Page 2 of 3 FirstFirst 123 LastLast
Results 11 to 20 of 23

Thread: Something's Trying to Get Out 2

  1. #11
    Security Expert-emeritus Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    4,084

    Default

    Windows Defender wants to remove, are Bitrep.B and Beilextec. Should I remove them?
    I forgot this, Yes
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  2. #12
    Junior Member
    Join Date
    Aug 2018
    Posts
    26

    Default Still Ongoing

    Yes, this is still ongoing. I teach university and have a kid moving dorms 4 hours away. The first two weeks are kind of crazy. I will try to do the deletions and post a FRST log tonight.

  3. #13
    Junior Member
    Join Date
    Aug 2018
    Posts
    26

    Default Files Deleted, FRST Log Pasted

    OK. Quarantined everything found by Windows Defender's long scan. Deleted some files as recommended. Did not reboot. Ran FRST. Two logs below.

    It will probably be Friday before I am back to this PC for any additional rounds.

    Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 23.08.2018
    Ran by Office Administrator (administrator) on 2012_OFFICE (28-08-2018 22:45:23)
    Running from C:\Users\Dave\Desktop
    Loaded Profiles: Dave & Office Administrator (Available Profiles: Dave & Hope & Ben & Mary Jo & Office Administrator & Share_with_Office & Rich & Administrator & DefaultAppPool)
    Platform: Windows 10 Home Version 1803 17134.228 (X64) Language: English (United States)
    Internet Explorer Version 11 (Default browser: Edge)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic...ery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
    (ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
    (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    (Blue Coat Systems, Inc.) C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe
    (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
    (PaperCut Software International Pty Ltd) C:\Program Files (x86)\PaperCut Print Logger\pcpl.exe
    (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
    () C:\Program Files\Everything\Everything.exe
    (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
    (DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe
    (Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1807.18075-0\MsMpEng.exe
    (Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
    (Microsoft Corporation) C:\Windows\System32\mqsvc.exe
    (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
    (Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
    (Microsoft Corporation) C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe
    (Microsoft Corporation) C:\Windows\System32\dllhost.exe
    () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1815.210.0_x64__kzf8qxf38zg5c\SkypeHost.exe
    () C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18071.11811.0_x64__8wekyb3d8bbwe\Video.UI.exe
    (Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1807.18075-0\NisSrv.exe
    (Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
    () C:\Program Files\Everything\Everything.exe
    (Intel Corporation) C:\Windows\System32\hkcmd.exe
    (Intel Corporation) C:\Windows\System32\igfxpers.exe
    (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
    (f.lux Software LLC) C:\Users\Dave\AppData\Local\FluxSoftware\Flux\flux.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    () C:\Program Files\Google\Drive\googledrivesync.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Moonchild Productions) C:\Program Files\Pale Moon\palemoon.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (SlySoft, Inc.) C:\Program Files (x86)\SlySoft\CloneCD\CloneCDTray.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    () C:\Users\Dave\Documents\My Program Files\AutoHotkey\Compiler\keywords.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
    (Microsoft Corporation) C:\Windows\System32\dllhost.exe
    (Microsoft Corporation) C:\Windows\System32\dllhost.exe
    (Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
    (Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera_crashreporter.exe
    (Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
    (Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
    (Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
    (Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
    (Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
    (Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
    (Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    (Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
    () C:\Program Files\Google\Drive\googledrivesync.exe
    (Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
    (Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
    (Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
    (Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
    (Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
    (Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
    (Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
    (Opera Software) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
    (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
    (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
    (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
    (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
    (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
    (Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\SeaPort.EXE
    () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
    (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
    (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
    (Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
    (Microsoft Corporation) C:\Windows\System32\browser_broker.exe
    (Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    (Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    (Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsStore_11807.1001.13.0_x64__8wekyb3d8bbwe\WinStore.App.exe
    (Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.10314.31700.0_x64__8wekyb3d8bbwe\Office16\OfficeHubTaskHost.exe
    (Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1807.18075-0\MpCmdRun.exe
    (Microsoft Corporation) C:\Windows\System32\smartscreen.exe
    (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Microsoft Corporation) C:\Windows\System32\dllhost.exe

    ==================== Registry (Whitelisted) ===========================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [638872 2018-04-11] (Microsoft Corporation)
    HKLM\...\Run: [CanonSolutionMenu] => C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [767312 2009-09-04] (CANON INC.)
    HKLM\...\Run: [Everything] => C:\Program Files\Everything\Everything.exe [1441792 2014-08-05] ()
    HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [298296 2018-07-06] (Apple Inc.)
    HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
    HKLM-x32\...\Run: [CloneCDTray] => C:\Program Files (x86)\SlySoft\CloneCD\CloneCDTray.exe [57344 2009-01-29] (SlySoft, Inc.)
    HKLM-x32\...\Run: [ArcSoft Connection Service] => C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.)
    HKLM-x32\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2109952 2014-10-07] (Dominik Reichl)
    HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [1224704 2017-05-17] (Cisco Systems, Inc.)
    HKLM\...\RunOnce: [*EmptyTemp] => cmd /c rd /q/s C:\FRST\Temp
    Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
    HKU\S-1-5-19\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-11] (Microsoft Corporation)
    HKU\S-1-5-20\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-11] (Microsoft Corporation)
    HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\...\Run: [F.lux] => C:\Users\Dave\AppData\Local\FluxSoftware\Flux\flux.exe [1806344 2018-07-03] (f.lux Software LLC)
    HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\...\Run: [GoogleChromeAutoLaunch_C62251D359A8F5B5CC8EADB510991ABB] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [1577816 2018-08-07] (Google Inc.)
    HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\...\Run: [GoogleDriveSync] => C:\Program Files\Google\Drive\googledrivesync.exe [46281248 2018-05-30] ()
    HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\...\Run: [AnyDVD] => C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVD.exe [109480 2014-11-08] (SlySoft, Inc.)
    HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\...\Run: [Plex Media Server] => C:\Program Files (x86)\Plex\Plex Media Server\Plex Media Server.exe [5127304 2014-11-20] (Plex, Inc.)
    HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\...\Run: [SynchronossPC] => C:\Program Files\Verizon\Verizon Cloud\VerizonCloud.exe [2862384 2016-10-10] ()
    HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [67384 2018-06-26] (Apple Inc.)
    HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-11] (Microsoft Corporation)
    HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\...\RunOnce: [iCloud] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloud.exe [67384 2018-06-26] (Apple Inc.)
    HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\...\Policies\Explorer: [NoChangeStartMenu] 0
    HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\...\Policies\Explorer: [NoLogOff] 0
    HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\SysWOW64\2017SC~1.SCR [3170336 2017-08-08] (Finalhit Ltd.)
    ShellExecuteHooks: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL -> No File
    ShellExecuteHooks-x32: Eudora's Shell Extension - {EDB0E980-90BD-11D4-8599-0008C7D3B6F8} - C:\Program Files (x86)\Eudora\EuShlExt.dll [86016 2005-08-09] (Qualcomm Inc.)
    Startup: C:\Users\Dave\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\keywords - Shortcut.lnk [2012-07-31]
    ShortcutTarget: keywords - Shortcut.lnk -> C:\Users\Dave\Documents\My Program Files\AutoHotkey\Compiler\keywords.exe ()
    Startup: C:\Users\Dave\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk [2016-07-28]
    ShortcutTarget: OneNote 2010 Screen Clipper and Launcher.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
    Tcpip\Parameters: [DhcpNameServer] 74.211.15.210 74.211.15.211 24.56.178.102
    Tcpip\..\Interfaces\{2e0767a7-1000-4233-b9a4-a7209860729f}: [DhcpNameServer] 74.211.15.210 74.211.15.211 24.56.178.102
    Tcpip\..\Interfaces\{e41e13c2-fdb5-4a91-bf30-2f642af83cec}: [NameServer] 208.67.222.222,8.8.8.8
    Tcpip\..\Interfaces\{e41e13c2-fdb5-4a91-bf30-2f642af83cec}: [DhcpNameServer] 74.211.15.210 74.211.15.211 24.56.178.102

    Internet Explorer:
    ==================
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
    HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.msn.com/HPDSK/1
    HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL => No File
    BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Silverlight\Office14\URLREDIR.DLL => No File
    BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
    BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-03-01] (Oracle Corporation)
    BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
    BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll [2014-03-11] (Microsoft Corporation.)
    BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-03-01] (Oracle Corporation)
    Toolbar: HKLM - No Name - {8dcb7100-df86-4384-8842-8fa844297b3f} - No File
    Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll [2014-03-11] (Microsoft Corporation.)
    Toolbar: HKU\S-1-5-21-4063716828-1680190529-1648852121-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File

    FireFox:
    ========
    FF ProfilePath: C:\Users\Office Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\63hhxx68.default [2018-08-09]
    FF Homepage: Mozilla\Firefox\Profiles\63hhxx68.default -> google.com
    FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_30_0_0_154.dll [2018-08-15] ()
    FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2012-06-21] (Tracker Software Products (Canada) Ltd.)
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
    FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\Program Files\Microsoft Silverlight\Office14\NPAUTHZ.DLL [No File]
    FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_30_0_0_154.dll [2018-08-15] ()
    FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2012-06-21] (Tracker Software Products (Canada) Ltd.)
    FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google)
    FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-03-01] (Oracle Corporation)
    FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-03-01] (Oracle Corporation)
    FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
    FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-16] (Google Inc.)
    FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-16] (Google Inc.)
    FF Plugin-x32: @videolan.org/vlc,version=2.0.7 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
    FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
    FF Plugin-x32: @wolfram.com/Mathematica -> C:\Program Files (x86)\Common Files\Wolfram Research\Browser\8.0.4.2609412\npmathplugin.dll [2011-10-03] (Wolfram Research, Inc.)
    FF Plugin HKU\S-1-5-21-4063716828-1680190529-1648852121-1006: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2012-06-21] (Tracker Software Products (Canada) Ltd.)
    FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\defaults\pref\itms.js [2011-01-24]

    Chrome:
    =======
    CHR DefaultProfile: Default
    CHR StartupUrls: Default -> "hxxp://www.google.com"
    CHR Profile: C:\Users\Office Administrator\AppData\Local\Google\Chrome\User Data\Default [2018-08-09]
    CHR Extension: (Chrome Web Store Payments) - C:\Users\Office Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-08-05]
    CHR Extension: (Chrome Media Router) - C:\Users\Office Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-08-05]
    CHR HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Dave\AppData\Local\Google\Drive\user_default\apdfllckaahabafndbhieahigkjlhalf_live.crx [2017-03-12]
    CHR HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx

    Opera:
    =======
    OPR Extension: (Pushbullet) - C:\Users\Office Administrator\AppData\Roaming\Opera Software\Opera Stable\Extensions\jacmgnhcnfdmjdkdlfndaccecdegacba [2015-03-01]

    ==================== Services (Whitelisted) ====================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
    R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2018-07-05] (Apple Inc.)
    R2 bckwfs; C:\Program Files\Blue Coat K9 Web Protection\k9filter.exe [2122000 2012-02-13] (Blue Coat Systems, Inc.)
    R2 Everything; C:\Program Files\Everything\Everything.exe [1441792 2014-08-05] () [File not signed]
    S3 HPAuto; C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe [682040 2011-02-16] (Hewlett-Packard)
    R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [6541008 2018-05-03] (Malwarebytes)
    R2 PCPrintLogger; C:\Program Files (x86)\PaperCut Print Logger\pcpl.exe [929792 2013-07-03] (PaperCut Software International Pty Ltd) [File not signed]
    S4 ssh-agent; C:\WINDOWS\System32\OpenSSH\ssh-agent.exe [495616 2018-03-10] ()
    R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [754784 2016-01-08] (DEVGURU Co., LTD.)
    R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1807.18075-0\NisSrv.exe [3905952 2018-07-31] (Microsoft Corporation)
    R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1807.18075-0\MsMpEng.exe [110944 2018-07-31] (Microsoft Corporation)
    S3 WMPNetworkSvc; C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe [913408 2006-10-18] (Microsoft Corporation) [File not signed]

    ===================== Drivers (Whitelisted) ======================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    R3 AnyDVD; C:\WINDOWS\System32\Drivers\AnyDVD.sys [138664 2014-04-24] (SlySoft, Inc.)
    R3 AnyDVD; C:\Windows\SysWOW64\Drivers\AnyDVD.sys [138664 2014-04-24] (SlySoft, Inc.)
    R1 bckd; C:\WINDOWS\System32\drivers\bckd.sys [108304 2012-02-13] (Blue Coat Systems, Inc.)
    S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.)
    R3 ElbyCDFL; C:\WINDOWS\System32\Drivers\ElbyCDFL.sys [40648 2007-02-15] (SlySoft, Inc.)
    R3 ElbyCDFL; C:\Windows\SysWOW64\Drivers\ElbyCDFL.sys [40648 2007-02-15] (SlySoft, Inc.)
    R0 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [253664 2018-08-10] (Malwarebytes)
    R3 netr28x; C:\WINDOWS\System32\drivers\netr28x.sys [2537984 2018-04-11] (MediaTek Inc.)
    S3 pmxdrv; C:\Windows\system32\drivers\pmxdrv.sys [31152 2011-08-19] ()
    R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [984032 2017-07-24] (Realtek )
    S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [165504 2016-09-05] (Samsung Electronics Co., Ltd.)
    S3 vpnva; C:\WINDOWS\System32\drivers\vpnva64-6.sys [52592 2015-09-23] (Cisco Systems, Inc.)
    S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [46584 2018-07-31] (Microsoft Corporation)
    R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [340008 2018-07-31] (Microsoft Corporation)
    R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [61992 2018-07-31] (Microsoft Corporation)
    U3 idsvc; no ImagePath

    ==================== NetSvcs (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    ==================== One Month Created files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2018-08-28 22:45 - 2018-08-28 22:45 - 000000000 ____D C:\Users\Dave\Desktop\FRST-OlderVersion
    2018-08-28 22:44 - 2018-08-28 22:45 - 000000000 ____D C:\FRST
    2018-08-26 10:27 - 2018-08-26 10:27 - 000015108 _____ C:\Users\Dave\Desktop\Windows Defender Log 18-08-25.txt
    2018-08-25 10:56 - 2018-08-25 10:56 - 000250222 _____ C:\Users\Dave\Downloads\Green Pepper Genders Swiflie.pdf
    2018-08-21 15:14 - 2018-08-21 15:23 - 000021274 _____ C:\Users\Dave\Downloads\Text Request Form Email Attachment, Tufte, for Fall 2018.xlsx
    2018-08-20 00:49 - 2018-08-20 00:49 - 000671029 _____ C:\Users\Dave\Downloads\Holmes;JPE;74;'The Process of International Adjustments Under Conditions of Full Employment - A Keynesian View Revised'.pdf
    2018-08-18 15:34 - 2018-08-18 15:35 - 000108701 _____ C:\Users\Dave\Downloads\Iron_County_School_District_Calendar_18-19_SUPER_HIGH_QUALITY.pdf
    2018-08-18 11:03 - 2018-08-18 11:03 - 039982433 _____ (Moonchild Productions) C:\Users\Dave\Downloads\palemoon-28.0.0.win64.installer.exe
    2018-08-15 23:11 - 2018-08-15 23:16 - 000000000 ____D C:\Users\Dave\Downloads\IDrive
    2018-08-15 23:11 - 2018-08-15 23:11 - 002102584 _____ C:\Users\Dave\Downloads\IDrive.zip
    2018-08-15 15:54 - 2018-08-15 15:54 - 000417741 _____ C:\Users\Dave\Downloads\Ben's 2018-9 FAFSA Confirmation.pdf
    2018-08-15 15:52 - 2018-08-15 15:53 - 003080314 _____ C:\Users\Dave\Downloads\Ben's 2018-9 FAFSA.pdf
    2018-08-15 01:04 - 2018-08-02 21:39 - 007519992 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
    2018-08-15 01:04 - 2018-08-02 21:25 - 006568784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
    2018-08-15 01:04 - 2018-08-02 21:23 - 025846784 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
    2018-08-15 01:04 - 2018-08-02 21:18 - 022714880 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
    2018-08-15 01:04 - 2018-07-14 00:46 - 023862784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Hydrogen.dll
    2018-08-15 01:03 - 2018-08-03 02:39 - 021389368 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
    2018-08-15 01:03 - 2018-08-03 02:39 - 000790304 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
    2018-08-15 01:03 - 2018-08-03 02:25 - 000178176 _____ (Microsoft Corporation) C:\WINDOWS\system32\t2embed.dll
    2018-08-15 01:03 - 2018-08-03 02:25 - 000123392 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontsub.dll
    2018-08-15 01:03 - 2018-08-03 02:24 - 000099328 _____ (Microsoft Corporation) C:\WINDOWS\system32\hlink.dll
    2018-08-15 01:03 - 2018-08-03 02:24 - 000066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\msiexec.exe
    2018-08-15 01:03 - 2018-08-03 02:22 - 001127936 _____ (Microsoft Corporation) C:\WINDOWS\system32\nettrace.dll
    2018-08-15 01:03 - 2018-08-03 02:21 - 001364992 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvruserservice.dll
    2018-08-15 01:03 - 2018-08-03 02:21 - 001121792 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWorkspace.dll
    2018-08-15 01:03 - 2018-08-03 02:21 - 000765440 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdh.dll
    2018-08-15 01:03 - 2018-08-03 02:21 - 000391680 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
    2018-08-15 01:03 - 2018-08-03 02:20 - 004049408 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
    2018-08-15 01:03 - 2018-08-03 02:20 - 003652608 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
    2018-08-15 01:03 - 2018-08-03 02:20 - 000134144 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppc.dll
    2018-08-15 01:03 - 2018-08-03 02:19 - 001661440 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
    2018-08-15 01:03 - 2018-08-03 01:45 - 000663128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
    2018-08-15 01:03 - 2018-08-03 01:43 - 020383720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
    2018-08-15 01:03 - 2018-08-03 01:33 - 000138752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\t2embed.dll
    2018-08-15 01:03 - 2018-08-03 01:33 - 000098304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontsub.dll
    2018-08-15 01:03 - 2018-08-03 01:32 - 000060416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msiexec.exe
    2018-08-15 01:03 - 2018-08-03 01:30 - 000099840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hlink.dll
    2018-08-15 01:03 - 2018-08-03 01:29 - 000621568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdh.dll
    2018-08-15 01:03 - 2018-08-03 01:29 - 000343552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
    2018-08-15 01:03 - 2018-08-03 01:28 - 002895360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
    2018-08-15 01:03 - 2018-08-03 01:27 - 004050432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
    2018-08-15 01:03 - 2018-08-03 01:27 - 001469952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
    2018-08-15 01:03 - 2018-08-02 23:41 - 001008640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.MixedRealityCapture.dll
    2018-08-15 01:03 - 2018-08-02 22:49 - 000868864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.MixedRealityCapture.dll
    2018-08-15 01:03 - 2018-08-02 21:47 - 001034624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplyTrustOffline.exe
    2018-08-15 01:03 - 2018-08-02 21:47 - 000128920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\scmbus.sys
    2018-08-15 01:03 - 2018-08-02 21:46 - 000272296 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave.dll
    2018-08-15 01:03 - 2018-08-02 21:46 - 000269248 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave_secure.dll
    2018-08-15 01:03 - 2018-08-02 21:41 - 000568600 _____ (Microsoft Corporation) C:\WINDOWS\system32\tcblaunch.exe
    2018-08-15 01:03 - 2018-08-02 21:41 - 000077608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hvservice.sys
    2018-08-15 01:03 - 2018-08-02 21:41 - 000061736 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvhostsvc.dll
    2018-08-15 01:03 - 2018-08-02 21:40 - 001221048 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
    2018-08-15 01:03 - 2018-08-02 21:40 - 001064744 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
    2018-08-15 01:03 - 2018-08-02 21:40 - 001030952 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
    2018-08-15 01:03 - 2018-08-02 21:40 - 000566568 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
    2018-08-15 01:03 - 2018-08-02 21:40 - 000228136 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Ucx01000.sys
    2018-08-15 01:03 - 2018-08-02 21:40 - 000136488 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll
    2018-08-15 01:03 - 2018-08-02 21:40 - 000072800 _____ (Microsoft Corporation) C:\WINDOWS\system32\wldp.dll
    2018-08-15 01:03 - 2018-08-02 21:39 - 009091480 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
    2018-08-15 01:03 - 2018-08-02 21:39 - 007436120 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
    2018-08-15 01:03 - 2018-08-02 21:39 - 002829216 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
    2018-08-15 01:03 - 2018-08-02 21:39 - 001457136 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
    2018-08-15 01:03 - 2018-08-02 21:39 - 000709824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
    2018-08-15 01:03 - 2018-08-02 21:39 - 000692240 _____ (Microsoft Corporation) C:\WINDOWS\system32\StructuredQuery.dll
    2018-08-15 01:03 - 2018-08-02 21:39 - 000170936 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
    2018-08-15 01:03 - 2018-08-02 21:39 - 000114080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmbus.sys
    2018-08-15 01:03 - 2018-08-02 21:39 - 000075160 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vpci.sys
    2018-08-15 01:03 - 2018-08-02 21:39 - 000031648 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\winhv.sys
    2018-08-15 01:03 - 2018-08-02 21:38 - 002765440 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
    2018-08-15 01:03 - 2018-08-02 21:38 - 001945792 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
    2018-08-15 01:03 - 2018-08-02 21:38 - 001285536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys
    2018-08-15 01:03 - 2018-08-02 21:38 - 001258288 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
    2018-08-15 01:03 - 2018-08-02 21:38 - 001140576 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
    2018-08-15 01:03 - 2018-08-02 21:38 - 001097648 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvproc.dll
    2018-08-15 01:03 - 2018-08-02 21:38 - 000983016 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
    2018-08-15 01:03 - 2018-08-02 21:38 - 000885856 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
    2018-08-15 01:03 - 2018-08-02 21:38 - 000713368 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVideoDSP.dll
    2018-08-15 01:03 - 2018-08-02 21:38 - 000604576 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe
    2018-08-15 01:03 - 2018-08-02 21:38 - 000158720 _____ (Microsoft Corporation) C:\WINDOWS\system32\vertdll.dll
    2018-08-15 01:03 - 2018-08-02 21:38 - 000115640 _____ (Microsoft Corporation) C:\WINDOWS\system32\kdnet.dll
    2018-08-15 01:03 - 2018-08-02 21:27 - 000061032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wldp.dll
    2018-08-15 01:03 - 2018-08-02 21:26 - 006043600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
    2018-08-15 01:03 - 2018-08-02 21:25 - 002255008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
    2018-08-15 01:03 - 2018-08-02 21:25 - 001622296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
    2018-08-15 01:03 - 2018-08-02 21:25 - 001131064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvproc.dll
    2018-08-15 01:03 - 2018-08-02 21:25 - 000583120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVideoDSP.dll
    2018-08-15 01:03 - 2018-08-02 21:25 - 000568568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
    2018-08-15 01:03 - 2018-08-02 21:25 - 000539168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StructuredQuery.dll
    2018-08-15 01:03 - 2018-08-02 21:18 - 022007808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
    2018-08-15 01:03 - 2018-08-02 21:17 - 004380160 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeContent.dll
    2018-08-15 01:03 - 2018-08-02 21:16 - 000144384 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll
    2018-08-15 01:03 - 2018-08-02 21:15 - 008188928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
    2018-08-15 01:03 - 2018-08-02 21:15 - 000068096 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\winhvr.sys
    2018-08-15 01:03 - 2018-08-02 21:14 - 004867584 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
    2018-08-15 01:03 - 2018-08-02 21:14 - 000514560 _____ (Microsoft Corporation) C:\WINDOWS\system32\nltest.exe
    2018-08-15 01:03 - 2018-08-02 21:14 - 000209408 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXApplicabilityBlob.dll
    2018-08-15 01:03 - 2018-08-02 21:14 - 000113664 _____ (Microsoft Corporation) C:\WINDOWS\system32\WaaSAssessment.dll
    2018-08-15 01:03 - 2018-08-02 21:13 - 019404288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
    2018-08-15 01:03 - 2018-08-02 21:13 - 006661632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
    2018-08-15 01:03 - 2018-08-02 21:13 - 003395072 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
    2018-08-15 01:03 - 2018-08-02 21:13 - 000395776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Search.ProtocolHandler.MAPI2.dll
    2018-08-15 01:03 - 2018-08-02 21:12 - 003392000 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll
    2018-08-15 01:03 - 2018-08-02 21:12 - 002738688 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssrch.dll
    2018-08-15 01:03 - 2018-08-02 21:12 - 000894464 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll
    2018-08-15 01:03 - 2018-08-02 21:12 - 000761344 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
    2018-08-15 01:03 - 2018-08-02 21:12 - 000726528 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
    2018-08-15 01:03 - 2018-08-02 21:12 - 000311296 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netbt.sys
    2018-08-15 01:03 - 2018-08-02 21:11 - 007577088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
    2018-08-15 01:03 - 2018-08-02 21:11 - 003712000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
    2018-08-15 01:03 - 2018-08-02 21:11 - 002700288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll
    2018-08-15 01:03 - 2018-08-02 21:11 - 002172928 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
    2018-08-15 01:03 - 2018-08-02 21:11 - 001708544 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSPhotography.dll
    2018-08-15 01:03 - 2018-08-02 21:11 - 000983040 _____ (Microsoft Corporation) C:\WINDOWS\system32\wbiosrvc.dll
    2018-08-15 01:03 - 2018-08-02 21:11 - 000898560 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebFilter.dll
    2018-08-15 01:03 - 2018-08-02 21:11 - 000808448 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeManager.dll
    2018-08-15 01:03 - 2018-08-02 21:10 - 001535488 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
    2018-08-15 01:03 - 2018-08-02 21:09 - 005776896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
    2018-08-15 01:03 - 2018-08-02 21:09 - 004615680 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
    2018-08-15 01:03 - 2018-08-02 21:09 - 001932288 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgeangle.dll
    2018-08-15 01:03 - 2018-08-02 21:09 - 001854976 _____ (Microsoft Corporation) C:\WINDOWS\system32\wevtsvc.dll
    2018-08-15 01:03 - 2018-08-02 21:09 - 001550848 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
    2018-08-15 01:03 - 2018-08-02 21:09 - 001395200 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
    2018-08-15 01:03 - 2018-08-02 21:09 - 001361408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSPhotography.dll
    2018-08-15 01:03 - 2018-08-02 21:09 - 001057792 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchIndexer.exe
    2018-08-15 01:03 - 2018-08-02 21:09 - 000916480 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.Web.Core.dll
    2018-08-15 01:03 - 2018-08-02 21:08 - 002258944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssrch.dll
    2018-08-15 01:03 - 2018-08-02 21:08 - 002236928 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
    2018-08-15 01:03 - 2018-08-02 21:08 - 000796672 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssvp.dll
    2018-08-15 01:03 - 2018-08-02 21:08 - 000776192 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
    2018-08-15 01:03 - 2018-08-02 21:08 - 000608768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EdgeManager.dll
    2018-08-15 01:03 - 2018-08-02 21:08 - 000602112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll
    2018-08-15 01:03 - 2018-08-02 21:08 - 000561152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
    2018-08-15 01:03 - 2018-08-02 21:08 - 000542208 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
    2018-08-15 01:03 - 2018-08-02 21:08 - 000406528 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchProtocolHost.exe
    2018-08-15 01:03 - 2018-08-02 21:08 - 000331264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgeIso.dll
    2018-08-15 01:03 - 2018-08-02 21:07 - 000578560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll
    2018-08-15 01:03 - 2018-08-02 21:07 - 000505344 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgeIso.dll
    2018-08-15 01:03 - 2018-08-02 21:07 - 000176640 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssph.dll
    2018-08-15 01:03 - 2018-08-02 21:06 - 004191232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
    2018-08-15 01:03 - 2018-08-02 21:06 - 001000448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
    2018-08-15 01:03 - 2018-08-02 21:06 - 000856064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchIndexer.exe
    2018-08-15 01:03 - 2018-08-02 21:06 - 000678400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.Web.Core.dll
    2018-08-15 01:03 - 2018-08-02 21:06 - 000619520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WpcWebFilter.dll
    2018-08-15 01:03 - 2018-08-02 21:06 - 000251904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll
    2018-08-15 01:03 - 2018-08-02 21:05 - 000735744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssvp.dll
    2018-08-15 01:03 - 2018-08-02 21:05 - 000669696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
    2018-08-15 01:03 - 2018-08-02 21:05 - 000534016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
    2018-08-15 01:03 - 2018-08-02 21:04 - 000345088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchProtocolHost.exe
    2018-08-15 01:03 - 2018-07-14 18:58 - 000094112 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
    2018-08-15 01:03 - 2018-07-14 18:56 - 001523240 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
    2018-08-15 01:03 - 2018-07-14 18:44 - 006587392 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
    2018-08-15 01:03 - 2018-07-14 18:43 - 012710400 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
    2018-08-15 01:03 - 2018-07-14 18:42 - 008624128 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
    2018-08-15 01:03 - 2018-07-14 18:42 - 004708864 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.pcshell.dll
    2018-08-15 01:03 - 2018-07-14 18:41 - 000169984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.XamlHost.dll
    2018-08-15 01:03 - 2018-07-14 18:41 - 000075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProvSysprep.dll
    2018-08-15 01:03 - 2018-07-14 18:39 - 001787392 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_health.dll
    2018-08-15 01:03 - 2018-07-14 18:39 - 001605632 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
    2018-08-15 01:03 - 2018-07-14 18:38 - 002051584 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_fs.dll
    2018-08-15 01:03 - 2018-07-14 18:38 - 001180160 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
    2018-08-15 01:03 - 2018-07-14 18:38 - 001004032 _____ (Microsoft Corporation) C:\WINDOWS\system32\clusapi.dll
    2018-08-15 01:03 - 2018-07-14 18:38 - 000615936 _____ (Microsoft Corporation) C:\WINDOWS\system32\resutils.dll
    2018-08-15 01:03 - 2018-07-14 18:36 - 000091136 _____ (Microsoft Corporation) C:\WINDOWS\system32\mcbuilder.exe
    2018-08-15 01:03 - 2018-07-14 17:28 - 001327424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
    2018-08-15 01:03 - 2018-07-14 17:18 - 005657600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
    2018-08-15 01:03 - 2018-07-14 17:17 - 011901440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
    2018-08-15 01:03 - 2018-07-14 17:15 - 007987712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
    2018-08-15 01:03 - 2018-07-14 17:14 - 000133632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.XamlHost.dll
    2018-08-15 01:03 - 2018-07-14 17:13 - 001452544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_fs.dll
    2018-08-15 01:03 - 2018-07-14 17:13 - 001308160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_health.dll
    2018-08-15 01:03 - 2018-07-14 17:13 - 000775168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\clusapi.dll
    2018-08-15 01:03 - 2018-07-14 17:13 - 000485376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\resutils.dll
    2018-08-15 01:03 - 2018-07-14 17:11 - 000080384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mcbuilder.exe
    2018-08-15 01:03 - 2018-07-14 00:42 - 019525632 _____ (Microsoft Corporation) C:\WINDOWS\system32\HologramCompositor.dll
    2018-08-15 01:03 - 2018-07-13 22:37 - 000375712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys
    2018-08-15 01:03 - 2018-07-13 22:37 - 000230304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tpm.sys
    2018-08-15 01:03 - 2018-07-13 22:23 - 000760888 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecurityHealthService.exe
    2018-08-15 01:03 - 2018-07-13 22:22 - 006813744 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
    2018-08-15 01:03 - 2018-07-13 22:22 - 001144664 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfnetcore.dll
    2018-08-15 01:03 - 2018-07-13 22:22 - 000510392 _____ (Microsoft Corporation) C:\WINDOWS\system32\policymanager.dll
    2018-08-15 01:03 - 2018-07-13 22:22 - 000203560 _____ (Microsoft Corporation) C:\WINDOWS\system32\rsaenh.dll
    2018-08-15 01:03 - 2018-07-13 22:21 - 000722824 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
    2018-08-15 01:03 - 2018-07-13 22:21 - 000192920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\appid.sys
    2018-08-15 01:03 - 2018-07-13 22:20 - 000184472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rsaenh.dll
    2018-08-15 01:03 - 2018-07-13 22:19 - 002535032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
    2018-08-15 01:03 - 2018-07-13 22:19 - 001946752 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfplat.dll
    2018-08-15 01:03 - 2018-07-13 22:19 - 000981920 _____ (Microsoft Corporation) C:\WINDOWS\system32\LicenseManager.dll
    2018-08-15 01:03 - 2018-07-13 22:19 - 000636944 _____ (Microsoft Corporation) C:\WINDOWS\system32\services.exe
    2018-08-15 01:03 - 2018-07-13 22:19 - 000483024 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase_enclave.dll
    2018-08-15 01:03 - 2018-07-13 22:18 - 002563984 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
    2018-08-15 01:03 - 2018-07-13 22:18 - 002371416 _____ (Microsoft Corporation) C:\WINDOWS\system32\msmpeg2vdec.dll
    2018-08-15 01:03 - 2018-07-13 22:18 - 001017584 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase.dll
    2018-08-15 01:03 - 2018-07-13 22:18 - 000930712 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWAHost.exe
    2018-08-15 01:03 - 2018-07-13 22:18 - 000613176 _____ (Microsoft Corporation) C:\WINDOWS\system32\TextInputFramework.dll
    2018-08-15 01:03 - 2018-07-13 22:18 - 000443216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\policymanager.dll
    2018-08-15 01:03 - 2018-07-13 22:18 - 000376216 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fastfat.sys
    2018-08-15 01:03 - 2018-07-13 22:17 - 006527056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
    2018-08-15 01:03 - 2018-07-13 22:17 - 002420632 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
    2018-08-15 01:03 - 2018-07-13 22:17 - 000743320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LicenseManager.dll
    2018-08-15 01:03 - 2018-07-13 22:16 - 002331576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msmpeg2vdec.dll
    2018-08-15 01:03 - 2018-07-13 22:16 - 001143096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfnetcore.dll
    2018-08-15 01:03 - 2018-07-13 22:16 - 000506728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TextInputFramework.dll
    2018-08-15 01:03 - 2018-07-13 22:15 - 001559368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfplat.dll
    2018-08-15 01:03 - 2018-07-13 22:15 - 001174552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ucrtbase.dll
    2018-08-15 01:03 - 2018-07-13 22:15 - 000829856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWAHost.exe
    2018-08-15 01:03 - 2018-07-13 22:01 - 006647296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingMaps.dll
    2018-08-15 01:03 - 2018-07-13 21:59 - 009084928 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingMaps.dll
    2018-08-15 01:03 - 2018-07-13 21:59 - 005883392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mos.dll
    2018-08-15 01:03 - 2018-07-13 21:59 - 003553280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputService.dll
    2018-08-15 01:03 - 2018-07-13 21:58 - 000094720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataTimeUtil.dll
    2018-08-15 01:03 - 2018-07-13 21:57 - 007057920 _____ (Microsoft Corporation) C:\WINDOWS\system32\mos.dll
    2018-08-15 01:03 - 2018-07-13 21:57 - 004331008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
    2018-08-15 01:03 - 2018-07-13 21:57 - 001295360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVPXENC.dll
    2018-08-15 01:03 - 2018-07-13 21:57 - 000391168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\daxexec.dll
    2018-08-15 01:03 - 2018-07-13 21:56 - 004559872 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
    2018-08-15 01:03 - 2018-07-13 21:56 - 002900992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
    2018-08-15 01:03 - 2018-07-13 21:56 - 002697216 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.Controls.dll
    2018-08-15 01:03 - 2018-07-13 21:56 - 002449408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapRouter.dll
    2018-08-15 01:03 - 2018-07-13 21:56 - 001986560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapGeocoder.dll
    2018-08-15 01:03 - 2018-07-13 21:56 - 001703936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.Controls.dll
    2018-08-15 01:03 - 2018-07-13 21:56 - 001558016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpserverbase.dll
    2018-08-15 01:03 - 2018-07-13 21:56 - 000392704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapConfiguration.dll
    2018-08-15 01:03 - 2018-07-13 21:56 - 000365568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpencom.dll
    2018-08-15 01:03 - 2018-07-13 21:56 - 000257536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WiFiDisplay.dll
    2018-08-15 01:03 - 2018-07-13 21:56 - 000118784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\raschap.dll
    2018-08-15 01:03 - 2018-07-13 21:55 - 001627136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
    2018-08-15 01:03 - 2018-07-13 21:55 - 001124352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdprt.dll
    2018-08-15 01:03 - 2018-07-13 21:55 - 000993792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.Vpn.dll
    2018-08-15 01:03 - 2018-07-13 21:55 - 000458752 _____ (Microsoft Corporation) C:\WINDOWS\system32\cloudAP.dll
    2018-08-15 01:03 - 2018-07-13 21:55 - 000414720 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cldflt.sys
    2018-08-15 01:03 - 2018-07-13 21:55 - 000344576 _____ (Microsoft Corporation) C:\WINDOWS\system32\RasMediaManager.dll
    2018-08-15 01:03 - 2018-07-13 21:55 - 000317440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dhcpcore.dll
    2018-08-15 01:03 - 2018-07-13 21:55 - 000282624 _____ (Microsoft Corporation) C:\WINDOWS\system32\provops.dll
    2018-08-15 01:03 - 2018-07-13 21:55 - 000227840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\winnat.sys
    2018-08-15 01:03 - 2018-07-13 21:55 - 000208384 _____ (Microsoft Corporation) C:\WINDOWS\system32\provisioningcsp.dll
    2018-08-15 01:03 - 2018-07-13 21:55 - 000147456 _____ (Microsoft Corporation) C:\WINDOWS\system32\datamarketsvc.dll
    2018-08-15 01:03 - 2018-07-13 21:55 - 000119296 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataTimeUtil.dll
    2018-08-15 01:03 - 2018-07-13 21:55 - 000062976 _____ (Microsoft Corporation) C:\WINDOWS\system32\EASPolicyManagerBrokerHost.exe
    2018-08-15 01:03 - 2018-07-13 21:54 - 003319808 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
    2018-08-15 01:03 - 2018-07-13 21:54 - 002825728 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapGeocoder.dll
    2018-08-15 01:03 - 2018-07-13 21:54 - 001627136 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
    2018-08-15 01:03 - 2018-07-13 21:54 - 001537024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActiveSyncProvider.dll
    2018-08-15 01:03 - 2018-07-13 21:54 - 001307648 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVPXENC.dll
    2018-08-15 01:03 - 2018-07-13 21:54 - 000898560 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
    2018-08-15 01:03 - 2018-07-13 21:54 - 000729088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NMAA.dll
    2018-08-15 01:03 - 2018-07-13 21:54 - 000603648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PCPKsp.dll
    2018-08-15 01:03 - 2018-07-13 21:54 - 000530432 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapConfiguration.dll
    2018-08-15 01:03 - 2018-07-13 21:54 - 000444416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dmenrollengine.dll
    2018-08-15 01:03 - 2018-07-13 21:54 - 000409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpencom.dll
    2018-08-15 01:03 - 2018-07-13 21:54 - 000392192 _____ (Microsoft Corporation) C:\WINDOWS\system32\provengine.dll
    2018-08-15 01:03 - 2018-07-13 21:54 - 000358400 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\exfat.sys
    2018-08-15 01:03 - 2018-07-13 21:54 - 000352768 _____ (Microsoft Corporation) C:\WINDOWS\system32\dhcpcore.dll
    2018-08-15 01:03 - 2018-07-13 21:54 - 000262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\PushToInstall.dll
    2018-08-15 01:03 - 2018-07-13 21:54 - 000137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\raschap.dll
    2018-08-15 01:03 - 2018-07-13 21:54 - 000014336 _____ (Microsoft Corporation) C:\WINDOWS\system32\EasPolicyManagerBrokerPS.dll
    2018-08-15 01:03 - 2018-07-13 21:53 - 004770816 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputService.dll
    2018-08-15 01:03 - 2018-07-13 21:53 - 003381248 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapRouter.dll
    2018-08-15 01:03 - 2018-07-13 21:53 - 002368512 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebRuntimeManager.dll
    2018-08-15 01:03 - 2018-07-13 21:53 - 001825792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.CloudStore.dll
    2018-08-15 01:03 - 2018-07-13 21:53 - 001668096 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdprt.dll
    2018-08-15 01:03 - 2018-07-13 21:53 - 000713216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BingOnlineServices.dll
    2018-08-15 01:03 - 2018-07-13 21:53 - 000705024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MapControlCore.dll
    2018-08-15 01:03 - 2018-07-13 21:53 - 000681984 _____ (Microsoft Corporation) C:\WINDOWS\system32\WFDSConMgrSvc.dll
    2018-08-15 01:03 - 2018-07-13 21:53 - 000566272 _____ (Microsoft Corporation) C:\WINDOWS\system32\daxexec.dll
    2018-08-15 01:03 - 2018-07-13 21:53 - 000450560 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneCoreCommonProxyStub.dll
    2018-08-15 01:03 - 2018-07-13 21:53 - 000396800 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
    2018-08-15 01:03 - 2018-07-13 21:53 - 000220160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mdmregistration.dll
    2018-08-15 01:03 - 2018-07-13 21:52 - 000972800 _____ (Microsoft Corporation) C:\WINDOWS\system32\sysmain.dll
    2018-08-15 01:03 - 2018-07-13 21:52 - 000790528 _____ (Microsoft Corporation) C:\WINDOWS\system32\PCPKsp.dll
    2018-08-15 01:03 - 2018-07-13 21:52 - 000755712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Core.TextInput.dll
    2018-08-15 01:03 - 2018-07-13 21:52 - 000506880 _____ (Microsoft Corporation) C:\WINDOWS\system32\netprofmsvc.dll
    2018-08-15 01:03 - 2018-07-13 21:52 - 000311296 _____ (Microsoft Corporation) C:\WINDOWS\system32\WiFiDisplay.dll
    2018-08-15 01:03 - 2018-07-13 21:51 - 003376640 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkMobileSettings.dll
    2018-08-15 01:03 - 2018-07-13 21:51 - 002904576 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
    2018-08-15 01:03 - 2018-07-13 21:51 - 001804288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
    2018-08-15 01:03 - 2018-07-13 21:51 - 001747968 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpserverbase.dll
    2018-08-15 01:03 - 2018-07-13 21:51 - 001304064 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.Vpn.dll
    2018-08-15 01:03 - 2018-07-13 21:51 - 000491520 _____ (Microsoft Corporation) C:\WINDOWS\system32\defragsvc.dll
    2018-08-15 01:03 - 2018-07-13 21:51 - 000466432 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll
    2018-08-15 01:03 - 2018-07-13 21:50 - 001773056 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActiveSyncProvider.dll
    2018-08-15 01:03 - 2018-07-13 21:50 - 001457664 _____ (Microsoft Corporation) C:\WINDOWS\system32\dosvc.dll
    2018-08-15 01:03 - 2018-07-13 21:50 - 001359360 _____ (Microsoft Corporation) C:\WINDOWS\system32\lpasvc.dll
    2018-08-15 01:03 - 2018-07-13 21:50 - 001225216 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapsStore.dll
    2018-08-15 01:03 - 2018-07-13 21:50 - 000949760 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmsvc.dll
    2018-08-15 01:03 - 2018-07-13 21:50 - 000943616 _____ (Microsoft Corporation) C:\WINDOWS\system32\BingOnlineServices.dll
    2018-08-15 01:03 - 2018-07-13 21:50 - 000932352 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasmans.dll
    2018-08-15 01:03 - 2018-07-13 21:50 - 000884224 _____ (Microsoft Corporation) C:\WINDOWS\system32\NMAA.dll
    2018-08-15 01:03 - 2018-07-13 21:50 - 000522752 _____ (Microsoft Corporation) C:\WINDOWS\system32\dmenrollengine.dll
    2018-08-15 01:03 - 2018-07-13 21:49 - 000884736 _____ (Microsoft Corporation) C:\WINDOWS\system32\MapControlCore.dll
    2018-08-15 01:03 - 2018-07-12 22:30 - 002718624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
    2018-08-15 01:02 - 2018-08-03 02:24 - 000046592 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
    2018-08-15 01:02 - 2018-08-02 21:17 - 000010240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vmgid.sys
    2018-08-15 01:02 - 2018-08-02 21:16 - 000018432 _____ (Microsoft Corporation) C:\WINDOWS\system32\winshfhc.dll
    2018-08-15 01:02 - 2018-08-02 21:13 - 000154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
    2018-08-15 01:02 - 2018-08-02 21:10 - 000015872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winshfhc.dll
    2018-08-15 01:02 - 2018-08-02 21:08 - 000288768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Search.ProtocolHandler.MAPI2.dll
    2018-08-15 01:02 - 2018-08-02 21:07 - 000115712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
    2018-08-15 01:02 - 2018-08-02 19:54 - 000001312 _____ C:\WINDOWS\system32\tcbres.wim
    2018-08-15 01:02 - 2018-07-14 18:44 - 000064000 _____ (Microsoft Corporation) C:\WINDOWS\system32\iemigplugin.dll
    2018-08-15 01:02 - 2018-07-13 21:58 - 000172544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\enrollmentapi.dll
    2018-08-15 01:02 - 2018-07-13 21:58 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tzres.dll
    2018-08-15 01:02 - 2018-07-13 21:56 - 000073728 _____ (Microsoft Corporation) C:\WINDOWS\system32\WFDSConMgr.dll
    2018-08-15 01:02 - 2018-07-13 21:55 - 000582144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Core.TextInput.dll
    2018-08-15 01:02 - 2018-07-13 21:55 - 000205312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OneCoreCommonProxyStub.dll
    2018-08-15 01:02 - 2018-07-13 21:55 - 000204288 _____ (Microsoft Corporation) C:\WINDOWS\system32\enrollmentapi.dll
    2018-08-15 01:02 - 2018-07-13 21:55 - 000185856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mdmregistration.dll
    2018-08-15 01:02 - 2018-07-13 21:55 - 000002560 _____ (Microsoft Corporation) C:\WINDOWS\system32\tzres.dll
    2018-08-15 01:02 - 2018-07-13 21:50 - 000401920 _____ (Microsoft Corporation) C:\WINDOWS\system32\rascustom.dll
    2018-08-13 15:37 - 2018-08-13 15:37 - 000118284 _____ C:\Users\Office Administrator\Desktop\K9 Log 18-08-13.txt
    2018-08-13 15:29 - 2018-08-13 15:30 - 000001301 _____ C:\DelFix.txt
    2018-08-11 10:29 - 2018-08-11 10:29 - 007417040 _____ (Malwarebytes) C:\Users\Dave\Desktop\adwcleaner_7.2.2.exe
    2018-08-10 14:23 - 2018-08-10 14:23 - 000013964 _____ C:\Users\Office Administrator\Desktop\Forensics_180810-142309.txt
    2018-08-10 14:06 - 2018-08-10 14:06 - 000000000 ___HD C:\OneDriveTemp
    2018-08-10 11:54 - 2018-08-10 11:54 - 000000000 ____D C:\ProgramData\Emsisoft
    2018-08-10 11:52 - 2018-08-10 14:27 - 000000000 ____D C:\EEK
    2018-08-10 11:50 - 2018-08-10 11:51 - 353335496 _____ C:\Users\Dave\Desktop\EmsisoftEmergencyKit.exe
    2018-08-10 11:39 - 2018-08-10 11:49 - 000001415 _____ C:\Users\Dave\Desktop\180810 Malwarebytes Report.txt
    2018-08-10 01:57 - 2018-08-10 01:57 - 000011774 _____ C:\Users\Office Administrator\Desktop\rk_AAF2.tmp.txt
    2018-08-10 00:19 - 2018-08-10 00:19 - 000028272 _____ C:\WINDOWS\system32\Drivers\TrueSight.sys
    2018-08-10 00:18 - 2018-08-10 11:40 - 000000000 ____D C:\ProgramData\RogueKiller
    2018-08-10 00:18 - 2018-08-10 00:18 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RogueKiller
    2018-08-10 00:18 - 2018-08-10 00:18 - 000000000 ____D C:\Program Files\RogueKiller
    2018-08-10 00:16 - 2018-08-10 00:17 - 036798240 _____ (Adlice Software ) C:\Users\Dave\Desktop\RogueKiller_setup.exe
    2018-08-10 00:10 - 2018-08-10 00:10 - 000003156 _____ C:\WINDOWS\System32\Tasks\AdwCleaner_onReboot
    2018-08-09 23:46 - 2018-08-09 23:49 - 000040530 _____ C:\Users\Dave\Desktop\Fixlog.txt
    2018-08-09 10:44 - 2018-08-09 10:54 - 000000000 ____D C:\WINDOWS\Minidump
    2018-08-09 10:38 - 2018-08-09 10:38 - 005198336 _____ (AVAST Software) C:\Users\Dave\Desktop\aswMBR.exe
    2018-08-09 10:27 - 2018-08-09 10:29 - 000084822 _____ C:\Users\Dave\Desktop\Addition.txt
    2018-08-09 10:24 - 2018-08-28 22:46 - 000024098 _____ C:\Users\Dave\Desktop\FRST.txt
    2018-08-09 10:23 - 2018-08-28 22:45 - 002413056 _____ (Farbar) C:\Users\Dave\Desktop\FRST64.exe
    2018-08-09 10:20 - 2018-08-09 10:20 - 000017999 _____ C:\WINDOWS\Tweaking.com - Registry Backup Setup Log.txt
    2018-08-09 10:20 - 2018-08-09 10:20 - 000002314 _____ C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
    2018-08-09 10:20 - 2018-08-09 10:20 - 000000207 _____ C:\WINDOWS\tweaking.com-regbackup-2012_OFFICE-Windows-10-Home-(64-bit).dat
    2018-08-09 10:20 - 2018-08-09 10:20 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
    2018-08-09 10:20 - 2018-08-09 10:20 - 000000000 ____D C:\Program Files (x86)\Tweaking.com
    2018-08-09 10:18 - 2018-08-09 10:18 - 005766144 _____ (Tweaking.com) C:\Users\Dave\Desktop\tweaking.com_registry_backup_setup.exe
    2018-08-08 11:30 - 2018-08-08 11:31 - 000007794 _____ C:\Users\Dave\Downloads\Grateful Dead Releases by Date.txt
    2018-08-06 13:26 - 2018-08-06 13:26 - 000428662 _____ C:\Users\Dave\Downloads\Know Your Vehicle.pdf

    ==================== One Month Modified files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2018-08-28 22:47 - 2018-04-11 17:38 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
    2018-08-28 22:31 - 2012-06-19 10:07 - 000000000 ____D C:\Users\Dave\AppData\Roaming\vlc
    2018-08-28 22:19 - 2018-05-15 23:51 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
    2018-08-28 22:11 - 2018-05-16 00:43 - 000004158 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{CB1BE535-6F0F-4578-8662-9C0E1D1C3C7F}
    2018-08-28 19:59 - 2013-08-02 00:48 - 000000000 ____D C:\Users\Dave\Downloads\Dave's Phone
    2018-08-28 19:58 - 2018-01-25 00:57 - 000000000 ____D C:\Users\Dave\Downloads\Memes I Liked
    2018-08-28 06:57 - 2018-04-11 17:30 - 000000000 ____D C:\WINDOWS\CbsTemp
    2018-08-28 02:15 - 2018-04-11 17:38 - 000000000 ___HD C:\Program Files\WindowsApps
    2018-08-28 02:15 - 2018-04-11 17:38 - 000000000 ____D C:\WINDOWS\AppReadiness
    2018-08-26 11:04 - 2016-11-26 00:39 - 000000000 ____D C:\Users\Dave\AppData\LocalLow\Mozilla
    2018-08-26 11:03 - 2015-03-01 12:24 - 000000000 ____D C:\Program Files (x86)\Opera
    2018-08-26 11:01 - 2018-05-15 23:56 - 000968400 _____ C:\WINDOWS\system32\PerfStringBackup.INI
    2018-08-26 11:01 - 2018-04-11 17:36 - 000000000 ____D C:\WINDOWS\INF
    2018-08-26 10:59 - 2016-07-23 22:49 - 000000000 ___RD C:\Users\Dave\OneDrive
    2018-08-26 10:58 - 2012-06-28 14:05 - 000000000 ____D C:\Users\Dave\AppData\Local\CrashDumps
    2018-08-26 10:54 - 2018-05-16 00:43 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
    2018-08-26 10:53 - 2018-04-11 15:04 - 001310720 _____ C:\WINDOWS\system32\config\BBI
    2018-08-26 10:53 - 2015-08-03 11:34 - 000000000 ____D C:\Users\Dave\AppData\Roaming\Everything
    2018-08-26 10:35 - 2018-04-11 17:38 - 000000000 ____D C:\WINDOWS\LiveKernelReports
    2018-08-19 12:41 - 2016-02-15 01:00 - 000000000 ____D C:\Users\Dave\Downloads\Podcasts
    2018-08-18 11:04 - 2016-12-17 12:58 - 000000000 ____D C:\Program Files\Pale Moon
    2018-08-18 11:04 - 2013-06-11 13:27 - 000000968 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pale Moon.lnk
    2018-08-18 11:04 - 2013-06-11 13:27 - 000000956 _____ C:\Users\Public\Desktop\Pale Moon.lnk
    2018-08-17 08:00 - 2014-12-11 00:49 - 000000000 ____D C:\Users\Dave\AppData\Roaming\KeePass
    2018-08-15 17:34 - 2018-05-16 00:43 - 000004530 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player PPAPI Notifier
    2018-08-15 17:34 - 2018-04-11 17:38 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed
    2018-08-15 17:34 - 2018-04-11 17:38 - 000000000 ____D C:\WINDOWS\system32\Macromed
    2018-08-15 15:52 - 2016-06-10 11:22 - 000000000 ____D C:\Users\Dave\AppData\LocalLow\Temp
    2018-08-15 13:00 - 2017-12-23 20:18 - 000000000 ___RD C:\Users\Dave\3D Objects
    2018-08-15 13:00 - 2016-07-23 22:45 - 000000000 __RHD C:\Users\Public\AccountPictures
    2018-08-15 12:59 - 2018-05-15 23:51 - 000453184 _____ C:\WINDOWS\system32\FNTCACHE.DAT
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\zu-ZA
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\yo-NG
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\xh-ZA
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\wo-SN
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\uz-Latn-UZ
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\tn-ZA
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\ti-ET
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\tg-Cyrl-TJ
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\sr-Cyrl-RS
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\sr-Cyrl-BA
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\sd-Arab-PK
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\rw-RW
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\quc-Latn-GT
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\pa-Arab-PK
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\nso-ZA
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\ku-Arab-IQ
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\ig-NG
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\ha-Latn-NG
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\chr-CHER-US
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\ca-ES-valencia
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\bs-Latn-BA
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\SysWOW64\az-Latn-AZ
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\zu-ZA
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\yo-NG
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\xh-ZA
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\wo-SN
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\uz-Latn-UZ
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\tn-ZA
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\ti-ET
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\tg-Cyrl-TJ
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\sr-Cyrl-RS
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\sr-Cyrl-BA
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\sd-Arab-PK
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\rw-RW
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\quc-Latn-GT
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\pa-Arab-PK
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\nso-ZA
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\ku-Arab-IQ
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\ig-NG
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\ha-Latn-NG
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\chr-CHER-US
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\ca-ES-valencia
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\bs-Latn-BA
    2018-08-15 12:55 - 2018-04-12 03:19 - 000000000 ____D C:\WINDOWS\system32\az-Latn-AZ
    2018-08-15 12:55 - 2018-04-11 17:38 - 000000000 ___SD C:\WINDOWS\SysWOW64\F12
    2018-08-15 12:55 - 2018-04-11 17:38 - 000000000 ___SD C:\WINDOWS\system32\UNP
    2018-08-15 12:55 - 2018-04-11 17:38 - 000000000 ___SD C:\WINDOWS\system32\F12
    2018-08-15 12:55 - 2018-04-11 17:38 - 000000000 ___SD C:\WINDOWS\system32\DiagSvcs
    2018-08-15 12:55 - 2018-04-11 17:38 - 000000000 ___RD C:\WINDOWS\PrintDialog
    2018-08-15 12:55 - 2018-04-11 17:38 - 000000000 ___RD C:\Program Files\Windows Defender
    2018-08-15 12:55 - 2018-04-11 17:38 - 000000000 ____D C:\WINDOWS\TextInput
    2018-08-15 12:55 - 2018-04-11 17:38 - 000000000 ____D C:\WINDOWS\system32\ShellExperiences
    2018-08-15 12:55 - 2018-04-11 17:38 - 000000000 ____D C:\WINDOWS\ShellExperiences
    2018-08-15 12:55 - 2018-04-11 17:38 - 000000000 ____D C:\WINDOWS\bcastdvr
    2018-08-15 12:55 - 2018-04-11 17:38 - 000000000 ____D C:\Program Files (x86)\Windows Defender
    2018-08-15 12:54 - 2013-08-14 09:15 - 000000000 ____D C:\WINDOWS\system32\MRT
    2018-08-15 01:34 - 2018-05-16 00:43 - 000004578 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player NPAPI Notifier
    2018-08-15 01:17 - 2012-06-16 13:56 - 137343192 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
    2018-08-15 01:16 - 2009-07-13 20:34 - 000000478 _____ C:\WINDOWS\win.ini
    2018-08-13 15:30 - 2007-11-24 23:54 - 000000000 ____D C:\Program Files (x86)\Trend Micro
    2018-08-11 12:58 - 2018-05-16 00:43 - 000000000 ____D C:\WINDOWS\System32\Tasks\OfficeSoftwareProtectionPlatform
    2018-08-10 14:00 - 2012-06-26 18:29 - 000000000 ____D C:\Users\Dave\Downloads\Installed
    2018-08-10 11:41 - 2012-07-03 10:13 - 000000000 ____D C:\Program Files (x86)\SABnzbd
    2018-08-10 01:42 - 2009-07-13 21:20 - 000000000 ___HD C:\WINDOWS\system32\GroupPolicy
    2018-08-10 00:47 - 2018-05-16 00:43 - 000003368 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-4063716828-1680190529-1648852121-1000
    2018-08-10 00:47 - 2018-05-16 00:01 - 000002409 _____ C:\Users\Dave\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
    2018-08-10 00:11 - 2018-07-16 11:34 - 000253664 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
    2018-08-09 23:51 - 2014-11-18 23:12 - 000000008 __RSH C:\ProgramData\ntuser.pol
    2018-08-09 23:50 - 2018-05-16 00:01 - 000000000 ____D C:\Users\Dave
    2018-08-09 23:48 - 2016-10-20 23:14 - 000000000 ____D C:\Users\Ben\AppData\LocalLow\Temp
    2018-08-09 23:46 - 2018-04-11 17:38 - 000000000 ____D C:\WINDOWS\SysWOW64\GroupPolicy
    2018-08-09 23:45 - 2018-05-16 00:01 - 000000000 ____D C:\Users\Office Administrator
    2018-08-09 11:24 - 2018-05-16 00:43 - 000003962 _____ C:\WINDOWS\System32\Tasks\Opera scheduled Autoupdate 1425234319
    2018-08-09 11:24 - 2017-06-30 11:17 - 000001122 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera Browser.lnk
    2018-08-09 10:54 - 2012-06-16 13:55 - 000394057 ____N C:\WINDOWS\Minidump\080918-44281-01.dmp
    2018-08-09 10:44 - 2017-04-30 13:14 - 000000000 ____D C:\Program Files\Mozilla Firefox
    2018-08-09 10:44 - 2012-06-20 13:19 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
    2018-08-09 10:44 - 2012-06-16 13:55 - 000847649 ____N C:\WINDOWS\Minidump\080918-48140-01.dmp
    2018-08-09 10:05 - 2013-03-03 20:11 - 000001007 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
    2018-08-09 09:57 - 2018-06-29 12:48 - 000001307 _____ C:\Users\Dave\Desktop\Device Manager - Shortcut.lnk
    2018-08-08 22:58 - 2012-06-29 00:10 - 000002303 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
    2018-08-08 11:32 - 2018-07-09 23:11 - 000001106 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++.lnk
    2018-08-07 23:42 - 2016-05-13 18:01 - 000000000 ____D C:\Users\Dave\AppData\Roaming\GrabIt
    2018-08-06 10:03 - 2015-08-08 17:19 - 000001414 _____ C:\Users\Dave\Desktop\Everything.exe - Shortcut.lnk
    2018-08-06 09:19 - 2018-07-11 01:08 - 000836480 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
    2018-08-06 09:19 - 2018-07-11 01:08 - 000181120 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
    2018-08-02 14:26 - 2015-03-01 10:56 - 000000000 ____D C:\Users\Dave\AppData\Roaming\Apple Computer
    2018-07-31 10:44 - 2018-07-10 20:14 - 000000000 ____D C:\ProgramData\Packages
    2018-07-31 10:32 - 2018-02-27 22:40 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
    2018-07-29 11:14 - 2012-08-19 10:49 - 000000000 ____D C:\Users\Dave\Downloads\Posted Cartoons

    ==================== Files in the root of some directories =======

    2011-08-19 16:02 - 2011-06-09 17:44 - 000002792 _____ () C:\Program Files\HP SimplePass 2011
    2009-04-20 23:51 - 2007-12-14 19:33 - 000262144 _____ (ZoneAlarm) C:\Program Files (x86)\Uninstall Spy Blocker.dll
    2012-07-27 11:57 - 2012-07-27 11:57 - 000007859 _____ () C:\Users\Office Administrator\AppData\Roaming\pcouffin.cat
    2012-07-27 11:57 - 2012-07-27 11:57 - 000001167 _____ () C:\Users\Office Administrator\AppData\Roaming\pcouffin.inf
    2012-07-27 11:57 - 2012-07-27 11:57 - 000000034 _____ () C:\Users\Office Administrator\AppData\Roaming\pcouffin.log
    2012-07-27 11:57 - 2012-07-27 11:57 - 000082816 _____ (VSO Software) C:\Users\Office Administrator\AppData\Roaming\pcouffin.sys
    2012-10-13 19:45 - 2012-10-13 19:45 - 000000600 _____ () C:\Users\Office Administrator\AppData\Roaming\winscp.rnd

    Some files in TEMP:
    ====================
    2018-08-10 00:18 - 2018-07-06 01:25 - 001945784 _____ (Microsoft Corporation) C:\Users\Office Administrator\AppData\Local\Temp\dllnt_dump.dll

    ==================== Bamital & volsnap ======================

    (There is no automatic fix for files that do not pass verification.)

    C:\WINDOWS\system32\winlogon.exe => File is digitally signed
    C:\WINDOWS\system32\wininit.exe => File is digitally signed
    C:\WINDOWS\explorer.exe => File is digitally signed
    C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
    C:\WINDOWS\system32\svchost.exe => File is digitally signed
    C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
    C:\WINDOWS\system32\services.exe => File is digitally signed
    C:\WINDOWS\system32\User32.dll => File is digitally signed
    C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
    C:\WINDOWS\system32\userinit.exe => File is digitally signed
    C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
    C:\WINDOWS\system32\rpcss.dll => File is digitally signed
    C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
    C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
    C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

    LastRegBack: 2018-05-15 23:51

    ==================== End of FRST.txt ============================

    Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23.08.2018
    Ran by Office Administrator (28-08-2018 22:48:36)
    Running from C:\Users\Dave\Desktop
    Windows 10 Home Version 1803 17134.228 (X64) (2018-05-16 06:45:36)
    Boot Mode: Normal
    ==========================================================


    ==================== Accounts: =============================

    Administrator (S-1-5-21-4063716828-1680190529-1648852121-500 - Administrator - Disabled) => C:\Users\Administrator
    Ben (S-1-5-21-4063716828-1680190529-1648852121-1004 - Limited - Enabled) => C:\Users\Ben
    Dave (S-1-5-21-4063716828-1680190529-1648852121-1000 - Limited - Enabled) => C:\Users\Dave
    DefaultAccount (S-1-5-21-4063716828-1680190529-1648852121-503 - Limited - Disabled)
    Guest (S-1-5-21-4063716828-1680190529-1648852121-501 - Limited - Disabled)
    HomeGroupUser$ (S-1-5-21-4063716828-1680190529-1648852121-1002 - Limited - Enabled)
    Hope (S-1-5-21-4063716828-1680190529-1648852121-1003 - Limited - Enabled) => C:\Users\Hope
    Mary Jo (S-1-5-21-4063716828-1680190529-1648852121-1005 - Limited - Enabled) => C:\Users\Mary Jo
    Office Administrator (S-1-5-21-4063716828-1680190529-1648852121-1006 - Administrator - Enabled) => C:\Users\Office Administrator
    Rich (S-1-5-21-4063716828-1680190529-1648852121-1008 - Limited - Enabled) => C:\Users\Rich
    Share_with_Office (S-1-5-21-4063716828-1680190529-1648852121-1007 - Limited - Enabled) => C:\Users\Share_with_Office
    WDAGUtilityAccount (S-1-5-21-4063716828-1680190529-1648852121-504 - Limited - Disabled)

    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    ==================== Installed Programs ======================

    (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    µTorrent (HKLM-x32\...\uTorrent) (Version: 3.2.0 - )
    2017 Screen Saver (HKLM-x32\...\2017 Screen Saver_is1) (Version: - Access Analytic)
    4K YouTube to MP3 3.3 (HKLM-x32\...\{35F6F72F-08F5-4885-8B69-7A3C6C1F038E}) (Version: 3.3.5.1797 - Open Media LLC)
    802.11n Wireless LAN Card (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 3.01.18.0 - Ralink)
    Adobe Digital Editions 2.0 (HKLM-x32\...\Adobe Digital Editions 2.0) (Version: 2.0 - Adobe Systems Incorporated)
    Adobe Digital Editions 4.5 (HKLM-x32\...\Adobe Digital Editions 4.5) (Version: 4.5.4 - Adobe Systems Incorporated)
    Adobe Flash Player 30 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 30.0.0.154 - Adobe Systems Incorporated)
    Adobe Flash Player 30 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 30.0.0.154 - Adobe Systems Incorporated)
    Amazon Kindle (HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\...\Amazon Kindle) (Version: 1.20.1.47037 - Amazon)
    AnyDVD (HKLM-x32\...\AnyDVD) (Version: 7.5.3.0 - SlySoft)
    Apple Application Support (32-bit) (HKLM-x32\...\{E5347310-C82F-4833-AA36-8D11E5A8A86A}) (Version: 6.6 - Apple Inc.)
    Apple Application Support (64-bit) (HKLM\...\{D745E014-74DD-43A3-98DF-E7D38164B681}) (Version: 6.6 - Apple Inc.)
    Apple Mobile Device Support (HKLM\...\{C29B636B-9015-4ED1-A12F-6375A337F23B}) (Version: 11.4.1.46 - Apple Inc.)
    Apple Software Update (HKLM-x32\...\{A30EA700-5515-48F0-88B0-9E99DC356B88}) (Version: 2.6.0.1 - Apple Inc.)
    ArcSoft ShowBiz (HKLM-x32\...\{9D41D2EF-2D33-4CFD-8A3E-C7E6FCC3303B}) (Version: 3.5.13.64 - ArcSoft)
    Asterisk Key 10.0 (HKLM-x32\...\asterisk key) (Version: - )
    Audacity 2.0 (HKLM-x32\...\Audacity_is1) (Version: - Audacity Team)
    AVIcodec (remove only) (HKLM-x32\...\AVIcodec) (Version: - )
    Avidemux 2.6 (32-bit) (HKLM-x32\...\Avidemux 2.6) (Version: 2.6.1.8321 - )
    AviSynth 2.5 (HKLM-x32\...\AviSynth) (Version: - )
    Backup and Sync from Google (HKLM\...\{AEFBDB5B-899F-4AE6-B789-BA56A652A476}) (Version: 3.42.9858.3671 - Google, Inc.)
    Bandicam (HKLM-x32\...\Bandicam) (Version: 2.1.1.731 - Bandisoft.com)
    Bandisoft MPEG-1 Decoder (HKLM-x32\...\BandiMPEG1) (Version: - Bandisoft.com)
    Beyond Compare 4.2.2 (HKLM\...\BeyondCompare4_is1) (Version: 4.2.2.22384 - Scooter Software)
    Bing Bar (HKLM-x32\...\{3365E735-48A6-4194-9988-CE59AC5AE503}) (Version: 7.3.132.0 - Microsoft Corporation)
    Blue Coat K9 Web Protection (HKLM\...\Blue Coat K9 Web Protection) (Version: 4.3.188 - Blue Coat Systems, Inc.)
    Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
    calibre (HKLM-x32\...\{D2DCF339-7EBC-4D88-B515-A504297796EA}) (Version: 3.6.0 - Kovid Goyal)
    Canon MP Navigator EX 2.0 (HKLM-x32\...\MP Navigator EX 2.0) (Version: - )
    Canon Utilities Solution Menu (HKLM-x32\...\CanonSolutionMenu) (Version: - )
    CanoScan LiDE 200 Scanner Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ4807) (Version: - )
    Cisco AnyConnect Secure Mobility Client (HKLM-x32\...\Cisco AnyConnect Secure Mobility Client) (Version: 4.4.03034 - Cisco Systems, Inc.)
    Cisco AnyConnect Secure Mobility Client (HKLM-x32\...\{EB629A98-5E69-40E8-BA9E-C393899F959D}) (Version: 4.4.03034 - Cisco Systems, Inc.) Hidden
    Cisco Connect (HKLM-x32\...\Cisco Connect) (Version: 1.4.12334.0 - Cisco Consumer Products LLC)
    Cisco WebEx Meetings (HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\...\ActiveTouchMeetingClient) (Version: - Cisco WebEx LLC)
    CloneCD (HKLM-x32\...\CloneCD) (Version: - SlySoft)
    CloneDVD2 (HKLM-x32\...\CloneDVD2) (Version: 2.9.3.0 - Elaborate Bytes)
    Coupon Printer for Windows (HKLM-x32\...\Coupon Printer for Windows5.0.0.1) (Version: 5.0.0.1 - Coupons.com Incorporated)
    D3DX10 (HKLM-x32\...\{E09C4DB7-630C-4F06-A631-8EA7239923AF}) (Version: 15.4.2368.0902 - Microsoft) Hidden
    DjVuLibre DjView 3.5.27+4.10.4 (HKLM-x32\...\DjVuLibre+DjView) (Version: 3.5.27+4.10.4 - DjVuZone)
    Driver Install 64-Bit (HKLM-x32\...\{AA107568-1B58-407E-9867-D51F71C9F446}) (Version: 6.0.107.0 - China) Hidden
    Driver Install 64-Bit (HKLM-x32\...\InstallShield_{AA107568-1B58-407E-9867-D51F71C9F446}) (Version: 6.0.107.0 - China)
    EPubsoft Adobe PDF ePub DRM Removal 8.9.6 (HKLM-x32\...\{917CB2F3-7BAF-4E1E-9444-1241BF3D6B92}) (Version: 8.9.6 - EPUBSOFT)
    Eudora (HKLM-x32\...\{FC40342A-B862-4F02-9B85-EBC13BE78AD1}) (Version: 7.0 - )
    Everything 1.3.4.686 (x64) (HKLM\...\Everything) (Version: - )
    Exact Audio Copy 1.0beta3 (HKLM-x32\...\Exact Audio Copy) (Version: 1.0beta3 - Andre Wiethoff)
    EZ Grabber (HKLM-x32\...\{8543A572-5993-4101-BACC-C83884E183A4}) (Version: 2.00.0000 - EZ Grabber)
    f.lux (HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\...\Flux) (Version: - f.lux Software LLC)
    Family Tree Maker 2012 (HKLM-x32\...\{1CB0993B-1CD4-4A18-9C85-9732AFD9843F}) (Version: 21.0.452 - Ancestry.com, Inc.) Hidden
    Family Tree Maker 2012 (HKLM-x32\...\Family Tree Maker 2012) (Version: 21.0.452 - Ancestry.com, Inc.)
    FeedDemon (HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\...\FeedDemon_is1) (Version: 4.5.0.0 - NewsGator Technologies, Inc.)
    Flash Decompiler Trillix (HKLM-x32\...\Flash Decompiler Trillix_is1) (Version: 5.3 - Eltima Software)
    foobar2000 v1.3.10 (HKLM-x32\...\foobar2000) (Version: 1.3.10 - Peter Pawlowski)
    FormatFactory 3.0.1 (HKLM-x32\...\FormatFactory) (Version: 3.0.1 - Free Time)
    FREE EML File Viewer version v2.0 (HKLM-x32\...\{6B16A616-C931-4D4B-B1C5-E04F2D4DDD63}_is1) (Version: v2.0 - www.freeviewer.org)
    GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
    Gmail Backup (HKLM-x32\...\gmailbackup) (Version: - )
    GnuWin32: Wget-1.11.4-1 (HKLM-x32\...\Wget-1.11.4-1_is1) (Version: 1.11.4-1 - GnuWin32)
    Google Chrome (HKLM-x32\...\Google Chrome) (Version: 68.0.3440.106 - Google Inc.)
    Google Earth Plug-in (HKLM-x32\...\{57BB4801-61C8-4E74-9672-2160728A461E}) (Version: 7.1.5.1557 - Google)
    Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.17 - Google Inc.) Hidden
    Google Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.25.11 - Google Inc.) Hidden
    GrabIt 1.7.3 Beta (build 1010) (HKLM-x32\...\GrabIt_is1) (Version: - Ilan Shemes)
    HandBrake 0.9.6 (HKLM-x32\...\HandBrake) (Version: 0.9.6 - )
    Huffyuv AVI lossless video codec - MultiThread (Remove Only) (HKLM-x32\...\HuffyuvcodecMT) (Version: - )
    iCloud (HKLM\...\{82FCC407-A0E5-4B80-9241-5ABA78B61090}) (Version: 7.6.0.15 - Apple Inc.)
    ImageMagick 6.8.9-5 Q8 (64-bit) (2014-07-15) (HKLM\...\ImageMagick 6.8.9 Q8 (64-bit)_is1) (Version: 6.8.9 - ImageMagick Studio LLC)
    iMazing HEIC Converter version 1.0.5 (HKLM\...\{FA58AFA9-B210-409C-88F1-2A90D577C170}_is1) (Version: 1.0.5 - DigiDNA)
    Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
    Intel(R) Identity Protection Technology 1.1.2.0 (HKLM-x32\...\{C01A86F5-56E7-101F-9BC9-E3F1025EB779}) (Version: 1.1.2.0 - Intel Corporation)
    Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
    Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2291 - Intel Corporation)
    IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.32 - Irfan Skiljan)
    iTunes (HKLM\...\{36F365B3-05C2-455D-9D96-B73829DE046D}) (Version: 12.8.0.150 - Apple Inc.)
    Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
    JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
    JDownloader 0.9 (HKLM-x32\...\5513-1208-7298-9440) (Version: 0.9 - AppWork GmbH)
    Junk Mail filter update (HKLM-x32\...\{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}) (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    KeePass Password Safe 2.28 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.28 - Dominik Reichl)
    Lagarith Lossless Codec (1.3.27) (HKLM-x32\...\{F59AC46C-10C3-4023-882C-4212A92283B3}_is1) (Version: - )
    Lame ACM MP3 Codec (HKLM-x32\...\LameACM) (Version: - )
    LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version: - )
    Link Shell Extension (HKLM\...\HardlinkShellExt) (Version: 3.7.5.1 - Hermann Schinagl)
    Malwarebytes version 3.5.1.2522 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.5.1.2522 - Malwarebytes)
    MapWindow GIS (HKLM-x32\...\{0018DC60-E4CB-4884-81EC-52CF2BAF54EF}_is1) (Version: 4.8.8 - MapWindow GIS)
    Mathematica Extras 8.0 (2609412) (HKLM\...\A-WIN-Extras 8.0.4 2609412_is1) (Version: 8.0.4 - Wolfram Research, Inc.)
    MediaHuman YouTube to MP3 Converter version 3.9.8.10 (HKLM-x32\...\MediaHuman YouTube to MP3 Converter_is1) (Version: 3.9.8.10 - )
    MediaInfo 0.7.67 (HKLM\...\MediaInfo) (Version: 0.7.67 - MediaArea.net)
    MediaMonkey 4.1 (HKLM-x32\...\MediaMonkey_is1) (Version: 4.1 - Ventis Media Inc.)
    Mesh Runtime (HKLM-x32\...\{8C6D6116-B724-4810-8F2D-D047E6B7D68E}) (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
    Microsoft Mathematics (HKLM-x32\...\{4D090F70-6F08-4B60-9357-A1DFD4458F09}) (Version: 4.0 - Microsoft Corporation)
    Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
    Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
    Microsoft OneDrive (HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\...\OneDriveSetup.exe) (Version: 18.131.0701.0007 - Microsoft Corporation)
    Microsoft OneDrive (HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\...\OneDriveSetup.exe) (Version: 17.3.6943.0625 - Microsoft Corporation)
    Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation)
    Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
    Microsoft Sync Framework 2.0 Core Components (x64) ENU (HKLM\...\{8CCBEC22-D2DB-4DC9-A58A-E1A1F3A38C8A}) (Version: 2.0.1578.0 - Microsoft Corporation)
    Microsoft Sync Framework 2.0 Provider Services (x64) ENU (HKLM\...\{03AC245F-4C64-425C-89CF-7783C1D3AB2C}) (Version: 2.0.1578.0 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
    Mozilla Firefox 61.0.2 (x64 en-US) (HKLM\...\Mozilla Firefox 61.0.2 (x64 en-US)) (Version: 61.0.2 - Mozilla)
    Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 57.0 - Mozilla)
    MP4Tools v3.1 (HKLM-x32\...\MP4Tools_is1) (Version: - )
    MuseScore 2 (HKLM-x32\...\{703926DE-F24B-11E4-AA68-472FB664A5DC}) (Version: 2.0.1 - Werner Schweer and Others)
    Neat Video v3.0 Demo plug-in for VirtualDub (32-bit) (HKLM-x32\...\Neat Video for VirtualDub (32-bit)_is1) (Version: - Neat Video team, ABSoft)
    Network Stumbler 0.4.0 (remove only) (HKLM-x32\...\Network Stumbler) (Version: - )
    NirSoft VideoCacheView (HKLM-x32\...\NirSoft VideoCacheView) (Version: - )
    NLOGIT 4.0 (HKLM-x32\...\{162D8CCE-79C2-4587-A026-22B8D8B73015}) (Version: 04.00.0001 - Econometric Software, Inc.)
    Notepad++ (32-bit x86) (HKLM-x32\...\Notepad++) (Version: 7.5.8 - Notepad++ Team)
    NZBLeecher (HKLM-x32\...\NZBLeecher) (Version: - )
    Open Live Writer (HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\...\OpenLiveWriter) (Version: 0.6.2 - Open Live Writer)
    Opera Stable 54.0.2952.71 (HKLM-x32\...\Opera 54.0.2952.71) (Version: 54.0.2952.71 - Opera Software)
    paint.net (HKLM\...\{E8FA8815-3817-4128-A814-E2EAC456ADF0}) (Version: 4.0.21 - dotPDN LLC)
    Pale Moon 27.0.2 (x86 en-US) (HKLM-x32\...\Pale Moon 27.0.2 (x86 en-US)) (Version: 27.0.2 - Moonchild Productions)
    Pale Moon 28.0.0 (x64 en-US) (HKLM\...\Pale Moon 28.0.0 (x64 en-US)) (Version: 28.0.0 - Moonchild Productions)
    PaperCut Print Logger 1.10 (HKLM-x32\...\PaperCut Print Logger_is1) (Version: - PaperCut Software Int. Pty. Ltd.)
    PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.4.1 - Frank Heindörfer, Philip Chinery)
    PdfMerge (HKLM-x32\...\{1CD59184-5172-4899-BAE4-4F06D57B2004}) (Version: 1.19.0 - PdfMerge)
    PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.203.0 - Tracker Software Products Ltd)
    PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
    PlayReady PC Runtime x86 (HKLM-x32\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)
    Plex Media Server (HKLM-x32\...\{16eca963-68c5-4756-80f9-db9094a4d6f0}) (Version: 0.9.1104 - Plex, Inc.)
    Plex Media Server (HKLM-x32\...\{A6BF4853-41E9-4DA1-AD81-4B16FEE938C2}) (Version: 0.9.1104 - Plex, Inc.) Hidden
    POV-Ray for Windows v3.6.1c (HKLM-x32\...\POV-Ray for Windows v3.6) (Version: 3.6 - Persistence of Vision Raytracer Pty. Ltd.)
    Power2Go (HKLM-x32\...\{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.5331 - CyberLink Corp.) Hidden
    Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.5331 - CyberLink Corp.)
    QuickPar 0.9 (HKLM-x32\...\QuickPar) (Version: 0.9 - Peter B. Clements)
    Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6662 - Realtek Semiconductor Corp.)
    Recovery Manager (HKLM-x32\...\{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}) (Version: 5.5.0.4320 - CyberLink Corp.) Hidden
    Recuva (HKLM\...\Recuva) (Version: 1.53 - Piriform)
    Respondus 4.0 Campus-Wide (HKLM-x32\...\{8DB14A0D-7D84-46B3-AEE4-D265729C78BD}) (Version: 4.00.0000 - Respondus, Inc.)
    Respondus LockDown Browser 2 (HKLM-x32\...\{BBC7F69B-7A94-41E9-8A4B-B55A8D06431F}) (Version: 2.00.0000 - Respondus)
    RogueKiller version 12.12.30.0 (HKLM\...\8B3D7924-ED89-486B-8322-E8594065D5CB_is1) (Version: 12.12.30.0 - Adlice Software)
    Samsung USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.59.0 - Samsung Electronics Co., Ltd.)
    screen-scraper Basic Edition (HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\...\5814-3494-4319-2342) (Version: 7.0 - ekiwi, LLC)
    Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
    Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
    Smart Switch (HKLM-x32\...\{74FA5314-85C8-4E2A-907D-D9ECCCB770A7}) (Version: 4.1.16052.2 - Samsung Electronics Co., Ltd.) Hidden
    Smart Switch (HKLM-x32\...\InstallShield_{74FA5314-85C8-4E2A-907D-D9ECCCB770A7}) (Version: 4.1.16052.2 - Samsung Electronics Co., Ltd.)
    Snagit 12 (HKLM-x32\...\{B298CE4A-880B-4D6E-8987-2D8A616BF568}) (Version: 12.0.0 - TechSmith Corporation) Hidden
    Snagit 12 (HKLM-x32\...\{bdac23f5-7943-42cf-ba56-4732fc20b6a7}) (Version: 12.0.0.1001 - TechSmith Corporation)
    SyncToy 2.1 (x64) (HKLM\...\{88DAAF05-5A72-46D2-A7C5-C3759697E943}) (Version: 2.1.0 - Microsoft)
    ThumbNailer (HKLM\...\{4FF14ED2-7B23-4EBF-A88B-CAE3590F9388}) (Version: 10.1.0.10 - Smaller Animals Software) Hidden
    ThumbNailer 10 (HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\...\ThumbNailer 10.1.0.10) (Version: 10.1.0.10 - Smaller Animals Software)
    TreeSize Free V2.7 (HKLM-x32\...\TreeSize Free_is1) (Version: 2.7 - JAM Software)
    Tweaking.com - Registry Backup (HKLM-x32\...\Tweaking.com - Registry Backup) (Version: 3.5.3 - Tweaking.com)
    Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\...\{DE083343-D24D-4495-919E-18C65EC0F289}) (Version: 2.8.0.0 - Microsoft Corporation)
    Verizon Cloud (HKLM\...\Verizon Cloud) (Version: 16.1.8.13 - Verizon)
    VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.4 - VideoLAN)
    VSO Inspector 2.0.2 (HKLM-x32\...\VSO Inspector_is1) (Version: - VSO-Software SARL)
    WD Link (HKLM-x32\...\WD Link) (Version: 1.00.03 - Western Digital)
    WebP Codec for Windows 0.19 (HKLM\...\{9D2F4EB8-98AD-4C8B-A0C5-4C114B3F1287}) (Version: 0.19.9 - Google Inc)
    Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
    Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
    Windows Media Encoder 9 Series (HKLM-x32\...\Windows Media Encoder 9) (Version: - )
    WinRAR 4.20 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
    WinRAR 5.60 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.60.0 - win.rar GmbH)
    WinSCP 5.1 (HKLM-x32\...\winscp3_is1) (Version: 5.1 - Martin Prikryl)
    Wolfram CDF Player (M-WIN-D 8.0.4 2609533) (HKLM-x32\...\M-WIN-D 8.0.4 2609533_is1) (Version: 8.0.4 - Wolfram Research, Inc.)

    ==================== Custom CLSID (Whitelisted): ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files\Google\Drive\googledrivesync64.dll [2018-05-30] (Google)
    ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files\Google\Drive\googledrivesync64.dll [2018-05-30] (Google)
    ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files\Google\Drive\googledrivesync64.dll [2018-05-30] (Google)
    ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => -> No File
    ShellIconOverlayIdentifiers: [ SncrOverlays (Blocked)] -> {C418E880-6280-4010-A888-FD76028E5511} => C:\Program Files\Verizon\Verizon Cloud\x64\Sncr.Overlays.dll [2016-10-10] (Synchronoss Technologies Inc.)
    ShellIconOverlayIdentifiers: [ SncrOverlays (InSync)] -> {5F4A6070-DB92-4C56-A487-F3850430608F} => C:\Program Files\Verizon\Verizon Cloud\x64\Sncr.Overlays.dll [2016-10-10] (Synchronoss Technologies Inc.)
    ShellIconOverlayIdentifiers: [ SncrOverlays (Pending)] -> {EE73A341-C788-4A6B-B1EF-DDBFC0F190B6} => C:\Program Files\Verizon\Verizon Cloud\x64\Sncr.Overlays.dll [2016-10-10] (Synchronoss Technologies Inc.)
    ShellIconOverlayIdentifiers: [ SncrOverlays (Syncing)] -> {28CDCD88-B179-49D6-8B21-1A9AF9C0AE13} => C:\Program Files\Verizon\Verizon Cloud\x64\Sncr.Overlays.dll [2016-10-10] (Synchronoss Technologies Inc.)
    ShellIconOverlayIdentifiers: [HardLinkMenu] -> {0A479751-02BC-11d3-A855-0004AC2568AA} => C:\Program Files\LinkShellExtension\HardlinkShellExt.dll [2013-08-23] (Hermann Schinagl)
    ShellIconOverlayIdentifiers: [IconOverlayHardLink] -> {0A479751-02BC-11d3-A855-0004AC2568DD} => C:\Program Files\LinkShellExtension\HardlinkShellExt.dll [2013-08-23] (Hermann Schinagl)
    ShellIconOverlayIdentifiers: [IconOverlaySymbolicLink] -> {0A479751-02BC-11d3-A855-0004AC2568EE} => C:\Program Files\LinkShellExtension\HardlinkShellExt.dll [2013-08-23] (Hermann Schinagl)
    ShellIconOverlayIdentifiers-x32: [ SncrOverlays (Blocked)] -> {C418E880-6280-4010-A888-FD76028E5511} => C:\Program Files\Verizon\Verizon Cloud\x64\Sncr.Overlays.dll [2016-10-10] (Synchronoss Technologies Inc.)
    ShellIconOverlayIdentifiers-x32: [ SncrOverlays (InSync)] -> {5F4A6070-DB92-4C56-A487-F3850430608F} => C:\Program Files\Verizon\Verizon Cloud\x64\Sncr.Overlays.dll [2016-10-10] (Synchronoss Technologies Inc.)
    ShellIconOverlayIdentifiers-x32: [ SncrOverlays (Pending)] -> {EE73A341-C788-4A6B-B1EF-DDBFC0F190B6} => C:\Program Files\Verizon\Verizon Cloud\x64\Sncr.Overlays.dll [2016-10-10] (Synchronoss Technologies Inc.)
    ShellIconOverlayIdentifiers-x32: [ SncrOverlays (Syncing)] -> {28CDCD88-B179-49D6-8B21-1A9AF9C0AE13} => C:\Program Files\Verizon\Verizon Cloud\x64\Sncr.Overlays.dll [2016-10-10] (Synchronoss Technologies Inc.)
    ShellIconOverlayIdentifiers-x32: [HardLinkMenu] -> {0A479751-02BC-11d3-A855-0004AC2568AA} => C:\Program Files\LinkShellExtension\HardlinkShellExt.dll [2013-08-23] (Hermann Schinagl)
    ShellIconOverlayIdentifiers-x32: [IconOverlayHardLink] -> {0A479751-02BC-11d3-A855-0004AC2568DD} => C:\Program Files\LinkShellExtension\HardlinkShellExt.dll [2013-08-23] (Hermann Schinagl)
    ShellIconOverlayIdentifiers-x32: [IconOverlaySymbolicLink] -> {0A479751-02BC-11d3-A855-0004AC2568EE} => C:\Program Files\LinkShellExtension\HardlinkShellExt.dll [2013-08-23] (Hermann Schinagl)
    ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} => C:\Program Files (x86)\Notepad++\NppShell_06.dll [2018-07-22] ()
    ContextMenuHandlers1: [CirrusShellEx] -> {57FA2D12-D22D-490A-805A-5CB48E84F12A} => C:\My Program Files (x86)\Beyond Compare 4\BCShellEx64.dll [2017-05-18] (Scooter Software)
    ContextMenuHandlers1: [GDContextMenu] -> {BB02B294-8425-42E5-983F-41A1FA970CD6} => C:\Program Files\Google\Drive\contextmenu64.dll [2018-05-30] (Google)
    ContextMenuHandlers1: [HardLinkMenu] -> {0A479751-02BC-11d3-A855-0004AC2568AA} => C:\Program Files\LinkShellExtension\HardlinkShellExt.dll [2013-08-23] (Hermann Schinagl)
    ContextMenuHandlers1: [Notepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} => C:\Program Files (x86)\Notepad++\NppShell_06.dll [2018-07-22] ()
    ContextMenuHandlers1: [PhotoStreamsExt] -> {89D984B3-813B-406A-8298-118AFA3A22AE} => C:\Program Files\Common Files\Apple\Internet Services\ShellStreams64.dll [2018-06-26] (Apple Inc.)
    ContextMenuHandlers1: [SnagItMainShellExt] -> {CF74B903-3389-469c-B3B6-0204D204FCBD} => C:\Program Files (x86)\TechSmith\Snagit 12\DLLx64\SnagitShellExt64.dll [2014-04-18] (TechSmith Corporation)
    ContextMenuHandlers1: [VerizonCtxMenu] -> {8CA825D9-C7DB-4833-9901-E7400521CE04} => C:\Program Files\Verizon\Verizon Cloud\x64\Sncr.ContextMenus.dll [2016-10-10] (Synchronoss Technologies Inc.)
    ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2018-06-24] (Alexander Roshal)
    ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2018-06-24] (Alexander Roshal)
    ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-05-03] (Malwarebytes)
    ContextMenuHandlers4: [CirrusShellEx] -> {57FA2D12-D22D-490A-805A-5CB48E84F12A} => C:\My Program Files (x86)\Beyond Compare 4\BCShellEx64.dll [2017-05-18] (Scooter Software)
    ContextMenuHandlers4: [GDContextMenu] -> {BB02B294-8425-42E5-983F-41A1FA970CD6} => C:\Program Files\Google\Drive\contextmenu64.dll [2018-05-30] (Google)
    ContextMenuHandlers4: [RecuvaShellExt] -> {435E5DF5-2510-463C-B223-BDA47006D002} => C:\Program Files\Recuva\RecuvaShell64.dll [2016-06-06] (Piriform Ltd)
    ContextMenuHandlers4: [SnagItMainShellExt] -> {CF74B903-3389-469c-B3B6-0204D204FCBD} => C:\Program Files (x86)\TechSmith\Snagit 12\DLLx64\SnagitShellExt64.dll [2014-04-18] (TechSmith Corporation)
    ContextMenuHandlers4: [VerizonCtxMenu] -> {8CA825D9-C7DB-4833-9901-E7400521CE04} => C:\Program Files\Verizon\Verizon Cloud\x64\Sncr.ContextMenus.dll [2016-10-10] (Synchronoss Technologies Inc.)
    ContextMenuHandlers5: [HardLinkMenu] -> {0A479751-02BC-11d3-A855-0004AC2568AA} => C:\Program Files\LinkShellExtension\HardlinkShellExt.dll [2013-08-23] (Hermann Schinagl)
    ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => C:\WINDOWS\system32\igfxpph.dll [2017-03-09] (Intel Corporation)
    ContextMenuHandlers5: [VerizonCtxMenu] -> {8CA825D9-C7DB-4833-9901-E7400521CE04} => C:\Program Files\Verizon\Verizon Cloud\x64\Sncr.ContextMenus.dll [2016-10-10] (Synchronoss Technologies Inc.)
    ContextMenuHandlers6: [CirrusShellEx] -> {57FA2D12-D22D-490A-805A-5CB48E84F12A} => C:\My Program Files (x86)\Beyond Compare 4\BCShellEx64.dll [2017-05-18] (Scooter Software)
    ContextMenuHandlers6: [HardLinkMenu] -> {0A479751-02BC-11d3-A855-0004AC2568AA} => C:\Program Files\LinkShellExtension\HardlinkShellExt.dll [2013-08-23] (Hermann Schinagl)
    ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2018-05-03] (Malwarebytes)
    ContextMenuHandlers6: [RecuvaShellExt] -> {435E5DF5-2510-463C-B223-BDA47006D002} => C:\Program Files\Recuva\RecuvaShell64.dll [2016-06-06] (Piriform Ltd)
    ContextMenuHandlers6: [VerizonCtxMenu] -> {8CA825D9-C7DB-4833-9901-E7400521CE04} => C:\Program Files\Verizon\Verizon Cloud\x64\Sncr.ContextMenus.dll [2016-10-10] (Synchronoss Technologies Inc.)
    ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2018-06-24] (Alexander Roshal)
    ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2018-06-24] (Alexander Roshal)

    ==================== Scheduled Tasks (Whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    Task: {042937CB-5476-4C2A-8480-C5E036578E2B} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\WINDOWS\ehome\ehPrivJob.exe
    Task: {22B36131-D912-447F-8E3A-93B96D768A49} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\WINDOWS\ehome\ehrec.exe
    Task: {35A742C1-2971-4943-A2E3-29AD462FFAAC} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\WINDOWS\ehome\ehPrivJob.exe
    Task: {3ACF76E4-F5DF-431C-BEA2-BE70CF85AE6D} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
    Task: {3F0B4EA2-4D7B-4D23-876A-75BCC92FE9AF} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2018-08-15] (Adobe Systems Incorporated)
    Task: {40916EEB-6F1E-4999-9E15-7F491478CD18} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)
    Task: {442A0DF8-035C-4EC9-9586-E841BDA7E761} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1807.18075-0\MpCmdRun.exe [2018-07-31] (Microsoft Corporation)
    Task: {448270B0-5154-498D-B24D-AE71E7DB5927} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\WINDOWS\ehome\ehPrivJob.exe
    Task: {4BC2A2DA-AFD4-4150-A965-394C5A98BC48} - System32\Tasks\SetupManager => C:\Program Files (x86)\Hewlett-Packard\Setup Manager\toaster.exe
    Task: {4EF9C94A-BEB8-4886-8EFB-6F8DC72DE967} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\WINDOWS\ehome\ehPrivJob.exe
    Task: {53ABC437-1B0B-41C8-BFA8-0949927B2CAE} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\WINDOWS\ehome\ehPrivJob.exe
    Task: {55FDF64B-3C5A-49F4-9EC4-597B575CA285} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\WINDOWS\ehome\ehPrivJob.exe
    Task: {60C6872D-D8C5-4B88-8980-45D08F81447E} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\WINDOWS\ehome\mcupdate.exe
    Task: {65B85F6F-35B3-4459-A179-28255D5B7B25} - System32\Tasks\Microsoft\Windows\HelloFace\FODCleanupTask => C:\WINDOWS\System32\WinBioPlugIns\FaceFodUninstaller.exe [2018-04-11] ()
    Task: {66373DB8-4A8D-49A8-88A9-7AC45A9257AE} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\WINDOWS\ehome\MCUpdate.exe
    Task: {6F313266-B64D-44AE-A7BB-DE6293968188} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\WINDOWS\ehome\mcupdate.exe
    Task: {76028AB5-AC97-4F06-8327-7D5A47A19935} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\WINDOWS\ehome\ehPrivJob.exe
    Task: {8019363D-BCAD-4773-B90D-F17D42075CBA} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
    Task: {8D77A25D-FD6A-481A-B0D6-9678902CB9A5} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\WINDOWS\ehome\mcupdate.exe
    Task: {962F44DF-9C5B-4695-A5B2-B3B13C819136} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1807.18075-0\MpCmdRun.exe [2018-07-31] (Microsoft Corporation)
    Task: {97D57FBC-B035-440C-88E7-9E676CD64057} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\WINDOWS\ehome\ehPrivJob.exe
    Task: {9EE88514-786B-4C6B-B761-AD00A3815399} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\WINDOWS\ehome\ehrec.exe
    Task: {A1F811BD-AFE5-40CD-B189-BEC191A3CDD1} - System32\Tasks\Opera scheduled Autoupdate 1425234319 => C:\Program Files (x86)\Opera\launcher.exe [2018-08-06] (Opera Software)
    Task: {AAAF2967-9FCF-4FE5-B8ED-82D0D1916F31} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1807.18075-0\MpCmdRun.exe [2018-07-31] (Microsoft Corporation)
    Task: {ABE81196-0AAC-419A-993A-CA0F9FA7E738} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
    Task: {B0783751-AFAE-4BFF-B02A-3C74BBADC98E} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\WINDOWS\ehome\ehPrivJob.exe
    Task: {BB891099-3F04-45DA-8DFA-066AB33B0F7D} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\WINDOWS\ehome\ehPrivJob.exe
    Task: {C0F395F2-9715-4314-A840-2E6C417F6A32} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\WINDOWS\ehome\ehPrivJob.exe
    Task: {C1C94E11-56D4-42FD-B052-F12EAEB7E8A4} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)
    Task: {C29AFA7A-269B-4DEC-95F3-09270AAEC4FB} - System32\Tasks\Adobe Flash Player NPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_30_0_0_154_Plugin.exe [2018-08-15] (Adobe Systems Incorporated)
    Task: {C6429797-F491-4F5C-BD36-6AC08CF60D18} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\WINDOWS\ehome\ehPrivJob.exe
    Task: {DC0B13A5-A3AF-44DB-A8AF-45ED1E90A3D1} - System32\Tasks\TechSmith Updater => C:\Program Files (x86)\Common Files\TechSmith Shared\Updater\TSCUpdClt.exe [2014-04-17] (TechSmith Corporation)
    Task: {DD8F35AB-434A-41DE-9AD1-1257D3D4E48B} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2018-01-08] (Apple Inc.)
    Task: {E40AF1E4-E26D-4DF8-BF69-C3737ACB46AC} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => c:\Program Files\Microsoft Security Client\MpCmdRun.exe
    Task: {E4E1AB3F-C6DC-443F-A040-1F71DC7EA004} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1807.18075-0\MpCmdRun.exe [2018-07-31] (Microsoft Corporation)
    Task: {EE44F1BC-3A65-4249-BBAC-F4DEB17CDF61} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
    Task: {F2511BEE-366D-49C8-BB06-D1D74AAAE162} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\WINDOWS\ehome\ehPrivJob.exe
    Task: {FE713D77-2EF1-4348-86DE-E0815C71AAD4} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_30_0_0_154_pepper.exe [2018-08-15] (Adobe Systems Incorporated)
    Task: {FF39504A-D292-4D33-BB14-3944FA41D129} - System32\Tasks\AdwCleaner_onReboot => C:\Users\Dave\Desktop\AdwCleaner.exe

    (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


    ==================== Shortcuts & WMI ========================

    (The entries could be listed to be restored or removed.)


    ==================== Loaded Modules (Whitelisted) ==============

    2018-01-05 00:14 - 2018-01-05 00:14 - 000088888 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
    2018-06-23 06:56 - 2018-06-23 06:56 - 001356088 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
    2015-08-03 10:45 - 2014-08-05 19:04 - 001441792 _____ () C:\Program Files\Everything\Everything.exe
    2018-05-15 16:00 - 2018-07-16 11:34 - 002433744 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SelfProtectionSdk.dll
    2013-08-05 00:15 - 2013-08-05 00:15 - 000070712 _____ () c:\windows\system32\bdmpega64.acm
    2018-04-11 17:34 - 2018-04-11 17:34 - 000491744 _____ () C:\WINDOWS\SYSTEM32\inputhost.dll
    2004-09-30 12:15 - 2004-09-30 12:15 - 000192000 _____ () C:\Program Files\LinkShellExtension\RockallDLL.dll
    2018-04-11 17:34 - 2018-04-11 17:34 - 000472064 _____ () C:\Windows\ShellExperiences\TileControl.dll
    2018-04-11 17:34 - 2018-04-11 17:34 - 002759168 _____ () C:\Windows\ShellComponents\TaskFlowUI.dll
    2018-07-22 18:14 - 2018-07-22 18:14 - 000230064 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
    2018-08-15 01:03 - 2018-08-02 21:09 - 002185728 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
    2018-07-17 15:13 - 2018-07-17 15:13 - 000086528 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1815.210.0_x64__kzf8qxf38zg5c\SkypeHost.exe
    2018-07-17 15:13 - 2018-07-17 15:13 - 000195072 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1815.210.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
    2018-07-17 15:13 - 2018-07-17 15:14 - 022373888 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1815.210.0_x64__kzf8qxf38zg5c\SkyWrap.dll
    2018-07-17 15:13 - 2018-07-17 15:13 - 002610176 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_12.1815.210.0_x64__kzf8qxf38zg5c\skypert.dll
    2018-08-10 12:04 - 2018-08-10 12:04 - 035124224 _____ () C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18071.11811.0_x64__8wekyb3d8bbwe\Video.UI.exe
    2018-08-10 12:04 - 2018-08-10 12:04 - 000290816 _____ () C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18071.11811.0_x64__8wekyb3d8bbwe\SharedUI.dll
    2018-08-10 12:04 - 2018-08-10 12:04 - 006417408 _____ () C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18071.11811.0_x64__8wekyb3d8bbwe\EntCommon.dll
    2017-09-25 22:50 - 2017-09-25 22:50 - 003553704 _____ () C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18071.11811.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll
    2018-08-10 12:04 - 2018-08-10 12:04 - 009010176 _____ () C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.18071.11811.0_x64__8wekyb3d8bbwe\EntPlat.dll
    2017-03-09 02:16 - 2017-03-09 02:16 - 000112264 _____ () C:\Windows\System32\IccLibDll_x64.dll
    2018-07-06 02:00 - 2018-07-06 02:00 - 000088888 _____ () C:\Program Files\iTunes\zlib1.dll
    2018-07-06 02:00 - 2018-07-06 02:00 - 001356088 _____ () C:\Program Files\iTunes\libxml2.dll
    2018-05-30 11:03 - 2018-05-30 11:03 - 046281248 _____ () C:\Program Files\Google\Drive\googledrivesync.exe
    2018-08-08 22:58 - 2018-08-07 18:41 - 004855640 _____ () C:\Program Files (x86)\Google\Chrome\Application\68.0.3440.106\libglesv2.dll
    2018-08-08 22:58 - 2018-08-07 18:41 - 000115544 _____ () C:\Program Files (x86)\Google\Chrome\Application\68.0.3440.106\libegl.dll
    2011-12-22 11:10 - 2011-12-22 11:58 - 000207717 _____ () C:\Users\Dave\Documents\My Program Files\AutoHotkey\Compiler\keywords.exe
    2018-08-26 10:57 - 2018-08-26 10:57 - 000113152 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\_ctypes.pyd
    2018-08-26 10:57 - 2018-08-26 10:57 - 000080896 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\bz2.pyd
    2018-08-26 10:57 - 2018-08-26 10:57 - 001585152 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\_hashlib.pyd
    2018-08-26 10:58 - 2018-08-26 10:58 - 000128512 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\win32api.pyd
    2018-08-26 10:57 - 2018-08-26 10:57 - 000137728 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\pywintypes27.dll
    2018-08-26 10:57 - 2018-08-26 10:57 - 000548864 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\pythoncom27.dll
    2018-08-26 10:58 - 2018-08-26 10:58 - 000689664 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\unicodedata.pyd
    2018-08-26 10:58 - 2018-08-26 10:58 - 000438784 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\win32com.shell.shell.pyd
    2018-08-26 10:58 - 2018-08-26 10:58 - 001489408 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\wx._core_.pyd
    2018-08-26 10:58 - 2018-08-26 10:58 - 001007104 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\wx._gdi_.pyd
    2018-08-26 10:58 - 2018-08-26 10:58 - 001039872 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\wx._windows_.pyd
    2018-08-26 10:58 - 2018-08-26 10:58 - 001325056 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\wx._controls_.pyd
    2018-08-26 10:58 - 2018-08-26 10:58 - 000916992 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\wx._misc_.pyd
    2018-08-26 10:57 - 2018-08-26 10:57 - 001084416 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\pysqlite2._sqlite.pyd
    2018-08-26 10:58 - 2018-08-26 10:58 - 000149504 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\win32file.pyd
    2018-08-26 10:58 - 2018-08-26 10:58 - 000136192 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\win32security.pyd
    2018-08-26 10:57 - 2018-08-26 10:57 - 000007680 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\hashobjs_ext.pyd
    2018-08-26 10:57 - 2018-08-26 10:57 - 000020992 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\thumbnails_ext.pyd
    2018-08-26 10:58 - 2018-08-26 10:58 - 000118784 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\usb_ext.pyd
    2018-08-26 10:57 - 2018-08-26 10:57 - 000047616 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\_socket.pyd
    2018-08-26 10:57 - 2018-08-26 10:57 - 002224640 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\_ssl.pyd
    2018-08-26 10:57 - 2018-08-26 10:57 - 000014848 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\common.time34.pyd
    2018-08-26 10:58 - 2018-08-26 10:58 - 000023040 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\win32event.pyd
    2018-08-26 10:58 - 2018-08-26 10:58 - 000034304 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\windows.conditional.pyd
    2018-08-26 10:58 - 2018-08-26 10:58 - 000020480 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\windows.winwrap.pyd
    2018-08-26 10:58 - 2018-08-26 10:58 - 000110080 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\windows.volumes.pyd
    2018-08-26 10:58 - 2018-08-26 10:58 - 000223232 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\win32gui.pyd
    2018-08-26 10:57 - 2018-08-26 10:57 - 000173568 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\_elementtree.pyd
    2018-08-26 10:57 - 2018-08-26 10:57 - 000169472 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\pyexpat.pyd
    2018-08-26 10:58 - 2018-08-26 10:58 - 000048128 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\win32inet.pyd
    2018-08-26 10:58 - 2018-08-26 10:58 - 000103424 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\wx._html2.pyd
    2018-08-26 10:57 - 2018-08-26 10:57 - 000046080 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\_psutil_windows.pyd
    2018-08-26 10:58 - 2018-08-26 10:58 - 000633272 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\windows._cacheinvalidation.pyd
    2018-08-26 10:58 - 2018-08-26 10:58 - 000011776 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\win32crypt.pyd
    2018-08-26 10:57 - 2018-08-26 10:57 - 000301568 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\PIL._imaging.pyd
    2018-08-26 10:57 - 2018-08-26 10:57 - 000032256 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\_multiprocessing.pyd
    2018-08-26 10:57 - 2018-08-26 10:57 - 005458944 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\cello.pyd
    2018-08-26 10:57 - 2018-08-26 10:57 - 000026112 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\_yappi.pyd
    2018-08-26 10:58 - 2018-08-26 10:58 - 000044032 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\win32process.pyd
    2018-08-26 10:58 - 2018-08-26 10:58 - 000027648 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\win32pipe.pyd
    2018-08-26 10:57 - 2018-08-26 10:57 - 000010752 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\select.pyd
    2018-08-26 10:58 - 2018-08-26 10:58 - 000029696 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\win32pdh.pyd
    2018-08-26 10:58 - 2018-08-26 10:58 - 000038400 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\windows.connectivity.pyd
    2018-08-26 10:58 - 2018-08-26 10:58 - 000073216 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\windows.device_monitor.pyd
    2018-08-26 10:58 - 2018-08-26 10:58 - 000020480 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\win32profile.pyd
    2018-08-26 10:58 - 2018-08-26 10:58 - 000026624 _____ () C:\Users\Dave\AppData\Local\Temp\_MEI99602\win32ts.pyd
    2018-08-17 07:40 - 2018-08-17 07:40 - 000479232 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
    2018-08-17 07:40 - 2018-08-17 07:40 - 069226496 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\Microsoft.Photos.dll
    2017-12-23 21:01 - 2017-12-23 21:02 - 002523136 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\UnityEngineDelegates.dll
    2018-08-17 07:40 - 2018-08-17 07:40 - 000049664 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\RenderingPlugin.dll
    2018-08-17 07:40 - 2018-08-17 07:40 - 003693568 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\MediaEngineCSWrapper.dll
    2018-05-03 16:25 - 2018-05-03 16:26 - 000009216 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\ImagePipelineNative.dll
    2018-08-17 07:40 - 2018-08-17 07:40 - 002280960 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\opencv_core320.dll
    2018-08-17 07:40 - 2018-08-17 07:40 - 000035328 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\WinMLWrapper.UWP.dll
    2018-04-04 16:58 - 2018-04-04 16:59 - 002283008 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\TrackingDLLUWP.dll
    2018-08-17 07:40 - 2018-08-17 07:40 - 002480640 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\opencv_imgproc320.dll
    2018-08-17 07:40 - 2018-08-17 07:40 - 014258688 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\PhotosApp.Windows.dll
    2018-08-17 07:40 - 2018-08-17 07:40 - 003538944 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\MediaEngine.dll
    2018-08-17 07:40 - 2018-08-17 07:40 - 002944512 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\AppCore.Windows.dll
    2018-05-30 14:11 - 2018-05-30 14:12 - 000872448 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\RuntimeConfiguration.dll
    2018-07-27 10:37 - 2018-07-27 10:38 - 004584960 _____ () C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2018.18061.17410.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll
    2018-07-31 10:40 - 2018-07-31 10:41 - 000199168 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_11807.1001.13.0_x64__8wekyb3d8bbwe\WinStore.Preview.dll
    2018-07-31 10:39 - 2018-07-31 10:40 - 002447072 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_11807.1001.13.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml.dll
    2018-07-31 10:40 - 2018-07-31 10:41 - 007814144 _____ () C:\Program Files\WindowsApps\Microsoft.WindowsStore_11807.1001.13.0_x64__8wekyb3d8bbwe\WinStore.Entertainment.Mobile.dll
    2018-07-10 20:13 - 2018-07-10 20:13 - 001922224 _____ () C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.10314.31700.0_x64__8wekyb3d8bbwe\Microsoft.Applications.Telemetry.Windows.dll
    2017-05-17 06:16 - 2017-05-17 06:16 - 000073728 _____ () C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll
    2018-08-09 11:23 - 2018-08-09 11:23 - 087838296 _____ () C:\Program Files (x86)\Opera\54.0.2952.71\opera_browser.dll
    2004-09-30 11:09 - 2004-09-30 11:09 - 000155648 _____ () C:\Program Files\LinkShellExtension\32\RockallDLL.dll
    2018-08-09 11:23 - 2018-08-09 11:23 - 003871320 _____ () C:\Program Files (x86)\Opera\54.0.2952.71\libglesv2.dll
    2018-08-09 11:23 - 2018-08-09 11:23 - 000086616 _____ () C:\Program Files (x86)\Opera\54.0.2952.71\libegl.dll

    ==================== Alternate Data Streams (Whitelisted) =========

    (If an entry is included in the fixlist, only the ADS will be removed.)


    ==================== Safe Mode (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


    ==================== Association (Whitelisted) ===============

    (If an entry is included in the fixlist, the registry item will be restored to default or removed.)


    ==================== Internet Explorer trusted/restricted ===============

    (If an entry is included in the fixlist, it will be removed from the registry.)


    ==================== Hosts content: ==========================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2009-07-13 20:34 - 2018-08-26 10:58 - 000001707 _____ C:\WINDOWS\system32\Drivers\etc\hosts

    127.0.0.1 localhost
    216.239.32.20 www.google.ae # bck9
    216.239.32.20 www.google.at # bck9
    216.239.32.20 www.google.be # bck9
    216.239.32.20 www.google.ca # bck9
    216.239.32.20 www.google.ch # bck9
    216.239.32.20 www.google.cl # bck9
    216.239.32.20 www.google.co.il # bck9
    216.239.32.20 www.google.co.in # bck9
    216.239.32.20 www.google.co.jp # bck9
    216.239.32.20 www.google.co.kr # bck9
    216.239.32.20 www.google.co.nz # bck9
    216.239.32.20 www.google.co.uk # bck9
    216.239.32.20 www.google.co.ve # bck9
    216.239.32.20 www.google.co.za # bck9
    216.239.32.20 www.google.com # bck9
    216.239.32.20 www.google.com.ar # bck9
    216.239.32.20 www.google.com.au # bck9
    216.239.32.20 www.google.com.br # bck9
    216.239.32.20 www.google.com.co # bck9
    216.239.32.20 www.google.com.gr # bck9
    216.239.32.20 www.google.com.hk # bck9
    216.239.32.20 www.google.com.mx # bck9
    216.239.32.20 www.google.com.my # bck9
    216.239.32.20 www.google.com.pe # bck9
    216.239.32.20 www.google.com.ph # bck9
    216.239.32.20 www.google.com.pk # bck9
    216.239.32.20 www.google.com.sg # bck9
    216.239.32.20 www.google.com.tr # bck9
    216.239.32.20 www.google.com.tw # bck9

    ==================== Other Areas ============================

    (Currently there is no automatic fix for this section.)

    HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Dave\Downloads\Wallpapers\Thomas Herbich\SMOKE_176_HD.jpg
    HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\Control Panel\Desktop\\Wallpaper -> C:\Users\Office Administrator\AppData\Local\Microsoft\Windows\Themes\img16.jpg
    DNS Servers: 208.67.222.222 - 8.8.8.8
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
    Windows Firewall is enabled.

    ==================== MSCONFIG/TASK MANAGER disabled items ==

    HKLM\...\StartupApproved\Run32: => "Cisco AnyConnect Secure Mobility Agent for Windows"
    HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\...\StartupApproved\Run: => "Plex Media Server"

    ==================== FirewallRules (Whitelisted) ===============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    FirewallRules: [{C97E4394-8A48-4F21-B464-9A6A5D5A54A1}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    FirewallRules: [{93776A94-90D5-4519-B1A0-E098CE312A7F}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    FirewallRules: [{DA8A793E-A5E4-47D7-81AE-84BF66EC42C4}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
    FirewallRules: [{4D080D92-8DEC-4CE0-BCEA-A1F319E1E296}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
    FirewallRules: [{D6AC1967-FD24-478D-8B49-891B52A2AE67}] => (Allow) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
    FirewallRules: [Threshold.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\Threshold.exe
    FirewallRules: [Threshold.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\Threshold.exe
    FirewallRules: [StreamNet.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\StreamNet.exe
    FirewallRules: [StreamNet.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\StreamNet.exe
    FirewallRules: [SlopeAveDown.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\SlopeAveDown.exe
    FirewallRules: [SlopeAveDown.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\SlopeAveDown.exe
    FirewallRules: [SlopeAreaRatio.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\SlopeAreaRatio.exe
    FirewallRules: [SlopeAreaRatio.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\SlopeAreaRatio.exe
    FirewallRules: [SlopeArea.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\SlopeArea.exe
    FirewallRules: [SlopeArea.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\SlopeArea.exe
    FirewallRules: [PitRemove.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\PitRemove.exe
    FirewallRules: [PitRemove.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\PitRemove.exe
    FirewallRules: [PeukerDouglas.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\PeukerDouglas.exe
    FirewallRules: [PeukerDouglas.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\PeukerDouglas.exe
    FirewallRules: [MoveOutletsToStreams.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\MoveOutletsToStreams.exe
    FirewallRules: [MoveOutletsToStreams.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\MoveOutletsToStreams.exe
    FirewallRules: [LengthArea.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\LengthArea.exe
    FirewallRules: [LengthArea.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\LengthArea.exe
    FirewallRules: [GridNet.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\GridNet.exe
    FirewallRules: [GridNet.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\GridNet.exe
    FirewallRules: [DropAnalysis.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DropAnalysis.exe
    FirewallRules: [DropAnalysis.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DropAnalysis.exe
    FirewallRules: [DinfUpDependence.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfUpDependence.exe
    FirewallRules: [DinfUpDependence.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfUpDependence.exe
    FirewallRules: [DinfTransLimAccum.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfTransLimAccum.exe
    FirewallRules: [DinfTransLimAccum.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfTransLimAccum.exe
    FirewallRules: [DinfRevAccum.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfRevAccum.exe
    FirewallRules: [DinfRevAccum.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfRevAccum.exe
    FirewallRules: [DinfFlowDir.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfFlowDir.exe
    FirewallRules: [DinfFlowDir.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfFlowDir.exe
    FirewallRules: [DinfDistUp.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfDistUp.exe
    FirewallRules: [DinfDistUp.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfDistUp.exe
    FirewallRules: [DinfDistDown.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfDistDown.exe
    FirewallRules: [DinfDistDown.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfDistDown.exe
    FirewallRules: [DinfDecayAccum.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfDecayAccum.exe
    FirewallRules: [DinfDecayAccum.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfDecayAccum.exe
    FirewallRules: [DinfConcLimAccum.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfConcLimAccum.exe
    FirewallRules: [DinfConcLimAccum.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfConcLimAccum.exe
    FirewallRules: [DinfAvalanche.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfAvalanche.exe
    FirewallRules: [DinfAvalanche.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\DinfAvalanche.exe
    FirewallRules: [D8HDistToStrm.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\D8HDistToStrm.exe
    FirewallRules: [D8HDistToStrm.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\D8HDistToStrm.exe
    FirewallRules: [D8FlowPathExtremeUp.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\D8FlowPathExtremeUp.exe
    FirewallRules: [D8FlowPathExtremeUp.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\D8FlowPathExtremeUp.exe
    FirewallRules: [D8FlowDir.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\D8FlowDir.exe
    FirewallRules: [D8FlowDir.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\D8FlowDir.exe
    FirewallRules: [AreaDinf.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\AreaDinf.exe
    FirewallRules: [AreaDinf.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\AreaDinf.exe
    FirewallRules: [AreaD8.exe-UDP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\AreaD8.exe
    FirewallRules: [AreaD8.exe-TCP] => (Block) C:\Program Files (x86)\MapWindow\Taudem5Exe\AreaD8.exe
    FirewallRules: [{B64BF283-2A93-45C4-9DD1-59549F5FAD14}] => (Allow) C:\Program Files (x86)\MediaMonkey\MediaMonkey.exe
    FirewallRules: [{C7BC21A7-C3FA-4E28-BC1A-A557808EF625}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
    FirewallRules: [{D2A9995C-573D-4870-A196-E6F92C7FEA75}] => (Allow) LPort=2869
    FirewallRules: [{98FA0158-258F-4FA8-89DD-ECE5A11273C6}] => (Allow) LPort=1900
    FirewallRules: [{EA34BF9A-7A5F-4F3F-A5BD-663CC060D6E3}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
    FirewallRules: [{ED82AD9C-AFA6-4735-A920-DC574204A409}] => (Allow) C:\Program Files (x86)\Windows Live\Mesh\MOE.exe
    FirewallRules: [TCP Query User{C66D7923-A783-41D0-84CF-2B67EFA6E8AC}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre7\bin\javaw.exe
    FirewallRules: [UDP Query User{6A6D3589-27E9-4166-A941-B67F7F496C4F}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre7\bin\javaw.exe
    FirewallRules: [TCP Query User{A25D23CA-7804-4EA6-B0D3-955DA76CFA0F}C:\windows\syswow64\java.exe] => (Allow) C:\windows\syswow64\java.exe
    FirewallRules: [UDP Query User{64406E4F-99E3-47BB-AE74-B49BD5C4A72A}C:\windows\syswow64\java.exe] => (Allow) C:\windows\syswow64\java.exe
    FirewallRules: [TCP Query User{6578A75B-A845-4BFE-A275-8FD74C984758}C:\program files (x86)\internet explorer\iexplore.exe] => (Block) C:\program files (x86)\internet explorer\iexplore.exe
    FirewallRules: [UDP Query User{85D6766B-6445-4445-ABA5-C4818CC9EBDC}C:\program files (x86)\internet explorer\iexplore.exe] => (Block) C:\program files (x86)\internet explorer\iexplore.exe
    FirewallRules: [{99BEEB2A-E79C-439B-9A70-3D225C43D63F}] => (Allow) C:\Program Files (x86)\uTorrent\uTorrent.exe
    FirewallRules: [{3EB3C082-397F-411C-9636-9ED1253AE631}] => (Allow) C:\Program Files (x86)\uTorrent\uTorrent.exe
    FirewallRules: [{EA796675-EE94-497F-BC35-CA9CBC9616C1}] => (Allow) C:\Program Files (x86)\Wolfram Research\Wolfram CDF Player\8.0\WolframCDFPlayer.exe
    FirewallRules: [{46D7AF76-9E5A-4ABE-A0E2-E0E055EDF20F}] => (Allow) C:\Program Files (x86)\Wolfram Research\Wolfram CDF Player\8.0\WolframCDFPlayer.exe
    FirewallRules: [{C4776A0E-63A8-4BF4-9607-AFD7FD9FC2B1}] => (Allow) C:\Program Files (x86)\Wolfram Research\Wolfram CDF Player\8.0\math.exe
    FirewallRules: [{F0EA1B3E-80F1-44FB-A051-2AB84E74E76B}] => (Allow) C:\Program Files (x86)\Wolfram Research\Wolfram CDF Player\8.0\math.exe
    FirewallRules: [{D79BB384-A9B2-4C88-950E-CB3217FCF8B9}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
    FirewallRules: [TCP Query User{EB64F111-26BF-419C-873E-0DB8B100F120}C:\users\dave\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe] => (Allow) C:\users\dave\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe
    FirewallRules: [UDP Query User{58913BBD-D8FB-45F6-A6D3-A6F3557780AB}C:\users\dave\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe] => (Allow) C:\users\dave\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe
    FirewallRules: [{E21B9340-397D-4611-BF10-2984A0055970}] => (Block) C:\users\dave\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe
    FirewallRules: [{10379A70-582A-44A7-A7CA-55594BB13019}] => (Block) C:\users\dave\appdata\local\logmein rescue applet\lmir0001.tmp\lmi_rescue.exe
    FirewallRules: [TCP Query User{7C2313F0-154A-4E6E-90D6-7E90379CA707}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre7\bin\javaw.exe
    FirewallRules: [UDP Query User{A94DDC9C-3777-4D71-8BBE-4D876BCD135D}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre7\bin\javaw.exe
    FirewallRules: [{9C966373-284D-4353-ACE9-CD031EB094C4}] => (Allow) LPort=8298
    FirewallRules: [{45DAD556-0BDA-4265-83C2-FE50B971192F}] => (Allow) C:\Program Files (x86)\Plex\Plex Media Server\Plex Media Server.exe
    FirewallRules: [{05D180E3-1AED-45AF-B671-62836A25F3DB}] => (Allow) C:\Program Files (x86)\Plex\Plex Media Server\PlexScriptHost.exe
    FirewallRules: [{5BA111A5-F7EE-4FA6-9FCF-182CBE7BCFA4}] => (Allow) C:\Program Files (x86)\Plex\Plex Media Server\PlexDlnaServer.exe
    FirewallRules: [{4528EE72-9CE0-421E-8550-3B24C363B9F5}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    FirewallRules: [TCP Query User{F6C09B32-9999-462F-AB77-DF7799C0C78F}C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe
    FirewallRules: [UDP Query User{CD2A1F08-F0C1-4981-90F7-5D39F3D41DA8}C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe
    FirewallRules: [{21CC09DF-8C0C-4A80-9937-5AABCB29BBCF}] => (Block) C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe
    FirewallRules: [{D9C5B658-463C-4498-B23A-2ABFB367CC8A}] => (Block) C:\program files (x86)\java\jre1.8.0_31\bin\javaw.exe
    FirewallRules: [{E025775D-8895-4976-BA29-A879288BC421}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    FirewallRules: [{CA7BBAD6-8275-43AD-A8F5-B21337FA9A66}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    FirewallRules: [TCP Query User{7AA5E096-F108-4834-88E6-661BC0F25167}C:\users\dave\documents\screenscraper basic\screen-scraper basic edition\screen-scraper.exe] => (Allow) C:\users\dave\documents\screenscraper basic\screen-scraper basic edition\screen-scraper.exe
    FirewallRules: [UDP Query User{4F2DEC60-AB57-4F30-B6FC-8328AC5AB464}C:\users\dave\documents\screenscraper basic\screen-scraper basic edition\screen-scraper.exe] => (Allow) C:\users\dave\documents\screenscraper basic\screen-scraper basic edition\screen-scraper.exe
    FirewallRules: [TCP Query User{6D1B4B3D-DC44-4E97-ABF5-BF0A5D719339}C:\users\dave\documents\screenscraper basic\screen-scraper basic edition\jre\bin\java.exe] => (Allow) C:\users\dave\documents\screenscraper basic\screen-scraper basic edition\jre\bin\java.exe
    FirewallRules: [UDP Query User{6717A046-F10E-44A8-A0C4-9552514FD275}C:\users\dave\documents\screenscraper basic\screen-scraper basic edition\jre\bin\java.exe] => (Allow) C:\users\dave\documents\screenscraper basic\screen-scraper basic edition\jre\bin\java.exe
    FirewallRules: [{61999273-0528-4DEE-9F0F-38CB07458FF8}] => (Block) C:\users\dave\documents\screenscraper basic\screen-scraper basic edition\screen-scraper.exe
    FirewallRules: [{216A7450-775A-4FEE-B105-4DD82BA1CE49}] => (Block) C:\users\dave\documents\screenscraper basic\screen-scraper basic edition\screen-scraper.exe
    FirewallRules: [{F184E7F9-BEAD-4372-85AE-AFD57A3276BD}] => (Block) C:\users\dave\documents\screenscraper basic\screen-scraper basic edition\jre\bin\java.exe
    FirewallRules: [{418F4DC2-5545-48F0-A759-AB3BAB8BFBC4}] => (Block) C:\users\dave\documents\screenscraper basic\screen-scraper basic edition\jre\bin\java.exe
    FirewallRules: [TCP Query User{8F8E1440-4D93-43AB-A3D6-201C8C23F463}K:\_personal\software\screenscraper basic\screen-scraper basic edition\screen-scraper.exe] => (Allow) K:\_personal\software\screenscraper basic\screen-scraper basic edition\screen-scraper.exe
    FirewallRules: [UDP Query User{40CCAE81-8109-420E-AF87-77E26890B7F5}K:\_personal\software\screenscraper basic\screen-scraper basic edition\screen-scraper.exe] => (Allow) K:\_personal\software\screenscraper basic\screen-scraper basic edition\screen-scraper.exe
    FirewallRules: [{C9ECCCEC-27ED-4620-9248-4C5E5EEAC2DC}] => (Block) K:\_personal\software\screenscraper basic\screen-scraper basic edition\screen-scraper.exe
    FirewallRules: [{97E2E5D7-3C8D-4277-8621-2AEDEA7CD348}] => (Block) K:\_personal\software\screenscraper basic\screen-scraper basic edition\screen-scraper.exe
    FirewallRules: [TCP Query User{A8769730-A01D-4989-8620-3ADE44A7D02B}C:\users\dave\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\dave\appdata\roaming\spotify\spotify.exe
    FirewallRules: [UDP Query User{046F220F-EFB1-4E01-B03D-8F38DD13339A}C:\users\dave\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\dave\appdata\roaming\spotify\spotify.exe
    FirewallRules: [{66F7B5B5-ED35-4329-B549-A95D03B9B1F1}] => (Block) C:\users\dave\appdata\roaming\spotify\spotify.exe
    FirewallRules: [{58B041DA-DDE2-43FC-B32A-71F354676EB8}] => (Block) C:\users\dave\appdata\roaming\spotify\spotify.exe
    FirewallRules: [{4EEFD3C5-14F1-4076-8EE4-F389AD479545}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
    FirewallRules: [{6D39C845-E020-45D1-BBE6-56AFA68C82DE}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
    FirewallRules: [{D5D7FE67-D60F-48B3-BD94-753E4765D5C4}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
    FirewallRules: [{60D599F0-5D17-4685-A9AA-02518D2C3139}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
    FirewallRules: [TCP Query User{FB4981A4-3783-4464-B83E-AE98B5232A38}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe
    FirewallRules: [UDP Query User{341C4F30-A9D6-4890-B70C-C049009C3C6F}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe
    FirewallRules: [{033619D0-9520-42E2-83E8-ADC19A261AC1}] => (Allow) C:\Program Files\iTunes\iTunes.exe
    FirewallRules: [{11BBCA25-52E8-4C6D-9047-B9C87502457D}] => (Allow) C:\Program Files (x86)\Opera\54.0.2952.64\opera.exe
    FirewallRules: [{BF968F8D-7C5E-4EB9-B0CF-C0CE516F489F}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    FirewallRules: [{DDA01E78-044D-41D8-B8A9-36B1018C64A4}] => (Allow) C:\Program Files (x86)\Opera\54.0.2952.71\opera.exe
    FirewallRules: [{26F3B8AD-3EAB-4971-BD7F-01011DB0A5F7}] => (Allow) C:\Program Files\Pale Moon\palemoon.exe
    FirewallRules: [{03A9717A-9E7B-43FE-9BC4-4A42887BEA87}] => (Allow) C:\Program Files\Pale Moon\palemoon.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Orbitdownloader\orbitdm.exe] => Enabled:Orbit
    StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Orbitdownloader\orbitnet.exe] => Enabled:Orbit

    ==================== Restore Points =========================

    17-08-2018 08:58:26 Windows Modules Installer
    18-08-2018 10:58:48 Windows Modules Installer
    19-08-2018 12:58:35 Windows Modules Installer
    21-08-2018 01:01:02 Windows Modules Installer
    22-08-2018 07:02:52 Windows Modules Installer
    25-08-2018 00:59:10 Windows Modules Installer
    26-08-2018 03:20:53 Windows Modules Installer
    27-08-2018 04:57:02 Windows Modules Installer
    28-08-2018 06:57:00 Windows Modules Installer

    ==================== Faulty Device Manager Devices =============

    Name: MyBookWorld
    Description: My Book World Edition Network Storage
    Class Guid: {4d36e967-e325-11ce-bfc1-08002be10318}
    Manufacturer: Western Digital Corporation
    Service: UmPass
    Problem: : This device cannot start. (Code10)
    Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
    On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

    Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
    Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
    Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
    Manufacturer: Cisco Systems
    Service: vpnva
    Problem: : This device is disabled. (Code 22)
    Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (08/26/2018 10:57:28 AM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application name: ACDaemon.exe, version: 1.1.0.49, time stamp: 0x4cc808ec
    Faulting module name: ACDaemon.exe, version: 1.1.0.49, time stamp: 0x4cc808ec
    Exception code: 0xc0000005
    Fault offset: 0x0001af76
    Faulting process id: 0x55c
    Faulting application start time: 0x01d43d5dd6304533
    Faulting application path: C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
    Faulting module path: C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
    Report Id: 8ea5f03b-5fc5-491c-9aa5-9e4cdd56039f
    Faulting package full name:
    Faulting package-relative application ID:

    Error: (08/26/2018 10:33:28 AM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application name: ACDaemon.exe, version: 1.1.0.49, time stamp: 0x4cc808ec
    Faulting module name: ACDaemon.exe, version: 1.1.0.49, time stamp: 0x4cc808ec
    Exception code: 0xc0000005
    Fault offset: 0x0001af76
    Faulting process id: 0x11c0
    Faulting application start time: 0x01d43d5a7db560b0
    Faulting application path: C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
    Faulting module path: C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
    Report Id: a4054b1d-126d-4ee2-9867-04eae985c035
    Faulting package full name:
    Faulting package-relative application ID:

    Error: (08/26/2018 10:28:56 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: m->NextScheduledSPRetry 14094

    Error: (08/26/2018 10:28:56 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: m->NextScheduledEvent 14094

    Error: (08/26/2018 10:28:56 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: Continuously busy for more than a second

    Error: (08/26/2018 10:28:49 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: m->NextScheduledSPRetry 6860

    Error: (08/26/2018 10:28:49 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: m->NextScheduledEvent 6860

    Error: (08/26/2018 10:28:49 AM) (Source: Bonjour Service) (EventID: 100) (User: )
    Description: Task Scheduling Error: Continuously busy for more than a second


    System errors:
    =============
    Error: (08/27/2018 11:06:36 PM) (Source: DCOM) (EventID: 10016) (User: 2012_Office)
    Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
    {8BC3F05E-D86B-11D0-A075-00C04FB68820}
    and APPID
    {8BC3F05E-D86B-11D0-A075-00C04FB68820}
    to the user 2012_Office\Dave SID (S-1-5-21-4063716828-1680190529-1648852121-1000) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.ContentDeliveryManager_10.0.17134.1_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723). This security permission can be modified using the Component Services administrative tool.

    Error: (08/27/2018 08:01:40 AM) (Source: DCOM) (EventID: 10016) (User: 2012_Office)
    Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
    {8BC3F05E-D86B-11D0-A075-00C04FB68820}
    and APPID
    {8BC3F05E-D86B-11D0-A075-00C04FB68820}
    to the user 2012_Office\Dave SID (S-1-5-21-4063716828-1680190529-1648852121-1000) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.ContentDeliveryManager_10.0.17134.1_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723). This security permission can be modified using the Component Services administrative tool.

    Error: (08/26/2018 11:09:17 AM) (Source: DCOM) (EventID: 10016) (User: 2012_Office)
    Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
    {8BC3F05E-D86B-11D0-A075-00C04FB68820}
    and APPID
    {8BC3F05E-D86B-11D0-A075-00C04FB68820}
    to the user 2012_Office\Dave SID (S-1-5-21-4063716828-1680190529-1648852121-1000) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.ContentDeliveryManager_10.0.17134.1_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723). This security permission can be modified using the Component Services administrative tool.

    Error: (08/26/2018 11:09:15 AM) (Source: DCOM) (EventID: 10016) (User: 2012_Office)
    Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
    {8BC3F05E-D86B-11D0-A075-00C04FB68820}
    and APPID
    {8BC3F05E-D86B-11D0-A075-00C04FB68820}
    to the user 2012_Office\Dave SID (S-1-5-21-4063716828-1680190529-1648852121-1000) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.ContentDeliveryManager_10.0.17134.1_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723). This security permission can be modified using the Component Services administrative tool.

    Error: (08/26/2018 11:09:15 AM) (Source: DCOM) (EventID: 10016) (User: 2012_Office)
    Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
    {8BC3F05E-D86B-11D0-A075-00C04FB68820}
    and APPID
    {8BC3F05E-D86B-11D0-A075-00C04FB68820}
    to the user 2012_Office\Dave SID (S-1-5-21-4063716828-1680190529-1648852121-1000) from address LocalHost (Using LRPC) running in the application container Microsoft.Windows.ContentDeliveryManager_10.0.17134.1_neutral_neutral_cw5n1h2txyewy SID (S-1-15-2-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723). This security permission can be modified using the Component Services administrative tool.

    Error: (08/26/2018 11:07:25 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
    Description: The Intel(R) Management and Security Application User Notification Service service hung on starting.

    Error: (08/26/2018 11:05:55 AM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)
    Description: The server {B91D5831-B1BD-4608-8198-D72E155020F7} did not register with DCOM within the required timeout.

    Error: (08/26/2018 11:05:23 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
    Description: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
    Windows.SecurityCenter.WscBrokerManager
    and APPID
    Unavailable
    to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.


    Windows Defender:
    ===================================
    Date: 2018-08-25 11:21:40.899
    Description:
    Windows Defender Antivirus has detected malware or other potentially unwanted software.
    For more information please see the following:
    https://go.microsoft.com/fwlink/?lin...5&enterprise=0
    Name: HackTool:Win32/Netpass
    ID: 2147605535
    Severity: High
    Category: Tool
    Path: containerfile:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload 18-06-18\Utilities\Zip Files\netpass.zip; file:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload 18-06-18\Utilities\Zip Files\netpass.zip->netpass.exe; file:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload 18-06-18\Utilities\Zip Files\netpass.zip->netpass.exe->(UPX)
    Detection Origin: Local machine
    Detection Type: FastPath
    Detection Source: User
    Process Name: Unknown
    Signature Version: AV: 1.275.151.0, AS: 1.275.151.0, NIS: 1.275.151.0
    Engine Version: AM: 1.1.15200.1, NIS: 1.1.15200.1

    Date: 2018-08-25 03:07:00.918
    Description:
    Windows Defender Antivirus has detected malware or other potentially unwanted software.
    For more information please see the following:
    https://go.microsoft.com/fwlink/?lin...6&enterprise=0
    Name: Trojan:Win32/Fuerboos.E!cl
    ID: 2147723656
    Severity: Severe
    Category: Trojan
    Path: file:_P:\Laptop Backup 14-04-06\Documents and Settings\Ben\My Documents\Downloads\Java.exe
    Detection Origin: Local machine
    Detection Type: FastPath
    Detection Source: User
    Process Name: Unknown
    Signature Version: AV: 1.273.1749.0, AS: 1.273.1749.0, NIS: 1.273.1749.0
    Engine Version: AM: 1.1.15100.1, NIS: 1.1.15100.1

    Date: 2018-08-25 03:07:00.916
    Description:
    Windows Defender Antivirus has detected malware or other potentially unwanted software.
    For more information please see the following:
    https://go.microsoft.com/fwlink/?lin...1&enterprise=0
    Name: BrowserModifier:Win32/Beilextec
    ID: 240791
    Severity: High
    Category: Browser Modifier
    Path: containerfile:_C:\Users\Dave\Downloads\Installed\Format Factory\FFSetup3.0.1.exe; file:_C:\Users\Dave\Downloads\Installed\Format Factory\FFSetup3.0.1.exe->(nsis-6-v9fft.exe)
    Detection Origin: Local machine
    Detection Type: Concrete
    Detection Source: User
    Process Name: Unknown
    Signature Version: AV: 1.273.1749.0, AS: 1.273.1749.0, NIS: 1.273.1749.0
    Engine Version: AM: 1.1.15100.1, NIS: 1.1.15100.1

    Date: 2018-08-25 03:07:00.915
    Description:
    Windows Defender Antivirus has detected malware or other potentially unwanted software.
    For more information please see the following:
    https://go.microsoft.com/fwlink/?lin...7&enterprise=0
    Name: HackTool:Win32/Wirekeyview
    ID: 2147657007
    Severity: High
    Category: Tool
    Path: containerfile:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload 18-06-18\Utilities\Zip Files\wirelesskeyview.zip; file:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload 18-06-18\Utilities\Zip Files\wirelesskeyview.zip->WirelessKeyView.exe
    Detection Origin: Local machine
    Detection Type: Concrete
    Detection Source: User
    Process Name: Unknown
    Signature Version: AV: 1.273.1749.0, AS: 1.273.1749.0, NIS: 1.273.1749.0
    Engine Version: AM: 1.1.15100.1, NIS: 1.1.15100.1

    Date: 2018-08-25 03:07:00.913
    Description:
    Windows Defender Antivirus has detected malware or other potentially unwanted software.
    For more information please see the following:
    https://go.microsoft.com/fwlink/?lin...5&enterprise=0
    Name: HackTool:Win32/BrowserPassview
    ID: 2147685165
    Severity: High
    Category: Tool
    Path: containerfile:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload 18-06-18\Utilities\Zip Files\webbrowserpassview.zip; file:_C:\Users\Dave\Downloads\Flashdrive (Black) Offload 18-06-18\Utilities\Zip Files\webbrowserpassview.zip->WebBrowserPassView.exe
    Detection Origin: Local machine
    Detection Type: Concrete
    Detection Source: User
    Process Name: Unknown
    Signature Version: AV: 1.273.1749.0, AS: 1.273.1749.0, NIS: 1.273.1749.0
    Engine Version: AM: 1.1.15100.1, NIS: 1.1.15100.1

    Date: 2018-08-28 22:42:34.239
    Description:
    Windows Defender Antivirus has encountered an error trying to upload a suspicious file for further analysis.
    Filename: P:\Laptop Backup 14-04-06\Documents and Settings\Ben\My Documents\Downloads\Java.exe
    Sha256:
    Current Signature Version: AV: 1.275.323.0, AS: 1.275.323.0
    Current Engine Version: 1.1.15200.1
    Error code: 0x80508016

    Date: 2018-08-26 10:40:29.117
    Description:
    Windows Defender Antivirus has encountered an error trying to update signatures.
    New Signature Version:
    Previous Signature Version: 1.275.151.0
    Update Source: Microsoft Update Server
    Signature Type: AntiVirus
    Update Type: Full
    Current Engine Version:
    Previous Engine Version: 1.1.15200.1
    Error code: 0x80070008
    Error description: Not enough memory resources are available to process this command.

    Date: 2018-08-26 00:26:50.444
    Description:
    Windows Defender Antivirus has encountered an error trying to update signatures.
    New Signature Version:
    Previous Signature Version: 1.275.151.0
    Update Source: Microsoft Update Server
    Signature Type: AntiVirus
    Update Type: Full
    Current Engine Version:
    Previous Engine Version: 1.1.15200.1
    Error code: 0x80070008
    Error description: Not enough memory resources are available to process this command.

    CodeIntegrity:
    ===================================

    Date: 2018-08-16 13:15:09.616
    Description:
    Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.StdFormat.dll that did not meet the Microsoft signing level requirements.

    Date: 2018-08-16 13:15:09.558
    Description:
    Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\ADODB.dll that did not meet the Microsoft signing level requirements.

    Date: 2018-08-16 13:15:09.496
    Description:
    Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\MSDATASRC.dll that did not meet the Microsoft signing level requirements.

    Date: 2018-08-16 13:15:09.308
    Description:
    Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.StdFormat.dll that did not meet the Microsoft signing level requirements.

    Date: 2018-08-16 13:15:09.263
    Description:
    Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\ADODB.dll that did not meet the Microsoft signing level requirements.

    Date: 2018-08-16 13:15:09.217
    Description:
    Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\MSDATASRC.dll that did not meet the Microsoft signing level requirements.

    Date: 2018-08-16 13:15:07.524
    Description:
    Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\stdole.dll that did not meet the Microsoft signing level requirements.

    Date: 2018-08-16 13:15:06.841
    Description:
    Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume2\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\stdole.dll that did not meet the Microsoft signing level requirements.

    ==================== Memory info ===========================

    Processor: Intel(R) Core(TM) i5-2400 CPU @ 3.10GHz
    Percentage of memory in use: 62%
    Total physical RAM: 8098.51 MB
    Available physical RAM: 3067.95 MB
    Total Virtual: 15522.51 MB
    Available Virtual: 7801.06 MB

    ==================== Drives ================================

    Drive c: (OS) (Fixed) (Total:919.45 GB) (Free:74.42 GB) NTFS ==>[system with boot components (obtained from drive)]
    Drive d: (HP_RECOVERY) (Fixed) (Total:11.52 GB) (Free:1.4 GB) NTFS ==>[system with boot components (obtained from drive)]
    Drive p: (New Volume) (Fixed) (Total:2794.39 GB) (Free:86.23 GB) NTFS

    \\?\Volume{28a723c4-b7ed-11e1-ac0c-806e6f6e6963}\ (SYSTEM) (Fixed) (Total:0.1 GB) (Free:0.06 GB) NTFS
    \\?\Volume{a1e71db5-0000-0000-0000-20e3e5000000}\ () (Fixed) (Total:0.44 GB) (Free:0.06 GB) NTFS

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (MBR Code: Windows 7/8/10) (Size: 931.5 GB) (Disk ID: A1E71DB5)
    Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
    Partition 2: (Not Active) - (Size=919.5 GB) - (Type=07 NTFS)
    Partition 3: (Not Active) - (Size=450 MB) - (Type=27)
    Partition 4: (Not Active) - (Size=11.5 GB) - (Type=07 NTFS)

    ========================================================
    Disk: 1 (Protective MBR) (Size: 2794.5 GB) (Disk ID: 00000000)

    Partition: GPT.

    ==================== End of Addition.txt ============================

  4. #14
    Security Expert-emeritus Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    4,084

    Default

    Did Windows Defender have trouble removing what it found?

    ~~

    Start Farbar Recovery Scan Tool with Administrator privileges
    (Right click on the FRST icon and select Run as administrator)

    highlight on the text below and select Copy.
    beginning with Start:: and finishing with End::
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    Highlight the entire content of the quote box below and select Copy.


    Start::
    CloseProcesses:
    CreateRestorePoint:
    SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL => No File
    BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Silverlight\Office14\URLREDIR.DLL => No File
    BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll [2014-03-11] (Microsoft Corporation.)
    Toolbar: HKLM - No Name - {8dcb7100-df86-4384-8842-8fa844297b3f} - No File
    Toolbar: HKU\S-1-5-21-4063716828-1680190529-1648852121-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
    FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\defaults\pref\itms.js [2011-01-24]
    2018-08-10 00:18 - 2018-07-06 01:25 - 001945784 _____ (Microsoft Corporation) C:\Users\Office Administrator\AppData\Local\Temp\dllnt_dump.dll
    ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => -> No File
    C:\Windows\Temp\*.*
    Emptytemp:
    End::

    Start FRST (FRST64) with Administrator privileges
    Press the Fix button. FRST will process the lines copied above from the clipboard.
    When finished, a log file (Fixlog.txt) will pop up and saved in the same location the tool was ran from.

    Please copy and paste its contents in your next reply.
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    Also, tell me how the computer is now.
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  5. #15
    Junior Member
    Join Date
    Aug 2018
    Posts
    26

    Default Done

    Windows Defender had no trouble removing those.

    PC seems to be running fine.

    Ran FRST. Log pasted below.

    Fix result of Farbar Recovery Scan Tool (x64) Version: 02.08.2018
    Ran by Office Administrator (09-08-2018 23:46:16) Run:1
    Running from C:\Users\Dave\Desktop
    Loaded Profiles: Dave & Office Administrator (Available Profiles: Dave & Hope & Ben & Mary Jo & Office Administrator & Share_with_Office & Rich & Administrator & DefaultAppPool)
    Boot Mode: Normal
    ==============================================

    fixlist content:
    *****************
    CloseProcesses:
    CreateRestorePoint:
    C:\Windows\Temp\*.*
    GroupPolicy: Restriction ? <==== ATTENTION
    GroupPolicy\User: Restriction ? <==== ATTENTION
    GroupPolicyUsers\S-1-5-21-4063716828-1680190529-1648852121-1004\User: Restriction <==== ATTENTION
    HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
    SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
    SearchScopes: HKLM -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
    SearchScopes: HKLM -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
    SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
    SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
    SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
    SearchScopes: HKU\S-1-5-21-4063716828-1680190529-1648852121-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
    SearchScopes: HKU\S-1-5-21-4063716828-1680190529-1648852121-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
    SearchScopes: HKU\S-1-5-21-4063716828-1680190529-1648852121-1000 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
    SearchScopes: HKU\S-1-5-21-4063716828-1680190529-1648852121-1006 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
    SearchScopes: HKU\S-1-5-21-4063716828-1680190529-1648852121-1006 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
    SearchScopes: HKU\S-1-5-21-4063716828-1680190529-1648852121-1006 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxps://isearch.avg.com/search?cid={1B9CC6B6-62E7-4842-A87E-60C6CEC9B3DC}&mid=&lang=&ds=&pr=&d=&v=&sap=dsp&q={searchTerms}
    SearchScopes: HKU\S-1-5-21-4063716828-1680190529-1648852121-1006 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
    BHO: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll [2014-03-11] (Microsoft Corporation.)
    BHO-x32: Octh Class -> {000123B4-9B42-4900-B3F7-F4B073EFC214} -> C:\Program Files (x86)\Orbitdownloader\orbitcth.dll [2013-05-02] (Orbitdownloader.com)
    Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll [2014-03-11] (Microsoft Corporation.)Toolbar: HKU\S-1-5-21-4063716828-1680190529-1648852121-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
    Toolbar: HKU\S-1-5-21-4063716828-1680190529-1648852121-1006 -> No Name - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No File
    Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll No File
    Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll No File
    2018-08-08 11:31 - 2018-08-08 11:31 - 004264384 _____ (Don HO don.h@free.fr) C:\Users\Dave\AppData\Local\Temp\npp.7.5.8.Installer.exe
    2018-05-24 19:49 - 2018-05-24 19:49 - 004299968 _____ (Don HO don.h@free.fr) C:\Users\Office Administrator\AppData\Local\Temp\npp.7.5.6.Installer.exe
    ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 1 (GFS Unread Stub)] -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL -> No File
    ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 2 (GFS Stub)] -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL -> No File
    ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)] -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL -> No File
    ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 3 (GFS Folder)] -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL -> No File
    ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 4 (GFS Unread Mark)] -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL -> No File
    ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => -> No File
    ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 1 (GFS Unread Stub)] -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL -> No File
    ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 2 (GFS Stub)] -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL -> No File
    ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)] -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL -> No File
    ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 3 (GFS Folder)] -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL -> No File
    ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 4 (GFS Unread Mark)] -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL -> No File
    ContextMenuHandlers1-x32: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} => C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL -> No File
    ContextMenuHandlers3: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} => C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL -> No File
    ContextMenuHandlers4: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} => C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL -> No File
    ContextMenuHandlers5: [Gadgets] -> {6B9228DA-9C15-419e-856C-19E768A13BDC} => -> No File
    ContextMenuHandlers5: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} => C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL -> No File
    ContextMenuHandlers6-x32: [XXX Groove GFS Context Menu Handler XXX] -> {6C467336-8281-4E60-8204-430CED96822D} => C:\Program Files\Microsoft Silverlight\Office14\GROOVEEX.DLL -> No File
    Task: {032B01CC-1874-43B4-A40E-0A34AE5B0219} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime -> No File <==== ATTENTION
    Task: {0CC3794B-E509-49AE-AF82-09F758E715B3} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
    Task: {0EBF683C-73C8-427B-888B-F5FEDFA0A8B8} - \Microsoft\Windows\UNP\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Unlock -> No File <==== ATTENTION
    Task: {14160C5A-0629-4486-AD42-B50AD57381FA} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
    Task: {15CDA51F-2714-4EDB-A171-93B428EB5EAB} - \Microsoft\Windows\UNP\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\OutOfIdle -> No File <==== ATTENTION
    Task: {225F401F-D757-4C63-9C5E-338A1BF1A40C} - \Microsoft\Windows\Setup\gwx\rundetector -> No File <==== ATTENTION
    Task: {310AE0D2-A029-42FE-9CBF-BE9D3169809C} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
    Task: {3311EDC2-3EB7-44C7-98E3-001274DB87E2} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
    Task: {3D5FD92F-118C-45D9-B0B3-3723CAC9801B} - \Microsoft\Windows\Setup\GWXTriggers\Time-Weekend -> No File <==== ATTENTION
    Task: {453D4E41-9E0A-450B-ABEE-1E59AE056970} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
    Task: {4EA06D77-9D3C-4D8D-87AC-E943886E5F61} - \Microsoft\Windows\UNP\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\OnIdle -> No File <==== ATTENTION
    Task: {72D3B183-DAE2-4C2A-B083-2F775CA56B84} - \OfficeSoftwareProtectionPlatform\SvcRestartTask -> No File <==== ATTENTION
    Task: {81CF05AE-D06C-4C08-9EC1-EF7705F329D2} - \Microsoft\Windows\UNP\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Logon -> No File <==== ATTENTION
    Task: {92371601-C4C9-4886-8F49-55A1B31041CA} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
    Task: {A67499BF-E58D-4F6B-808F-5521BCB22C84} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
    Task: {B45BD574-7084-4DF1-82B3-CD8D60EDDB56} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
    Task: {B575AFE0-AF73-4398-9D64-5D7A4249CF40} - \CCleanerSkipUAC -> No File <==== ATTENTION
    Task: {B7A8F376-2E78-4061-83AB-BD6CC226463C} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
    Task: {B887A7D3-7A91-488D-87DA-512ED75B31E7} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime -> No File <==== ATTENTION
    Task: {CC5E2665-C32E-472A-B456-DD8263A22363} - \Microsoft\Windows\UNP\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Time -> No File <==== ATTENTION
    Task: {DB90AE6C-A7F3-4DCB-8F95-73AC04603218} - \Microsoft\Windows\Setup\GWXTriggers\OnIdle-5d -> No File <==== ATTENTION
    Task: {E63BAE5A-5EBA-47EA-A20E-B92FD497F1B2} - \Microsoft\Windows\UNP\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\RunCampaignManager2 -> No File <==== ATTENTION
    Task: {E715D404-048F-428E-B4E3-3091D17C67DF} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
    Task: {F1B34399-703E-4852-B06A-F538BC5472CA} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
    AlternateDataStreams: C:\ProgramData\Temp:DED17083 [286]
    Emptytemp:

    *****************

    Processes closed successfully.
    Restore point was successfully created.

    =========== "C:\Windows\Temp\*.*" ==========

    C:\Windows\Temp\ASPNETSetup_00000.log => moved successfully
    C:\Windows\Temp\ASPNETSetup_00001.log => moved successfully
    C:\Windows\Temp\ccleaner64.exe.png => moved successfully
    C:\Windows\Temp\chrome_installer.log => moved successfully
    C:\Windows\Temp\CProgram Files (x86)Opera52.0.2871.64opera_autoupdate.download.lock => moved successfully
    C:\Windows\Temp\CProgram Files (x86)Opera53.0.2907.68opera_autoupdate.download.lock => moved successfully
    C:\Windows\Temp\CProgram Files (x86)Opera53.0.2907.99opera_autoupdate.download.lock => moved successfully
    C:\Windows\Temp\CProgram Files (x86)Opera54.0.2952.51opera_autoupdate.download.lock => moved successfully
    C:\Windows\Temp\CProgram Files (x86)Opera54.0.2952.54opera_autoupdate.download.lock => moved successfully
    C:\Windows\Temp\CProgram Files (x86)Opera54.0.2952.64opera_autoupdate.download.lock => moved successfully
    C:\Windows\Temp\easyclea.exe.png => moved successfully
    C:\Windows\Temp\FXSAPIDebugLogFile.txt => moved successfully
    C:\Windows\Temp\FXSTIFFDebugLogFile.txt => moved successfully
    C:\Windows\Temp\MpCmdRun.log => moved successfully
    C:\Windows\Temp\MpSigStub.log => moved successfully
    C:\Windows\Temp\opera_crashreporter.log => moved successfully
    C:\Windows\Temp\Opera_installer_180516065107578.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180517003808963.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180517141350204.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180517231321000.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180517232424842.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180518001313655.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180518003809164.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180518061320300.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180519003809063.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180519061325579.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180520025744624.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180520061334625.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180521003808944.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180521061340919.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180522003809702.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180522061359177.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180523053058263.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180523061414625.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180523153712496.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180523155327936.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180523172527527.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180524003808798.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180524172536263.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180525013519843.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180525172543227.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180526064750140.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180526161634847.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180526221506407.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180527003809198.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180527221515581.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180529064602222.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180529163744323.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180529221612512.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180529223729324.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180531064515685.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180601064706678.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180602064617077.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180602064937738.dll => moved successfully
    C:\Windows\Temp\Opera_installer_180606041226536.dll => moved successfully
    C:\Windows\Temp\sa.007CAC78-C79B-923B-71A8-B5DFAE2AF4C2_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.00D57B0F-01FA-B79F-08D6-878ED20C4C9B_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.0116DC02-781B-D1D1-FC1C-C80195511E17_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.0251D65D-E887-28BD-A226-3ECD72FB59C6_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.0862A72D-A96C-83E5-AD0F-78B6AA06F9C6_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.0A55FA08-ED1C-797E-BCC1-BBA3F550B119_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.0C8CF327-9D17-CCDE-18AF-DFF4F20070E5_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.18DDC675-D472-0DB4-9563-7DF7C34F512C_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.1A7994D6-5342-8581-71FB-A2BD1C895D93_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.1F63B8C3-2D48-9497-0A0A-2CBD462EDE76_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.1FE89C0B-9BED-CC5D-7426-9E4025D6BDD9_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.31A692E0-F967-E4F8-A441-21A804580E9E_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.32A48683-F264-932C-7870-B93BB448ED69_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.3BFD26C9-8DA9-B940-F638-55890012AAB4_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.49F33C48-B2DE-F82A-56F2-64425F298B84_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.50611331-FE19-D366-B049-694B8AC9D758_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.557EA3BB-623E-ADD9-4DFB-629A8648A038_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.558F5D32-0827-EB7B-6AD6-D5DB4138B3AA_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.62B49C0A-499E-A02D-EBCB-EB168E148E52_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.6447326C-966E-1B7C-F7BE-35D29235B75F_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.664AA17A-2D25-0823-3315-3708FE16147A_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.674C4C14-7BAA-F782-E214-956DC3BEDF39_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.68BC3251-2D8B-A604-92BA-893638CA72EA_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.68E019EB-0B92-5E08-5D86-9BFE6DBA8517_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.69F3BCAB-8975-C526-30F5-39FA70C77AD9_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.6D151227-6BD9-726D-B30E-A8A018DCC82B_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.6DA3D5C0-A460-4E4E-3B2A-8530BC7CAFDA_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.6EA6FC2E-9305-586B-3411-02826D151533_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.70BC17F8-0AA7-CB35-CEE0-EF1B47A0FD3E_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.7583E141-6210-5A36-BB89-80D0397C4721_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.8F700A8E-3731-B777-A6DD-000FE1F8FCB2_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.97612282-D1E8-1D6A-9E92-C271E7F177EF_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.993325CD-9CA8-DD49-50C4-377C092AEF1B_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.9D4DED89-CABC-F4FB-8133-BC5EDB1C7EDA_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.A715D489-C343-F20B-B22E-F8D749061B0C_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.A8849751-10C4-3F5D-1F42-DA79DB2C7BE9_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.A90B8400-D36D-8235-8BF2-A21A53D3FB65_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.AB7C46F6-66DE-8533-C6B1-FFE36BF92E97_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.B1B6FBCA-CD11-CB52-6CA7-06B47EB7C197_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.BBFD7549-71AE-D8FD-9F58-2EF4C874B21C_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.D73AFAA4-7387-FEF0-0786-A226F43AD6F5_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.DFBE09D0-1F22-A9C0-2D3D-3F4C6351E58F_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.E336BB8F-16ED-7CBE-AFEE-971DD3041585_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.E6658C19-4221-2EBE-763A-F0493FBA2BB0_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.E6D3B497-80AF-7F14-F9E6-9606EE369FC3_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.FACF9DDE-1FF1-B57D-4D1D-CE479FDD42AF_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\sa.FB06EF95-BC48-1A6A-26FB-4450CE9A5906_5__.Public.AppUpdate.dat => moved successfully
    C:\Windows\Temp\tem8429.tmp => moved successfully
    C:\Windows\Temp\wmsetup.log => moved successfully

    ========= End -> "C:\Windows\Temp\*.*" ========

    C:\WINDOWS\system32\GroupPolicy\Machine => moved successfully
    C:\WINDOWS\system32\GroupPolicy\GPT.ini => moved successfully
    C:\WINDOWS\SysWOW64\GroupPolicy\GPT.ini => moved successfully
    C:\WINDOWS\system32\GroupPolicy\User => moved successfully
    C:\WINDOWS\system32\GroupPolicyUsers\S-1-5-21-4063716828-1680190529-1648852121-1004\User => moved successfully
    "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => removed successfully
    HKLM\Software\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => not found
    "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}" => removed successfully
    HKLM\Software\Classes\CLSID\{b7fca997-d0fb-4fe0-8afd-255e89cf9671} => not found
    "HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}" => removed successfully
    HKLM\Software\Classes\CLSID\{d43b3890-80c7-4010-a95d-1e77b5924dc3} => not found
    HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value restored successfully
    "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => removed successfully
    HKLM\Software\Wow6432Node\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => not found
    "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}" => removed successfully
    HKLM\Software\Wow6432Node\Classes\CLSID\{b7fca997-d0fb-4fe0-8afd-255e89cf9671} => not found
    "HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope" => removed successfully
    "HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => removed successfully
    HKLM\Software\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => not found
    "HKU\S-1-5-21-4063716828-1680190529-1648852121-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}" => removed successfully
    HKLM\Software\Classes\CLSID\{b7fca997-d0fb-4fe0-8afd-255e89cf9671} => not found
    "HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope" => removed successfully
    "HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => removed successfully
    HKLM\Software\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => not found
    "HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}" => removed successfully
    HKLM\Software\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233} => not found
    "HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{b7fca997-d0fb-4fe0-8afd-255e89cf9671}" => removed successfully
    HKLM\Software\Classes\CLSID\{b7fca997-d0fb-4fe0-8afd-255e89cf9671} => not found
    "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}" => removed successfully
    "HKLM\Software\Classes\CLSID\{d2ce3e00-f94a-4740-988e-03dc2f38c34f}" => removed successfully
    "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000123B4-9B42-4900-B3F7-F4B073EFC214}" => removed successfully
    "HKLM\Software\Wow6432Node\Classes\CLSID\{000123B4-9B42-4900-B3F7-F4B073EFC214}" => removed successfully
    "HKU\Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll [2014-03-11] (Microsoft Corporation.)S-1-5-21-4063716828-1680190529-1648852121-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{8dcb7100-df86-4384-8842-8fa844297b3f}" => not found
    "HKLM\Software\Classes\CLSID\{8dcb7100-df86-4384-8842-8fa844297b3f}" => removed successfully
    "HKU\S-1-5-21-4063716828-1680190529-1648852121-1006\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{C55BBCD6-41AD-48AD-9953-3609C48EACC7}" => removed successfully
    HKLM\Software\Classes\CLSID\{C55BBCD6-41AD-48AD-9953-3609C48EACC7} => not found
    "HKLM\Software\Classes\PROTOCOLS\Handler\livecall" => removed successfully
    HKLM\Software\Classes\CLSID\{828030A1-22C1-4009-854F-8E305202313F} => not found
    "HKLM\Software\Classes\PROTOCOLS\Handler\msnim" => removed successfully
    HKLM\Software\Classes\CLSID\{828030A1-22C1-4009-854F-8E305202313F} => not found
    C:\Users\Dave\AppData\Local\Temp\npp.7.5.8.Installer.exe => moved successfully
    C:\Users\Office Administrator\AppData\Local\Temp\npp.7.5.6.Installer.exe => moved successfully
    "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 1 (GFS Unread Stub)" => removed successfully
    "HKLM\Software\Classes\CLSID\{99FD978C-D287-4F50-827F-B2C658EDA8E7}" => removed successfully
    "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2 (GFS Stub)" => removed successfully
    "HKLM\Software\Classes\CLSID\{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}" => removed successfully
    "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" => removed successfully
    "HKLM\Software\Classes\CLSID\{920E6DB1-9907-4370-B3A0-BAFC03D81399}" => removed successfully
    "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 3 (GFS Folder)" => removed successfully
    "HKLM\Software\Classes\CLSID\{16F3DD56-1AF5-4347-846D-7C10C4192619}" => removed successfully
    "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 4 (GFS Unread Mark)" => removed successfully
    "HKLM\Software\Classes\CLSID\{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}" => removed successfully
    "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive7" => removed successfully
    HKLM\Software\Wow6432Node\Classes\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => not found
    "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 1 (GFS Unread Stub)" => removed successfully
    "HKLM\Software\Wow6432Node\Classes\CLSID\{99FD978C-D287-4F50-827F-B2C658EDA8E7}" => removed successfully
    "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2 (GFS Stub)" => removed successfully
    "HKLM\Software\Wow6432Node\Classes\CLSID\{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}" => removed successfully
    "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" => removed successfully
    "HKLM\Software\Wow6432Node\Classes\CLSID\{920E6DB1-9907-4370-B3A0-BAFC03D81399}" => removed successfully
    "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 3 (GFS Folder)" => removed successfully
    "HKLM\Software\Wow6432Node\Classes\CLSID\{16F3DD56-1AF5-4347-846D-7C10C4192619}" => removed successfully
    "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Groove Explorer Icon Overlay 4 (GFS Unread Mark)" => removed successfully
    "HKLM\Software\Wow6432Node\Classes\CLSID\{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}" => removed successfully
    "HKLM\Software\Classes\*\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX" => removed successfully
    "HKLM\Software\Wow6432Node\Classes\CLSID\{6C467336-8281-4E60-8204-430CED96822D}" => removed successfully
    "HKLM\Software\Classes\AllFileSystemObjects\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX" => removed successfully
    "HKLM\Software\Classes\CLSID\{6C467336-8281-4E60-8204-430CED96822D}" => removed successfully
    "HKLM\Software\Classes\Directory\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX" => removed successfully
    HKLM\Software\Classes\CLSID\{6C467336-8281-4E60-8204-430CED96822D} => not found
    "HKLM\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers\Gadgets" => removed successfully
    HKLM\Software\Classes\CLSID\{6B9228DA-9C15-419e-856C-19E768A13BDC} => not found
    "HKLM\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX" => removed successfully
    HKLM\Software\Classes\CLSID\{6C467336-8281-4E60-8204-430CED96822D} => not found
    "HKLM\Software\Classes\Folder\ShellEx\ContextMenuHandlers\XXX Groove GFS Context Menu Handler XXX" => removed successfully
    HKLM\Software\Wow6432Node\Classes\CLSID\{6C467336-8281-4E60-8204-430CED96822D} => not found
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{032B01CC-1874-43B4-A40E-0A34AE5B0219}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{032B01CC-1874-43B4-A40E-0A34AE5B0219}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{0CC3794B-E509-49AE-AF82-09F758E715B3}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0CC3794B-E509-49AE-AF82-09F758E715B3}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{0EBF683C-73C8-427B-888B-F5FEDFA0A8B8}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0EBF683C-73C8-427B-888B-F5FEDFA0A8B8}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UNP\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Unlock" => not found
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{14160C5A-0629-4486-AD42-B50AD57381FA}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{14160C5A-0629-4486-AD42-B50AD57381FA}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\launchtrayprocess" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{15CDA51F-2714-4EDB-A171-93B428EB5EAB}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{15CDA51F-2714-4EDB-A171-93B428EB5EAB}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UNP\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\OutOfIdle" => not found
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{225F401F-D757-4C63-9C5E-338A1BF1A40C}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{225F401F-D757-4C63-9C5E-338A1BF1A40C}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\rundetector" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{310AE0D2-A029-42FE-9CBF-BE9D3169809C}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{310AE0D2-A029-42FE-9CBF-BE9D3169809C}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{3311EDC2-3EB7-44C7-98E3-001274DB87E2}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3311EDC2-3EB7-44C7-98E3-001274DB87E2}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Logon-5d" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3D5FD92F-118C-45D9-B0B3-3723CAC9801B}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3D5FD92F-118C-45D9-B0B3-3723CAC9801B}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Time-Weekend" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{453D4E41-9E0A-450B-ABEE-1E59AE056970}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{453D4E41-9E0A-450B-ABEE-1E59AE056970}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4EA06D77-9D3C-4D8D-87AC-E943886E5F61}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4EA06D77-9D3C-4D8D-87AC-E943886E5F61}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UNP\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\OnIdle" => not found
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{72D3B183-DAE2-4C2A-B083-2F775CA56B84}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{72D3B183-DAE2-4C2A-B083-2F775CA56B84}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\OfficeSoftwareProtectionPlatform\SvcRestartTask" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{81CF05AE-D06C-4C08-9EC1-EF7705F329D2}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{81CF05AE-D06C-4C08-9EC1-EF7705F329D2}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UNP\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Logon" => not found
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{92371601-C4C9-4886-8F49-55A1B31041CA}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{92371601-C4C9-4886-8F49-55A1B31041CA}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfig" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A67499BF-E58D-4F6B-808F-5521BCB22C84}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A67499BF-E58D-4F6B-808F-5521BCB22C84}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B45BD574-7084-4DF1-82B3-CD8D60EDDB56}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B45BD574-7084-4DF1-82B3-CD8D60EDDB56}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Time-5d" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B575AFE0-AF73-4398-9D64-5D7A4249CF40}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B575AFE0-AF73-4398-9D64-5D7A4249CF40}" => removed successfully
    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\CCleanerSkipUAC => not found
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B7A8F376-2E78-4061-83AB-BD6CC226463C}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B7A8F376-2E78-4061-83AB-BD6CC226463C}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxcontent" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B887A7D3-7A91-488D-87DA-512ED75B31E7}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B887A7D3-7A91-488D-87DA-512ED75B31E7}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CC5E2665-C32E-472A-B456-DD8263A22363}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CC5E2665-C32E-472A-B456-DD8263A22363}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UNP\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\Time" => not found
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{DB90AE6C-A7F3-4DCB-8F95-73AC04603218}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DB90AE6C-A7F3-4DCB-8F95-73AC04603218}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OnIdle-5d" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E63BAE5A-5EBA-47EA-A20E-B92FD497F1B2}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E63BAE5A-5EBA-47EA-A20E-B92FD497F1B2}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UNP\Campaigns\{91be532c-f9f1-406a-9858-43697c6f437a}\RunCampaignManager2" => not found
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E715D404-048F-428E-B4E3-3091D17C67DF}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E715D404-048F-428E-B4E3-3091D17C67DF}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F1B34399-703E-4852-B06A-F538BC5472CA}" => removed successfully
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F1B34399-703E-4852-B06A-F538BC5472CA}" => removed successfully
    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UNP\RunCampaignManager => not found
    C:\ProgramData\Temp => ":DED17083" ADS removed successfully

    =========== EmptyTemp: ==========

    BITS transfer queue => 9199616 B
    DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 2245638 B
    Java, Flash, Steam htmlcache => 1650 B
    Windows/system/drivers => 2013057 B
    Edge => 9573 B
    Chrome => 48077512 B
    Firefox => 104223863 B
    Opera => 22643417 B

    Temp, IE cache, history, cookies, recent:
    Default => 6656 B
    Users => 0 B
    ProgramData => 0 B
    Public => 0 B
    systemprofile => 0 B
    systemprofile32 => 0 B
    LocalService => 7616 B
    LocalService => 0 B
    NetworkService => 175062 B
    NetworkService => 0 B
    Dave => 109713227 B
    Hope => 82751493 B
    Ben => 700139 B
    Mary Jo => 439931 B
    Office Administrator => 411743592 B
    Share_with_Office => 174146 B
    Rich => 135222 B
    Administrator => 1313530 B
    DefaultAppPool => 6656 B

    RecycleBin => 695648941 B
    EmptyTemp: => 1.4 GB temporary data Removed.

    ================================


    The system needed a reboot.

    ==== End of Fixlog 23:49:42 ====
    Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 01-09-2018 15:36:21)

    C:\Program Files (x86)\mozilla firefox\defaults\pref\itms.js => Could not move

    Result of scheduled keys to remove after reboot:

    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} => could not remove. Access Denied.
    HKLM\Software\Classes\CLSID\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} => could not remove. Access Denied.
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} => could not remove. Access Denied.
    HKLM\Software\Classes\CLSID\{B4F3A835-0E21-4959-BA22-42B3008E02FF} => could not remove. Access Denied.
    HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f} => could not remove. Access Denied.
    HKLM\Software\Wow6432Node\Classes\CLSID\{d2ce3e00-f94a-4740-988e-03dc2f38c34f} => could not remove. Access Denied.
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\ OneDrive7 => could not remove. Access Denied.

    ==== End of Fixlog 15:36:21 ====

  6. #16
    Security Expert-emeritus Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    4,084

    Default

    PC seems to be running fine.
    Good

    Did you add items to remove from the fix I had created?


    ~~~~

    Emsisoft Emergency Kit - Fix Mode
    Follow the instructions below to run a scan using the Emsisoft Emergency Kit.
    • Download the Emsisoft Emergency Kit and execute it. From there, click on the Install button to extract the program in the EEK folder;
    • Once the extraction is complete, the EEK folder will open. Right-click on start emergency kit scanner.exe and select Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users);
    • EEK will suggest that you run an online update before using the program. Click on Yes to launch it.
    • After the update, click on Malware Scan under 2. Scan and accept to let EEK detect PUPs (click on Yes).
    • Once the scan is complete, make sure that every item in the list is checked, and click on the Quarantine selected button;
    • If it asks you for a reboot to delete some items, click on Ok to reboot automatically;
    • After the restart, open EEK again (in the C:\EEK folder);
    • This time, click on Logs;
    • From there, go under the Quarantine Log tab, and click on the Export button;
    • Save the log on your desktop, then open it, and copy/paste its content in your next reply;
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  7. #17
    Junior Member
    Join Date
    Aug 2018
    Posts
    26

    Default Done

    I am not sure what you meant. If you meant — did I copy your fix out of your post and run FRST with the fix option while that copy was in the clipboard — then yes.

    Log pasted below:

    Emsisoft Emergency Kit - Version 2018.6
    Last update: 9/2/2018 11:00:33 AM
    User account: 2012_Office\Office Administrator
    Computer name: 2012_OFFICE
    OS version: Windows 10x64

    Scan settings:

    Scan type: Malware Scan
    Objects: Rootkits, Memory, Traces, Files

    Detect PUPs: On
    Scan archives: Off
    Scan mail archives: Off
    ADS Scan: On
    File extension filter: Off
    Direct disk access: Off

    Scan start: 9/2/2018 11:00:54 AM

    Scanned 284819
    Found 0

    Scan end: 9/2/2018 12:56:25 PM
    Scan time: 1:55:31

  8. #18
    Junior Member
    Join Date
    Aug 2018
    Posts
    26

    Default Need K9 BlueCoat Advice

    This PC is not new. It has been running for 6 years, and getting some fairly intense usage. It's going to get kludgy.

    BUT, the point of having K9 BlueCoat installed was to limit/monitor young teenager porn viewing. That's not a problem anymore.

    Given that it seems that K9 may be generating false positives, is it time to uninstall it?

    If so, would I be good to go for general use with Windows Defender and Malwarebytes?

  9. #19
    Security Expert-emeritus Juliet's Avatar
    Join Date
    Feb 2007
    Location
    Deep South
    Posts
    4,084

    Default

    Quote Originally Posted by BooBounder View Post
    This PC is not new. It has been running for 6 years, and getting some fairly intense usage. It's going to get kludgy.
    BUT, the point of having K9 BlueCoat installed was to limit/monitor young teenager porn viewing. That's not a problem anymore.
    Given that it seems that K9 may be generating false positives, is it time to uninstall it?
    If so, would I be good to go for general use with Windows Defender and Malwarebytes?
    These are all good questions. The best answer I know of is to experiment around with the security (antivirus apps) to see what runs best on your machine.
    I've seen in the past, security suites that can bog down a computer to a crawl where on other computers they seem to run very well.

    I can supply you with a list of different security apps for you to read over then, if you make a decision to change you can switch over

    Anti-Virus, Anti-Malware, Firewall and Anti-Exploit/Ransomware

    Having a decent security setup (which also includes an Anti-Virus) is the most crucial step to protect a system. These programs are a layer of defence that will prevent a system from being infected, or if it somehow ends up infected, help mitigate the infection and remediate it. Ideally, you should have on your system one Antivirus (never more than one installed at the time), one Antimalware (you can install multiple of these, assuming they do not conflict with each other and the other security programs installed), one Firewall if you wish, one Anti-Exploit and/or Anti-Ransomware (since Ransomware are currently the most dangerous threat around and it can hit anywhere). Here are a few programs worth checking out if you don't have one yet.

    Note: The programs listed below are all free to use or they have some sort of trial. Some of them have a paid version that provides more features, while a lot of other good programs only have a paid version but aren't listed there (such as Kaspersky and ESET Antivirus products).

    Anti-Virus


    Anti-Malware
    • Malwarebytes - Has both a free and paid version. The Premium version of Malwarebytes also offers Exploit and Ransomware protection, for a complete package of: Malware, Web, Exploit and Ransomware protection
    • HitmanPro 3 - Free 30 day trial
    • Zemana AntiMalware - Free 30 day trial


    Firewall
    Starting in Windows Vista, the Windows Firewall greatly improved and will satisfy the needs of most users. If you do not have an Internet Suite Antivirus program (which includes a firewall) and you want to use a 3rd party firewall, you can consider the options below.
    • GlassWire - Has both a free and paid version (with different packages)
    • Windows Firewall Control - Gives you more control over your Windows Firewall
    • TinyWall - Lightweight firewall implementing the Windows Firewall and giving you more control over it


    Anti-Exploit/Anti-Ransomware


    the above information is created by Aura
    Windows Insider MVP Consumer Security 2009 - 2017
    Please do not PM me for Malware help, we all benefit from posting on the open board.

  10. #20
    Junior Member
    Join Date
    Aug 2018
    Posts
    26

    Default Thanks

    I see that you do not have Windows Defender on there.

    Should I always be running this on Windows 10 as my default?

    Or should I substitute one from each of the lists you gave (and not run Defender at all).

    FWIW: I will explore uninstalling K9 and see if my false positives go away.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •