Page 1 of 3 123 LastLast
Results 1 to 10 of 30

Thread: Loud Computer, fan running all the time

  1. #1
    Senior Member gigglepot's Avatar
    Join Date
    Jun 2014
    Posts
    148

    Default Loud Computer, fan running all the time

    Hello, a few months back my computer was running really loud, all the time, no break or change in fan speed. Spybot helped me try everything to fix it and still no luck, except at the very end I was told to run my Windows Updates, turns out I had a ton of them, so I ran them all and the super loud fan stopped running, you can hardly hear my computer on! I was thrilled. Except it's happening again and this time my Windows Important Updates are all up to date, nothing to update. So I ran the following........SpyBot, MalwareBytes, AdwCleaner, SuperAntiSpyware and Spyware Blaster. Nothing helped. Please help. I don't know what to try next.

  2. #2
    Security Expert-emeritus Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    4,084

    Default

    • Please download Farbar Recovery Scan Tool (x32) or Farbar Recovery Scan Tool (x64) andsave the file to your Desktop.
    • Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.
    • Right-Click FRST.exe / FRST64.exe and select Run as administrator to run the programme.
    • Click Yes to the disclaimer.
    • Ensure the Addition.txt box is checked.
    • Click the Scan button and let the programme run.
    • Upon completion, click OK, then OK on the Addition.txt pop up screen.
    • Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply.
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  3. #3
    Senior Member gigglepot's Avatar
    Join Date
    Jun 2014
    Posts
    148

    Default

    Hi Juliet, thanks for helping me.

    Here is the FRST log:

    Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 17-09-2016
    Ran by Owner (administrator) on OWNER-HP (18-09-2016 06:33:41)
    Running from C:\Users\Owner\Desktop
    Loaded Profiles: Owner (Available Profiles: Owner)
    Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
    Internet Explorer Version 9 (Default browser: FF)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic...ery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (AMD) C:\Windows\System32\atiesrxx.exe
    (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    (AMD) C:\Windows\System32\atieclxx.exe
    (SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
    (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
    (Windows (R) Win 7 DDK provider) C:\Windows\System32\DbxSvc.exe
    (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
    (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler.exe
    (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler64.exe
    (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
    (Hewlett-Packard Company) C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe
    (LeapFrog Enterprises, Inc.) C:\Program Files (x86)\LeapFrog\LeapFrog Connect\CommandService.exe
    (Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
    (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
    (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
    (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
    (DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe
    (Guillemot Corporation) C:\Program Files (x86)\Thrustmaster\TARGET\TmService.exe
    (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
    (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
    (Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
    (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
    (Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
    (Pelmorex Media Inc.) C:\Users\Owner\AppData\Local\TheWeatherNetwork\WeatherEye\WeatherEye.exe
    (Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
    (Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
    (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
    (Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
    (Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
    (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    (Microsoft Corporation) C:\Windows\System32\dllhost.exe
    (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    (Microsoft Corporation) C:\Program Files (x86)\Windows Live\Mail\wlmail.exe
    (Microsoft Corporation) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
    (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe


    ==================== Registry (Whitelisted) ===========================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [hpsysdrv] => c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard)
    HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [9107616 2016-09-12] (AVAST Software)
    HKLM-x32\...\Run: [PDF Complete] => C:\Program Files (x86)\PDF Complete\pdfsty.exe
    HKLM-x32\...\Run: [StartCCC] => c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [102400 2010-05-11] (Advanced Micro Devices, Inc.)
    Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
    HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\Run: [WeatherEye] => C:\Users\Owner\AppData\Local\TheWeatherNetwork\WeatherEye\WeatherEye.exe [309104 2010-09-21] (Pelmorex Media Inc.)
    HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2857248 2016-08-23] (Valve Corporation)
    HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\MountPoints2: F - F:\DisneySplash.exe
    HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\MountPoints2: {2e587596-fbf0-11e5-ba25-6431503ceaa3} - F:\startme.exe
    HKU\S-1-5-18\...\RunOnce: [iCloud] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloud.exe [60688 2015-10-21] (Apple Inc.)
    ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-07-29] (Google)
    ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-07-29] (Google)
    ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-07-29] (Google)
    ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2016-08-29] (AVAST Software)
    BootExecute: autocheck autochk * sdnclean64.exe

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    Tcpip\Parameters: [DhcpNameServer] 64.59.135.148 64.59.128.114
    Tcpip\..\Interfaces\{853F1832-EF79-4946-9A19-0123FAFCABB6}: [DhcpNameServer] 64.59.135.148 64.59.128.114

    Internet Explorer:
    ==================
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://ca.yahoo.com?fr=hp-avast&type=avastbcl
    HKU\S-1-5-21-179166284-1700762968-3849658672-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxps://ca.yahoo.com?fr=hp-avast&type=avastbcl
    HKU\S-1-5-21-179166284-1700762968-3849658672-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://ca.msn.com/
    HKU\S-1-5-21-179166284-1700762968-3849658672-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://ca.yahoo.com?fr=hp-avast&type=avastbcl
    BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
    BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2016-08-29] (AVAST Software)
    BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
    BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
    BHO-x32: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll [2009-01-26] (Safer Networking Limited)
    BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
    BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\ssv.dll [2016-07-03] (Oracle Corporation)
    BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-08-29] (AVAST Software)
    BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
    BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
    BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\jp2ssv.dll [2016-07-03] (Oracle Corporation)
    DPF: HKLM-x32 {149E45D8-163E-4189-86FC-45022AB2B6C9} file:///C:/Program%20Files%20(x86)/Plants%20vs.%20Zombies/Images/stg_drm.ocx
    DPF: HKLM-x32 {BEA7310D-06C4-4339-A784-DC3804819809} hxxp://www.photolab.ca/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab
    DPF: HKLM-x32 {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///C:/Program%20Files%20(x86)/Plants%20vs.%20Zombies/Images/armhelper.ocx
    Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-07-27] (Citrix Systems, Inc.)
    Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-07-27] (Citrix Systems, Inc.)
    Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-07-27] (Citrix Systems, Inc.)
    Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-07-27] (Citrix Systems, Inc.)
    Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-07-27] (Citrix Systems, Inc.)
    Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-07-27] (Citrix Systems, Inc.)
    Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-07-27] (Citrix Systems, Inc.)
    Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-07-27] (Citrix Systems, Inc.)
    Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-07-27] (Citrix Systems, Inc.)
    Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-07-27] (Citrix Systems, Inc.)
    Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-07-27] (Citrix Systems, Inc.)
    Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-07-27] (Citrix Systems, Inc.)
    Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-07-27] (Citrix Systems, Inc.)
    Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-07-27] (Citrix Systems, Inc.)
    Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-07-27] (Citrix Systems, Inc.)
    Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-07-27] (Citrix Systems, Inc.)

    FireFox:
    ========
    FF ProfilePath: C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\oeo7drnr.default-1460249555612
    FF Homepage: hxxp://www.kijiji.ca/h-calgary/1700199
    FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_23_0_0_162.dll [2016-09-13] ()
    FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
    FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
    FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_23_0_0_162.dll [2016-09-13] ()
    FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-10-08] ()
    FF Plugin-x32: @Citrix.com/npican -> C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll [2012-07-27] (Citrix Systems, Inc.)
    FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2014-01-06] (Google, Inc.)
    FF Plugin-x32: @java.com/DTPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\dtplugin\npDeployJava1.dll [2016-07-03] (Oracle Corporation)
    FF Plugin-x32: @java.com/JavaPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\plugin2\npjp2.dll [2016-07-03] (Oracle Corporation)
    FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
    FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)
    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)
    FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
    FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
    FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
    FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-06-30] (Adobe Systems Inc.)
    FF Plugin HKU\S-1-5-21-179166284-1700762968-3849658672-1000: @nsroblox.roblox.com/launcher -> C:\Users\Owner\AppData\Local\Roblox\Versions\version-ea857a546aae4b0e\\NPRobloxProxy.dll [2013-01-01] ( ROBLOX Corporation)
    FF Plugin HKU\S-1-5-21-179166284-1700762968-3849658672-1000: @nsroblox.roblox.com/launcher64 -> C:\Users\Owner\AppData\Local\Roblox\Versions\version-ea857a546aae4b0e\\NPRobloxProxy64.dll [2013-01-01] ( ROBLOX Corporation)
    FF Plugin HKU\S-1-5-21-179166284-1700762968-3849658672-1000: sony.com/MediaGoDetector -> C:\Program Files (x86)\Sony\Media Go\npMediaGoDetector.dll [2015-11-20] (Sony Network Entertainment International LLC)
    FF Extension: (leethax.net extension) - C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\oeo7drnr.default-1460249555612\extensions\leethax@leethax.net.xpi [2016-05-11]
    FF Extension: (Bitdefender QuickScan) - C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\oeo7drnr.default-1460249555612\extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2016-06-27]
    FF Extension: (Greasemonkey) - C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\oeo7drnr.default-1460249555612\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2016-08-20]
    FF Extension: (New Tab Override (browser.newtab.url replacement)) - C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\oeo7drnr.default-1460249555612\Extensions\newtaboverride@agenedia.com.xpi [2016-06-29]
    FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
    FF Extension: (Avast Online Security) - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-08-29]
    FF HKLM\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
    FF Extension: (Avast SafePrice) - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2016-08-29]
    FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
    FF HKLM-x32\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF

    Chrome:
    =======
    CHR HomePage: Default -> hxxp://www.kijiji.ca/
    CHR StartupUrls: Default -> "hxxp://calgary.kijiji.ca/"
    CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\50.0.2661.87\PepperFlash\pepflashplayer.dll => No File
    CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\50.0.2661.87\ppGoogleNaClPluginChrome.dll => No File
    CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\50.0.2661.87\pdf.dll => No File
    CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll => No File
    CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
    CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
    CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
    CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
    CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
    CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll => No File
    CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll => No File
    CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
    CHR Plugin: (Citrix ICA Client) - C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll (Citrix Systems, Inc.)
    CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
    CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll => No File
    CHR Plugin: (Java(TM) Platform SE 7 U21) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll => No File
    CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll => No File
    CHR Plugin: (Windows Live? Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
    CHR Plugin: (Roblox Launcher Plugin) - C:\Users\Owner\AppData\Local\Roblox\Versions\version-1a23fdbca04d4954\\NPRobloxProxy.dll => No File
    CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll => No File
    CHR Profile: C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default [2016-08-11]
    CHR Extension: (Google Drive) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-04-14]
    CHR Extension: (Google Docs Offline) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-04-14]
    CHR Extension: (Avast Online Security) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2016-04-14]
    CHR Extension: (Chrome Web Store Payments) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-09]
    CHR HKU\S-1-5-21-179166284-1700762968-3849658672-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Owner\AppData\Local\Google\Drive\user_default\apdfllckaahabafndbhieahigkjlhalf_live.crx [2016-01-30]
    CHR HKU\S-1-5-21-179166284-1700762968-3849658672-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
    CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
    CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <not found>

    ==================== Services (Whitelisted) ========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-08-13] (SUPERAntiSpyware.com)
    R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-10-07] (Apple Inc.)
    R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [197128 2016-08-29] (AVAST Software)
    S3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.) [File not signed]
    R2 DbxSvc; C:\Windows\system32\DbxSvc.exe [42792 2016-09-12] (Windows (R) Win 7 DDK provider)
    R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89352 2014-09-15] (Hewlett-Packard Company)
    S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
    R2 LightScribeService; c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2010-11-22] (Hewlett-Packard Company) [File not signed]
    R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
    R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
    R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
    R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
    R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [754784 2016-01-08] (DEVGURU Co., LTD.)
    R2 TmWinService; C:\Program Files (x86)\Thrustmaster\TARGET\TmService.exe [304640 2011-03-04] (Guillemot Corporation) [File not signed]
    S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)
    S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [X]
    S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [X]
    S3 WsDrvInst; "C:\Program Files (x86)\Wondershare\Dr.Fone for Android\DriverInstall.exe" [X]

    ===================== Drivers (Whitelisted) ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    S3 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [37656 2016-08-29] (AVAST Software)
    R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [37144 2016-08-29] (AVAST Software)
    R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [108816 2016-08-29] (AVAST Software)
    R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [103064 2016-08-29] (AVAST Software)
    R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [74544 2016-08-29] (AVAST Software)
    R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [969184 2016-09-13] (AVAST Software)
    R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [513496 2016-08-29] (AVAST Software)
    R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [163416 2016-08-29] (AVAST Software)
    R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [292704 2016-08-29] (AVAST Software)
    S3 dg_ssudbus; C:\Windows\System32\DRIVERS\ssudbus.sys [130688 2016-07-22] (Samsung Electronics Co., Ltd.)
    S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
    S3 FlyUsb; C:\Windows\System32\DRIVERS\FlyUsb.sys [24576 2015-06-04] (LeapFrog)
    S3 ggsomc; C:\Windows\System32\DRIVERS\ggsomc.sys [30424 2016-09-10] (Sony Mobile Communications)
    S3 SaiH0464; C:\Windows\System32\DRIVERS\SaiH0464.sys [178432 2008-03-31] (Saitek)
    R3 SaiMini; C:\Windows\System32\DRIVERS\SaiMini.sys [25120 2013-04-30] (Saitek)
    R3 SaiNtBus; C:\Windows\System32\drivers\SaiBus.sys [52640 2013-04-30] (Saitek)
    R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
    R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
    S3 ssudmdm; C:\Windows\System32\DRIVERS\ssudmdm.sys [164992 2016-07-22] (Samsung Electronics Co., Ltd.)
    R3 TmBusEn; C:\Windows\System32\DRIVERS\TmBusEn.sys [30208 2011-01-26] (Guillemot Corporation)
    R3 TmBusEn; C:\Windows\SysWOW64\DRIVERS\TmBusEn.sys [30208 2011-01-26] (Guillemot Corporation)
    S3 TmFilter; C:\Windows\System32\DRIVERS\TmFilter.sys [24576 2011-01-26] (Guillemot Corporation)
    S3 TmFilter; C:\Windows\SysWOW64\DRIVERS\TmFilter.sys [24576 2011-01-26] (Guillemot Corporation)
    S3 TmHid; C:\Windows\System32\DRIVERS\TmHid.sys [24704 2011-01-26] (Guillemot Corporation)
    S3 TmHid; C:\Windows\SysWOW64\DRIVERS\TmHid.sys [24704 2011-01-26] (Guillemot Corporation)
    S3 dbx; system32\DRIVERS\dbx.sys [X]

    ==================== NetSvcs (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    ==================== One Month Created files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2016-09-18 06:33 - 2016-09-18 06:35 - 00026520 _____ C:\Users\Owner\Desktop\FRST.txt
    2016-09-18 06:33 - 2016-09-18 06:33 - 02399232 _____ (Farbar) C:\Users\Owner\Desktop\FRST64.exe
    2016-09-18 06:33 - 2016-09-18 06:33 - 00000000 ____D C:\FRST
    2016-09-17 19:19 - 2016-09-17 19:20 - 00000000 ____D C:\Users\Owner\AppData\Local\{44EBC9BE-50EB-456F-A420-DAF9668C2F71}
    2016-09-17 12:22 - 2016-09-17 12:24 - 00000000 ____D C:\AdwCleaner
    2016-09-17 12:21 - 2016-09-17 12:22 - 03861056 _____ C:\Users\Owner\Desktop\AdwCleaner.exe
    2016-09-17 07:19 - 2016-09-17 07:19 - 00000000 ____D C:\Users\Owner\AppData\Local\{3B5BBF45-B4A9-4E93-83CF-D76D0B374CEE}
    2016-09-16 10:49 - 2016-09-16 10:49 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_ggsomc_01009.Wdf
    2016-09-16 10:49 - 2016-09-16 10:49 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_ggflt_01009.Wdf
    2016-09-16 09:39 - 2016-09-16 09:40 - 00000000 ____D C:\Users\Owner\AppData\Local\{A44E8D0E-E8C6-4294-B2C6-B8163E95DF57}
    2016-09-15 21:39 - 2016-09-15 21:39 - 00000000 ____D C:\Users\Owner\AppData\Local\{6D0E66CC-288B-4FC8-9379-FF2B759CECC4}
    2016-09-15 20:10 - 2016-09-15 20:10 - 00001109 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
    2016-09-15 20:03 - 2016-09-15 20:09 - 44497776 _____ C:\Users\Owner\Desktop\Firefox Setup 46.0.1.exe
    2016-09-15 09:38 - 2016-09-15 09:39 - 00000000 ____D C:\Users\Owner\AppData\Local\{7740A674-CE9B-45D2-B4AD-6E3DFACC0F43}
    2016-09-14 21:38 - 2016-09-14 21:38 - 00000000 ____D C:\Users\Owner\AppData\Local\{3E5A5AE4-EC79-4EBB-A526-34E11C171248}
    2016-09-14 09:38 - 2016-09-14 09:38 - 00000000 ____D C:\Users\Owner\AppData\Local\{6C13D7C4-2646-4E1C-9BE5-9498A0C320ED}
    2016-09-13 21:37 - 2016-09-13 21:37 - 00000000 ____D C:\Users\Owner\AppData\Local\{19101583-86C2-4400-B515-86D04B87FC68}
    2016-09-13 09:37 - 2016-09-13 09:37 - 00000000 ____D C:\Users\Owner\AppData\Local\{2CC9B5A5-7100-49D6-9CDB-AE9CFFEA0D3B}
    2016-09-12 21:37 - 2016-09-12 21:37 - 00000000 ____D C:\Users\Owner\AppData\Local\{D0D28D77-92CD-4A4F-BCF2-F67D1CF15786}
    2016-09-12 09:36 - 2016-09-12 09:36 - 00000000 ____D C:\Users\Owner\AppData\Local\{4E31553C-510F-4E64-BAE6-51F9033F7E28}
    2016-09-12 07:11 - 2016-09-12 07:11 - 00042792 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\DbxSvc.exe
    2016-09-12 07:05 - 2016-09-12 07:05 - 00073840 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\dbx-stable.sys
    2016-09-12 07:05 - 2016-09-12 07:05 - 00073840 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\dbx-dev.sys
    2016-09-12 07:05 - 2016-09-12 07:05 - 00073840 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\dbx-canary.sys
    2016-09-11 21:36 - 2016-09-11 21:36 - 00000000 ____D C:\Users\Owner\AppData\Local\{2B2BE6D9-7FC0-4DBF-BA68-DEE4CE5994A5}
    2016-09-11 09:34 - 2016-09-11 09:34 - 00000000 ____D C:\Users\Owner\AppData\Local\{9C9276F2-651C-4DB9-9537-823704317027}
    2016-09-10 21:33 - 2016-09-10 21:33 - 00000000 ____D C:\Users\Owner\AppData\Local\{56339C22-97B4-4B9A-88EA-73795DD53D8A}
    2016-09-10 16:23 - 2016-09-10 16:23 - 00030424 _____ (Sony Mobile Communications) C:\Windows\system32\Drivers\ggsomc.sys
    2016-09-10 16:23 - 2016-09-10 16:23 - 00016088 _____ (Sony Mobile Communications) C:\Windows\system32\Drivers\ggflt.sys
    2016-09-10 16:21 - 2016-09-10 16:21 - 00000000 ____D C:\ProgramData\Sony Mobile
    2016-09-10 16:21 - 2016-09-10 16:21 - 00000000 ____D C:\Program Files (x86)\Sony Mobile
    2016-09-10 09:32 - 2016-09-10 09:33 - 00000000 ____D C:\Users\Owner\AppData\Local\{B3285994-9C48-47E2-A9AE-1BC9AA212BA4}
    2016-09-09 21:31 - 2016-09-09 21:32 - 00000000 ____D C:\Users\Owner\AppData\Local\{DE14F04F-CC81-410E-99AA-736E40953E1D}
    2016-09-09 09:30 - 2016-09-09 09:31 - 00000000 ____D C:\Users\Owner\AppData\Local\{69D22C83-FEA3-4E2C-B8CF-B9B23E9E219D}
    2016-09-08 21:29 - 2016-09-08 21:30 - 00000000 ____D C:\Users\Owner\AppData\Local\{A9D03064-40C5-4D07-A5F3-8F967D97D69D}
    2016-09-08 09:29 - 2016-09-08 09:29 - 00000000 ____D C:\Users\Owner\AppData\Local\{450913BA-3524-438A-B1CE-A81F0677704D}
    2016-09-07 21:28 - 2016-09-07 21:29 - 00000000 ____D C:\Users\Owner\AppData\Local\{BAFC6672-4E75-4294-AB9B-20E6B6C20F51}
    2016-09-07 09:28 - 2016-09-07 09:28 - 00000000 ____D C:\Users\Owner\AppData\Local\{3F1B9554-A1A3-484E-BEFA-D7E9FF06A55B}
    2016-09-06 21:28 - 2016-09-06 21:28 - 00000000 ____D C:\Users\Owner\AppData\Local\{7756E88A-474B-467B-AD08-561DAC6CE6BE}
    2016-09-06 09:53 - 2016-09-17 11:05 - 00002661 _____ C:\Users\Public\Desktop\Xperia Companion.lnk
    2016-09-06 09:27 - 2016-09-06 09:27 - 00000000 ____D C:\Users\Owner\AppData\Local\{96E6027E-D180-47C4-8A17-2E19E20F3509}
    2016-09-05 21:27 - 2016-09-05 21:27 - 00000000 ____D C:\Users\Owner\AppData\Local\{B7D8870A-3E85-472B-A940-E2679FD02BAE}
    2016-09-05 09:26 - 2016-09-05 09:27 - 00000000 ____D C:\Users\Owner\AppData\Local\{A4E9CFF9-2687-4394-A72B-55D72C1F90FF}
    2016-09-04 21:26 - 2016-09-04 21:26 - 00000000 ____D C:\Users\Owner\AppData\Local\{D9CFB0E8-78FB-4630-AF75-5245370F263F}
    2016-09-04 09:26 - 2016-09-04 09:26 - 00000000 ____D C:\Users\Owner\AppData\Local\{BD99D952-4E7F-451D-89D7-190CB323CAF8}
    2016-09-03 21:25 - 2016-09-03 21:25 - 00000000 ____D C:\Users\Owner\AppData\Local\{592B3716-50A8-4A06-B6D7-A9298B5E7A75}
    2016-09-03 09:25 - 2016-09-03 09:25 - 00000000 ____D C:\Users\Owner\AppData\Local\{A69F61A1-E7E0-44FB-A8FB-1894354A5C41}
    2016-09-02 21:25 - 2016-09-02 21:25 - 00000000 ____D C:\Users\Owner\AppData\Local\{34F408D0-F070-4CF2-BE03-7F3724468A64}
    2016-09-02 09:24 - 2016-09-02 09:24 - 00000000 ____D C:\Users\Owner\AppData\Local\{E21C2ABE-B10C-4E28-A065-60D93DB48DB5}
    2016-09-01 21:23 - 2016-09-01 21:23 - 00000000 ____D C:\Users\Owner\AppData\Local\{2AAB15C5-6C3A-44FF-A92E-324B0AF65061}
    2016-09-01 09:22 - 2016-09-01 09:23 - 00000000 ____D C:\Users\Owner\AppData\Local\{02C0208C-DC4A-4E64-9885-5F69DE8D4ACB}
    2016-08-31 21:22 - 2016-08-31 21:22 - 00000000 ____D C:\Users\Owner\AppData\Local\{393D2E20-7CA5-498C-AE5E-17124BA47E74}
    2016-08-31 09:22 - 2016-08-31 09:22 - 00000000 ____D C:\Users\Owner\AppData\Local\{15650557-DAB6-4106-AE26-96BF2C9B766F}
    2016-08-30 21:21 - 2016-08-30 21:21 - 00000000 ____D C:\Users\Owner\AppData\Local\{5FFC0A48-23A0-45AE-B1B7-959C8346A41C}
    2016-08-30 09:21 - 2016-08-30 09:21 - 00000000 ____D C:\Users\Owner\AppData\Local\{6CBEAB9D-4298-4C72-989E-138343196661}
    2016-08-30 07:08 - 2016-08-30 07:08 - 00003890 _____ C:\Windows\System32\Tasks\SafeZone scheduled Autoupdate 1465907730
    2016-08-29 21:20 - 2016-08-29 21:20 - 00000000 ____D C:\Users\Owner\AppData\Local\{BE8D6866-64A0-4475-8004-296292B2F672}
    2016-08-29 12:58 - 2016-08-29 12:58 - 00391496 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
    2016-08-29 12:58 - 2016-08-29 12:58 - 00053208 _____ (AVAST Software) C:\Windows\avastSS.scr
    2016-08-29 09:19 - 2016-08-29 09:19 - 00000000 ____D C:\Users\Owner\AppData\Local\{C7102ACF-66D4-44E1-B238-19E8EF520DAC}
    2016-08-28 21:18 - 2016-08-28 21:18 - 00000000 ____D C:\Users\Owner\AppData\Local\{E8714771-FC90-48FD-BDC2-894CD1DA07B4}
    2016-08-28 09:17 - 2016-08-28 09:17 - 00000000 ____D C:\Users\Owner\AppData\Local\{451D6863-3E29-468D-BFCF-A218468E96F3}
    2016-08-27 21:16 - 2016-08-27 21:16 - 00000000 ____D C:\Users\Owner\AppData\Local\{E2DA54C4-EE95-4292-B7B1-B5635FADFBBB}
    2016-08-27 09:15 - 2016-08-27 09:15 - 00000000 ____D C:\Users\Owner\AppData\Local\{D852B7B9-91A3-4166-A4A5-59E7071CECB4}
    2016-08-26 21:14 - 2016-08-26 21:14 - 00000000 ____D C:\Users\Owner\AppData\Local\{CD54E28A-EC0D-4F24-8246-D4771D3E6506}
    2016-08-26 09:13 - 2016-08-26 09:13 - 00000000 ____D C:\Users\Owner\AppData\Local\{FB8D576D-1C37-4E7C-BBD4-BB742F516DAD}
    2016-08-25 21:12 - 2016-08-25 21:12 - 00000000 ____D C:\Users\Owner\AppData\Local\{10DA4172-1302-45F1-8FF2-65802F4D9C96}
    2016-08-25 09:11 - 2016-08-25 09:11 - 00000000 ____D C:\Users\Owner\AppData\Local\{7AA7BF82-C882-4117-8410-E180934DC606}
    2016-08-24 21:10 - 2016-08-24 21:10 - 00000000 ____D C:\Users\Owner\AppData\Local\{ECB36ED5-32AC-4694-8F42-08E5370C9704}
    2016-08-24 09:09 - 2016-08-24 09:09 - 00000000 ____D C:\Users\Owner\AppData\Local\{D3EB4F18-7793-49F8-94A4-D946022DA016}
    2016-08-23 21:08 - 2016-08-23 21:08 - 00000000 ____D C:\Users\Owner\AppData\Local\{1A16FA20-D639-4593-9CC0-1EA244324396}
    2016-08-23 09:07 - 2016-08-23 09:08 - 00000000 ____D C:\Users\Owner\AppData\Local\{354A0E43-9AB4-476D-93AA-EBFB00D09A74}
    2016-08-22 21:06 - 2016-08-22 21:06 - 00000000 ____D C:\Users\Owner\AppData\Local\{ECF51D14-71D4-4A1F-B262-B03B4937B322}
    2016-08-22 09:06 - 2016-08-22 09:06 - 00000000 ____D C:\Users\Owner\AppData\Local\{6C0C9DB4-BC94-4776-82C0-D4C1CDF467EC}
    2016-08-21 21:05 - 2016-08-21 21:06 - 00000000 ____D C:\Users\Owner\AppData\Local\{29A5629C-FC94-40E3-A568-A3E6954EEE5A}
    2016-08-21 09:04 - 2016-08-21 09:04 - 00000000 ____D C:\Users\Owner\AppData\Local\{36BB4B10-9A7B-499D-9890-B03DC677B242}
    2016-08-21 07:14 - 2008-10-15 06:22 - 05631312 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_40.dll
    2016-08-21 07:14 - 2008-10-15 06:22 - 02605920 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_40.dll
    2016-08-21 07:14 - 2008-10-15 06:22 - 00519000 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_40.dll
    2016-08-20 22:12 - 2016-08-20 22:12 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Warner Bros. Interactive Entertainment
    2016-08-20 21:03 - 2016-08-20 21:04 - 00000000 ____D C:\Users\Owner\AppData\Local\{3C8F344C-507B-42FF-88C7-CC84DE6B78E0}
    2016-08-20 20:01 - 2016-08-20 20:01 - 00000222 _____ C:\Users\Owner\Desktop\LEGO Worlds.url
    2016-08-20 20:01 - 2016-08-20 20:01 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
    2016-08-20 19:59 - 2016-08-20 19:59 - 00000000 ____D C:\Users\Owner\AppData\Local\Steam
    2016-08-20 19:39 - 2016-09-18 06:20 - 00000000 ____D C:\Program Files (x86)\Steam
    2016-08-20 19:39 - 2016-08-20 19:39 - 01446792 _____ C:\Users\Owner\Desktop\SteamSetup.exe
    2016-08-20 19:39 - 2016-08-20 19:39 - 00000925 _____ C:\Users\Public\Desktop\Steam.lnk
    2016-08-20 19:39 - 2016-08-20 19:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
    2016-08-20 09:03 - 2016-08-20 09:03 - 00000000 ____D C:\Users\Owner\AppData\Local\{88232FE4-EFAF-4B36-9215-5C94E1553916}
    2016-08-19 21:02 - 2016-08-19 21:02 - 00000000 ____D C:\Users\Owner\AppData\Local\{CFC3688F-B90B-4320-BA98-FE15EC5A47AE}
    2016-08-19 09:02 - 2016-08-19 09:02 - 00000000 ____D C:\Users\Owner\AppData\Local\{D9486B45-BC14-4423-A0D5-A9C674E127E6}

    ==================== One Month Modified files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2016-09-18 06:29 - 2009-07-13 22:45 - 00018736 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2016-09-18 06:29 - 2009-07-13 22:45 - 00018736 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2016-09-18 06:22 - 2015-11-16 07:24 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
    2016-09-18 06:20 - 2011-05-12 13:16 - 00000000 ____D C:\Users\Owner\AppData\Local\VirtualStore
    2016-09-18 06:19 - 2014-09-08 11:32 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
    2016-09-18 06:19 - 2009-07-13 23:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
    2016-09-17 19:56 - 2014-09-08 11:32 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
    2016-09-17 12:52 - 2011-05-12 13:22 - 00003926 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{BF401F47-875B-4406-9B0C-8E70A5A1480F}
    2016-09-17 12:26 - 2014-06-17 14:33 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
    2016-09-17 12:22 - 2011-03-14 16:11 - 00000000 ____D C:\ProgramData\Temp
    2016-09-17 12:20 - 2014-06-17 14:03 - 00000000 ____D C:\Program Files (x86)\SpywareBlaster
    2016-09-17 12:17 - 2016-04-12 06:28 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
    2016-09-17 11:04 - 2011-06-04 16:13 - 00000000 ____D C:\Users\Owner\AppData\Local\CrashDumps
    2016-09-17 10:38 - 2015-05-22 11:42 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
    2016-09-17 09:31 - 2013-03-26 20:18 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Roblox
    2016-09-16 18:08 - 2011-05-15 17:36 - 00000000 ____D C:\Users\Owner\AppData\Roaming\HpUpdate
    2016-09-16 18:08 - 2011-05-15 17:36 - 00000000 ____D C:\Users\Owner\AppData\Roaming\HP Support Assistant
    2016-09-16 17:59 - 2014-09-08 11:38 - 00002157 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
    2016-09-16 15:38 - 2012-09-04 16:09 - 00000000 ____D C:\Users\Owner\AppData\Roaming\.minecraft
    2016-09-16 11:16 - 2011-05-22 07:01 - 00000000 ____D C:\Users\Owner\Documents\Lillian
    2016-09-16 10:44 - 2009-07-13 21:20 - 00000000 ____D C:\Windows\inf
    2016-09-16 09:30 - 2016-04-06 09:36 - 15516672 _____ C:\Users\Owner\AppData\Local\pcc.exe
    2016-09-15 20:13 - 2016-01-30 20:41 - 00000000 ____D C:\Program Files (x86)\Dropbox
    2016-09-15 20:13 - 2013-11-14 07:59 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
    2016-09-15 20:10 - 2013-11-14 07:59 - 00001121 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
    2016-09-15 20:04 - 2011-05-17 15:16 - 00000000 ____D C:\Users\Owner\AppData\Roaming\vlc
    2016-09-15 18:49 - 2016-01-29 19:48 - 00003186 _____ C:\Windows\System32\Tasks\HPCeeScheduleForOwner
    2016-09-15 18:49 - 2016-01-29 19:48 - 00000332 _____ C:\Windows\Tasks\HPCeeScheduleForOwner.job
    2016-09-15 16:59 - 2014-12-25 08:11 - 00004476 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
    2016-09-14 22:18 - 2016-06-30 19:49 - 17983233 ____H C:\Users\Owner\AppData\Local\IconCache.db.backup
    2016-09-13 10:22 - 2015-11-16 07:24 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
    2016-09-13 10:22 - 2012-07-11 07:42 - 00000000 ____D C:\Windows\system32\Macromed
    2016-09-13 10:22 - 2012-05-14 06:53 - 00796352 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
    2016-09-13 10:22 - 2011-08-06 07:47 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
    2016-09-13 10:22 - 2011-03-14 16:02 - 00000000 ____D C:\Windows\SysWOW64\Macromed
    2016-09-13 06:11 - 2011-05-15 23:54 - 00969184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
    2016-09-12 10:34 - 2011-05-12 13:07 - 00000000 ____D C:\Users\Owner
    2016-09-10 16:21 - 2016-06-29 10:48 - 00000000 ____D C:\Users\Owner\.oracle_jre_usage
    2016-09-06 20:29 - 2016-01-30 20:54 - 00000000 ___RD C:\Users\Owner\Dropbox
    2016-09-06 09:53 - 2016-04-06 10:02 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
    2016-09-06 09:53 - 2016-04-06 10:02 - 00000000 ____D C:\Program Files (x86)\Sony
    2016-09-06 09:53 - 2016-04-06 09:59 - 00000000 ____D C:\ProgramData\Package Cache
    2016-09-06 09:34 - 2009-07-13 23:13 - 00783464 _____ C:\Windows\system32\PerfStringBackup.INI
    2016-08-29 12:59 - 2015-04-24 06:19 - 00003922 _____ C:\Windows\System32\Tasks\avast! Emergency Update
    2016-08-29 12:58 - 2016-06-14 06:27 - 00037144 _____ (AVAST Software) C:\Windows\system32\Drivers\aswKbd.sys
    2016-08-29 12:58 - 2014-04-23 10:41 - 00037656 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
    2016-08-29 12:58 - 2013-12-23 07:00 - 00163416 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
    2016-08-29 12:58 - 2013-03-07 07:33 - 00292704 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
    2016-08-29 12:58 - 2013-03-07 07:33 - 00074544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
    2016-08-29 12:58 - 2012-02-24 07:44 - 00103064 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
    2016-08-29 12:58 - 2011-05-15 23:54 - 00513496 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
    2016-08-29 12:58 - 2011-05-15 23:54 - 00108816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
    2016-08-20 19:39 - 2011-05-16 16:00 - 00000000 ____D C:\Users\Owner\Documents\Vuze Downloads
    2016-08-20 19:39 - 2011-05-16 15:53 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Azureus
    2016-08-20 12:25 - 2011-06-13 06:25 - 00003218 _____ C:\Windows\System32\Tasks\HPCeeScheduleForOWNER-HP$
    2016-08-20 12:25 - 2011-06-13 06:25 - 00000342 _____ C:\Windows\Tasks\HPCeeScheduleForOWNER-HP$.job
    2016-08-19 15:30 - 2016-08-18 15:23 - 00000000 _____ C:\Windows\SysWOW64\last.dump
    2016-08-19 08:06 - 2016-01-30 20:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive

    ==================== Files in the root of some directories =======

    2011-06-24 14:38 - 2011-09-23 14:24 - 0001854 _____ () C:\Users\Owner\AppData\Roaming\GhostObjGAFix.xml
    2012-04-12 15:00 - 2014-06-06 10:41 - 0122368 _____ () C:\Users\Owner\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    2016-04-06 09:36 - 2016-09-16 09:30 - 15516672 _____ () C:\Users\Owner\AppData\Local\pcc.exe
    2013-01-07 10:09 - 2013-01-07 10:09 - 0002145 _____ () C:\Users\Owner\AppData\Local\recently-used.xbel
    2011-05-20 22:49 - 2011-05-20 22:49 - 0000017 _____ () C:\Users\Owner\AppData\Local\resmon.resmoncfg
    2011-05-16 06:54 - 2011-05-23 15:36 - 0000691 _____ () C:\ProgramData\hpzinstall.log

    ==================== Bamital & volsnap =================

    (There is no automatic fix for files that do not pass verification.)

    C:\Windows\system32\winlogon.exe => File is digitally signed
    C:\Windows\system32\wininit.exe => File is digitally signed
    C:\Windows\SysWOW64\wininit.exe => File is digitally signed
    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\SysWOW64\explorer.exe => File is digitally signed
    C:\Windows\system32\svchost.exe => File is digitally signed
    C:\Windows\SysWOW64\svchost.exe => File is digitally signed
    C:\Windows\system32\services.exe => File is digitally signed
    C:\Windows\system32\User32.dll => File is digitally signed
    C:\Windows\SysWOW64\User32.dll => File is digitally signed
    C:\Windows\system32\userinit.exe => File is digitally signed
    C:\Windows\SysWOW64\userinit.exe => File is digitally signed
    C:\Windows\system32\rpcss.dll => File is digitally signed
    C:\Windows\system32\dnsapi.dll => File is digitally signed
    C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
    C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


    LastRegBack: 2016-08-26 08:33

    ==================== End of FRST.txt ============================

    And here is the Addition.txt log:

    Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-09-2016
    Ran by Owner (18-09-2016 06:36:05)
    Running from C:\Users\Owner\Desktop
    Windows 7 Home Premium Service Pack 1 (X64) (2011-05-12 19:07:51)
    Boot Mode: Normal
    ==========================================================


    ==================== Accounts: =============================

    Administrator (S-1-5-21-179166284-1700762968-3849658672-500 - Administrator - Disabled)
    Guest (S-1-5-21-179166284-1700762968-3849658672-501 - Limited - Disabled)
    HomeGroupUser$ (S-1-5-21-179166284-1700762968-3849658672-1002 - Limited - Enabled)
    Owner (S-1-5-21-179166284-1700762968-3849658672-1000 - Administrator - Enabled) => C:\Users\Owner

    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: Avast Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
    AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
    AS: Avast Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

    ==================== Installed Programs ======================

    (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    µTorrent (HKLM-x32\...\uTorrent) (Version: 2.2.1 - )
    7-Zip 9.22 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0922-000001000000}) (Version: 9.22.00.0 - Igor Pavlov)
    Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.017.20053 - Adobe Systems Incorporated)
    Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.7.0.1530 - Adobe Systems Incorporated)
    Adobe Flash Player 23 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 23.0.0.162 - Adobe Systems Incorporated)
    Adobe Flash Player 23 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 23.0.0.162 - Adobe Systems Incorporated)
    Apple Application Support (32-bit) (HKLM-x32\...\{649A1FD9-5892-46AD-8DF0-C4A43FF61CB7}) (Version: 4.1 - Apple Inc.)
    Apple Application Support (64-bit) (HKLM\...\{0DE0A178-AC7B-4650-806C-CF226DE03766}) (Version: 4.1 - Apple Inc.)
    Apple Mobile Device Support (HKLM\...\{3540181E-340A-4E7A-B409-31663472B2F7}) (Version: 9.1.0.6 - Apple Inc.)
    Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)
    ATI Catalyst Install Manager (HKLM\...\{7C7A5A92-046C-A38C-AE0F-8F9CCA0F67A8}) (Version: 3.0.774.0 - ATI Technologies, Inc.)
    Avast Free Antivirus (HKLM-x32\...\avast) (Version: 12.3.2280 - AVAST Software)
    Avidemux 2.5 (HKLM-x32\...\Avidemux 2.5) (Version: 2.5.4.6714 - )
    Bing Rewards Client Installer (x32 Version: 16.0.345.0 - Microsoft Corporation) Hidden
    Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
    Brother MFL-Pro Suite MFC-J615W (HKLM-x32\...\{7FB6B1B7-075B-4B7F-BEB6-97584F73C7B5}) (Version: 1.0.4.0 - Brother Industries, Ltd.)
    CanoScan Toolbox Ver4.9 (HKLM-x32\...\{CA9BCD4D-B782-4637-8F1F-F9A328D3C244}) (Version: - )
    ccc-core-static (x32 Version: 2010.0511.2153.37435 - ATI) Hidden
    Citrix Receiver (HKLM-x32\...\CitrixOnlinePluginPackWeb) (Version: 13.3.0.55 - Citrix Systems, Inc.)
    Compaq Setup Manager (HKLM-x32\...\{AE856388-AFAD-4753-81DF-D96B19D0A17C}) (Version: 1.0.12844.3519 - Hewlett-Packard Company)
    Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
    CyberLink DVD Suite Deluxe (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 7.0.3210 - CyberLink Corp.)
    D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
    Dora Backpack (HKLM-x32\...\{D859D35F-E947-4F2A-8591-C76A4D116178}) (Version: - )
    Drome Racers (HKLM-x32\...\{EC1DCD6C-3AE0-42CE-8EAA-6886CC4400DC}) (Version: - )
    DVD Flick 1.3.0.7 (HKLM-x32\...\DVD Flick_is1) (Version: 1.3.0.7 - Dennis Meuwissen)
    FastStone Image Viewer 4.5 (HKLM-x32\...\FastStone Image Viewer) (Version: 4.5 - FastStone Soft)
    Five Nights at Freddy's DEMO (HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\Five Nights at Freddy's DEMO) (Version: - )
    Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Google Chrome (HKLM-x32\...\Google Chrome) (Version: 53.0.2785.116 - Google Inc.)
    Google Drive (HKLM-x32\...\{459CE109-4E46-4340-92BC-054642BC3BC2}) (Version: 1.31.2873.2758 - Google, Inc.)
    Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
    Google Update Helper (x32 Version: 1.3.31.5 - Google Inc.) Hidden
    Google+ Auto Backup (HKLM-x32\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google)
    Hewlett-Packard ACLM.NET v1.1.1.0 (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
    HP Odometer (HKLM-x32\...\{B8AC1A89-FFD1-4F97-8051-E505A160F562}) (Version: 2.10.0000 - Hewlett-Packard)
    HP Setup (HKLM-x32\...\{53469506-A37E-4314-A9D9-38724EC23A75}) (Version: 8.4.4400.3525 - Hewlett-Packard Company)
    HP Support Assistant (HKLM-x32\...\{CA43FE4F-9FF2-4AD7-88F0-CC3BAC17B226}) (Version: 6.0.5.4 - Hewlett-Packard Company)
    HP Support Information (HKLM-x32\...\{7F2A11F4-EAE8-4325-83EC-E3E99F85169E}) (Version: 10.1.1000 - Hewlett-Packard)
    HP Support Solutions Framework (HKLM-x32\...\{44157EB3-D8D0-4BB1-B0F5-AD2C38814ED1}) (Version: 11.51.0027 - Hewlett-Packard Company)
    HP Update (HKLM-x32\...\{DE77FE3F-A33D-499A-87AD-5FC406617B40}) (Version: 5.002.003.003 - Hewlett-Packard)
    HP Vision Hardware Diagnostics (HKLM\...\{D79A02E9-6713-4335-9668-AAC7474C0C0E}) (Version: 2.1.6.0 - Hewlett-Packard)
    iCloud (HKLM\...\{B33C558F-772F-4308-A059-390FBF9BAAAE}) (Version: 5.0.2.61 - Apple Inc.)
    iTunes (HKLM\...\{E690A491-702F-4DEC-9977-C015D1DBB57C}) (Version: 12.3.1.23 - Apple Inc.)
    Java 8 Update 91 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218091F0}) (Version: 8.0.910.15 - Oracle Corporation)
    Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    KMSpico v9.2.2 RC (HKLM\...\KMSpico_is1) (Version: 9.2.2 RC - )
    LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.3130 - CyberLink Corp.)
    LabelPrint (x32 Version: 2.5.3130 - CyberLink Corp.) Hidden
    LeapFrog Connect (HKLM-x32\...\UPCShell) (Version: 7.0.7.20035 - LeapFrog)
    LeapFrog Connect (x32 Version: 7.0.7.20035 - LeapFrog) Hidden
    LeapFrog Tag Plugin (x32 Version: 7.0.6.19846 - LeapFrog) Hidden
    LEGO Star Wars (HKLM-x32\...\InstallShield_{E914A24F-2412-4374-B420-86D21D6D444A}) (Version: 1.00.0000 - Giant)
    LEGO Star Wars (x32 Version: 1.00.0000 - Giant) Hidden
    LEGO Star Wars II (HKLM-x32\...\InstallShield_{578FA426-47C0-4A3F-98A4-01ACD26B7556}) (Version: 1.00.0000 - LucasArts)
    LEGO Star Wars II (x32 Version: 1.00.0000 - LucasArts) Hidden
    LEGO® Batman™ (HKLM-x32\...\InstallShield_{398AB469-77FC-4935-820B-D419388C0A6A}) (Version: 1.00.0000 - Warner Bros. Interactive Entertainment)
    LEGO® Batman™ (x32 Version: 1.00.0000 - Warner Bros. Interactive Entertainment) Hidden
    LEGO® Indiana Jones™ 2 (x32 Version: 1.00.0000 - LucasArts) Hidden
    LEGO® Indiana Jones™ 2: The Adventure Continues (HKLM-x32\...\InstallShield_{11192AA7-FBE3-4150-9667-EE7279CCC769}) (Version: 1.00.0000 - LucasArts)
    LEGO® Star Wars™ III: The Clone Wars™ (HKLM-x32\...\{6C0A6B81-0D00-453F-B220-E1F7931B3C2A}) (Version: 1.0.0.0 - LucasArts)
    LEGO® Worlds (HKLM\...\Steam App 332310) (Version: - TT Games)
    LightScribe System Software (HKLM-x32\...\{FD7F0DB8-0E96-4D64-AD4D-9B5A936AF2A8}) (Version: 1.18.20.1 - LightScribe)
    Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
    Media Go (HKLM-x32\...\{65256C0D-3FE7-4D2E-BB3E-53F1175481C8}) (Version: 3.0.403 - Sony)
    Media Go Network Downloader (HKLM-x32\...\{C52148B9-19E0-433A-9422-3451B1BEE20F}) (Version: 1.6.01.0 - Sony)
    Media Go Video Playback Engine 2.20.101.05210 (HKLM-x32\...\{78D0E870-B5F7-8AE8-35DC-18060AAD9C7A}) (Version: 2.20.101.05210 - Sony)
    Microsoft .NET Framework 4.6.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.6.01055 - Microsoft Corporation)
    Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
    Microsoft Office Click-to-Run 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
    Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
    Microsoft Office Starter 2010 - English (HKLM-x32\...\{90140011-0066-0409-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
    Microsoft Office XP Professional with FrontPage (HKLM-x32\...\{90280409-6000-11D3-8CFE-0050048383C9}) (Version: 10.0.6626.0 - Microsoft Corporation)
    Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
    Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
    Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
    Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
    Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23026 (HKLM-x32\...\{74d0e5db-b326-4dae-a6b2-445b9de1836e}) (Version: 14.0.23026.0 - Microsoft Corporation)
    Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
    Minecraft (HKLM-x32\...\{02BAAFC5-4E16-42E6-A9F6-8DDE0B7ED3B8}) (Version: 1.0.0.0 - Mojang)
    Mozilla Firefox 46.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 46.0.1 (x86 en-US)) (Version: 46.0.1 - Mozilla)
    Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 46.0.1 - Mozilla)
    MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
    MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
    NHL® 09 (HKLM-x32\...\{F2B5A2A7-2DF9-4361-8BD5-362714528B51}) (Version: 2.0.1.0 - Electronic Arts)
    Online Plug-in (x32 Version: 13.3.0.55 - Citrix Systems, Inc.) Hidden
    Paint.NET v3.5.10 (HKLM\...\{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}) (Version: 3.60.0 - dotPDN LLC)
    PaperPort Image Printer 64-bit (HKLM\...\{ABA4FAF1-6389-45F9-92CE-3914A4E5C471}) (Version: 1.00.0000 - Nuance Communications, Inc.)
    Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
    PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
    PlayReady PC Runtime x86 (HKLM-x32\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)
    Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.4329 - CyberLink Corp.)
    Power2Go (x32 Version: 6.1.4329 - CyberLink Corp.) Hidden
    PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 8.0.3129 - CyberLink Corp.)
    PowerDirector (x32 Version: 8.0.3129 - CyberLink Corp.) Hidden
    Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6196 - Realtek Semiconductor Corp.)
    Recovery Manager (x32 Version: 5.5.3219 - CyberLink Corp.) Hidden
    ROBLOX Player for Owner (HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\{373B1718-8CC5-4567-8EE2-9033AD08A680}) (Version: - ROBLOX Corporation)
    ROBLOX Studio for Owner (HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\{2922D6F1-2865-4EFA-97A9-94EEAB3AFA14}) (Version: - ROBLOX Corporation)
    SafeZone Stable 1.51.2220.53 (x32 Version: 1.51.2220.53 - Avast Software) Hidden
    Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.5.2.13021_10 - Samsung Electronics Co., Ltd.)
    Samsung Kies (x32 Version: 2.5.2.13021_10 - Samsung Electronics Co., Ltd.) Hidden
    Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.15072.2 - Samsung Electronics Co., Ltd.)
    Samsung Kies3 (x32 Version: 3.2.15072.2 - Samsung Electronics Co., Ltd.) Hidden
    Samsung Story Album Viewer (HKLM-x32\...\InstallShield_{698BBAD8-B116-495D-B879-0F07A533E57F}) (Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.)
    Samsung Story Album Viewer (x32 Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.) Hidden
    Samsung USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.59.0 - Samsung Electronics Co., Ltd.)
    ScanSoft PaperPort 11 (HKLM-x32\...\{02570AE0-BEE0-4A6C-BE3F-D806E9F2EA17}) (Version: 11.2.0000 - Nuance Communications, Inc.)
    Self-service Plug-in (x32 Version: 3.3.0.27839 - Citrix Systems, Inc.) Hidden
    Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
    Shareaza (x32 Version: 8.0.0.123534 - Discordia, LTD) Hidden
    Smart Technology Programming Software 7.0.27.13 (HKLM\...\{BD90BC1C-115D-47E1-B85C-07AE182C3AB8}) (Version: 7.0.27.13 - Mad Catz)
    Sony Mobile Update Engine (HKLM-x32\...\Update Engine) (Version: 2.16.12.201608221014 - Sony Mobile Communications Inc.)
    SoulSeek 157 NS 13e (HKLM-x32\...\Soulseek2) (Version: - )
    Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)
    Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
    SpywareBlaster 5.0 (HKLM-x32\...\SpywareBlaster_is1) (Version: 5.0.0 - BrightFort LLC)
    Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
    StudioTax 2011 (HKLM\...\{85FD0263-98BB-4B0E-990C-A31094DE8DDE}) (Version: 7.0.4.0 - BHOK IT Consulting)
    StudioTax 2012 (HKLM-x32\...\{FD31CD68-1D2F-4F9C-8ACB-9A7806D53D3B}) (Version: 8.0.5.2 - BHOK IT Consulting)
    StudioTax 2013 (HKLM-x32\...\{3F525B18-4DA5-447A-97E5-8F00EA9DF4B1}) (Version: 9.1.8.2 - BHOK IT Consulting)
    StudioTax 2014 (HKLM-x32\...\{F4A42DCD-CE34-4D3F-B328-BDC81CF50737}) (Version: 10.0.7.0 - BHOK IT Consulting)
    StudioTax 2015 (HKLM-x32\...\{D4ED4657-36AF-443C-8274-AEA66D8A6317}) (Version: 11.0.8.6 - BHOK IT Consulting)
    SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 5.7.1026 - SUPERAntiSpyware.com)
    System Scheduler 4.23 (HKLM-x32\...\Windows Scheduler_is1) (Version: - Splinterware Software Solutions)
    Thrustmaster TARGET (HKLM-x32\...\{8036A569-CA02-4D33-A7E9-E9BC8A482E91}) (Version: 2.0.10.0 - Thrustmaster)
    Toy Story 3 (HKLM-x32\...\{AAFD160A-2333-40D8-AA25-42D1989CA0F2}) (Version: 1.00.0000 - Disney Interactive Studios)
    Tweaking.com - Registry Backup (HKLM-x32\...\Tweaking.com - Registry Backup) (Version: 3.4.1 - Tweaking.com)
    Use the entry named LeapFrog Connect to uninstall (LeapFrog Tag Plugin) (HKLM-x32\...\TagPlugin) (Version: 7.0.6.19846 - LeapFrog)
    VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.1 - VideoLAN)
    Vuze (HKLM-x32\...\8461-7759-5462-8226) (Version: 5.6.2.0 - Azureus Software, Inc.)
    War Thunder CDK 0.1 (HKLM-x32\...\{ed8deea4-29fe-1932-9612-e2122d8a62d9}}_is1) (Version: - Gaijin Entertainment)
    War Thunder Launcher 1.0.1.278 (HKLM-x32\...\{ed8deea4-29fa-3932-9612-e2122d8a62d9}}_is1) (Version: - 2013 Gaijin Entertainment Corporation)
    War Thunder Launcher 1.0.1.340 (HKLM-x32\...\{abc8eea4-29fa-3932-9612-e2122d8a62d9}}_is1) (Version: - Gaijin Entertainment)
    WeatherEye (HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\WeatherEye) (Version: - )
    Windows Driver Package - LeapFrog (FlyUsb) USB (11/05/2008 1.1.1.0) (HKLM\...\781745E87AFF80C0C1388CFF79D19ECAB2E9BB47) (Version: 11/05/2008 1.1.1.0 - LeapFrog)
    Windows Driver Package - Leapfrog (Leapfrog-USBLAN) Net (09/10/2009 02.03.05.012) (HKLM\...\8F14F2ECEDE68D26EA515B48DC25B39103C4FE8D) (Version: 09/10/2009 02.03.05.012 - Leapfrog)
    Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
    WinRAR 5.11 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH)
    WinRAR 5.11 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH)
    Xperia Companion (HKLM-x32\...\{8f4f39fa-087f-4e5c-84f3-1433ac7389e9}) (Version: 1.2.8.0 - Sony)
    Xperia Companion (x32 Version: 1.2.8.0 - Sony) Hidden
    yuPlay client 0.7.50 (HKLM-x32\...\yuPlay клиент_is1) (Version: - )

    ==================== Custom CLSID (Whitelisted): ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    ==================== Scheduled Tasks (Whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    Task: {037E3E9F-FF34-40FB-BFD2-25CC5B2EFA9C} - System32\Tasks\SafeZone scheduled Autoupdate 1465907730 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2016-08-09] (Avast Software)
    Task: {0FE7318E-4885-42C4-93E3-FB734E63E4E0} - System32\Tasks\HPCeeScheduleForOWNER-HP$ => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13] (Hewlett-Packard)
    Task: {11D2342F-839E-48E3-9AD7-A5763372DFCE} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2014-06-24] (Safer-Networking Ltd.)
    Task: {1229D5C6-2C31-45A5-A77F-872758277322} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
    Task: {16E260E2-3C55-4817-B513-96F247AF4450} - System32\Tasks\{DC3699EB-8B75-4644-AAEF-06F2728982ED} => pcalua.exe -a "C:\Users\Owner\Documents\Lillian\Nick's Stuff\Saitek_Cyborg_Evo_SD6_32.exe" -d "C:\Users\Owner\Documents\Lillian\Nick's Stuff"
    Task: {1C0D8719-CA60-4A76-A976-EC85FC47EAC5} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
    Task: {2EF2F4D7-6FAB-489C-BB4D-D22154387F11} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-09-13] (Adobe Systems Incorporated)
    Task: {3D812D1B-A978-4A78-BF49-361B915FC140} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2016-06-03] (AVAST Software)
    Task: {5518C77C-1BE8-4B27-975B-F7C8675C0729} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2014-06-24] (Safer-Networking Ltd.)
    Task: {64BF764D-B178-4D83-9A47-9CC348E19F17} - System32\Tasks\HPCeeScheduleForOwner => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13] (Hewlett-Packard)
    Task: {8922745A-B80F-4AD0-A5A3-71E78518093B} - System32\Tasks\{7F85E32C-7D35-4958-B03F-BBAEF0CBC775} => pcalua.exe -a "C:\Users\Owner\Documents\Lillian\Nick's Stuff\Saitek_Cyborg_Evo_SD6_64.exe" -d "C:\Users\Owner\Documents\Lillian\Nick's Stuff"
    Task: {8A2B4C85-7287-4463-9AE1-B5439A79026F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-06-21] (Hewlett-Packard Company)
    Task: {9C9157B1-4249-47A0-BCE7-7E76C8CE1510} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPSFMessenger\HPSFMsgr.exe [2011-06-21] (Hewlett-Packard Company)
    Task: {A2046887-4841-44D4-8FE6-9E6E7CCE795A} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater\HPSFUpdater.exe [2011-06-14] (Hewlett-Packard)
    Task: {A449C73B-4565-4F8F-943C-0C5CFEFBC971} - System32\Tasks\{787706EA-A8A6-446E-BDFD-AC04640298DC} => pcalua.exe -a "C:\Program Files (x86)\Registry Helper\uninst.exe"
    Task: {B819D107-2890-46A6-923E-872F90D94F20} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-08-27] (Apple Inc.)
    Task: {BCCAF77B-676F-4503-9124-452B84F74C89} - System32\Tasks\{8C85E8B1-A460-4EED-8DAC-C757387E1D2D} => pcalua.exe -a E:\SETUP.EXE -d E:\ -c -AutoRun
    Task: {C258BB7D-E898-4D19-9E91-E318E67FBCD0} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-28] (Google Inc.)
    Task: {CC86B01E-CE0A-4E21-A91A-759BB6BA026B} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-06-21] (Hewlett-Packard Company)
    Task: {F1FF4C19-ED0D-4035-B119-4E2F39823BB4} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-09-08] (Adobe Systems Incorporated)
    Task: {F6762DFA-B52E-47A6-A4A7-4E4C8E8B540E} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2016-08-29] (AVAST Software)
    Task: {FC0A2883-58B4-4B24-8468-2652A26F0B2E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Total Care Tune-Up => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPTuneUp.exe [2011-03-22] (Hewlett-Packard Company)

    (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

    Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: C:\Windows\Tasks\HPCeeScheduleForOWNER-HP$.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
    Task: C:\Windows\Tasks\HPCeeScheduleForOwner.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

    ==================== Shortcuts =============================

    (The entries could be listed to be restored or removed.)

    Shortcut: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Network Shortcuts\My Web Sites on MSN\target.lnk -> hxxp://www.msnusers.com

    ==================== Loaded Modules (Whitelisted) ==============

    2015-02-13 04:20 - 2015-02-13 04:20 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
    2015-10-13 05:45 - 2015-10-13 05:45 - 01328912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
    2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
    2010-10-20 15:23 - 2010-10-20 15:23 - 08801632 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
    2009-06-08 17:45 - 2009-06-08 17:45 - 00098304 ____R () c:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
    2011-03-14 16:10 - 2011-03-14 16:10 - 00270336 _____ () C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
    2016-08-29 12:58 - 2016-08-29 12:58 - 00169064 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
    2016-09-18 06:20 - 2016-09-18 06:20 - 03086136 _____ () C:\Program Files\AVAST Software\Avast\defs\16091800\algo.dll
    2016-08-29 12:58 - 2016-08-29 12:58 - 00482928 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
    2015-05-14 13:02 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
    2015-05-14 13:02 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
    2015-05-14 13:02 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
    2015-05-14 13:02 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
    2015-05-14 13:02 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
    2016-08-20 19:58 - 2016-08-08 17:27 - 00785920 _____ () C:\Program Files (x86)\Steam\SDL2.dll
    2016-08-20 19:58 - 2015-07-01 16:06 - 04962816 _____ () C:\Program Files (x86)\Steam\v8.dll
    2016-08-20 19:58 - 2015-07-01 16:06 - 01556992 _____ () C:\Program Files (x86)\Steam\icui18n.dll
    2016-08-20 19:58 - 2015-07-01 16:06 - 01187840 _____ () C:\Program Files (x86)\Steam\icuuc.dll
    2016-08-20 19:58 - 2016-08-23 13:33 - 02321184 _____ () C:\Program Files (x86)\Steam\video.dll
    2016-08-20 19:58 - 2016-01-27 01:49 - 02549760 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll
    2016-08-20 19:58 - 2016-01-27 01:49 - 00442880 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll
    2016-08-20 19:58 - 2016-01-27 01:49 - 00491008 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll
    2016-08-20 19:58 - 2016-01-27 01:49 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll
    2016-08-20 19:58 - 2016-01-27 01:49 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll
    2016-08-20 19:58 - 2016-08-23 13:33 - 00835360 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
    2016-08-20 19:58 - 2016-07-04 16:17 - 00266560 _____ () C:\Program Files (x86)\Steam\openvr_api.dll
    2016-06-29 16:11 - 2016-06-29 16:11 - 48936448 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
    2016-08-20 19:58 - 2016-08-04 14:56 - 49825056 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll
    2016-09-13 10:22 - 2016-09-13 10:22 - 19588800 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_23_0_0_162.dll

    ==================== Alternate Data Streams (Whitelisted) =========

    (If an entry is included in the fixlist, only the ADS will be removed.)

    AlternateDataStreams: C:\ProgramData\Temp:5C321E34 [119]
    AlternateDataStreams: C:\Users\Owner\Downloads:Shareaza.GUID [16]

    ==================== Safe Mode (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


    ==================== Association (Whitelisted) ===============

    (If an entry is included in the fixlist, the registry item will be restored to default or removed.)


    ==================== Internet Explorer trusted/restricted ===============

    (If an entry is included in the fixlist, it will be removed from the registry.)

    IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\008i.com -> 008i.com
    IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\008k.com -> 008k.com
    IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\00hq.com -> 00hq.com
    IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\0190-dialers.com -> 0190-dialers.com
    IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\01i.info -> 01i.info
    IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com
    IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\0411dd.com -> 0411dd.com
    IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\0511zfhl.com -> 0511zfhl.com
    IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\05p.com -> 05p.com
    IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\0632qyw.com -> 0632qyw.com
    IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com
    IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com
    IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com
    IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\0calories.net -> 0calories.net
    IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\0cj.net -> 0cj.net
    IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\0scan.com -> 0scan.com
    IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\1-britney-spears-nude.com -> 1-britney-spears-nude.com
    IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\1-domains-registrations.com -> 1-domains-registrations.com
    IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\1-se.com -> 1-se.com
    IE restricted site: HKU\S-1-5-21-179166284-1700762968-3849658672-1000\...\1001movie.com -> 1001movie.com

    There are 6091 more sites.


    ==================== Hosts content: ===============================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2009-07-13 20:34 - 2016-06-30 19:45 - 00000035 ____A C:\Windows\system32\Drivers\etc\hosts


    ==================== Other Areas ============================

    (Currently there is no automatic fix for this section.)

    HKU\S-1-5-21-179166284-1700762968-3849658672-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
    DNS Servers: 64.59.135.148 - 64.59.128.114
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
    Windows Firewall is enabled.

    ==================== MSCONFIG/TASK MANAGER disabled items ==

    (Currently there is no automatic fix for this section.)

    MSCONFIG\startupreg: Akamai NetSession Interface => "C:\Users\Owner\AppData\Local\Akamai\netsession_win.exe"
    MSCONFIG\startupreg: ApplePhotoStreams => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
    MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
    MSCONFIG\startupreg: BrStsMon00 => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe /AUTORUN
    MSCONFIG\startupreg: CitrixReceiver => "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citrix\Receiver Updater.lnk"
    MSCONFIG\startupreg: ConnectionCenter => "C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" /startup
    MSCONFIG\startupreg: ControlCenter3 => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe /autorun
    MSCONFIG\startupreg: Dropbox => "C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" /systemstartup
    MSCONFIG\startupreg: GoogleDriveSync => "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart
    MSCONFIG\startupreg: iCloudDrive => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe
    MSCONFIG\startupreg: iCloudServices => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
    MSCONFIG\startupreg: IndexSearch => "C:\Program Files (x86)\ScanSoft\PaperPort\IndexSearch.exe"
    MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"
    MSCONFIG\startupreg: KiesPDLR.exe => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe Run
    MSCONFIG\startupreg: KiesPreload => C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload
    MSCONFIG\startupreg: KiesTrayAgent => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
    MSCONFIG\startupreg: Monitor => "C:\Program Files (x86)\LeapFrog\LeapFrog Connect\Monitor.exe"
    MSCONFIG\startupreg: Norton Online Backup => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
    MSCONFIG\startupreg: PaperPort PTD => "C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe"
    MSCONFIG\startupreg: PPort11reminder => "C:\Program Files (x86)\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini"
    MSCONFIG\startupreg: ProfilerU => C:\Program Files\SmartTechnology\Software\ProfilerU.exe
    MSCONFIG\startupreg: SaiMfd => C:\Program Files\SmartTechnology\Software\SaiMfd.exe
    MSCONFIG\startupreg: SDTray => "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
    MSCONFIG\startupreg: SpybotSD TeaTimer => C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
    MSCONFIG\startupreg: SSBkgdUpdate => "C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
    MSCONFIG\startupreg: SUPERAntiSpyware => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    MSCONFIG\startupreg: XperiaCompanionAgent => "C:\Program Files (x86)\Sony\Xperia Companion\XperiaCompanionAgent.exe"

    ==================== FirewallRules (Whitelisted) ===============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    FirewallRules: [{16467055-0A06-4B08-B61F-9DE42788DAD8}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDirector\PDR8.EXE
    FirewallRules: [{2EBA5488-FA5F-4FFE-9810-A60F1B44FD7D}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
    FirewallRules: [{FCF8FCE5-E6D2-4F9F-B47E-1532B3F3FFB9}] => (Allow) LPort=2869
    FirewallRules: [{24263477-6EF3-402F-AE43-F9CD8CB45D85}] => (Allow) LPort=1900
    FirewallRules: [{B9C9DF76-EF62-47DF-8DFB-5A6DE0DE80ED}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
    FirewallRules: [{13EB4188-C29B-40D3-8F11-46D708CB7236}] => (Allow) C:\Program Files (x86)\uTorrent\uTorrent.exe
    FirewallRules: [{E7146E26-B002-435D-8D24-195587E8ED9F}] => (Allow) C:\Program Files (x86)\uTorrent\uTorrent.exe
    FirewallRules: [TCP Query User{01EDB30A-24ED-4B0E-800E-7055527A3B20}C:\program files (x86)\java\jre6\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre6\bin\javaw.exe
    FirewallRules: [UDP Query User{EFC2BCB0-E996-4868-9EFE-3254FCD32F5C}C:\program files (x86)\java\jre6\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre6\bin\javaw.exe
    FirewallRules: [{11C8BEDA-8ABC-4F90-AE1A-511AE0F55291}] => (Allow) C:\Program Files (x86)\WinMX Music\WinMX Music.exe
    FirewallRules: [{C448FDCC-80E1-4057-ABE0-710B5FA1343D}] => (Allow) C:\Program Files (x86)\WinMX Music\WinMX Music.exe
    FirewallRules: [{40911C0D-BD8E-4F56-8828-B215A7B9179A}] => (Allow) C:\Program Files (x86)\WinMX Music\WinMX Music.exe
    FirewallRules: [{C548D574-4C9A-4522-B803-186915733595}] => (Allow) C:\Program Files (x86)\WinMX Music\WinMX Music.exe
    FirewallRules: [{7122594F-D635-4D46-AA08-2165ED451E67}] => (Allow) C:\Program Files (x86)\Ares Galaxy Professional\Ares Galaxy Professional.exe
    FirewallRules: [{174F363F-F7C0-4F07-922F-84A5A6A691D7}] => (Allow) C:\Program Files (x86)\Ares Galaxy Professional\Ares Galaxy Professional.exe
    FirewallRules: [TCP Query User{CC88F561-E8A6-4FD1-82FA-10E7F359F88B}C:\program files (x86)\luckywire\luckywire.exe] => (Allow) C:\program files (x86)\luckywire\luckywire.exe
    FirewallRules: [UDP Query User{DD2FAD5B-3F81-4772-92C8-B3F9CE4DE016}C:\program files (x86)\luckywire\luckywire.exe] => (Allow) C:\program files (x86)\luckywire\luckywire.exe
    FirewallRules: [TCP Query User{D5E10871-07D1-48E8-ABF8-801957270CE4}C:\program files (x86)\soulseekns\slsk.exe] => (Allow) C:\program files (x86)\soulseekns\slsk.exe
    FirewallRules: [UDP Query User{543BF0B9-50DE-4A51-ADAF-42127F5D2E1C}C:\program files (x86)\soulseekns\slsk.exe] => (Allow) C:\program files (x86)\soulseekns\slsk.exe
    FirewallRules: [{2DD217DC-2AFA-4D68-B2CF-ADA1F2364264}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    FirewallRules: [{743E506E-3E3F-4827-8076-9AA0040C5414}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    FirewallRules: [{CAFD9837-95E4-469D-A7E8-06ABA46063DE}] => (Allow) C:\Program Files (x86)\Ubisoft\Tom Clancy's H.A.W.X\HAWX.exe
    FirewallRules: [{0FAEB502-E14D-4939-A6A8-244D5350F547}] => (Allow) C:\Program Files (x86)\Ubisoft\Tom Clancy's H.A.W.X\HAWX.exe
    FirewallRules: [{673ECEFF-6EFD-4A09-998B-9888503B1492}] => (Allow) C:\Program Files (x86)\Ubisoft\Tom Clancy's H.A.W.X\HAWX_dx10.exe
    FirewallRules: [{CFE403B5-C691-4DAE-BF52-12F340194F64}] => (Allow) C:\Program Files (x86)\Ubisoft\Tom Clancy's H.A.W.X\HAWX_dx10.exe
    FirewallRules: [{1E9B59DF-C948-4266-945C-5AE93937C9EE}] => (Allow) C:\Users\Owner\AppData\Local\Akamai\netsession_win.exe
    FirewallRules: [{0203E568-A224-47A6-89F8-112F71BCB211}] => (Allow) C:\Users\Owner\AppData\Local\Akamai\netsession_win.exe
    FirewallRules: [TCP Query User{EA856CC0-C507-4E96-9579-0B129CD6273E}C:\users\owner\documents\vuze downloads\heroes over europe\heroes over europe\heroes2.exe] => (Block) C:\users\owner\documents\vuze downloads\heroes over europe\heroes over europe\heroes2.exe
    FirewallRules: [UDP Query User{60DAFC93-C5F2-47EE-8694-E2A7C74D374F}C:\users\owner\documents\vuze downloads\heroes over europe\heroes over europe\heroes2.exe] => (Block) C:\users\owner\documents\vuze downloads\heroes over europe\heroes over europe\heroes2.exe
    FirewallRules: [{3BC2ED6C-1E1B-4B88-842C-AF7EDF3BA584}] => (Allow) C:\Program Files (x86)\Vuze\Azureus.exe
    FirewallRules: [{32595600-4DD5-464A-A818-DFD17D2C8EAE}] => (Allow) C:\Program Files (x86)\Vuze\Azureus.exe
    FirewallRules: [TCP Query User{77D4987A-AC25-428B-9ACB-1CBF920AD48E}C:\users\owner\appdata\local\akamai\netsession_win.exe] => (Block) C:\users\owner\appdata\local\akamai\netsession_win.exe
    FirewallRules: [UDP Query User{3511D6F4-DBE3-464F-94E6-A0F3E56238FC}C:\users\owner\appdata\local\akamai\netsession_win.exe] => (Block) C:\users\owner\appdata\local\akamai\netsession_win.exe
    FirewallRules: [TCP Query User{8D75B86D-1E4D-4D6B-B334-E3D3763E2B42}C:\program files (x86)\soulseekns\slsk.exe] => (Allow) C:\program files (x86)\soulseekns\slsk.exe
    FirewallRules: [UDP Query User{2B620B09-DBA9-490C-ACAE-A16901A87CE4}C:\program files (x86)\soulseekns\slsk.exe] => (Allow) C:\program files (x86)\soulseekns\slsk.exe
    FirewallRules: [{97B68B06-CAB6-44EF-A0D7-407195AAABAA}] => (Allow) C:\Program Files (x86)\Shareaza Applications\Shareaza\Shareaza.exe
    FirewallRules: [{5672826E-EA20-47EA-A572-77EF2511987D}] => (Allow) C:\Program Files (x86)\Shareaza Applications\Shareaza\Shareaza.exe
    FirewallRules: [{BEEC241A-BA90-4150-B594-576DD5CBB529}] => (Allow) C:\Program Files (x86)\Shareaza Applications\Shareaza\Shareaza.exe
    FirewallRules: [{631A0E21-89D0-4057-A2E6-D6688596BBCB}] => (Allow) C:\Program Files (x86)\Shareaza Applications\Shareaza\Shareaza.exe
    FirewallRules: [TCP Query User{71B9E913-DB94-46FE-8C11-6C5832797F75}C:\program files (x86)\luckywire\luckywire.exe] => (Allow) C:\program files (x86)\luckywire\luckywire.exe
    FirewallRules: [UDP Query User{3FE532E0-2092-40B0-8EF3-514E06282FE3}C:\program files (x86)\luckywire\luckywire.exe] => (Allow) C:\program files (x86)\luckywire\luckywire.exe
    FirewallRules: [TCP Query User{2007745D-6D9E-47E1-87C9-19DBEC9C972B}C:\users\owner\documents\vuze downloads\heroes over europe\heroes over europe\heroes2.exe] => (Block) C:\users\owner\documents\vuze downloads\heroes over europe\heroes over europe\heroes2.exe
    FirewallRules: [UDP Query User{D71A3971-F5B8-4772-8D1D-5C8A37FD7FD7}C:\users\owner\documents\vuze downloads\heroes over europe\heroes over europe\heroes2.exe] => (Block) C:\users\owner\documents\vuze downloads\heroes over europe\heroes over europe\heroes2.exe
    FirewallRules: [{3D1CE419-E3EE-4904-AF6A-ED10B7B63C5C}] => (Allow) C:\Program Files (x86)\FrostWire 5\FrostWire.exe
    FirewallRules: [{38C9EE8C-B8C9-4D74-99D5-E4EEE31C9101}] => (Allow) C:\Program Files (x86)\FrostWire 5\FrostWire.exe
    FirewallRules: [TCP Query User{515F347E-6B10-4FD3-B850-896F296377C4}C:\games\world_of_warplanes\worldofwarplanes.exe] => (Allow) C:\games\world_of_warplanes\worldofwarplanes.exe
    FirewallRules: [UDP Query User{6EF7121F-2748-44DE-9934-09E9807783DF}C:\games\world_of_warplanes\worldofwarplanes.exe] => (Allow) C:\games\world_of_warplanes\worldofwarplanes.exe
    FirewallRules: [{977796B3-1E02-45FE-B689-E0B474524668}] => (Allow) C:\Program Files (x86)\WarThunder\launcher.exe
    FirewallRules: [{1A13A48E-5475-45B1-AC30-C2F323181F53}] => (Allow) C:\Program Files (x86)\WarThunder\launcher.exe
    FirewallRules: [TCP Query User{5D2F1BFF-EFCA-4E39-8DC1-AC7FC6C8E549}C:\program files (x86)\warthunder\aces.exe] => (Block) C:\program files (x86)\warthunder\aces.exe
    FirewallRules: [UDP Query User{A5ED236A-1D30-45B6-A387-9C7C8EC401DF}C:\program files (x86)\warthunder\aces.exe] => (Block) C:\program files (x86)\warthunder\aces.exe
    FirewallRules: [TCP Query User{7BD76936-67B7-4D1C-A661-593CBC604C5E}C:\program files\shareaza\shareaza.exe] => (Allow) C:\program files\shareaza\shareaza.exe
    FirewallRules: [UDP Query User{85081895-C77F-4E5F-8E89-A1561CB1F813}C:\program files\shareaza\shareaza.exe] => (Allow) C:\program files\shareaza\shareaza.exe
    FirewallRules: [TCP Query User{AF5782F4-29C7-4328-82E4-9B169F800C61}C:\users\owner\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe] => (Block) C:\users\owner\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe
    FirewallRules: [UDP Query User{DD128279-0910-48E0-9D6F-3530F804A54C}C:\users\owner\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe] => (Block) C:\users\owner\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe
    FirewallRules: [{4A00BE5E-C4BB-406A-9C1C-111E498D2754}] => (Allow) C:\Program Files (x86)\WarThunderDev\launcher.exe
    FirewallRules: [{74FD960D-0204-4EC6-9405-C928CDB27F6C}] => (Allow) C:\Program Files (x86)\WarThunderDev\launcher.exe
    FirewallRules: [{5D3B0F77-681B-4BF6-973F-C855F16B443E}] => (Allow) C:\Program Files\KMSpico\KMSELDI.exe
    FirewallRules: [{12AA15F5-BB5F-49CC-A3F0-7F131D82B4E5}] => (Allow) C:\Program Files\KMSpico\KMSELDI.exe
    FirewallRules: [{05E88CCD-91BB-459B-91A2-8575DAB3D889}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
    FirewallRules: [{A0208C98-7633-4F97-9701-5138D1F50098}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
    FirewallRules: [{0543AA67-EFEF-48CB-A54A-E55248412302}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
    FirewallRules: [{8D8977CB-FD86-48F0-B70D-630C93B72306}] => (Allow) C:\Program Files\KMSpico\Service_KMS.exe
    FirewallRules: [TCP Query User{6A4611D8-38C5-46C8-9677-D1F5EBB63634}C:\program files (x86)\warthunder\launcher.exe] => (Block) C:\program files (x86)\warthunder\launcher.exe
    FirewallRules: [UDP Query User{D635811C-907C-4BA5-9BB7-A03D4B92C769}C:\program files (x86)\warthunder\launcher.exe] => (Block) C:\program files (x86)\warthunder\launcher.exe
    FirewallRules: [TCP Query User{B0E16C88-EB41-40D8-9D3A-CB7A89C101E0}C:\program files (x86)\warthunder\aces.exe] => (Block) C:\program files (x86)\warthunder\aces.exe
    FirewallRules: [UDP Query User{AE9A77FE-DE46-48D8-ACB6-966C08183A55}C:\program files (x86)\warthunder\aces.exe] => (Block) C:\program files (x86)\warthunder\aces.exe
    FirewallRules: [TCP Query User{E38558DB-7354-4C79-8329-00D620FFA8F0}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre7\bin\javaw.exe
    FirewallRules: [UDP Query User{58534CE6-32B2-4188-94B4-9694300709A7}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre7\bin\javaw.exe
    FirewallRules: [{4CD324AF-862E-4619-8325-B26102F003FB}] => (Allow) C:\Users\Owner\AppData\Local\Temp\7zS6E55\HPDiagnosticCoreUI.exe
    FirewallRules: [{CA65A48D-1C4E-4C60-8B60-5971AE48A3D7}] => (Allow) C:\Users\Owner\AppData\Local\Temp\7zS6E55\HPDiagnosticCoreUI.exe
    FirewallRules: [TCP Query User{07FA16CF-8E53-46D0-8EF4-98F43854C6C3}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
    FirewallRules: [UDP Query User{AC95E5A8-C4A2-40B8-B8FC-67652C4B46F0}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
    FirewallRules: [TCP Query User{2D80C42C-041C-4225-B704-A2249D61814C}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Block) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
    FirewallRules: [UDP Query User{07898DC9-9BC5-47AF-B6CC-C27D7C79420F}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Block) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
    FirewallRules: [{60ABEBFC-BBD4-4A43-827E-463B00E4379D}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    FirewallRules: [{C8DCF127-A930-44D0-854F-F4F36033C251}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    FirewallRules: [{D45E0402-3769-444F-AD1E-B5FDC7D0D918}] => (Allow) E:\install\data\Disk1\setup.exe
    FirewallRules: [{17ABD4EB-72AB-4552-A7E1-738AA045AA2A}] => (Allow) E:\install\data\Disk1\setup.exe
    FirewallRules: [TCP Query User{A36C05D2-0977-453F-A653-AB2BCDD9D688}C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe
    FirewallRules: [UDP Query User{6B5E252F-F1FA-4E6B-AF7A-0C0DE4BB37B1}C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe
    FirewallRules: [TCP Query User{F1F0FA83-9FB5-4003-BAF1-54734BDE87A3}C:\games\world_of_tanks\wotlauncher.exe] => (Allow) C:\games\world_of_tanks\wotlauncher.exe
    FirewallRules: [UDP Query User{045B515A-278C-41F9-99DF-E9D541FDAE7F}C:\games\world_of_tanks\wotlauncher.exe] => (Allow) C:\games\world_of_tanks\wotlauncher.exe
    FirewallRules: [TCP Query User{4034B617-6B8D-4015-A932-8EB2E7B1BB19}C:\games\world_of_tanks\worldoftanks.exe] => (Allow) C:\games\world_of_tanks\worldoftanks.exe
    FirewallRules: [UDP Query User{2D4BE10F-8FBB-4B4E-AEA7-9DA052168303}C:\games\world_of_tanks\worldoftanks.exe] => (Allow) C:\games\world_of_tanks\worldoftanks.exe
    FirewallRules: [{9366515B-744A-488A-8DF6-DBA9E7CCC573}] => (Allow) LPort=1689
    FirewallRules: [{BB916D80-4841-43B3-AB07-D1293D5F0B82}] => (Allow) C:\Program Files (x86)\Vuze\Azureus.exe
    FirewallRules: [{EB2D3A8E-B730-4F88-AF3C-12D8E3082F96}] => (Allow) C:\Program Files (x86)\Vuze\Azureus.exe
    FirewallRules: [{B880294E-D4BD-42BA-9DA5-2277E86966DC}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
    FirewallRules: [{301CDF90-CE68-473F-9BEF-E38DB843B7B6}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
    FirewallRules: [{48A21795-96F2-494A-901D-1D10223D04F6}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    FirewallRules: [{DC590E6A-69AD-48B6-B836-06D68987EAE0}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    FirewallRules: [{53C8BFB3-44B9-460F-A1A4-4B56DAAD797B}] => (Allow) C:\Program Files\iTunes\iTunes.exe
    FirewallRules: [{BA2135F6-3391-46EC-AF57-CD1565039942}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    FirewallRules: [{E4006AF8-6EBB-4E93-9137-DAF3C2616420}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    FirewallRules: [TCP Query User{20A8A227-51F6-41BD-BDB6-FAB90B83EC6D}C:\program files (x86)\sony\media go\mediago.exe] => (Block) C:\program files (x86)\sony\media go\mediago.exe
    FirewallRules: [UDP Query User{E8CB7A32-53DA-4735-B88A-4F925B5CBD75}C:\program files (x86)\sony\media go\mediago.exe] => (Block) C:\program files (x86)\sony\media go\mediago.exe
    FirewallRules: [{765C2B3C-2F60-48B9-8734-F350C2FF2DB0}] => (Allow) LPort=1688
    FirewallRules: [{2300150D-3AA1-428A-8458-A27DFB895C59}] => (Allow) C:\Program Files (x86)\Gaijin\Wings of Prey\launcher.exe
    FirewallRules: [{52BA9802-9554-4905-896A-BF7B4629D395}] => (Allow) C:\Program Files (x86)\Gaijin\Wings of Prey\launcher.exe
    FirewallRules: [{8B176D70-5855-4EB9-9D94-6632FA4B9370}] => (Allow) C:\Program Files (x86)\Gaijin\Wings of Prey\acess.exe
    FirewallRules: [{36776038-946C-4A26-AAEF-BF4BD4A97249}] => (Allow) C:\Program Files (x86)\Gaijin\Wings of Prey\acess.exe
    FirewallRules: [TCP Query User{9F5BE4E0-ABE0-4A29-A254-341B6D8C2FEF}C:\program files (x86)\warthunder\win32\aces.exe] => (Allow) C:\program files (x86)\warthunder\win32\aces.exe
    FirewallRules: [UDP Query User{F2114CC7-7210-4349-BC0E-8C975A3654DB}C:\program files (x86)\warthunder\win32\aces.exe] => (Allow) C:\program files (x86)\warthunder\win32\aces.exe
    FirewallRules: [{FE7C76B9-6C16-45EC-B92D-766FD70BD4BB}] => (Allow) C:\Program Files (x86)\LeapFrog\LeapFrog Connect\LeapfrogConnect.exe
    FirewallRules: [TCP Query User{BBB32AA5-54DC-4A3F-B0EE-885D285D6A11}C:\program files (x86)\java\jre1.8.0_91\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre1.8.0_91\bin\javaw.exe
    FirewallRules: [UDP Query User{1F5A1764-5A00-48B1-9EB8-C8755FED0CA7}C:\program files (x86)\java\jre1.8.0_91\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre1.8.0_91\bin\javaw.exe
    FirewallRules: [{32C003BE-F3EA-4D2D-BA0B-3911994E6608}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
    FirewallRules: [{90EF858C-4CCC-4B3F-BE72-C7A488248DA8}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
    FirewallRules: [{F3927768-1095-4994-9B65-9D3CF6F936C7}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
    FirewallRules: [{A2ABEE39-62DB-4A5E-8F2E-C6DAA3CE4E52}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
    FirewallRules: [{524E4D3D-3875-44C3-816B-31D2714C344B}] => (Allow) C:\Program Files (x86)\Sony\Xperia Companion\XperiaCompanion.exe
    FirewallRules: [{92695654-98EE-4694-B775-D22240802ECD}] => (Allow) C:\Program Files (x86)\Sony Mobile\Update Engine\Sony Mobile Update Engine.exe
    FirewallRules: [{97CADA1B-294D-45FF-889E-C08A4BC3A150}] => (Allow) C:\Program Files (x86)\Sony Mobile\Update Engine\Sony Mobile Update Engine.exe
    FirewallRules: [{8AC136A1-6E7C-4F76-AE3F-D51889D844BC}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
    StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
    StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
    StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service

    ==================== Restore Points =========================

    02-09-2016 07:33:57 HPSF Restore Point
    04-09-2016 19:00:09 Windows Backup
    06-09-2016 09:50:53 Xperia Companion
    08-09-2016 09:08:25 Xperia Companion
    10-09-2016 16:22:05 Installed Sony Mobile Drivers
    11-09-2016 19:00:18 Windows Backup
    12-09-2016 09:58:04 Xperia Companion

    ==================== Faulty Device Manager Devices =============

    Name: Programmable Root Enumerator
    Description: Programming Support
    Class Guid: {678dcf40-e2e6-11d5-8cd5-e960089ea00a}
    Manufacturer: Mad Catz
    Service: SaiNtBus
    Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
    Resolution: Update the driver


    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (09/17/2016 11:04:43 AM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application name: XperiaCompanion.exe, version: 1.2.8.0, time stamp: 0x5746f2da
    Faulting module name: XperiaCompanion.exe, version: 1.2.8.0, time stamp: 0x5746f2da
    Exception code: 0xc0000005
    Fault offset: 0x001d50f1
    Faulting process id: 0xbb8
    Faulting application start time: 0x01d211057418d6f4
    Faulting application path: C:\Program Files (x86)\Sony\Xperia Companion\XperiaCompanion.exe
    Faulting module path: C:\Program Files (x86)\Sony\Xperia Companion\XperiaCompanion.exe
    Report Id: d39e966b-7cf8-11e6-85e7-6431503ceaa3

    Error: (09/12/2016 12:17:45 PM) (Source: Application Hang) (EventID: 1002) (User: )
    Description: The program Explorer.EXE version 6.1.7601.23418 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

    Process ID: 5a0

    Start Time: 01d20d1922061310

    Termination Time: 499

    Application Path: C:\Windows\Explorer.EXE

    Report Id: 30e7f891-7915-11e6-a04f-6431503ceaa3

    Error: (09/11/2016 11:38:10 AM) (Source: Application Hang) (EventID: 1002) (User: )
    Description: The program explorer.exe version 6.1.7601.23418 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

    Process ID: 1938

    Start Time: 01d20c5301f1abd3

    Termination Time: 61

    Application Path: C:\Windows\explorer.exe

    Report Id: 7fd35f4b-7846-11e6-9471-6431503ceaa3

    Error: (09/11/2016 11:36:19 AM) (Source: Application Hang) (EventID: 1002) (User: )
    Description: The program Explorer.EXE version 6.1.7601.23418 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

    Process ID: 5c0

    Start Time: 01d20c2cb299045c

    Termination Time: 52

    Application Path: C:\Windows\Explorer.EXE

    Report Id: 3ce50f98-7846-11e6-9471-6431503ceaa3

    Error: (09/06/2016 08:18:09 PM) (Source: Application Hang) (EventID: 1002) (User: )
    Description: The program Explorer.EXE version 6.1.7601.23418 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

    Process ID: 5a4

    Start Time: 01d208ad696954c4

    Termination Time: 31

    Application Path: C:\Windows\Explorer.EXE

    Report Id: 3cd1356b-74a1-11e6-8d84-6431503ceaa3

    Error: (09/06/2016 09:29:24 AM) (Source: Application Hang) (EventID: 1002) (User: )
    Description: The program Explorer.EXE version 6.1.7601.23418 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

    Process ID: 5c4

    Start Time: 01d208381443fd76

    Termination Time: 1186

    Application Path: C:\Windows\Explorer.EXE

    Report Id: ac5b82f9-7446-11e6-b766-6431503ceaa3

    Error: (08/28/2016 07:56:44 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application name: vlc.exe, version: 2.2.1.0, time stamp: 0x00000004
    Faulting module name: libqt4_plugin.dll, version: 2.2.1.0, time stamp: 0x00020002
    Exception code: 0x40000015
    Fault offset: 0x007ca10a
    Faulting process id: 0x1b18
    Faulting application start time: 0x01d201988052abce
    Faulting application path: C:\Program Files (x86)\VideoLAN\VLC\vlc.exe
    Faulting module path: C:\Program Files (x86)\VideoLAN\VLC\plugins\gui\libqt4_plugin.dll
    Report Id: d5768bbd-6d8b-11e6-ac50-6431503ceaa3

    Error: (08/01/2016 07:53:01 PM) (Source: Application Hang) (EventID: 1002) (User: )
    Description: The program javaw.exe version 8.0.910.15 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

    Process ID: 12b0

    Start Time: 01d1ec4070ae8b7d

    Termination Time: 16

    Application Path: C:\Program Files (x86)\Java\jre1.8.0_91\bin\javaw.exe

    Report Id:

    Error: (08/01/2016 07:22:15 AM) (Source: SsfService) (EventID: 0) (User: )
    Description: Service cannot be started. The service process could not connect to the service controller

    Error: (07/29/2016 01:36:24 PM) (Source: Application Hang) (EventID: 1002) (User: )
    Description: The program javaw.exe version 8.0.910.15 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

    Process ID: 188c

    Start Time: 01d1e9cf3eb3d9ff

    Termination Time: 78

    Application Path: C:\Program Files (x86)\Java\jre1.8.0_91\bin\javaw.exe

    Report Id: b01d17d1-55c3-11e6-b21a-6431503ceaa3


    System errors:
    =============
    Error: (09/18/2016 06:23:09 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
    Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the LanmanServer service.

    Error: (09/18/2016 06:20:24 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: The Service KMSELDI service failed to start due to the following error:
    The system cannot find the file specified.

    Error: (09/17/2016 12:27:35 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: The Service KMSELDI service failed to start due to the following error:
    The system cannot find the file specified.

    Error: (09/17/2016 07:23:49 AM) (Source: DCOM) (EventID: 10010) (User: )
    Description: The server {D085A4AB-CAB1-4729-9DF8-FCEEDDBD19E4} did not register with DCOM within the required timeout.

    Error: (09/17/2016 07:14:20 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: The Service KMSELDI service failed to start due to the following error:
    The system cannot find the file specified.

    Error: (09/17/2016 07:14:12 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: The Spybot-S&D 2 Scanner Service service failed to start due to the following error:
    The service did not respond to the start or control request in a timely fashion.

    Error: (09/17/2016 07:14:12 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
    Description: A timeout was reached (30000 milliseconds) while waiting for the Spybot-S&D 2 Scanner Service service to connect.

    Error: (09/17/2016 07:13:26 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: The HP Support Solutions Framework Service service failed to start due to the following error:
    The service did not respond to the start or control request in a timely fashion.

    Error: (09/17/2016 07:13:26 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
    Description: A timeout was reached (30000 milliseconds) while waiting for the HP Support Solutions Framework Service service to connect.

    Error: (09/16/2016 09:31:32 AM) (Source: DCOM) (EventID: 10010) (User: )
    Description: The server {D085A4AB-CAB1-4729-9DF8-FCEEDDBD19E4} did not register with DCOM within the required timeout.


    CodeIntegrity:
    ===================================
    Date: 2016-08-29 08:40:46.693
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\aswKbd.sys because the set of per-page image hashes could not be found on the system.

    Date: 2016-08-29 08:40:46.225
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.

    Date: 2016-08-28 07:47:43.566
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\aswKbd.sys because the set of per-page image hashes could not be found on the system.

    Date: 2016-08-28 07:47:43.067
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.

    Date: 2016-08-27 05:52:04.050
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\aswKbd.sys because the set of per-page image hashes could not be found on the system.

    Date: 2016-08-27 05:52:03.847
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.

    Date: 2016-08-26 07:01:36.860
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\aswKbd.sys because the set of per-page image hashes could not be found on the system.

    Date: 2016-08-26 07:01:36.111
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.

    Date: 2016-08-25 07:01:43.287
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\aswKbd.sys because the set of per-page image hashes could not be found on the system.

    Date: 2016-08-25 07:01:42.663
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\aswSnx.sys because the set of per-page image hashes could not be found on the system.


    ==================== Memory info ===========================

    Processor: AMD Athlon(tm) II X2 245 Processor
    Percentage of memory in use: 72%
    Total physical RAM: 2815.29 MB
    Available physical RAM: 787.13 MB
    Total Virtual: 5628.75 MB
    Available Virtual: 2868.68 MB

    ==================== Drives ================================

    Drive c: (OS) (Fixed) (Total:686.49 GB) (Free:314.51 GB) NTFS
    Drive d: (HP_RECOVERY) (Fixed) (Total:12.04 GB) (Free:1.44 GB) NTFS ==>[system with boot components (obtained from drive)]

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (Size: 698.6 GB) (Disk ID: CCC43D8D)
    Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
    Partition 2: (Not Active) - (Size=686.5 GB) - (Type=07 NTFS)
    Partition 3: (Not Active) - (Size=12 GB) - (Type=07 NTFS)

    ==================== End of Addition.txt ============================

  4. #4
    Security Expert-emeritus Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    4,084

    Default

    Not much showing.

    KMSpico v9.2.2 RC <==need to uninstall this


    Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
    To do this highlight the contents of the box and right click on it and select copy.
    Paste this into the open notepad. save it to the Desktop as fixlist.txt
    NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
    It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)





    start
    CreateRestorePoint:
    CloseProcesses:
    CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll => No File
    CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll => No File
    CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\50.0.2661.87\PepperFlash\pepflashplayer.dll => No File
    CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\50.0.2661.87\ppGoogleNaClPluginChrome.dll => No File
    CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\50.0.2661.87\pdf.dll => No File
    CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll => No File
    CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll => No File
    CHR Plugin: (Java(TM) Platform SE 7 U21) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll => No File
    CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll => No File
    CHR Plugin: (Roblox Launcher Plugin) - C:\Users\Owner\AppData\Local\Roblox\Versions\version-1a23fdbca04d4954\\NPRobloxProxy.dll => No File
    CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll => No File
    CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <not found>
    S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [X]
    S3 WsDrvInst; "C:\Program Files (x86)\Wondershare\Dr.Fone for Android\DriverInstall.exe" [X]
    C:\Users\Owner\AppData\Roaming\GhostObjGAFix.xml
    AlternateDataStreams: C:\ProgramData\Temp:5C321E34 [119]
    AlternateDataStreams: C:\Users\Owner\Downloads:Shareaza.GUID [16]
    CMD: ipconfig /flushdns
    CMD: netsh winsock reset all
    CMD: netsh int ipv4 reset
    CMD: netsh int ipv6 reset
    Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
    Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
    EmptyTemp:
    Hosts:
    End
    Open FRST/FRST64 and press the > Fix < button just once and wait.
    If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
    When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
    ~~~~~~~~~~~~~~~~~~~~~`

    Let's update Malwarebytes Anti-Malware


    • On the Dashboard click on Update Now
    • Go to the Setting Tab
    • Under Setting go to Detection and Protection
    • Under PUP and PUM make sure both are set to show Treat Detections as Malware
    • Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
    • Then on the Dashboard click on Scan
    • Make sure to select THREAT SCAN
    • Then click on Scan
    • Note: You may see the following message, "Could not load DDA driver". Click Yes, allow your PC to reboot and continue afterwards.
    • If threats are detected, click Remove Selected. If you are prompted to reboot, click Yes.
    • Upon completion of the scan (or after the reboot), click the History tab.
    • Click Application Logs, followed by the first Scan Log.
    • Click Export,followed by Copy to Clipboard. Paste the log in your next reply.


    ~~~~~~~~~~~~~
    Please post these 2 logs when finished.
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  5. #5
    Senior Member gigglepot's Avatar
    Join Date
    Jun 2014
    Posts
    148

    Default

    Here is the Fixlog.txt:

    Fix result of Farbar Recovery Scan Tool (x64) Version: 18-09-2016
    Ran by Owner (19-09-2016 12:13:49) Run:1
    Running from C:\Users\Owner\Desktop
    Loaded Profiles: Owner & (Available Profiles: Owner)
    Boot Mode: Normal
    ==============================================

    fixlist content:
    *****************
    start
    CreateRestorePoint:
    CloseProcesses:
    CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll => No File
    CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll => No File
    CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\50.0.2661.87\PepperFlash\pepflashplayer.dll => No File
    CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\50.0.2661.87\ppGoogleNaClPluginChrome.dll => No File
    CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\50.0.2661.87\pdf.dll => No File
    CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll => No File
    CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll => No File
    CHR Plugin: (Java(TM) Platform SE 7 U21) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll => No File
    CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll => No File
    CHR Plugin: (Roblox Launcher Plugin) - C:\Users\Owner\AppData\Local\Roblox\Versions\version-1a23fdbca04d4954\\NPRobloxProxy.dll => No File
    CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll => No File
    CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <not found>
    S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [X]
    S3 WsDrvInst; "C:\Program Files (x86)\Wondershare\Dr.Fone for Android\DriverInstall.exe" [X]
    C:\Users\Owner\AppData\Roaming\GhostObjGAFix.xml
    AlternateDataStreams: C:\ProgramData\Temp:5C321E34 [119]
    AlternateDataStreams: C:\Users\Owner\Downloads:Shareaza.GUID [16]
    CMD: ipconfig /flushdns
    CMD: netsh winsock reset all
    CMD: netsh int ipv4 reset
    CMD: netsh int ipv6 reset
    Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
    Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
    EmptyTemp:
    Hosts:
    End
    *****************

    Restore point was successfully created.
    Processes closed successfully.
    C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll => not found.
    C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll => not found.
    C:\Program Files (x86)\Google\Chrome\Application\50.0.2661.87\PepperFlash\pepflashplayer.dll => not found.
    C:\Program Files (x86)\Google\Chrome\Application\50.0.2661.87\ppGoogleNaClPluginChrome.dll => not found.
    C:\Program Files (x86)\Google\Chrome\Application\50.0.2661.87\pdf.dll => not found.
    C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll => not found.
    C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll => not found.
    C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll => not found.
    C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll => not found.
    C:\Users\Owner\AppData\Local\Roblox\Versions\version-1a23fdbca04d4954\\NPRobloxProxy.dll => not found.
    c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll => not found.
    "HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\gomekmidlodglbbmalcneegieacbdmki" => key removed successfully
    Service KMSELDI => service removed successfully
    WsDrvInst => service removed successfully
    C:\Users\Owner\AppData\Roaming\GhostObjGAFix.xml => moved successfully
    C:\ProgramData\Temp => ":5C321E34" ADS removed successfully.
    "C:\Users\Owner\Downloads" => ":Shareaza.GUID" ADS not found.

    ========= ipconfig /flushdns =========


    Windows IP Configuration

    Successfully flushed the DNS Resolver Cache.

    ========= End of CMD: =========


    ========= netsh winsock reset all =========


    Sucessfully reset the Winsock Catalog.
    You must restart the computer in order to complete the reset.


    ========= End of CMD: =========


    ========= netsh int ipv4 reset =========

    Reseting Interface, OK!
    Restart the computer to complete this action.


    ========= End of CMD: =========


    ========= netsh int ipv6 reset =========

    There's no user specified settings to be reset.


    ========= End of CMD: =========


    ========= reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========

    The operation completed successfully.



    ========= End of Reg: =========


    ========= reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========

    The operation completed successfully.



    ========= End of Reg: =========

    C:\Windows\System32\Drivers\etc\hosts => moved successfully
    Hosts restored successfully.

    =========== EmptyTemp: ==========

    BITS transfer queue => 8388608 B
    DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 22749874 B
    Java, Flash, Steam htmlcache => 30422007 B
    Windows/system/drivers => 1595146 B
    Edge => 0 B
    Chrome => 0 B
    Firefox => 388724695 B
    Opera => 0 B

    Temp, IE cache, history, cookies, recent:
    Default => 0 B
    Public => 0 B
    ProgramData => 0 B
    systemprofile => 83525 B
    systemprofile32 => 692 B
    LocalService => 0 B
    NetworkService => 21300 B
    Owner => 139579550 B

    RecycleBin => 1597377460 B
    EmptyTemp: => 2 GB temporary data Removed.

    ================================


    The system needed a reboot.

    ==== End of Fixlog 12:19:27 ====

  6. #6
    Senior Member gigglepot's Avatar
    Join Date
    Jun 2014
    Posts
    148

    Default

    I noticed that after running the "fix", it deleted all of my pinned files that I had on my Excel taskbar button at the bottom of my screen. I needed to put them all back on again (or the ones I could remember). I'm running MalwareBytes now.....

  7. #7
    Senior Member gigglepot's Avatar
    Join Date
    Jun 2014
    Posts
    148

    Default

    Here is the MalwareBytes log:

    Malwarebytes Anti-Malware
    www.malwarebytes.org

    Scan Date: 09/19/2016
    Scan Time: 12:32 PM
    Logfile:
    Administrator: Yes

    Version: 2.2.1.1043
    Malware Database: v2016.09.19.07
    Rootkit Database: v2016.08.15.01
    License: Free
    Malware Protection: Disabled
    Malicious Website Protection: Disabled
    Self-protection: Disabled

    OS: Windows 7 Service Pack 1
    CPU: x64
    File System: NTFS
    User: Owner

    Scan Type: Threat Scan
    Result: Completed
    Objects Scanned: 401374
    Time Elapsed: 37 min, 28 sec

    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Disabled
    Heuristics: Enabled
    PUP: Enabled
    PUM: Enabled

    Processes: 0
    (No malicious items detected)

    Modules: 0
    (No malicious items detected)

    Registry Keys: 0
    (No malicious items detected)

    Registry Values: 0
    (No malicious items detected)

    Registry Data: 0
    (No malicious items detected)

    Folders: 0
    (No malicious items detected)

    Files: 0
    (No malicious items detected)

    Physical Sectors: 0
    (No malicious items detected)


    (end)

  8. #8
    Senior Member gigglepot's Avatar
    Join Date
    Jun 2014
    Posts
    148

    Default

    Before I wrote in for help I ran Malwarebytes, let me know if you want me to post that History Scan Log as well. There were a lot of PUP things deleted then.

  9. #9
    Security Expert-emeritus Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    4,084

    Default

    Quote Originally Posted by gigglepot View Post
    Before I wrote in for help I ran Malwarebytes, let me know if you want me to post that History Scan Log as well. There were a lot of PUP things deleted then.
    Don't think I need to see it but hold on to it.

    Please download Emsisoft Emergency Kit and save it to your desktop.
    Double click on the EmsisoftEmergencyKit file you downloaded to extract its contents and create a shortcut on the desktop.
    • Leave all settings as they are and click the Extract button at the bottom.
    • A folder named EEK will be created in the root of the drive (usually c:\).
    • After extraction please double-click on the new Start Emsisoft Emergency Kit icon on your desktop.
    • The first time you launch it, Emsisoft Emergency Kit will recommend that you allow it to download updates.
    • Please click Yes so that it downloads the latest database updates.
    • When the update process is complete, a new button will appear in the lower-left corner that says Back. Click on this button to return to the Overview screen.
    • Click on Scan to be taken to the scan options.
    • If you are asked if you want the scanner to scan for Potentially Unwanted Programs, then click Yes.
    • Click on the Malware Scan button to start the scan.
    • When the scan is completed click the View report button in the lower-right corner, and the scan log will be opened in Notepad.
    • Please save the log in Notepad on your desktop, and copy it to your next reply.
    • When you close Emsisoft Emergency Kit, it will give you an option to sign up for a newsletter. This is optional, and is not necessary for the malware removal process.
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  10. #10
    Senior Member gigglepot's Avatar
    Join Date
    Jun 2014
    Posts
    148

    Default

    Here is the EEK log:

    Emsisoft Emergency Kit - Version 11.9
    Last update: 09/19/2016 8:48:38 PM
    User account: Owner-HP\Owner
    Computer name: OWNER-HP
    OS version: Windows 7x64 Service Pack 1

    Scan settings:

    Scan type: Malware Scan
    Objects: Rootkits, Memory, Traces, Files

    Detect PUPs: On
    Scan archives: Off
    ADS Scan: On
    File extension filter: Off
    Advanced caching: On
    Direct disk access: Off

    Scan start: 09/19/2016 8:50:34 PM
    Key: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\AU__RASAPI32 detected: Application.Win32.InstallExt (A)
    Key: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\AU__RASMANCS detected: Application.Win32.InstallExt (A)
    Key: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\HPSF_TASKS_RASAPI32 detected: Application.Win32.InstallExt (A)
    Key: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\HPSF_TASKS_RASMANCS detected: Application.Win32.InstallExt (A)

    Scanned 83380
    Found 4

    Scan end: 09/19/2016 9:00:06 PM
    Scan time: 0:09:32

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •