Removal of s.yimg.com

Bobby06 · Dec 2, 2016

I need assistance Please with the removal of s.yimg.com, which is affecting everything on my PC it appeared first some 10 days ago on the bottom LH corner of Yahoo7, as of this moment I cannot access a full page of Yahoo of any description and access to Yahoo mail is the same symptoms. Any help would be most appreciated.
Regards
Nigel Stockley

tashi · Dec 2, 2016

Hello Bobby06,

Please see the FAQ which includes instructions in post #2 on how to provide the logs from Farbar Recovery Scan Tool and aswMBR, which are the logs used in the preliminary analysis.

http://forums.spybot.info/showthread.php?t=288

Once you provide the logs in this topic I will remove my post and merge yours, unless a helper responds beforehand.

Best regards.

Bobby06 · Dec 2, 2016

aswMBR version 1.0.1.2252 Copyright(c) 2014 AVAST Software
Run date: 2016-12-02 22:17:34
-----------------------------
22:17:34.939 OS Version: Windows x64 6.2.9200
22:17:34.939 Number of processors: 2 586 0x4C03
22:17:34.941 ComputerName: DESKTOP-G99A7OK UserName: stock
22:17:39.343 Initialize success
22:17:39.368 VM: initialized successfully
22:17:39.376 VM: Intel CPU BiosDisabled
22:17:49.101 AVAST engine defs: 16120100
22:18:14.122 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000024
22:18:14.126 Disk 0 Vendor: Size: 0MB BusType: 0
22:18:14.230 Disk 0 MBR read successfully
22:18:14.237 Disk 0 MBR scan
22:18:14.281 Disk 0 unknown MBR code
22:18:14.289 Disk 0 MBR hidden
22:18:14.305 Disk 0 Partition 1 00 EE GPT 2097151 MB offset 1
22:18:14.345 Disk 0 scanning C:\WINDOWS\system32\drivers
22:18:34.777 Service scanning
22:19:08.003 Modules scanning
22:19:08.070 Disk 0 trace - called modules:
22:19:08.137
22:19:10.261 AVAST engine scan C:\WINDOWS
22:19:18.647 AVAST engine scan C:\WINDOWS\system32
22:24:52.536 AVAST engine scan C:\WINDOWS\system32\drivers
22:25:47.562 AVAST engine scan C:\Users\stockScan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 30-11-2016
Ran by stock (administrator) on DESKTOP-G99A7OK (02-12-2016 22:02:47)
Running from C:\Users\stock\Downloads
Loaded Profiles: stock (Available Profiles: stock)
Platform: Windows 10 Home Version 1607 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Hola Networks Ltd.) C:\Program Files\Hola\app\hola_updater.exe
(Intel(R) Corporation) C:\Program Files\Intel\BCA\pabeSvc64.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Hola Networks Ltd.) C:\Program Files\Hola\app\hola_svc.exe
(McAfee, Inc.) C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(HP Inc.) C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\TXE Components\DAL\jhi_service.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler.exe
(McAfee, Inc.) C:\Program Files\TrueKey\McTkSchedulerService.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler64.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Security Assist\isa.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Hola Networks Ltd.) C:\Program Files\Hola\app\hola.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Logitech Inc.) C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe
() C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWelcome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8790264 2016-03-29] (Realtek Semiconductor)
HKLM\...\Run: [BtServer] => C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe [229592 2015-07-10] (Realtek Semiconductor Corporation)
HKLM\...\Run: [hola] => C:\Program Files\Hola\app\hola.exe [2166376 2016-10-18] (Hola Networks Ltd.) <===== ATTENTION
HKLM-x32\...\Run: [PowerDVD14Agent] => C:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14Agent.exe [795336 2015-10-01] (CyberLink Corp.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [9103976 2016-12-01] (AVAST Software)
HKLM-x32\...\Run: [BingDesktop] => C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe [2372800 2014-11-26] (Microsoft Corp.)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-09-22] (Oracle Corporation)
HKLM-x32\...\Run: [LWS] => C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [204136 2012-09-13] (Logitech Inc.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [5915776 2016-03-21] (Safer-Networking Ltd.)
HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\RunOnce: [Uninstall C:\Users\stock\AppData\Local\Microsoft\OneDrive\17.3.6390.0509_1\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\stock\AppData\Local\Microsoft\OneDrive\17.3.6390.0509_1\amd64"
HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\windows\WLXPGSS.SCR [322248 2014-03-31] (Microsoft Corporation)
Lsa: [Notification Packages] scecli C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2016-08-31] (AVAST Software)
Startup: C:\Users\stock\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Product Registration.lnk [2016-12-01]
ShortcutTarget: Logitech . Product Registration.lnk -> C:\Program Files (x86)\Logitech\Ereg\eReg.exe (Leader Technologies/Logitech)
Startup: C:\Users\stock\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - .lnk [2016-10-19]
ShortcutTarget: Monitor Ink Alerts - .lnk -> C:\Program Files\HP\HP Deskjet 1510 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
Startup: C:\Users\stock\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Deskjet 1510 series.lnk [2016-12-02]
ShortcutTarget: Monitor Ink Alerts - HP Deskjet 1510 series.lnk -> C:\Program Files\HP\HP Deskjet 1510 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{6a084aa0-8bc4-4012-b8f2-586389011ba5}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{c7f68307-655d-41b7-b9cc-15d172cda5aa}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://hp15-comm.msn.com/?pc=HRTE
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp15-comm.msn.com/?pc=HRTE
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://hp15-comm.msn.com/?pc=HRTE
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp15-comm.msn.com/?pc=HRTE
HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/en-au/?ocid=U143DHP&pfr=1
HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://hp15-comm.msn.com/?pc=HRTE
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2016-07-21] (HP Inc.)
BHO-x32: True Key Helper -> {0F4B8786-5502-4803-8EBC-F652A1153BB6} -> C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll [2016-07-15] (Intel Security)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\ssv.dll [2016-10-26] (Oracle Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll [2015-07-02] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\jp2ssv.dll [2016-10-26] (Oracle Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2016-07-21] (HP Inc.)
Toolbar: HKLM-x32 - True Key - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll [2016-07-15] (Intel Security)
Toolbar: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

Edge:
======
Edge Extension: (Adblock Plus) -> 10_EyeoGmbHAdblockPlus_d55gg7py3s0m0 => C:\Program Files\WindowsApps\EyeoGmbH.AdblockPlus_0.9.9.0_neutral__d55gg7py3s0m0 [2016-12-01]

FireFox:
========
FF ProfilePath: C:\Users\stock\AppData\Roaming\Mozilla\Firefox\Profiles\whawyrn4.default-1478817956913 [2016-12-02]
FF Homepage: Mozilla\Firefox\Profiles\whawyrn4.default-1478817956913 -> hxxps://au.yahoo.com/#
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: (Avast Online Security) - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-12-01]
FF HKLM\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF Extension: (Avast SafePrice) - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2016-12-01]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF HKLM-x32\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_23_0_0_207.dll [2016-11-09] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWoW64\Macromed\Flash\NPSWF32_23_0_0_207.dll [2016-11-09] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.56 -> C:\Program Files (x86)\Intel\TXE Components\IPT\npIntelWebAPIIPT.dll [2014-07-02] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\TXE Components\IPT\npIntelWebAPIUpdater.dll [2014-07-02] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.111.2 -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\dtplugin\npDeployJava1.dll [2016-10-26] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.111.2 -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\plugin2\npjp2.dll [2016-10-26] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-29] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-29] (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll [2016-08-01] ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-10-01] (Adobe Systems Inc.)

Chrome:
=======
CHR HomePage: Default -> nine.com.au/
CHR Profile: C:\Users\stock\AppData\Local\Google\Chrome\User Data\Default [2016-12-02]
CHR Extension: (Google Docs) - C:\Users\stock\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-12-02]
CHR Extension: (Google Drive) - C:\Users\stock\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-12-02]
CHR Extension: (YouTube) - C:\Users\stock\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-12-02]
CHR Extension: (X-notifier (for Gmail™,Hotmail,Yahoo,AOL...)) - C:\Users\stock\AppData\Local\Google\Chrome\User Data\Default\Extensions\cdfjbkbddpfnoplfhceolpopfoepleco [2016-12-02]
CHR Extension: (Adblock Plus) - C:\Users\stock\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-12-02]
CHR Extension: (Nine.com.au - Homepage & Bookmarks) - C:\Users\stock\AppData\Local\Google\Chrome\User Data\Default\Extensions\efeejpljhmnlmccjklepacdpmjgmhieg [2016-12-02]
CHR Extension: (Avast SafePrice) - C:\Users\stock\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2016-12-02]
CHR Extension: (Radioplayer) - C:\Users\stock\AppData\Local\Google\Chrome\User Data\Default\Extensions\fcppdfelojakeahklfgkjegnpbgndoch [2016-12-02]
CHR Extension: (Google Docs Offline) - C:\Users\stock\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-12-02]
CHR Extension: (Unlimited Free VPN - Hola) - C:\Users\stock\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio [2016-12-02]
CHR Extension: (Avast Online Security) - C:\Users\stock\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2016-12-02]
CHR Extension: (Chrome Web Store Payments) - C:\Users\stock\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-12-02]
CHR Extension: (Gmail) - C:\Users\stock\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-12-02]
CHR Extension: (Chrome Media Router) - C:\Users\stock\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-12-02]
CHR HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [fkkcgfbgohboipdhliafmacjnhjbhmim] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <not found>

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [197128 2016-08-31] (AVAST Software)
S2 BingDesktopUpdate; C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [173248 2014-11-26] (Microsoft Corp.)
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-05] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2016-11-05] (Dropbox, Inc.)
S2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [350064 2016-08-01] (WildTangent)
R2 hola_svc; C:\Program Files\Hola\app\hola_svc.exe [5622376 2016-10-18] (Hola Networks Ltd.) <==== ATTENTION
R2 hola_updater; C:\Program Files\Hola\app\hola_updater.exe [5622376 2016-10-18] (Hola Networks Ltd.) <==== ATTENTION
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [29728 2016-08-15] (HP Inc.)
R2 igfxCUIService2.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [353896 2015-12-02] (Intel Corporation)
R3 Intel(R) Security Assist; C:\Program Files (x86)\Intel\Intel(R) Security Assist\isa.exe [335872 2015-05-20] (Intel Corporation) [File not signed]
R2 IntelBCAsvc; C:\Program Files\Intel\BCA\pabeSvc64.exe [3026584 2016-05-06] (Intel(R) Corporation)
S2 isaHelperSvc; C:\Program Files (x86)\Intel\Intel(R) Security Assist\isaHelperService.exe [7680 2015-05-20] () [File not signed]
R2 jhi_service; C:\Program Files (x86)\Intel\TXE Components\DAL\jhi_service.exe [174368 2015-04-22] (Intel Corporation)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [389896 2014-04-15] ()
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [316152 2016-03-29] (Realtek Semiconductor)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [4088608 2016-09-21] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [235984 2016-11-24] (Safer-Networking Ltd.)
R2 TrueKey; C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe [908256 2016-07-22] (McAfee, Inc.)
R2 TrueKeyScheduler; C:\Program Files\TrueKey\McTkSchedulerService.exe [15736 2016-07-22] (McAfee, Inc.)
S3 TrueKeyServiceHelper; C:\Program Files\TrueKey\McAfee.TrueKey.ServiceHelper.exe [86864 2016-07-22] (McAfee, Inc.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 aswHwid; C:\WINDOWS\system32\drivers\aswHwid.sys [37656 2016-08-31] (AVAST Software)
R1 aswKbd; C:\WINDOWS\system32\drivers\aswKbd.sys [37144 2016-08-31] (AVAST Software)
R2 aswMonFlt; C:\WINDOWS\system32\drivers\aswMonFlt.sys [108816 2016-08-31] (AVAST Software)
R1 aswRdr; C:\WINDOWS\system32\drivers\aswRdr2.sys [103064 2016-08-31] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [74544 2016-08-31] (AVAST Software)
R1 aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [969184 2016-10-26] (AVAST Software)
R1 aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [513632 2016-10-26] (AVAST Software)
R2 aswStm; C:\WINDOWS\system32\drivers\aswStm.sys [163416 2016-08-31] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [293352 2016-10-26] (AVAST Software)
R3 igfxLP; C:\WINDOWS\system32\DRIVERS\igdkmd64lp.sys [7279504 2015-12-02] (Intel Corporation)
S3 mfencbdc; C:\WINDOWS\System32\DRIVERS\mfencbdc.sys [543488 2016-02-10] (McAfee, Inc.)
S3 mfencrk; C:\WINDOWS\System32\DRIVERS\mfencrk.sys [109480 2016-02-10] (McAfee, Inc.)
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [886528 2015-06-03] (Realtek )
R3 RtkBtFilter; C:\WINDOWS\system32\DRIVERS\RtkBtfilter.sys [709376 2016-03-16] (Realtek Semiconductor Corporation)
R3 RTSUER; C:\WINDOWS\system32\Drivers\RtsUer.sys [402136 2015-05-28] (Realsil Semiconductor Corporation)
R3 RTWlanE; C:\WINDOWS\System32\drivers\rtwlane.sys [5144064 2016-07-16] (Realtek Semiconductor Corporation )
U1 staport; C:\Windows\System32\Drivers\staport.sys [44952 2016-10-26] ()
R3 TXEIx64; C:\WINDOWS\System32\drivers\TXEIx64.sys [146200 2015-12-02] (Intel Corporation)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-12-02 22:02 - 2016-12-02 22:03 - 00021649 _____ C:\Users\stock\Downloads\FRST.txt
2016-12-02 21:59 - 2016-12-02 22:02 - 00000000 ____D C:\FRST
2016-12-02 21:59 - 2016-12-02 21:59 - 02411520 _____ (Farbar) C:\Users\stock\Downloads\FRST64.exe
2016-12-02 21:55 - 2016-12-02 21:55 - 00002319 _____ C:\Users\Public\Desktop\Tweaking.com - Registry Backup.lnk
2016-12-02 21:55 - 2016-12-02 21:55 - 00000207 _____ C:\WINDOWS\tweaking.com-regbackup-DESKTOP-G99A7OK-Windows-10-Home-(64-bit).dat
2016-12-02 21:55 - 2016-12-02 21:55 - 00000000 ____D C:\RegBackup
2016-12-02 21:55 - 2016-12-02 21:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2016-12-02 21:55 - 2016-12-02 21:55 - 00000000 ____D C:\Program Files (x86)\Tweaking.com
2016-12-02 21:54 - 2016-12-02 21:55 - 00017987 _____ C:\WINDOWS\Tweaking.com - Registry Backup Setup Log.txt
2016-12-02 21:52 - 2016-12-02 21:54 - 05766144 _____ (Tweaking.com) C:\Users\stock\Downloads\tweaking.com_registry_backup_setup.exe
2016-12-02 18:32 - 2016-12-02 18:32 - 00000000 ___HD C:\OneDriveTemp
2016-12-02 11:58 - 2016-11-10 20:13 - 00453396 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20161202-115818.backup
2016-12-02 09:17 - 2016-12-02 09:17 - 00002355 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-12-02 09:17 - 2016-12-02 09:17 - 00002343 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-12-02 09:14 - 2016-12-02 09:14 - 01065376 _____ (Google Inc.) C:\Users\stock\Downloads\ChromeSetup (1).exe
2016-12-01 22:07 - 2016-12-01 22:07 - 00044952 _____ () C:\WINDOWS\system32\Drivers\staport.sys.148059403967102
2016-12-01 22:06 - 2016-10-26 10:15 - 00969184 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw932E.tmp
2016-12-01 22:06 - 2016-10-26 10:15 - 00513632 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw93A0.tmp
2016-12-01 22:06 - 2016-10-26 10:15 - 00293352 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw96AE.tmp
2016-12-01 22:06 - 2016-08-31 07:35 - 00391496 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2016-12-01 22:06 - 2016-08-31 07:35 - 00163416 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw96BF.tmp
2016-12-01 22:06 - 2016-08-31 07:35 - 00108816 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw938E.tmp
2016-12-01 22:06 - 2016-08-31 07:35 - 00103064 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw936D.tmp
2016-12-01 22:06 - 2016-08-31 07:35 - 00074544 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw938F.tmp
2016-12-01 22:06 - 2016-08-31 07:35 - 00037656 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw937E.tmp
2016-12-01 22:06 - 2016-08-31 07:34 - 00037144 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\asw9252.tmp
2016-12-01 22:03 - 2016-12-01 22:03 - 00000000 ____D C:\WINDOWS\Panther
2016-12-01 21:16 - 2016-12-01 21:16 - 00659732 _____ C:\Users\stock\OneDrive\Documents\cc_20161201_211606.reg
2016-12-01 21:14 - 2016-12-01 21:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2016-11-26 08:58 - 2016-11-26 08:58 - 00000000 ____D C:\$SysReset
2016-11-24 18:18 - 2016-11-24 18:18 - 03278250 _____ C:\Users\stock\Downloads\236902298.pdf
2016-11-16 20:48 - 2016-12-01 21:21 - 00000000 ____D C:\Users\stock\AppData\LocalLow\Mozilla
2016-11-11 08:54 - 2016-11-11 08:55 - 00243520 _____ C:\Users\stock\Downloads\Firefox Setup Stub 49.0.2.exe
2016-11-10 20:13 - 2016-10-31 21:13 - 00453346 ____R C:\WINDOWS\system32\Drivers\etc\hosts.20161110-201325.backup
2016-11-10 19:56 - 2016-11-10 19:56 - 00000308 _____ C:\WINDOWS\wininit.ini
2016-11-10 08:04 - 2016-11-10 08:04 - 00000000 ____D C:\Users\stock\AppData\Local\AVAST Software
2016-11-10 07:55 - 2016-11-02 21:22 - 01570672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2016-11-10 07:55 - 2016-11-02 21:22 - 00601712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll
2016-11-10 07:55 - 2016-11-02 21:12 - 00341344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2016-11-10 07:55 - 2016-11-02 21:09 - 02257104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2016-11-10 07:55 - 2016-11-02 21:08 - 00602464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupEngine.dll
2016-11-10 07:55 - 2016-11-02 21:08 - 00111968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupApi.dll
2016-11-10 07:55 - 2016-11-02 21:05 - 20969928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2016-11-10 07:55 - 2016-11-02 21:05 - 06657176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2016-11-10 07:55 - 2016-11-02 21:05 - 03892352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2016-11-10 07:55 - 2016-11-02 21:05 - 00951904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll
2016-11-10 07:55 - 2016-11-02 21:04 - 00596832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comctl32.dll
2016-11-10 07:55 - 2016-11-02 21:01 - 01425000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d9.dll
2016-11-10 07:55 - 2016-11-02 21:01 - 01263856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2016-11-10 07:55 - 2016-11-02 21:01 - 00276832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\input.dll
2016-11-10 07:55 - 2016-11-02 20:50 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LaunchWinApp.exe
2016-11-10 07:55 - 2016-11-02 20:49 - 00147968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32k.sys
2016-11-10 07:55 - 2016-11-02 20:48 - 00095232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TSpkg.dll
2016-11-10 07:55 - 2016-11-02 20:48 - 00081408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2016-11-10 07:55 - 2016-11-02 20:47 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BlockedShutdown.dll
2016-11-10 07:55 - 2016-11-02 20:47 - 00047104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Shell.Search.UriHandler.dll
2016-11-10 07:55 - 2016-11-02 20:46 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininetlui.dll
2016-11-10 07:55 - 2016-11-02 20:45 - 00253952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BioFeedback.dll
2016-11-10 07:55 - 2016-11-02 20:45 - 00182784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsensorgroup.dll
2016-11-10 07:55 - 2016-11-02 20:44 - 00180224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe
2016-11-10 07:55 - 2016-11-02 20:44 - 00089088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AuthExt.dll
2016-11-10 07:55 - 2016-11-02 20:43 - 00731136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d8.dll
2016-11-10 07:55 - 2016-11-02 20:43 - 00557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StoreAgent.dll
2016-11-10 07:55 - 2016-11-02 20:43 - 00198144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FSClient.dll
2016-11-10 07:55 - 2016-11-02 20:42 - 00866816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Cred.dll
2016-11-10 07:55 - 2016-11-02 20:42 - 00632832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sud.dll
2016-11-10 07:55 - 2016-11-02 20:42 - 00549376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActionCenterCPL.dll
2016-11-10 07:55 - 2016-11-02 20:42 - 00506880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DevicePairing.dll
2016-11-10 07:55 - 2016-11-02 20:42 - 00306176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieproxy.dll
2016-11-10 07:55 - 2016-11-02 20:42 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgentUserBroker.exe
2016-11-10 07:55 - 2016-11-02 20:41 - 00635904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2016-11-10 07:55 - 2016-11-02 20:40 - 00548352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ddraw.dll
2016-11-10 07:55 - 2016-11-02 20:40 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\indexeddbserver.dll
2016-11-10 07:55 - 2016-11-02 20:39 - 00465920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LockAppBroker.dll
2016-11-10 07:55 - 2016-11-02 20:39 - 00348672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\zipfldr.dll
2016-11-10 07:55 - 2016-11-02 20:39 - 00236544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIAnimation.dll
2016-11-10 07:55 - 2016-11-02 20:38 - 00760832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\appwiz.cpl
2016-11-10 07:55 - 2016-11-02 20:37 - 19415040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2016-11-10 07:55 - 2016-11-02 20:36 - 07626752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2016-11-10 07:55 - 2016-11-02 20:35 - 00336896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msinfo32.exe
2016-11-10 07:55 - 2016-11-02 20:33 - 12349952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2016-11-10 07:55 - 2016-11-02 20:33 - 03307520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2016-11-10 07:55 - 2016-11-02 20:31 - 01228288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usercpl.dll
2016-11-10 07:55 - 2016-11-02 20:31 - 00090624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll
2016-11-10 07:55 - 2016-11-02 20:30 - 12175360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2016-11-10 07:55 - 2016-11-02 20:29 - 07469056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2016-11-10 07:55 - 2016-11-02 20:29 - 03666432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2016-11-10 07:55 - 2016-11-02 20:29 - 00884224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2016-11-10 07:55 - 2016-11-02 20:29 - 00122368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NPSM.dll
2016-11-10 07:55 - 2016-11-02 20:28 - 06044160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2016-11-10 07:55 - 2016-11-02 20:28 - 00807424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.OnlineId.dll
2016-11-10 07:55 - 2016-11-02 20:28 - 00079360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\asycfilt.dll
2016-11-10 07:55 - 2016-11-02 20:27 - 02458112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\themecpl.dll
2016-11-10 07:55 - 2016-11-02 20:27 - 00580608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hgcpl.dll
2016-11-10 07:55 - 2016-11-02 20:27 - 00422400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.dll
2016-11-10 07:55 - 2016-11-02 20:26 - 02747392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll
2016-11-10 07:55 - 2016-11-02 20:26 - 01880576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll
2016-11-10 07:55 - 2016-11-02 20:26 - 01595392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2016-11-10 07:55 - 2016-11-02 20:26 - 01509376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2016-11-10 07:55 - 2016-11-02 20:26 - 00912896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comdlg32.dll
2016-11-10 07:55 - 2016-11-02 20:26 - 00798208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2016-11-10 07:55 - 2016-11-02 20:26 - 00712192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Search.dll
2016-11-10 07:55 - 2016-11-02 20:26 - 00358912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\stobject.dll
2016-11-10 07:55 - 2016-11-02 20:25 - 02998272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2016-11-10 07:55 - 2016-11-02 20:25 - 02256384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2016-11-10 07:55 - 2016-11-02 20:25 - 01556480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll
2016-11-10 07:55 - 2016-11-02 20:25 - 00772608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntshrui.dll
2016-11-10 07:55 - 2016-11-02 20:23 - 03106304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstsc.exe
2016-11-10 07:55 - 2016-11-02 20:23 - 02356736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVidCtl.dll
2016-11-10 07:55 - 2016-08-02 14:30 - 00822784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll
2016-11-10 07:54 - 2016-11-02 22:01 - 00484584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2016-11-10 07:54 - 2016-11-02 22:01 - 00315744 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2016-11-10 07:54 - 2016-11-02 21:10 - 02323728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll
2016-11-10 07:54 - 2016-11-02 21:08 - 00576408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2016-11-10 07:54 - 2016-11-02 21:08 - 00186424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\weretw.dll
2016-11-10 07:54 - 2016-11-02 21:05 - 00959112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2016-11-10 07:54 - 2016-11-02 21:04 - 04312248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2016-11-10 07:54 - 2016-11-02 21:01 - 01415744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2016-11-10 07:54 - 2016-11-02 21:01 - 00545936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2016-11-10 07:54 - 2016-11-02 20:49 - 00037376 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2016-11-10 07:54 - 2016-11-02 20:48 - 00032768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\efsext.dll
2016-11-10 07:54 - 2016-11-02 20:47 - 00156672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BcastDVRHelper.dll
2016-11-10 07:54 - 2016-11-02 20:46 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppCapture.dll
2016-11-10 07:54 - 2016-11-02 20:45 - 00492032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcastdvr.exe
2016-11-10 07:54 - 2016-11-02 20:44 - 00231936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll
2016-11-10 07:54 - 2016-11-02 20:43 - 00270336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2016-11-10 07:54 - 2016-11-02 20:43 - 00126464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2016-11-10 07:54 - 2016-11-02 20:42 - 00202752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.HumanInterfaceDevice.dll
2016-11-10 07:54 - 2016-11-02 20:40 - 00896512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontext.dll
2016-11-10 07:54 - 2016-11-02 20:36 - 19415552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2016-11-10 07:54 - 2016-11-02 20:36 - 00063488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ErrorDetailsUpdate.dll
2016-11-10 07:54 - 2016-11-02 20:31 - 03196416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdp.dll
2016-11-10 07:54 - 2016-11-02 20:30 - 00134144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ErrorDetails.dll
2016-11-10 07:54 - 2016-11-02 20:29 - 01247232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll
2016-11-10 07:54 - 2016-11-02 20:28 - 04423680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll
2016-11-10 07:54 - 2016-11-02 20:28 - 00109568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\chartv.dll
2016-11-10 07:54 - 2016-11-02 20:26 - 02484736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gameux.dll
2016-11-10 07:54 - 2016-11-02 20:23 - 00199680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GlobCollationHost.dll
2016-11-10 07:54 - 2016-11-02 19:11 - 00788624 _____ C:\WINDOWS\SysWOW64\locale.nls
2016-11-10 07:54 - 2016-11-02 19:11 - 00788624 _____ C:\WINDOWS\system32\locale.nls
2016-11-10 07:52 - 2016-11-02 20:23 - 02104320 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidsvc.dll
2016-11-10 07:51 - 2016-11-02 21:20 - 00378720 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2016-11-10 07:51 - 2016-11-02 21:14 - 07816544 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2016-11-10 07:51 - 2016-11-02 21:13 - 01883784 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2016-11-10 07:51 - 2016-11-02 21:13 - 00773720 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll
2016-11-10 07:51 - 2016-11-02 21:13 - 00423776 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifitask.exe
2016-11-10 07:51 - 2016-11-02 21:12 - 02255712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2016-11-10 07:51 - 2016-11-02 21:12 - 00376672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys
2016-11-10 07:51 - 2016-11-02 21:05 - 00405856 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2016-11-10 07:51 - 2016-11-02 21:04 - 02678056 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll
2016-11-10 07:51 - 2016-11-02 21:03 - 02750936 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2016-11-10 07:51 - 2016-11-02 21:02 - 00848736 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupEngine.dll
2016-11-10 07:51 - 2016-11-02 21:02 - 00682816 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2016-11-10 07:51 - 2016-11-02 21:02 - 00238056 _____ (Microsoft Corporation) C:\WINDOWS\system32\weretw.dll
2016-11-10 07:51 - 2016-11-02 21:02 - 00148832 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupApi.dll
2016-11-10 07:51 - 2016-11-02 21:01 - 00092512 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2016-11-10 07:51 - 2016-11-02 21:00 - 22223968 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2016-11-10 07:51 - 2016-11-02 21:00 - 08156080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2016-11-10 07:51 - 2016-11-02 21:00 - 04130432 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2016-11-10 07:51 - 2016-11-02 21:00 - 01274712 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2016-11-10 07:51 - 2016-11-02 21:00 - 01061968 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll
2016-11-10 07:51 - 2016-11-02 20:59 - 04673304 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2016-11-10 07:51 - 2016-11-02 20:56 - 01609920 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d9.dll
2016-11-10 07:51 - 2016-11-02 20:56 - 01572768 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2016-11-10 07:51 - 2016-11-02 20:56 - 01418312 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2016-11-10 07:51 - 2016-11-02 20:56 - 00628552 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2016-11-10 07:51 - 2016-11-02 20:56 - 00322912 _____ (Microsoft Corporation) C:\WINDOWS\system32\input.dll
2016-11-10 07:51 - 2016-11-02 20:55 - 00048992 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\iorate.sys
2016-11-10 07:51 - 2016-11-02 20:38 - 22563840 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2016-11-10 07:51 - 2016-11-02 20:34 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\system32\microsoft-windows-system-events.dll
2016-11-10 07:51 - 2016-11-02 20:34 - 00043008 _____ (Microsoft Corporation) C:\WINDOWS\system32\LaunchWinApp.exe
2016-11-10 07:51 - 2016-11-02 20:33 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2016-11-10 07:51 - 2016-11-02 20:32 - 00045056 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2016-11-10 07:51 - 2016-11-02 20:32 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\system32\efsext.dll
2016-11-10 07:51 - 2016-11-02 20:31 - 00226304 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcTok.exe
2016-11-10 07:51 - 2016-11-02 20:31 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSpkg.dll
2016-11-10 07:51 - 2016-11-02 20:31 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininetlui.dll
2016-11-10 07:51 - 2016-11-02 20:30 - 09131008 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2016-11-10 07:51 - 2016-11-02 20:30 - 00635904 _____ (Microsoft Corporation) C:\WINDOWS\system32\FlightSettings.dll
2016-11-10 07:51 - 2016-11-02 20:30 - 00567296 _____ (Microsoft Corporation) C:\WINDOWS\system32\DevicePairing.dll
2016-11-10 07:51 - 2016-11-02 20:30 - 00363520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BioFeedback.dll
2016-11-10 07:51 - 2016-11-02 20:30 - 00321536 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2016-11-10 07:51 - 2016-11-02 20:30 - 00109056 _____ (Microsoft Corporation) C:\WINDOWS\system32\dab.dll
2016-11-10 07:51 - 2016-11-02 20:30 - 00058880 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Shell.Search.UriHandler.dll
2016-11-10 07:51 - 2016-11-02 20:29 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BlockedShutdown.dll
2016-11-10 07:51 - 2016-11-02 20:29 - 00336896 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkBindingEngineMigPlugin.dll
2016-11-10 07:51 - 2016-11-02 20:29 - 00314880 _____ (Microsoft Corporation) C:\WINDOWS\system32\FSClient.dll
2016-11-10 07:51 - 2016-11-02 20:29 - 00296960 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsensorgroup.dll
2016-11-10 07:51 - 2016-11-02 20:29 - 00276992 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2016-11-10 07:51 - 2016-11-02 20:29 - 00211968 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe
2016-11-10 07:51 - 2016-11-02 20:29 - 00139264 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2016-11-10 07:51 - 2016-11-02 20:28 - 00748544 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll
2016-11-10 07:51 - 2016-11-02 20:28 - 00690176 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieproxy.dll
2016-11-10 07:51 - 2016-11-02 20:28 - 00566784 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActionCenterCPL.dll
2016-11-10 07:51 - 2016-11-02 20:28 - 00432128 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpAXHolder.dll
2016-11-10 07:51 - 2016-11-02 20:28 - 00411136 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCenter.dll
2016-11-10 07:51 - 2016-11-02 20:28 - 00321024 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkUXBroker.dll
2016-11-10 07:51 - 2016-11-02 20:28 - 00279552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.HumanInterfaceDevice.dll
2016-11-10 07:51 - 2016-11-02 20:28 - 00274432 _____ (Microsoft Corporation) C:\WINDOWS\system32\ListSvc.dll
2016-11-10 07:51 - 2016-11-02 20:28 - 00260608 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgentUserBroker.exe
2016-11-10 07:51 - 2016-11-02 20:28 - 00252928 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll
2016-11-10 07:51 - 2016-11-02 20:28 - 00240640 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkDesktopSettings.dll
2016-11-10 07:51 - 2016-11-02 20:28 - 00115200 _____ (Microsoft Corporation) C:\WINDOWS\system32\IdCtrls.dll
2016-11-10 07:51 - 2016-11-02 20:28 - 00088576 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2016-11-10 07:51 - 2016-11-02 20:27 - 23677952 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2016-11-10 07:51 - 2016-11-02 20:27 - 01388544 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Cred.dll
2016-11-10 07:51 - 2016-11-02 20:27 - 00631296 _____ (Microsoft Corporation) C:\WINDOWS\system32\WlanMediaManager.dll
2016-11-10 07:51 - 2016-11-02 20:27 - 00545792 _____ (Microsoft Corporation) C:\WINDOWS\system32\timedate.cpl
2016-11-10 07:51 - 2016-11-02 20:27 - 00495104 _____ (Microsoft Corporation) C:\WINDOWS\system32\DataSenseHandlers.dll
2016-11-10 07:51 - 2016-11-02 20:27 - 00261632 _____ (Microsoft Corporation) C:\WINDOWS\system32\indexeddbserver.dll
2016-11-10 07:51 - 2016-11-02 20:26 - 00579072 _____ (Microsoft Corporation) C:\WINDOWS\system32\ddraw.dll
2016-11-10 07:51 - 2016-11-02 20:26 - 00388608 _____ (Microsoft Corporation) C:\WINDOWS\system32\zipfldr.dll
2016-11-10 07:51 - 2016-11-02 20:26 - 00278016 _____ (Microsoft Corporation) C:\WINDOWS\system32\netplwiz.dll
2016-11-10 07:51 - 2016-11-02 20:26 - 00273920 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIAnimation.dll
2016-11-10 07:51 - 2016-11-02 20:26 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll
2016-11-10 07:51 - 2016-11-02 20:25 - 00655872 _____ (Microsoft Corporation) C:\WINDOWS\system32\sud.dll
2016-11-10 07:51 - 2016-11-02 20:25 - 00541696 _____ (Microsoft Corporation) C:\WINDOWS\system32\ipnathlp.dll
2016-11-10 07:51 - 2016-11-02 20:25 - 00496128 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettings.UserAccountsHandlers.dll
2016-11-10 07:51 - 2016-11-02 20:24 - 03778560 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2016-11-10 07:51 - 2016-11-02 20:24 - 00940032 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontext.dll
2016-11-10 07:51 - 2016-11-02 20:22 - 13441024 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
2016-11-10 07:51 - 2016-11-02 20:22 - 13081600 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2016-11-10 07:51 - 2016-11-02 20:22 - 04749312 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2016-11-10 07:51 - 2016-11-02 20:22 - 00369664 _____ (Microsoft Corporation) C:\WINDOWS\system32\msinfo32.exe
2016-11-10 07:51 - 2016-11-02 20:21 - 05111296 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdp.dll
2016-11-10 07:51 - 2016-11-02 20:19 - 08127488 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2016-11-10 07:51 - 2016-11-02 20:19 - 08075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2016-11-10 07:51 - 2016-11-02 20:19 - 01586176 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll
2016-11-10 07:51 - 2016-11-02 20:19 - 00981504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.OnlineId.dll
2016-11-10 07:51 - 2016-11-02 20:19 - 00805888 _____ (Microsoft Corporation) C:\WINDOWS\system32\FrameServer.dll
2016-11-10 07:51 - 2016-11-02 20:19 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\NPSM.dll
2016-11-10 07:51 - 2016-11-02 20:19 - 00130560 _____ (Microsoft Corporation) C:\WINDOWS\system32\chartv.dll
2016-11-10 07:51 - 2016-11-02 20:19 - 00089088 _____ (Microsoft Corporation) C:\WINDOWS\system32\asycfilt.dll
2016-11-10 07:51 - 2016-11-02 20:18 - 00991232 _____ (Microsoft Corporation) C:\WINDOWS\system32\comdlg32.dll
2016-11-10 07:51 - 2016-11-02 20:18 - 00836608 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcRefreshTask.dll
2016-11-10 07:51 - 2016-11-02 20:18 - 00243712 _____ (Microsoft Corporation) C:\WINDOWS\system32\shdocvw.dll
2016-11-10 07:51 - 2016-11-02 20:17 - 04746752 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2016-11-10 07:51 - 2016-11-02 20:17 - 01282048 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2016-11-10 07:51 - 2016-11-02 20:17 - 00982528 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2016-11-10 07:51 - 2016-11-02 20:17 - 00909824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Search.dll
2016-11-10 07:51 - 2016-11-02 20:17 - 00389632 _____ (Microsoft Corporation) C:\WINDOWS\system32\stobject.dll
2016-11-10 07:51 - 2016-11-02 20:16 - 04148736 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2016-11-10 07:51 - 2016-11-02 20:16 - 03400192 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncCenter.dll
2016-11-10 07:51 - 2016-11-02 20:16 - 03133440 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll
2016-11-10 07:51 - 2016-11-02 20:16 - 02688512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll
2016-11-10 07:51 - 2016-11-02 20:16 - 02669056 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2016-11-10 07:51 - 2016-11-02 20:16 - 02512384 _____ (Microsoft Corporation) C:\WINDOWS\system32\themecpl.dll
2016-11-10 07:51 - 2016-11-02 20:16 - 01779712 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2016-11-10 07:51 - 2016-11-02 20:16 - 01637888 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2016-11-10 07:51 - 2016-11-02 20:16 - 01490944 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2016-11-10 07:51 - 2016-11-02 20:16 - 01359360 _____ (Microsoft Corporation) C:\WINDOWS\system32\usercpl.dll
2016-11-10 07:51 - 2016-11-02 20:16 - 00629248 _____ (Microsoft Corporation) C:\WINDOWS\system32\hgcpl.dll
2016-11-10 07:51 - 2016-11-02 20:16 - 00579072 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppBroker.dll
2016-11-10 07:51 - 2016-11-02 20:16 - 00308736 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActionCenter.dll
2016-11-10 07:51 - 2016-11-02 20:16 - 00265728 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupSvc.dll
2016-11-10 07:51 - 2016-11-02 20:15 - 04708864 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExplorerFrame.dll
2016-11-10 07:51 - 2016-11-02 20:15 - 03616768 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2016-11-10 07:51 - 2016-11-02 20:15 - 02611200 _____ (Microsoft Corporation) C:\WINDOWS\system32\gameux.dll
2016-11-10 07:51 - 2016-11-02 20:15 - 01513472 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2016-11-10 07:51 - 2016-11-02 20:15 - 01348608 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll
2016-11-10 07:51 - 2016-11-02 20:15 - 00842240 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntshrui.dll
2016-11-10 07:51 - 2016-11-02 20:15 - 00483328 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.dll
2016-11-10 07:51 - 2016-11-02 20:14 - 01726976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll
2016-11-10 07:51 - 2016-11-02 20:13 - 03496960 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVidCtl.dll
2016-11-10 07:51 - 2016-11-02 20:13 - 03299840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstsc.exe
2016-11-10 07:51 - 2016-11-02 20:13 - 00322048 _____ (Microsoft Corporation) C:\WINDOWS\system32\GlobCollationHost.dll
2016-11-10 07:51 - 2016-11-02 18:20 - 00446896 _____ C:\WINDOWS\system32\ApnDatabase.xml
2016-11-10 07:50 - 2016-11-02 21:20 - 00590960 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2016-11-10 07:50 - 2016-11-02 21:15 - 01051112 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2016-11-10 07:50 - 2016-11-02 21:15 - 00894096 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2016-11-10 07:50 - 2016-11-02 21:13 - 01354320 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2016-11-10 07:50 - 2016-11-02 21:13 - 01173496 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2016-11-10 07:50 - 2016-11-02 21:03 - 00714592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2016-11-10 07:50 - 2016-11-02 21:00 - 00534096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2016-11-10 07:50 - 2016-11-02 20:31 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\system32\BcastDVRHelper.dll
2016-11-10 07:50 - 2016-11-02 20:31 - 00170496 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppCapture.dll
2016-11-10 07:50 - 2016-11-02 20:31 - 00159232 _____ (Microsoft Corporation) C:\WINDOWS\system32\ACPBackgroundManagerPolicy.dll
2016-11-10 07:50 - 2016-11-02 20:31 - 00097792 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll
2016-11-10 07:50 - 2016-11-02 20:28 - 00324608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll
2016-11-10 07:50 - 2016-11-02 20:27 - 00605184 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvr.exe
2016-11-10 07:50 - 2016-11-02 20:25 - 00956416 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2016-11-10 07:50 - 2016-11-02 20:23 - 00101888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bowser.sys
2016-11-10 07:50 - 2016-11-02 20:23 - 00072704 _____ (Microsoft Corporation) C:\WINDOWS\system32\ErrorDetailsUpdate.dll
2016-11-10 07:50 - 2016-11-02 20:22 - 00337920 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2016-11-10 07:50 - 2016-11-02 20:21 - 00942080 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2016-11-10 07:50 - 2016-11-02 20:20 - 02273792 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2016-11-10 07:50 - 2016-11-02 20:20 - 00167936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ErrorDetails.dll
2016-11-10 07:50 - 2016-11-02 20:18 - 01690112 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2016-11-10 07:50 - 2016-11-02 20:17 - 00828416 _____ (Microsoft Corporation) C:\WINDOWS\system32\appwiz.cpl
2016-11-10 07:50 - 2016-11-02 20:16 - 00881664 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2016-11-10 07:50 - 2016-11-02 20:16 - 00770560 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll
2016-11-09 23:20 - 2016-12-02 18:35 - 00000000 ____D C:\ProgramData\Skype
2016-11-09 23:17 - 2016-11-09 23:19 - 43760768 _____ (Skype Technologies S.A.) C:\Users\stock\Downloads\SkypeSetupFull.exe
2016-11-09 20:11 - 2016-11-09 20:11 - 00000000 ____D C:\Users\stock\AppData\Local\Logitech® Webcam Software
2016-11-09 20:08 - 2016-11-09 20:08 - 00000000 ____D C:\ProgramData\LogiShrd
2016-11-09 20:07 - 2016-11-09 20:07 - 00000000 ____D C:\Users\stock\AppData\Roaming\Leadertech
2016-11-09 20:06 - 2016-11-09 20:06 - 00001720 _____ C:\Users\Public\Desktop\Logitech Webcam Software .lnk
2016-11-09 20:03 - 2016-12-01 21:59 - 00000000 ____D C:\Program Files\Common Files\logishrd
2016-11-09 20:03 - 2016-11-09 20:05 - 74520472 _____ (Logitech, Inc.) C:\Users\stock\Downloads\lws280.exe
2016-11-08 20:24 - 2003-03-18 22:20 - 01060864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFC71.dll
2016-11-08 20:24 - 2003-03-18 21:44 - 00057344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFC71ENU.DLL
2016-11-08 20:24 - 2003-03-18 21:14 - 00499712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcp71.dll
2016-11-08 20:24 - 2003-02-21 05:42 - 00348160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcr71.dll
2016-11-08 20:24 - 1999-04-23 22:22 - 00933888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFC413aa.rra
2016-11-08 20:17 - 1999-04-23 22:22 - 00933888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFC4b6d1.rra
2016-11-08 20:15 - 2016-11-08 20:15 - 00000268 _____ C:\WINDOWS\_delis32.ini
2016-11-08 20:15 - 1998-10-29 17:45 - 00306688 _____ (InstallShield Software Corporation) C:\WINDOWS\IsUninst.exe
2016-11-08 20:08 - 2016-11-08 20:08 - 00000000 ____D C:\Users\stock\AppData\Local\Logitech-LS
2016-11-08 10:32 - 2016-12-01 21:59 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech
2016-11-08 10:32 - 2003-05-02 14:14 - 00466944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\capicom.dll
2016-11-08 10:31 - 2016-11-09 22:37 - 00000000 ____D C:\Program Files (x86)\Logitech
2016-11-08 10:31 - 2003-03-18 22:12 - 01047552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFC71u.dll
2016-11-08 10:31 - 2003-03-18 21:44 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFC71DEU.DLL
2016-11-08 10:31 - 2003-03-18 21:44 - 00061440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFC71ITA.DLL
2016-11-08 10:31 - 2003-03-18 21:44 - 00061440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFC71ESP.DLL
2016-11-08 10:31 - 2003-03-18 21:44 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFC71KOR.DLL
2016-11-08 10:31 - 2003-03-18 21:44 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFC71JPN.DLL
2016-11-08 10:31 - 2003-03-18 21:44 - 00045056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFC71CHT.DLL
2016-11-08 10:31 - 2003-03-18 21:44 - 00040960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFC71CHS.DLL
2016-11-08 10:31 - 2003-03-18 20:05 - 00089088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\atl71.dll
2016-11-08 10:31 - 1999-04-23 22:22 - 00933888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFC41b03.rra

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-12-02 19:54 - 2016-08-08 17:26 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2016-12-02 18:59 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\system32\NDF
2016-12-02 18:39 - 2016-07-16 21:47 - 00000000 ___HD C:\Program Files\WindowsApps
2016-12-02 18:39 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-12-02 18:35 - 2016-08-23 08:50 - 00000000 ____D C:\Users\stock\AppData\Roaming\Skype
2016-12-02 18:32 - 2016-05-21 15:41 - 00000000 ___RD C:\Users\stock\OneDrive
2016-12-02 18:31 - 2016-08-08 17:28 - 00000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2016-12-02 18:31 - 2016-05-21 15:36 - 00000000 __SHD C:\Users\stock\IntelGraphicsProfiles
2016-12-02 12:10 - 2016-08-08 17:33 - 00000000 ____D C:\Users\stock
2016-12-02 10:46 - 2016-05-21 15:53 - 00000000 ____D C:\Users\stock\AppData\Local\Google
2016-12-02 10:43 - 2016-08-08 17:51 - 00003982 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player PPAPI Notifier
2016-12-02 10:43 - 2016-05-27 10:13 - 00000892 _____ C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job
2016-12-02 10:43 - 2016-05-22 08:49 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2016-12-02 10:42 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed
2016-12-02 10:42 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\system32\Macromed
2016-12-02 10:38 - 2016-05-24 07:46 - 00000000 ____D C:\Users\stock\AppData\Local\ElevatedDiagnostics
2016-12-02 09:48 - 2016-05-21 15:36 - 00000000 ____D C:\Users\stock\AppData\Local\Packages
2016-12-02 09:16 - 2016-05-21 15:53 - 00000000 ____D C:\Program Files (x86)\Google
2016-12-02 09:01 - 2016-05-29 09:11 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2016-12-02 08:35 - 2016-05-24 21:13 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2016-12-02 08:00 - 2016-07-16 21:45 - 00000000 ____D C:\WINDOWS\INF
2016-12-01 22:22 - 2016-08-08 17:51 - 00004020 _____ C:\WINDOWS\System32\Tasks\SafeZone scheduled Autoupdate 1463815370
2016-12-01 22:21 - 2016-05-21 17:22 - 00001095 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast SafeZone Browser.lnk
2016-12-01 22:09 - 2016-08-08 17:32 - 01926810 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-12-01 22:08 - 2016-05-21 17:15 - 00001986 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast Free Antivirus.lnk
2016-12-01 22:08 - 2016-05-21 17:15 - 00001974 _____ C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2016-12-01 22:07 - 2016-08-08 17:51 - 00004008 _____ C:\WINDOWS\System32\Tasks\DropboxUpdateTaskMachineUA
2016-12-01 22:07 - 2016-08-08 17:51 - 00004004 _____ C:\WINDOWS\System32\Tasks\avast! Emergency Update
2016-12-01 22:07 - 2016-08-08 17:51 - 00003776 _____ C:\WINDOWS\System32\Tasks\DropboxUpdateTaskMachineCore
2016-12-01 22:07 - 2016-01-19 14:05 - 00000948 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job
2016-12-01 22:07 - 2016-01-19 14:05 - 00000944 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job
2016-12-01 22:03 - 2016-08-08 17:51 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-12-01 22:01 - 2016-07-16 21:47 - 00000000 ___SD C:\WINDOWS\system32\Nui
2016-12-01 22:01 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2016-12-01 22:01 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\system32\migwiz
2016-12-01 22:01 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\system32\icsxml
2016-12-01 22:01 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\L2Schemas
2016-12-01 22:01 - 2016-01-19 14:01 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2016-12-01 22:00 - 2016-08-08 17:51 - 00000000 ____D C:\WINDOWS\System32\Tasks\Hewlett-Packard
2016-12-01 22:00 - 2016-08-01 18:26 - 00000000 ____D C:\Users\stock\AppData\Roaming\WildTangent
2016-12-01 22:00 - 2016-07-16 21:47 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2016-12-01 22:00 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\rescache
2016-12-01 22:00 - 2016-07-16 16:04 - 00000000 ____D C:\WINDOWS\system32\Sysprep
2016-12-01 21:59 - 2016-07-30 18:19 - 00000000 ____D C:\Program Files\TrueKey
2016-12-01 21:59 - 2016-05-24 21:13 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2016-12-01 21:59 - 2016-05-23 10:00 - 00000000 ____D C:\Program Files\Google
2016-12-01 21:59 - 2016-01-19 14:01 - 00000000 ____D C:\Program Files (x86)\WildGames
2016-12-01 21:59 - 2016-01-19 14:00 - 00000000 ____D C:\ProgramData\WildTangent
2016-12-01 21:59 - 2016-01-19 14:00 - 00000000 ____D C:\Program Files (x86)\WildTangent Games
2016-12-01 21:46 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\registration
2016-12-01 21:38 - 2016-07-30 18:31 - 00000000 ____D C:\Users\stock\AppData\Local\tkdata
2016-12-01 21:33 - 2016-05-21 16:15 - 00000000 ____D C:\Users\stock\AppData\Local\Mozilla
2016-12-01 21:18 - 2016-05-25 22:24 - 00000000 ____D C:\Users\stock\Tracing
2016-11-27 08:00 - 2016-05-21 15:38 - 00000000 ____D C:\Users\stock\AppData\Local\Publishers
2016-11-24 21:11 - 2016-05-22 08:48 - 00000000 ____D C:\Users\stock\AppData\Local\Adobe
2016-11-14 08:56 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2016-11-11 08:15 - 2015-11-04 12:11 - 00000000 __RHD C:\Users\Public\AccountPictures
2016-11-11 08:08 - 2016-08-08 17:26 - 00214896 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2016-11-11 08:08 - 2016-06-01 09:34 - 00000364 _____ C:\WINDOWS\Tasks\HPCeeScheduleForstock.job
2016-11-10 21:45 - 2016-07-16 16:04 - 12058624 _____ C:\WINDOWS\system32\config\BBI
2016-11-10 21:43 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\system32\oobe
2016-11-10 21:43 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\ShellExperiences
2016-11-10 21:43 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\bcastdvr
2016-11-10 20:56 - 2016-07-16 21:36 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-11-10 20:43 - 2016-05-21 16:21 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-11-10 20:34 - 2016-05-21 16:21 - 141011376 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-11-10 19:27 - 2016-08-08 17:51 - 00003256 _____ C:\WINDOWS\System32\Tasks\HPCeeScheduleForstock
2016-11-10 07:49 - 2016-07-16 16:04 - 00032768 _____ C:\WINDOWS\system32\config\ELAM
2016-11-09 22:55 - 2016-08-08 17:51 - 00004562 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2016-11-08 11:13 - 2016-05-21 15:36 - 00000000 ____D C:\Users\stock\AppData\Local\VirtualStore
2016-11-08 10:31 - 2016-01-19 13:39 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2016-11-06 20:21 - 2016-07-30 18:18 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk

==================== Files in the root of some directories =======

2016-05-21 15:36 - 2016-05-28 20:28 - 0037849 _____ () C:\Users\stock\AppData\Local\BTServer.log
2016-07-31 17:44 - 2016-07-31 17:44 - 0000057 _____ () C:\ProgramData\Ament.ini

Files to move or delete:
====================
C:\Program Files\Hola\app\hola.exe

Some files in TEMP:
====================
C:\Users\stock\AppData\Local\Temp\{BE5A9AF0-2DD0-4789-9FB9-D59C6AC46193}-55.0.2883.75_chrome_installer.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2016-12-02 10:38

==================== End of FRST.txt ============================
22:30:00.307 Disk 0 MBR has been saved successfully to "C:\Users\stock\Downloads\MBR.dat"
22:30:00.329 The log file has been saved successfully to "C:\Users\stock\Downloads\aswMBR.txt"

Juliet · Dec 2, 2016

Hi

When Farbar Recovery Scan Tool was first run it should had produced an Addition.txt

Can you locate this please and copy and paste it in your next reply.

Bobby06 · Dec 2, 2016

Sorry about the missing file, I think this is it.Additional scan result of Farbar Recovery Scan Tool (x64) Version: 30-11-2016
Ran by stock (02-12-2016 22:05:04)
Running from C:\Users\stock\Downloads
Windows 10 Home Version 1607 (X64) (2016-08-08 08:00:22)
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-1283020984-1161487079-2240348159-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-1283020984-1161487079-2240348159-503 - Limited - Disabled)
Guest (S-1-5-21-1283020984-1161487079-2240348159-501 - Limited - Disabled)
stock (S-1-5-21-1283020984-1161487079-2240348159-1001 - Administrator - Enabled) => C:\Users\stock

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Avast Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Spybot - Search and Destroy (Enabled - Up to date) {A16C3F68-9280-E053-1818-342707FECF4D}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Disabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: Avast Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

12 Labours of Hercules III: Girl Power (x32 Version: 3.0.2.118 - WildTangent) Hidden
Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.020.20042 - Adobe Systems Incorporated)
Adobe Flash Player 23 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 23.0.0.207 - Adobe Systems Incorporated)
Adobe Flash Player 23 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 23.0.0.207 - Adobe Systems Incorporated)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 12.3.2280 - AVAST Software)
Azkend 2: The World Beneath (x32 Version: 2.2.0.98 - WildTangent) Hidden
BBC iPlayer Downloads (HKLM-x32\...\{148784F3-3B6E-4DFA-B7A1-3400B277DAF3}) (Version: 1.14.2 - BBC)
Bing Desktop (HKLM-x32\...\{7D095455-D971-4D4C-9EFD-9AF6A6584F3A}) (Version: 1.4.167.0 - Microsoft Corporation)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Building the Great Wall of China Collector's Edition (x32 Version: 3.0.2.48 - WildTangent) Hidden
CameraHelperMsi (x32 Version: 13.51.815.0 - Logitech) Hidden
Coyote The Outlander (x32 Version: 3.0.2.59 - WildTangent) Hidden
CyberLink PhotoDirector (HKLM-x32\...\InstallShield_{5A454EC5-217A-42a5-8CE1-2DDEC4E70E01}) (Version: 5.0.6.7006 - CyberLink Corp.)
CyberLink PhotoDirector (Version: 5.0.6.7006 - CyberLink Corp.) Hidden
CyberLink Power Media Player 14 (HKLM-x32\...\{32C8E300-BDB4-4398-92C2-E9B7D8A233DB}) (Version: 14.0.2.5801 - CyberLink Corp.)
CyberLink PowerDirector 12 (HKLM-x32\...\InstallShield_{E1646825-D391-42A0-93AA-27FA810DA093}) (Version: 12.0.5.4614 - CyberLink Corp.)
CyberLink PowerDirector 12 (Version: 12.0.5.4614 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Delicious: Emily's Wonder Wedding Premium Edition (x32 Version: 3.0.2.59 - WildTangent) Hidden
Dropbox 25 GB (HKLM-x32\...\{736A97C6-8766-3699-84A9-71736C5E0CE3}) (Version: 3.1.11.0 - Dropbox, Inc.)
Dropbox Update Helper (x32 Version: 1.3.59.1 - Dropbox, Inc.) Hidden
Energy Star (HKLM\...\{5CB22648-35F8-41BC-9C35-1E41FE6E12A5}) (Version: 1.1.1 - HP Inc.)
Entwined: The Perfect Murder (x32 Version: 3.0.2.59 - WildTangent) Hidden
erLT (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
Evernote v. 5.8.13 (HKLM-x32\...\{A229420E-204B-11E5-B844-0050569584E9}) (Version: 5.8.13.8152 - Evernote Corp.)
Family Vacation 2: Road Trip (x32 Version: 3.0.2.59 - WildTangent) Hidden
Foxtel GO (HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\Foxtel GO 1.84) (Version: 1.84 - Foxtel)
Foxtel GO (x32 Version: 1.84 - Foxtel) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 55.0.2883.75 - Google Inc.)
Google Update Helper (x32 Version: 1.3.31.5 - Google Inc.) Hidden
Hola™ 1.17.142 - Better Internet (HKLM\...\Hola) (Version: 1.17.142 - Hola Networks Ltd.) <==== ATTENTION
Home Makeover (x32 Version: 3.0.2.59 - WildTangent) Hidden
HP Deskjet 1510 series Basic Device Software (HKLM\...\{D17E60E8-478A-4D4A-8147-21D481B5CA55}) (Version: 32.2.188.47710 - Hewlett-Packard Co.)
HP Deskjet 1510 series Help (HKLM-x32\...\{2E25FCEB-EFCB-4696-AA01-D3CBAC721831}) (Version: 30.0.0 - Hewlett Packard)
HP Documentation (HKLM\...\HP_Documentation) (Version: 1.0.0.1 - HP)
HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.7702 - HP)
HP Registration Service (HKLM\...\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.8318.5320 - Hewlett-Packard)
HP Support Assistant (HKLM-x32\...\{79C54A05-F146-4EA0-8A70-D4EFE6181E52}) (Version: 8.3.34.7 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\...\{76272057-98E0-4DC4-AAC3-10C546C47195}) (Version: 14.00.0000 - Hewlett-Packard)
HP Support Solutions Framework (HKLM-x32\...\{55065080-504F-43BB-BE00-36B80D7D39A5}) (Version: 12.5.32.37 - Hewlett-Packard Company)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HP Welcome (HKLM\...\HPWelcome) (Version: 1.0 - HP Inc.)
IGT Slots: Paradise Garden (x32 Version: 3.0.2.59 - WildTangent) Hidden
Imperial Island: Birth of an Empire (x32 Version: 3.0.2.59 - WildTangent) Hidden
Insane Cold: Back to the Ice Age (x32 Version: 3.0.2.59 - WildTangent) Hidden
Intel Security True Key (HKLM\...\TrueKey) (Version: 4.4.135.1 - Intel Security)
Intel(R) Chipset Device Software (x32 Version: 10.1.1.11 - Intel(R) Corporation) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.4320 - Intel Corporation)
Intel(R) Trusted Execution Engine (HKLM\...\{176E2755-0A17-42C6-88E2-192AB2131278}) (Version: 2.0.0.1094 - Intel Corporation)
Intel® Security Assist (HKLM-x32\...\{4B230374-6475-4A73-BA6E-41015E9C5013}) (Version: 1.0.0.532 - Intel Corporation)
Java 8 Update 111 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180111F0}) (Version: 8.0.1110.14 - Oracle Corporation)
Jewel Match Snowscapes (x32 Version: 3.0.2.118 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Living Legends: Frozen Beauty Collector's Edition (x32 Version: 3.0.2.59 - WildTangent) Hidden
Logitech Webcam Software (HKLM-x32\...\{D40EB009-0499-459c-A8AF-C9C110766215}) (Version: 2.80 - Logitech Inc.)
Lost Lands: Dark Overlord Collector's Edition (x32 Version: 3.0.2.59 - WildTangent) Hidden
Lost Souls: Timeless Fables Collector's Edition (x32 Version: 3.0.2.59 - WildTangent) Hidden
Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Manor Memoirs Collector's Edition (x32 Version: 3.0.2.59 - WildTangent) Hidden
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4693.1005 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50901.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mystery Expedition: Prisoners of Ice (x32 Version: 3.0.2.59 - WildTangent) Hidden
NavDesk 7.50 (HKLM-x32\...\{AB756389-9A03-44f3-ABAF-3699C01B4868}-Navman-7.50) (Version: 7.50.0112.135 - Navman Technology NZ Limited)
Plagiarii (x32 Version: 3.0.2.59 - WildTangent) Hidden
Polar Bowler 1st Frame (x32 Version: 3.0.2.59 - WildTangent) Hidden
Product Improvement Study for HP Deskjet 1510 series (HKLM\...\{35DB2630-846E-47C5-AF84-9D6AC3629F55}) (Version: 32.2.188.47710 - Hewlett-Packard Co.)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.10125.31214 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.1.505.2015 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7673 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\...\{A5107464-AA9B-4177-8129-5FF2F42DD322}) (Version: 1.0.0.64 - REALTEK Semiconductor Corp.)
Runefall (x32 Version: 3.0.2.126 - WildTangent) Hidden
SafeZone Stable 1.51.2220.62 (x32 Version: 1.51.2220.62 - Avast Software) Hidden
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
Tweaking.com - Registry Backup (HKLM-x32\...\Tweaking.com - Registry Backup) (Version: 3.5.3 - Tweaking.com)
Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
WildTangent Games App for HP (x32 Version: 4.0.11.16 - WildTangent) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {02C481A7-4DD3-4FC7-A575-3E4CC513625D} - System32\Tasks\HPCustParticipation HP Deskjet 1510 series => C:\Program Files\HP\HP Deskjet 1510 series\Bin\HPCustPartic.exe [2014-03-06] (Hewlett-Packard Co.)
Task: {043950DF-1A89-441B-813F-15FD09DD6152} - System32\Tasks\HPCeeScheduleForstock => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2015-06-17] (Hewlett-Packard)
Task: {38C2450B-861C-4437-BE70-3FA7502266B3} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2016-08-31] (AVAST Software)
Task: {473B63E6-731B-4FDB-9724-4AFDDBF07E78} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2016-08-23] (HP Inc.)
Task: {5206F88A-EA64-48CE-A1FF-3F4AA000E557} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-10-21] (Adobe Systems Incorporated)
Task: {5BC25A7F-F4B6-40E8-A330-F671F7CD1092} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-05-21] (Google Inc.)
Task: {6971802E-193D-40F5-B760-91F18CD4DF59} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1283020984-1161487079-2240348159-1001UA => C:\Users\stock\AppData\Local\Google\Update\GoogleUpdate.exe
Task: {73152C4E-C1ED-4621-A4FF-BE86F15EAA61} - System32\Tasks\Hewlett-Packard\HP Active Health\HP Active Health Scan (HPSA) => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPActiveHealth\ActiveHealth.exe [2016-08-18] (HP Inc.)
Task: {84777A26-7B5B-49C3-A6FC-AABC84FE1D03} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2016-03-21] (Safer-Networking Ltd.)
Task: {95530B3B-DB61-4DE5-A489-281D9A5B9224} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater - Resources => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2016-08-03] (HP Inc.)
Task: {973433E0-8FC3-4F5B-B11F-582236FA86D4} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-12-02] (Adobe Systems Incorporated)
Task: {9E6F5CF6-1547-41E4-A9E8-1634C8443593} - System32\Tasks\SafeZone scheduled Autoupdate 1463815370 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2016-09-06] (Avast Software)
Task: {AA399E49-1FF3-433C-8C37-18D16B4E32E4} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-11-05] (Dropbox, Inc.)
Task: {AD9C3733-96B3-4782-A642-189D87DE5CEA} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2016-08-23] (HP Inc.)
Task: {BBB07AC2-6511-4217-B643-A91B56314544} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2016-11-05] (Dropbox, Inc.)
Task: {C06DBA5B-E337-4955-BA0C-D342BB14F07C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-05-21] (Google Inc.)
Task: {C12619B3-ACB2-403B-9D5F-75B9279447DD} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Updater => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [2016-08-03] (HP Inc.)
Task: {D32AE5A1-10DB-4569-AEB6-7576668C1854} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2016-03-21] (Safer-Networking Ltd.)
Task: {D5440922-C589-40DB-9291-34382FF44EB5} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
Task: {DE6200AB-9F8E-4EFF-A4A0-0E72575F2D8B} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\WINDOWS\SysWoW64\Macromed\Flash\FlashUtil32_23_0_0_207_pepper.exe [2016-12-02] (Adobe Systems Incorporated)
Task: {F1EDFFB8-E127-472F-8A33-DDDE109F479D} - System32\Tasks\DropboxOEM => C:\Program Files (x86)\Dropbox\DropboxOEM\DropboxOEM.exe [2016-04-04] ()
Task: {F63F535D-388B-459D-9180-EB2336C23A8C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSFReport.exe [2016-05-09] (Hewlett-Packard)
Task: {FAE3CA76-723F-48C5-91FB-06CCEA91962F} - System32\Tasks\{ADF7D1CB-5E6C-4A5F-8BDA-8BEFE61A2899} => pcalua.exe -a E:\install.exe -d E:\

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job => C:\WINDOWS\SysWoW64\Macromed\Flash\FlashUtil32_23_0_0_207_pepper.exe
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\HPCeeScheduleForstock.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

ShortcutWithArgument: C:\Users\stock\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\45a4b0557a8c430b\Radioplayer.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=fcppdfelojakeahklfgkjegnpbgndoch

==================== Loaded Modules (Whitelisted) ==============

2016-01-19 13:55 - 2014-04-15 12:59 - 00389896 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2016-07-16 21:42 - 2016-07-16 21:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-09-30 08:37 - 2016-09-16 03:25 - 02681200 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2016-09-30 08:37 - 2016-09-16 03:25 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-09-30 08:37 - 2016-09-16 03:25 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll
2016-08-23 08:51 - 2016-08-23 08:51 - 01864384 _____ () C:\Users\stock\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\amd64\ClientTelemetry.dll
2016-09-14 17:28 - 2016-09-07 14:56 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2016-11-10 07:51 - 2016-11-02 20:30 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 00264040 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
2016-11-10 07:50 - 2016-11-02 20:15 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2016-11-10 07:50 - 2016-11-02 20:21 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2016-11-10 07:51 - 2016-11-02 20:14 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2016-11-10 07:50 - 2016-11-02 20:15 - 01033216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2016-11-10 07:50 - 2016-11-02 20:16 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2016-11-10 07:51 - 2016-11-02 20:17 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2016-12-02 09:17 - 2016-12-01 12:11 - 02418280 _____ () C:\Program Files (x86)\Google\Chrome\Application\55.0.2883.75\libglesv2.dll
2016-12-02 09:17 - 2016-12-01 12:11 - 00105064 _____ () C:\Program Files (x86)\Google\Chrome\Application\55.0.2883.75\libegl.dll
2016-08-31 07:34 - 2016-08-31 07:34 - 00169064 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2016-08-31 07:34 - 2016-08-31 07:34 - 00482928 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2016-12-01 22:10 - 2016-12-01 22:10 - 03129808 _____ () C:\Program Files\AVAST Software\Avast\defs\16120100\algo.dll
2016-05-24 21:13 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2016-05-24 21:13 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2016-05-24 21:13 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2016-05-24 21:13 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2016-05-24 21:13 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2016-08-23 08:50 - 2016-08-23 08:50 - 01383616 _____ () C:\Users\stock\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\ClientTelemetry.dll
2016-08-23 08:51 - 2016-08-23 08:51 - 00118976 _____ () C:\Users\stock\AppData\Local\Microsoft\OneDrive\17.3.6517.0809\FileSyncViews.dll
2016-07-01 08:51 - 2016-07-01 08:51 - 48936448 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 02144104 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtCore4.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 00341352 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtXml4.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 07955304 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtGui4.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 00028008 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QGif4.dll
2012-09-13 00:38 - 2012-09-13 00:38 - 00127336 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QJpeg4.dll
2012-09-13 00:39 - 2012-09-13 00:39 - 00336232 _____ () C:\Program Files (x86)\Common Files\logishrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

There are 7916 more sites.

IE trusted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\hola.org -> hxxp://hola.org
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\...\123simsen.com -> www.123simsen.com

There are 7916 more sites.

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2015-10-30 17:24 - 2016-12-02 11:58 - 00453396 ____R C:\WINDOWS\system32\Drivers\etc\hosts

0.0.0.1 mssplus.mcafee.com127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123haustiereundmehr.com
127.0.0.1 123moviedownload.com
127.0.0.1 www.123moviedownload.com

There are 15557 more lines.

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\stock\AppData\Local\Microsoft\BingDesktop\themes\2016-12-02.jpg
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

HKLM\...\StartupApproved\Run: => "BtServer"
HKLM\...\StartupApproved\Run32: => "PowerDVD14Agent"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => LPort=139
FirewallRules: [{F3CA351F-895D-4EF5-8C73-D14E0B9BBEC1}] => C:\Users\stock\AppData\Local\Temp\7zS54DE\hppiw.exe
FirewallRules: [{95C6C0F3-8F85-450F-A7F4-32BCD1130593}] => C:\Users\stock\AppData\Local\Temp\7zS54DE\hppiw.exe
FirewallRules: [{58AF624F-3BE2-4CDD-8A96-E5238DA93E84}] => C:\Users\stock\AppData\Local\Temp\7zS1776\HPDiagnosticCoreUI.exe
FirewallRules: [{C70B6F8D-EAF4-48B0-944C-1FB6824329C1}] => C:\Users\stock\AppData\Local\Temp\7zS1776\HPDiagnosticCoreUI.exe
FirewallRules: [{15085010-F520-4F4B-B30E-1A5DB6BFCF71}] => C:\Users\stock\AppData\Local\Temp\7zS021F\HPDiagnosticCoreUI.exe
FirewallRules: [{1DA69DA6-65F5-4A63-8165-A78FDDE0C787}] => C:\Users\stock\AppData\Local\Temp\7zS021F\HPDiagnosticCoreUI.exe
FirewallRules: [{87D9F119-42EB-46DC-93DB-51FB58CD97C8}] => C:\Program Files\HP\HP Deskjet 1510 series\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [{4DC30DC6-2C01-496D-B2F2-496DEF84F794}] => C:\Program Files\HP\HP Deskjet 1510 series\Bin\USBSetup.exe
FirewallRules: [{D69D7CC6-51DF-481C-99F7-F496C64B40FF}] => C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{87B9F87E-DEC1-441E-8DC7-CC03C83472EC}] => LPort=1900
FirewallRules: [{8D3D48D6-B731-46E6-ABD6-8062A054125E}] => LPort=2869
FirewallRules: [{71CCCF05-5BD6-4803-A259-E882DF1402B2}] => C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{302B4349-795B-47FD-B4CD-5ACAA0E68341}] => C:\Program Files (x86)\CyberLink\PowerDVD14\Movie\PowerDVD Cinema\PowerDVDCinema.exe
FirewallRules: [{9E145408-7440-4920-9370-1825A92435D4}] => C:\Program Files (x86)\CyberLink\PowerDVD14\Movie\PowerDVDMovie.exe
FirewallRules: [{DF8F0C10-1615-4022-A054-0D517ACA7A21}] => C:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14Agent.exe
FirewallRules: [{DCA196B5-C594-43BA-AA56-77FA1D2D12BD}] => C:\Program Files (x86)\CyberLink\PowerDVD14\Kernel\DMS\CLMSServerPDVD14.exe
FirewallRules: [{6A24C025-AF5B-4FE4-83FF-A7371BF893EE}] => C:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD.exe
FirewallRules: [{C52035F1-DDC7-4B70-BEB6-90891FE64966}] => c:\Program Files\CyberLink\PowerDirector12\PDR10.EXE
FirewallRules: [{7E3F1E80-BA38-40BF-9696-69692ABCBA2F}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{0CBE1825-F870-481F-8921-EBCB842B4884}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{2C4F3196-E21A-4F0B-BB3B-16725B29BD5B}] => C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{75B0F717-57E5-4FA9-9203-E21814CBDF22}] => C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{0EF3BD16-8466-4FD8-9574-01B8D5BACA5B}] => C:\Users\stock\AppData\Local\Temp\7zS0E0F\HPDiagnosticCoreUI.exe
FirewallRules: [{D1691CDB-B1BA-4703-8467-260B3AD6AD03}] => C:\Users\stock\AppData\Local\Temp\7zS0E0F\HPDiagnosticCoreUI.exe
FirewallRules: [{3E2F86CD-A6FA-458F-97CF-119C78EC5F59}] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service

==================== Restore Points =========================

01-12-2016 21:22:53 Restore Operation

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (12/02/2016 09:56:37 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "c:\program files\cyberlink\photodirector\kernel\ces\CES_AudioCacheAgent.exe.Manifest".
Dependent Assembly PDR.X,type="win32",version="1.0.0.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (12/02/2016 09:56:36 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Activation context generation failed for "c:\program files\cyberlink\photodirector\kernel\ces\CES_CacheAgent.exe.Manifest".
Dependent Assembly PDR.X,type="win32",version="1.0.0.0" could not be found.
Please use sxstrace.exe for detailed diagnosis.

Error: (12/02/2016 07:26:30 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1594

Error: (12/02/2016 07:26:30 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1594

Error: (12/02/2016 07:26:30 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (12/02/2016 06:34:16 PM) (Source: HP Active Health) (EventID: 88) (User: )
Description: -- SECURITY WARNING -- ActiveHealthProperties.ini has been tampered with, resetting it

Error: (12/02/2016 12:10:52 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 9031

Error: (12/02/2016 12:10:52 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 9031

Error: (12/02/2016 12:10:52 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (12/02/2016 12:10:51 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 7516

System errors:
=============
Error: (12/02/2016 07:58:02 PM) (Source: DCOM) (EventID: 10016) (User: DESKTOP-G99A7OK)
Description: The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
and APPID
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
to the user DESKTOP-G99A7OK\stock SID (S-1-5-21-1283020984-1161487079-2240348159-1001) from address LocalHost (Using LRPC) running in the application container Microsoft.MicrosoftSolitaireCollection_3.12.11142.0_x64__8wekyb3d8bbwe SID (S-1-15-2-1985198343-3186790915-4047221937-1969271670-3792558349-1325541827-400269725). This security permission can be modified using the Component Services administrative tool.

Error: (12/02/2016 07:55:02 PM) (Source: Tcpip) (EventID: 4199) (User: )
Description: The system detected an address conflict for IP address 192.168.0.2 with the system
having network hardware address 00-1E-64-07-0E-8C. Network operations on this system may
be disrupted as a result.

Error: (12/02/2016 07:14:55 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (12/02/2016 06:31:49 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
and APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (12/02/2016 12:08:46 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (12/02/2016 10:53:59 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (12/02/2016 08:32:57 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (12/02/2016 08:15:12 AM) (Source: DCOM) (EventID: 10001) (User: DESKTOP-G99A7OK)
Description: Unable to start a DCOM Server: App.AppX85gcbw533amccd2rr8qswxymhfj649t2.mca as Unavailable/Unavailable. The error:
"15616"
Happened while starting this command:
"C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.9.251.0_x64__kzf8qxf38zg5c\SkypeHost.exe" -ServerName:SkypeHost.ServerServer

Error: (12/02/2016 08:10:03 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80073d02: Microsoft Solitaire Collection.

Error: (12/02/2016 07:33:37 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
and APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

==================== Memory info ===========================

Processor: Intel(R) Celeron(R) CPU N3050 @ 1.60GHz
Percentage of memory in use: 59%
Total physical RAM: 4017.36 MB
Available physical RAM: 1625 MB
Total Virtual: 5103.7 MB
Available Virtual: 1993.09 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:912.03 GB) (Free:839.05 GB) NTFS
Drive d: (Recovery Image) (Fixed) (Total:18.2 GB) (Free:2.32 GB) NTFS ==>[system with boot components (obtained from drive)]

==================== MBR & Partition Table ==================

==================== End of Addition.txt ============================

Juliet · Dec 3, 2016

Hola™ 1.17.142 - Better Internet <== needs to be uninstalled.
http://www.isthisfilesafe.com/company/Hola Networks Ltd._details.aspx

~~~~~~~~~~~~`

Running from C:\Users\stock\Downloads

It's best we move Farbar's to desktop.

Please go to your downloads folder, locate Farbar Recovery Scan Tool, right click and select CUT
Go to an open spot on your desktop, right click and select PASTE
You should now have Farbar Recovery Scan Tool on your desktop.

Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)

start
CreateRestorePoint:
CloseProcesses:
HKLM\...\Run: [hola] => C:\Program Files\Hola\app\hola.exe [2166376 2016-10-18] (Hola Networks Ltd.) <===== ATTENTION
HKLM-x32\...\Run: [] => [X]
Toolbar: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
R2 hola_svc; C:\Program Files\Hola\app\hola_svc.exe [5622376 2016-10-18] (Hola Networks Ltd.) <==== ATTENTION
R2 hola_updater; C:\Program Files\Hola\app\hola_updater.exe [5622376 2016-10-18] (Hola Networks Ltd.) <==== ATTENTION
C:\Program Files\Hola\app\hola_svc.exe
C:\Program Files\Hola\app\hola_updater.exe
C:\Program Files\Hola\app\hola.exe
C:\Users\stock\AppData\Local\Temp\{BE5A9AF0-2DD0-4789-9FB9-D59C6AC46193}-55.0.2883.75_chrome_installer.exe
ShortcutWithArgument: C:\Users\stock\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\45a4b0557a8c430b\Radioplayer.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=fcppdfelojakeahklfgkjegnpbgndoch
EmptyTemp:
Hosts:
End

Open FRST/FRST64 and press the > Fix < button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
~~~~~~~~~~~~~~~~`

AdwCleaner

Please download AdwCleaner and save the file to your Desktop.
In order to use AdwCleaner, you have to agree the Eula:
Right-click AdwCleaner.exe and select

Run as administrator to run the programme.
Follow the prompts.
Click

Scan.
Upon completion, click

Logfile. A log (AdwCleaner[S1].txt) will open. Briefly check the log for anything you know to be legitimate.
Return to AdwCleaner. Ensure anything you know to be legitimate does not have a checkmark under the corresponding tab.
Click

Clean.
Follow the prompts and allow your computer to reboot.
After the reboot, a log (AdwCleaner[C1].txt) will open. Copy the contents of the log and paste in your next reply.

-- File and folder backups are made for items removed using this programme. Should a legitimate file or folder be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the item. Please do not overly concern yourself with the contents of AdwCleaner[C1].txt.

~~~~

Please download Junkware Removal Tool
or from here http://downloads.malwarebytes.org/file/jrt
to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

~~~
please post
Fixlog.txt
AdwCleaner[C1].txt
JRT.txt

Bobby06 · Dec 3, 2016

Hi, thanks for all the help so far, I'm having a problem getting the FRST64.exe and FRST.txt to enter the Notepad, all items are on desktop but cut and paste also copy and paste do not appear to work , I can however drag and drop both FRST64.exe and FRST.txt into Notepad, but will that be OK also how I've been unable to rename the Notepad as fixlist.txt. Sorry!

Bobby06 · Dec 3, 2016

# AdwCleaner v6.040 - Logfile created 03/12/2016 at 20:20:31
# Updated on 02/12/2016 by Malwarebytes
# Database : 2016-12-02.1 [Server]
# Operating System : Windows 10 Home (X64)
# Username : stock - DESKTOP-G99A7OK
# Running from : C:\Users\stock\Downloads\AdwCleaner.exe
# Mode: Clean
# Support : https://www.malwarebytes.com/support

***** [ Services ] *****

***** [ Folders ] *****

[-] Folder deleted: C:\Users\stock\AppData\Roaming\Hola
[-] Folder deleted: C:\Program Files\Hola

***** [ Files ] *****

***** [ DLL ] *****

***** [ WMI ] *****

***** [ Shortcuts ] *****

***** [ Scheduled Tasks ] *****

***** [ Registry ] *****

[-] Key deleted: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001\Software\Classes\AppXrh6feys59dqfzsv9p3s9p6aep0hwtb23
[#] Key deleted on reboot: HKCU\Software\Classes\AppXrh6feys59dqfzsv9p3s9p6aep0hwtb23
[-] Key deleted: HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho
[-] Key deleted: HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho.1
[#] Key deleted on reboot: [x64] HKCU\Software\Classes\AppXrh6feys59dqfzsv9p3s9p6aep0hwtb23
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\protector_dll.ProtectorBho.1
[-] Key deleted: HKU\.DEFAULT\Software\Hola
[#] Key deleted on reboot: HKU\S-1-5-18\Software\Hola
[-] Key deleted: [x64] HKLM\SOFTWARE\Hola

***** [ Web browsers ] *****

*************************

:: "Tracing" keys deleted
:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [1587 Bytes] - [03/12/2016 20:20:31]
C:\AdwCleaner\AdwCleaner[S0].txt - [1818 Bytes] - [03/12/2016 20:15:37]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [1733 Bytes] ##########

Bobby06 · Dec 3, 2016

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.9 (09.30.2016)
Operating System: Windows 10 Home x64
Ran by stock (Administrator) on Sat 03/12/2016 at 20:41:39.72
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

File System: 4

Successfully deleted: C:\Users\stock\AppData\Local\{3B925AA3-A13A-4822-9DEA-5DB87B631D64} (Empty Folder)
Successfully deleted: C:\Users\stock\AppData\Local\{3E5DEA14-7B0D-45A7-8B30-9F37901E75E2} (Empty Folder)
Successfully deleted: C:\Users\stock\AppData\Local\{8F31BED1-686C-488F-9A45-DF1EB4CEF7E1} (Empty Folder)
Successfully deleted: C:\WINDOWS\wininit.ini (File)

Registry: 0

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sat 03/12/2016 at 20:49:40.20
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Juliet · Dec 3, 2016

Bobby06 said:
Hi, thanks for all the help so far, I'm having a problem getting the FRST64.exe and FRST.txt to enter the Notepad, all items are on desktop but cut and paste also copy and paste do not appear to work , I can however drag and drop both FRST64.exe and FRST.txt into Notepad, but will that be OK also how I've been unable to rename the Notepad as fixlist.txt. Sorry!

I don't think drag and drop to Notepad will work, of course you can try but it will probably error out.

Can you open a new blank Notepad?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Let's update and run a new scan with Malwarebytes Anti-Malware

Open Malwarebytes Anti-Malware

On the Dashboard click on Update Now
Go to the Setting Tab
Under Setting go to Detection and Protection
Under PUP and PUM make sure both are set to show Treat Detections as Malware
Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked
Then on the Dashboard click on Scan
Make sure to select THREAT SCAN
Then click on Scan
Note: You may see the following message, "Could not load DDA driver". Click Yes, allow your PC to reboot and continue afterwards.
If threats are detected, click Remove Selected. If you are prompted to reboot, click Yes.
Upon completion of the scan (or after the reboot), click the History tab.
Click Application Logs, followed by the first Scan Log.
Click Export, followed by Copy to Clipboard. Paste the log in your next reply.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[font=helvetica, sans-serif]Please download [/font][font=helvetica, sans-serif]Emsisoft Emergency Kit[/font][font=helvetica, sans-serif] and save it to your desktop.
Double click on the EmsisoftEmergencyKit file you downloaded to extract its contents and create a shortcut on the desktop.

Leave all settings as they are and click the Extract button at the bottom.
A folder named EEK will be created in the root of the drive (usually c:\).[/font]

[font=helvetica, sans-serif]After extraction please double-click on the new Start Emsisoft Emergency Kit icon on your desktop.[/font]
[font=helvetica, sans-serif]The first time you launch it, Emsisoft Emergency Kit will recommend that you allow it to download updates.
Please click Yes so that it downloads the latest database updates.[/font]
[font=helvetica, sans-serif]When the update process is complete, a new button will appear in the lower-left corner that says Back. Click on this button to return to the Overview screen.[/font]
[font=helvetica, sans-serif]Click on Scan to be taken to the scan options.
If you are asked if you want the scanner to scan for Potentially Unwanted Programs, then click Yes.[/font]
[font=helvetica, sans-serif]Click on the Malware Scan button to start the scan.[/font]
[font=helvetica, sans-serif]When the scan is completed click the Quarantine selected objects button. Note, this option is only available if malicious objects were detected during the scan.[/font]
[font=helvetica, sans-serif]When the threats have been quarantined, click the View report button in the lower-right corner, and the scan log will be opened in Notepad.[/font]
[font=helvetica, sans-serif]Please save the log in Notepad on your desktop, and copy it to your next reply.[/font]
[font=helvetica, sans-serif]When you close Emsisoft Emergency Kit, it will give you an option to sign up for a newsletter. This is optional, and is not necessary for the malware removal process.[/font]

~~~~~~~~~

Bobby06 · Dec 3, 2016

Hi Juliet, The Malwarebytes checks were carried out as per your info the scan ran and found no threats, (I had in fact ran and quarantined some threats 2 days ago on Malwarebytes) now in Application Logs I have ticked the first scan box and I am offered to options Delete/Delete All as far as I can see there is no options to export and post to you.

Bobby06 · Dec 3, 2016

Hi Juliet, I've downloaded the Emsisoft Emergency kit to desktop and it updated itself but there appears to be no back button in the bottom LH corner??

Bobby06 · Dec 4, 2016

Hi Juliet, Yes I can download a new notepad as regards the getting FRST.exe and FRST.txt to enter , I still unable to copy/cut and paste from desktop to the new notepad, drag and drop will appear to work and show in the newly formed notepad but seems unable to be exported and posted on this tread.

Juliet · Dec 4, 2016

let's try to use a shortcut
Hold down Ctrl and press C to copy. Right-click the item's destination and choose Paste.

Try clearing the Copy/Paste Cache. This is for the creation of a shortcut. But should work. Clear Clipboard shortcut - Create in Windows 10 - Windows 10 Forums

Bobby06 · Dec 4, 2016

Hi Juliet you say lets create a shortcut, for "what" I'm completely lost as to what you are trying to achieve. I've tried push Ctrl and C for a shortcut but FRST.exe and FRST.txt are already on the Desktop, I did however get FRST.txt into a Notepad ,I right clicked and there was nothing about sending to destination, I clicked "select all' but was unable to send it anywhere.

Juliet · Dec 5, 2016

I did however get FRST.txt into a Notepad

Ok
Did you set it or place it next to Farbar Recovery Scan Tool

Open FRST/FRST64 and press the > Fix < button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

Bobby06 · Dec 5, 2016

Yes they are right next to one another on my desktop.

Juliet · Dec 5, 2016

Open FRST/FRST64 and press the > Fix < button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

Bobby06 · Dec 5, 2016

Nothing seems to be working for me regards FRST ,so what if I remove all the previous FRST downloads from my Desktop, and start again with a fresh FRST download?.

Juliet · Dec 5, 2016

Bobby06 said:
Nothing seems to be working for me regards FRST ,so what if I remove all the previous FRST downloads from my Desktop, and start again with a fresh FRST download?.

We'll try this

- Save ALL Tools to your Desktop-

All tools that I have you download should be placed on the desktop unless otherwise stated. If you are familiar with how to save files to the desktop then you can skip this step.

Since you are continuing with this step then I assume you are unfamiliar with saving files to your desktop. As a result it's easiest if you configure your browser(s) to download any tools to the desktop by default. Please use the appropriate instructions below depending on the browser you are using.

Google Chrome - Click the "Customize and control Google Chrome" button in the upper right-corner of the browser.

Choose Settings. at the bottom of the screen click the
"Show advanced settings..." link. Scroll down to find the Downloads section and click the Change... button. Select your desktop and click OK.

Mozilla Firefox - Click the "Open Menu" button in the upper right-corner of the browser.

Choose Options. In the downloads section, click the Browse button, click on the Desktop folder
and the click the "Select Folder" button. Click OK to get out of the Options menu.

Internet Explorer - Click the Tools menu in the upper right-corner of the browser.

Select View downloads. Select the Options link in the lower left of the window. Click Browse and
select the Desktop and then choose the Select Folder button. Click OK to get out of the download options screen and then click Close to get out of the View Downloads screen.
NOTE: IE8 Does not support changing download locations in this manner. You will need to download the tool(s) to the default folder, usually Downloads, then copy them to the desktop.

~~~

FRST (Farbar Recovery Scan Tool) should be on desktop, right click on that and send it to the recycle bin.

Now we'll download a fresh version.
~~~~

Please download Farbar Recovery Scan Tool (x32) or Farbar Recovery Scan Tool (x64) and save the file to your Desktop.
Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.

Don't run it now I just want the tool ready, we'll place the fixlist.txt next to it then click on the FIX button to run it.

Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)

start
CreateRestorePoint:
CloseProcesses:
HKLM\...\Run: [hola] => C:\Program Files\Hola\app\hola.exe [2166376 2016-10-18] (Hola Networks Ltd.) <===== ATTENTION
HKLM-x32\...\Run: [] => [X]
Toolbar: HKU\S-1-5-21-1283020984-1161487079-2240348159-1001 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
R2 hola_svc; C:\Program Files\Hola\app\hola_svc.exe [5622376 2016-10-18] (Hola Networks Ltd.) <==== ATTENTION
R2 hola_updater; C:\Program Files\Hola\app\hola_updater.exe [5622376 2016-10-18] (Hola Networks Ltd.) <==== ATTENTION
C:\Program Files\Hola\app\hola_svc.exe
C:\Program Files\Hola\app\hola_updater.exe
C:\Program Files\Hola\app\hola.exe
C:\Users\stock\AppData\Local\Temp\{BE5A9AF0-2DD0-4789-9FB9-D59C6AC46193}-55.0.2883.75_chrome_installer.exe
ShortcutWithArgument: C:\Users\stock\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\45a4b0557a8c430b\Radioplayer.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --profile-directory=Default --app-id=fcppdfelojakeahklfgkjegnpbgndoch
EmptyTemp:
Hosts:
End

Open FRST/FRST64 and press the > Fix < button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

Removal of s.yimg.com

New member

Member of Team Spybot

New member

Security Expert-emeritus

New member

Security Expert-emeritus

New member

New member

New member

Security Expert-emeritus

New member

New member

New member

Security Expert-emeritus

New member

Security Expert-emeritus

New member

Security Expert-emeritus

New member

Security Expert-emeritus