Removal of s.yimg.com

Bobby06 · Dec 6, 2016

Hi Juliet I'm even more confused than before I selected Mozilla for my downloads and followed the instructions exactly until I got to "Select Folder" where it said now click OK, but where is the OK button there was no sign of it on my page ?.

Juliet · Dec 6, 2016

First, let's check Firefox and make sure you have the most current version.

Open Firefox, next click on the

upper right corner.
scroll all the way down to where you see a question mark, click on that, then next scroll down the window that opens and click on About Firefox.
This will show you if you need to update.

Open Mozilla Firefox again - Click the "Open Menu" button in the upper right-corner of the browser.

Choose Options.

Next you should be on the General page
scroll down to Downloads click the button Save files to
then click on the Browse button and then locate Desktop.
Then you can close out of that window and all downloads/files should be saved to desktop

Bobby06 · Dec 6, 2016

Hi Juliet Now I have Mozilla Updated to Version 50.0.2 and downloads are selected to go to desktop, the FRST.exe is showing on desktop. The previous FRST attempts are in the Recycle bin and its been emptied. I've noticed as a matter of interest that if you remove Adblock devices (Which I did have installed notably Adblock Plus,Adblock Ultimate
and Adguard) and of any persuasion from Mozilla on Yahoo7 homepage the "Connected to s.yimg.com" on the bottom LH corner disappears. What now please?

/in

Bobby06 · Dec 6, 2016

Update to my last message Re Adblock devices and there influence on removal of s.yimg.com, Please disregard as my observations were based on the first logon on the day where everything appeared back to normal so being adventurous I decided to add Adblock (I tried all of them) and thats where the trouble reappeared, now the wheel keeps circyling top LH corner and "Connected to s.yimg.com" come and goes . Thanks for all your help thus far!.

I nownotice

Juliet · Dec 6, 2016

Were you able to run the fixlist.txt?

~~~

Adblock Plus, Once you have installed it, click on it and choose Filter Preferences. At the bottom

UNcheck Allow Some Non-intrusive Advertising.

~~

there should be an option to also remove acceptable ads - make sure you tell it you don't want any ads.
https://adblockplus.org/en/acceptable-ads

Bobby06 · Dec 7, 2016

Hi Juliet Regards the Adblock plus I found the box and unticked it for "allow some unobtrusive advertising" and on saying that I've just gone back there and found its been reticked by something or someone.I have now ran the FRST and its produced two (2) Notepads i.e FRST.txt and Additial.txt ,they are with tool FRST64.exe in close proximity on my desktop. What do I do now to achieve a fixlist.txt?.

Juliet · Dec 7, 2016

[font=helvetica, sans-serif]Please download [/font][font=helvetica, sans-serif]Emsisoft Emergency Kit[/font][font=helvetica, sans-serif] and save it to your desktop.
Double click on the EmsisoftEmergencyKit file you downloaded to extract its contents and create a shortcut on the desktop.

Leave all settings as they are and click the Extract button at the bottom.
A folder named EEK will be created in the root of the drive (usually c:\).[/font]

[font=helvetica, sans-serif]After extraction please double-click on the new Start Emsisoft Emergency Kit icon on your desktop.[/font]
[font=helvetica, sans-serif]The first time you launch it, Emsisoft Emergency Kit will recommend that you allow it to download updates.
Please click Yes so that it downloads the latest database updates.[/font]
[font=helvetica, sans-serif]When the update process is complete, a new button will appear in the lower-left corner that says Back. Click on this button to return to the Overview screen.[/font]
[font=helvetica, sans-serif]Click on Scan to be taken to the scan options.
If you are asked if you want the scanner to scan for Potentially Unwanted Programs, then click Yes.[/font]
[font=helvetica, sans-serif]Click on the Malware Scan button to start the scan.[/font]
[font=helvetica, sans-serif]When the scan is completed click the Quarantine selected objects button. Note, this option is only available if malicious objects were detected during the scan.[/font]
[font=helvetica, sans-serif]When the threats have been quarantined, click the View report button in the lower-right corner, and the scan log will be opened in Notepad.[/font]
[font=helvetica, sans-serif]Please save the log in Notepad on your desktop, and copy it to your next reply.[/font]
[font=helvetica, sans-serif]When you close Emsisoft Emergency Kit, it will give you an option to sign up for a newsletter. This is optional, and is not necessary for the malware removal process.[/font]

Bobby06 · Dec 7, 2016

Hi Juliet I have downloaded the Emsisoft Emergency Kit which I installed and left a download named Start Emergency Kit Scanner.exe in downloads C

rive which I cut and pasted to Desktop under Emsisoft Emergency Kit, So now I have Both the Emsisoft Kit and Scanner one upon the other on Desktop however when I click on the Emergency Scanner I get window "User Account Control" asking "Do you want to allow changes to your device", I have clicked "Yes" unfortunately nothing happens. I have done this several times and waited but still nothing appear to occur ?

Juliet · Dec 7, 2016

Something went wrong somewhere.

Download Zemana AntiMalware:

open the program and without changing any options, press Scan
after the scan is finished, if threats are detected press Next to remove them

Note: If restart is required to finish the cleaning process, you should click Reboot. If reboot isn't required, please restart your computer manually.

open Zemana AntiMalware again and locate the latest report
please paste the contents into your reply.

========================

Bobby06 · Dec 7, 2016

Zemana AntiMalware 2.70.2.25 (Installed)

-------------------------------------------------------
Scan Result : Completed
Scan Date : 2016/12/8
Operating System : Windows 10 64-bit
Processor : 2X Intel(R) Celeron(R) CPU N3050 @ 1.60GHz
BIOS Mode : UEFI
CUID : 126E4C4E5146E54B7E6DA6
Scan Type : System Scan
Duration : 9m 6s
Scanned Objects : 66566
Detected Objects : 2
Excluded Objects : 0
Read Level : SCSI
Auto Upload : Enabled
Detect All Extensions : Disabled
Scan Documents : Disabled
Domain Info : WORKGROUP,0,2

Detected Objects
-------------------------------------------------------

Chrome Shortcut
Status : Scanned
Object : --app-id=fcppdfelojakeahklfgkjegnpbgndoch
MD5 : -
Publisher : -
Size : -
Version : -
Detection : Suspicious Browser Setting
Cleaning Action : Repair
Related Objects :
Browser Setting - Chrome Shortcut

Yahoo Mail Hide Ad Panel
Status : Scanned
Object : %appdata%\mozilla\firefox\profiles\whawyrn4.default-1478817956913\extensions\{c37bac34-849a-4d28-be41-549b2c76c64e}.xpi
MD5 : 2EF76B682455C93E9672540E1B6CDAA2
Publisher : -
Size : 22014
Version : -
Detection : PUA.FirefoxExt!Gr
Cleaning Action : Repair
Related Objects :
Browser Extension - Yahoo Mail Hide Ad Panel
File - %appdata%\mozilla\firefox\profiles\whawyrn4.default-1478817956913\extensions\{c37bac34-849a-4d28-be41-549b2c76c64e}.xpi

Cleaning Result
-------------------------------------------------------
Cleaned : 2
Reported as safe : 0
Failed : 0

Juliet · Dec 7, 2016

it appears to have taken out 2 items related to Yahoo

Extension ID: {c37bac34-849a-4d28-be41-549b2c76c64e}. Name: Yahoo Mail Hide Ad Panel.

How is the computer now?

Bobby06 · Dec 8, 2016

Hi Juliet Much, Much better so far no sign of the dreaded "Connected to s.yimg.com". Thanks for all your help!

Juliet · Dec 8, 2016

You don't know how glad I am to hear this.

I think we're ready to remove tools and quarantine folders?

Bobby06 · Dec 8, 2016

Hi Juliet It (s.yimg.com) came back again on my Desktop first thing this morning only on Yahoo7 which is my home page, however if I disable Adblock plus, it works normally. Unfortunately it has now appeared on Laptop so last night I downloaded and ran Zemana AntiMalware on the laptop it found a heap of stuff associated with Google Chrome and some trojans all of which it cleaned/quarantined but no mention of the dreaded s.yimg.com. So with your permission I'd like to run all the treads "Removal of s.yimg.com on my laptop, what do reckon?

Bobby06 · Dec 9, 2016

Hi Juliet Do you want me to go ahead and remove all the tools and files I/We have created on Desktop?

Juliet · Dec 9, 2016

s.yimg is actually part of Yahoo, s.yimg.com is a domain owned and operated by Yahoo, Yahoo Mail phone app
When using AdBlock it's blocking part of Yahoo as designed but, it's actually not malicious.
https://www.bleepingcomputer.com/forums/t/575540/what-is-yimgcom/

For the computer we just worked on

Please download DelFix or from Here and save the file to your Desktop.
Double-click DelFix.exe to run the programme.
Place a checkmark next to the following items:
Activate UAC
Remove disinfection tools
Click the Run button.
-- This will remove the specialized tools we used to disinfect your system.
Any leftover logs, files, folders or tools remaining on your Desktop which were not removed can be deleted manually (right-click the file + delete).

****************
~~~~~
For the other computer....

Unfortunately it has now appeared on Laptop so last night I downloaded and ran Zemana AntiMalware on the laptop it found a heap of stuff associated with Google Chrome and some trojans all of which it cleaned/quarantined but no mention of the dreaded s.yimg.com. So with your permission I'd like to run all the treads "Removal of s.yimg.com on my laptop, what do reckon?

Now, for your Laptop

Make sure you set downloads to install on desktop

Farbar Recovery Scan Tool (FRST) Scan

Please download Farbar Recovery Scan Tool (x32) or Farbar Recovery Scan Tool (x64) and save the file to your Desktop.
Note: Download and run the version compatible with your system (32 or 64-bit). Download both if you're unsure; only one will run.
Right-Click FRST.exe / FRST64.exe and select

Run as administrator to run the programme.
Click Yes to the disclaimer.
Ensure the Addition.txt box is checked.
Click the Scan button and let the programme run.
Upon completion, click OK, then OK on the Addition.txt pop up screen.
Two logs (FRST.txt & Addition.txt) will now be open on your Desktop. Copy the contents of both logs and paste in your next reply.

Bobby06 · Dec 10, 2016

Hi Juliet Here is the FRST txt'sScan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 07-12-2016
Ran by Nigel (administrator) on AVRILANDNIGENOT (10-12-2016 11:31:18)
Running from C:\Users\Nigel\Downloads
Loaded Profiles: Nigel (Available Profiles: Nigel & DefaultAppPool)
Platform: Windows 10 Home Version 1607 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\BCA\pabeSvc64.exe
(Microsoft Corporation) C:\Windows\System32\mqsvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(McAfee, Inc.) C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler64.exe
(McAfee, Inc.) C:\Program Files\TrueKey\McTkSchedulerService.exe
(Zemana Ltd.) C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(AlcorMicro Co., Ltd.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
() C:\Windows\PLFSetI.exe
(Zemana Ltd.) C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe
(© 2015 Microsoft Corporation) C:\Users\Nigel\AppData\Local\Microsoft\BingSvc\BingSvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Google, Inc) C:\Users\Nigel\AppData\Local\Programs\Google\Google Photos Backup\Google Photos Backup.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.11.427\SSScheduler.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.EXE
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe
() C:\Program Files (x86)\Hostless Modem\Telstra USB+Wi-Fi\CheckNDISPort_df.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.9.261.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13885696 2015-06-24] (Realtek Semiconductor)
HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)
HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [320000 2009-04-09] (AlcorMicro Co., Ltd.)
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [828960 2009-08-06] (Acer Incorporated)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2012-06-29] ()
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3935912 2015-08-06] (Synaptics Incorporated)
HKLM\...\Run: [ZAM] => C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe [13915888 2016-11-22] (Zemana Ltd.)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [825864 2009-08-17] (Dritek System Inc.)
HKLM-x32\...\Run: [RemoteControl8] => C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe [91432 2009-04-16] (CyberLink Corp.)
HKLM-x32\...\Run: [PDVD8LanguageShortcut] => C:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe [50472 2009-04-16] (CyberLink Corp.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [CheckNDISPort_df] => C:\Program Files (x86)\Hostless Modem\Telstra USB+Wi-Fi\CheckNDISPort_df.exe [442696 2012-09-21] ()
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4127488 2015-06-16] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [BingDesktop] => C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe [2369248 2015-07-21] (Microsoft Corp.)
HKLM-x32\...\Run: [AvgUi] => "C:\Program Files (x86)\AVG\Framework\Common\avguirnx.exe" /lps=fmw
HKLM-x32\...\Run: [OV3_Monitor] => C:\Program Files (x86)\OLYMPUS\OLYMPUS Viewer 3\FirstStart.exe [40472 2015-11-04] (Olympus Corporation)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [9080768 2016-11-24] (AVAST Software)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-09-22] (Oracle Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\Run: [BingSvc] => C:\Users\Nigel\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2015-11-12] (© 2015 Microsoft Corporation)
HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [5915776 2016-03-21] (Safer-Networking Ltd.)
HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\Run: [OV3_Monitor] => C:\Program Files (x86)\OLYMPUS\OLYMPUS Viewer 3\OV3Monitor.exe [415768 2015-11-04] (Olympus Corporation)
HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\Run: [Google Update] => C:\Users\Nigel\AppData\Local\Google\Update\GoogleUpdate.exe [153752 2016-09-11] (Google Inc.)
HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\Run: [Google Photos Backup] => C:\Users\Nigel\AppData\Local\Programs\Google\Google Photos Backup\Google Photos Backup.exe [3790936 2016-04-09] (Google, Inc)
HKU\S-1-5-21-4116000945-235673462-3313673197-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\WLXPGSS.SCR [322248 2014-03-31] (Microsoft Corporation)
Lsa: [Notification Packages] scecli C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => No File
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => No File
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2016-09-11] (AVAST Software)
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Acer VCM.lnk [2009-08-20]
ShortcutTarget: Acer VCM.lnk -> C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe (Acer Incorporated)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2016-11-29]
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.427\SSScheduler.exe (McAfee, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{2FCE2750-CD22-4D0C-9D14-BF5F0D1E1AAB}: [DhcpNameServer] 192.168.9.1 192.168.9.1
Tcpip\..\Interfaces\{8243e958-5c29-4b35-8ed2-7cc9b2f4df69}: [NameServer] 61.8.0.113,210.23.129.34
Tcpip\..\Interfaces\{8243e958-5c29-4b35-8ed2-7cc9b2f4df69}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{B7E4C052-531B-4694-9DA1-86D220B0682C}: [DhcpNameServer] 192.168.0.1 192.168.0.1
Tcpip\..\Interfaces\{D6888746-2980-4D8F-B4E2-20FB33893D3B}: [DhcpNameServer] 192.168.9.1 192.168.9.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\S-1-5-21-4116000945-235673462-3313673197-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/en-au/?ocid=U143DHP&pfr=1
SearchScopes: HKLM-x32 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKLM-x32 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKU\S-1-5-21-4116000945-235673462-3313673197-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=U313DF&PC=U313&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-4116000945-235673462-3313673197-1000 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKU\S-1-5-21-4116000945-235673462-3313673197-1000 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
BHO: Expat Shield Class -> {3706EE7C-3CAD-445D-8A43-03EBC3B75908} -> No File
BHO: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus64.dll [2015-09-22] (Eyeo GmbH)
BHO-x32: True Key Helper -> {0F4B8786-5502-4803-8EBC-F652A1153BB6} -> C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll [2016-07-15] (Intel Security)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\ssv.dll [2016-12-02] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\jp2ssv.dll [2016-12-02] (Oracle Corporation)
BHO-x32: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll [2015-09-22] (Eyeo GmbH)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Toolbar: HKLM-x32 - True Key - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll [2016-07-15] (Intel Security)
Toolbar: HKU\S-1-5-21-4116000945-235673462-3313673197-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKU\S-1-5-21-4116000945-235673462-3313673197-1000 -> No Name - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2016-09-23] (Skype Technologies)

FireFox:
========
FF DefaultProfile: z69ot8oc.default
FF ProfilePath: C:\Users\Nigel\AppData\Roaming\TomTom\HOME\Profiles\z9a5dup9.default [2015-08-10]
FF Extension: (Emulator) - C:\Users\Nigel\AppData\Roaming\TomTom\HOME\Profiles\z9a5dup9.default\Extensions\Navcore.9.430.890926@tomtom.com [2012-10-08] [not signed]
FF Extension: (Emulator) - C:\Users\Nigel\AppData\Roaming\TomTom\HOME\Profiles\z9a5dup9.default\Extensions\Navcore.9.510.1234792@tomtom.com [2014-06-12] [not signed]
FF Extension: (No Name) - C:\Program Files (x86)\TomTom HOME 2\xul\extensions\MapShare-status@tomtom.com [not found]
FF ProfilePath: C:\Users\Nigel\AppData\Roaming\Mozilla\Firefox\Profiles\z69ot8oc.default [2016-12-10]
FF Homepage: Mozilla\Firefox\Profiles\z69ot8oc.default -> hxxp://www.msn.com/?pc=U143&ocid=U143DHP&osmkt=en-au
hxxps://au.yahoo.com/#
FF Extension: (Adblock Plus) - C:\Users\Nigel\AppData\Roaming\Mozilla\Firefox\Profiles\z69ot8oc.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-12-07]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: (Avast Online Security) - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-09-11]
FF HKLM\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF Extension: (Avast SafePrice) - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2016-09-11]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF HKLM-x32\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_23_0_0_207.dll [2016-11-26] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWoW64\Macromed\Flash\NPSWF32_23_0_0_207.dll [2016-11-26] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2016-10-06] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.111.2 -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\dtplugin\npDeployJava1.dll [2016-12-02] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.111.2 -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\plugin2\npjp2.dll [2016-12-02] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-30] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-30] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-10-01] (Adobe Systems Inc.)
FF Plugin HKU\.DEFAULT: @hola.org/FlashPlayer -> C:\Users\Nigel\AppData\Local\Hola\firefox_hola\app\flash\NPSWF32_18_0_0_232.dll [2015-11-09] ()
FF Plugin HKU\.DEFAULT: @hola.org/vlc -> C:\Users\Nigel\AppData\Local\Hola\firefox_hola\app\vlc\npvlc.dll [2015-11-09] (Hola)
FF Plugin HKU\S-1-5-21-4116000945-235673462-3313673197-1000: @hola.org/FlashPlayer -> C:\Users\Nigel\AppData\Local\Hola\firefox_hola\app\flash\NPSWF32_18_0_0_232.dll [2015-11-09] ()
FF Plugin HKU\S-1-5-21-4116000945-235673462-3313673197-1000: @hola.org/vlc -> C:\Users\Nigel\AppData\Local\Hola\firefox_hola\app\vlc\npvlc.dll [2015-11-09] (Hola)
FF Plugin HKU\S-1-5-21-4116000945-235673462-3313673197-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Nigel\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [No File]
FF Plugin HKU\S-1-5-21-4116000945-235673462-3313673197-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Nigel\AppData\Local\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-09-11] (Google Inc.)
FF Plugin HKU\S-1-5-21-4116000945-235673462-3313673197-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Nigel\AppData\Local\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-09-11] (Google Inc.)
FF Plugin HKU\S-1-5-21-4116000945-235673462-3313673197-1000: SkypePlugin -> C:\Users\Nigel\AppData\Local\SkypePlugin\7.26.0.48\npGatewayNpapi.dll [2016-09-22] (Skype Technologies S.A.)
FF Plugin HKU\S-1-5-21-4116000945-235673462-3313673197-1000: SkypePlugin64 -> C:\Users\Nigel\AppData\Local\SkypePlugin\7.26.0.48\npGatewayNpapi-x64.dll [2016-09-22] (Skype Technologies S.A.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2016-10-01] (Adobe Systems Inc.)

Chrome:
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> msn.com/?pc=__PARAM__&ocid=__PARAM__DHP&osmkt=en-us
CHR StartupUrls: Default -> "hxxp://www.nine.com.au/"
CHR DefaultSearchKeyword: Default -> google.com.au_
CHR Profile: C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default [2016-12-10]
CHR Extension: (TV) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\beobeededemalmllhkmnkinmfembdimh [2015-11-26]
CHR Extension: (YouTube) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-25]
CHR Extension: (X-notifier (for Gmail™,Hotmail,Yahoo,AOL...)) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\cdfjbkbddpfnoplfhceolpopfoepleco [2016-11-25]
CHR Extension: (Adblock Plus) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-11-28]
CHR Extension: (Google Search) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-25]
CHR Extension: (Fahrenheit Celsius) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejfdmibdakgahpjamigfcdlogfcilohl [2016-09-03]
CHR Extension: (Avast SafePrice) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2016-11-16]
CHR Extension: (Radioplayer) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\fcppdfelojakeahklfgkjegnpbgndoch [2015-11-25]
CHR Extension: (Google Sheets) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-11-25]
CHR Extension: (TV - Voozy.tv) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\flnepcgaapadgbmfkmacafjiejjhbipm [2015-11-25]
CHR Extension: (Quick Javascript Switcher) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\geddoclleiomckbhadiaipdggiiccfje [2016-01-09]
CHR Extension: (Google Docs Offline) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-17]
CHR Extension: (Avast Online Security) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2016-11-12]
CHR Extension: (Google Maps) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\lneaknkopdijkpnocmklfnjbeapigfbh [2015-11-25]
CHR Extension: (Office Online) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndjpnladcallmjemlbaebfadecfhkepb [2016-10-13]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-10]
CHR Extension: (Hola - Unlimited Proxy VPN) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\opalpjjboefohnelaemnhdhlceibbcgl [2016-01-20]
CHR Extension: (Gmail) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-11-25]
CHR Extension: (Chrome Media Router) - C:\Users\Nigel\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-10-15]
CHR HKU\S-1-5-21-4116000945-235673462-3313673197-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Nigel\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx <not found>
CHR HKU\S-1-5-21-4116000945-235673462-3313673197-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [fcfenmboojpjinhpgggodefccipikbpd] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-4116000945-235673462-3313673197-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [197128 2016-09-11] (AVAST Software)
R2 BcmBtRSupport; C:\WINDOWS\system32\BtwRSupportService.exe [2255064 2015-10-20] (Broadcom Corporation.)
S2 BingDesktopUpdate; C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktopUpdater.exe [173792 2015-07-21] (Microsoft Corp.)
R2 IntelBCAsvc; C:\Program Files\Intel\BCA\pabeSvc64.exe [3026584 2016-05-06] (Intel(R) Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.427\McCHSvc.exe [329480 2016-10-13] (McAfee, Inc.)
R2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [253952 2009-07-10] (Acer Incorporated) [File not signed]
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1750712 2015-06-16] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [4088608 2016-09-21] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [235984 2016-11-24] (Safer-Networking Ltd.)
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [237736 2015-08-06] (Synaptics Incorporated)
R2 TrueKey; C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe [908256 2016-07-22] (McAfee, Inc.)
R2 TrueKeyScheduler; C:\Program Files\TrueKey\McTkSchedulerService.exe [15736 2016-07-22] (McAfee, Inc.)
S3 TrueKeyServiceHelper; C:\Program Files\TrueKey\McAfee.TrueKey.ServiceHelper.exe [86864 2016-07-22] (McAfee, Inc.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)
R2 ZAMSvc; C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe [13915888 2016-11-22] (Zemana Ltd.)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 aswHwid; C:\WINDOWS\system32\drivers\aswHwid.sys [37656 2016-09-11] (AVAST Software)
R1 aswKbd; C:\WINDOWS\system32\drivers\aswKbd.sys [37144 2016-09-11] (AVAST Software)
R2 aswMonFlt; C:\WINDOWS\system32\drivers\aswMonFlt.sys [108816 2016-09-11] (AVAST Software)
R1 aswRdr; C:\WINDOWS\system32\drivers\aswRdr2.sys [103064 2016-09-11] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [74544 2016-09-11] (AVAST Software)
R1 aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [969184 2016-09-17] (AVAST Software)
R1 aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [513632 2016-09-27] (AVAST Software)
R2 aswStm; C:\WINDOWS\system32\drivers\aswStm.sys [163416 2016-09-11] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [293352 2016-11-01] (AVAST Software)
R3 bcbtums; C:\WINDOWS\system32\drivers\bcbtums.sys [170712 2015-10-20] (Broadcom Corporation.)
S1 HssDRV6; C:\WINDOWS\System32\DRIVERS\hssdrv6.sys [44648 2015-06-04] (AnchorFree Inc.)
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
S3 NETw1v64; C:\WINDOWS\System32\DRIVERS\NETw1v64.sys [7058432 2009-07-20] (Intel Corporation) [File not signed]
R3 SmbDrvI; C:\WINDOWS\system32\DRIVERS\Smb_driver_Intel.sys [33960 2015-08-06] (Synaptics Incorporated)
S3 taphss6; C:\WINDOWS\System32\drivers\taphss6.sys [42088 2015-06-04] (Anchorfree Inc.)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
R1 ZAM; C:\WINDOWS\System32\drivers\zam64.sys [203680 2016-12-08] (Zemana Ltd.)
R1 ZAM_Guard; C:\WINDOWS\System32\drivers\zamguard64.sys [203680 2016-12-08] (Zemana Ltd.)
U3 idsvc; no ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-12-10 11:31 - 2016-12-10 11:33 - 00027997 _____ C:\Users\Nigel\Downloads\FRST.txt
2016-12-10 11:24 - 2016-12-10 11:31 - 00000000 ____D C:\FRST
2016-12-10 11:22 - 2016-12-10 11:23 - 02420224 _____ (Farbar) C:\Users\Nigel\Downloads\FRST64.exe
2016-12-10 11:20 - 2016-12-10 11:21 - 01761792 _____ (Farbar) C:\Users\Nigel\Desktop\FRST.exe
2016-12-10 10:34 - 2016-12-10 10:37 - 02559864 _____ (Microsoft Corporation) C:\Users\Nigel\Downloads\DefaultPack (4).EXE
2016-12-10 10:21 - 2016-12-10 10:21 - 00000000 ___RD C:\Users\Nigel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD 8
2016-12-08 21:18 - 2016-12-10 11:32 - 00174629 _____ C:\WINDOWS\ZAM.krnl.trace
2016-12-08 21:18 - 2016-12-10 11:32 - 00162511 _____ C:\WINDOWS\ZAM_Guard.krnl.trace
2016-12-08 21:18 - 2016-12-08 21:18 - 00203680 _____ (Zemana Ltd.) C:\WINDOWS\system32\Drivers\zamguard64.sys
2016-12-08 21:18 - 2016-12-08 21:18 - 00203680 _____ (Zemana Ltd.) C:\WINDOWS\system32\Drivers\zam64.sys
2016-12-08 21:18 - 2016-12-08 21:18 - 00001221 _____ C:\Users\Public\Desktop\Zemana AntiMalware.lnk
2016-12-08 21:18 - 2016-12-08 21:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zemana AntiMalware
2016-12-08 21:18 - 2016-12-08 21:18 - 00000000 ____D C:\Program Files (x86)\Zemana AntiMalware
2016-12-08 21:17 - 2016-12-08 21:17 - 00000000 ____D C:\Users\Nigel\AppData\Local\Zemana
2016-12-08 21:16 - 2016-12-08 21:17 - 05431336 _____ ( ) C:\Users\Nigel\Downloads\Zemana.AntiMalware.Setup(1).exe
2016-12-08 21:10 - 2016-12-08 21:11 - 05431336 _____ ( ) C:\Users\Nigel\Downloads\Zemana.AntiMalware.Setup.exe
2016-12-07 10:48 - 2016-12-07 10:48 - 00001232 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-12-07 10:48 - 2016-12-07 10:48 - 00001220 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2016-12-07 10:48 - 2016-12-07 10:48 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-12-07 10:40 - 2016-12-07 10:40 - 00243552 _____ C:\Users\Nigel\Downloads\Firefox Setup Stub 50.0.2 (2).exe
2016-12-07 10:31 - 2016-12-07 10:31 - 00243552 _____ C:\Users\Nigel\Downloads\Firefox Setup Stub 50.0.2 (1).exe
2016-12-07 10:20 - 2016-12-07 10:20 - 00243552 _____ C:\Users\Nigel\Downloads\Firefox Setup Stub 50.0.2.exe
2016-12-02 22:18 - 2016-11-29 10:34 - 00452469 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20161202-221826.backup
2016-12-02 11:47 - 2016-12-02 11:48 - 00737344 _____ (Oracle Corporation) C:\Users\Nigel\Downloads\JavaSetup8u111 (4).exe
2016-12-02 11:46 - 2016-12-02 11:47 - 00737344 _____ (Oracle Corporation) C:\Users\Nigel\Downloads\JavaSetup8u111 (3).exe
2016-12-02 11:32 - 2016-12-02 11:32 - 00737344 _____ (Oracle Corporation) C:\Users\Nigel\Downloads\JavaSetup8u111 (2).exe
2016-12-02 11:31 - 2016-12-02 11:31 - 00737344 _____ (Oracle Corporation) C:\Users\Nigel\Downloads\JavaSetup8u111 (1).exe
2016-12-02 11:30 - 2016-12-02 11:31 - 00737344 _____ (Oracle Corporation) C:\Users\Nigel\Downloads\JavaSetup8u111.exe
2016-11-29 10:34 - 2016-11-29 10:34 - 00002013 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2016-11-29 10:34 - 2016-11-29 10:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
2016-11-29 10:33 - 2016-11-29 10:34 - 00000000 ____D C:\Program Files\McAfee Security Scan
2016-11-27 11:12 - 2016-11-27 11:12 - 00002348 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-11-27 11:12 - 2016-11-27 11:12 - 00002336 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-11-27 11:10 - 2016-11-27 11:10 - 01065376 _____ (Google Inc.) C:\Users\Nigel\Downloads\ChromeSetup (9).exe
2016-11-27 10:57 - 2016-11-27 10:57 - 01065376 _____ (Google Inc.) C:\Users\Nigel\Downloads\ChromeSetup (8).exe
2016-11-26 14:30 - 2016-12-10 11:13 - 00000000 ____D C:\Users\Nigel\AppData\LocalLow\Mozilla
2016-11-26 14:29 - 2016-12-07 10:48 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-11-21 11:38 - 2016-11-21 11:38 - 00002225 _____ C:\Users\Public\Desktop\Google Earth.lnk
2016-11-21 11:37 - 2016-11-21 11:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
2016-11-20 20:44 - 2016-11-02 22:01 - 00315744 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2016-11-20 20:44 - 2016-11-02 21:13 - 00773720 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll
2016-11-20 20:44 - 2016-11-02 21:12 - 00376672 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys
2016-11-20 20:44 - 2016-11-02 21:10 - 02323728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll
2016-11-20 20:44 - 2016-11-02 21:09 - 02257104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2016-11-20 20:44 - 2016-11-02 21:08 - 00576408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2016-11-20 20:44 - 2016-11-02 21:08 - 00186424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\weretw.dll
2016-11-20 20:44 - 2016-11-02 21:05 - 00959112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2016-11-20 20:44 - 2016-11-02 21:02 - 00682816 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2016-11-20 20:44 - 2016-11-02 21:02 - 00238056 _____ (Microsoft Corporation) C:\WINDOWS\system32\weretw.dll
2016-11-20 20:44 - 2016-11-02 21:01 - 01263856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2016-11-20 20:44 - 2016-11-02 21:01 - 00545936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2016-11-20 20:44 - 2016-11-02 21:00 - 08156080 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2016-11-20 20:44 - 2016-11-02 21:00 - 01274712 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2016-11-20 20:44 - 2016-11-02 20:49 - 00037376 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2016-11-20 20:44 - 2016-11-02 20:47 - 00047104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Shell.Search.UriHandler.dll
2016-11-20 20:44 - 2016-11-02 20:46 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininetlui.dll
2016-11-20 20:44 - 2016-11-02 20:39 - 00348672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\zipfldr.dll
2016-11-20 20:44 - 2016-11-02 20:33 - 12349952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2016-11-20 20:44 - 2016-11-02 20:33 - 03307520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2016-11-20 20:44 - 2016-11-02 20:31 - 00226304 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcTok.exe
2016-11-20 20:44 - 2016-11-02 20:31 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSpkg.dll
2016-11-20 20:44 - 2016-11-02 20:30 - 00109056 _____ (Microsoft Corporation) C:\WINDOWS\system32\dab.dll
2016-11-20 20:44 - 2016-11-02 20:30 - 00058880 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Shell.Search.UriHandler.dll
2016-11-20 20:44 - 2016-11-02 20:29 - 00884224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2016-11-20 20:44 - 2016-11-02 20:29 - 00336896 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkBindingEngineMigPlugin.dll
2016-11-20 20:44 - 2016-11-02 20:29 - 00122368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NPSM.dll
2016-11-20 20:44 - 2016-11-02 20:28 - 04423680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExplorerFrame.dll
2016-11-20 20:44 - 2016-11-02 20:28 - 00566784 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActionCenterCPL.dll
2016-11-20 20:44 - 2016-11-02 20:28 - 00432128 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpAXHolder.dll
2016-11-20 20:44 - 2016-11-02 20:28 - 00252928 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll
2016-11-20 20:44 - 2016-11-02 20:28 - 00109568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\chartv.dll
2016-11-20 20:44 - 2016-11-02 20:27 - 01388544 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Cred.dll
2016-11-20 20:44 - 2016-11-02 20:26 - 00712192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Search.dll
2016-11-20 20:44 - 2016-11-02 20:26 - 00579072 _____ (Microsoft Corporation) C:\WINDOWS\system32\ddraw.dll
2016-11-20 20:44 - 2016-11-02 20:26 - 00278016 _____ (Microsoft Corporation) C:\WINDOWS\system32\netplwiz.dll
2016-11-20 20:44 - 2016-11-02 20:23 - 00101888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bowser.sys
2016-11-20 20:44 - 2016-11-02 20:22 - 13441024 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
2016-11-20 20:44 - 2016-11-02 20:22 - 00369664 _____ (Microsoft Corporation) C:\WINDOWS\system32\msinfo32.exe
2016-11-20 20:44 - 2016-11-02 20:19 - 00089088 _____ (Microsoft Corporation) C:\WINDOWS\system32\asycfilt.dll
2016-11-20 20:44 - 2016-11-02 20:18 - 00836608 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcRefreshTask.dll
2016-11-20 20:44 - 2016-11-02 20:17 - 00909824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Search.dll
2016-11-20 20:44 - 2016-11-02 20:16 - 01359360 _____ (Microsoft Corporation) C:\WINDOWS\system32\usercpl.dll
2016-11-20 20:44 - 2016-11-02 20:16 - 00308736 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActionCenter.dll
2016-11-20 20:44 - 2016-11-02 18:20 - 00446896 _____ C:\WINDOWS\system32\ApnDatabase.xml
2016-11-20 20:43 - 2016-11-02 22:01 - 00484584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2016-11-20 20:43 - 2016-11-02 21:22 - 01570672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2016-11-20 20:43 - 2016-11-02 21:20 - 00590960 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2016-11-20 20:43 - 2016-11-02 21:13 - 01883784 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2016-11-20 20:43 - 2016-11-02 21:12 - 02255712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2016-11-20 20:43 - 2016-11-02 21:12 - 00341344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll
2016-11-20 20:43 - 2016-11-02 21:05 - 06657176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2016-11-20 20:43 - 2016-11-02 21:05 - 03892352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2016-11-20 20:43 - 2016-11-02 21:05 - 00951904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll
2016-11-20 20:43 - 2016-11-02 21:05 - 00405856 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll
2016-11-20 20:43 - 2016-11-02 21:04 - 04312248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2016-11-20 20:43 - 2016-11-02 21:03 - 00714592 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\vhdmp.sys
2016-11-20 20:43 - 2016-11-02 21:00 - 00534096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2016-11-20 20:43 - 2016-11-02 20:59 - 04673304 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2016-11-20 20:43 - 2016-11-02 20:50 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LaunchWinApp.exe
2016-11-20 20:43 - 2016-11-02 20:49 - 00147968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32k.sys
2016-11-20 20:43 - 2016-11-02 20:44 - 00180224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe
2016-11-20 20:43 - 2016-11-02 20:44 - 00089088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AuthExt.dll
2016-11-20 20:43 - 2016-11-02 20:43 - 00557568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StoreAgent.dll
2016-11-20 20:43 - 2016-11-02 20:42 - 00632832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sud.dll
2016-11-20 20:43 - 2016-11-02 20:42 - 00506880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DevicePairing.dll
2016-11-20 20:43 - 2016-11-02 20:42 - 00223232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgentUserBroker.exe
2016-11-20 20:43 - 2016-11-02 20:40 - 00896512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontext.dll
2016-11-20 20:43 - 2016-11-02 20:38 - 22563840 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2016-11-20 20:43 - 2016-11-02 20:38 - 00760832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\appwiz.cpl
2016-11-20 20:43 - 2016-11-02 20:36 - 07626752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2016-11-20 20:43 - 2016-11-02 20:34 - 00043008 _____ (Microsoft Corporation) C:\WINDOWS\system32\LaunchWinApp.exe
2016-11-20 20:43 - 2016-11-02 20:32 - 00040448 _____ (Microsoft Corporation) C:\WINDOWS\system32\efsext.dll
2016-11-20 20:43 - 2016-11-02 20:31 - 01228288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\usercpl.dll
2016-11-20 20:43 - 2016-11-02 20:31 - 00097792 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll
2016-11-20 20:43 - 2016-11-02 20:30 - 09131008 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2016-11-20 20:43 - 2016-11-02 20:30 - 00567296 _____ (Microsoft Corporation) C:\WINDOWS\system32\DevicePairing.dll
2016-11-20 20:43 - 2016-11-02 20:29 - 07469056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2016-11-20 20:43 - 2016-11-02 20:28 - 00411136 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCenter.dll
2016-11-20 20:43 - 2016-11-02 20:28 - 00324608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll
2016-11-20 20:43 - 2016-11-02 20:28 - 00274432 _____ (Microsoft Corporation) C:\WINDOWS\system32\ListSvc.dll
2016-11-20 20:43 - 2016-11-02 20:28 - 00240640 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkDesktopSettings.dll
2016-11-20 20:43 - 2016-11-02 20:28 - 00115200 _____ (Microsoft Corporation) C:\WINDOWS\system32\IdCtrls.dll
2016-11-20 20:43 - 2016-11-02 20:27 - 23677952 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2016-11-20 20:43 - 2016-11-02 20:27 - 02458112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\themecpl.dll
2016-11-20 20:43 - 2016-11-02 20:27 - 00631296 _____ (Microsoft Corporation) C:\WINDOWS\system32\WlanMediaManager.dll
2016-11-20 20:43 - 2016-11-02 20:27 - 00580608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hgcpl.dll
2016-11-20 20:43 - 2016-11-02 20:27 - 00545792 _____ (Microsoft Corporation) C:\WINDOWS\system32\timedate.cpl
2016-11-20 20:43 - 2016-11-02 20:27 - 00495104 _____ (Microsoft Corporation) C:\WINDOWS\system32\DataSenseHandlers.dll
2016-11-20 20:43 - 2016-11-02 20:27 - 00422400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinapi.dll
2016-11-20 20:43 - 2016-11-02 20:26 - 02747392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpcore.dll
2016-11-20 20:43 - 2016-11-02 20:26 - 02484736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gameux.dll
2016-11-20 20:43 - 2016-11-02 20:26 - 00912896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comdlg32.dll
2016-11-20 20:43 - 2016-11-02 20:26 - 00388608 _____ (Microsoft Corporation) C:\WINDOWS\system32\zipfldr.dll
2016-11-20 20:43 - 2016-11-02 20:26 - 00358912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\stobject.dll
2016-11-20 20:43 - 2016-11-02 20:26 - 00049152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Shell.dll
2016-11-20 20:43 - 2016-11-02 20:25 - 02998272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2016-11-20 20:43 - 2016-11-02 20:25 - 01556480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll
2016-11-20 20:43 - 2016-11-02 20:25 - 00655872 _____ (Microsoft Corporation) C:\WINDOWS\system32\sud.dll
2016-11-20 20:43 - 2016-11-02 20:25 - 00496128 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettings.UserAccountsHandlers.dll
2016-11-20 20:43 - 2016-11-02 20:24 - 00940032 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontext.dll
2016-11-20 20:43 - 2016-11-02 20:23 - 03106304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstsc.exe
2016-11-20 20:43 - 2016-11-02 20:23 - 02104320 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlidsvc.dll
2016-11-20 20:43 - 2016-11-02 20:22 - 04749312 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2016-11-20 20:43 - 2016-11-02 20:22 - 00337920 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2016-11-20 20:43 - 2016-11-02 20:21 - 00942080 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2016-11-20 20:43 - 2016-11-02 20:19 - 00981504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Security.Authentication.OnlineId.dll
2016-11-20 20:43 - 2016-11-02 20:19 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\NPSM.dll
2016-11-20 20:43 - 2016-11-02 20:19 - 00130560 _____ (Microsoft Corporation) C:\WINDOWS\system32\chartv.dll
2016-11-20 20:43 - 2016-11-02 20:18 - 00991232 _____ (Microsoft Corporation) C:\WINDOWS\system32\comdlg32.dll
2016-11-20 20:43 - 2016-11-02 20:17 - 01282048 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwansvc.dll
2016-11-20 20:43 - 2016-11-02 20:17 - 00828416 _____ (Microsoft Corporation) C:\WINDOWS\system32\appwiz.cpl
2016-11-20 20:43 - 2016-11-02 20:17 - 00389632 _____ (Microsoft Corporation) C:\WINDOWS\system32\stobject.dll
2016-11-20 20:43 - 2016-11-02 20:16 - 03400192 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncCenter.dll
2016-11-20 20:43 - 2016-11-02 20:16 - 03133440 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcore.dll
2016-11-20 20:43 - 2016-11-02 20:16 - 02512384 _____ (Microsoft Corporation) C:\WINDOWS\system32\themecpl.dll
2016-11-20 20:43 - 2016-11-02 20:16 - 00881664 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2016-11-20 20:43 - 2016-11-02 20:16 - 00629248 _____ (Microsoft Corporation) C:\WINDOWS\system32\hgcpl.dll
2016-11-20 20:43 - 2016-11-02 20:15 - 02611200 _____ (Microsoft Corporation) C:\WINDOWS\system32\gameux.dll
2016-11-20 20:43 - 2016-11-02 20:15 - 00483328 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.dll
2016-11-20 20:43 - 2016-11-02 20:14 - 01726976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll
2016-11-20 20:42 - 2016-11-02 21:22 - 00601712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll
2016-11-20 20:42 - 2016-11-02 21:13 - 00423776 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifitask.exe
2016-11-20 20:42 - 2016-11-02 21:08 - 00602464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupEngine.dll
2016-11-20 20:42 - 2016-11-02 21:08 - 00111968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupApi.dll
2016-11-20 20:42 - 2016-11-02 21:03 - 02750936 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2016-11-20 20:42 - 2016-11-02 21:01 - 01425000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d9.dll
2016-11-20 20:42 - 2016-11-02 21:01 - 01415744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2016-11-20 20:42 - 2016-11-02 21:01 - 00276832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\input.dll
2016-11-20 20:42 - 2016-11-02 21:00 - 22223968 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2016-11-20 20:42 - 2016-11-02 20:48 - 00095232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TSpkg.dll
2016-11-20 20:42 - 2016-11-02 20:43 - 00270336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2016-11-20 20:42 - 2016-11-02 20:42 - 00549376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActionCenterCPL.dll
2016-11-20 20:42 - 2016-11-02 20:42 - 00306176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieproxy.dll
2016-11-20 20:42 - 2016-11-02 20:40 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\indexeddbserver.dll
2016-11-20 20:42 - 2016-11-02 20:39 - 00465920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LockAppBroker.dll
2016-11-20 20:42 - 2016-11-02 20:39 - 00236544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIAnimation.dll
2016-11-20 20:42 - 2016-11-02 20:37 - 19415040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2016-11-20 20:42 - 2016-11-02 20:36 - 19415552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2016-11-20 20:42 - 2016-11-02 20:31 - 03196416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cdp.dll
2016-11-20 20:42 - 2016-11-02 20:31 - 00159232 _____ (Microsoft Corporation) C:\WINDOWS\system32\ACPBackgroundManagerPolicy.dll
2016-11-20 20:42 - 2016-11-02 20:31 - 00090624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll
2016-11-20 20:42 - 2016-11-02 20:30 - 12175360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2016-11-20 20:42 - 2016-11-02 20:30 - 00363520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BioFeedback.dll
2016-11-20 20:42 - 2016-11-02 20:30 - 00321536 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2016-11-20 20:42 - 2016-11-02 20:29 - 03666432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2016-11-20 20:42 - 2016-11-02 20:29 - 01247232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll
2016-11-20 20:42 - 2016-11-02 20:29 - 00296960 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsensorgroup.dll
2016-11-20 20:42 - 2016-11-02 20:28 - 06044160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2016-11-20 20:42 - 2016-11-02 20:28 - 00807424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Security.Authentication.OnlineId.dll
2016-11-20 20:42 - 2016-11-02 20:28 - 00690176 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieproxy.dll
2016-11-20 20:42 - 2016-11-02 20:28 - 00279552 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.HumanInterfaceDevice.dll
2016-11-20 20:42 - 2016-11-02 20:28 - 00079360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\asycfilt.dll
2016-11-20 20:42 - 2016-11-02 20:27 - 00605184 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvr.exe
2016-11-20 20:42 - 2016-11-02 20:27 - 00261632 _____ (Microsoft Corporation) C:\WINDOWS\system32\indexeddbserver.dll
2016-11-20 20:42 - 2016-11-02 20:26 - 01509376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2016-11-20 20:42 - 2016-11-02 20:25 - 00956416 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2016-11-20 20:42 - 2016-11-02 20:23 - 00072704 _____ (Microsoft Corporation) C:\WINDOWS\system32\ErrorDetailsUpdate.dll
2016-11-20 20:42 - 2016-11-02 20:22 - 13081600 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2016-11-20 20:42 - 2016-11-02 20:21 - 05111296 _____ (Microsoft Corporation) C:\WINDOWS\system32\cdp.dll
2016-11-20 20:42 - 2016-11-02 20:20 - 02273792 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2016-11-20 20:42 - 2016-11-02 20:19 - 08127488 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2016-11-20 20:42 - 2016-11-02 20:19 - 08075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2016-11-20 20:42 - 2016-11-02 20:19 - 01586176 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll
2016-11-20 20:42 - 2016-11-02 20:19 - 00805888 _____ (Microsoft Corporation) C:\WINDOWS\system32\FrameServer.dll
2016-11-20 20:42 - 2016-11-02 20:18 - 01690112 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2016-11-20 20:42 - 2016-11-02 20:17 - 04746752 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2016-11-20 20:42 - 2016-11-02 20:17 - 00982528 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2016-11-20 20:42 - 2016-11-02 20:16 - 02688512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll
2016-11-20 20:42 - 2016-11-02 20:16 - 02669056 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2016-11-20 20:42 - 2016-11-02 20:16 - 01779712 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2016-11-20 20:42 - 2016-11-02 20:16 - 01637888 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2016-11-20 20:42 - 2016-11-02 20:16 - 00770560 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll
2016-11-20 20:42 - 2016-11-02 20:16 - 00579072 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppBroker.dll
2016-11-20 20:42 - 2016-11-02 20:15 - 04708864 _____ (Microsoft Corporation) C:\WINDOWS\system32\ExplorerFrame.dll
2016-11-20 20:42 - 2016-11-02 20:15 - 01513472 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2016-11-20 20:42 - 2016-11-02 20:15 - 01348608 _____ (Microsoft Corporation) C:\WINDOWS\system32\wifinetworkmanager.dll
2016-11-20 20:42 - 2016-11-02 20:15 - 00842240 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntshrui.dll
2016-11-20 20:42 - 2016-11-02 20:13 - 03496960 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVidCtl.dll
2016-11-20 20:42 - 2016-11-02 20:13 - 03299840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstsc.exe
2016-11-20 20:41 - 2016-11-02 21:20 - 00378720 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2016-11-20 20:41 - 2016-11-02 21:15 - 01051112 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2016-11-20 20:41 - 2016-11-02 21:15 - 00894096 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2016-11-20 20:41 - 2016-11-02 21:14 - 07816544 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2016-11-20 20:41 - 2016-11-02 21:13 - 01354320 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2016-11-20 20:41 - 2016-11-02 21:13 - 01173496 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2016-11-20 20:41 - 2016-11-02 21:05 - 20969928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2016-11-20 20:41 - 2016-11-02 21:04 - 02678056 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll
2016-11-20 20:41 - 2016-11-02 21:04 - 00596832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comctl32.dll
2016-11-20 20:41 - 2016-11-02 21:02 - 00848736 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupEngine.dll
2016-11-20 20:41 - 2016-11-02 21:02 - 00148832 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupApi.dll
2016-11-20 20:41 - 2016-11-02 21:01 - 00092512 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2016-11-20 20:41 - 2016-11-02 21:00 - 04130432 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2016-11-20 20:41 - 2016-11-02 21:00 - 01061968 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll
2016-11-20 20:41 - 2016-11-02 20:56 - 01609920 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d9.dll
2016-11-20 20:41 - 2016-11-02 20:56 - 01572768 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2016-11-20 20:41 - 2016-11-02 20:56 - 01418312 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2016-11-20 20:41 - 2016-11-02 20:56 - 00628552 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2016-11-20 20:41 - 2016-11-02 20:56 - 00322912 _____ (Microsoft Corporation) C:\WINDOWS\system32\input.dll
2016-11-20 20:41 - 2016-11-02 20:55 - 00048992 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\iorate.sys
2016-11-20 20:41 - 2016-11-02 20:48 - 00081408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2016-11-20 20:41 - 2016-11-02 20:48 - 00032768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\efsext.dll
2016-11-20 20:41 - 2016-11-02 20:47 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BlockedShutdown.dll
2016-11-20 20:41 - 2016-11-02 20:47 - 00156672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BcastDVRHelper.dll
2016-11-20 20:41 - 2016-11-02 20:46 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppCapture.dll
2016-11-20 20:41 - 2016-11-02 20:45 - 00492032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcastdvr.exe
2016-11-20 20:41 - 2016-11-02 20:45 - 00253952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BioFeedback.dll
2016-11-20 20:41 - 2016-11-02 20:45 - 00182784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsensorgroup.dll
2016-11-20 20:41 - 2016-11-02 20:44 - 00231936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll
2016-11-20 20:41 - 2016-11-02 20:43 - 00731136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d8.dll
2016-11-20 20:41 - 2016-11-02 20:43 - 00198144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FSClient.dll
2016-11-20 20:41 - 2016-11-02 20:43 - 00126464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2016-11-20 20:41 - 2016-11-02 20:42 - 00866816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Cred.dll
2016-11-20 20:41 - 2016-11-02 20:42 - 00202752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.HumanInterfaceDevice.dll
2016-11-20 20:41 - 2016-11-02 20:41 - 00635904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2016-11-20 20:41 - 2016-11-02 20:40 - 00548352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ddraw.dll
2016-11-20 20:41 - 2016-11-02 20:36 - 00063488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ErrorDetailsUpdate.dll
2016-11-20 20:41 - 2016-11-02 20:35 - 00336896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msinfo32.exe
2016-11-20 20:41 - 2016-11-02 20:34 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\system32\microsoft-windows-system-events.dll
2016-11-20 20:41 - 2016-11-02 20:33 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2016-11-20 20:41 - 2016-11-02 20:32 - 00045056 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2016-11-20 20:41 - 2016-11-02 20:31 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\system32\BcastDVRHelper.dll
2016-11-20 20:41 - 2016-11-02 20:31 - 00170496 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppCapture.dll
2016-11-20 20:41 - 2016-11-02 20:31 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininetlui.dll
2016-11-20 20:41 - 2016-11-02 20:30 - 00635904 _____ (Microsoft Corporation) C:\WINDOWS\system32\FlightSettings.dll
2016-11-20 20:41 - 2016-11-02 20:30 - 00134144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ErrorDetails.dll
2016-11-20 20:41 - 2016-11-02 20:29 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BlockedShutdown.dll
2016-11-20 20:41 - 2016-11-02 20:29 - 00314880 _____ (Microsoft Corporation) C:\WINDOWS\system32\FSClient.dll
2016-11-20 20:41 - 2016-11-02 20:29 - 00276992 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2016-11-20 20:41 - 2016-11-02 20:29 - 00211968 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe
2016-11-20 20:41 - 2016-11-02 20:29 - 00139264 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2016-11-20 20:41 - 2016-11-02 20:28 - 00748544 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll
2016-11-20 20:41 - 2016-11-02 20:28 - 00321024 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkUXBroker.dll
2016-11-20 20:41 - 2016-11-02 20:28 - 00260608 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgentUserBroker.exe
2016-11-20 20:41 - 2016-11-02 20:28 - 00088576 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2016-11-20 20:41 - 2016-11-02 20:26 - 01880576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll
2016-11-20 20:41 - 2016-11-02 20:26 - 01595392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2016-11-20 20:41 - 2016-11-02 20:26 - 00798208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2016-11-20 20:41 - 2016-11-02 20:26 - 00273920 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIAnimation.dll
2016-11-20 20:41 - 2016-11-02 20:25 - 02256384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2016-11-20 20:41 - 2016-11-02 20:25 - 00772608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntshrui.dll
2016-11-20 20:41 - 2016-11-02 20:25 - 00541696 _____ (Microsoft Corporation) C:\WINDOWS\system32\ipnathlp.dll
2016-11-20 20:41 - 2016-11-02 20:24 - 03778560 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2016-11-20 20:41 - 2016-11-02 20:23 - 02356736 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVidCtl.dll
2016-11-20 20:41 - 2016-11-02 20:23 - 00199680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GlobCollationHost.dll
2016-11-20 20:41 - 2016-11-02 20:20 - 00167936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ErrorDetails.dll
2016-11-20 20:41 - 2016-11-02 20:18 - 00243712 _____ (Microsoft Corporation) C:\WINDOWS\system32\shdocvw.dll
2016-11-20 20:41 - 2016-11-02 20:16 - 04148736 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2016-11-20 20:41 - 2016-11-02 20:16 - 01490944 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2016-11-20 20:41 - 2016-11-02 20:16 - 00265728 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupSvc.dll
2016-11-20 20:41 - 2016-11-02 20:15 - 03616768 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2016-11-20 20:41 - 2016-11-02 20:13 - 00322048 _____ (Microsoft Corporation) C:\WINDOWS\system32\GlobCollationHost.dll
2016-11-20 20:41 - 2016-11-02 19:11 - 00788624 _____ C:\WINDOWS\SysWOW64\locale.nls
2016-11-20 20:41 - 2016-11-02 19:11 - 00788624 _____ C:\WINDOWS\system32\locale.nls
2016-11-20 20:41 - 2016-08-02 14:30 - 00822784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-12-10 10:39 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-12-10 10:38 - 2016-07-16 21:47 - 00000000 ___HD C:\Program Files\WindowsApps
2016-12-08 21:48 - 2015-07-28 18:59 - 00000258 __RSH C:\ProgramData\ntuser.pol
2016-12-08 21:18 - 2016-10-04 23:08 - 00000000 ____D C:\Users\Nigel
2016-12-05 10:31 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\system32\NDF
2016-12-04 10:55 - 2016-10-05 00:18 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-12-04 10:55 - 2016-10-04 22:58 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2016-12-03 11:25 - 2016-04-09 09:42 - 00000892 _____ C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job
2016-12-03 11:25 - 2013-06-01 16:31 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2016-12-03 11:20 - 2016-07-16 21:45 - 00000000 ____D C:\WINDOWS\INF
2016-12-02 19:05 - 2014-05-22 21:30 - 00000000 ____D C:\Users\Nigel\AppData\Local\Packages
2016-12-02 18:40 - 2015-08-06 21:12 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2016-12-02 12:16 - 2016-04-21 08:42 - 00000000 ____D C:\Users\Nigel\AppData\Local\tkdata
2016-12-02 12:13 - 2013-09-22 18:38 - 00000000 ____D C:\ProgramData\Oracle
2016-12-02 12:12 - 2014-10-17 17:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2016-12-02 12:12 - 2013-09-22 18:36 - 00000000 ____D C:\Program Files (x86)\Java
2016-12-02 12:00 - 2016-05-03 21:28 - 00097856 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2016-12-02 11:40 - 2014-06-19 09:35 - 00000000 ____D C:\Users\Nigel\AppData\Local\Adobe
2016-12-02 11:39 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed
2016-12-02 11:39 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\system32\Macromed
2016-11-30 21:12 - 2016-10-05 16:49 - 00000000 ____D C:\Windows.old
2016-11-30 20:38 - 2015-09-08 09:10 - 00000000 ____D C:\Users\Public\Downloads\Maps
2016-11-30 10:57 - 2013-04-29 21:06 - 00000000 ____D C:\ProgramData\Yahoo!
2016-11-30 10:57 - 2013-04-29 21:00 - 00000000 ____D C:\Program Files (x86)\Yahoo!
2016-11-27 10:31 - 2015-08-06 09:48 - 00000000 ____D C:\Users\Nigel\AppData\Local\Publishers
2016-11-26 20:01 - 2012-11-06 14:38 - 00003326 _____ C:\WINDOWS\wininit.ini
2016-11-26 16:29 - 2014-06-23 21:53 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2016-11-24 10:47 - 2015-08-06 09:44 - 00000000 __RHD C:\Users\Public\AccountPictures
2016-11-24 10:42 - 2016-10-04 22:58 - 00267136 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2016-11-24 10:40 - 2016-07-16 16:04 - 00786432 _____ C:\WINDOWS\system32\config\BBI
2016-11-24 10:38 - 2016-07-16 21:47 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2016-11-24 10:38 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2016-11-24 10:38 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\system32\oobe
2016-11-24 10:38 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\system32\migwiz
2016-11-24 10:38 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\ShellExperiences
2016-11-24 10:38 - 2016-07-16 21:47 - 00000000 ____D C:\WINDOWS\bcastdvr
2016-11-24 10:32 - 2016-10-05 00:18 - 00004018 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player PPAPI Notifier
2016-11-23 22:33 - 2013-08-14 08:38 - 00000000 ____D C:\WINDOWS\system32\MRT
2016-11-23 22:13 - 2012-06-29 11:45 - 141011376 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2016-11-23 22:10 - 2016-07-16 21:36 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-11-23 11:32 - 2012-08-29 09:48 - 00000000 ____D C:\Users\Nigel\AppData\Roaming\Skype
2016-11-23 11:17 - 2012-08-29 09:47 - 00000000 ____D C:\ProgramData\Skype
2016-11-23 11:16 - 2014-06-06 21:08 - 00000000 ___RD C:\Program Files (x86)\Skype
2016-11-21 11:37 - 2009-08-20 15:38 - 00000000 ____D C:\Program Files (x86)\Google
2016-11-21 11:20 - 2012-06-29 12:47 - 00000000 ____D C:\Users\Nigel\AppData\Local\Google
2016-11-16 11:42 - 2016-10-04 23:06 - 01103758 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-11-15 21:38 - 2016-01-20 16:22 - 00000000 ___HD C:\WINDOWS\AxInstSV
2016-11-11 10:16 - 2016-02-28 20:38 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-11-11 10:13 - 2016-10-05 00:18 - 00004562 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task

==================== Files in the root of some directories =======

2014-05-22 11:41 - 2014-05-22 11:41 - 6103040 _____ () C:\Program Files (x86)\GUT2D95.tmp
2015-02-05 15:23 - 2015-02-05 15:23 - 6103040 _____ () C:\Program Files (x86)\GUT7CBF.tmp
2014-09-15 21:59 - 2014-09-15 22:04 - 6010880 _____ () C:\Program Files (x86)\GUT7DD7.tmp
2009-08-20 15:17 - 2009-02-11 05:23 - 0192484 _____ () C:\Program Files (x86)\Common Files\Acer GameZone online.ico
2015-09-25 20:59 - 2015-09-25 21:00 - 0013088 _____ () C:\Users\Nigel\AppData\Local\HWVendorDetection.log
2014-12-12 19:02 - 2014-12-12 19:14 - 0006089 _____ () C:\Users\Nigel\AppData\Local\MyWinLockerInstaller.txt-20141212.log
2015-08-16 22:21 - 2015-08-16 22:21 - 0000017 _____ () C:\Users\Nigel\AppData\Local\resmon.resmoncfg
2014-02-03 18:09 - 2014-02-03 17:55 - 0104448 _____ () C:\Users\Nigel\AppData\Local\Web Data
2015-10-19 18:42 - 2015-10-19 18:42 - 0000000 _____ () C:\Users\Nigel\AppData\Local\{76C6879A-3328-4562-ACF0-045591FB2DF0}
2016-09-08 21:11 - 2016-09-08 21:11 - 0000000 _____ () C:\Users\Nigel\AppData\Local\{B24D55FB-15A9-4F27-9676-79376512B41F}
2016-10-04 23:02 - 2016-10-04 23:02 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2014-07-24 21:17 - 2014-07-24 21:17 - 0000282 _____ () C:\ProgramData\fontcacheev1.dat
2009-08-20 15:17 - 2009-07-18 11:57 - 0036136 _____ (Oberon Media) C:\ProgramData\FullRemove.exe

Files to move or delete:
====================
C:\ProgramData\fontcacheev1.dat

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2016-11-30 21:11

==================== End of FRST.txt ============================Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-12-2016
Ran by Nigel (10-12-2016 11:36:19)
Running from C:\Users\Nigel\Downloads
Windows 10 Home Version 1607 (X64) (2016-10-04 14:27:41)
Boot Mode: Normal
==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-4116000945-235673462-3313673197-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-4116000945-235673462-3313673197-503 - Limited - Disabled)
Guest (S-1-5-21-4116000945-235673462-3313673197-501 - Limited - Disabled)
Nigel (S-1-5-21-4116000945-235673462-3313673197-1000 - Administrator - Enabled) => C:\Users\Nigel

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Avast Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Spybot - Search and Destroy (Disabled - Out of date) {A16C3F68-9280-E053-1818-342707FECF4D}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avast Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Acer Crystal Eye webcam Ver:1.1.95.714 (HKLM-x32\...\{D0ACE89D-EC7F-470F-80BE-4C98ED366B32}) (Version: 1.1.95.714 - Chicony Electronics Co.,Ltd.)
Acer ePower Management (HKLM-x32\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 4.05.3002 - Acer Incorporated)
Acer eRecovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3002 - Acer Incorporated)
Acer GameZone Console (HKLM-x32\...\{8ed9688e-4f79-4308-91ca-f1c37ca142b4}_is1) (Version: 5.1.0.2 - Oberon Media, Inc.)
Acer GridVista (HKLM-x32\...\GridVista) (Version: 3.01.0730 - Acer Inc.)
Acer ScreenSaver (HKLM-x32\...\Acer Screensaver) (Version: 1.06.0804 - Acer Incorporated)
Acer Updater (HKLM-x32\...\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.01.3014 - Acer Incorporated)
Acer VCM (HKLM-x32\...\{047F790A-7A2A-4B6A-AD02-38092BA63DAC}) (Version: 4.05.3000 - Acer Incorporated)
Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adblock Plus for IE (32-bit and 64-bit) (HKLM\...\{0F347A49-E36C-4639-8D2E-003AD408B8B2}) (Version: 1.5 - Eyeo GmbH)
Adblock Plus for IE (HKLM-x32\...\{fd97d1e2-368a-4cd9-af63-8eeff938044a}) (Version: 1.1 - )
Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.020.20042 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 23.0.0.257 - Adobe Systems Incorporated)
Adobe Flash Player 23 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 23.0.0.207 - Adobe Systems Incorporated)
Adobe Flash Player 23 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 23.0.0.207 - Adobe Systems Incorporated)
Alcor Micro USB Card Reader (HKLM-x32\...\InstallShield_{5A22D889-FBDD-4AE8-86EC-089D45FC133E}) (Version: 1.2.17.05001 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (x32 Version: 1.2.17.05001 - Alcor Micro Corp.) Hidden
Alice Greenfingers (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}) (Version: - Oberon Media)
Amazonia (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11273477}) (Version: - Oberon Media)
Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{2EF5D87E-B7BD-458F-8428-E4D0B8B4E65C}) (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{56EC47AA-5813-4FF6-8E75-544026FBEA83}) (Version: 2.2.0.150 - Apple Inc.)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 12.3.2280 - AVAST Software)
Bing Bar (HKLM-x32\...\{449CE12D-E2C7-4B97-B19E-55D163EA9435}) (Version: 7.0.619.0 - Microsoft Corporation)
Bing Desktop (HKLM-x32\...\{7D095455-D971-4D4C-9EFD-9AF6A6584F3A}) (Version: 1.3.475.0 - Microsoft Corporation)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Chicken Invaders 2 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110209593}) (Version: - Oberon Media)
Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
CyberLink PowerDVD 8 (HKLM-x32\...\InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}) (Version: 8.1.2815o.50 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dairy Dash (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115053100}) (Version: - Oberon Media)
Dream Day First Home (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113832110}) (Version: - Oberon Media)
eSobi v2 (HKLM-x32\...\InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}) (Version: 2.0.4.000274 - esobi Inc.)
eSobi v2 (x32 Version: 2.0.4.000274 - esobi Inc.) Hidden
Facebook Video Calling 1.2.0.287 (HKLM-x32\...\{B92C5909-1D37-4C51-8397-A28BB28E5DC3}) (Version: 1.2.287 - Skype Limited)
Farm Frenzy 2 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11531173}) (Version: - Oberon Media)
Foxtel GO (HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\Foxtel GO 1.84) (Version: 1.84 - Foxtel)
Foxtel GO (x32 Version: 1.84 - Foxtel) Hidden
Free FreeCell Solitaire 2016 v3.1 (HKLM-x32\...\Free FreeCell Solitaire_is1) (Version: - TreeCardGames)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 54.0.2840.99 - Google Inc.)
Google Earth (HKLM-x32\...\{A0C18B96-AB79-46BD-8321-6FA83E6D25B9}) (Version: 7.1.7.2606 - Google)
Google Photos Backup (HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\Google Photos Backup) (Version: 1.1.2.13 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.31.5 - Google Inc.) Hidden
Granny In Paradise (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110551697}) (Version: - Oberon Media)
Heroes of Hellas (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113786380}) (Version: - Oberon Media)
Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3001 - Acer Incorporated)
Intel Security True Key (HKLM\...\TrueKey) (Version: 4.4.135.1 - Intel Security)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1892 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - Intel Corporation)
Java 8 Update 111 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180111F0}) (Version: 8.0.1110.14 - Oracle Corporation)
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Launch Manager (HKLM-x32\...\LManager) (Version: 3.0.02 - Acer Inc.)
Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.11.427.2 - McAfee, Inc.)
Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\...\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM-x32\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50901.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Works (HKLM-x32\...\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}) (Version: 9.7.0621 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 50.0.2 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 50.0.2 (x86 en-US)) (Version: 50.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 50.0.2 - Mozilla)
MSXML 4.0 SP2 Parser and SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
NavDesk 7.50 (HKLM-x32\...\{AB756389-9A03-44f3-ABAF-3699C01B4868}-Navman-7.50) (Version: 7.50.0112.135 - Navman Technology NZ Limited)
OLYMPUS Digital Camera Updater (HKLM-x32\...\{392427E9-9FA4-4CD2-99EB-FD53A12BDCDA}) (Version: 1.2.1 - Olympus Corporation)
OLYMPUS Viewer 3 (HKLM-x32\...\{0CE3A5C0-9544-4CE0-8AFD-8562CD9E5913}) (Version: 2.0.0 - Olympus Corporation)
Radioplayer (HKLM-x32\...\com.radioplayer.launcher.radioplayerlauncher) (Version: 1.2.386 - UK Radioplayer Ltd)
Radioplayer (x32 Version: 1.2.386 - UK Radioplayer Ltd) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7535 - Realtek Semiconductor Corp.)
SafeZone Stable 1.51.2220.62 (x32 Version: 1.51.2220.62 - Avast Software) Hidden
Skype Click to Call (HKLM-x32\...\{873F8E7C-10E6-449F-BD7E-5FBA7C8E1C9B}) (Version: 8.5.0.9167 - Microsoft Corporation)
Skype Web Plugin (HKLM-x32\...\{DF6DC2FB-6783-4340-8B98-401CB656AD3A}) (Version: 7.26.0.48 - Skype Technologies S.A.)
Skype™ 7.30 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.30.105 - Skype Technologies S.A.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.5.43 - Safer-Networking Ltd.)
Star Defender 4 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-114803710}) (Version: - Oberon Media)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 19.0.13.0 - Synaptics Incorporated)
Telstra USB+Wi-Fi Hostless Modem (HKLM-x32\...\{AEFF9E60-3E93-41EE-9895-311F7D1C5FFD}) (Version: 1.0.0.2 - ZTE Corporation)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
Welcome Center (HKLM-x32\...\Acer Welcome Center) (Version: 1.00.3005 - Acer Incorporated)
Windows Driver Package - OLYMPUS IMAGING CORP. Camera Communication Driver Package (09/09/2009 1.0.0.0) (HKLM\...\2C1C2F29FADF39F533CEEE67B90F07A5306A4BDB) (Version: 09/09/2009 1.0.0.0 - OLYMPUS IMAGING CORP.)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
Windows Phone app for desktop (HKLM-x32\...\{5F71448B-88EB-4357-9A98-8658D4C49C48}) (Version: 1.1.2726.0 - Microsoft Corporation)
Zemana AntiMalware (HKLM-x32\...\{8F0CD7D1-42F3-4195-95CD-833578D45057}_is1) (Version: 2.70.25 - Zemana Ltd.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-4116000945-235673462-3313673197-1000_Classes\CLSID\{59B55F04-DE14-4BB8-92FF-C4A22EF2E5F4}\InprocServer32 -> C:\Users\Nigel\AppData\Local\Google\Update\1.3.31.5\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4116000945-235673462-3313673197-1000_Classes\CLSID\{BB384F15-7676-403E-B797-1F9D935525A3}\InprocServer32 -> C:\Users\Nigel\AppData\Local\SkypePlugin\7.26.0.48\GatewayActiveX-x64.dll (Skype Technologies S.A.)
CustomCLSID: HKU\S-1-5-21-4116000945-235673462-3313673197-1000_Classes\CLSID\{CBF9CD8C-2714-4F36-B76A-43E6C7547BC2}\localserver32 -> C:\Users\Nigel\AppData\Local\SkypePlugin\7.26.0.48\EdgeCalling.exe (Skype Technologies S.A.)
CustomCLSID: HKU\S-1-5-21-4116000945-235673462-3313673197-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Nigel\AppData\Local\Google\Update\1.3.31.5\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4116000945-235673462-3313673197-1000_Classes\CLSID\{EE77E2C8-7CCF-4449-AC4D-C885C28FAEA2}\localserver32 -> C:\Users\Nigel\AppData\Local\SkypePlugin\7.26.0.48\GatewayVersion-x64.exe (Skype Technologies S.A.)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {01159DE2-A011-4764-98F3-346CB60699E4} - System32\Tasks\{D7654395-BFA9-4959-B8B1-44BD951EFB86} => C:\Program Files (x86)\BBC iPlayer Desktop\BBC iPlayer Desktop.exe
Task: {0AD379C5-5504-43E6-A142-8F50E0E3D24C} - System32\Tasks\{4BE954A3-3C41-4AB0-AC89-E19A30EB9F15} => pcalua.exe -a "C:\Program Files\Hola\app\hola_setup.exe" -c --remove-hola --no-rmt-conf --hola-cr
Task: {0EC964F6-DAB6-4CBE-974C-E984A1E77D89} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\WINDOWS\ehome\mcupdate.exe
Task: {0F0DC27D-9F40-4E52-8BF2-2AA4C8A4BDAD} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {11D36760-7600-4937-9B3A-73CF7DC51AF7} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {1383606C-BC21-4B80-98A7-C5E01E568454} - \{49E65517-C6FF-4662-926A-722036CEACED} -> No File <==== ATTENTION
Task: {14271593-BC2C-4235-8C85-52EA6D45277F} - System32\Tasks\Java Platform SE Auto Updater => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2016-09-22] (Oracle Corporation)
Task: {17B7ADFC-F0C7-4A13-A09F-26840081CD9A} - System32\Tasks\{FCA8B98D-7B6E-4847-AA86-EAD1A463EB8F} => pcalua.exe -a "C:\Program Files\Hola\app\hola_setup.exe" -c --remove-hola --no-rmt-conf --hola-cr
Task: {19A5EFD8-8733-4600-AC14-7018D37E0B1E} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {1AF5BABE-EAFF-41AC-BB6C-4B8E94219134} - System32\Tasks\Puohxiilsri => C:\ProgramData\Puohxiilsri\1.0.4.1\hanuxlin.exe
Task: {1DB3DD4E-A51F-4B7C-98D8-31843575334C} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {1E96951C-B31C-4BCD-BE5A-3295B4DD9410} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {24ABF28E-6BB4-48FF-8938-31AA7803021F} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {2BC317B3-78C6-4ABA-A446-C5200C67E770} - System32\Tasks\{D6CF8AC5-F6E3-4AE0-BF96-ABF7F4C423B2} => pcalua.exe -a C:\Users\Nigel\Downloads\AdobeAIRInstaller(1).exe -d C:\Users\Nigel\Downloads
Task: {2C08F93E-4D64-4926-9F70-779510E5F131} - \{3BCAB8DD-A9A8-467A-9DF8-252117296EF5} -> No File <==== ATTENTION
Task: {2CB922F1-4434-4FE8-9261-4B096CB1A94C} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4116000945-235673462-3313673197-1000UA => C:\Users\Nigel\AppData\Local\Google\Update\GoogleUpdate.exe [2016-09-11] (Google Inc.)
Task: {2FCFC2B7-80A2-4360-96DD-3AF9EC600FA7} - System32\Tasks\{FA2DFFBA-D8D9-43BE-8798-6320337ECC10} => C:\Program Files (x86)\Expat Shield\bin\openvpntray.exe
Task: {2FD8C111-4C6B-455F-8CCD-1846C1CAB2A8} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2016-02-23] (Apple Inc.)
Task: {30E8AB6A-CDA6-4108-9940-D6058DA5E3CF} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {317C3EBB-645E-452F-B40C-A2081F55861E} - System32\Tasks\{C9EAA295-3EC7-4043-B759-AD03F0D4F849} => C:\Program Files (x86)\Google\Google Earth\client\googleearth.exe [2016-10-06] (Google)
Task: {31FDA94E-6044-4C4F-9373-BB0358CD1D96} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\WINDOWS\ehome\MCUpdate.exe
Task: {382C7A2E-A0F8-4ECE-989C-D527979AB83C} - System32\Tasks\SafeZone scheduled Autoupdate 1460846800 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2016-09-06] (Avast Software)
Task: {3C9B9881-3C6A-4575-A3FB-5ABCF44C3A4B} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {4415D626-BBDD-4E3F-8B25-94E5A9A7CE74} - System32\Tasks\{DC92A6B2-BF5A-4D6A-ACDE-685C9D2C8033} => pcalua.exe -a C:\Users\Nigel\Downloads\AdobeAIRInstaller(2).exe -d C:\Users\Nigel\Downloads
Task: {47D465D4-873F-4CAC-8364-8A93745A96A8} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2016-03-21] (Safer-Networking Ltd.)
Task: {49D324DC-C170-41BA-A9FE-29AB6185D368} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2016-11-23] (Microsoft Corporation)
Task: {4BD39ABF-CD59-4689-8A96-9D3075E58E72} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {57759F43-E8BD-403C-B4E9-04221655B39B} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {5AD5A731-ACC5-4A85-BB0E-E14B5EB5BC40} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {64AAAF77-2283-490B-A64A-FA5F7C4BC0DE} - System32\Tasks\Recovery Management\Burn Notification => C:\Program Files\Acer\Acer eRecovery Management\NotificationCenter\Notification.exe [2009-07-10] (Acer)
Task: {6601D78C-E2BA-475F-A625-6A4CFD4DD470} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\WINDOWS\ehome\ehrec.exe
Task: {7DE9E188-85DC-4372-A019-0FD548E04907} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\WINDOWS\ehome\ehrec.exe
Task: {806FABEF-ECCE-4DB5-81BE-C56D648F5466} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {876B424C-AB44-433A-8C1F-D83FB8F1331E} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\WINDOWS\SysWoW64\Macromed\Flash\FlashUtil32_23_0_0_207_pepper.exe [2016-12-02] (Adobe Systems Incorporated)
Task: {8951E175-2CFB-4385-AED6-C503308B4852} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {8B3EDE07-409A-4578-962A-7B68D3E4CDFC} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {8E0CF9E7-08BC-4F5F-97CC-A1B32032561F} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {8E3CC729-4E96-490A-B927-16B4ABDCEA5A} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2016-03-21] (Safer-Networking Ltd.)
Task: {904486BF-59C1-4236-900C-079FC2BE8051} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {9646E692-C19C-46BF-8D5A-3BAF46F7B27D} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-10-21] (Adobe Systems Incorporated)
Task: {9849B8C7-8F74-4D4D-A8A4-74E814A05DE7} - System32\Tasks\avastBCLRestartS-1-5-21-4116000945-235673462-3313673197-1000 => Chrome.exe
Task: {9B206781-8799-47F6-AFED-FE4F4788E851} - System32\Tasks\{BB110E67-98B9-4BBA-A79C-13A8C150DB91} => Firefox.exe
Task: {A0EFBC9D-4493-45EA-91F2-FADF220EEE2B} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\WINDOWS\ehome\mcupdate.exe
Task: {A37AB1E6-5D39-44DF-89F0-E331B58C68A8} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-31] (Google Inc.)
Task: {AA191788-5067-4364-8E02-D592A650CB85} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {AB7F661F-4B3B-403F-BD46-B7B14F74B4AD} - System32\Tasks\{BB7CBED7-C704-4865-80F9-D7034E5EB1CE} => pcalua.exe -a C:\Users\Nigel\AppData\Roaming\webssearches\UninstallManager.exe -c -ptid=slbnew <==== ATTENTION
Task: {AB8D459A-9DF3-4165-8B86-405730A3E3AF} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {ABD943F4-1266-443F-BF02-653F006F58C1} - \{5E281035-07E3-4953-9823-2E84881987F6} -> No File <==== ATTENTION
Task: {B49D5260-6EB7-4231-99E3-869BE5A8FD7E} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2015-06-16] (Safer-Networking Ltd.)
Task: {B6F5E4F0-B8F9-44BB-BD67-0478C4EB57C5} - \{02776CF1-FDD5-44F5-8243-916C10FDFA96} -> No File <==== ATTENTION
Task: {BCB89F73-A162-4BB0-8AC8-D72E9CABBC09} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-12-02] (Adobe Systems Incorporated)
Task: {C158FFE0-D94D-4701-823E-597676B40860} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {C4A9CC96-9392-44B1-9585-987DA1BA6EAE} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {CDE97BA4-71B7-42DC-84CD-0C0BA144AB96} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {D03A3632-7F4C-44FE-ACBD-F9FD15CBE069} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4116000945-235673462-3313673197-1000Core => C:\Users\Nigel\AppData\Local\Google\Update\GoogleUpdate.exe [2016-09-11] (Google Inc.)
Task: {D0FD3BCE-A299-411E-A85E-1A19F66E216B} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {D790A0D6-F182-4B61-867F-52C033DE4BB2} - System32\Tasks\{F461A16A-7BA2-4D69-A610-19EB24634E71} => pcalua.exe -a "C:\Users\Nigel\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K7GZ4M1E\AdobeAIRInstaller.exe" -d C:\Users\Nigel\Desktop
Task: {DC233075-1CF9-4946-9E15-2E240EBF50F1} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {DEDED0B7-06E5-4744-B1E9-078BC5FEC328} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {E33473C9-4870-4013-BE3E-6C5A0F72E8E9} - \{2413066B-5A68-422E-B866-0F489CA77B20} -> No File <==== ATTENTION
Task: {E6EBA970-2BB1-4617-9C99-18D11502BADF} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-31] (Google Inc.)
Task: {E8A98060-3BD9-4DB3-BD94-E087B74AE633} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2016-09-11] (AVAST Software)
Task: {EE0EBC6F-4E44-49CC-A1FE-89A2B2C21B68} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {F6B6409E-DB2D-481D-94C0-8E9B48E315BA} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {FADB0856-9332-4BEE-83E4-90BEEF2FA6C9} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {FC449D2B-AB91-463F-925F-EB33227FBD07} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {FD404129-1E1B-493F-9589-55905E70BD7B} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\WINDOWS\ehome\ehPrivJob.exe

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job => C:\WINDOWS\SysWoW64\Macromed\Flash\FlashUtil32_23_0_0_207_pepper.exe
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-4116000945-235673462-3313673197-1000Core.job => C:\Users\Nigel\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-4116000945-235673462-3313673197-1000UA.job => C:\Users\Nigel\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

ShortcutWithArgument: C:\Users\Public\Desktop\Telstra USB+Wi-Fi.lnk -> C:\Program Files (x86)\Hostless Modem\Telstra USB+Wi-Fi\LaunchWebUI.exe () -> hxxp://m.home

==================== Loaded Modules (Whitelisted) ==============

2016-07-16 21:42 - 2016-07-16 21:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-10-05 16:40 - 2016-10-05 16:40 - 02681200 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2016-10-05 16:40 - 2016-10-05 16:40 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2016-10-05 16:40 - 2016-10-05 16:40 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll
2016-12-08 21:18 - 2016-12-08 21:18 - 00152944 _____ () C:\Program Files (x86)\Zemana AntiMalware\ZAMShellExt64.dll
2016-10-05 16:41 - 2016-10-05 16:41 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2016-11-20 20:43 - 2016-11-02 20:30 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2016-11-20 20:42 - 2016-11-02 20:21 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2016-11-20 20:42 - 2016-11-02 20:15 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2016-11-20 20:41 - 2016-11-02 20:14 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2016-11-20 20:42 - 2016-11-02 20:15 - 01033216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2016-11-20 20:42 - 2016-11-02 20:16 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2016-11-20 20:42 - 2016-11-02 20:17 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2012-06-29 09:36 - 2012-06-29 09:35 - 00200704 _____ () C:\Windows\PLFSetI.exe
2013-06-12 14:44 - 2012-09-21 00:16 - 00442696 _____ () C:\Program Files (x86)\Hostless Modem\Telstra USB+Wi-Fi\CheckNDISPort_df.exe
2016-11-25 11:12 - 2016-11-25 11:23 - 00072192 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.9.261.0_x64__kzf8qxf38zg5c\SkypeHost.exe
2016-11-25 11:12 - 2016-11-25 11:23 - 00178688 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.9.261.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll
2016-11-25 11:12 - 2016-11-25 11:23 - 41609728 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.9.261.0_x64__kzf8qxf38zg5c\SkyWrap.dll
2016-09-11 17:43 - 2016-09-11 17:43 - 00169064 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2016-09-11 17:43 - 2016-09-11 17:43 - 00482928 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2016-12-07 10:18 - 2016-12-07 10:18 - 03067392 _____ () C:\Program Files\AVAST Software\Avast\defs\16120600\algo.dll
2016-12-10 10:25 - 2016-12-10 10:25 - 03067904 _____ () C:\Program Files\AVAST Software\Avast\defs\16120901\algo.dll
2012-08-27 21:33 - 2012-08-27 21:33 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2012-08-27 21:33 - 2012-08-27 21:33 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2015-08-07 21:35 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-08-07 21:35 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2016-01-30 16:57 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2016-01-30 16:57 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2016-04-09 08:35 - 2016-04-09 08:35 - 03481600 _____ () C:\Users\Nigel\AppData\Local\Programs\Google\Google Photos Backup\gpuploader_i18n.dll
2016-06-27 21:02 - 2016-06-27 21:02 - 48936448 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:1D32EC29 [129]
AlternateDataStreams: C:\ProgramData\Temp:373E1720 [118]
AlternateDataStreams: C:\ProgramData\Temp:93DE1838 [133]
AlternateDataStreams: C:\Users\Nigel\AppData\Roaming\Microsoft\Windows\Start Menu\ninemsn Homepage - Hotmail, Messenger, News, Sport & More.website

ESTICON_favicon-1545051169 [8574]
AlternateDataStreams: C:\Users\Nigel\AppData\Roaming\Microsoft\Windows\Start Menu\ninemsn Homepage - Hotmail, Messenger, News, Sport & More.website

ESTICON_favicon-2129689956 [8574]
AlternateDataStreams: C:\Users\Nigel\AppData\Roaming\Microsoft\Windows\Start Menu\ninemsn Homepage - Hotmail, Messenger, News, Sport & More.website

ESTICON_favicon-309781297 [8574]
AlternateDataStreams: C:\Users\Nigel\AppData\Roaming\Microsoft\Windows\Start Menu\ninemsn Homepage - Hotmail, Messenger, News, Sport & More.website

ESTICON_favicon-571293185 [8574]
AlternateDataStreams: C:\Users\Nigel\AppData\Roaming\Microsoft\Windows\Start Menu\ninemsn Homepage - Hotmail, Messenger, News, Sport & More.website

ESTICON_favicon730968612 [8574]
AlternateDataStreams: C:\Users\Nigel\AppData\Roaming\Microsoft\Windows\Start Menu\ninemsn Homepage - Outlook.com, News, Sport & More.website

ESTICON_favicon-1545051169 [8574]
AlternateDataStreams: C:\Users\Nigel\AppData\Roaming\Microsoft\Windows\Start Menu\ninemsn Homepage - Outlook.com, News, Sport & More.website

ESTICON_favicon-2129689956 [8574]
AlternateDataStreams: C:\Users\Nigel\AppData\Roaming\Microsoft\Windows\Start Menu\ninemsn Homepage - Outlook.com, News, Sport & More.website

ESTICON_favicon-309781297 [8574]
AlternateDataStreams: C:\Users\Nigel\AppData\Roaming\Microsoft\Windows\Start Menu\ninemsn Homepage - Outlook.com, News, Sport & More.website

ESTICON_favicon-571293185 [8574]
AlternateDataStreams: C:\Users\Nigel\AppData\Roaming\Microsoft\Windows\Start Menu\ninemsn Homepage - Outlook.com, News, Sport & More.website

ESTICON_favicon730968612 [8574]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com
IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com
IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com
IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com
IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com
IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com
IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com
IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com

There are 7916 more sites.

IE trusted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\hola.org -> hxxp://hola.org
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\007guard.com -> install.007guard.com
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\008k.com -> www.008k.com
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\00hq.com -> www.00hq.com
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\010402.com -> 010402.com
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\0scan.com -> www.0scan.com
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\1-2005-search.com -> www.1-2005-search.com
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\1-domains-registrations.com -> www.1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\1000gratisproben.com -> www.1000gratisproben.com
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\1001namen.com -> www.1001namen.com
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\100888290cs.com -> mir.100888290cs.com
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\100sexlinks.com -> www.100sexlinks.com
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\10sek.com -> www.10sek.com
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\12-26.net -> user1.12-26.net
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\12-27.net -> user1.12-27.net
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\123fporn.info -> www.123fporn.info
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\123haustiereundmehr.com -> www.123haustiereundmehr.com
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\123moviedownload.com -> www.123moviedownload.com
IE restricted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\123simsen.com -> www.123simsen.com

There are 7917 more sites.

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 12:34 - 2016-12-02 22:18 - 00452572 ____R C:\WINDOWS\system32\Drivers\etc\hosts

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123haustiereundmehr.com
127.0.0.1 123moviedownload.com
127.0.0.1 www.123moviedownload.com

There are 15557 more lines.

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-4116000945-235673462-3313673197-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Nigel\AppData\Local\Microsoft\BingDesktop\themes\2016-12-08.jpg
DNS Servers: 61.8.0.113 - 210.23.129.34
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

HKLM\...\StartupApproved\Run: => "HotKeysCmds"
HKLM\...\StartupApproved\Run: => "Persistence"
HKLM\...\StartupApproved\Run: => "IgfxTray"
HKLM\...\StartupApproved\Run: => "Skytel"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [vm-monitoring-nb-session] => LPort=139
FirewallRules: [MSMQ-In-TCP] => %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-TCP] => %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-In-UDP] => %systemroot%\system32\mqsvc.exe
FirewallRules: [MSMQ-Out-UDP] => %systemroot%\system32\mqsvc.exe
FirewallRules: [WCF-NetTcpActivator-In-TCP-64bit] => LPort=808
FirewallRules: [UDP Query User{8F34EEC7-E63E-4B49-B2AF-DC3C67076642}C:\users\nigel\appdata\local\skypeplugin\pluginhost.exe] => C:\users\nigel\appdata\local\skypeplugin\pluginhost.exe
FirewallRules: [TCP Query User{65926A33-230C-4D7E-A28E-269A1867A51F}C:\users\nigel\appdata\local\skypeplugin\pluginhost.exe] => C:\users\nigel\appdata\local\skypeplugin\pluginhost.exe
FirewallRules: [UDP Query User{EC5BC0AB-F029-4B4D-BD66-12D61BB5F3B8}C:\users\nigel\appdata\local\skypeplugin\7.7.0.219\pluginhost.exe] => C:\users\nigel\appdata\local\skypeplugin\7.7.0.219\pluginhost.exe
FirewallRules: [TCP Query User{A5C6454D-A0EE-4569-B882-35595A9453D4}C:\users\nigel\appdata\local\skypeplugin\7.7.0.219\pluginhost.exe] => C:\users\nigel\appdata\local\skypeplugin\7.7.0.219\pluginhost.exe
FirewallRules: [{683B65AB-56E4-447F-B7A8-86D1ED229CEB}] => C:\Program Files (x86)\AVG\Av\avgemca.exe
FirewallRules: [{1F29FF03-6B1D-4660-B61A-ABDAA716BB7D}] => C:\Program Files (x86)\AVG\Av\avgemca.exe
FirewallRules: [{946D736C-B128-4015-95D3-66F39AEDBD3A}] => C:\Program Files (x86)\AVG\Av\avgdiagex.exe
FirewallRules: [{6528F923-5A39-42CB-B01D-B8EC8B795BB9}] => C:\Program Files (x86)\AVG\Av\avgdiagex.exe
FirewallRules: [{9A6F95D4-C45E-454A-A7D8-A88511D43024}] => C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [UDP Query User{02A8529B-F575-4C62-9C46-0B6E748CDB5A}C:\users\nigel\appdata\roaming\macromedia\flash player\www.macromedia.com\bin\octoshape\octoshape.exe] => C:\users\nigel\appdata\roaming\macromedia\flash player\www.macromedia.com\bin\octoshape\octoshape.exe
FirewallRules: [TCP Query User{87833F89-E06B-4147-B61A-D9AE1E20A5B4}C:\users\nigel\appdata\roaming\macromedia\flash player\www.macromedia.com\bin\octoshape\octoshape.exe] => C:\users\nigel\appdata\roaming\macromedia\flash player\www.macromedia.com\bin\octoshape\octoshape.exe
FirewallRules: [{BF7D3625-0E52-48E9-961B-CA77A02910E8}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{54ED9DD8-3F7F-4C5E-8A8B-F1464F7A714E}] => C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{D22D2F2A-F3FA-4555-ACF3-4A58CC5BD5D4}] => C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{DACDEDAE-BDCB-4458-8C56-C21FEEAA3797}] => C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{728C5889-C206-4ED8-9CB2-D23F2907B958}] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe
FirewallRules: [UDP Query User{06933D3E-C1CC-4811-B2FC-8873B7F646AF}C:\program files\internet explorer\iexplore.exe] => C:\program files\internet explorer\iexplore.exe
FirewallRules: [TCP Query User{3BFCEDD6-0786-41E5-AAB8-E816036E418E}C:\program files\internet explorer\iexplore.exe] => C:\program files\internet explorer\iexplore.exe
FirewallRules: [{3185065B-D60C-4CF3-B9B8-51D65AC08DBE}] => svchost.exe
FirewallRules: [{57B97727-0854-464C-97FF-479654710C31}] => C:\Program Files (x86)\Acer\Acer VCM\VC.exe
FirewallRules: [{529A50E4-29EA-4F12-BEBE-ECE64B25EA61}] => C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe
FirewallRules: [{7379F072-F05F-4157-A7F0-C9A787CD3393}] => C:\Program Files (x86)\CyberLink\PowerDVD8\PowerDVD8.EXE
FirewallRules: [{3F33DB1F-0C12-4B32-A76C-F44A380B3672}] => C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{84890AA7-CD24-46E2-A9F3-982316250600}] => LPort=2869
FirewallRules: [{1224F7D3-4CB4-4DA6-BA0F-C8FC9A12AFB0}] => LPort=1900
FirewallRules: [{91F96A73-4A41-4072-8B8F-468AFE5CF17E}] => C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{A4D878C4-5107-4FE7-9980-812A329EC42A}] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{44A92B06-327E-4296-80D1-3F7F6DE4A6B4}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{FF53FEC6-39F5-4F55-ADBB-3FF25A70A365}] => C:\Program Files (x86)\Mozilla Firefox\firefox.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service

==================== Restore Points =========================

20-11-2016 20:49:18 Windows Update
23-11-2016 22:10:14 Windows Update

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (12/09/2016 11:53:35 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 15484

Error: (12/09/2016 11:53:35 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 15484

Error: (12/09/2016 11:53:35 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (12/09/2016 10:28:18 AM) (Source: Windows Search Service) (EventID: 3104) (User: )
Description: Enumerating user sessions to generate filter pools failed.

Details:
(HRESULT : 0x80040210) (0x80040210)

Error: (12/09/2016 10:28:02 AM) (Source: Windows Search Service) (EventID: 3104) (User: )
Description: Enumerating user sessions to generate filter pools failed.

Details:
(HRESULT : 0x80040210) (0x80040210)

Error: (12/09/2016 10:28:02 AM) (Source: Windows Search Service) (EventID: 3104) (User: )
Description: Enumerating user sessions to generate filter pools failed.

Details:
(HRESULT : 0x80040210) (0x80040210)

Error: (12/09/2016 09:52:50 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 15625

Error: (12/09/2016 09:52:50 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 15625

Error: (12/09/2016 09:52:50 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (12/09/2016 09:11:44 AM) (Source: SideBySide) (EventID: 9) (User: )
Description: Activation context generation failed for "c:\program files (x86)\spybot - search & destroy 2\Tools.dll".Error in manifest or policy file "c:\program files (x86)\spybot - search & destroy 2\Tools.dll" on line 2.
The manifest file root element must be assembly.

System errors:
=============
Error: (12/10/2016 10:20:19 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (12/10/2016 10:20:19 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (12/10/2016 10:20:16 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
and APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (12/09/2016 10:29:03 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (12/09/2016 10:29:03 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (12/09/2016 10:29:03 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
and APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (12/09/2016 09:07:52 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (12/09/2016 09:07:52 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
and APPID
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
to the user NT AUTHORITY\LOCAL SERVICE SID (S-1-5-19) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (12/09/2016 09:07:50 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
and APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

Error: (12/09/2016 09:05:34 AM) (Source: Tcpip) (EventID: 4199) (User: )
Description: The system detected an address conflict for IP address 192.168.0.2 with the system
having network hardware address A8-A7-95-8E-C1-91. Network operations on this system may
be disrupted as a result.

==================== Memory info ===========================

Processor: Genuine Intel(R) CPU U4100 @ 1.30GHz
Percentage of memory in use: 80%
Total physical RAM: 1978.91 MB
Available physical RAM: 381 MB
Total Virtual: 3962.91 MB
Available Virtual: 1655.95 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:220.79 GB) (Free:106.42 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: E4578272)
Partition 1: (Not Active) - (Size=12 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=220.8 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

Bobby06 · Dec 10, 2016

Hi Juliet just to touch base with you the last report was FRST scans for my Laptop, I ran DELFIX as suggested by you on my Desktop to get rid of all the downloads and manually deleted what was left so the Desktop is all good Well done!. What was your opinion of the Laptops first FRST scans?

Juliet · Dec 10, 2016

Bobby06 said:
Hi Juliet just to touch base with you the last report was FRST scans for my Laptop, I ran DELFIX as suggested by you on my Desktop to get rid of all the downloads and manually deleted what was left so the Desktop is all good Well done!. What was your opinion of the Laptops first FRST scans?

So far it appears to be more of a tidy-up, since some tools were run and I do not see the logs from those scans I have no idea what was removed.

Can you give me information as to what this might be?
C:\ProgramData\Puohxiilsri\1.0.4.1\hanuxlin.exe

~~~

Running from C:\Users\Nigel\Downloads

It's best we move Farbar's to desktop.

Please go to your downloads folder, locate Farbar Recovery Scan Tool, right click and select CUT
Go to an open spot on your desktop, right click and select PASTE
You should now have Farbar Recovery Scan Tool on your desktop.

Please open Notepad *Do Not Use Wordpad!* or use any other text editor than Notepad or the script will fail. (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the quote box below:
To do this highlight the contents of the box and right click on it and select copy.
Paste this into the open notepad. save it to the Desktop as fixlist.txt
NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.
It needs to be saved Next to the "Farbar Recovery Scan Tool" (If asked to overwrite existing one please allow)

start
CreateRestorePoint:
CloseProcesses:
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => No File
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => No File
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
SearchScopes: HKLM-x32 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
BHO: Expat Shield Class -> {3706EE7C-3CAD-445D-8A43-03EBC3B75908} -> No File
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Toolbar: HKU\S-1-5-21-4116000945-235673462-3313673197-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKU\S-1-5-21-4116000945-235673462-3313673197-1000 -> No Name - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - No File
FF Extension: (No Name) - C:\Program Files (x86)\TomTom HOME 2\xul\extensions\MapShare-status@tomtom.com [not found]
CHR HKU\S-1-5-21-4116000945-235673462-3313673197-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Nigel\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx <not found>
C:\ProgramData\fontcacheev1.dat
Task: {0AD379C5-5504-43E6-A142-8F50E0E3D24C} - System32\Tasks\{4BE954A3-3C41-4AB0-AC89-E19A30EB9F15} => pcalua.exe -a "C:\Program Files\Hola\app\hola_setup.exe" -c --remove-hola --no-rmt-conf --hola-cr
Task: {0F0DC27D-9F40-4E52-8BF2-2AA4C8A4BDAD} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {1383606C-BC21-4B80-98A7-C5E01E568454} - \{49E65517-C6FF-4662-926A-722036CEACED} -> No File <==== ATTENTION
Task: {17B7ADFC-F0C7-4A13-A09F-26840081CD9A} - System32\Tasks\{FCA8B98D-7B6E-4847-AA86-EAD1A463EB8F} => pcalua.exe -a "C:\Program Files\Hola\app\hola_setup.exe" -c --remove-hola --no-rmt-conf --hola-cr
Task: {1DB3DD4E-A51F-4B7C-98D8-31843575334C} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {2C08F93E-4D64-4926-9F70-779510E5F131} - \{3BCAB8DD-A9A8-467A-9DF8-252117296EF5} -> No File <==== ATTENTION
Task: {3C9B9881-3C6A-4575-A3FB-5ABCF44C3A4B} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {57759F43-E8BD-403C-B4E9-04221655B39B} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {5AD5A731-ACC5-4A85-BB0E-E14B5EB5BC40} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {8951E175-2CFB-4385-AED6-C503308B4852} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {8B3EDE07-409A-4578-962A-7B68D3E4CDFC} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {AA191788-5067-4364-8E02-D592A650CB85} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {AB7F661F-4B3B-403F-BD46-B7B14F74B4AD} - System32\Tasks\{BB7CBED7-C704-4865-80F9-D7034E5EB1CE} => pcalua.exe -a C:\Users\Nigel\AppData\Roaming\webssearches\UninstallManager.exe -c -ptid=slbnew <==== ATTENTION
Task: {AB8D459A-9DF3-4165-8B86-405730A3E3AF} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {ABD943F4-1266-443F-BF02-653F006F58C1} - \{5E281035-07E3-4953-9823-2E84881987F6} -> No File <==== ATTENTION
Task: {B6F5E4F0-B8F9-44BB-BD67-0478C4EB57C5} - \{02776CF1-FDD5-44F5-8243-916C10FDFA96} -> No File <==== ATTENTION
Task: {E33473C9-4870-4013-BE3E-6C5A0F72E8E9} - \{2413066B-5A68-422E-B866-0F489CA77B20} -> No File <==== ATTENTION
Task: {EE0EBC6F-4E44-49CC-A1FE-89A2B2C21B68} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {FC449D2B-AB91-463F-925F-EB33227FBD07} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
ShortcutWithArgument: C:\Users\Public\Desktop\Telstra USB+Wi-Fi.lnk -> C:\Program Files (x86)\Hostless Modem\Telstra USB+Wi-Fi\LaunchWebUI.exe () -> hxxp://m.home
AlternateDataStreams: C:\ProgramData\Temp:1D32EC29 [129]
AlternateDataStreams: C:\ProgramData\Temp:373E1720 [118]
AlternateDataStreams: C:\ProgramData\Temp:93DE1838 [133]
IE trusted site: HKU\S-1-5-21-4116000945-235673462-3313673197-1000\...\hola.org -> hxxp://hola.org
EmptyTemp:
Hosts:
End

Open FRST/FRST64 and press the > Fix < button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

~~~~~~~~~~~~~~~

AdwCleaner

Please download AdwCleaner and save the file to your Desktop.
In order to use AdwCleaner, you have to agree the Eula:
Right-click AdwCleaner.exe and select

Run as administrator to run the programme.
Follow the prompts.
Click

Scan.
Upon completion, click

Logfile. A log (AdwCleaner[S1].txt) will open. Briefly check the log for anything you know to be legitimate.
Return to AdwCleaner. Ensure anything you know to be legitimate does not have a checkmark under the corresponding tab.
Click

Clean.
Follow the prompts and allow your computer to reboot.
After the reboot, a log (AdwCleaner[C1].txt) will open. Copy the contents of the log and paste in your next reply.

-- File and folder backups are made for items removed using this programme. Should a legitimate file or folder be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the item. Please do not overly concern yourself with the contents of AdwCleaner[C1].txt.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Please download Junkware Removal Tool
or from here http://downloads.malwarebytes.org/file/jrt
to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

~~~
please post
Fixlog.txt
AdwCleaner[C1].txt
JRT.txt

Bobby06 · Dec 11, 2016

Hi Juliet I have no idea what C:\ProgramData\Puohxiilsri\1.0.4.1\hanuxlin.exe is and google is no help either. Now for the FRST scans I have them on desktop I managed to make fixlist.txt which I found in Documents and have made shortcut to desktop , but I'm lost on how to "Fix" you mention a quote box but I'm sorry I dont understand what you mean?. Sorry

Removal of s.yimg.com

New member

Security Expert-emeritus

New member

New member

Security Expert-emeritus

New member

Security Expert-emeritus

New member

Security Expert-emeritus

New member

Security Expert-emeritus

New member

Security Expert-emeritus

New member

New member

Security Expert-emeritus

New member

New member

Security Expert-emeritus

New member