_HD.jpg
HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\Control Panel\Desktop\\Wallpaper -> C:\Users\Office Administrator\AppData\Local\Microsoft\Windows\Themes\img16.jpg
DNS Servers: 208.67.222.222 - 8.8.8.8
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

HKLM\...\StartupApproved\Run32: => "Cisco AnyConnect Secure Mobility Agent for Windows"
HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\...\StartupApproved\Run: => "Plex Media Server"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{C97E4394-8A48-4F21-B464-9A6A5D5A54A1}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{93776A94-90D5-4519-B1A0-E098CE312A7F}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{DA8A793E-A5E4-47D7-81AE-84BF66EC42C4}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{4D080D92-8DEC-4CE0-BCEA-A1F319E1E296}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{D6AC1967-FD24-478D-8B49-891B52A2AE67}] => (Allow) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
FirewallRules: [Threshold.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\Threshold.exe
FirewallRules: [Threshold.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\Threshold.exe
FirewallRules: [StreamNet.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\StreamNet.exe
FirewallRules: [StreamNet.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\StreamNet.exe
FirewallRules: [SlopeAveDown.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\SlopeAveDown.exe
FirewallRules: [SlopeAveDown.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\SlopeAveDown.exe
FirewallRules: [SlopeAreaRatio.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\SlopeAreaRatio.exe
FirewallRules: [SlopeAreaRatio.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\SlopeAreaRatio.exe
FirewallRules: [SlopeArea.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\SlopeArea.exe
FirewallRules: [SlopeArea.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\SlopeArea.exe
FirewallRules: [PitRemove.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\PitRemove.exe
FirewallRules: [PitRemove.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\PitRemove.exe
FirewallRules: [PeukerDouglas.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\PeukerDouglas.exe
FirewallRules: [PeukerDouglas.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\PeukerDouglas.exe
FirewallRules: [MoveOutletsToStreams.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\MoveOutletsToStreams.exe
FirewallRules: [MoveOutletsToStreams.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\MoveOutletsToStreams.exe
FirewallRules: [LengthArea.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\LengthArea.exe
FirewallRules: [LengthArea.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\LengthArea.exe
FirewallRules: [GridNet.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\GridNet.exe
FirewallRules: [GridNet.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\GridNet.exe
FirewallRules: [DropAnalysis.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DropAnalysis.exe
FirewallRules: [DropAnalysis.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DropAnalysis.exe
FirewallRules: [DinfUpDependence.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfUpDependence.exe
FirewallRules: [DinfUpDependence.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfUpDependence.exe
FirewallRules: [DinfTransLimAccum.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfTransLimAccum.exe
FirewallRules: [DinfTransLimAccum.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfTransLimAccum.exe
FirewallRules: [DinfRevAccum.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfRevAccum.exe
FirewallRules: [DinfRevAccum.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfRevAccum.exe
FirewallRules: [DinfFlowDir.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfFlowDir.exe
FirewallRules: [DinfFlowDir.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfFlowDir.exe
FirewallRules: [DinfDistUp.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfDistUp.exe
FirewallRules: [DinfDistUp.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfDistUp.exe
FirewallRules: [DinfDistDown.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfDistDown.exe
FirewallRules: [DinfDistDown.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfDistDown.exe
FirewallRules: [DinfDecayAccum.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfDecayAccum.exe
FirewallRules: [DinfDecayAccum.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfDecayAccum.exe
FirewallRules: [DinfConcLimAccum.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfConcLimAccum.exe
FirewallRules: [DinfConcLimAccum.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfConcLimAccum.exe
FirewallRules: [DinfAvalanche.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfAvalanche.exe
FirewallRules: [DinfAvalanche.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfAvalanche.exe
FirewallRules: [D8HDistToStrm.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\D8HDistToStrm.exe
FirewallRules: [D8HDistToStrm.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\D8HDistToStrm.exe
FirewallRules: [D8FlowPathExtremeUp.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\D8FlowPathExtremeUp.exe
FirewallRules: [D8FlowPathExtremeUp.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\D8FlowPathExtremeUp.exe
FirewallRules: [D8FlowDir.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\D8FlowDir.exe
FirewallRules: [D8FlowDir.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\D8FlowDir.exe
FirewallRules: [AreaDinf.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\AreaDinf.exe
FirewallRules: [AreaDinf.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\AreaDinf.exe
FirewallRules: [AreaD8.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\AreaD8.exe
FirewallRules: [AreaD8.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\AreaD8.exe
FirewallRules: [{B64BF283-2A93-45C4-9DD1-59549F5FAD14}] => (Allow) C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe
FirewallRules: [{C7BC21A7-C3FA-4E28-BC1A-A557808EF625}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{D2A9995C-573D-4870-A196-E6F92C7FEA75}] => (Allow) LPort=2869
FirewallRules: [{98FA0158-258F-4FA8-89DD-ECE5A11273C6}] => (Allow) LPort=1900
FirewallRules: [{EA34BF9A-7A5F-4F3F-A5BD-663CC060D6E3}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{ED82AD9C-AFA6-4735-A920-DC574204A409}] => (Allow) C:\Program Files (x86)\Windows Live\Mesh\MOE.exe
FirewallRules: [TCP Query User{C66D7923-A783-41D0-84CF-2B67EFA6E8AC}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre7\bin\javaw.exe
FirewallRules: [UDP Query User{6A6D3589-27E9-4166-A941-B67F7F496C4F}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre7\bin\javaw.exe
FirewallRules: [TCP Query User{A25D23CA-7804-4EA6-B0D3-955DA76CFA0F}C:\windows\syswow64\java.exe] => (Allow) C:\windows\syswow64\java.exe
FirewallRules: [UDP Query User{64406E4F-99E3-47BB-AE74-B49BD5C4A72A}C:\windows\syswow64\java.exe] => (Allow) C:\windows\syswow64\java.exe
FirewallRules: [TCP Query User{6578A75B-A845-4BFE-A275-8FD74C984758}C:\program files (x86)\internet explorer\iexplore.exe] => (Block) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [UDP Query User{85D6766B-6445-4445-ABA5-C4818CC9EBDC}C:\program files (x86)\internet explorer\iexplore.exe] => (Block) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [{99BEEB2A-E79C-439B-9A70-3D225C43D63F}] => (Allow) C:\Program Files (x86)\uTorrent\uTorrent.exe
FirewallRules: [{3EB3C082-397F-411C-9636-9ED1253AE631}] => (Allow) C:\Program Files (x86)\uTorrent\uTorrent.exe
FirewallRules: [{EA796675-EE94-497F-BC35-CA9CBC9616C1}] => (Allow) C:\Program Files (x86)\Wolfram Research\Wolfram CDF Player\8.0\WolframCDFPlayer.exe
FirewallRules: [{46D7AF76-9E5A-4ABE-A0E2-E0E055EDF20F}] => (Allow) C:\Program Files (x86)\Wolfram Research\Wolfram CDF Player\8.0\WolframCDFPlayer.exe
FirewallRules: [{C4776A0E-63A8-4BF4-9607-AFD7FD9FC2B1}] => (Allow) C:\Program Files (x86)\Wolfram Research\Wolfram CDF Player\8.0\math.exe
FirewallRules: [{F0EA1B3E-80F1-44FB-A051-2AB84E74E76B}] => (Allow) C:\Program Files (x86)\Wolfram Research\Wolfram CDF Player\8.0\math.exe
FirewallRules: [{D79BB384-A9B2-4C88-950E-CB3217FCF8B9}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{EB64F111-26BF-419C-873E-0DB8B100F120}C:\users\dave\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe] => (Allow) C:\users\dave\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe
FirewallRules: [UDP Query User{58913BBD-D8FB-45F6-A6D3-A6F3557780AB}C:\users\dave\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe] => (Allow) C:\users\dave\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe
FirewallRules: [{E21B9340-397D-4611-BF10-2984A0055970}] => (Block) C:\users\dave\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe
FirewallRules: [{10379A70-582A-44A7-A7CA-55594BB13019}] => (Block) C:\users\dave\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe
FirewallRules: [TCP Query User{7C2313F0-154A-4E6E-90D6-7E90379CA707}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre7\bin\javaw.exe
FirewallRules: [UDP Query User{A94DDC9C-3777-4D71-8BBE-4D876BCD135D}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre7\bin\javaw.exe
FirewallRules: [{9C966373-284D-4353-ACE9-CD031EB094C4}] => (Allow) LPort=8298
FirewallRules: [{45DAD556-0BDA-4265-83C2-FE50B971192F}] => (Allow) C:\Program Files (x86)\Plex\Plex Media Server\Plex Media Server.exe
FirewallRules: [{05D180E3-1AED-45AF-B671-62836A25F3DB}] => (Allow) C:\Program Files (x86)\Plex\Plex Media Server\PlexScriptHost.exe
FirewallRules: [{5BA111A5-F7EE-4FA6-9FCF-182CBE7BCFA4}] => (Allow) C:\Program Files (x86)\Plex\Plex Media Server\PlexDlnaServer.exe
FirewallRules: [{4528EE72-9CE0-421E-8550-3B24C363B9F5}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{F6C09B32-9999-462F-AB77-DF7799C0C78F}C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe
FirewallRules: [UDP Query User{CD2A1F08-F0C1-4981-90F7-5D39F3D41DA8}C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe
FirewallRules: [{21CC09DF-8C0C-4A80-9937-5AABCB29BBCF}] => (Block) C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe
FirewallRules: [{D9C5B658-463C-4498-B23A-2ABFB367CC8A}] => (Block) C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe
FirewallRules: [{E025775D-8895-4976-BA29-A879288BC421}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{CA7BBAD6-8275-43AD-A8F5-B21337FA9A66}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{7AA5E096-F108-4834-88E6-661BC0F25167}C:\users\dave\documents\screenscraper basic\screen-scraper basic edition\screen-scraper.exe] => (Allow) C:\users\dave\documents\screenscraper basic\screen-scraper basic edition\screen-scraper.exe
FirewallRules: [UDP Query User{4F2DEC60-AB57-4F30-B6FC-8328AC5AB464}C:\users\dave\documents\screenscraper basic\screen-scraper basic edition\screen-scraper.exe] => (Allow) C:\users\dave\documents\screenscraper basic\screen-scraper basic edition\screen-scraper.exe
FirewallRules: [TCP Query User{6D1B4B3D-DC44-4E97-ABF5-BF0A5D719339}C:\users\dave\documents\screenscraper basic\screen-scraper basic edition\jre\bin\java.exe] => (Allow) C:\users\dave\documents\screenscraper basic\screen-scraper basic edition\jre\bin\java.exe
FirewallRules: [UDP Query User{6717A046-F10E-44A8-A0C4-9552514FD275}C:\users\dave\documents\screenscraper basic\screen-scraper basic edition\jre\bin\java.exe] => (Allow) C:\users\dave\documents\screenscraper basic\screen-scraper basic edition\jre\bin\java.exe
FirewallRules: [{61999273-0528-4DEE-9F0F-38CB07458FF8}] => (Block) C:\users\dave\documents\screenscraper basic\screen-scraper basic edition\screen-scraper.exe
FirewallRules: [{216A7450-775A-4FEE-B105-4DD82BA1CE49}] => (Block) C:\users\dave\documents\screenscraper basic\screen-scraper basic edition\screen-scraper.exe
FirewallRules: [{F184E7F9-BEAD-4372-85AE-AFD57A3276BD}] => (Block) C:\users\dave\documents\screenscraper basic\screen-scraper basic edition\jre\bin\java.exe
FirewallRules: [{418F4DC2-5545-48F0-A759-AB3BAB8BFBC4}] => (Block) C:\users\dave\documents\screenscraper basic\screen-scraper basic edition\jre\bin\java.exe
FirewallRules: [TCP Query User{8F8E1440-4D93-43AB-A3D6-201C8C23F463}K:\_personal\software\screenscraper basic\screen-scraper basic edition\screen-scraper.exe] => (Allow) K:\_personal\software\screenscraper basic\screen-scraper basic edition\screen-scraper.exe
FirewallRules: [UDP Query User{40CCAE81-8109-420E-AF87-77E26890B7F5}K:\_personal\software\screenscraper basic\screen-scraper basic edition\screen-scraper.exe] => (Allow) K:\_personal\software\screenscraper basic\screen-scraper basic edition\screen-scraper.exe
FirewallRules: [{C9ECCCEC-27ED-4620-9248-4C5E5EEAC2DC}] => (Block) K:\_personal\software\screenscraper basic\screen-scraper basic edition\screen-scraper.exe
FirewallRules: [{97E2E5D7-3C8D-4277-8621-2AEDEA7CD348}] => (Block) K:\_personal\software\screenscraper basic\screen-scraper basic edition\screen-scraper.exe
FirewallRules: [TCP Query User{A8769730-A01D-4989-8620-3ADE44A7D02B}C:\users\dave\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\dave\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{046F220F-EFB1-4E01-B03D-8F38DD13339A}C:\users\dave\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\dave\appdata\roaming\spotify\spotify.exe
FirewallRules: [{66F7B5B5-ED35-4329-B549-A95D03B9B1F1}] => (Block) C:\users\dave\appdata\roaming\spotify\spotify.exe
FirewallRules: [{58B041DA-DDE2-43FC-B32A-71F354676EB8}] => (Block) C:\users\dave\appdata\roaming\spotify\spotify.exe
FirewallRules: [{4EEFD3C5-14F1-4076-8EE4-F389AD479545}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [{6D39C845-E020-45D1-BBE6-56AFA68C82DE}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [{D5D7FE67-D60F-48B3-BD94-753E4765D5C4}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{60D599F0-5D17-4685-A9AA-02518D2C3139}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{FB4981A4-3783-4464-B83E-AE98B5232A38}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{341C4F30-A9D6-4890-B70C-C049009C3C6F}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [{033619D0-9520-42E2-83E8-ADC19A261AC1}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{11BBCA25-52E8-4C6D-9047-B9C87502457D}] => (Allow) C:\Program Files (x86)\Opera\54.0.2952.64\opera.exe
FirewallRules: [{BF968F8D-7C5E-4EB9-B0CF-C0CE516F489F}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{DDA01E78-044D-41D8-B8A9-36B1018C64A4}] => (Allow) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
FirewallRules: [{26F3B8AD-3EAB-4971-BD7F-01011DB0A5F7}] => (Allow) C:\Program Files\Pale Moon\palemoon.exe
FirewallRules: [{03A9717A-9E7B-43FE-9BC4-4A42887BEA87}] => (Allow) C:\Program Files\Pale Moon\palemoon.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Orbitdownloader\orbitdm.exe] => Enabled:Orbit
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Orbitdownloader\orbitnet.exe] => Enabled:Orbit

==================== Restore Points =========================

17-08-2018 08:58:26 Windows Modules Installer
18-08-2018 10:58:48 Windows Modules Installer
19-08-2018 12:58:35 Windows Modules Installer
21-08-2018 01:01:02 Windows Modules Installer
22-08-2018 07:02:52 Windows Modules Installer
25-08-2018 00:59:10 Windows Modules Installer
26-08-2018 03:20:53 Windows Modules Installer
27-08-2018 04:57:02 Windows Modules Installer
28-08-2018 06:57:00 Windows Modules Installer

==================== Faulty Device Manager Devices =============

Name: MyBookWorld
Description: My Book World Edition Network Storage
Class Guid: {4d36e967-e325-11ce-bfc1-08002be10318}
Manufacturer: Western Digital Corporation
Service: UmPass
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

==================== Event log errors: =========================

Application errors:
==================
Error: (08/26/2018 10:57:28 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: ACDaemon.exe, version: 1.1.0.49, time stamp: 0x4cc808ec
Faulting module name: ACDaemon.exe, version: 1.1.0.49, time stamp: 0x4cc808ec
Exception code: 0xc0000005
Fault offset: 0x0001af76
Faulting process id: 0x55c
Faulting application start time: 0x01d43d5dd6304533
Faulting application path: C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
Faulting module path: C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
Report Id: 8ea5f03b-5fc5-491c-9aa5-9e4cdd56039f
Faulting package full name:
Faulting package-relative application ID:

Error: (08/26/2018 10:33:28 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: ACDaemon.exe, version: 1.1.0.49, time stamp: 0x4cc808ec
Faulting module name: ACDaemon.exe, version: 1.1.0.49, time stamp: 0x4cc808ec
Exception code: 0xc0000005
Fault offset: 0x0001af76
Faulting process id: 0x11c0
Faulting application start time: 0x01d43d5a7db560b0
Faulting application path: C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
Faulting module path: C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
Report Id: a4054b1d-126d-4ee2-9867-04eae985c035
Faulting package full name:
Faulting package-relative application ID:

Error: (08/26/2018 10:28:56 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 14094

Error: (08/26/2018 10:28:56 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 14094

Error: (08/26/2018 10:28:56 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (08/26/2018 10:28:49 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 6860

Error: (08/26/2018 10:28:49 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 6860

Error: (08/26/2018 10:28:49 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

System errors:
=============
Error: (08/27/2018 11:06:36 PM) (Source: DCOM) (EventID: 10016) (User: 2012_Office)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
and APPID
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
to the user 2012_Office\Dave SID (S-1-5-21-4063716828-1680190529-1648852121-1000) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.ContentDeliveryManager_10.0.17134.1_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723). This security permission can be modified using the Component Services administrative tool.

Error: (08/27/2018 08:01:40 AM) (Source: DCOM) (EventID: 10016) (User: 2012_Office)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
and APPID
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
to the user 2012_Office\Dave SID (S-1-5-21-4063716828-1680190529-1648852121-1000) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.ContentDeliveryManager_10.0.17134.1_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723). This security permission can be modified using the Component Services administrative tool.

Error: (08/26/2018 11:09:17 AM) (Source: DCOM) (EventID: 10016) (User: 2012_Office)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
and APPID
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
to the user 2012_Office\Dave SID (S-1-5-21-4063716828-1680190529-1648852121-1000) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.ContentDeliveryManager_10.0.17134.1_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723). This security permission can be modified using the Component Services administrative tool.

Error: (08/26/2018 11:09:15 AM) (Source: DCOM) (EventID: 10016) (User: 2012_Office)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
and APPID
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
to the user 2012_Office\Dave SID (S-1-5-21-4063716828-1680190529-1648852121-1000) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.ContentDeliveryManager_10.0.17134.1_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723). This security permission can be modified using the Component Services administrative tool.

Error: (08/26/2018 11:09:15 AM) (Source: DCOM) (EventID: 10016) (User: 2012_Office)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
and APPID
{8BC3F05E-D86B-11D0-A075-00C04FB68820}
to the user 2012_Office\Dave SID (S-1-5-21-4063716828-1680190529-1648852121-1000) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.ContentDeliveryManager_10.0.17134.1_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723). This security permission can be modified using the Component Services administrative tool.

Error: (08/26/2018 11:07:25 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The Intel(R) Management and Security Application User Notification Service service hung on starting.

Error: (08/26/2018 11:05:55 AM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)
Description: The server {B91D5831-B1BD-4608-8198-D72E155020F7} did not register with DCOM within the required timeout.

Error: (08/26/2018 11:05:23 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
Windows.SecurityCenter.WscBrokerManager
and APPID
Unavailable
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Windows Defender:
===================================
Date: 2018-08-25 11:21:40.899
Description:
Windows Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?lin...5&enterprise=0
Name: HackTool:Win32/Netpass
ID: 2147605535
Severity: High
Category: Tool
Path: containerfile:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload 18-06-18\Utilities\Zip Files\netpass.zip; file:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload 18-06-18\Utilities\Zip Files\netpass.zip->netpass.exe; file:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload 18-06-18\Utilities\Zip Files\netpass.zip->netpass.exe->(UPX)
Detection Origin: Local machine
Detection Type: FastPath
Detection Source: User
Process Name: Unknown
Signature Version: AV: 1.275.151.0, AS: 1.275.151.0, NIS: 1.275.151.0
Engine Version: AM: 1.1.15200.1, NIS: 1.1.15200.1

Date: 2018-08-25 03:07:00.918
Description:
Windows Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?lin...6&enterprise=0
Name: Trojan:Win32/Fuerboos.E!cl
ID: 2147723656
Severity: Severe
Category: Trojan
Path: file:_P:\Laptop Backup 14-04-06\Documents and Settings\Ben\My Documents\Downloads\Java.exe
Detection Origin: Local machine
Detection Type: FastPath
Detection Source: User
Process Name: Unknown
Signature Version: AV: 1.273.1749.0, AS: 1.273.1749.0, NIS: 1.273.1749.0
Engine Version: AM: 1.1.15100.1, NIS: 1.1.15100.1

Date: 2018-08-25 03:07:00.916
Description:
Windows Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?lin...1&enterprise=0
Name: BrowserModifier:Win32/Beilextec
ID: 240791
Severity: High
Category: Browser Modifier
Path: containerfile:_C:\Users\Dave\Downloads\Installed\Format Factory\FFSetup3.0.1.exe; file:_C:\Users\Dave\Downloads\Installed\Format Factory\FFSetup3.0.1.exe->(nsis-6-v9fft.exe)
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: User
Process Name: Unknown
Signature Version: AV: 1.273.1749.0, AS: 1.273.1749.0, NIS: 1.273.1749.0
Engine Version: AM: 1.1.15100.1, NIS: 1.1.15100.1

Date: 2018-08-25 03:07:00.915
Description:
Windows Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?lin...7&enterprise=0
Name: HackTool:Win32/Wirekeyview
ID: 2147657007
Severity: High
Category: Tool
Path: containerfile:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload 18-06-18\Utilities\Zip Files\wirelesskeyview.zip; file:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload 18-06-18\Utilities\Zip Files\wirelesskeyview.zip->WirelessKeyView.exe
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: User
Process Name: Unknown
Signature Version: AV: 1.273.1749.0, AS: 1.273.1749.0, NIS: 1.273.1749.0
Engine Version: AM: 1.1.15100.1, NIS: 1.1.15100.1

Date: 2018-08-25 03:07:00.913
Description:
Windows Defender Antivirus has detected malware or other potentially unwanted software.
For more information please see the following:
https://go.microsoft.com/fwlink/?lin...5&enterprise=0
Name: HackTool:Win32/BrowserPassview
ID: 2147685165
Severity: High
Category: Tool
Path: containerfile:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload 18-06-18\Utilities\Zip Files\webbrowserpassview.zip; file:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload 18-06-18\Utilities\Zip Files\webbrowserpassview.zip->WebBrowserPassView.exe
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: User
Process Name: Unknown
Signature Version: AV: 1.273.1749.0, AS: 1.273.1749.0, NIS: 1.273.1749.0
Engine Version: AM: 1.1.15100.1, NIS: 1.1.15100.1

Date: 2018-08-28 22:42:34.239
Description:
Windows Defender Antivirus has encountered an error trying to upload a suspicious file for further analysis.
Filename: P:\Laptop Backup 14-04-06\Documents and Settings\Ben\My Documents\Downloads\Java.exe
Sha256:
Current Signature Version: AV: 1.275.323.0, AS: 1.275.323.0
Current Engine Version: 1.1.15200.1
Error code: 0x80508016

Date: 2018-08-26 10:40:29.117
Description:
Windows Defender Antivirus has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.275.151.0
Update Source: Microsoft Update Server
Signature Type: AntiVirus
Update Type: Full
Current Engine Version:
Previous Engine Version: 1.1.15200.1
Error code: 0x80070008
Error description: Not enough memory resources are available to process this command.

Date: 2018-08-26 00:26:50.444
Description:
Windows Defender Antivirus has encountered an error trying to update signatures.
New Signature Version:
Previous Signature Version: 1.275.151.0
Update Source: Microsoft Update Server
Signature Type: AntiVirus
Update Type: Full
Current Engine Version:
Previous Engine Version: 1.1.15200.1
Error code: 0x80070008
Error description: Not enough memory resources are available to process this command.

CodeIntegrity:
===================================

Date: 2018-08-16 13:15:09.616
Description:
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.StdFormat.dll that did not meet the Microsoft signing level requirements.

Date: 2018-08-16 13:15:09.558
Description:
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\ADODB.dll that did not meet the Microsoft signing level requirements.

Date: 2018-08-16 13:15:09.496
Description:
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\MSDATASRC.dll that did not meet the Microsoft signing level requirements.

Date: 2018-08-16 13:15:09.308
Description:
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.StdFormat.dll that did not meet the Microsoft signing level requirements.

Date: 2018-08-16 13:15:09.263
Description:
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\ADODB.dll that did not meet the Microsoft signing level requirements.

Date: 2018-08-16 13:15:09.217
Description:
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\MSDATASRC.dll that did not meet the Microsoft signing level requirements.

Date: 2018-08-16 13:15:07.524
Description:
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\stdole.dll that did not meet the Microsoft signing level requirements.

Date: 2018-08-16 13:15:06.841
Description:
Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\stdole.dll that did not meet the Microsoft signing level requirements.

==================== Memory info ===========================

Processor: Intel(R) Core(TM) i5-2400 CPU @ 3.10GHz
Percentage of memory in use: 62%
Total physical RAM: 8098.51 MB
Available physical RAM: 3067.95 MB
Total Virtual: 15522.51 MB
Available Virtual: 7801.06 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:919.45 GB) (Free:74.42 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive d: (HP_RECOVERY) (Fixed) (Total:11.52 GB) (Free:1.4 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive p: (New Volume) (Fixed) (Total:2794.39 GB) (Free:86.23 GB) NTFS

\\?\Volume{28a723c4-b7ed-11e1-ac0c-806e6f6e6963}\ (SYSTEM) (Fixed) (Total:0.1 GB) (Free:0.06 GB) NTFS
\\?\Volume{a1e71db5-0000-0000-0000-20e3e5000000}\ () (Fixed) (Total:0.44 GB) (Free:0.06 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7/8/10) (Size: 931.5 GB) (Disk ID: A1E71DB5)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=919.5 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=450 MB) - (Type=27)
Partition 4: (Not Active) - (Size=11.5 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Protective MBR) (Size: 2794.5 GB) (Disk ID: 00000000)

Partition: GPT.

==================== End of Addition.txt ============================

Did Windows Defender have trouble removing what it found?

~~

Start Farbar Recovery Scan Tool with Administrator privileges
(Right click on the FRST icon and select Run as administrator)

highlight on the text below and select Copy.
beginning with Start:: and finishing with End::
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Highlight the entire content of the quote box below and select Copy.

Quote:

Start::
CloseProcesses:
CreateRestorePoint:
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL => No File
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Silverlight\Office14\URLREDIR.DLL => No File
BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll [2014-03-11] (Microsoft Corporation.)
Toolbar: HKLM - No Name - {8dcb7100-df86-4384-8842-8fa844297b3f} - No File
Toolbar: HKU\S-1-5-21-4063716828-1680190529-1648852121-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\defaults\pref\itms.js [2011-01-24]
2018-08-10 00:18 - 2018-07-06 01:25 - 001945784 _____ (Microsoft Corporation) C:\Users\Office Administrator\AppData\Local\Temp\dllnt_dump.dll
ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => -> No File
C:\Windows\Temp\*.*
Emptytemp:
End::

Start FRST (FRST64) with Administrator privileges
Press the Fix button. FRST will process the lines copied above from the clipboard.
When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

Please copy and paste its contents in your next reply.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Also, tell me how the computer is now.

Done

Windows Defender had no trouble removing those.

PC seems to be running fine.

Ran FRST. Log pasted below.

Fix result of Farbar Recovery Scan Tool (x64) Version: 02.08.2018
Ran by Office Administrator (09-08-2018 23:46:16) Run:1
Running from C:\Users\Dave\Desktop
Loaded Profiles: Dave & Office Administrator (Available Profiles: Dave & Hope & Ben & Mary Jo & Office Administrator & Share_with_Office & Rich & Administrator & DefaultAppPool)
Boot Mode: Normal
==============================================

fixlist content:
*****************
CloseProcesses:
CreateRestorePoint:
C:\Windows\Temp\*.*
GroupPolicy: Restriction ? <==== ATTENTION
GroupPolicy\User: Restriction ? <==== ATTENTION
GroupPolicyUsers\S-1-5-21-4063716828-1680190529-1648852121-1004\User: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKLM -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
SearchScopes: HKLM -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
SearchScopes: HKU\S-1-5-21-4063716828-1680190529-1648852121-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-4063716828-1680190529-1648852121-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-4063716828-1680190529-1648852121-1000 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
SearchScopes: HKU\S-1-5-21-4063716828-1680190529-1648852121-1006 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-4063716828-1680190529-1648852121-1006 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-4063716828-1680190529-1648852121-1006 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxps://isearch.avg.com/search?cid={1B9CC6B6-62E7-4842-A87E-60C6CEC9B3DC}&mid=&lang=&ds=&pr=&d=&v=&sap=dsp&q={searchTerms}
SearchScopes: HKU\S-1-5-21-4063716828-1680190529-1648852121-1006 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
BHO: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll [2014-03-11] (Microsoft Corporation.)
BHO-x32: Octh Class -> {000123B4-9B42-4900-B3F7-F4B073EFC214} -> C:\Program Files (x86)\Orbitdownloader\orbitcth.dll [2013-05-02] (Orbitdownloader.com)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll [2014-03-11] (Microsoft Corporation.)Toolbar: HKU\S-1-5-21-4063716828-1680190529-1648852121-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKU\S-1-5-21-4063716828-1680190529-1648852121-1006 -> No Name - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No File
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll No File
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll No File
2018-08-08 11:31 - 2018-08-08 11:31 - 004264384 _____ (Don HO don.h@free.fr) C:\Users\Dave\AppData\Local\Temp\npp.7.5.8.Installer.exe
2018-05-24 19:49 - 2018-05-24 19:49 - 004299968 _____ (Don HO don.h@free.fr) C:\Users\Office Administrator\AppData\Local\Temp\npp.7.5.6.Installer.exe
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 1 (GFS Unread Stub)] -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL -> No File
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 2 (GFS Stub)] -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL -> No File
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)] -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL -> No File
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 3 (GFS Folder)] -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL -> No File
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 4 (GFS Unread Mark)] -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => -> No File
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 1 (GFS Unread Stub)] -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL -> No File
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 2 (GFS Stub)] -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL -> No File
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)] -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL -> No File
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 3 (GFS Folder)] -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL -> No File
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 4 (GFS Unread Mark)] -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL -> No File
ContextMenuHandlers1-x32: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} => C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL -> No File
ContextMenuHandlers3: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} => C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL -> No File
ContextMenuHandlers4: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} => C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL -> No File
ContextMenuHandlers5: [Gadgets] -> {6B9228DA-9C15-419e-856C-19E768A13BDC} => -> No File
ContextMenuHandlers5: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} => C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL -> No File
ContextMenuHandlers6-x32: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} => C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL -> No File
Task: {032B01CC-1874-43B4-A40E-0A34AE5B0219} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime -> No File <==== ATTENTION
Task: {0CC3794B-E509-49AE-AF82-09F758E715B3} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {0EBF683C-73C8-427B-888B-F5FEDFA0A8B8} - \Microsoft\Windows\UNP\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Unlock -> No File <==== ATTENTION
Task: {14160C5A-0629-4486-AD42-B50AD57381FA} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {15CDA51F-2714-4EDB-A171-93B428EB5EAB} - \Microsoft\Windows\UNP\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\OutOfIdle -> No File <==== ATTENTION
Task: {225F401F-D757-4C63-9C5E-338A1BF1A40C} - \Microsoft\Windows\Setup\gwx\rundetector -> No File <==== ATTENTION
Task: {310AE0D2-A029-42FE-9CBF-BE9D3169809C} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {3311EDC2-3EB7-44C7-98E3-001274DB87E2} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {3D5FD92F-118C-45D9-B0B3-3723CAC9801B} - \Microsoft\Windows\Setup\GWXTriggers\Time-Weekend -> No File <==== ATTENTION
Task: {453D4E41-9E0A-450B-ABEE-1E59AE056970} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {4EA06D77-9D3C-4D8D-87AC-E943886E5F61} - \Microsoft\Windows\UNP\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\OnIdle -> No File <==== ATTENTION
Task: {72D3B183-DAE2-4C2A-B083-2F775CA56B84} - \OfficeSoftwareProtectionPlatform\SvcRestartTask -> No File <==== ATTENTION
Task: {81CF05AE-D06C-4C08-9EC1-EF7705F329D2} - \Microsoft\Windows\UNP\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Logon -> No File <==== ATTENTION
Task: {92371601-C4C9-4886-8F49-55A1B31041CA} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {A67499BF-E58D-4F6B-808F-5521BCB22C84} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {B45BD574-7084-4DF1-82B3-CD8D60EDDB56} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {B575AFE0-AF73-4398-9D64-5D7A4249CF40} - \CCleanerSkipUAC -> No File <==== ATTENTION
Task: {B7A8F376-2E78-4061-83AB-BD6CC226463C} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {B887A7D3-7A91-488D-87DA-512ED75B31E7} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime -> No File <==== ATTENTION
Task: {CC5E2665-C32E-472A-B456-DD8263A22363} - \Microsoft\Windows\UNP\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Time -> No File <==== ATTENTION
Task: {DB90AE6C-A7F3-4DCB-8F95-73AC04603218} - \Microsoft\Windows\Setup\GWXTriggers\OnIdle-5d -> No File <==== ATTENTION
Task: {E63BAE5A-5EBA-47EA-A20E-B92FD497F1B2} - \Microsoft\Windows\UNP\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\RunCampaignManager2 -> No File <==== ATTENTION
Task: {E715D404-048F-428E-B4E3-3091D17C67DF} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {F1B34399-703E-4852-B06A-F538BC5472CA} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
AlternateDataStreams: C:\ProgramData\Temp:DED17083 [286]
Emptytemp:

*****************

Processes closed successfully.
Restore point was successfully created.

=========== "C:\Windows\Temp\*.*" ==========

C:\Windows\Temp\ASPNETSetup_00000.log => moved successfully
C:\Windows\Temp\ASPNETSetup_00001.log => moved successfully
C:\Windows\Temp\ccleaner64.exe.png => moved successfully
C:\Windows\Temp\chrome_installer.log => moved successfully
C:\Windows\Temp\CProgram Files (x86)Opera52.0.2871.64opera_autoupdate.download.lock => moved successfully
C:\Windows\Temp\CProgram Files (x86)Opera53.0.2907.68opera_autoupdate.download.lock => moved successfully
C:\Windows\Temp\CProgram Files (x86)Opera53.0.2907.99opera_autoupdate.download.lock => moved successfully
C:\Windows\Temp\CProgram Files (x86)Opera54.0.2952.51opera_autoupdate.download.lock => moved successfully
C:\Windows\Temp\CProgram Files (x86)Opera54.0.2952.54opera_autoupdate.download.lock => moved successfully
C:\Windows\Temp\CProgram Files (x86)Opera54.0.2952.64opera_autoupdate.download.lock => moved successfully
C:\Windows\Temp\easyclea.exe.png => moved successfully
C:\Windows\Temp\FXSAPIDebugLogFile.txt => moved successfully
C:\Windows\Temp\FXSTIFFDebugLogFile.txt => moved successfully
C:\Windows\Temp\MpCmdRun.log => moved successfully
C:\Windows\Temp\MpSigStub.log => moved successfully
C:\Windows\Temp\opera_crashreporter.log => moved successfully
C:\Windows\Temp\Opera_installer_180516065107578.dll => moved successfully
C:\Windows\Temp\Opera_installer_180517003808963.dll => moved successfully
C:\Windows\Temp\Opera_installer_180517141350204.dll => moved successfully
C:\Windows\Temp\Opera_installer_180517231321000.dll => moved successfully
C:\Windows\Temp\Opera_installer_180517232424842.dll => moved successfully
C:\Windows\Temp\Opera_installer_180518001313655.dll => moved successfully
C:\Windows\Temp\Opera_installer_180518003809164.dll => moved successfully
C:\Windows\Temp\Opera_installer_180518061320300.dll => moved successfully
C:\Windows\Temp\Opera_installer_180519003809063.dll => moved successfully
C:\Windows\Temp\Opera_installer_180519061325579.dll => moved successfully
C:\Windows\Temp\Opera_installer_180520025744624.dll => moved successfully
C:\Windows\Temp\Opera_installer_180520061334625.dll => moved successfully
C:\Windows\Temp\Opera_installer_180521003808944.dll => moved successfully
C:\Windows\Temp\Opera_installer_180521061340919.dll => moved successfully
C:\Windows\Temp\Opera_installer_180522003809702.dll => moved successfully
C:\Windows\Temp\Opera_installer_180522061359177.dll => moved successfully
C:\Windows\Temp\Opera_installer_180523053058263.dll => moved successfully
C:\Windows\Temp\Opera_installer_180523061414625.dll => moved successfully
C:\Windows\Temp\Opera_installer_180523153712496.dll => moved successfully
C:\Windows\Temp\Opera_installer_180523155327936.dll => moved successfully
C:\Windows\Temp\Opera_installer_180523172527527.dll => moved successfully
C:\Windows\Temp\Opera_installer_180524003808798.dll => moved successfully
C:\Windows\Temp\Opera_installer_180524172536263.dll => moved successfully
C:\Windows\Temp\Opera_installer_180525013519843.dll => moved successfully
C:\Windows\Temp\Opera_installer_180525172543227.dll => moved successfully
C:\Windows\Temp\Opera_installer_180526064750140.dll => moved successfully
C:\Windows\Temp\Opera_installer_180526161634847.dll => moved successfully
C:\Windows\Temp\Opera_installer_180526221506407.dll => moved successfully
C:\Windows\Temp\Opera_installer_180527003809198.dll => moved successfully
C:\Windows\Temp\Opera_installer_180527221515581.dll => moved successfully
C:\Windows\Temp\Opera_installer_180529064602222.dll => moved successfully
C:\Windows\Temp\Opera_installer_180529163744323.dll => moved successfully
C:\Windows\Temp\Opera_installer_180529221612512.dll => moved successfully
C:\Windows\Temp\Opera_installer_180529223729324.dll => moved successfully
C:\Windows\Temp\Opera_installer_180531064515685.dll => moved successfully
C:\Windows\Temp\Opera_installer_180601064706678.dll => moved successfully
C:\Windows\Temp\Opera_installer_180602064617077.dll => moved successfully
C:\Windows\Temp\Opera_installer_180602064937738.dll => moved successfully
C:\Windows\Temp\Opera_installer_180606041226536.dll => moved successfully
C:\Windows\Temp\sa.007CAC78-C79B-923B-71A8-B5DFAE2AF4C2_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.00D57B0F-01FA-B79F-08D6-878ED20C4C9B_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.0116DC02-781B-D1D1-FC1C-C80195511E17_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.0251D65D-E887-28BD-A226-3ECD72FB59C6_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.0862A72D-A96C-83E5-AD0F-78B6AA06F9C6_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.0A55FA08-ED1C-797E-BCC1-BBA3F550B119_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.0C8CF327-9D17-CCDE-18AF-DFF4F20070E5_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.18DDC675-D472-0DB4-9563-7DF7C34F512C_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.1A7994D6-5342-8581-71FB-A2BD1C895D93_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.1F63B8C3-2D48-9497-0A0A-2CBD462EDE76_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.1FE89C0B-9BED-CC5D-7426-9E4025D6BDD9_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.31A692E0-F967-E4F8-A441-21A804580E9E_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.32A48683-F264-932C-7870-B93BB448ED69_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.3BFD26C9-8DA9-B940-F638-55890012AAB4_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.49F33C48-B2DE-F82A-56F2-64425F298B84_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.50611331-FE19-D366-B049-694B8AC9D758_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.557EA3BB-623E-ADD9-4DFB-629A8648A038_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.558F5D32-0827-EB7B-6AD6-D5DB4138B3AA_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.62B49C0A-499E-A02D-EBCB-EB168E148E52_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.6447326C-966E-1B7C-F7BE-35D29235B75F_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.664AA17A-2D25-0823-3315-3708FE16147A_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.674C4C14-7BAA-F782-E214-956DC3BEDF39_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.68BC3251-2D8B-A604-92BA-893638CA72EA_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.68E019EB-0B92-5E08-5D86-9BFE6DBA8517_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.69F3BCAB-8975-C526-30F5-39FA70C77AD9_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.6D151227-6BD9-726D-B30E-A8A018DCC82B_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.6DA3D5C0-A460-4E4E-3B2A-8530BC7CAFDA_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.6EA6FC2E-9305-586B-3411-02826D151533_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.70BC17F8-0AA7-CB35-CEE0-EF1B47A0FD3E_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.7583E141-6210-5A36-BB89-80D0397C4721_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.8F700A8E-3731-B777-A6DD-000FE1F8FCB2_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.97612282-D1E8-1D6A-9E92-C271E7F177EF_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.993325CD-9CA8-DD49-50C4-377C092AEF1B_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.9D4DED89-CABC-F4FB-8133-BC5EDB1C7EDA_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.A715D489-C343-F20B-B22E-F8D749061B0C_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.A8849751-10C4-3F5D-1F42-DA79DB2C7BE9_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.A90B8400-D36D-8235-8BF2-A21A53D3FB65_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.AB7C46F6-66DE-8533-C6B1-FFE36BF92E97_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.B1B6FBCA-CD11-CB52-6CA7-06B47EB7C197_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.BBFD7549-71AE-D8FD-9F58-2EF4C874B21C_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.D73AFAA4-7387-FEF0-0786-A226F43AD6F5_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.DFBE09D0-1F22-A9C0-2D3D-3F4C6351E58F_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.E336BB8F-16ED-7CBE-AFEE-971DD3041585_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.E6658C19-4221-2EBE-763A-F0493FBA2BB0_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.E6D3B497-80AF-7F14-F9E6-9606EE369FC3_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.FACF9DDE-1FF1-B57D-4D1D-CE479FDD42AF_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\sa.FB06EF95-BC48-1A6A-26FB-4450CE9A5906_5__.Public.AppUpdate.dat => moved successfully
C:\Windows\Temp\tem8429.tmp => moved successfully
C:\Windows\Temp\wmsetup.log => moved successfully

========= End -> "C:\Windows\Temp\*.*" ========

C:\WINDOWS\system32\GroupPolicy\Machine => moved successfully
C:\WINDOWS\system32\GroupPolicy\GPT.ini => moved successfully
C:\WINDOWS\SysWOW64\GroupPolicy\GPT.ini => moved successfully
C:\WINDOWS\system32\GroupPolicy\User => moved successfully
C:\WINDOWS\system32\GroupPolicyUsers\S-1-5-21-4063716828-1680190529-1648852121-1004\User => moved successfully
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => removed successfully
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => removed successfully
HKLM\Software\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => not found
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}" => removed successfully
HKLM\Software\Classes\CLSID\{b7fca997-d0fb-4fe0-8afd-255e89cf9671} => not found
"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}" => removed successfully
HKLM\Software\Classes\CLSID\{d43b3890-80c7-4010-a95d-1e77b5924dc3} => not found
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => removed successfully
HKLM\Software\Wow6432Node\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => not found
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}" => removed successfully
HKLM\Software\Wow6432Node\Classes\CLSID\{b7fca997-d0fb-4fe0-8afd-255e89cf9671} => not found
"HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope" => removed successfully
"HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => removed successfully
HKLM\Software\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => not found
"HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}" => removed successfully
HKLM\Software\Classes\CLSID\{b7fca997-d0fb-4fe0-8afd-255e89cf9671} => not found
"HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope" => removed successfully
"HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => removed successfully
HKLM\Software\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => not found
"HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}" => removed successfully
HKLM\Software\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233} => not found
"HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}" => removed successfully
HKLM\Software\Classes\CLSID\{b7fca997-d0fb-4fe0-8afd-255e89cf9671} => not found
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}" => removed successfully
"HKLM\Software\Classes\CLSID\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}" => removed successfully
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000123B4-9B42-4900-B3F7-F4B073EFC214}" => removed successfully
"HKLM\Software\Wow6432Node\Classes\CLSID\{000123B4-9B42-4900-B3F7-F4B073EFC214}" => removed successfully
"HKU\Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll [2014-03-11] (Microsoft Corporation.)S-1-5-21-4063716828-1680190529-1648852121-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{8dcb7100-df86-4384-8842-8fa844297b3f}" => not found
"HKLM\Software\Classes\CLSID\{8dcb7100-df86-4384-8842-8fa844297b3f}" => removed successfully
"HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{C55BBCD6-41AD-48AD-9953-3609C48EACC7}" => removed successfully
HKLM\Software\Classes\CLSID\{C55BBCD6-41AD-48AD-9953-3609C48EACC7} => not found
"HKLM\Software\Classes\PROTOCOLS\Handler\livecall" => removed successfully
HKLM\Software\Classes\CLSID\{828030A1-22C1-4009-854F-8E305202313F} => not found
"HKLM\Software\Classes\PROTOCOLS\Handler\msnim" => removed successfully
HKLM\Software\Classes\CLSID\{828030A1-22C1-4009-854F-8E305202313F} => not found
C:\Users\Dave\AppData\Local\Temp\npp.7.5.8.Installer.exe => moved successfully
C:\Users\Office Administrator\AppData\Local\Temp\npp.7.5.6.Installer.exe => moved successfully
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 1 (GFS Unread Stub)" => removed successfully
"HKLM\Software\Classes\CLSID\{99FD978C-D287-4F50-827F-B2C658EDA8E7}" => removed successfully
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2 (GFS Stub)" => removed successfully
"HKLM\Software\Classes\CLSID\{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}" => removed successfully
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" => removed successfully
"HKLM\Software\Classes\CLSID\{920E6DB1-9907-4370-B3A0-BAFC03D81399}" => removed successfully
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 3 (GFS Folder)" => removed successfully
"HKLM\Software\Classes\CLSID\{16F3DD56-1AF5-4347-846D-7C10C4192619}" => removed successfully
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 4 (GFS Unread Mark)" => removed successfully
"HKLM\Software\Classes\CLSID\{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}" => removed successfully
"HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive7" => removed successfully
HKLM\Software\Wow6432Node\Classes\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => not found
"HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 1 (GFS Unread Stub)" => removed successfully
"HKLM\Software\Wow6432Node\Classes\CLSID\{99FD978C-D287-4F50-827F-B2C658EDA8E7}" => removed successfully
"HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2 (GFS Stub)" => removed successfully
"HKLM\Software\Wow6432Node\Classes\CLSID\{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}" => removed successfully
"HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" => removed successfully
"HKLM\Software\Wow6432Node\Classes\CLSID\{920E6DB1-9907-4370-B3A0-BAFC03D81399}" => removed successfully
"HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 3 (GFS Folder)" => removed successfully
"HKLM\Software\Wow6432Node\Classes\CLSID\{16F3DD56-1AF5-4347-846D-7C10C4192619}" => removed successfully
"HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 4 (GFS Unread Mark)" => removed successfully
"HKLM\Software\Wow6432Node\Classes\CLSID\{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}" => removed successfully
"HKLM\Software\Classes\*\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX" => removed successfully
"HKLM\Software\Wow6432Node\Classes\CLSID\{6C467336-8281-4E60-8204-430CED96822D}" => removed successfully
"HKLM\Software\Classes\AllFileSystemObjects\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX" => removed successfully
"HKLM\Software\Classes\CLSID\{6C467336-8281-4E60-8204-430CED96822D}" => removed successfully
"HKLM\Software\Classes\Directory\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX" => removed successfully
HKLM\Software\Classes\CLSID\{6C467336-8281-4E60-8204-430CED96822D} => not found
"HKLM\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers\Gadgets" => removed successfully
HKLM\Software\Classes\CLSID\{6B9228DA-9C15-419e-856C-19E768A13BDC} => not found
"HKLM\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX" => removed successfully
HKLM\Software\Classes\CLSID\{6C467336-8281-4E60-8204-430CED96822D} => not found
"HKLM\Software\Classes\Folder\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX" => removed successfully
HKLM\Software\Wow6432Node\Classes\CLSID\{6C467336-8281-4E60-8204-430CED96822D} => not found
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{032B01CC-1874-43B4-A40E-0A34AE5B0219}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{032B01CC-1874-43B4-A40E-0A34AE5B0219}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{0CC3794B-E509-49AE-AF82-09F758E715B3}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0CC3794B-E509-49AE-AF82-09F758E715B3}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{0EBF683C-73C8-427B-888B-F5FEDFA0A8B8}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0EBF683C-73C8-427B-888B-F5FEDFA0A8B8}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UNP\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Unlock" => not found
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{14160C5A-0629-4486-AD42-B50AD57381FA}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{14160C5A-0629-4486-AD42-B50AD57381FA}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\launchtrayprocess" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{15CDA51F-2714-4EDB-A171-93B428EB5EAB}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{15CDA51F-2714-4EDB-A171-93B428EB5EAB}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UNP\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\OutOfIdle" => not found
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{225F401F-D757-4C63-9C5E-338A1BF1A40C}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{225F401F-D757-4C63-9C5E-338A1BF1A40C}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\rundetector" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{310AE0D2-A029-42FE-9CBF-BE9D3169809C}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{310AE0D2-A029-42FE-9CBF-BE9D3169809C}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{3311EDC2-3EB7-44C7-98E3-001274DB87E2}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3311EDC2-3EB7-44C7-98E3-001274DB87E2}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Logon-5d" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3D5FD92F-118C-45D9-B0B3-3723CAC9801B}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3D5FD92F-118C-45D9-B0B3-3723CAC9801B}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Time-Weekend" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{453D4E41-9E0A-450B-ABEE-1E59AE056970}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{453D4E41-9E0A-450B-ABEE-1E59AE056970}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4EA06D77-9D3C-4D8D-87AC-E943886E5F61}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4EA06D77-9D3C-4D8D-87AC-E943886E5F61}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UNP\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\OnIdle" => not found
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{72D3B183-DAE2-4C2A-B083-2F775CA56B84}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{72D3B183-DAE2-4C2A-B083-2F775CA56B84}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\OfficeSoftwareProtectionPlatform\SvcRestartTask" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{81CF05AE-D06C-4C08-9EC1-EF7705F329D2}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{81CF05AE-D06C-4C08-9EC1-EF7705F329D2}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UNP\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Logon" => not found
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{92371601-C4C9-4886-8F49-55A1B31041CA}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{92371601-C4C9-4886-8F49-55A1B31041CA}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfig" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A67499BF-E58D-4F6B-808F-5521BCB22C84}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A67499BF-E58D-4F6B-808F-5521BCB22C84}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B45BD574-7084-4DF1-82B3-CD8D60EDDB56}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B45BD574-7084-4DF1-82B3-CD8D60EDDB56}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Time-5d" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B575AFE0-AF73-4398-9D64-5D7A4249CF40}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B575AFE0-AF73-4398-9D64-5D7A4249CF40}" => removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\CCleanerSkipUAC => not found
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B7A8F376-2E78-4061-83AB-BD6CC226463C}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B7A8F376-2E78-4061-83AB-BD6CC226463C}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxcontent" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B887A7D3-7A91-488D-87DA-512ED75B31E7}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B887A7D3-7A91-488D-87DA-512ED75B31E7}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CC5E2665-C32E-472A-B456-DD8263A22363}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CC5E2665-C32E-472A-B456-DD8263A22363}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UNP\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Time" => not found
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{DB90AE6C-A7F3-4DCB-8F95-73AC04603218}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DB90AE6C-A7F3-4DCB-8F95-73AC04603218}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OnIdle-5d" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E63BAE5A-5EBA-47EA-A20E-B92FD497F1B2}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E63BAE5A-5EBA-47EA-A20E-B92FD497F1B2}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UNP\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\RunCampaignManager2" => not found
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E715D404-048F-428E-B4E3-3091D17C67DF}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E715D404-048F-428E-B4E3-3091D17C67DF}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F1B34399-703E-4852-B06A-F538BC5472CA}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F1B34399-703E-4852-B06A-F538BC5472CA}" => removed successfully
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UNP\RunCampaignManager => not found
C:\ProgramData\Temp => ":DED17083" ADS removed successfully

=========== EmptyTemp: ==========

BITS transfer queue => 9199616 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 2245638 B
Java, Flash, Steam htmlcache => 1650 B
Windows/system/drivers => 2013057 B
Edge => 9573 B
Chrome => 48077512 B
Firefox => 104223863 B
Opera => 22643417 B

Temp, IE cache, history, cookies, recent:
Default => 6656 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 7616 B
LocalService => 0 B
NetworkService => 175062 B
NetworkService => 0 B
Dave => 109713227 B
Hope => 82751493 B
Ben => 700139 B
Mary Jo => 439931 B
Office Administrator => 411743592 B
Share_with_Office => 174146 B
Rich => 135222 B
Administrator => 1313530 B
DefaultAppPool => 6656 B

RecycleBin => 695648941 B
EmptyTemp: => 1.4 GB temporary data Removed.

================================

The system needed a reboot.

==== End of Fixlog 23:49:42 ====
Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 01-09-2018 15:36:21)

C:\Program Files (x86)\mozilla firefox\defaults\pref\itms.js => Could not move

Result of scheduled keys to remove after reboot:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} => could not remove. Access Denied.
HKLM\Software\Classes\CLSID\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} => could not remove. Access Denied.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} => could not remove. Access Denied.
HKLM\Software\Classes\CLSID\{B4F3A835-0E21-4959-BA22-42B3008E02FF} => could not remove. Access Denied.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f} => could not remove. Access Denied.
HKLM\Software\Wow6432Node\Classes\CLSID\{d2ce3e00-f94a-4740-988e-03dc2f38c34f} => could not remove. Access Denied.
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive7 => could not remove. Access Denied.

==== End of Fixlog 15:36:21 ====

Quote:

PC seems to be running fine.

Good

Did you add items to remove from the fix I had created?

~~~~

http://i.imgur.com/G0tu5D9.pngEmsisoft Emergency Kit - Fix Mode
Follow the instructions below to run a scan using the Emsisoft Emergency Kit.

Download the Emsisoft Emergency Kit and execute it. From there, click on the Install button to extract the program in the EEK folder;
Once the extraction is complete, the EEK folder will open. Right-click on http://i.imgur.com/G0tu5D9.pngstart emergency kit scanner.exe and select http://i.imgur.com/Spcusrh.pngRun as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users);
EEK will suggest that you run an online update before using the program. Click on Yes to launch it.
After the update, click on Malware Scan under 2. Scan and accept to let EEK detect PUPs (click on Yes).
Once the scan is complete, make sure that every item in the list is checked, and click on the Quarantine selected button;
If it asks you for a reboot to delete some items, click on Ok to reboot automatically;
After the restart, open EEK again (in the C:\EEK folder);
This time, click on Logs;
From there, go under the Quarantine Log tab, and click on the Export button;
Save the log on your desktop, then open it, and copy/paste its content in your next reply;

Done

I am not sure what you meant. If you meant — did I copy your fix out of your post and run FRST with the fix option while that copy was in the clipboard — then yes.

Log pasted below:

Emsisoft Emergency Kit - Version 2018.6
Last update: 9/2/2018 11:00:33 AM
User account: 2012_Office\Office Administrator
Computer name: 2012_OFFICE
OS version: Windows 10x64

Scan settings:

Scan type: Malware Scan
Objects: Rootkits, Memory, Traces, Files

Detect PUPs: On
Scan archives: Off
Scan mail archives: Off
ADS Scan: On
File extension filter: Off
Direct disk access: Off

Scan start: 9/2/2018 11:00:54 AM

Scanned 284819
Found 0

Scan end: 9/2/2018 12:56:25 PM
Scan time: 1:55:31

Need K9 BlueCoat Advice

This PC is not new. It has been running for 6 years, and getting some fairly intense usage. It's going to get kludgy.

BUT, the point of having K9 BlueCoat installed was to limit/monitor young teenager porn viewing. That's not a problem anymore.

Given that it seems that K9 may be generating false positives, is it time to uninstall it?

If so, would I be good to go for general use with Windows Defender and Malwarebytes?

Quote:

Originally Posted by BooBounder

This PC is not new. It has been running for 6 years, and getting some fairly intense usage. It's going to get kludgy.
BUT, the point of having K9 BlueCoat installed was to limit/monitor young teenager porn viewing. That's not a problem anymore.
Given that it seems that K9 may be generating false positives, is it time to uninstall it?
If so, would I be good to go for general use with Windows Defender and Malwarebytes?

These are all good questions. The best answer I know of is to experiment around with the security (antivirus apps) to see what runs best on your machine.
I've seen in the past, security suites that can bog down a computer to a crawl where on other computers they seem to run very well.

I can supply you with a list of different security apps for you to read over then, if you make a decision to change you can switch over

Anti-Virus, Anti-Malware, Firewall and Anti-Exploit/Ransomware

Having a decent security setup (which also includes an Anti-Virus) is the most crucial step to protect a system. These programs are a layer of defence that will prevent a system from being infected, or if it somehow ends up infected, help mitigate the infection and remediate it. Ideally, you should have on your system one Antivirus (never more than one installed at the time), one Antimalware (you can install multiple of these, assuming they do not conflict with each other and the other security programs installed), one Firewall if you wish, one Anti-Exploit and/or Anti-Ransomware (since Ransomware are currently the most dangerous threat around and it can hit anywhere). Here are a few programs worth checking out if you don't have one yet.

Note: The programs listed below are all free to use or they have some sort of trial. Some of them have a paid version that provides more features, while a lot of other good programs only have a paid version but aren't listed there (such as Kaspersky and ESET Antivirus products).

Anti-Virus

https://i.imgur.com/sZQBUGE.png Sophos Home
https://i.imgur.com/GCZb0TR.png Bitdefender Free Antivirus
https://i.imgur.com/1lXc99W.png Emsisoft Anti-Malware - Free 30 day trial. Once it expires, EAM enters into a freeware mode where it is still considered an Antivirus program, but without real-time protection
https://i.imgur.com/szLrBjg.png Avira Free Antivirus
https://i.imgur.com/90ChiEw.png avast! Free Antivirus

Anti-Malware

Malwarebytes - Has both a free and paid version. The Premium version of Malwarebytes also offers Exploit and Ransomware protection, for a complete package of: Malware, Web, Exploit and Ransomware protection
HitmanPro 3 - Free 30 day trial
Zemana AntiMalware - Free 30 day trial

Firewall
Starting in Windows Vista, the Windows Firewall greatly improved and will satisfy the needs of most users. If you do not have an Internet Suite Antivirus program (which includes a firewall) and you want to use a 3rd party firewall, you can consider the options below.

GlassWire - Has both a free and paid version (with different packages)
https://i.imgur.com/MQIMh6k.png Windows Firewall Control - Gives you more control over your Windows Firewall
TinyWall - Lightweight firewall implementing the Windows Firewall and giving you more control over it

Anti-Exploit/Anti-Ransomware

https://i.imgur.com/zGy061p.png Malwarebytes Anti-Exploit Beta - In a perpetual beta state, and entirely free
https://i.imgur.com/S2NFpNw.png HitmanPro.Alert - Free 30 day trial
https://i.imgur.com/E8I37RF.png CryptoPrevent - Has both a free and paid version

the above information is created by Aura

Thanks

I see that you do not have Windows Defender on there.

Should I always be running this on Windows 10 as my default?

Or should I substitute one from each of the lists you gave (and not run Defender at all).

FWIW: I will explore uninstalling K9 and see if my false positives go away.

By design, starting I think back to Windows 7 \ 8. Windows Defender is a part of the operating system. It's there without you downloading it.
For Windows 10 it's an improved package to be used totally as onboard antivirus (Some like it, some don't)

Now, many decide to download and install other antivirus to use and it's there choice and manufacturers even supply trial antivirus when selling new computers and this is OK because, Windows Defender will disable to allow these other applications to run.
If you want to experiment with other antivirus thats fine or if you want to try and use Windows Defender thats fine too.

Thanks

OK. Done with this PC. Will start up a new thread with our third one in a couple of days.

Sounds OK, will close this one.